scalix 1.5.2 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to Scalix Coder will be documented in this file.
 
+## [1.6.0] - 2026-11-11
+
+### Added
+- **`/marketplace` — the Scalix curated plugin catalog.** Browse, inspect and install catalog listings from the TUI: MCP servers into `mcp-services.json`, skills into `.scalix/skills/`, rules into `.scalix/rules/`, subagents into `.scalix/agents/`. Every listing is re-validated client-side before anything touches disk (https-only public-host remote entries, bare stdio command names, relative file paths, env-var names only — never credential values), stdio installs require explicit confirmation, and install telemetry is best-effort and anonymous. New module `src/marketplace.ts`; 21 unit tests.
+
+### Security
+- **Repo-supplied slash commands are trust-gated and run with a sanitized environment.** `.scalix/commands/*.md` templates were loaded in every front end without the workspace-trust check that plugins and hooks get, and their `` !`cmd` `` inline-bash expansions executed with the full parent environment — API keys readable. Inline bash now runs with `sanitizeEnvForCommand()`, loading is gated on `isWorkspaceTrusted()` (with a skip notice), and a repo carrying `commands/` now triggers the trust prompt. (Audit F1)
+- **`browser_session_save` / `restore` reject traversal names.** The `name` argument became a filename via `path.join` without validation, so `../../..` wrote and read JSON outside the sandbox. Names are now restricted to `[A-Za-z0-9._-]` at the schema and in `saveSessionState`. (F2)
+- **`search_files` ripgrep fast path is sandbox-contained.** The rg branch took any absolute `path` and read it; the JS fallback already validated. The target now goes through `sandboxPath()` before any backend runs, with rg output relativized to preserve the old shape. (F3)
+- **Project `settings.local.json` can no longer escalate permissions.** A trusted repo could set `permissionMode: "yolo"`, reclassify tools via `toolOverrides`, disable blocklist/injection patterns, or add scoped "allow" rules. Project files may now only tighten: `plan` mode, deny-only scoped rules, and a whitelist of tightening security fields; escalation attempts are ignored with a notice. Managed settings (`managed-settings.json`) are now validated with the same validators as user config. (F4)
+- **`@file` prompt references are sandbox-contained.** `@/abs/path.ext` in a prompt read any file on disk in the TUI and was attacker-influenceable via `--pipe`; both `agent.ts` and `commands.ts` expansion now route through the sandbox check. (F5)
+- **Alibaba Cloud metadata IP `100.100.100.200` is treated as private** by `web_fetch` and the browser tools — it sits outside every previously-listed range and exposed instance credentials on ECS. (F9)
+- MCP `serverUrl` values are redacted (userinfo stripped) before logging; MCP fetch now downgrades 301/302/303 redirects of POST requests to GET and drops the body per the fetch spec. (F12 + redirect semantics)
+- IPC `setPermissionMode` validates the mode against `PERMISSION_MODES` instead of applying any string. (F14)
+
+### Fixed
+- **A user abort no longer pollutes the model circuit breaker.** Aborting mid-request was recorded as a model failure — five Escapes within the reset window silently rotated the model. The abort path now returns `'[interrupted]'` consistently whether it lands between tool calls or mid-request. (Audit: agent abort contract)
+- **Retry backoff, stream-fallback waits, and tool-confirmation prompts are abort-aware.** Cancelling during a Retry-After wait (up to 60s) or a pending confirmation (up to 300s) returns immediately instead of parking the loop.
+- **Conflicted sub-agent worktree merges keep their branch.** Teardown ran `git branch -D` unconditionally, destroying the sub-agent's unmerged commits right after reporting the conflict; removal now uses a safe delete and keeps unmerged `scalix-agent/*` branches for recovery. A failed merge probe is reported as a failure (with `error`) instead of `{merged: true, commitCount: 0}`.
+- **`/delegate` works on BYOK sessions.** The headless sub-agent config omitted `provider` (and cloud credentials), so the sub-agent called the Scalix URL shape against a third-party base URL and 404'd on every request.
+- **Per-request timeout defaults to 300s.** The comment promised it but unset `SCALIX_REQUEST_TIMEOUT_MS` meant *no* timeout; a wedged connection hung the turn forever.
+- The capability probe (`streamsToolCalls`) can no longer fail a turn — errors default to the conservative non-streaming answer.
+- `clearHistory()` / `loadMessages()` reset the output-format instruction index, so a `/load` followed by a JSON-format request can no longer overwrite an unrelated system message.
+- Streaming TTFT and per-turn metrics reset each loop iteration, so `turn:summary` reports the turn that produced the final response.
+- `scalix run` no longer double-prints errors (REPORTED_ERROR dedup applied to headless).
+
+### VS Code extension
+- **Fixed the send dead-latch.** The chat panel set the tab's `isRunning` flag before reading it, so the direct-send branch was dead code: every message queued as "Queued: …" and was only released when an unrelated engine status event arrived.
+- **Chat tabs stay in sync with the engine.** Switching tabs now posts `switchSession` (the host previously kept sending to the previous tab's session, and background-tab streams were dropped); `send`/`abort` honor the message's own `sessionId` with the host value as fallback. Queued messages now carry their images through the queue.
+- **Feedback is actually stored.** The submit-feedback flow thanked the user and discarded everything; it now records through `FeedbackService` (local history, capped at 100 — nothing leaves the machine).
+- **Tool-approval handler cleanup on dispose.** With a sidebar and an editor-tab chat open, closing the editor tab left its dead confirm handler registered, so in-panel approvals silently stopped for the surviving surface.
+- `scalix.cliPath`, `scalix.baseUrl`, `scalix.openaiBaseUrl`, `scalix.provider`, and `scalix.permissionMode` are now machine-scoped — a repo's `.vscode/settings.json` can no longer point the engine spawn at arbitrary code or redirect the API key's destination endpoint.
+
+### Known issues (from the 2026-10-14 audit, not yet addressed)
+- The webview's per-tab `innerHTML` cache destroys event listeners on restored tabs (dead confirm-card buttons after a tab round-trip) — needs the data-driven re-render refactor.
+- Background-tab stream events are still dropped rather than buffered per session.
+- The OS command sandbox (seatbelt/bwrap) remains opt-in and default-off; the regex command blocklist is explicitly not a security boundary.
+- DNS-rebinding TOCTOU remains in `web_fetch`/MCP fetch (validation and fetch resolve DNS independently).
+- `vscode-extension/tests` are still not wired into either publish workflow.
+
 ## [1.5.1] - 2026-08-08
 
 ### Added

package/README.md

@@ -99,6 +99,7 @@ First launch opens a setup wizard to configure your Scalix API key, endpoint, an
 | `SCALIX_MODEL`    | Comma-separated model IDs        |
 | `SCALIX_BASE_URL` | API base URL                     |
 | `SCALIX_PROJECT`  | Project ID for org-wide keys (sent as `x-scalix-project` on platform tool calls) |
+| `SCALIX_COMMAND_SANDBOX` | OS-level command sandbox: `off` \| `filesystem` \| `strict` (overrides config) |
 | `BRAVE_API_KEY`   | Brave Search API key             |
 | `TAVILY_API_KEY`  | Tavily Search API key            |
 
@@ -122,6 +123,7 @@ scalix run "generate a migration" --output migration.sql --format patch
 | `/models`          | List active models           |
 | `/model`           | Switch model                 |
 | `/mode`            | Set permission mode          |
+| `/sandbox`         | Set the OS command sandbox (off \| filesystem \| strict) |
 | `/compact`         | Compress context             |
 | `/cost`            | Token usage & cost           |
 | `/budget`          | Budget status                |
@@ -224,7 +226,9 @@ scalix run "generate a migration" --output migration.sql --format patch
 | `notebook_edit`  | Jupyter notebook operations |
 | `monitor`        | Background process output   |
 | `agent`          | Spawn sub-agents            |
-| `add_mcp_server` | Register MCP servers        |
+| `write_artifact`  | Write a reviewable plan / walkthrough / tasklist / summary to `.scalix/artifacts/` |
+| `list_artifacts`  | List previously written artifacts (newest first) |
+| `add_mcp_server` | Register MCP servers |
 
 ## Configuration
 
@@ -255,6 +259,25 @@ Config is stored in `~/.scalix-coder/config.json`.
 | `.scalix/rules/*.md`    | Scoped rules                  |
 | `mcp-services.json`     | MCP server config             |
 
+### Command sandbox (opt-in)
+
+`run_command` can execute inside a kernel-enforced sandbox — the OS-level wall
+behind the logical checks (blocklist, injection detection, path containment).
+Set `commandSandbox` in `~/.scalix-coder/config.json` (or `SCALIX_COMMAND_SANDBOX`):
+
+| Mode         | What it does |
+| ------------ | ------------ |
+| `off`        | Default. No sandbox — behaviour unchanged. |
+| `filesystem` | macOS seatbelt / Linux bubblewrap: writes confined to the workspace + system temp, reads unrestricted, network allowed. |
+| `strict`     | `filesystem` plus no network (unshared netns / seatbelt `deny network*`). For untrusted builds. |
+
+Notes: Windows is not supported — with a mode set there, commands fail closed
+with the reason instead of running unsandboxed. Package managers that cache in
+`$HOME` (pip, cargo) will fail cache writes in `filesystem` mode; that is the
+wall working. The backend binary must exist (`sandbox-exec` on macOS ships with
+the OS; `bwrap` must be installed on Linux) — a missing backend is reported,
+never skipped.
+
 ### MCP servers
 
 Servers listed in `mcp-services.json` (project root, or `.scalix/` as a
@@ -284,6 +307,26 @@ is accepted too, so an existing config can be dropped in unchanged.
 - MCP tools are external, so they require confirmation under the default
   permission mode.
 
+### Scalix Marketplace (`/marketplace`)
+
+Browse the curated plugin catalog and install it in one command:
+
+```
+/marketplace                 featured listings
+/marketplace <query>         search the catalog
+/marketplace info <id>       detail + what an install would write
+/marketplace install <id>    install (stdio MCP needs `--confirm`)
+```
+
+Four artifact kinds are installed into this workspace: **MCP servers**
+(`mcp-services.json`), **skills** (`.scalix/skills/<name>/`), **rules**
+(`.scalix/rules/`) and **subagents** (`.scalix/agents/`). Every listing carries
+a trust tier — ★ official, ✔ verified, · community — and an env-var reference
+is stored by NAME only (you set the value in your environment). The catalog is
+fetched from `https://api.scalix.world/v1/marketplace` (override with
+`SCALIX_MARKETPLACE_URL`); payloads are re-validated before anything is
+written to disk. Full contract: `scalix-cloud/docs/MARKETPLACE.md`.
+
 ## VS Code Extension
 
 Install from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=scalix.scalix) — or from [Open VSX](https://open-vsx.org/extension/scalix/scalix) if you use Cursor, Windsurf, or VSCodium:

package/dist/agent.js

@@ -1,7 +1,7 @@
 import { ApiError } from './api-client.js';
 import { EventEmitter } from 'eventemitter3';
 import { randomUUID } from 'node:crypto';
-import { getToolPermissionWithArgs, getMaxImageSize } from './sandbox.js';
+import { getToolPermissionWithArgs, getMaxImageSize, sandboxPathAsync } from './sandbox.js';
 import { logger } from './logger.js';
 import { DEFAULT_MODELS as FALLBACK_MODELS, DEFAULT_INSTRUCTIONS, DEFAULT_BASE_URL, AGENT_DEFAULTS, TOOL_DEFAULTS, BACKOFF_DEFAULTS, CONTEXT_DEFAULTS, SCALIX_PLATFORM_SECTION, SCALIX_CLOUD_RESOURCES_SECTION, SCALIX_DEPLOY_PLAYBOOK_SECTION, SCALIX_PLATFORM_PLAYBOOK_SECTION, SCALIX_NEUTRAL_POINTER, SCALIX_STEERING_ALWAYS_ON, modelSupportsVision, getModelSpec, maxOutputTokensForRequest, hasExplicitModelSpec } from './constants.js';
 import { estimateMessageTokens as estimateTokenCount, estimateTokens } from './token-counter.js';
@@ -12,6 +12,8 @@ import { AgentReplay } from './agent-replay.js';
 import { loadHooks, runHooks } from './hooks.js';
 import { isWorkspaceTrusted } from './workspace-trust.js';
 import { setAgentToolConfig } from './tools-advanced.js';
+import { setCommandSandboxMode } from './tools.js';
+import { resolveCommandSandboxMode } from './command-sandbox.js';
 import { AgentRegistry, generateAgentId } from './agent-registry.js';
 import { getPreset } from './agent-presets.js';
 import { runVerification, VERIFY_DEFAULTS } from './auto-verify.js';
@@ -170,7 +172,13 @@ export class Agent extends EventEmitter {
     configuredContextTokens;
     toolSelector = null;
     _aborted = false;
+    // Resolved when abort() fires — lets in-flight sleeps (retry backoff, tool
+    // confirmation) return immediately instead of ignoring cancellation.
+    _abortWaiters = new Set();
     _thinkingActive = false;
+    // Reasoning text accumulated across the current turn (all model calls) —
+    // what "what is the agent thinking" renders from.
+    _reasoningText = '';
     replay;
     boardRefresher;
     boardPrimed;
@@ -250,6 +258,11 @@ export class Agent extends EventEmitter {
             workspaceRoot: config.workspaceRoot ?? process.cwd(),
         };
         this.cloudProjectId = config.cloudProjectId ?? process.env.SCALIX_PROJECT ?? undefined;
+        // OS-level command sandbox: the tool module is process-global, so every
+        // front end (CLI, IPC sessions, headless) inherits the mode the moment an
+        // agent is constructed. SCALIX_COMMAND_SANDBOX overrides the config value.
+        // Per-session override is deliberate — this is machine policy, not chat state.
+        setCommandSandboxMode(resolveCommandSandboxMode(config.commandSandbox, process.env.SCALIX_COMMAND_SANDBOX));
         this.contextManager = new ContextManager(config.contextManager);
         // Kept separately because syncContextLimit() overwrites the manager's own
         // value on every read and would otherwise have nothing to fall back to.
@@ -451,8 +464,14 @@ export class Agent extends EventEmitter {
         this.messages = [];
         this.verifyFailCounts.clear();
         this.modelFailures.clear();
+        // The old index points into the discarded history — keeping it would make
+        // the next addOutputFormatInstructions() overwrite an unrelated message.
+        this.outputFormatInstructionIndex = null;
+    }
+    loadMessages(messages) {
+        this.messages = [...messages];
+        this.outputFormatInstructionIndex = null;
     }
-    loadMessages(messages) { this.messages = [...messages]; }
     getInstructions() { return this.config.instructions; }
     setInstructions(instructions) { this.config.instructions = instructions; }
     getPermissionMode() { return this.config.permissionMode; }
@@ -900,6 +919,12 @@ export class Agent extends EventEmitter {
         return {
             apiKey: this.config.apiKey,
             baseUrl: this.client.baseURL,
+            // Sub-agents must inherit the provider itself, not just its URL: without
+            // it a BYOK session's sub-agent would default to provider 'scalix' while
+            // keeping the third-party baseUrl and 404 on <byok-host>/v1/ai/...
+            provider: this.providerId,
+            cloudApiKey: this.cloudApiKey,
+            cloudBaseUrl: this.cloudBaseUrl,
             models: this.config.models,
             permissionMode: this.config.permissionMode,
             confirmToolCall: this.config.confirmToolCall,
@@ -911,8 +936,26 @@ export class Agent extends EventEmitter {
             this._abortController.abort();
             this._abortController = null;
         }
+        const waiters = [...this._abortWaiters];
+        this._abortWaiters.clear();
+        for (const w of waiters)
+            w();
         this.emitThinkingEnd();
     }
+    /**
+     * Sleep that returns early when abort() fires. Unlike a bare setTimeout,
+     * cancellation during retry backoff or a confirmation wait is observed
+     * immediately rather than after the full delay.
+     */
+    abortableSleep(ms) {
+        if (this._aborted)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const waiter = () => { clearTimeout(timer); resolve(); };
+            const timer = setTimeout(() => { this._abortWaiters.delete(waiter); resolve(); }, ms);
+            this._abortWaiters.add(waiter);
+        });
+    }
     removeModel(model) {
         const idx = this.config.models.indexOf(model);
         if (idx !== -1 && this.config.models.length > 1) {
@@ -935,7 +978,11 @@ export class Agent extends EventEmitter {
         const imageParts = [];
         for (const filePath of matches) {
             try {
-                const resolved = path.resolve(process.cwd(), filePath);
+                // @file mentions expand file contents into the prompt — route them
+                // through the same containment as read_file, and resolve against the
+                // configured workspace root (not necessarily process.cwd()).
+                const root = this.config.workspaceRoot ?? process.cwd();
+                const resolved = await sandboxPathAsync(path.resolve(root, filePath));
                 if (isImageFile(filePath)) {
                     const dataUrl = await encodeImageToDataUrl(resolved);
                     imageParts.push({ type: 'image_url', image_url: { url: dataUrl, detail: 'auto' } });
@@ -1051,6 +1098,7 @@ export class Agent extends EventEmitter {
         this.messages.push(userMessage);
         this.emit('message:user', userMessage);
         this._thinkingActive = true;
+        this._reasoningText = '';
         this.emit('thinking:start');
         this.truncateMessages();
         this.replay.record('user_message', { content });
@@ -1137,6 +1185,15 @@ export class Agent extends EventEmitter {
             }
             this.checkInbox();
             turnCount++;
+            // Per-turn metrics reset here so streaming TTFT (and token/duration
+            // counters) reflect the turn that actually produced the final response,
+            // not the first turn of the request.
+            _turnToolDurationMs = 0;
+            _turnLlmStartMs = 0;
+            _turnTtftMs = 0;
+            _firstDeltaSeen = false;
+            _turnInputTokens = 0;
+            _turnOutputTokens = 0;
             let fullText = '';
             const toolCalls = new Map();
             try {
@@ -1211,8 +1268,10 @@ export class Agent extends EventEmitter {
                 // An endpoint that does not carry tool calls over SSE would answer an
                 // agentic turn in prose and lose the calls, so those turns go
                 // non-streaming there and the user watches a spinner instead of output.
-                // Text-only turns stream either way.
-                const useStreaming = !forceNonStreaming && (await this.streamsToolCalls()
+                // Text-only turns stream either way. The probe must never fail a turn:
+                // any error defaults to the conservative non-streaming answer.
+                const streams = await this.streamsToolCalls().catch(() => false);
+                const useStreaming = !forceNonStreaming && (streams
                     ? true
                     : (!apiTools || apiTools.length === 0) && !hasToolMessages);
                 if (useStreaming) {
@@ -1243,6 +1302,20 @@ export class Agent extends EventEmitter {
                                 fullText += delta.content;
                                 this.emit('stream:delta', delta.content, fullText);
                             }
+                            // Reasoning deltas (deepseek-reasoner, glm thinking models,
+                            // OpenRouter :thinking, the Scalix router's thinking_level) were
+                            // dropped — the "what is the agent thinking" display streams
+                            // from these. Some models emit reasoning unconditionally; when
+                            // it arrives after content started, re-open the thinking phase.
+                            const reasoningPiece = delta.reasoning_content ?? delta.reasoning ?? null;
+                            if (reasoningPiece) {
+                                if (!this._thinkingActive) {
+                                    this._thinkingActive = true;
+                                    this.emit('thinking:start');
+                                }
+                                this._reasoningText += reasoningPiece;
+                                this.emit('reasoning:update', this._reasoningText);
+                            }
                             if (delta.tool_calls) {
                                 for (const tc of delta.tool_calls) {
                                     const idx = tc.index ?? toolCalls.size;
@@ -1299,6 +1372,12 @@ export class Agent extends EventEmitter {
                             fullText = choice.message.content;
                             this.emit('stream:delta', fullText, fullText);
                         }
+                        // Non-streaming path carries reasoning the same way.
+                        const msg = choice.message;
+                        if (msg.reasoning || msg.reasoning_content) {
+                            this._reasoningText += String(msg.reasoning_content ?? msg.reasoning ?? '');
+                            this.emit('reasoning:update', this._reasoningText);
+                        }
                         if (choice.message.tool_calls) {
                             for (const tc of choice.message.tool_calls) {
                                 toolCalls.set(toolCalls.size, {
@@ -1381,10 +1460,16 @@ export class Agent extends EventEmitter {
                 this.messages.push(assistantMessage);
                 this.emit('message:assistant', assistantMessage);
                 if (resolvedToolCalls.length > 0) {
-                    for (const call of resolvedToolCalls) {
+                    // Multiple sub-agent spawns in one turn run concurrently — the
+                    // Kilo Code behavior for parallel Task calls. Every spawn is an
+                    // independent `agent` call, so sequencing them only adds wall-clock
+                    // time; any other tool mix stays sequential because write ordering
+                    // matters. Each call still goes through the same permission check,
+                    // confirmation, hooks and result plumbing as a solo call.
+                    const runCall = async (call) => {
                         if (this._aborted) {
                             reqLog.info('Agent aborted, skipping remaining tool calls');
-                            break;
+                            return;
                         }
                         const tool = this.config.tools.find((t) => (t.function?.name || t.name) === call.name);
                         let result;
@@ -1399,7 +1484,7 @@ export class Agent extends EventEmitter {
                                 this.emit('tool:blocked', call.name, 'Blocked by hook');
                                 this.messages.push({ role: 'tool', content: JSON.stringify(result), tool_call_id: call.id, name: call.name });
                                 this.emit('tool:result', call.name, result);
-                                continue;
+                                return;
                             }
                         }
                         // Parse tool arguments once, up front, so the permission decision,
@@ -1419,7 +1504,7 @@ export class Agent extends EventEmitter {
                                 this.emit('tool:blocked', call.name, 'Malformed arguments');
                                 this.messages.push({ role: 'tool', content: JSON.stringify(result), tool_call_id: call.id, name: call.name });
                                 this.emit('tool:result', call.name, result);
-                                continue;
+                                return;
                             }
                         }
                         // Args-aware permission so scoped allow/deny rules are enforced.
@@ -1435,7 +1520,7 @@ export class Agent extends EventEmitter {
                                 name: call.name,
                             });
                             this.emit('tool:result', call.name, result);
-                            continue;
+                            return;
                         }
                         if (permission === 'ask') {
                             if (!this.config.confirmToolCall) {
@@ -1453,24 +1538,36 @@ export class Agent extends EventEmitter {
                                         name: call.name,
                                     });
                                     this.emit('tool:result', call.name, result);
-                                    continue;
+                                    return;
                                 }
                             }
                             else {
                                 const args = parsedArgs;
                                 const CONFIRM_TIMEOUT_MS = 300_000;
                                 const confirmed = await new Promise((resolve) => {
-                                    const timer = setTimeout(() => resolve(false), CONFIRM_TIMEOUT_MS);
-                                    this.config.confirmToolCall(call.name, args).then((v) => {
+                                    let settled = false;
+                                    const done = (v) => {
+                                        if (settled)
+                                            return;
+                                        settled = true;
                                         clearTimeout(timer);
+                                        this._abortWaiters.delete(waiter);
                                         resolve(v);
+                                    };
+                                    // An abort during the wait denies the tool immediately; the
+                                    // loop's `if (this._aborted) break` below then exits —
+                                    // otherwise the loop parks here for up to 5 minutes.
+                                    const waiter = () => done(false);
+                                    const timer = setTimeout(() => done(false), CONFIRM_TIMEOUT_MS);
+                                    this._abortWaiters.add(waiter);
+                                    this.config.confirmToolCall(call.name, args).then((v) => {
+                                        done(v);
                                     }).catch(() => {
-                                        clearTimeout(timer);
-                                        resolve(false);
+                                        done(false);
                                     });
                                 });
                                 if (this._aborted)
-                                    break;
+                                    return;
                                 if (!confirmed) {
                                     result = { denied: true, message: `User denied execution of ${call.name}` };
                                     reqLog.info('Tool call denied by user', { tool: call.name });
@@ -1482,7 +1579,7 @@ export class Agent extends EventEmitter {
                                         name: call.name,
                                     });
                                     this.emit('tool:result', call.name, result);
-                                    continue;
+                                    return;
                                 }
                             }
                         }
@@ -1529,13 +1626,7 @@ export class Agent extends EventEmitter {
                                     workspaceRoot: this.config.workspaceRoot ?? process.cwd(),
                                     permissionMode: this.config.permissionMode,
                                     agentId: this.agentId,
-                                    agentConfig: {
-                                        apiKey: this.config.apiKey,
-                                        baseUrl: this.client.baseURL,
-                                        models: this.config.models,
-                                        permissionMode: this.config.permissionMode,
-                                        confirmToolCall: this.config.confirmToolCall,
-                                    },
+                                    agentConfig: this.getAgentConfig(),
                                 }), toolTimeout, call.name);
                                 const toolDurationMs = Date.now() - toolStart;
                                 _turnToolDurationMs += toolDurationMs;
@@ -1675,6 +1766,20 @@ export class Agent extends EventEmitter {
                                 }
                             }
                         }
+                    };
+                    if (resolvedToolCalls.length > 1 && resolvedToolCalls.every((c) => c.name === 'agent')) {
+                        await Promise.all(resolvedToolCalls.map((c) => runCall(c).catch((err) => {
+                            reqLog.error('Sub-agent spawn failed', { tool: c.name, error: err?.message });
+                        })));
+                    }
+                    else {
+                        for (const call of resolvedToolCalls) {
+                            if (this._aborted) {
+                                reqLog.info('Agent aborted, skipping remaining tool calls');
+                                break;
+                            }
+                            await runCall(call);
+                        }
                     }
                     if (this._aborted)
                         return '[interrupted]';
@@ -1721,6 +1826,15 @@ export class Agent extends EventEmitter {
             }
             catch (err) {
                 this._abortController = null;
+                // A user-initiated abort is not a model failure — recording it would
+                // open the circuit breaker after a few Escapes and silently rotate
+                // the user's model. An abort mid-request mirrors the between-iteration
+                // contract: deregister and return '[interrupted]'.
+                if (this._aborted || err?.name === 'AbortError') {
+                    reqLog.info('Agent aborted during request');
+                    this.deregisterFromRegistry('aborted');
+                    return '[interrupted]';
+                }
                 this.recordModelFailure(currentModel);
                 const errMsg = (err?.message || '').toLowerCase();
                 const isStreamError = errMsg.includes('stream') || errMsg.includes('sse') || errMsg.includes('no response body');
@@ -1728,7 +1842,7 @@ export class Agent extends EventEmitter {
                 if (isStreamError && !forceNonStreaming) {
                     forceNonStreaming = true;
                     reqLog.warn('Streaming failed, retrying with non-streaming mode', { error: err.message });
-                    await sleep(500);
+                    await this.abortableSleep(500);
                     continue;
                 }
                 if (this.shouldFallbackToNext(err) && retryAttempt < this.config.maxRetries && turnCount < this.config.maxSteps) {
@@ -1749,7 +1863,7 @@ export class Agent extends EventEmitter {
                         status: err instanceof ApiError ? err.status : undefined,
                         reason: err.message,
                     });
-                    await sleep(delay);
+                    await this.abortableSleep(delay);
                     currentModel = this.pickModel();
                     continue;
                 }

package/dist/api-client.js

@@ -12,6 +12,62 @@ export class ApiError extends Error {
         this.retryAfterMs = retryAfterMs;
     }
 }
+// ─── Request body guards ───
+// Two confirmed ways a request dies with the gateway's generic
+// "invalid JSON body" (400) before the model ever sees it:
+//
+// 1. A body over the wall. The gateway and the proxies in front of it
+//    refuse bodies past ~200KB — measured 192KB passing and 256KB
+//    failing — and the refusal is "invalid JSON body", not 413, which
+//    reads like a truncated stream. A single tool result is allowed to
+//    reach 500K chars, so one fat command output is enough to cross it.
+//
+// 2. A lone surrogate escape. JSON.stringify serializes half of a cut
+//    surrogate pair as \ud83d. JavaScript's JSON.parse accepts that;
+//    strict parsers (serde_json, Go's encoding/json) reject it. undici
+//    would silently map it to U+FFFD on the wire anyway, so the model
+//    never saw the half a character either.
+//
+// Both are fixed here rather than at every truncation site: the body
+// is sanitized, and tool results are shrunk until the request fits.
+const MAX_BODY_BYTES = 180_000;
+function utf8ByteLength(s) {
+    if (typeof Buffer !== 'undefined')
+        return Buffer.byteLength(s, 'utf8');
+    return new TextEncoder().encode(s).length;
+}
+function sanitizeLoneSurrogates(body) {
+    return body.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, '\uFFFD');
+}
+/** Cut tool-result contents, largest first, until the serialized
+ *  request fits. Tool results are the bulk of an oversized request,
+ *  and trimming their text keeps tool_call/result pairing intact —
+ *  dropping whole messages would break the pairing the wire requires.
+ *  Rounds, not one pass: a single command output can be many times
+ *  the wall, so the largest result is re-halved until the check
+ *  converges. */
+function shrinkToFit(req, maxBytes) {
+    let out = req;
+    for (;;) {
+        if (utf8ByteLength(JSON.stringify(out)) <= maxBytes)
+            return out;
+        const biggest = out.messages
+            .map((m, i) => ({ m, i }))
+            .filter(({ m }) => m.role === 'tool' && typeof m.content === 'string' && m.content.length > 400)
+            .sort((a, b) => b.m.content.length - a.m.content.length)[0];
+        // Nothing left worth cutting — the request is over for a reason
+        // this pass cannot fix, so send what remains.
+        if (!biggest)
+            return out;
+        const text = biggest.m.content;
+        const messages = [...out.messages];
+        messages[biggest.i] = {
+            ...biggest.m,
+            content: text.slice(0, Math.max(200, Math.floor(text.length / 2))) + '\n...[trimmed so the request fits the endpoint]',
+        };
+        out = { ...out, messages };
+    }
+}
 /**
  * Parse a Retry-After header value into milliseconds. Accepts both forms from
  * RFC 9110: delta-seconds ("120") and HTTP-date. Returns undefined for absent
@@ -31,11 +87,13 @@ export function parseRetryAfter(value) {
 // Per-request abort. 300s matches the platform's own proxy walls; the old
 // 120s default aborted the client before a slow first token could arrive on
 // CPU-served models (the request was fine, we hung up on it). For reference,
-// the OpenAI and Anthropic SDKs both default to 600s.
+// the OpenAI and Anthropic SDKs both default to 600s. The default applies
+// when SCALIX_REQUEST_TIMEOUT_MS is unset — 0 would mean "no timeout", which
+// lets a wedged connection hang the turn forever.
 const DEFAULT_TIMEOUT_MS = (() => {
     const v = process.env.SCALIX_REQUEST_TIMEOUT_MS;
     const n = v ? parseInt(v, 10) : NaN;
-    return Number.isFinite(n) ? n : 0;
+    return Number.isFinite(n) && n > 0 ? n : 300_000;
 })();
 // The capability probe only decides whether a turn streams. It must never be
 // the reason a turn is slow to start, so it gives up quickly and falls back to
@@ -123,7 +181,8 @@ export class ScalixClient {
         // as many times as there are narrowings left.
         for (;;) {
             const prepared = this.prepareRequest(req);
-            const body = JSON.stringify(prepared);
+            const wire = shrinkToFit(prepared, MAX_BODY_BYTES);
+            const body = sanitizeLoneSurrogates(JSON.stringify(wire));
             const timeoutSignal = this.timeoutMs > 0 ? AbortSignal.timeout(this.timeoutMs) : undefined;
             const combined = signal && timeoutSignal ? AbortSignal.any([signal, timeoutSignal]) : (signal || timeoutSignal);
             const response = await fetch(url, {