scalix 1.5.2 → 1.6.0

package/dist/tools-web.js

@@ -2,7 +2,7 @@ import { tool } from './tool-helper.js';
 import { z } from 'zod';
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import dns from 'node:dns';
+import { resolveLookupAddresses, pinnedFetch } from './secure-fetch.js';
 import { sandboxPath } from './sandbox.js';
 import { logger } from './logger.js';
 import { USER_AGENT, SEARCH_ENDPOINTS, WEB_DEFAULTS, TOOL_DEFAULTS, HTML_STRIP_TAGS, isPrivateHost, isPrivateIp, isHostExplicitlyAllowed, } from './constants.js';
@@ -11,29 +11,29 @@ import { DEFAULT_LIMITS } from './settings.js';
 const MAX_FETCH_REDIRECTS = 5;
 // Verify a URL is safe to fetch: http/https only, non-private hostname, and no
 // resolved IP that lands in a private/loopback/link-local range (defeats DNS
-// rebinding). Returns an error string when the URL must be blocked, else null.
+// rebinding). The addresses that PASSED the check are returned so the actual
+// connection can be pinned to them — otherwise the fetch re-resolves the name
+// and a rebinding answer lands the request inside the private network the
+// check just cleared.
 async function validateFetchTarget(target) {
     if (target.protocol !== 'http:' && target.protocol !== 'https:') {
-        return `Blocked: only http/https URLs are allowed (got ${target.protocol})`;
+        return { blocked: `Blocked: only http/https URLs are allowed (got ${target.protocol})`, addresses: [] };
     }
     const hostname = target.hostname.toLowerCase();
     if (isPrivateHost(hostname)) {
-        return 'Blocked: requests to localhost and private networks are not allowed';
+        return { blocked: 'Blocked: requests to localhost and private networks are not allowed', addresses: [] };
     }
     // An operator who allow-listed this exact name did so knowing it points into
     // a private range; re-checking the resolved address would only undo that.
     if (isHostExplicitlyAllowed(hostname))
-        return null;
-    try {
-        const addresses = await dns.promises.lookup(hostname, { all: true });
-        if (addresses.some((a) => isPrivateIp(a.address))) {
-            return 'Blocked: hostname resolves to a private network address';
-        }
+        return { blocked: null, addresses: [] };
+    const addresses = await resolveLookupAddresses(hostname);
+    if (addresses.length > 0 && addresses.some((a) => isPrivateIp(a.address))) {
+        return { blocked: 'Blocked: hostname resolves to a private network address', addresses: [] };
     }
-    catch {
-        // DNS failure will surface as a normal fetch error below; don't block here.
-    }
-    return null;
+    // A DNS failure is left to the request itself to report — and pins to the
+    // (empty) address list, so plain fetch surfaces the usual error.
+    return { blocked: null, addresses };
 }
 let _limits = DEFAULT_LIMITS;
 export function setWebToolLimits(limits) { _limits = limits; }
@@ -88,20 +88,23 @@ export const webFetchTool = tool({
             // SSRF checks (a 3xx to a private host would otherwise bypass them).
             let currentUrl = parsed;
             let response;
+            const requestInit = {
+                signal: controller.signal,
+                redirect: 'manual',
+                headers: {
+                    'User-Agent': `Mozilla/5.0 (compatible; ${USER_AGENT})`,
+                    'Accept': 'text/html,application/json,text/plain;q=0.9,*/*;q=0.8',
+                },
+            };
             try {
                 let hops = 0;
                 while (true) {
-                    const blocked = await validateFetchTarget(currentUrl);
+                    const { blocked, addresses } = await validateFetchTarget(currentUrl);
                     if (blocked)
                         return { error: blocked, url: currentUrl.href };
-                    response = await fetch(currentUrl.href, {
-                        signal: controller.signal,
-                        redirect: 'manual',
-                        headers: {
-                            'User-Agent': `Mozilla/5.0 (compatible; ${USER_AGENT})`,
-                            'Accept': 'text/html,application/json,text/plain;q=0.9,*/*;q=0.8',
-                        },
-                    });
+                    // Pinned to the addresses the SSRF check just validated, so the
+                    // connection cannot be re-pointed between the check and the dial.
+                    response = await pinnedFetch(currentUrl, requestInit, addresses);
                     if (response.status >= 300 && response.status < 400) {
                         const location = response.headers.get('location');
                         if (!location)

package/dist/tools.js

@@ -1,9 +1,10 @@
 import { tool } from './tool-helper.js';
 import { z } from 'zod';
-import { exec, spawn } from 'node:child_process';
+import { exec, execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import fsSync from 'node:fs';
 import fs from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import { safeEvaluate } from './safe-math.js';
 import { sandboxPath, isBlockedCommand, detectInjection, sanitizeEnvForCommand, getShellInfo, isWithinRoot, getSandboxRoot } from './sandbox.js';
@@ -11,9 +12,43 @@ import { DEFAULT_LIMITS } from './settings.js';
 import { TOOL_DEFAULTS, BINARY_DETECT_BUFFER_SIZE } from './constants.js';
 import { computeDiff, formatDiff } from './diff.js';
 import { normalizeMcpConfig, validateMcpUrl } from './mcp.js';
+import { buildSandboxWrap, materializeWrap } from './command-sandbox.js';
 let _limits = DEFAULT_LIMITS;
 export function setToolLimits(limits) { _limits = limits; }
+// OS-level command sandbox (command-sandbox.ts). Off until something wires it:
+// the Agent constructor pushes the resolved config mode here, so every front
+// end (CLI, IPC, headless) inherits the same policy with no per-entry plumbing.
+let _sandboxMode = 'off';
+export function setCommandSandboxMode(mode) { _sandboxMode = mode; }
+export function getCommandSandboxMode() { return _sandboxMode; }
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
+/**
+ * Run a command string inside the OS sandbox when enabled. Returns the wrap's
+ * exec argv, or null when the sandbox is off/unavailable (with a reason).
+ * The profile file (darwin) is written next to the process and unlinked by the
+ * caller after the child exits.
+ */
+async function sandboxedArgv(command, workingDir) {
+    if (_sandboxMode === 'off')
+        return { error: 'sandbox disabled' };
+    const shell = getShellInfo();
+    const built = buildSandboxWrap(_sandboxMode, workingDir, shell);
+    if (!built.ok)
+        return { error: built.error };
+    let profilePath;
+    if (built.wrap.profile) {
+        try {
+            profilePath = path.join(os.tmpdir(), `scalix-sandbox-${process.pid}-${Date.now()}.sb`);
+            await fs.writeFile(profilePath, built.wrap.profile, { mode: 0o600 });
+        }
+        catch (err) {
+            return { error: `could not write the sandbox profile: ${err.message}` };
+        }
+    }
+    const { execPath, args } = materializeWrap(built.wrap, command, profilePath);
+    return { execPath, args, profilePath };
+}
 let persistentCwd = process.cwd();
 export function getPersistentCwd() { return persistentCwd; }
 export function setPersistentCwd(dir) { persistentCwd = dir; }
@@ -94,12 +129,25 @@ export const runCommandTool = tool({
         }
         const shell = getShellInfo();
         if (runInBg) {
-            const child = spawn(shell.path, [...shell.args, command], {
-                detached: true,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                env: sanitizeEnvForCommand(),
-                cwd: workingDir,
-            });
+            const bg = _sandboxMode === 'off'
+                ? null
+                : await sandboxedArgv(command, workingDir);
+            if (bg && 'error' in bg) {
+                return { error: `Command sandbox unavailable: ${bg.error}`, exitCode: -1 };
+            }
+            const child = bg
+                ? spawn(bg.execPath, bg.args, {
+                    detached: true,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    env: sanitizeEnvForCommand(),
+                    cwd: workingDir,
+                })
+                : spawn(shell.path, [...shell.args, command], {
+                    detached: true,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    env: sanitizeEnvForCommand(),
+                    cwd: workingDir,
+                });
             if (!child.pid) {
                 return { error: 'Failed to spawn background process: no PID assigned', exitCode: -1 };
             }
@@ -181,13 +229,40 @@ export const runCommandTool = tool({
             fullCommand = cwdProbe;
         }
         try {
-            const { stdout, stderr } = await execAsync(fullCommand, {
+            let stdout;
+            let stderr;
+            const execOpts = {
                 timeout: timeout ?? _limits.commandTimeoutMs,
                 maxBuffer: TOOL_DEFAULTS.maxExecBufferDefault,
                 env: sanitizeEnvForCommand(),
                 cwd: workingDir,
                 shell: shell.path,
-            });
+            };
+            if (_sandboxMode === 'off') {
+                ({ stdout, stderr } = await execAsync(fullCommand, execOpts));
+            }
+            else {
+                // Kernel-enforced confinement: sandbox-exec (seatbelt) or bwrap execs
+                // the same shell with the same command string, so shell semantics are
+                // unchanged — what changes is what the child is allowed to touch.
+                const sb = await sandboxedArgv(fullCommand, workingDir);
+                if ('error' in sb) {
+                    return { error: `Command sandbox unavailable: ${sb.error}`, exitCode: -1 };
+                }
+                try {
+                    ({ stdout, stderr } = await execFileAsync(sb.execPath, sb.args, {
+                        timeout: execOpts.timeout,
+                        maxBuffer: execOpts.maxBuffer,
+                        env: execOpts.env,
+                        cwd: execOpts.cwd,
+                    }));
+                }
+                finally {
+                    if (sb.profilePath) {
+                        fs.unlink(sb.profilePath).catch(() => { });
+                    }
+                }
+            }
             if (cdTarget && fullCommand !== command) {
                 const markerIdx = stdout.indexOf(CWD_MARKER);
                 if (markerIdx !== -1) {

package/dist/workspace-trust.js

@@ -49,7 +49,11 @@ export function hasProjectExecSurface(cwd = process.cwd()) {
         // repo can carry MCP config without a root-level file. Listing only the
         // root filename meant an MCP-only clone looked inert and the user was
         // never offered the trust prompt for the one thing it did have.
-        path.join(dir, 'mcp-services.json'), path.join(dir, 'rules'), path.join(dir, 'settings.local.json'));
+        path.join(dir, 'mcp-services.json'), path.join(dir, 'rules'), path.join(dir, 'settings.local.json'), 
+        // Command .md files may carry !`cmd` inline-bash expansions, which run
+        // shell commands — an exec surface like hooks, so they warrant the
+        // trust prompt too.
+        path.join(dir, 'commands'));
     }
     return candidates.some(rel => {
         try {

package/dist/worktree.js

@@ -51,7 +51,7 @@ export async function createWorktree(agentId, basePath) {
         createdAt: Date.now(),
     };
 }
-export async function removeWorktree(info, basePath) {
+export async function removeWorktree(info, basePath, options = {}) {
     try {
         await execFileAsync('git', ['worktree', 'remove', info.path, '--force'], {
             cwd: basePath,
@@ -68,14 +68,31 @@ export async function removeWorktree(info, basePath) {
             // best effort
         }
     }
+    // `git branch -d` refuses to delete a branch with unmerged commits — the
+    // safe default. Only fall back to `-D` when the caller explicitly asked for
+    // a forced delete; otherwise keep the branch so the sub-agent's commits
+    // stay recoverable.
     try {
-        await execFileAsync('git', ['branch', '-D', info.branch], {
+        await execFileAsync('git', ['branch', '-d', info.branch], {
             cwd: basePath,
             timeout: 10_000,
         });
     }
     catch {
-        // branch may already be deleted
+        if (options.forceBranch) {
+            try {
+                await execFileAsync('git', ['branch', '-D', info.branch], {
+                    cwd: basePath,
+                    timeout: 10_000,
+                });
+            }
+            catch {
+                // branch may already be deleted
+            }
+        }
+        else {
+            logger.info('Kept unmerged worktree branch for recovery', { agentId: info.agentId, branch: info.branch });
+        }
     }
     logger.info('Removed worktree', { agentId: info.agentId, path: info.path });
 }
@@ -109,8 +126,10 @@ export async function mergeWorktree(info, basePath, targetBranch) {
             return { merged: false, conflicts, commitCount: commits.length };
         }
     }
-    catch {
-        return { merged: true, commitCount: 0 };
+    catch (err) {
+        // The probe itself failed (detached HEAD, missing ref, timeout) — report
+        // a real failure instead of pretending the merge was a clean no-op.
+        return { merged: false, commitCount: 0, error: err?.message || String(err) };
     }
 }
 export async function listWorktrees(basePath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalix",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "AI coding agent for the terminal — edit code, run commands, and build with Scalix",
   "main": "dist/headless.js",
   "bin": {
@@ -73,12 +73,12 @@
     "@types/react": "^19.2.14",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^9.0.0",
     "playwright": "^1.59.1",
     "tsx": "^4.21.0",
     "typescript": "^6.0.2",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.11"
   },
   "optionalDependencies": {
     "playwright": "^1.59.1"