vigthoria-cli 1.10.47 → 1.10.49

package/dist/utils/brain-hub-client.js

@@ -1,11 +1,8 @@
-"use strict";
 /**
  * Brain Hub client — sync workspace index + fetch account brain context
  * via coder.vigthoria.io (JWT-authenticated).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrainHubClient = void 0;
-class BrainHubClient {
+export class BrainHubClient {
     apiBase;
     getAuthToken;
     constructor(options) {
@@ -49,4 +46,3 @@ class BrainHubClient {
         return data;
     }
 }
-exports.BrainHubClient = BrainHubClient;

package/dist/utils/bridge-client.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Vigthoria CLI → DevTools Bridge Telemetry Client
  *
@@ -12,57 +11,18 @@
  *  - Opt-in via --bridge <url> flag
  *  - Sensitive data (API keys, tokens) is never transmitted
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BridgeClient = void 0;
-exports.getBridgeClient = getBridgeClient;
-const ws_1 = __importDefault(require("ws"));
-const os = __importStar(require("os"));
-const chalk_1 = __importDefault(require("chalk"));
-const logger_js_1 = require("./logger.js");
+import WebSocket from 'ws';
+import * as os from 'os';
+import chalk from 'chalk';
+import { CH } from './logger.js';
 // ── Singleton accessor ───────────────────────────────────────────────
 let _instance = null;
 /** Get the active bridge client (may be null if --bridge was not used). */
-function getBridgeClient() {
+export function getBridgeClient() {
     return _instance;
 }
 // ── BridgeClient ─────────────────────────────────────────────────────
-class BridgeClient {
+export class BridgeClient {
     ws = null;
     url;
     apiKey;
@@ -93,7 +53,7 @@ class BridgeClient {
             return;
         return new Promise((resolve) => {
             try {
-                this.ws = new ws_1.default(this.url, { handshakeTimeout: 8000 });
+                this.ws = new WebSocket(this.url, { handshakeTimeout: 8000 });
                 this.ws.on('open', () => {
                     this.connected = true;
                     this.reconnectDelay = 2000;
@@ -137,7 +97,7 @@ class BridgeClient {
                     this.stopHeartbeat();
                     this.scheduleReconnect();
                     if (process.env.DEBUG || process.env.VIGTHORIA_DEBUG) {
-                        console.log(chalk_1.default.yellow(`${logger_js_1.CH.warn} Bridge: connection failed, will retry in background.`));
+                        console.log(chalk.yellow(`${CH.warn} Bridge: connection failed, will retry in background.`));
                     }
                     resolve(); // resolve even on failure – must never block CLI
                 });
@@ -225,7 +185,7 @@ class BridgeClient {
             clientId: this.clientId,
         };
         const json = JSON.stringify(event);
-        if (this.connected && this.ws?.readyState === ws_1.default.OPEN) {
+        if (this.connected && this.ws?.readyState === WebSocket.OPEN) {
             try {
                 this.ws.send(json);
             }
@@ -238,7 +198,7 @@ class BridgeClient {
         }
     }
     sendRaw(obj) {
-        if (this.ws?.readyState === ws_1.default.OPEN) {
+        if (this.ws?.readyState === WebSocket.OPEN) {
             this.ws.send(JSON.stringify(obj));
         }
     }
@@ -249,7 +209,7 @@ class BridgeClient {
         this.queue.push(json);
     }
     flushQueue() {
-        while (this.queue.length > 0 && this.ws?.readyState === ws_1.default.OPEN) {
+        while (this.queue.length > 0 && this.ws?.readyState === WebSocket.OPEN) {
             const msg = this.queue.shift();
             try {
                 this.ws.send(msg);
@@ -280,4 +240,3 @@ class BridgeClient {
         }
     }
 }
-exports.BridgeClient = BridgeClient;

package/dist/utils/cli-state.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Vigthoria CLI — shared local-state helpers.
+ *
+ * Single source for:
+ *   • Offline-mode detection (VIGTHORIA_OFFLINE=1) — suppresses every
+ *     background network call (update checks, gateway preflights, etc.).
+ *   • Telemetry opt-out (VIGTHORIA_TELEMETRY_DISABLED=1).
+ *   • Update-check cache, so `npm view` is not invoked on every CLI start.
+ *   • Cross-platform safe file mode enforcement for tokens / sessions.
+ *
+ * No external network calls — pure local helpers.  Safe to import from
+ * any command module.
+ */
+/** 24h is plenty for an update-check ping. */
+export declare const UPDATE_CHECK_TTL_MS: number;
+/** 60s gateway-preflight cache so back-to-back CLI invocations stay fast. */
+export declare const GATEWAY_PREFLIGHT_TTL_MS: number;
+export interface CliStateShape {
+    updateCheck?: {
+        checkedAt: number;
+        latestVersion: string;
+        notifiedFor?: string;
+    };
+    gatewayPreflight?: {
+        checkedAt: number;
+        valid: boolean;
+    };
+    /** Last-seen version — used to render release notes on upgrade. */
+    lastSeenVersion?: string;
+}
+export declare function ensureStateDir(): void;
+/** Best-effort lock-down: `0o600` on POSIX, no-op on Windows (NTFS ACL ≠ chmod). */
+export declare function secureFileMode(filePath: string): void;
+/** Atomic write helper — write to temp then rename, never half-written JSON. */
+export declare function atomicWriteJson(targetPath: string, value: unknown, mode?: number): void;
+export declare function loadCliState(): CliStateShape;
+export declare function saveCliState(state: CliStateShape): void;
+export declare function getCliStateFile(): string;
+/**
+ * Offline mode — set VIGTHORIA_OFFLINE=1 to skip every non-essential
+ * outbound HTTP call. Useful for restricted networks, air-gapped runs,
+ * and deterministic CI.
+ */
+export declare function isOfflineMode(): boolean;
+/** Telemetry opt-out (also implied when offline mode is on). */
+export declare function isTelemetryDisabled(): boolean;
+/** When true the startup update check is suppressed (env override or offline). */
+export declare function isUpdateCheckSuppressed(): boolean;
+/** Cached read for the latest known version — null when stale or absent. */
+export declare function readCachedLatestVersion(maxAgeMs?: number): string | null;
+export declare function writeCachedLatestVersion(latestVersion: string, notifiedFor?: string): void;
+export declare function readGatewayPreflightCache(maxAgeMs?: number): boolean | null;
+export declare function writeGatewayPreflightCache(valid: boolean): void;
+export declare function isSafeNpmPackageSpec(spec: string): boolean;

package/dist/utils/cli-state.js

@@ -0,0 +1,185 @@
+/**
+ * Vigthoria CLI — shared local-state helpers.
+ *
+ * Single source for:
+ *   • Offline-mode detection (VIGTHORIA_OFFLINE=1) — suppresses every
+ *     background network call (update checks, gateway preflights, etc.).
+ *   • Telemetry opt-out (VIGTHORIA_TELEMETRY_DISABLED=1).
+ *   • Update-check cache, so `npm view` is not invoked on every CLI start.
+ *   • Cross-platform safe file mode enforcement for tokens / sessions.
+ *
+ * No external network calls — pure local helpers.  Safe to import from
+ * any command module.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+const STATE_DIR = path.join(os.homedir(), '.vigthoria');
+const STATE_FILE = path.join(STATE_DIR, 'cli-state.json');
+/** 24h is plenty for an update-check ping. */
+export const UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1000;
+/** 60s gateway-preflight cache so back-to-back CLI invocations stay fast. */
+export const GATEWAY_PREFLIGHT_TTL_MS = 60 * 1000;
+function readStateUnchecked() {
+    try {
+        if (!fs.existsSync(STATE_FILE)) {
+            return {};
+        }
+        const text = fs.readFileSync(STATE_FILE, 'utf8');
+        if (!text.trim()) {
+            return {};
+        }
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        // Corrupt state file should never crash the CLI — treat as empty.
+        return {};
+    }
+}
+export function ensureStateDir() {
+    try {
+        if (!fs.existsSync(STATE_DIR)) {
+            fs.mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+        }
+        if (process.platform !== 'win32') {
+            try {
+                fs.chmodSync(STATE_DIR, 0o700);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    catch {
+        // Best-effort — caller will see write failure later if it matters.
+    }
+}
+/** Best-effort lock-down: `0o600` on POSIX, no-op on Windows (NTFS ACL ≠ chmod). */
+export function secureFileMode(filePath) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // File may not exist yet, or filesystem may not support chmod.
+    }
+}
+/** Atomic write helper — write to temp then rename, never half-written JSON. */
+export function atomicWriteJson(targetPath, value, mode = 0o600) {
+    ensureStateDir();
+    const parent = path.dirname(targetPath);
+    try {
+        if (!fs.existsSync(parent))
+            fs.mkdirSync(parent, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const tmpPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(value, null, 2), 'utf8');
+    if (process.platform !== 'win32') {
+        try {
+            fs.chmodSync(tmpPath, mode);
+        }
+        catch { /* ignore */ }
+    }
+    fs.renameSync(tmpPath, targetPath);
+}
+export function loadCliState() {
+    return readStateUnchecked();
+}
+export function saveCliState(state) {
+    atomicWriteJson(STATE_FILE, state);
+}
+export function getCliStateFile() {
+    return STATE_FILE;
+}
+/**
+ * Offline mode — set VIGTHORIA_OFFLINE=1 to skip every non-essential
+ * outbound HTTP call. Useful for restricted networks, air-gapped runs,
+ * and deterministic CI.
+ */
+export function isOfflineMode() {
+    const flag = String(process.env.VIGTHORIA_OFFLINE || '').trim().toLowerCase();
+    return flag === '1' || flag === 'true' || flag === 'yes';
+}
+/** Telemetry opt-out (also implied when offline mode is on). */
+export function isTelemetryDisabled() {
+    if (isOfflineMode())
+        return true;
+    const flag = String(process.env.VIGTHORIA_TELEMETRY_DISABLED || '').trim().toLowerCase();
+    return flag === '1' || flag === 'true' || flag === 'yes';
+}
+/** When true the startup update check is suppressed (env override or offline). */
+export function isUpdateCheckSuppressed() {
+    if (isOfflineMode())
+        return true;
+    const flag = String(process.env.VIGTHORIA_NO_UPDATE_CHECK || '').trim();
+    return flag === '1';
+}
+/** Cached read for the latest known version — null when stale or absent. */
+export function readCachedLatestVersion(maxAgeMs = UPDATE_CHECK_TTL_MS) {
+    const state = readStateUnchecked();
+    const entry = state.updateCheck;
+    if (!entry || !entry.latestVersion || typeof entry.checkedAt !== 'number') {
+        return null;
+    }
+    if (Date.now() - entry.checkedAt > maxAgeMs) {
+        return null;
+    }
+    return entry.latestVersion;
+}
+export function writeCachedLatestVersion(latestVersion, notifiedFor) {
+    try {
+        const state = readStateUnchecked();
+        state.updateCheck = {
+            checkedAt: Date.now(),
+            latestVersion,
+            notifiedFor: notifiedFor || state.updateCheck?.notifiedFor,
+        };
+        saveCliState(state);
+    }
+    catch {
+        // Caching is a nice-to-have, never block CLI on write failure.
+    }
+}
+export function readGatewayPreflightCache(maxAgeMs = GATEWAY_PREFLIGHT_TTL_MS) {
+    const state = readStateUnchecked();
+    const entry = state.gatewayPreflight;
+    if (!entry || typeof entry.checkedAt !== 'number' || typeof entry.valid !== 'boolean') {
+        return null;
+    }
+    if (Date.now() - entry.checkedAt > maxAgeMs) {
+        return null;
+    }
+    return entry.valid;
+}
+export function writeGatewayPreflightCache(valid) {
+    try {
+        const state = readStateUnchecked();
+        state.gatewayPreflight = { checkedAt: Date.now(), valid };
+        saveCliState(state);
+    }
+    catch {
+        // Best-effort.
+    }
+}
+/**
+ * Validate an npm package spec used by `vigthoria update --from <spec>`.
+ * Returns `true` when the spec is acceptable.  Rejects whitespace and
+ * shell metacharacters so the spec can never break out of `execFile` /
+ * a Windows `shell:true` fallback into command injection.
+ */
+const NPM_SPEC_ALLOWLIST = /^[A-Za-z0-9_./@:+\\=-]+$/;
+const DISALLOWED_SHELL_CHARS = /[;&|`$<>(){}\[\]"'\s]/;
+export function isSafeNpmPackageSpec(spec) {
+    const candidate = String(spec || '').trim();
+    if (!candidate)
+        return false;
+    if (candidate.length > 512)
+        return false;
+    if (DISALLOWED_SHELL_CHARS.test(candidate))
+        return false;
+    if (!NPM_SPEC_ALLOWLIST.test(candidate))
+        return false;
+    return true;
+}

package/dist/utils/codebase-indexer.js

@@ -1,46 +1,10 @@
-"use strict";
 /**
  * Local TF-IDF codebase indexer for CLI (mirrors Vigthoria Code extension indexer).
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CodebaseIndexer = void 0;
-const crypto = __importStar(require("crypto"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-class CodebaseIndexer {
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+export class CodebaseIndexer {
     workspaceRoot;
     index = new Map();
     invertedIndex = new Map();
@@ -348,4 +312,3 @@ class CodebaseIndexer {
         return this.ignorePatterns.some((pattern) => lowerPath.includes(pattern));
     }
 }
-exports.CodebaseIndexer = CodebaseIndexer;

package/dist/utils/config.d.ts

@@ -0,0 +1,82 @@
+export interface VigthoriaCLIConfig {
+    apiUrl: string;
+    modelsApiUrl: string;
+    wsUrl: string;
+    selfHostedModelsApiUrl: string | null;
+    authToken: string | null;
+    refreshToken: string | null;
+    userId: string | null;
+    email: string | null;
+    v3ServiceKey: string | null;
+    subscription: {
+        plan: string | null;
+        status: string | null;
+        expiresAt: string | null;
+    };
+    preferences: {
+        defaultModel: string;
+        theme: 'dark' | 'light';
+        autoApplyFixes: boolean;
+        showDiffs: boolean;
+        contextLines: number;
+        maxTokens: number;
+    };
+    project: {
+        rootPath: string | null;
+        ignorePatterns: string[];
+    };
+    persona: 'default' | 'wiener_grant';
+    hubModelPrefs?: {
+        enabledCloudModels: string[];
+        defaultCloudModel?: string;
+        defaultLocalModel?: string;
+        balance?: number;
+        fetchedAt?: string;
+    };
+}
+export interface AvailableModelDescriptor {
+    id: string;
+    name: string;
+    description: string;
+    tier: string;
+    backendModel: string;
+}
+export declare class Config {
+    private store;
+    private static readonly OPERATOR_PLANS;
+    private static readonly CLOUD_PLANS;
+    constructor();
+    /**
+     * Re-apply secure POSIX permissions to the on-disk config file.  Safe
+     * to call repeatedly; no-op on Windows.
+     */
+    secureOnDisk(): void;
+    get<K extends keyof VigthoriaCLIConfig>(key: K): VigthoriaCLIConfig[K];
+    set<K extends keyof VigthoriaCLIConfig>(key: K, value: VigthoriaCLIConfig[K]): void;
+    getAll(): VigthoriaCLIConfig;
+    reset(): void;
+    isAuthenticated(): boolean;
+    hasValidSubscription(): boolean;
+    getNormalizedPlan(): string;
+    hasOperatorAccess(): boolean;
+    hasCloudAccess(): boolean;
+    getConfigPath(): string;
+    setAuth(data: {
+        token: string;
+        refreshToken?: string;
+        userId: string;
+        email: string;
+    }): void;
+    clearAuth(): void;
+    setSubscription(data: {
+        plan: string;
+        status: string;
+        expiresAt?: string;
+    }): void;
+    getAvailableModels(): AvailableModelDescriptor[];
+    refreshHubModelPreferences(): Promise<void>;
+    isCloudModel(modelId: string): boolean;
+    filterModelsByHubPreferences(models: AvailableModelDescriptor[], enabledCloudModels?: string[]): AvailableModelDescriptor[];
+    isComplexTask(prompt: string): boolean;
+    shouldUseCloudForHeavyTask(prompt: string): boolean;
+}