scalix 1.5.2 → 1.6.0

package/dist/cli.js

@@ -33,6 +33,8 @@ import { checkForUpdate, getUpdateBanner, performUpdate } from './update-checker
 import { loadConfig, loadGlobalConfig, saveConfig, isConfigured, resolveActiveProvider, DEFAULT_LIMITS, THINKING_MODES } from './settings.js';
 import { fetchByokModels } from './providers/openai.js';
 import { getModeDescription, PERMISSION_MODES, setSandboxRoot, checkScopedPermission, getScopedPermissionRules } from './sandbox.js';
+import { getCommandSandboxMode, setCommandSandboxMode } from './tools.js';
+import { COMMAND_SANDBOX_MODES } from './command-sandbox.js';
 import { buildProjectIndex, indexToContext } from './project-index.js';
 import { collectGitInfo, gitInfoToContext } from './git-context.js';
 import { loadMemory, autoDetectConventions, saveMemory, memoryToContext, addNote, detectCorrection } from './project-memory.js';
@@ -52,6 +54,7 @@ import { stringWidth, truncateText } from './text-utils.js';
 import { isWorkspaceTrusted, trustWorkspace, hasProjectExecSurface } from './workspace-trust.js';
 import { setLocalOriginApprover } from './browser-access.js';
 import { fetchMe, fetchCloudTools, groupCloudTools, filterCatalogByScopes, cloudKeyRemedy, CONSOLE_KEYS_URL } from './cloud.js';
+import { listMarketplaceListings, getMarketplaceListing, installMarketplaceListing } from './marketplace.js';
 logger.setLevel('silent');
 // Promisified async child_process helpers (keep the TUI responsive vs execSync).
 const execFileAsync = promisify(execFile);
@@ -342,9 +345,13 @@ function initAgent(config) {
     }).catch((err) => {
         logger.warn('Failed to build enhanced instructions', { error: err.message });
     });
-    loadCustomCommands(process.cwd()).then((cmds) => {
-        customCommands = cmds;
-    }).catch((err) => { logger.warn('Failed to load custom commands', { error: err.message }); });
+    // Custom command templates can carry !`cmd` inline-bash, which executes
+    // shell — only load them from a trusted workspace, like plugins/hooks.
+    if (isWorkspaceTrusted(process.cwd())) {
+        loadCustomCommands(process.cwd()).then((cmds) => {
+            customCommands = cmds;
+        }).catch((err) => { logger.warn('Failed to load custom commands', { error: err.message }); });
+    }
     loadSkills(process.cwd()).then((skills) => {
         loadedSkills = skills;
     }).catch((err) => { logger.warn('Failed to load skills', { error: err.message }); });
@@ -2769,6 +2776,30 @@ function App({ config }) {
             }
             return true;
         }
+        if (cmd === '/sandbox') {
+            const arg = text.split(' ')[1]?.toLowerCase();
+            const current = getCommandSandboxMode();
+            if (arg && COMMAND_SANDBOX_MODES.includes(arg)) {
+                setCommandSandboxMode(arg);
+                loadGlobalConfig().then(cfg => {
+                    cfg.commandSandbox = arg;
+                    return saveConfig(cfg);
+                }).catch((err) => { logger.warn('Failed to save config', { error: err.message }); });
+                const why = arg === 'off'
+                    ? 'commands run unsandboxed'
+                    : arg === 'filesystem'
+                        ? 'writes confined to the workspace + temp; network allowed'
+                        : 'writes confined to the workspace + temp; network denied';
+                add('system', `Command sandbox: ${arg.toUpperCase()} — ${why}. Applies to new run_command calls immediately.`);
+            }
+            else if (!arg) {
+                add('system', `Command sandbox: ${current.toUpperCase()} — usage: /sandbox <off|filesystem|strict>. filesystem = workspace-only writes, strict = also no network.`);
+            }
+            else {
+                add('system', `Unknown sandbox mode "${arg}". Options: off, filesystem, strict.`);
+            }
+            return true;
+        }
         if (cmd === '/preset') {
             const arg = text.split(' ')[1]?.toLowerCase();
             if (arg) {
@@ -2826,11 +2857,107 @@ function App({ config }) {
             }
             agent.connectMcpServer({ serverLabel: p[1], serverUrl: p[2] }).then((s) => {
                 add(s.state === 'connected' ? 'system' : 'error', s.state === 'connected'
-                    ? `MCP connected: ${p[1]} \u2192 ${p[2]} (${s.toolCount} tool${s.toolCount === 1 ? '' : 's'})`
+                    ? `MCP connected: ${p[1]} → ${p[2]} (${s.toolCount} tool${s.toolCount === 1 ? '' : 's'})`
                     : `MCP ${p[1]} failed: ${s.error ?? 'unknown error'}`);
             });
             return true;
         }
+        if (cmd === '/marketplace') {
+            // The Scalix curated catalog (docs/MARKETPLACE.md). Server data is
+            // untrusted input: the client module re-validates every listing before
+            // it reaches disk, and a stdio listing never installs without an
+            // explicit --confirm flag (it spawns a local process).
+            const p = text.split(' ').filter(Boolean);
+            const trustBadge = (t) => t === 'official' ? '★' : t === 'verified' ? '✔' : '·';
+            const kindBadge = (k) => k === 'mcp' ? 'MCP' : k === 'skill' ? 'skill' : k === 'rule' ? 'rule' : 'agent';
+            const renderList = (list) => list.length
+                ? list.map(l => `${trustBadge(l.trust)} ${l.id} [${kindBadge(l.kind)} v${l.version || '?'}] — ${l.summary}`).join('\n')
+                : 'No listings matched.';
+            if (p.length === 1) {
+                setIsLoading(true);
+                setStatus('thinking');
+                listMarketplaceListings({ limit: 12 }).then((list) => {
+                    add('system', 'Scalix Marketplace — featured catalog:\n' + renderList(list) +
+                        '\n\n/marketplace <query> to search · /marketplace info <id> · /marketplace install <id>');
+                }).catch((err) => {
+                    add('error', `Marketplace unavailable: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
+            }
+            if (p[1] === 'install') {
+                const id = p[2];
+                if (!id) {
+                    add('system', 'Usage: /marketplace install <id> [--confirm]');
+                    return true;
+                }
+                const confirmStdio = p.includes('--confirm');
+                setIsLoading(true);
+                setStatus('thinking');
+                getMarketplaceListing(id).then((detail) => {
+                    return installMarketplaceListing(detail, { confirmStdio }).then((result) => {
+                        if (result.success) {
+                            add('system', result.message);
+                            const envNote = detail.payload?.kind === 'mcp' && detail.payload.requiredEnv?.length
+                                ? `\nSet ${detail.payload.requiredEnv.join(', ')} in your environment, then /mcp to connect.`
+                                : '';
+                            add('system', envNote.trim());
+                        }
+                        else {
+                            add('error', `Install failed: ${result.error}`);
+                        }
+                    });
+                }).catch((err) => {
+                    add('error', `Install failed: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
+            }
+            if (p[1] === 'info') {
+                const id = p[2];
+                if (!id) {
+                    add('system', 'Usage: /marketplace info <id>');
+                    return true;
+                }
+                setIsLoading(true);
+                setStatus('thinking');
+                getMarketplaceListing(id).then((detail) => {
+                    const payload = detail.payload;
+                    const lines = [
+                        `${detail.name} — ${detail.trust} · v${detail.version} by ${detail.author || 'unknown'}`,
+                        detail.summary,
+                    ];
+                    if (payload?.kind === 'mcp') {
+                        lines.push(payload.transport === 'http'
+                            ? `Remote MCP over https → ${payload.serverUrl}`
+                            : `Local MCP (stdio) → ${payload.command} ${(payload.args ?? []).join(' ')}`.trim());
+                        if (payload.requiredEnv?.length)
+                            lines.push(`Requires env: ${payload.requiredEnv.join(', ')}`);
+                    }
+                    else if (payload?.kind === 'skill') {
+                        lines.push(`Writes .scalix/skills/${payload.name}/ (${payload.files.length} file(s))`);
+                    }
+                    else if (payload) {
+                        lines.push(`Writes .scalix/${payload.kind === 'rule' ? 'rules' : 'agents'}/${payload.fileName}`);
+                    }
+                    else {
+                        lines.push('No installable payload on this listing.');
+                    }
+                    add('system', lines.join('\n'));
+                }).catch((err) => {
+                    add('error', `Marketplace unavailable: ${err.message}`);
+                }).finally(() => { setIsLoading(false); setStatus('ready'); });
+                return true;
+            }
+            const query = p.slice(1).join(' ');
+            setIsLoading(true);
+            setStatus('thinking');
+            listMarketplaceListings({ q: query, limit: 12 }).then((list) => {
+                add('system', `Scalix Marketplace — "${query}":\n` + renderList(list) +
+                    '\n\n/marketplace info <id> · /marketplace install <id>');
+            }).catch((err) => {
+                add('error', `Marketplace unavailable: ${err.message}`);
+            }).finally(() => { setIsLoading(false); setStatus('ready'); });
+            return true;
+        }
         if (cmd === '/index') {
             setIsLoading(true);
             setStatus('thinking');

package/dist/command-sandbox.js

@@ -0,0 +1,146 @@
+/**
+ * OS-level command sandbox — the outer wall behind the logical checks in
+ * sandbox.ts. When enabled, run_command executes inside a kernel-enforced
+ * sandbox instead of a bare shell:
+ *
+ *   filesystem  — writes confined to the workspace + system temp; network allowed
+ *   strict      — filesystem confinement PLUS no network (Antigravity's
+ *                 strict-mode equivalent; also the mode to run untrusted builds in)
+ *
+ * Backends:
+ *   macOS  — sandbox-exec (seatbelt). Deprecated by Apple but still present and
+ *            used widely; the profile denies file-writes outside the allowlist.
+ *   Linux  — bubblewrap (bwrap). Root filesystem read-only, workspace/tmp bound
+ *            writable; strict mode unshares the network namespace.
+ *   Windows — not supported: the tool fails closed with the reason rather than
+ *            silently running unsandboxed.
+ *
+ * Mode is opt-in: `commandSandbox` in ~/.scalix-coder/config.json, overridden by
+ * SCALIX_COMMAND_SANDBOX (off|filesystem|strict). Default off — this must never
+ * change behaviour for an existing install without the user asking for it.
+ *
+ * Trades: package managers that cache into $HOME (pip, cargo) will fail to
+ * write their caches in filesystem mode. That is the point of the wall; the
+ * agent sees the EACCES and can tell the user.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export const COMMAND_SANDBOX_MODES = ['off', 'filesystem', 'strict'];
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+/**
+ * Resolve the effective mode. Env wins over config so an operator can force a
+ * policy without touching the user's config file; an invalid value anywhere
+ * resolves to 'off' (never guesses upward).
+ */
+export function resolveCommandSandboxMode(configValue, envValue) {
+    const fromEnv = (envValue ?? '').trim().toLowerCase();
+    if (fromEnv) {
+        return COMMAND_SANDBOX_MODES.includes(fromEnv) ? fromEnv : 'off';
+    }
+    const fromConfig = typeof configValue === 'string' ? configValue.trim().toLowerCase() : '';
+    if (fromConfig) {
+        return COMMAND_SANDBOX_MODES.includes(fromConfig) ? fromConfig : 'off';
+    }
+    return 'off';
+}
+/** Seatbelt profile: baseline allow, deny all writes, re-allow workspace + temp. */
+export function buildSeatbeltProfile(mode, workspace, tmp) {
+    const q = (p) => p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const lines = [
+        '(version 1)',
+        '(allow default)',
+        '(deny file-write*)',
+        `(allow file-write*`,
+        `  (subpath "${q(workspace)}")`,
+        `  (subpath "${q(tmp)}")`,
+        // macOS temp roots resolve through /private symlinks; seatbelt matches the
+        // literal path, so both spellings are allowlisted.
+        `  (regex #"^/(private/)?var/folders/")`,
+        `  (literal "/dev/null")`,
+        `  (literal "/dev/zero")`,
+        `  (literal "/dev/dtrace-helper")`,
+        `)`,
+    ];
+    if (mode === 'strict') {
+        lines.push('(deny network*)');
+    }
+    return lines.join('\n') + '\n';
+}
+/** Bubblewrap argv prefix: root read-only, workspace + /tmp writable. */
+export function buildBubblewrapArgs(mode, workspace) {
+    const args = [
+        '--ro-bind', '/', '/',
+        '--bind', workspace, workspace,
+        '--bind', '/tmp', '/tmp',
+        '--dev', '/dev',
+        '--proc', '/proc',
+        '--tmpfs', '/run',
+    ];
+    if (mode === 'strict') {
+        args.push('--unshare-net');
+    }
+    return args;
+}
+function findOnPath(name) {
+    const dirs = (process.env.PATH || '').split(path.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, name);
+        try {
+            if (fs.statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* next */
+        }
+    }
+    return null;
+}
+/**
+ * Build the sandbox wrap for one command execution, or an error explaining why
+ * it cannot run (missing backend binary, unsupported platform). Pure aside from
+ * filesystem availability probes — safe to call per command.
+ */
+export function buildSandboxWrap(mode, workspace, shell) {
+    if (mode === 'off')
+        return { ok: false, error: 'sandbox disabled' };
+    if (process.platform === 'win32') {
+        return { ok: false, error: 'the command sandbox is not supported on Windows — set commandSandbox to "off" in ~/.scalix-coder/config.json or unset SCALIX_COMMAND_SANDBOX' };
+    }
+    const cwd = path.resolve(workspace);
+    if (process.platform === 'darwin') {
+        if (!fs.existsSync(SANDBOX_EXEC)) {
+            return { ok: false, error: 'sandbox-exec was not found at /usr/bin/sandbox-exec — set commandSandbox to "off" to run without the sandbox' };
+        }
+        return {
+            ok: true,
+            wrap: {
+                execPath: SANDBOX_EXEC,
+                // -f (profile file) not -p: the profile embeds absolute paths, and a
+                // workspace path containing quotes must never be interpolated into an
+                // inline profile string. The caller writes the profile to disk.
+                args: ['-f', '@PROFILE@', shell.path, ...shell.args, '@COMMAND@'],
+                profile: buildSeatbeltProfile(mode, cwd, os.tmpdir()),
+                backend: 'seatbelt',
+            },
+        };
+    }
+    // linux and other unix
+    const bwrap = findOnPath('bwrap');
+    if (!bwrap) {
+        return { ok: false, error: 'bubblewrap (bwrap) is not on PATH — install it (e.g. apt install bubblewrap) or set commandSandbox to "off"' };
+    }
+    return {
+        ok: true,
+        wrap: {
+            execPath: bwrap,
+            args: [...buildBubblewrapArgs(mode, cwd), '--', shell.path, ...shell.args, '@COMMAND@'],
+            backend: 'bubblewrap',
+        },
+    };
+}
+/** Splice the real command (and, on darwin, the profile file) into a wrap. */
+export function materializeWrap(wrap, command, profilePath) {
+    const args = wrap.args.map((a) => (a === '@COMMAND@' ? command : a === '@PROFILE@' ? (profilePath ?? '') : a));
+    return { execPath: wrap.execPath, args };
+}

package/dist/commands.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, PROJECT_CONFIG_DIR } from './constants.js';
+import { sanitizeEnvForCommand, sandboxPath } from './sandbox.js';
 const COMMAND_DIRS = PROJECT_LOOKUP_DIRS.map(d => `${d}/commands`);
 function parseFrontmatter(content) {
     const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
@@ -62,12 +63,16 @@ export async function loadCustomCommands(cwd = process.cwd()) {
 }
 function expandFileReferences(text, cwd) {
     return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
-        // Reject path traversal so a command file can't pull in files outside the
-        // project via `@../../etc/passwd`.
-        if (filePath.split(/[\\/]/).includes('..')) {
-            return `@${filePath} (path traversal blocked)`;
-        }
+        // @file reads go into the prompt, so they must respect the same sandbox as
+        // read_file: `..` segments, absolute paths outside the project, and
+        // symlinks pointing out are all blocked by sandboxPath().
         const resolved = path.resolve(cwd, filePath);
+        try {
+            sandboxPath(resolved);
+        }
+        catch {
+            return `@${filePath} (outside project — blocked)`;
+        }
         if (!existsSync(resolved))
             return `@${filePath} (file not found)`;
         try {
@@ -82,7 +87,14 @@ function expandFileReferences(text, cwd) {
 function expandInlineBash(text) {
     return text.replace(/!`([^`]+)`/g, (_match, command) => {
         try {
-            return execSync(command, { encoding: 'utf-8', timeout: 10_000 }).trim();
+            // Command templates come from project files. Strip credential-bearing
+            // variables from the child environment (same policy as hooks and
+            // run_command) so a repo-supplied command cannot read API keys.
+            return execSync(command, {
+                encoding: 'utf-8',
+                timeout: 10_000,
+                env: sanitizeEnvForCommand(),
+            }).trim();
         }
         catch (err) {
             return `(command failed: ${err.message})`;

package/dist/constants.js

@@ -76,6 +76,9 @@ export const CORE_INSTRUCTIONS = `You are an expert coding assistant. You write
 - Write no comments unless the WHY is non-obvious. Well-named code documents itself.
 - Prefer simple, readable solutions over clever ones.
 
+## Artifacts
+- For multi-step work, write an implementation plan with write_artifact (type "plan") before editing, and a walkthrough (type "walkthrough") when the task is done. Use "tasklist" for checklists the user should review, "summary" for research findings. Keep them concise — they are the review surface, not a diary.
+
 ## Safety
 - Never modify files outside the working directory.
 - Never expose API keys, secrets, or credentials in code.
@@ -452,6 +455,9 @@ export const PRIVATE_NETWORK_HOSTNAMES = new Set([
     '::', '[::]', '0:0:0:0:0:0:0:1', '[0:0:0:0:0:0:0:1]',
     // common cloud metadata endpoints (also covered by 169.254/CIDR, listed for clarity)
     'metadata.google.internal', 'metadata',
+    // Alibaba Cloud ECS instance metadata sits outside every RFC-1918 range and
+    // outside 169.254/16 — without this entry it is reachable as a "public" host.
+    '100.100.100.200',
 ]);
 export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
@@ -463,6 +469,8 @@ export const PRIVATE_NETWORK_CIDRS = [
     /^172\.(1[6-9]|2\d|3[01])\./,
     /^192\.168\./,
     /^169\.254\./,
+    // Alibaba Cloud instance metadata (see hostname note above).
+    /^100\.100\.100\.200$/,
     /^\[?fe80:/i,
     /^\[?fc00:/i,
     /^\[?fd[0-9a-f]{2}:/i,

package/dist/cost-tracker.js

@@ -77,7 +77,7 @@ export class CostTracker {
             // only attaches x-scalix-cost-cents to non-streaming responses (the
             // headers are already flushed by the time a stream's usage frame
             // arrives), so a streamed session simply never learns the figure.
-            lines.push(provider === 'openai'
+            lines.push(provider && provider !== 'scalix'
                 ? 'Est. cost: not reported by your endpoint — check your provider\'s billing dashboard.'
                 : 'Est. cost: not reported on streamed turns — see console.scalix.world → Billing.');
         }

package/dist/headless.js

@@ -1,7 +1,7 @@
 import readline from 'node:readline';
 import fs from 'node:fs/promises';
 import { execSync } from 'node:child_process';
-import { createAgent } from './agent.js';
+import { createAgent, REPORTED_ERROR } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
 import { memoryTools } from './tools-memory.js';
@@ -241,7 +241,9 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         fullResponse = await agent.send(prompt);
     }
     catch (err) {
-        console.error(`Error: ${err.message}`);
+        // The agent's 'error' event already printed this — don't print twice.
+        if (!err?.[REPORTED_ERROR])
+            console.error(`Error: ${err.message}`);
         if (beforeExit)
             await beforeExit();
         process.exit(1);
@@ -359,7 +361,11 @@ async function runInteractive() {
             return Promise.resolve('/exit');
         return new Promise((resolve) => rl.question(question, resolve));
     }
-    const customCmds = await loadCustomCommands(process.cwd());
+    // Command templates can carry !`cmd` inline-bash — trust-gate like plugins.
+    const customCmds = isWorkspaceTrusted() ? await loadCustomCommands(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project custom commands skipped (untrusted workspace).\n');
+    }
     const agent = createAgent({
         apiKey,
         baseUrl,
@@ -643,7 +649,18 @@ async function runInteractive() {
             const cheapModel = pickCheapestModel(agent.getModels());
             console.log(`\nDelegating to sub-agent (${shortModel(cheapModel)})...`);
             try {
-                const result = await spawnSubAgent({ apiKey: apiKey, baseUrl, models: agent.getModels() }, prompt, { model: cheapModel, tools: 'read-only', maxSteps: 10 });
+                const result = await spawnSubAgent({
+                    apiKey: apiKey,
+                    baseUrl,
+                    // Inherit the parent's provider + cloud credentials so a BYOK
+                    // session delegates through the same endpoint dialect it runs on;
+                    // without `provider` the sub-agent defaults to the Scalix client
+                    // and 404s on every request against a third-party base URL.
+                    provider: active.provider,
+                    cloudApiKey: active.cloudApiKey,
+                    cloudBaseUrl: active.cloudBaseUrl,
+                    models: agent.getModels(),
+                }, prompt, { model: cheapModel, tools: 'read-only', maxSteps: 10 });
                 console.log(`\n${result.response}\n`);
                 console.log(`\x1b[36mSub-agent: ${result.steps} steps, ~${result.tokenEstimate} tokens\x1b[0m\n`);
             }

package/dist/ipc-server.js

@@ -28,13 +28,15 @@ import { voiceTools } from './tools-voice.js';
 import { browserTools, closeBrowser, setBrowserFrameSink } from './tools-browser.js';
 import { setLocalOriginApprover, listApprovedLocalOrigins, forgetLocalOrigin } from './browser-access.js';
 import { connectMcpServers } from './mcp.js';
-import { loadConfig, resolveActiveProvider, DEFAULT_LIMITS } from './settings.js';
+import { loadConfig, resolveActiveProvider, resolveProviderByKey, summarizeProviders, DEFAULT_LIMITS } from './settings.js';
 import { PERMISSION_MODES } from './sandbox.js';
+import { isProviderId } from './providers/index.js';
 import { discoverPlugins, getPluginTools } from './plugins.js';
 import { isWorkspaceTrusted } from './workspace-trust.js';
 import { DEFAULT_MODELS, DEFAULT_INSTRUCTIONS, ENV_MODEL, fetchModelSpecs, registerUserModels, normalizeModelId, VERSION } from './constants.js';
 import { loadMemory, autoDetectConventions, saveMemory, addNote, detectCorrection } from './project-memory.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
+import { AgentRegistry } from './agent-registry.js';
 // Server→client requests awaiting an answer. Keyed by request id; the value is
 // resolved with whatever `result` object the client sends back. confirmTool was
 // the only user of this for a long time — the browser agent's local-origin
@@ -169,6 +171,7 @@ export async function runIpcServer() {
         agent.on('turn:summary', (i) => ev('turn:summary', i));
         agent.on('thinking:start', () => ev('thinking:start'));
         agent.on('thinking:end', () => ev('thinking:end'));
+        agent.on('reasoning:update', (t) => ev('reasoning:update', { text: t }));
         agent.on('usage', (d) => ev('usage', d));
         agent.on('error', (e) => ev('error', { message: e.message }));
         agent.on('context:compress', (i) => ev('context:compress', i));
@@ -181,13 +184,18 @@ export async function runIpcServer() {
         if (sessions.size >= MAX_SESSIONS) {
             throw new Error(`Session limit reached (${MAX_SESSIONS}) — close a chat tab first.`);
         }
-        // Per-session provider/creds: overrides let each tab use a different AI provider
-        // (Scalix, OpenAI, etc.) with its own API key, base URL, and model selection.
+        // Per-session provider/creds: overrides let each tab use a different AI
+        // provider (Scalix, any configured BYOK registry entry) with its own API
+        // key, base URL, and model selection. An explicit provider key resolves its
+        // credentials from the registry, so the front end only has to name it.
+        const overrideActive = override?.provider
+            ? resolveProviderByKey(config, override.provider)
+            : null;
         const sessionProvider = override?.provider ?? active.provider;
-        const sessionApiKey = override?.apiKey ?? apiKey;
-        const sessionBaseUrl = override?.baseUrl ?? baseUrl;
-        const sessionCloudApiKey = override?.cloudApiKey ?? active.cloudApiKey;
-        const sessionCloudBaseUrl = override?.cloudBaseUrl ?? active.cloudBaseUrl;
+        const sessionApiKey = override?.apiKey ?? overrideActive?.apiKey ?? apiKey;
+        const sessionBaseUrl = override?.baseUrl ?? overrideActive?.baseUrl ?? baseUrl;
+        const sessionCloudApiKey = override?.cloudApiKey ?? overrideActive?.cloudApiKey ?? active.cloudApiKey;
+        const sessionCloudBaseUrl = override?.cloudBaseUrl ?? overrideActive?.cloudBaseUrl ?? active.cloudBaseUrl;
         const sessionModels = override?.model ?? selectedModels;
         const sessionPermissionMode = override?.permissionMode ?? permissionMode;
         const agent = createAgent({
@@ -236,7 +244,7 @@ export async function runIpcServer() {
     // Signal ready with capability info. `version` lets the extension detect
     // engine/extension drift (a globally-installed CLI can lag the bundled one).
     // `multiSession` tells the extension it may open parallel chat sessions.
-    write({ type: 'event', event: 'ready', data: { version: VERSION, tools: allTools.length, models: selectedModels, permissionMode, multiSession: true } });
+    write({ type: 'event', event: 'ready', data: { version: VERSION, tools: allTools.length, models: selectedModels, permissionMode, multiSession: true, provider: active.provider, providers: summarizeProviders(config) } });
     if (defaultSession.agent.getSkippedHookCount() > 0) {
         process.stderr.write(`IPC: project hooks skipped (untrusted workspace): ${defaultSession.agent.getSkippedHookCount()}\n`);
     }
@@ -257,6 +265,13 @@ export async function runIpcServer() {
         }
     })
         .catch(err => { process.stderr.write(`IPC: MCP startup failed: ${err?.message || err}\n`); });
+    // Sub-agent lifecycle → the IDE's Agents tab. The registry is a process-wide
+    // singleton (the session agents and every spawned sub-agent register in it),
+    // so hook it once here and broadcast each spawn/completion as an event.
+    const registry = AgentRegistry.getInstance();
+    const subagentEvent = (entry) => write({ type: 'event', event: 'subagent', data: entry });
+    registry.on('agent:spawned', subagentEvent);
+    registry.on('agent:completed', subagentEvent);
     // Process JSONL from stdin — session-routed requests
     const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
     rl.on('line', async (line) => {
@@ -295,7 +310,7 @@ export async function runIpcServer() {
                         break;
                     }
                     const override = {};
-                    if (params?.provider && (params.provider === 'scalix' || params.provider === 'openai'))
+                    if (isProviderId(params?.provider))
                         override.provider = params.provider;
                     if (params?.apiKey && typeof params.apiKey === 'string')
                         override.apiKey = params.apiKey;
@@ -434,7 +449,11 @@ export async function runIpcServer() {
                 }
                 case 'getModels': {
                     const session = resolveSession(params);
-                    write({ type: 'response', id, result: { models: session.agent.getModels() } });
+                    write({ type: 'response', id, result: { models: session.agent.getModels(), provider: session.agent.getProvider() } });
+                    break;
+                }
+                case 'getProviders': {
+                    write({ type: 'response', id, result: { providers: summarizeProviders(config), active: active.provider } });
                     break;
                 }
                 case 'registerModels': {
@@ -495,11 +514,23 @@ export async function runIpcServer() {
                 }
                 case 'setPermissionMode': {
                     const session = resolveSession(params);
-                    if (params?.mode)
+                    // Same whitelist createSession applies — an unvalidated mode string
+                    // would degrade every tool to 'ask' (fail-safe) but leave the
+                    // session reporting a mode that does not exist.
+                    if (params?.mode && PERMISSION_MODES.includes(params.mode)) {
                         session.agent.setPermissionMode(params.mode);
+                    }
                     write({ type: 'response', id, result: { mode: session.agent.getPermissionMode() } });
                     break;
                 }
+                case 'listAgents': {
+                    // The IDE's Agents tab polls this: every registered agent (session
+                    // roots plus sub-agents spawned through the `agent` tool) with its
+                    // live status, model, token and step counts.
+                    const all = AgentRegistry.getInstance().listAll();
+                    write({ type: 'response', id, result: { agents: all, usage: AgentRegistry.getInstance().getUsageSummary() } });
+                    break;
+                }
                 default:
                     write({ type: 'response', id, error: { message: `Unknown method: ${method}` } });
             }