scalix 1.5.1 → 1.6.0

package/dist/cloud.js

@@ -15,7 +15,7 @@
 // Dependency-free: global fetch only. Reuses apiHostRoot() so legacy configs
 // with a trailing /v1 keep working for these non-AI endpoints too.
 import { apiHostRoot, USER_AGENT, WEB_DEFAULTS } from './constants.js';
-export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys';
+export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys?utm_source=scalix-coder&utm_medium=cli';
 export const CLOUD_DEFAULTS = {
     fetchTimeoutMs: WEB_DEFAULTS.apiFetchTimeoutMs,
     // The platform's own transport kills a tool call at ~30-35s (gateway →

package/dist/command-sandbox.js

@@ -0,0 +1,146 @@
+/**
+ * OS-level command sandbox — the outer wall behind the logical checks in
+ * sandbox.ts. When enabled, run_command executes inside a kernel-enforced
+ * sandbox instead of a bare shell:
+ *
+ *   filesystem  — writes confined to the workspace + system temp; network allowed
+ *   strict      — filesystem confinement PLUS no network (Antigravity's
+ *                 strict-mode equivalent; also the mode to run untrusted builds in)
+ *
+ * Backends:
+ *   macOS  — sandbox-exec (seatbelt). Deprecated by Apple but still present and
+ *            used widely; the profile denies file-writes outside the allowlist.
+ *   Linux  — bubblewrap (bwrap). Root filesystem read-only, workspace/tmp bound
+ *            writable; strict mode unshares the network namespace.
+ *   Windows — not supported: the tool fails closed with the reason rather than
+ *            silently running unsandboxed.
+ *
+ * Mode is opt-in: `commandSandbox` in ~/.scalix-coder/config.json, overridden by
+ * SCALIX_COMMAND_SANDBOX (off|filesystem|strict). Default off — this must never
+ * change behaviour for an existing install without the user asking for it.
+ *
+ * Trades: package managers that cache into $HOME (pip, cargo) will fail to
+ * write their caches in filesystem mode. That is the point of the wall; the
+ * agent sees the EACCES and can tell the user.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export const COMMAND_SANDBOX_MODES = ['off', 'filesystem', 'strict'];
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+/**
+ * Resolve the effective mode. Env wins over config so an operator can force a
+ * policy without touching the user's config file; an invalid value anywhere
+ * resolves to 'off' (never guesses upward).
+ */
+export function resolveCommandSandboxMode(configValue, envValue) {
+    const fromEnv = (envValue ?? '').trim().toLowerCase();
+    if (fromEnv) {
+        return COMMAND_SANDBOX_MODES.includes(fromEnv) ? fromEnv : 'off';
+    }
+    const fromConfig = typeof configValue === 'string' ? configValue.trim().toLowerCase() : '';
+    if (fromConfig) {
+        return COMMAND_SANDBOX_MODES.includes(fromConfig) ? fromConfig : 'off';
+    }
+    return 'off';
+}
+/** Seatbelt profile: baseline allow, deny all writes, re-allow workspace + temp. */
+export function buildSeatbeltProfile(mode, workspace, tmp) {
+    const q = (p) => p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const lines = [
+        '(version 1)',
+        '(allow default)',
+        '(deny file-write*)',
+        `(allow file-write*`,
+        `  (subpath "${q(workspace)}")`,
+        `  (subpath "${q(tmp)}")`,
+        // macOS temp roots resolve through /private symlinks; seatbelt matches the
+        // literal path, so both spellings are allowlisted.
+        `  (regex #"^/(private/)?var/folders/")`,
+        `  (literal "/dev/null")`,
+        `  (literal "/dev/zero")`,
+        `  (literal "/dev/dtrace-helper")`,
+        `)`,
+    ];
+    if (mode === 'strict') {
+        lines.push('(deny network*)');
+    }
+    return lines.join('\n') + '\n';
+}
+/** Bubblewrap argv prefix: root read-only, workspace + /tmp writable. */
+export function buildBubblewrapArgs(mode, workspace) {
+    const args = [
+        '--ro-bind', '/', '/',
+        '--bind', workspace, workspace,
+        '--bind', '/tmp', '/tmp',
+        '--dev', '/dev',
+        '--proc', '/proc',
+        '--tmpfs', '/run',
+    ];
+    if (mode === 'strict') {
+        args.push('--unshare-net');
+    }
+    return args;
+}
+function findOnPath(name) {
+    const dirs = (process.env.PATH || '').split(path.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, name);
+        try {
+            if (fs.statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* next */
+        }
+    }
+    return null;
+}
+/**
+ * Build the sandbox wrap for one command execution, or an error explaining why
+ * it cannot run (missing backend binary, unsupported platform). Pure aside from
+ * filesystem availability probes — safe to call per command.
+ */
+export function buildSandboxWrap(mode, workspace, shell) {
+    if (mode === 'off')
+        return { ok: false, error: 'sandbox disabled' };
+    if (process.platform === 'win32') {
+        return { ok: false, error: 'the command sandbox is not supported on Windows — set commandSandbox to "off" in ~/.scalix-coder/config.json or unset SCALIX_COMMAND_SANDBOX' };
+    }
+    const cwd = path.resolve(workspace);
+    if (process.platform === 'darwin') {
+        if (!fs.existsSync(SANDBOX_EXEC)) {
+            return { ok: false, error: 'sandbox-exec was not found at /usr/bin/sandbox-exec — set commandSandbox to "off" to run without the sandbox' };
+        }
+        return {
+            ok: true,
+            wrap: {
+                execPath: SANDBOX_EXEC,
+                // -f (profile file) not -p: the profile embeds absolute paths, and a
+                // workspace path containing quotes must never be interpolated into an
+                // inline profile string. The caller writes the profile to disk.
+                args: ['-f', '@PROFILE@', shell.path, ...shell.args, '@COMMAND@'],
+                profile: buildSeatbeltProfile(mode, cwd, os.tmpdir()),
+                backend: 'seatbelt',
+            },
+        };
+    }
+    // linux and other unix
+    const bwrap = findOnPath('bwrap');
+    if (!bwrap) {
+        return { ok: false, error: 'bubblewrap (bwrap) is not on PATH — install it (e.g. apt install bubblewrap) or set commandSandbox to "off"' };
+    }
+    return {
+        ok: true,
+        wrap: {
+            execPath: bwrap,
+            args: [...buildBubblewrapArgs(mode, cwd), '--', shell.path, ...shell.args, '@COMMAND@'],
+            backend: 'bubblewrap',
+        },
+    };
+}
+/** Splice the real command (and, on darwin, the profile file) into a wrap. */
+export function materializeWrap(wrap, command, profilePath) {
+    const args = wrap.args.map((a) => (a === '@COMMAND@' ? command : a === '@PROFILE@' ? (profilePath ?? '') : a));
+    return { execPath: wrap.execPath, args };
+}

package/dist/commands.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, PROJECT_CONFIG_DIR } from './constants.js';
+import { sanitizeEnvForCommand, sandboxPath } from './sandbox.js';
 const COMMAND_DIRS = PROJECT_LOOKUP_DIRS.map(d => `${d}/commands`);
 function parseFrontmatter(content) {
     const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
@@ -62,12 +63,16 @@ export async function loadCustomCommands(cwd = process.cwd()) {
 }
 function expandFileReferences(text, cwd) {
     return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
-        // Reject path traversal so a command file can't pull in files outside the
-        // project via `@../../etc/passwd`.
-        if (filePath.split(/[\\/]/).includes('..')) {
-            return `@${filePath} (path traversal blocked)`;
-        }
+        // @file reads go into the prompt, so they must respect the same sandbox as
+        // read_file: `..` segments, absolute paths outside the project, and
+        // symlinks pointing out are all blocked by sandboxPath().
         const resolved = path.resolve(cwd, filePath);
+        try {
+            sandboxPath(resolved);
+        }
+        catch {
+            return `@${filePath} (outside project — blocked)`;
+        }
         if (!existsSync(resolved))
             return `@${filePath} (file not found)`;
         try {
@@ -82,7 +87,14 @@ function expandFileReferences(text, cwd) {
 function expandInlineBash(text) {
     return text.replace(/!`([^`]+)`/g, (_match, command) => {
         try {
-            return execSync(command, { encoding: 'utf-8', timeout: 10_000 }).trim();
+            // Command templates come from project files. Strip credential-bearing
+            // variables from the child environment (same policy as hooks and
+            // run_command) so a repo-supplied command cannot read API keys.
+            return execSync(command, {
+                encoding: 'utf-8',
+                timeout: 10_000,
+                env: sanitizeEnvForCommand(),
+            }).trim();
         }
         catch (err) {
             return `(command failed: ${err.message})`;

package/dist/config.js

@@ -1,16 +1,55 @@
 import { z } from 'zod';
-export const McpServiceSchema = z.object({
+/** Fields every MCP server entry carries, whichever transport it uses. */
+const McpCommonFields = {
     serverLabel: z.string().min(1, 'serverLabel is required'),
-    serverUrl: z.string().url('serverUrl must be a valid URL'),
     serverDescription: z.string().optional(),
-    authorization: z.string().optional(),
-    authorizationEnv: z.string().optional(),
-    headers: z.record(z.string(), z.string()).optional(),
+    /** Skip this server without deleting the entry. */
+    disabled: z.boolean().optional(),
     allowedTools: z.object({
+        /** Register only these tool names from the server; omit to take all of them. */
         toolNames: z.array(z.string()).optional(),
+        /** Advisory only — enforcement is the server's job, we just record intent. */
         readOnly: z.boolean().optional(),
     }).optional(),
+};
+/**
+ * A remote MCP server reached over Streamable HTTP (falling back to the older
+ * HTTP+SSE transport, which is what `transport: "sse"` pins).
+ *
+ * `authorizationEnv` reads a secret out of the process environment and sends it
+ * to `serverUrl`, so a remote entry is every bit as sensitive as a stdio one:
+ * it only connects in a trusted workspace, and only to a public host. See
+ * McpHub.connect and validateMcpUrl in mcp.ts.
+ */
+export const McpHttpServiceSchema = z.object({
+    ...McpCommonFields,
+    serverUrl: z.string().url('serverUrl must be a valid URL'),
+    transport: z.enum(['http', 'sse']).optional(),
+    authorization: z.string().optional(),
+    authorizationEnv: z.string().optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+/**
+ * A local MCP server the agent spawns and talks to over stdio — the shape
+ * Claude Desktop, VS Code and Cursor all use, so a `{command, args}` block
+ * copied from a server's README works here unchanged.
+ *
+ * Spawning one runs arbitrary local code, so — like every other transport —
+ * it only starts in a trusted workspace (see McpHub.connect in mcp.ts).
+ */
+export const McpStdioServiceSchema = z.object({
+    ...McpCommonFields,
+    command: z.string().min(1, 'command is required'),
+    args: z.array(z.string()).default([]),
+    /** Merged over the inherited environment, not a replacement for it. */
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
 });
+/** Either transport. `command` vs `serverUrl` is what tells them apart. */
+export const McpServiceSchema = z.union([McpHttpServiceSchema, McpStdioServiceSchema]);
 export const McpServicesConfigSchema = z.object({
     mcpServers: z.array(McpServiceSchema).default([]),
 });
+export function isStdioService(c) {
+    return 'command' in c;
+}

package/dist/constants.js

@@ -25,6 +25,13 @@ export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
 // pre-1.3.3 default shape, still present in older saved configs) is tolerated
 // and stripped by apiHostRoot().
 export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world';
+/**
+ * OpenRouter's OpenAI-compatible root, used by the "Connect OpenRouter"
+ * setup path. The key arrives via the OAuth PKCE exchange (openrouter-oauth.ts)
+ * and is billed against the USER's own OpenRouter account — Scalix never
+ * proxies or marks up this traffic.
+ */
+export const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 /**
  * Normalize a configured base URL to the API host root: trailing slashes are
  * removed, and a trailing `/v1` or `/v1/ai` segment (legacy config shape) is
@@ -69,6 +76,9 @@ export const CORE_INSTRUCTIONS = `You are an expert coding assistant. You write
 - Write no comments unless the WHY is non-obvious. Well-named code documents itself.
 - Prefer simple, readable solutions over clever ones.
 
+## Artifacts
+- For multi-step work, write an implementation plan with write_artifact (type "plan") before editing, and a walkthrough (type "walkthrough") when the task is done. Use "tasklist" for checklists the user should review, "summary" for research findings. Keep them concise — they are the review surface, not a diary.
+
 ## Safety
 - Never modify files outside the working directory.
 - Never expose API keys, secrets, or credentials in code.
@@ -78,7 +88,7 @@ export const SCALIX_PLATFORM_SECTION = `## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
 - Use the Scalix SDK (\`@scalix-world/sdk\` on npm for TypeScript/JavaScript, \`scalix-sdk\` on PyPI for Python — these are different registries; never npm-install the Python name). Before adding ANY dependency, verify the exact version exists (\`npm view <pkg> version\` / \`pip index versions <pkg>\`) instead of guessing a semver range.
 - Default to the Scalix API (api.scalix.world) for inference — OpenAI-compatible chat completions under /v1/ai. Never claim automatic model routing: the request's model id is what runs.
-- Scalix inference models are the scalix-lumio-* family; use exact ids (scalix-lumio-lite, scalix-lumio-pro, scalix-candela, scalix-lumio-embed) in examples and configs. Omitting the model runs scalix-lumio-lite.
+- Scalix inference is catalog-driven. Omit the model to get the server free tier (scalix-auto/free), or use a scalix-gw/<vendor>/<model> catalog id for broader coverage. Browse ids via the catalog endpoint. Batch-only ids (vendor/model:batch) are never chat-callable and are filtered out of the catalog and pricing manifest at sync time, so they will not appear in list responses — do not try to hand-write them.
 - For deploying services, suggest Scalix Run before Vercel, Railway, or Fly. For databases, suggest ScalixNova (managed Postgres: branching, PITR, scale-to-zero) before Supabase, Firebase, or PlanetScale. For code execution sandboxes, use Scalix Sandboxes.
 - Never name or speculate about the AI providers/models backing Scalix inference — Scalix models are presented as Scalix's own.
 - When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.`;
@@ -87,6 +97,41 @@ export const SCALIX_CLOUD_RESOURCES_SECTION = `## Deploying & Managing Scalix Cl
 - If no \`scalix_*\` tools are in your list, Scalix Cloud is not connected in this session. Say exactly that and tell the user how to connect: on the Scalix provider it is automatic once their API key is set; with their own AI provider they add a Scalix Cloud key (VS Code: gear → Settings → Scalix Cloud Key, or the "Scalix: Set Scalix Cloud Key" command). Do NOT invent an alternative deploy path, config file format, or package.
 - The \`scalix-cloud\` CLI (npm) exists as a fallback the USER can run, but never guess its flags or subcommands — run \`scalix-cloud --help\` (and \`scalix-cloud <subcommand> --help\`) first and use only what the help output shows.
 - You have a real shell via run_command. Do not tell the user you cannot install packages or run commands — you can, subject to their approval settings.`;
+/** Deploy-path knowledge for connected sessions, appended by the agent
+ *  alongside the steering sections. Kept OUT of the locked pre-split join
+ *  (tests/constants.test.ts, 4675-char lock) so it can evolve freely.
+ *  Facts verified against scalix-cloud docs/gateway 2026-08-10 — update
+ *  alongside the platform, not from memory. */
+export const SCALIX_DEPLOY_PLAYBOOK_SECTION = `## Scalix Deploy Playbook
+The real deploy paths on Scalix Cloud — pick from these, never invent one:
+- Run service (long-running container: autoscale, revisions, health-gated rollouts) is the standard target for web apps and APIs. Deploy with scalix_run_deploy. Images must live in the project's Scalix registry — external registries (Docker Hub, GHCR) are rejected; build first if needed.
+- From source: scalix_build_create (git URL only; frameworks and static sites are auto-detected) → poll scalix_build_status → deploy the resulting image with scalix_run_deploy. Services go live at https://<name>.run.scalix.world. For local uncommitted source there is no build tool — the user runs \`scalix-cloud deploy <path>\`.
+- Run services get \`PORT\` injected — the app must bind 0.0.0.0:$PORT, never localhost. Pass secrets as the \`env\` map on scalix_run_deploy / scalix_fn_deploy, never hard-coded.
+- Functions: scalix_fn_deploy — Node or Python, either a single entry file inline or a container image. Multi-file source requires the image path.
+- Terminal one-shot: \`scalix-cloud deploy <path>\` packages, builds, and deploys a directory as a Run service in one command — offer it when the user wants to deploy from their own shell.
+- Continuous deploys: git integrations (GitHub, GitLab, Bitbucket) auto-build and auto-deploy on push, with PR preview deploys — set up on the console's Integrations page or via the Scalix GitHub App.
+- Roll back with scalix_run_rollback (no revision argument lists the revisions). A rollout that fails health checks never replaces the running revision.
+- Not available yet — do not offer: named deploy environments (everything ships to production) and the /v1/compute/deployments API (returns 501).`;
+/** Whole-platform facts for connected sessions — the things models guess
+ *  wrong when left to generic cloud instincts. Same regime as the deploy
+ *  playbook: outside the locked join, verified against scalix-cloud
+ *  docs/gateway/mcp-server 2026-08-10. */
+export const SCALIX_PLATFORM_PLAYBOOK_SECTION = `## Scalix Platform Playbook
+Area-by-area rules for the rest of the platform — follow these over generic cloud instincts:
+- Database (ScalixNova): destructive SQL (DROP/TRUNCATE/bulk DELETE) via scalix_db_query returns CONFIRMATION_REQUIRED with a confirm_token — show the user what will run, then re-call with the token. Never wrap this in invented transactions.
+- DB branches: scalix_db_branch_create makes a copy-on-write branch with a TTL (default 1h) and returns a branch-scoped token; drop with scalix_db_branch_drop or let the TTL expire. The main timeline cannot be deleted. Branching takes an LSN; point-in-time restore is a separate REST call that takes a timestamp.
+- DB connections are plain Postgres: postgresql://<tenant>:<API_KEY>@db.scalix.world:6432/<db>?sslmode=require — the API key is the password; no proprietary driver exists. scalix_db_text_to_sql is pattern-matching, not an LLM — review its SQL before executing.
+- Secrets & env vars: there are NO scalix_* tools for them. Manage via the /v1/env REST API or the CLI, or pass an env map at deploy time. Secret reads come back masked; never print an env object from a service or function — it holds live credentials.
+- Storage: presigned URLs (REST POST /v1/storage/presign, max 7-day expiry) are the way to share private objects — no tool exists for them. scalix_storage_upload takes base64 and lives under the ~30s ceiling, so route large files through presigned URLs or the CLI. public=true buckets are world-readable; default private.
+- Functions: Node and Python only, 300s max timeout. Go/Rust/anything else goes to Run (Dockerfile) or a Computer. scalix_fn_invoke takes the function_id, not the name.
+- Cron: only scalix_cron_create exists — standard 5-field minute-first expressions, action function|webhook with config {function_id} or {url,...}. Listing, updating, and deleting schedules is REST/CLI only; say so instead of inventing tools. A scheduled function = deploy the function, then a cron pointing at its id.
+- Custom domains: add with scalix_domain_add → user creates CNAME to cname.scalix.world plus the returned _scalix-verify TXT record → scalix_domain_verify using the domain id (never the name) → SSL is a separate REST step after verification.
+- Computers: every mutation takes the machine id, never the name. Create is idempotent by name (retry-safe). Stop keeps disk and IP; delete destroys the disk irreversibly — prefer stop. Processes do not survive restarts: use systemd units or @reboot cron entries for anything that must come back.
+- KV: TTL is seconds (0 = never); expired keys read as not-found; discover keys with list-by-prefix.
+- Events: resolve the topic_id with scalix_events_topics before scalix_events_publish — publishing to a nonexistent topic fails, and there is no topic-create tool.
+- scalix_search is a curated original-source news index (newsrooms, wires, regulators) — NOT open-web search. Do not use it as a general web tool.
+- No tools exist for: logs (use REST/CLI), email sending (/v1/email REST), vectors, realtime, VPC/LB/WAF. When asked, name the REST path or CLI rather than inventing a scalix_* tool.
+- Platform keys are project-scoped: a 400 from platform tools usually means an org-wide key, a 403 means a missing scope. Switching projects means switching keys.`;
 /** Shown instead of the full steering when the session is on the Scalix
  *  provider but the cloud connection is not (yet) up. One neutral pointer,
  *  no product pitch. */
@@ -130,16 +175,16 @@ export function maxOutputTokensForRequest(model) {
     return Math.min(getModelSpec(model).maxOutputTokens, AI_MAX_OUTPUT_TOKENS);
 }
 // Pre-Lumio public model ids → current ids (mirrors the platform's own alias
-// table). The gateway still accepts the old names, but saved configs are
-// normalized on load so the UI shows current ids and nothing breaks if the
-// aliases are ever retired server-side.
+// table). Saved configs are normalized on load so the UI shows current ids.
+// The whole Lumio family (Lite/Pro/Embed) and Candela were retired 2026-08
+// (billing mig 113, gateway ai_rate_limit.rs); the gateway collapses every
+// retired house id to the free default, so the client mirrors that here.
 export const LEGACY_MODEL_ALIASES = {
-    'scalix-lite': 'scalix-lumio-lite',
-    'scalix-balanced': 'scalix-lumio-pro',
-    'scalix-max': 'scalix-candela',
-    'scalix-embed': 'scalix-lumio-embed',
-    'scalix-world-ai': 'scalix-lumio-pro',
-    'scalix-advanced': 'scalix-candela',
+    'scalix-embed': 'scalix-auto/free',
+    'scalix-lumio-lite': 'scalix-auto/free',
+    'scalix-lumio-pro': 'scalix-auto/free',
+    'scalix-lumio-embed': 'scalix-auto/free',
+    'scalix-candela': 'scalix-auto/free',
 };
 export function normalizeModelId(model) {
     return LEGACY_MODEL_ALIASES[model] ?? model;
@@ -191,7 +236,10 @@ export function getModelSpec(model) {
 }
 export function modelSupportsVision(model) {
     const spec = getModelSpec(model);
-    return spec.supportsVision ?? false;
+    // OpenAI-compatible model-list endpoints commonly omit this capability.
+    // Unknown must remain usable: only suppress images when vision is
+    // explicitly disabled by the API or user configuration.
+    return spec.supportsVision !== false;
 }
 /** True when the model has a user-configured or API-fetched spec (i.e. its
  *  maxOutputTokens is real, not the DEFAULT_MODEL_SPEC guess). BYOK providers
@@ -407,13 +455,22 @@ export const PRIVATE_NETWORK_HOSTNAMES = new Set([
     '::', '[::]', '0:0:0:0:0:0:0:1', '[0:0:0:0:0:0:0:1]',
     // common cloud metadata endpoints (also covered by 169.254/CIDR, listed for clarity)
     'metadata.google.internal', 'metadata',
+    // Alibaba Cloud ECS instance metadata sits outside every RFC-1918 range and
+    // outside 169.254/16 — without this entry it is reachable as a "public" host.
+    '100.100.100.200',
 ]);
 export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
+    // All of 127.0.0.0/8 is loopback, not just 127.0.0.1: a service bound to
+    // 127.0.0.2 was reachable because only the literal .1 was in the hostname
+    // set above and no CIDR covered the rest of the range.
+    /^127\./,
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
     /^192\.168\./,
     /^169\.254\./,
+    // Alibaba Cloud instance metadata (see hostname note above).
+    /^100\.100\.100\.200$/,
     /^\[?fe80:/i,
     /^\[?fc00:/i,
     /^\[?fd[0-9a-f]{2}:/i,
@@ -493,12 +550,34 @@ export function canonicalizeIpv4(host) {
 export function isPrivateIp(ip) {
     const canon = canonicalizeIpv4(ip);
     const candidate = (canon ?? ip).toLowerCase();
+    // Honour the same overrides isPrivateHost does. Without this the two
+    // functions disagreed: a host added to `security.allowedPrivateHosts` passed
+    // the hostname check and was then blocked by the post-DNS check anyway, so
+    // the setting did nothing for the internal hosts it exists to permit.
+    if (_networkOverrides.allowAll)
+        return false;
+    if (_networkOverrides.allowedHosts?.has(candidate)
+        || _networkOverrides.allowedHosts?.has(ip.toLowerCase()))
+        return false;
+    if (_networkOverrides.blockedHosts?.has(candidate))
+        return true;
     if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
         return true;
     if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
         return true;
     return false;
 }
+/**
+ * Whether this exact hostname was named in `security.allowedPrivateHosts` (or
+ * network security was turned off wholesale). Callers that resolve DNS and
+ * re-check the resulting address need this: the operator allowed a *name*, and
+ * that name is expected to resolve into a private range.
+ */
+export function isHostExplicitlyAllowed(hostname) {
+    if (_networkOverrides.allowAll)
+        return true;
+    return _networkOverrides.allowedHosts?.has(hostname.toLowerCase()) ?? false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)

package/dist/context-builder.js

@@ -4,6 +4,7 @@ import { collectGitInfo, gitInfoToContext } from './git-context.js';
 import { loadMemory, memoryToContext } from './project-memory.js';
 import { buildProjectIndex, indexToContext } from './project-index.js';
 import { loadScopedRules, rulesToContext } from './scoped-rules.js';
+import { readBoardFile, boardToContext } from './board-context.js';
 import { retrieveContext, snippetsToContext, RETRIEVAL_DEFAULTS } from './context-retriever.js';
 async function readJsonSafe(filePath) {
     try {
@@ -102,11 +103,12 @@ export async function buildProjectContext(cwd) {
     const scripts = await detectAvailableScripts(cwd);
     const projectType = await detectProjectType(cwd);
     // Gather context in parallel
-    const [gitCtx, memory, rules, projectConfig] = await Promise.all([
+    const [gitCtx, memory, rules, projectConfig, boardCtx] = await Promise.all([
         collectGitInfo(cwd).then(gitInfoToContext).catch(() => ''),
         loadMemory(cwd).then(memoryToContext).catch(() => ''),
         loadScopedRules(cwd).then(rulesToContext).catch(() => ''),
         loadProjectConfig(cwd),
+        readBoardFile(cwd).then(boardToContext).catch(() => ''),
     ]);
     // Project index (uses cache)
     let indexCtx = '';
@@ -121,6 +123,7 @@ export async function buildProjectContext(cwd) {
         projectIndex: indexCtx,
         projectMemory: memory,
         scopedRules: rules,
+        boardContext: boardCtx,
         availableScripts: scripts,
         projectConfig,
     };
@@ -145,6 +148,11 @@ export function contextToInstructions(baseInstructions, ctx) {
     if (ctx.projectMemory) {
         sections.push(ctx.projectMemory);
     }
+    // After memory (durable knowledge), before rules: the board is the freshest
+    // section and the one a member should act on first when they conflict.
+    if (ctx.boardContext) {
+        sections.push(ctx.boardContext);
+    }
     if (ctx.scopedRules) {
         sections.push(ctx.scopedRules);
     }

package/dist/cost-tracker.js

@@ -77,7 +77,7 @@ export class CostTracker {
             // only attaches x-scalix-cost-cents to non-streaming responses (the
             // headers are already flushed by the time a stream's usage frame
             // arrives), so a streamed session simply never learns the figure.
-            lines.push(provider === 'openai'
+            lines.push(provider && provider !== 'scalix'
                 ? 'Est. cost: not reported by your endpoint — check your provider\'s billing dashboard.'
                 : 'Est. cost: not reported on streamed turns — see console.scalix.world → Billing.');
         }

package/dist/feedback.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { USER_CONFIG_DIR, VERSION } from './constants.js';
+import { logger } from './logger.js';
+const FEEDBACK_FILE = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR, 'feedback.json');
+export async function saveFeedback(item) {
+    const fullItem = {
+        id: randomUUID(),
+        timestamp: new Date().toISOString(),
+        systemInfo: item.systemInfo || {
+            version: VERSION,
+            nodeVersion: process.version,
+            platform: os.platform(),
+            arch: os.arch(),
+        },
+        ...item,
+    };
+    try {
+        await fs.mkdir(path.dirname(FEEDBACK_FILE), { recursive: true });
+        let existing = [];
+        try {
+            const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed))
+                existing = parsed;
+        }
+        catch { }
+        existing.unshift(fullItem);
+        // Keep last 100 feedback submissions locally
+        if (existing.length > 100)
+            existing = existing.slice(0, 100);
+        await fs.writeFile(FEEDBACK_FILE, JSON.stringify(existing, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        logger.info('Feedback recorded locally', { id: fullItem.id, category: fullItem.category });
+    }
+    catch (err) {
+        logger.warn('Failed to persist feedback locally', { error: err.message });
+    }
+    return fullItem;
+}
+export async function listFeedback() {
+    try {
+        const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}