scalix 1.5.1 → 1.6.0

package/dist/cli.js

@@ -15,21 +15,26 @@ import SelectInput from 'ink-select-input';
 import { createAgent, messageContentToString, REPORTED_ERROR } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
+import { memoryTools } from './tools-memory.js';
 import { webTools } from './tools-web.js';
 import { advancedTools } from './tools-advanced.js';
 import { visionTools } from './tools-vision.js';
 import { voiceTools } from './tools-voice.js';
 import { browserTools, closeBrowser } from './tools-browser.js';
-import { loadMcpServices } from './mcp.js';
+import { startMcp, validateMcpUrl } from './mcp.js';
 import { renderMarkdown } from './markdown.js';
 import { costTracker } from './cost-tracker.js';
 import { saveSession, listSessions, loadSession, generateSessionId, saveCrashState, loadCrashState, clearCrashState, forkSession } from './sessions.js';
+import { saveFeedback } from './feedback.js';
 import { logger } from './logger.js';
-import { VERSION, PRODUCT_NAME, DEFAULT_MODELS, DEFAULT_BASE_URL, DEFAULT_INSTRUCTIONS, ENV_API_KEY, ENV_MODEL, TOOL_DEFAULTS, HEADLESS_DEFAULTS, GIT_BOT_IDENTITY, BYOK_DEFAULT_CONTEXT_TOKENS, BYOK_DEFAULT_MAX_OUTPUT_TOKENS, USER_CONFIG_DIR, getModelContextWindow, fetchModelSpecs, normalizeModelId, registerUserModels, hasExplicitModelSpec } from './constants.js';
+import { VERSION, PRODUCT_NAME, DEFAULT_MODELS, DEFAULT_BASE_URL, DEFAULT_INSTRUCTIONS, ENV_API_KEY, ENV_MODEL, TOOL_DEFAULTS, HEADLESS_DEFAULTS, GIT_BOT_IDENTITY, BYOK_DEFAULT_CONTEXT_TOKENS, BYOK_DEFAULT_MAX_OUTPUT_TOKENS, USER_CONFIG_DIR, OPENROUTER_BASE_URL, getModelContextWindow, fetchModelSpecs, normalizeModelId, registerUserModels, hasExplicitModelSpec } from './constants.js';
+import { buildAuthUrl, exchangeCodeForKey, generatePkcePair, openInBrowser, startLoopbackCallback } from './openrouter-oauth.js';
 import { checkForUpdate, getUpdateBanner, performUpdate } from './update-checker.js';
 import { loadConfig, loadGlobalConfig, saveConfig, isConfigured, resolveActiveProvider, DEFAULT_LIMITS, THINKING_MODES } from './settings.js';
 import { fetchByokModels } from './providers/openai.js';
 import { getModeDescription, PERMISSION_MODES, setSandboxRoot, checkScopedPermission, getScopedPermissionRules } from './sandbox.js';
+import { getCommandSandboxMode, setCommandSandboxMode } from './tools.js';
+import { COMMAND_SANDBOX_MODES } from './command-sandbox.js';
 import { buildProjectIndex, indexToContext } from './project-index.js';
 import { collectGitInfo, gitInfoToContext } from './git-context.js';
 import { loadMemory, autoDetectConventions, saveMemory, memoryToContext, addNote, detectCorrection } from './project-memory.js';
@@ -47,7 +52,9 @@ import { createWorktree, listWorktrees, removeWorktree, cleanupStaleWorktrees }
 import { sendNotification, getTerminalType } from './terminal-notify.js';
 import { stringWidth, truncateText } from './text-utils.js';
 import { isWorkspaceTrusted, trustWorkspace, hasProjectExecSurface } from './workspace-trust.js';
+import { setLocalOriginApprover } from './browser-access.js';
 import { fetchMe, fetchCloudTools, groupCloudTools, filterCatalogByScopes, cloudKeyRemedy, CONSOLE_KEYS_URL } from './cloud.js';
+import { listMarketplaceListings, getMarketplaceListing, installMarketplaceListing } from './marketplace.js';
 logger.setLevel('silent');
 // Promisified async child_process helpers (keep the TUI responsive vs execSync).
 const execFileAsync = promisify(execFile);
@@ -86,7 +93,7 @@ setSandboxRoot(process.cwd());
 // Suppress noisy React 19 development-mode reconciler warnings that leak to stderr
 const _origConsoleError = console.error;
 console.error = (...args) => {
-    if (typeof args[0] === 'string' && args[0].startsWith('Warning:') && args[0].includes('same key'))
+    if (args.length === 1 && typeof args[0] === 'string' && args[0].includes('same key'))
         return;
     _origConsoleError(...args);
 };
@@ -95,14 +102,12 @@ console.error = (...args) => {
 // sanitizeInput) and buffer the pasted content into the input value instead of
 // treating each embedded newline as a separate Enter (which caused many submits).
 process.stdout.write('\x1b[?2004h');
-// User-registered external MCP servers (mcp-services.json). These are
-// decorative config entries only — they are filtered out of API requests by
-// transformToolsForApi. Scalix Cloud platform tools do NOT use this path: they
-// are fetched from the account's catalog and registered as first-class
-// function tools via agent.refreshCloudTools() (see connectCloud below).
-const mcpTools = loadMcpServices();
+// User-registered external MCP servers (mcp-services.json) are not in this
+// list: they are connected once the agent exists and registered from the live
+// connection by startMcp(), the same way Scalix Cloud platform tools arrive via
+// agent.refreshCloudTools() (see connectCloud below).
 let pluginTools = [];
-const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools];
+const allTools = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools];
 // ─── Confirmation bridge (event-driven) ───
 import { EventEmitter } from 'node:events';
 const confirmEmitter = new EventEmitter();
@@ -134,6 +139,11 @@ const confirmToolCall = async (toolName, args) => {
         confirmEmitter.emit('pending');
     });
 };
+// The browser tools refuse localhost and the LAN until the user says otherwise.
+// In the TUI that question goes through the same confirmation prompt as any
+// other tool call, so "Always allow" covers the rest of the session; a lasting,
+// written-down approval is the IDE's job (it can show and revoke the list).
+setLocalOriginApprover(async ({ origin, url }) => (await confirmToolCall('browser_open_local_address', { origin, url })) ? 'once' : 'deny');
 // ─── Agent (deferred until config is ready) ───
 let baseInstructions = DEFAULT_INSTRUCTIONS;
 let agent = null;
@@ -335,9 +345,13 @@ function initAgent(config) {
     }).catch((err) => {
         logger.warn('Failed to build enhanced instructions', { error: err.message });
     });
-    loadCustomCommands(process.cwd()).then((cmds) => {
-        customCommands = cmds;
-    }).catch((err) => { logger.warn('Failed to load custom commands', { error: err.message }); });
+    // Custom command templates can carry !`cmd` inline-bash, which executes
+    // shell — only load them from a trusted workspace, like plugins/hooks.
+    if (isWorkspaceTrusted(process.cwd())) {
+        loadCustomCommands(process.cwd()).then((cmds) => {
+            customCommands = cmds;
+        }).catch((err) => { logger.warn('Failed to load custom commands', { error: err.message }); });
+    }
     loadSkills(process.cwd()).then((skills) => {
         loadedSkills = skills;
     }).catch((err) => { logger.warn('Failed to load skills', { error: err.message }); });
@@ -560,6 +574,21 @@ function formatContextSize(tokens) {
         return `${(tokens / 1_000).toFixed(tokens % 1_000 === 0 ? 0 : 1)}K`;
     return String(tokens);
 }
+/**
+ * Paste box for the OpenRouter manual fallback: OpenRouter shows a single-use,
+ * 10-minute authorization code when the browser can't reach our loopback
+ * server (SSH/headless) or the user prefers another device.
+ */
+function ManualCodeInput({ onSubmit }) {
+    const [code, setCode] = useState('');
+    return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { dimColor: true, children: "Or paste the single-use code OpenRouter shows after you approve:" }), _jsxs(Box, { children: [_jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u276F', " "] }), _jsx(LongTextInput, { value: code, onChange: setCode, onSubmit: (v) => {
+                            const trimmed = v.trim();
+                            if (trimmed) {
+                                onSubmit(trimmed);
+                                setCode('');
+                            }
+                        }, placeholder: "paste code..." })] })] }));
+}
 /**
  * What to pre-fill the context-window box with.
  *
@@ -577,11 +606,17 @@ function defaultContextTokens(p, existing) {
 }
 function SetupScreen({ onComplete, existingConfig }) {
     const [provider, setProvider] = useState(existingConfig?.provider === 'openai' ? 'openai' : 'scalix');
+    // BYOK sub-flavor: a plain OpenAI-compatible endpoint (manual key + URL) or
+    // the OpenRouter OAuth connect. Both persist identically (providers.openai);
+    // the flavor only decides which steps run between provider and models.
+    const [byokFlavor, setByokFlavor] = useState('endpoint');
     // Scalix = zero-config default; BYOK (OpenAI-compatible) skips the
     // Scalix-only cloud step and enters models manually.
-    const STEPS = provider === 'openai'
-        ? ['provider', 'api-key', 'base-url', 'models', 'context-window']
-        : ['provider', 'api-key', 'base-url', 'cloud', 'models', 'context-window'];
+    const STEPS = provider !== 'openai'
+        ? ['provider', 'api-key', 'base-url', 'cloud', 'models', 'context-window']
+        : byokFlavor === 'openrouter'
+            ? ['provider', 'openrouter-auth', 'models', 'context-window']
+            : ['provider', 'api-key', 'base-url', 'models', 'context-window'];
     const [step, setStep] = useState('provider');
     const [apiKey, setApiKey] = useState(existingConfig?.apiKey || process.env[ENV_API_KEY] || '');
     const [baseUrl, setBaseUrl] = useState(existingConfig?.baseUrl || DEFAULT_BASE_URL);
@@ -605,6 +640,11 @@ function SetupScreen({ onComplete, existingConfig }) {
      *  borrowed default. */
     const [byokContextWindows, setByokContextWindows] = useState({});
     const [cloudCheck, setCloudCheck] = useState({ phase: 'checking' });
+    // ── OpenRouter connect (OAuth PKCE) ─────────────────────────────────────
+    // The PKCE verifier must outlive the effect that created it when the user
+    // falls back to manual code paste, so it lives in a ref.
+    const orPairRef = useRef(null);
+    const [orAuth, setOrAuth] = useState({ phase: 'starting' });
     const { exit } = useApp();
     // Validate the key against Scalix Cloud when the cloud step is entered:
     // /v1/me for identity/plan, then the tool catalog for the unlocked count.
@@ -634,6 +674,80 @@ function SetupScreen({ onComplete, existingConfig }) {
         // apiKey/baseUrl are intentionally not deps: they are frozen once the user
         // advances past base-url, and the step transition is the trigger.
     }, [step]);
+    // Shared tail of BOTH OpenRouter paths (browser callback and manual paste):
+    // persist the exchanged key, point the endpoint at OpenRouter, and rejoin
+    // the ordinary BYOK model-discovery flow exactly as the base-url step does.
+    const finishOpenRouterAuth = useCallback((key) => {
+        setApiKey(key);
+        setApiKeyError(false);
+        setBaseUrl(OPENROUTER_BASE_URL);
+        setBaseUrlError(false);
+        setFetchingModels(true);
+        fetchByokModels(OPENROUTER_BASE_URL, key).then((found) => {
+            setFetchedModels(found.map((m) => ({ id: m.id })));
+            setByokContextWindows(Object.fromEntries(found.filter((m) => m.contextWindow).map((m) => [m.id, m.contextWindow])));
+        }).catch((err) => { logger.warn('Failed to list endpoint models', { error: err.message }); })
+            .finally(() => { setFetchingModels(false); });
+        setStep('models');
+    }, []);
+    // The whole connect lives in one effect keyed on the step: pair → loopback
+    // bind → browser open → await code → exchange. Cleanup closes the server so
+    // a wizard abandoned mid-flow never leaks a socket or a pending promise.
+    useEffect(() => {
+        if (step !== 'openrouter-auth')
+            return;
+        let cancelled = false;
+        let handle = null;
+        setOrAuth({ phase: 'starting' });
+        (async () => {
+            const pair = generatePkcePair();
+            orPairRef.current = pair;
+            handle = await startLoopbackCallback();
+            if (cancelled) {
+                handle.close();
+                return;
+            }
+            const authUrl = buildAuthUrl(handle.url, pair);
+            const autoOpened = await openInBrowser(authUrl);
+            if (!cancelled)
+                setOrAuth({ phase: 'waiting', url: authUrl, autoOpened });
+            try {
+                const code = await handle.code;
+                if (cancelled)
+                    return;
+                setOrAuth({ phase: 'exchanging' });
+                const key = await exchangeCodeForKey(code, pair.verifier);
+                if (!cancelled)
+                    finishOpenRouterAuth(key);
+            }
+            catch (err) {
+                if (!cancelled)
+                    setOrAuth({ phase: 'fail', error: err?.message || String(err), url: authUrl });
+            }
+        })().catch((err) => {
+            // Bind/spawn failure lands here — manual paste remains available.
+            if (!cancelled)
+                setOrAuth({ phase: 'fail', error: err?.message || String(err) });
+        });
+        return () => {
+            cancelled = true;
+            handle?.close();
+        };
+    }, [step, finishOpenRouterAuth]);
+    const submitManualOpenRouterCode = useCallback(async (raw) => {
+        const code = raw.trim();
+        const pair = orPairRef.current;
+        if (!pair || !code)
+            return;
+        setOrAuth({ phase: 'exchanging' });
+        try {
+            const key = await exchangeCodeForKey(code, pair.verifier);
+            finishOpenRouterAuth(key);
+        }
+        catch (err) {
+            setOrAuth({ phase: 'fail', error: err?.message || String(err) });
+        }
+    }, [finishOpenRouterAuth]);
     // The smallest window across the picked models, because compression has to
     // fit the tightest one — a session that fits the 128K model and not the 8K
     // fallback fails the moment it falls back. null when the endpoint reported
@@ -685,32 +799,45 @@ function SetupScreen({ onComplete, existingConfig }) {
             }
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", width: "100%", children: [_jsx(Banner, {}), _jsxs(Box, { flexDirection: "column", paddingX: 3, paddingY: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u2501'.repeat(4), " First-time Setup ", '\u2501'.repeat(4)] }) }), _jsxs(Box, { marginBottom: 1, gap: 1, children: [_jsx(Text, { color: "#20a0a0", children: STEPS.map((_, i) => i < stepNumber ? '\u25CF' : '\u25CB').join('') }), _jsxs(Text, { dimColor: true, children: ["Step ", stepNumber, " of ", totalSteps] })] }), step === 'provider' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Provider" }), _jsx(Text, { dimColor: true, children: "Where should the agent send inference?" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+    return (_jsxs(Box, { flexDirection: "column", width: "100%", children: [_jsx(Banner, {}), _jsxs(Box, { flexDirection: "column", paddingX: 3, paddingY: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u2501'.repeat(4), " First-time Setup ", '\u2501'.repeat(4)] }) }), _jsxs(Box, { marginBottom: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: STEPS.map((_, i) => i < stepNumber ? '\u25CF' : '\u25CB').join('') }), _jsxs(Text, { dimColor: true, children: ["Step ", stepNumber, " of ", totalSteps] })] }), step === 'provider' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Provider" }), _jsx(Text, { dimColor: true, children: "Where should the agent send inference?" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
                                         { label: 'Scalix Cloud (recommended) \u2014 api.scalix.world, platform tools included', value: 'scalix' },
-                                        { label: 'OpenAI-compatible endpoint \u2014 bring your own key (OpenAI, OpenRouter, Ollama, vLLM, ...)', value: 'openai' },
+                                        { label: 'OpenRouter \u2014 connect your account in the browser (400+ models, billed to you)', value: 'openrouter' },
+                                        { label: 'OpenAI-compatible endpoint \u2014 bring your own key (OpenAI, Ollama, vLLM, ...)', value: 'openai' },
                                     ], onSelect: (item) => {
-                                        const p = item.value === 'openai' ? 'openai' : 'scalix';
-                                        setProvider(p);
-                                        if (p === 'openai') {
+                                        if (item.value === 'openrouter') {
+                                            // OpenRouter IS an OpenAI-compatible endpoint under the
+                                            // hood — config plumbing is identical; only the wizard
+                                            // steps differ (key arrives via OAuth, URL is fixed).
+                                            setProvider('openai');
+                                            setByokFlavor('openrouter');
                                             setApiKey(existingConfig?.providers?.openai?.apiKey || '');
-                                            setBaseUrl(existingConfig?.providers?.openai?.baseUrl || '');
+                                            setBaseUrl(existingConfig?.providers?.openai?.baseUrl || OPENROUTER_BASE_URL);
                                         }
                                         else {
-                                            setApiKey(existingConfig?.apiKey || process.env[ENV_API_KEY] || '');
-                                            setBaseUrl(existingConfig?.baseUrl || DEFAULT_BASE_URL);
+                                            const p = item.value === 'openai' ? 'openai' : 'scalix';
+                                            setProvider(p);
+                                            setByokFlavor('endpoint');
+                                            if (p === 'openai') {
+                                                setApiKey(existingConfig?.providers?.openai?.apiKey || '');
+                                                setBaseUrl(existingConfig?.providers?.openai?.baseUrl || '');
+                                            }
+                                            else {
+                                                setApiKey(existingConfig?.apiKey || process.env[ENV_API_KEY] || '');
+                                                setBaseUrl(existingConfig?.baseUrl || DEFAULT_BASE_URL);
+                                            }
                                         }
                                         // Model ids do not transfer between endpoints: keeping the
                                         // configured list after a switch pre-fills the next step with
                                         // ids the new endpoint has never heard of, and the wizard
                                         // finishes "successfully" onto a 404 on the first turn.
-                                        const configured = (existingConfig?.provider === 'openai' ? 'openai' : 'scalix') === p;
+                                        const configured = (existingConfig?.provider === 'openai' ? 'openai' : 'scalix') === (item.value === 'scalix' ? 'scalix' : 'openai');
                                         setModels(configured && existingConfig?.models?.length ? [...existingConfig.models] : []);
                                         setModelsMode('custom');
                                         setFetchedModels([]);
                                         setByokContextWindows({});
-                                        setContextInput(String(defaultContextTokens(p, existingConfig?.limits?.maxContextTokens)));
-                                        setStep('api-key');
-                                    } }) })] })), step === 'api-key' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "API Key" }), _jsx(Text, { dimColor: true, children: provider === 'openai' ? 'The API key for your endpoint. Press Enter to continue.' : 'Paste your Scalix API key (console.scalix.world/org/keys) and press Enter. Use a project-scoped key — the default all-scopes project key unlocks the platform tools.' }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u276F', " "] }), _jsx(LongTextInput, { value: apiKey, onChange: (v) => { setApiKey(v); setApiKeyError(false); }, onSubmit: (v) => {
+                                        setContextInput(String(defaultContextTokens(item.value === 'scalix' ? 'scalix' : 'openai', existingConfig?.limits?.maxContextTokens)));
+                                        setStep(item.value === 'openrouter' ? 'openrouter-auth' : item.value === 'openai' ? 'api-key' : 'api-key');
+                                    } }) })] })), step === 'api-key' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "API Key" }), _jsx(Text, { dimColor: true, children: provider === 'openai' ? 'The API key for your endpoint. Press Enter to continue.' : 'Paste your Scalix API key (console.scalix.world/org/keys) and press Enter. Use a project-scoped key — the default all-scopes project key unlocks the platform tools.' }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u276F', " "] }), _jsx(LongTextInput, { value: apiKey, onChange: (v) => { setApiKey(v); setApiKeyError(false); }, onSubmit: (v) => {
                                             const cleaned = v.trim();
                                             if (cleaned) {
                                                 setApiKey(cleaned);
@@ -719,7 +846,22 @@ function SetupScreen({ onComplete, existingConfig }) {
                                             else {
                                                 setApiKeyError(true);
                                             }
-                                        }, placeholder: provider === 'openai' ? 'sk-...' : 'scalix_sk_...' })] }), apiKeyError && (_jsx(Box, { marginTop: 0, paddingLeft: 2, children: _jsx(Text, { color: "yellow", dimColor: true, children: "API key is required." }) }))] })), step === 'base-url' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: provider === 'openai' ? 'Endpoint URL' : 'Base URL' }), _jsx(Text, { dimColor: true, children: provider === 'openai' ? 'Your OpenAI-compatible endpoint root, with or without /v1 (required).' : 'Scalix API endpoint (or your self-hosted gateway)' }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: baseUrl, onChange: (v) => { setBaseUrl(sanitizeInput(v)); setBaseUrlError(false); }, onSubmit: (v) => {
+                                        }, placeholder: provider === 'openai' ? 'sk-...' : 'scalix_sk_...' })] }), apiKeyError && (_jsx(Box, { marginTop: 0, paddingLeft: 2, children: _jsx(Text, { color: "yellow", dimColor: true, children: "API key is required." }) }))] })), step === 'openrouter-auth' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Connect OpenRouter" }), _jsx(Text, { dimColor: true, children: "Sign in to YOUR OpenRouter account \u2014 models are billed to you, not to Scalix." }), orAuth.phase === 'starting' && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Starting the connection..." })] })), orAuth.phase === 'waiting' && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { children: orAuth.autoOpened
+                                            ? 'Your browser should have opened. Approve access there.'
+                                            : 'Could not open a browser here — open the URL below on any device:' }), _jsx(Box, { marginTop: 1, flexDirection: "column", borderStyle: "round", borderColor: "#06B6D4", paddingX: 2, alignSelf: "flex-start", children: _jsx(Text, { color: "#06B6D4", children: orAuth.url }) }), !orAuth.autoOpened && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "The page shows a code \u2014 paste it below when it does." }) })), _jsx(ManualCodeInput, { onSubmit: (code) => { void submitManualOpenRouterCode(code); } })] })), orAuth.phase === 'exchanging' && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Exchanging the authorization for your API key..." })] })), orAuth.phase === 'fail' && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: "red", children: ['✘', " ", orAuth.error] }), orAuth.url && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "You can also open this URL manually and paste the shown code:" }) }), _jsx(Box, { marginTop: 1, flexDirection: "column", borderStyle: "round", borderColor: "#06B6D4", paddingX: 2, alignSelf: "flex-start", children: _jsx(Text, { color: "#06B6D4", children: orAuth.url }) }), _jsx(ManualCodeInput, { onSubmit: (code) => { void submitManualOpenRouterCode(code); } })] })), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+                                                { label: '↻ Retry the browser flow', value: '__retry__' },
+                                                ...(existingConfig ? [{ label: 'Back', value: '__back__' }] : []),
+                                            ], onSelect: (item) => {
+                                                if (item.value === '__retry__') {
+                                                    // Remount the effect: fresh pair, fresh loopback port.
+                                                    setOrAuth({ phase: 'starting' });
+                                                    setStep('provider');
+                                                    setTimeout(() => setStep('openrouter-auth'), 0);
+                                                }
+                                                else {
+                                                    setStep('provider');
+                                                }
+                                            } }) })] }))] })), step === 'base-url' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: provider === 'openai' ? 'Endpoint URL' : 'Base URL' }), _jsx(Text, { dimColor: true, children: provider === 'openai' ? 'Your OpenAI-compatible endpoint root, with or without /v1 (required).' : 'Scalix API endpoint (or your self-hosted gateway)' }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: baseUrl, onChange: (v) => { setBaseUrl(sanitizeInput(v)); setBaseUrlError(false); }, onSubmit: (v) => {
                                             const typed = sanitizeInput(v).trim();
                                             if (provider === 'openai') {
                                                 // BYOK has no default third-party URL \u2014 the endpoint is required.
@@ -760,7 +902,7 @@ function SetupScreen({ onComplete, existingConfig }) {
                                                 setFetchingModels(false);
                                             });
                                             setStep('cloud');
-                                        }, placeholder: provider === 'openai' ? 'e.g. http://localhost:11434/v1' : DEFAULT_BASE_URL })] }), baseUrlError && (_jsx(Box, { marginTop: 0, paddingLeft: 2, children: _jsx(Text, { color: "yellow", dimColor: true, children: "An endpoint URL is required for a BYOK provider." }) })), fetchingModels && (_jsx(Box, { paddingLeft: 2, marginTop: 1, children: _jsx(Text, { color: "#20a0a0", dimColor: true, children: "Fetching available models..." }) }))] })), step === 'cloud' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Scalix Cloud" }), cloudCheck.phase === 'checking' && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#20a0a0", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Validating your API key with Scalix Cloud..." })] })), cloudCheck.phase === 'ok' && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "#30c090", paddingX: 2, marginTop: 1, alignSelf: "flex-start", children: [_jsxs(Text, { color: "#30c090", bold: true, children: ['✓', " Connected to Scalix Cloud"] }), _jsxs(Text, { children: ["Org:        ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.identity.orgId })] }), _jsxs(Text, { children: ["Project:    ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.identity.projectId || 'org-wide' })] }), _jsxs(Text, { children: ["Plan:       ", _jsx(Text, { color: "#20a0a0", children: cloudCheck.identity.limits.plan })] }), _jsxs(Text, { children: ["Rate limit: ", _jsxs(Text, { color: "#20a0a0", children: [cloudCheck.identity.limits.rateLimitRps, " req/s"] })] }), _jsxs(Text, { color: "#30c090", bold: true, children: ['●', " ", cloudCheck.toolCount, " platform tools unlocked"] })] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [{ label: '→ Continue', value: '__continue__' }], onSelect: () => setStep('models') }) })] })), cloudCheck.phase === 'fail' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ['✘', " ", cloudCheck.error] }) }), cloudCheck.remedy && (_jsx(Text, { dimColor: true, children: cloudCheck.remedy })), !cloudCheck.remedy && !cloudCheck.error.includes(CONSOLE_KEYS_URL) && (_jsxs(Text, { dimColor: true, children: ["Create or check your key at ", CONSOLE_KEYS_URL] })), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
+                                        }, placeholder: provider === 'openai' ? 'e.g. http://localhost:11434/v1' : DEFAULT_BASE_URL })] }), baseUrlError && (_jsx(Box, { marginTop: 0, paddingLeft: 2, children: _jsx(Text, { color: "yellow", dimColor: true, children: "An endpoint URL is required for a BYOK provider." }) })), fetchingModels && (_jsx(Box, { paddingLeft: 2, marginTop: 1, children: _jsx(Text, { color: "#06B6D4", dimColor: true, children: "Fetching available models..." }) }))] })), step === 'cloud' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Scalix Cloud" }), cloudCheck.phase === 'checking' && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Validating your API key with Scalix Cloud..." })] })), cloudCheck.phase === 'ok' && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "#22C55E", paddingX: 2, marginTop: 1, alignSelf: "flex-start", children: [_jsxs(Text, { color: "#22C55E", bold: true, children: ['✓', " Connected to Scalix Cloud"] }), _jsxs(Text, { children: ["Org:        ", _jsx(Text, { color: "#06B6D4", children: cloudCheck.identity.identity.orgId })] }), _jsxs(Text, { children: ["Project:    ", _jsx(Text, { color: "#06B6D4", children: cloudCheck.identity.identity.projectId || 'org-wide' })] }), _jsxs(Text, { children: ["Plan:       ", _jsx(Text, { color: "#06B6D4", children: cloudCheck.identity.limits.plan })] }), _jsxs(Text, { children: ["Rate limit: ", _jsxs(Text, { color: "#06B6D4", children: [cloudCheck.identity.limits.rateLimitRps, " req/s"] })] }), _jsxs(Text, { color: "#22C55E", bold: true, children: ['●', " ", cloudCheck.toolCount, " platform tools unlocked"] })] }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [{ label: '→ Continue', value: '__continue__' }], onSelect: () => setStep('models') }) })] })), cloudCheck.phase === 'fail' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "red", children: ['✘', " ", cloudCheck.error] }) }), cloudCheck.remedy && (_jsx(Text, { dimColor: true, children: cloudCheck.remedy })), !cloudCheck.remedy && !cloudCheck.error.includes(CONSOLE_KEYS_URL) && (_jsxs(Text, { dimColor: true, children: ["Create or check your key at ", CONSOLE_KEYS_URL] })), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: [
                                                 { label: 'Re-enter API key', value: '__reenter__' },
                                                 { label: 'Skip — continue without Scalix Cloud (local tools only)', value: '__skip__' },
                                             ], onSelect: (item) => {
@@ -770,7 +912,7 @@ function SetupScreen({ onComplete, existingConfig }) {
                                                 else {
                                                     setStep('models');
                                                 }
-                                            } }) })] }))] })), step === 'models' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Models" }), fetchingModels && fetchedModels.length === 0 && models.length === 0 ? (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#20a0a0", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Asking your endpoint which models it serves..." })] })) : fetchedModels.length > 0 && modelsMode === 'custom' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Select models from your API or type a custom model ID." }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(SelectInput, { items: [
+                                            } }) })] }))] })), step === 'models' && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: "white", children: "Models" }), fetchingModels && fetchedModels.length === 0 && models.length === 0 ? (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Asking your endpoint which models it serves..." })] })) : fetchedModels.length > 0 && modelsMode === 'custom' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Select models from your API or type a custom model ID." }), _jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(SelectInput, { items: [
                                                 ...fetchedModels.filter((fm) => !models.includes(fm.id)).map((fm) => ({
                                                     label: `  ${fm.name || fm.id}`,
                                                     value: fm.id,
@@ -791,7 +933,7 @@ function SetupScreen({ onComplete, existingConfig }) {
                                                         setModels((prev) => [...prev, item.value]);
                                                     }
                                                 }
-                                            } }) }), models.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, marginTop: 1, children: [_jsx(Text, { dimColor: true, bold: true, children: "Selected:" }), models.map((m) => (_jsxs(Text, { color: "#30c090", children: ['\u25CF', " ", m] }, m)))] }))] })) : (_jsxs(_Fragment, { children: [_jsx(Text, { dimColor: true, children: "Type a model ID and press Enter to add. Add at least one." }), models.length > 0 && modelsMode === 'list' ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { dimColor: true, children: ["Added models (", '↑', "/", '↓', " to navigate, Enter on a model removes it):"] }), _jsx(SelectInput
+                                            } }) }), models.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, marginTop: 1, children: [_jsx(Text, { dimColor: true, bold: true, children: "Selected:" }), models.map((m) => (_jsxs(Text, { color: "#22C55E", children: ['\u25CF', " ", m] }, m)))] }))] })) : (_jsxs(_Fragment, { children: [_jsx(Text, { dimColor: true, children: "Type a model ID and press Enter to add. Add at least one." }), models.length > 0 && modelsMode === 'list' ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { dimColor: true, children: ["Added models (", '↑', "/", '↓', " to navigate, Enter on a model removes it):"] }), _jsx(SelectInput
                                             // Open on Continue. The list's first entries are the
                                             // models themselves and choosing one deletes it, so the
                                             // cursor used to start on a destructive action: the
@@ -830,7 +972,7 @@ function SetupScreen({ onComplete, existingConfig }) {
                                                             return next;
                                                         });
                                                     }
-                                                } })] })) : (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [models.length > 0 && (_jsx(Box, { flexDirection: "column", paddingLeft: 2, marginBottom: 1, children: models.map((m) => (_jsxs(Text, { color: "#30c090", children: ['\u25CF', " ", m] }, m))) })), _jsxs(Box, { children: [_jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: modelInput, onChange: (v) => setModelInput(sanitizeInput(v)), onSubmit: (v) => {
+                                                } })] })) : (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [models.length > 0 && (_jsx(Box, { flexDirection: "column", paddingLeft: 2, marginBottom: 1, children: models.map((m) => (_jsxs(Text, { color: "#22C55E", children: ['\u25CF', " ", m] }, m))) })), _jsxs(Box, { children: [_jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: modelInput, onChange: (v) => setModelInput(sanitizeInput(v)), onSubmit: (v) => {
                                                             const trimmed = sanitizeInput(v).trim();
                                                             if (trimmed) {
                                                                 if (!models.includes(trimmed)) {
@@ -853,8 +995,8 @@ function SetupScreen({ onComplete, existingConfig }) {
                             reportedContextWindow !== null ? (_jsxs(Text, { dimColor: true, children: ["Pre-filled with ", formatContextSize(reportedContextWindow), " \u2014 reported by your endpoint", models.length > 1 ? ', the smallest across the models you picked' : '', "."] })) : (_jsxs(Text, { dimColor: true, children: ["Pre-filled with a safe ", formatContextSize(BYOK_DEFAULT_CONTEXT_TOKENS), " \u2014 we can't read your endpoint's real limit."] }))), (() => {
                                 const parsed = parseInt(contextInput, 10);
                                 const valid = parsed > 0;
-                                return valid ? (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "#30c090", children: ['\u25CF', " ", formatContextSize(parsed), " tokens (", parsed.toLocaleString(), ")"] }) })) : null;
-                            })(), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#20a0a0", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: contextInput, onChange: setContextInput, onSubmit: (v) => {
+                                return valid ? (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "#22C55E", children: ['\u25CF', " ", formatContextSize(parsed), " tokens (", parsed.toLocaleString(), ")"] }) })) : null;
+                            })(), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: "#06B6D4", bold: true, children: ['\u276F', " "] }), _jsx(TextInput, { value: contextInput, onChange: setContextInput, onSubmit: (v) => {
                                             // saveConfig() writes the key to the OS keychain, and that
                                             // subprocess is not always quick — a locked keychain or a
                                             // pending "allow access?" dialog made one measured save take
@@ -913,7 +1055,7 @@ function SetupScreen({ onComplete, existingConfig }) {
                                             }).catch(() => {
                                                 onComplete(newConfig);
                                             });
-                                        }, placeholder: String(defaultContextTokens(provider, existingConfig?.limits?.maxContextTokens)), focus: !saving })] }), saving && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#20a0a0", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Saving configuration (storing your key in the OS keychain)..." })] }))] })), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, italic: true, children: [stepNumber > 1 ? 'Backspace (empty) to go back \u2022 ' : '', "ESC to quit"] }) })] })] }));
+                                        }, placeholder: String(defaultContextTokens(provider, existingConfig?.limits?.maxContextTokens)), focus: !saving })] }), saving && (_jsxs(Box, { marginTop: 1, gap: 1, children: [_jsx(Text, { color: "#06B6D4", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { dimColor: true, children: "Saving configuration (storing your key in the OS keychain)..." })] }))] })), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, italic: true, children: [stepNumber > 1 ? 'Backspace (empty) to go back \u2022 ' : '', "ESC to quit"] }) })] })] }));
 }
 const StatusBar = memo(function StatusBar({ status, model, toolCount, thinkStart, tokens, mode, contextPercent, rateLimitWarn }) {
     const { cols } = useTermSize();
@@ -1038,7 +1180,7 @@ function toolNamePreview(cols) {
 }
 const WelcomeScreen = memo(function WelcomeScreen({ cloud }) {
     const { cols } = useTermSize();
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 0, children: [_jsx(Text, { dimColor: true, children: "  Type a message or use /help for commands. Press Esc to exit." }), _jsxs(Box, { marginTop: 0, paddingLeft: 2, gap: 1, children: [_jsx(Text, { dimColor: true, children: "Tools:" }), _jsx(Text, { dimColor: true, bold: true, wrap: "truncate-end", children: toolNamePreview(cols) })] }), _jsx(Box, { paddingLeft: 2, children: cloud.connected ? (_jsxs(Text, { color: "#20a0a0", children: ['☁', " Scalix Cloud ", '·', " ", cloud.identity ? `${cloud.identity.limits.plan} ${'·'} ` : '', cloud.toolCount, " platform tools"] })) : (_jsx(Text, { dimColor: true, children: cloudStatusLine(cloud, false) })) })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 0, children: [_jsx(Text, { dimColor: true, children: "  Type a message or use /help for commands. Press Esc to exit." }), _jsxs(Box, { marginTop: 0, paddingLeft: 2, gap: 1, children: [_jsx(Text, { dimColor: true, children: "Tools:" }), _jsx(Text, { dimColor: true, bold: true, wrap: "truncate-end", children: toolNamePreview(cols) })] }), _jsx(Box, { paddingLeft: 2, children: cloud.connected ? (_jsxs(Text, { color: "#06B6D4", children: ['☁', " Scalix Cloud ", '·', " ", cloud.identity ? `${cloud.identity.limits.plan} ${'·'} ` : '', cloud.toolCount, " platform tools"] })) : (_jsx(Text, { dimColor: true, children: cloudStatusLine(cloud, false) })) })] }));
 });
 const UserMessage = memo(function UserMessage({ text }) {
     return (_jsx(Box, { paddingX: 2, marginTop: 1, children: _jsxs(Text, { wrap: "wrap", bold: true, children: [_jsx(Text, { color: "magentaBright", children: '\u276F ' }), text] }) }));
@@ -2169,6 +2311,22 @@ function App({ config }) {
             add('system', 'This workspace has project plugins/hooks/rules that were skipped because the workspace is not trusted. Run /trust to load them.');
         }
     }, [add]);
+    // MCP: connect every configured server once the agent exists and register
+    // the tools it reports. Only failures are announced — a working setup should
+    // not narrate itself at every launch.
+    useEffect(() => {
+        if (!agent)
+            return;
+        let hub = null;
+        let cancelled = false;
+        startMcp(agent, (m) => { if (!cancelled)
+            add('system', `⚠ ${m}`); })
+            .then((h) => { hub = h; if (cancelled)
+            void h.close(); })
+            .catch(() => { });
+        // stdio servers are child processes; a re-init must not leave them running.
+        return () => { cancelled = true; void hub?.close(); };
+    }, [agent]);
     // Scalix Cloud: on agent start (and after /setup or /login re-init), fetch
     // the account's tool catalog and register it. Failure or no key → local
     // tools only, with exactly one honest notice. No retry loop.
@@ -2377,6 +2535,43 @@ function App({ config }) {
             });
             return true;
         }
+        if (cmd === '/rename') {
+            const newName = text.slice(7).trim();
+            if (!newName) {
+                add('system', 'Usage: /rename <new session name>');
+                return true;
+            }
+            const msgs = agent.getMessages();
+            saveSession(sessionId, msgs, models[0] || 'unknown', newName, costTracker.getState()).then((meta) => {
+                add('system', `Session renamed to: "${meta.name}"`);
+            }).catch((err) => {
+                add('error', `Failed to rename session: ${err.message}`);
+            });
+            return true;
+        }
+        if (cmd === '/feedback') {
+            const feedbackMsg = text.slice(9).trim();
+            if (!feedbackMsg) {
+                add('system', 'Usage: /feedback <your feedback, issue report, or suggestion>');
+                return true;
+            }
+            saveFeedback({
+                category: 'general',
+                message: feedbackMsg,
+                systemInfo: {
+                    version: VERSION,
+                    nodeVersion: process.version,
+                    platform: os.platform(),
+                    arch: os.arch(),
+                    model: models[0] || 'unknown',
+                },
+            }).then(() => {
+                add('system', 'Thank you! Your feedback has been recorded and submitted to Scalix.');
+            }).catch((err) => {
+                add('error', `Failed to record feedback: ${err.message}`);
+            });
+            return true;
+        }
         if (cmd === '/load' || cmd === '/resume') {
             if (cmd === '/resume') {
                 loadCrashState().then(async (state) => {
@@ -2581,6 +2776,48 @@ function App({ config }) {
             }
             return true;
         }
+        if (cmd === '/sandbox') {
+            const arg = text.split(' ')[1]?.toLowerCase();
+            const current = getCommandSandboxMode();
+            if (arg && COMMAND_SANDBOX_MODES.includes(arg)) {
+                setCommandSandboxMode(arg);
+                loadGlobalConfig().then(cfg => {
+                    cfg.commandSandbox = arg;
+                    return saveConfig(cfg);
+                }).catch((err) => { logger.warn('Failed to save config', { error: err.message }); });
+                const why = arg === 'off'
+                    ? 'commands run unsandboxed'
+                    : arg === 'filesystem'
+                        ? 'writes confined to the workspace + temp; network allowed'
+                        : 'writes confined to the workspace + temp; network denied';
+                add('system', `Command sandbox: ${arg.toUpperCase()} — ${why}. Applies to new run_command calls immediately.`);
+            }
+            else if (!arg) {
+                add('system', `Command sandbox: ${current.toUpperCase()} — usage: /sandbox <off|filesystem|strict>. filesystem = workspace-only writes, strict = also no network.`);
+            }
+            else {
+                add('system', `Unknown sandbox mode "${arg}". Options: off, filesystem, strict.`);
+            }
+            return true;
+        }
+        if (cmd === '/preset') {
+            const arg = text.split(' ')[1]?.toLowerCase();
+            if (arg) {
+                try {
+                    agent.setPreset(arg);
+                    // When a preset switches mode, sync the TUI state
+                    setCurrentMode(agent.getPermissionMode());
+                    add('system', `Preset active: ${arg} — mode is now ${agent.getPermissionMode()}`);
+                }
+                catch (e) {
+                    add('system', `Error: ${e.message}\nAvailable presets: cloud-architect, dba, devops, full-access`);
+                }
+            }
+            else {
+                add('system', `Usage: /preset <id>\nAvailable presets: cloud-architect, dba, devops, full-access`);
+            }
+            return true;
+        }
         if (cmd === '/thinking') {
             const arg = text.split(' ')[1]?.toLowerCase();
             if (arg && THINKING_MODES.includes(arg)) {
@@ -2598,21 +2835,127 @@ function App({ config }) {
         }
         if (cmd === '/mcp') {
             const p = text.split(' ').filter(Boolean);
+            // Bare /mcp reports what is connected \u2014 the question people actually
+            // have, now that connecting is something that can fail.
+            if (p.length === 1) {
+                const st = agent.getMcpStatus();
+                add('system', st.length
+                    ? st.map(s => `${s.state === 'connected' ? '\u25cf' : '\u25cb'} ${s.label} (${s.transport}) \u2014 ${s.state === 'connected' ? `${s.toolCount} tool${s.toolCount === 1 ? '' : 's'}` : s.error ?? s.state}`).join('\n')
+                    : 'No MCP servers configured. Add one to mcp-services.json, or: /mcp <label> <url>');
+                return true;
+            }
             if (p.length < 3) {
-                add('system', 'Usage: /mcp <label> <url>');
+                add('system', 'Usage: /mcp            \u2014 show server status\n       /mcp <label> <url>');
                 return true;
             }
-            {
-                try {
-                    new URL(p[2]);
+            // Same validator add_mcp_server and the config loader use \u2014 a typed URL
+            // gets no more benefit of the doubt than a repo-supplied one.
+            const badUrl = validateMcpUrl(p[2]);
+            if (badUrl) {
+                add('error', `Invalid MCP server URL: ${badUrl}`);
+                return true;
+            }
+            agent.connectMcpServer({ serverLabel: p[1], serverUrl: p[2] }).then((s) => {
+                add(s.state === 'connected' ? 'system' : 'error', s.state === 'connected'
+                    ? `MCP connected: ${p[1]} → ${p[2]} (${s.toolCount} tool${s.toolCount === 1 ? '' : 's'})`
+                    : `MCP ${p[1]} failed: ${s.error ?? 'unknown error'}`);
+            });
+            return true;
+        }
+        if (cmd === '/marketplace') {
+            // The Scalix curated catalog (docs/MARKETPLACE.md). Server data is
+            // untrusted input: the client module re-validates every listing before
+            // it reaches disk, and a stdio listing never installs without an
+            // explicit --confirm flag (it spawns a local process).
+            const p = text.split(' ').filter(Boolean);
+            const trustBadge = (t) => t === 'official' ? '★' : t === 'verified' ? '✔' : '·';
+            const kindBadge = (k) => k === 'mcp' ? 'MCP' : k === 'skill' ? 'skill' : k === 'rule' ? 'rule' : 'agent';
+            const renderList = (list) => list.length
+                ? list.map(l => `${trustBadge(l.trust)} ${l.id} [${kindBadge(l.kind)} v${l.version || '?'}] — ${l.summary}`).join('\n')
+                : 'No listings matched.';
+            if (p.length === 1) {
+                setIsLoading(true);
+                setStatus('thinking');
+                listMarketplaceListings({ limit: 12 }).then((list) => {
+                    add('system', 'Scalix Marketplace — featured catalog:\n' + renderList(list) +
+                        '\n\n/marketplace <query> to search · /marketplace info <id> · /marketplace install <id>');
+                }).catch((err) => {
+                    add('error', `Marketplace unavailable: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
+            }
+            if (p[1] === 'install') {
+                const id = p[2];
+                if (!id) {
+                    add('system', 'Usage: /marketplace install <id> [--confirm]');
+                    return true;
                 }
-                catch {
-                    add('error', `Invalid URL: ${p[2]}`);
+                const confirmStdio = p.includes('--confirm');
+                setIsLoading(true);
+                setStatus('thinking');
+                getMarketplaceListing(id).then((detail) => {
+                    return installMarketplaceListing(detail, { confirmStdio }).then((result) => {
+                        if (result.success) {
+                            add('system', result.message);
+                            const envNote = detail.payload?.kind === 'mcp' && detail.payload.requiredEnv?.length
+                                ? `\nSet ${detail.payload.requiredEnv.join(', ')} in your environment, then /mcp to connect.`
+                                : '';
+                            add('system', envNote.trim());
+                        }
+                        else {
+                            add('error', `Install failed: ${result.error}`);
+                        }
+                    });
+                }).catch((err) => {
+                    add('error', `Install failed: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
+            }
+            if (p[1] === 'info') {
+                const id = p[2];
+                if (!id) {
+                    add('system', 'Usage: /marketplace info <id>');
                     return true;
                 }
-                agent.addTool({ type: 'mcp', serverLabel: p[1], serverUrl: p[2] });
-                add('system', `MCP registered: ${p[1]} \u2192 ${p[2]}`);
+                setIsLoading(true);
+                setStatus('thinking');
+                getMarketplaceListing(id).then((detail) => {
+                    const payload = detail.payload;
+                    const lines = [
+                        `${detail.name} — ${detail.trust} · v${detail.version} by ${detail.author || 'unknown'}`,
+                        detail.summary,
+                    ];
+                    if (payload?.kind === 'mcp') {
+                        lines.push(payload.transport === 'http'
+                            ? `Remote MCP over https → ${payload.serverUrl}`
+                            : `Local MCP (stdio) → ${payload.command} ${(payload.args ?? []).join(' ')}`.trim());
+                        if (payload.requiredEnv?.length)
+                            lines.push(`Requires env: ${payload.requiredEnv.join(', ')}`);
+                    }
+                    else if (payload?.kind === 'skill') {
+                        lines.push(`Writes .scalix/skills/${payload.name}/ (${payload.files.length} file(s))`);
+                    }
+                    else if (payload) {
+                        lines.push(`Writes .scalix/${payload.kind === 'rule' ? 'rules' : 'agents'}/${payload.fileName}`);
+                    }
+                    else {
+                        lines.push('No installable payload on this listing.');
+                    }
+                    add('system', lines.join('\n'));
+                }).catch((err) => {
+                    add('error', `Marketplace unavailable: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
             }
+            const query = p.slice(1).join(' ');
+            setIsLoading(true);
+            setStatus('thinking');
+            listMarketplaceListings({ q: query, limit: 12 }).then((list) => {
+                add('system', `Scalix Marketplace — "${query}":\n` + renderList(list) +
+                    '\n\n/marketplace info <id> · /marketplace install <id>');
+            }).catch((err) => {
+                add('error', `Marketplace unavailable: ${err.message}`);
+            }).finally(() => { setIsLoading(false); setStatus('ready'); });
             return true;
         }
         if (cmd === '/index') {
@@ -2662,6 +3005,9 @@ function App({ config }) {
             discoverPluginsForAgent(agent).then(() => {
                 add('system', `Loaded ${loadedPlugins.length} plugin(s).`);
             }).catch(() => { });
+            const hookCount = agent.reloadHooks();
+            if (hookCount > 0)
+                add('system', `Loaded ${hookCount} project hook(s).`);
             buildEnhancedInstructions().then((enhanced) => {
                 agent.setInstructions(enhanced);
                 add('system', 'Reloaded project rules into context.');
@@ -2713,6 +3059,12 @@ function App({ config }) {
         }
         if (cmd === '/hooks') {
             const hooks = agent.getHooks();
+            const skipped = agent.getSkippedHookCount();
+            // Hooks that exist but were withheld are worth a line of their own —
+            // "No hooks configured" would be a lie the user could act on wrongly.
+            if (skipped > 0) {
+                add('system', `${skipped} project hook(s) skipped — this workspace is untrusted. Run /trust to enable them.`);
+            }
             hooksSummary(hooks).split('\n').forEach((l) => add('system', l));
             return true;
         }