vigthoria-cli 1.11.36 → 1.11.43

package/dist/commands/bridge.js

@@ -2,6 +2,12 @@ import chalk from 'chalk';
 import { createSpinner } from '../utils/logger.js';
 import { APIClient } from '../utils/api.js';
 import { getDesktopBridgeStatus } from '../utils/desktop-bridge-client.js';
+function displayEndpoint(endpoint) {
+    if (/^(?:wss?|https?):\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?/i.test(endpoint)) {
+        return 'local loopback endpoint';
+    }
+    return endpoint;
+}
 export class BridgeCommand {
     api;
     constructor(config, logger) {
@@ -18,7 +24,7 @@ export class BridgeCommand {
         console.log(chalk.white('DevTools Bridge (browser, port 4016):'));
         console.log(chalk.gray('  Status: ') + (devtoolsBridge.ok ? chalk.green('Reachable') : chalk.yellow('Not running')));
         if (devtoolsBridge.ok) {
-            console.log(chalk.gray('  Endpoint: ') + devtoolsBridge.endpoint);
+            console.log(chalk.gray('  Endpoint: ') + displayEndpoint(devtoolsBridge.endpoint));
         }
         else {
             const detail = String(devtoolsBridge.error || 'Connection refused').trim() || 'Connection refused';
@@ -31,7 +37,7 @@ export class BridgeCommand {
         console.log(chalk.white('Desktop Bridge (Windows desktop, port 49160):'));
         console.log(chalk.gray('  Status: ') + (desktopBridge.ok ? chalk.green('Reachable') : chalk.yellow('Not running')));
         if (desktopBridge.ok) {
-            console.log(chalk.gray('  Endpoint: ') + desktopBridge.endpoint);
+            console.log(chalk.gray('  Endpoint: ') + displayEndpoint(desktopBridge.endpoint));
             if (desktopBridge.service)
                 console.log(chalk.gray('  Service: ') + desktopBridge.service);
             if (desktopBridge.version)

package/dist/commands/chat.d.ts

@@ -68,6 +68,7 @@ export declare class ChatCommand {
     private hasOperatorAccess;
     private operatorAccessMessage;
     private getDefaultChatModel;
+    private isHardExplicitAgentModelSelection;
     private resolveInitialModel;
     private isLegacyAgentFallbackAllowed;
     private shouldRescueFailedAnalysis;

package/dist/commands/chat.js

@@ -22,27 +22,54 @@ import { inferAgentTaskType as sharedInferAgentTaskType, inferAgentTaskTypeWithC
 import { resolveAgentRoute } from '../utils/agentRoute.js';
 import { runTemplateInstantPath } from '../utils/templateInstantPath.js';
 import { isV3StreamKeepaliveEvent } from '../utils/v3-stream-events.js';
+// Production safety net: previously these defaulted to 0 (disabled) unless an
+// operator manually set an env var. Real end-user installs never set these,
+// so a stalled/incomplete model stream (e.g. text ends after </think> with no
+// tool_call event) would hang the CLI forever with only a cosmetic
+// "[Wait] Model still working" notice and no actual abort. See TestFarm
+// incident 2026-07-04 (Gideon Lenz / C:\vigthoria\Apps\monopoly).
+// Set VIGTHORIA_AGENT_TIMEOUT_MS=0 / VIGTHORIA_AGENT_IDLE_TIMEOUT_MS=0 to
+// explicitly restore the old unbounded behavior for debugging.
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS;
     if (!rawValue) {
-        return 0;
+        return 1_200_000; // 20 min hard cap on the whole agent request
     }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 1_200_000;
 })();
 const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS;
     if (!rawValue) {
-        return 0;
+        return 60_000; // 60s with zero new stream data => abort/retry
     }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 60_000;
 })();
 const DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_SOFT_TIMEOUT_MS || process.env.V3_AGENT_SOFT_TIMEOUT_MS || '300000';
     const parsed = Number.parseInt(rawValue, 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : 300000;
 })();
+/** Block-write agent JSON to VIGTHORIA_AGENT_OUTPUT (Windows KVM fsync path). */
+function emitAgentJsonOutput(payload) {
+    const text = `${JSON.stringify(payload, null, 2)}\n`;
+    console.log(text.trimEnd());
+    const outPath = process.env.VIGTHORIA_AGENT_OUTPUT?.trim();
+    if (!outPath) {
+        return;
+    }
+    const dir = path.dirname(outPath);
+    fs.mkdirSync(dir, { recursive: true });
+    const fd = fs.openSync(outPath, 'w');
+    try {
+        fs.writeSync(fd, text, undefined, 'utf8');
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 export class ChatCommand {
     config;
     logger;
@@ -251,6 +278,19 @@ export class ChatCommand {
         }
         return preferredModel;
     }
+    isHardExplicitAgentModelSelection(options) {
+        const requestedModel = String(options.model || '').trim().toLowerCase();
+        if (!requestedModel) {
+            return false;
+        }
+        if (/^(1|true|yes)$/i.test(String(process.env.VIGTHORIA_FORCE_EXPLICIT_AGENT_MODEL || ''))) {
+            return true;
+        }
+        if (options.agent === true || options.operator === true) {
+            return !['agent', 'code', 'balanced', 'vigthoria-agent', 'vigthoria-code'].includes(requestedModel);
+        }
+        return true;
+    }
     resolveInitialModel(options) {
         const requestedModel = String(options.model || '').trim();
         if (requestedModel) {
@@ -312,6 +352,16 @@ export class ChatCommand {
                 routeReason: 'explicit-model-selection',
             };
         }
+        if (this.agentMode && ['agent', 'code', 'balanced', 'vigthoria-agent', 'vigthoria-code'].includes(String(this.currentModel || '').toLowerCase())) {
+            return {
+                selectedModel: 'agent',
+                explicitModel: false,
+                heavyTask,
+                cloudEligible,
+                cloudSelected: false,
+                routeReason: 'dispatcher-eligible-agent-default',
+            };
+        }
         if (this.lastAgentRoute?.path === 'template-instant') {
             return {
                 selectedModel: 'agent',
@@ -816,7 +866,12 @@ export class ChatCommand {
         }
         this.v3IdleWatchInterval = setInterval(() => {
             const idleMs = Date.now() - this.v3LastActivity;
-            if (idleMs < 15_000 || this.v3IdleNoticeShown) {
+            if (idleMs < 15_000) {
+                // Activity resumed — re-arm the notice so a later stall is reported too.
+                this.v3IdleNoticeShown = false;
+                return;
+            }
+            if (this.v3IdleNoticeShown) {
                 return;
             }
             this.v3IdleNoticeShown = true;
@@ -824,7 +879,11 @@ export class ChatCommand {
                 spinner.stop();
             }
             const seconds = Math.round(idleMs / 1000);
-            process.stderr.write(chalk.yellow(`  [Wait] Model still working (${seconds}s) — large context or server retry may take up to 90s...\n`));
+            const idleTimeoutSec = Math.round(DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS / 1000);
+            process.stderr.write(chalk.yellow(`  [Wait] Model still working (${seconds}s) — large context or server retry may take a while. ` +
+                (idleTimeoutSec > 0
+                    ? `A hard timeout (~${idleTimeoutSec}s of silence) will auto-recover and offer /retry if the model stalls.\n`
+                    : `\n`)));
             spinner.start();
             spinner.text = 'Waiting for model response...';
         }, 5_000);
@@ -1406,7 +1465,7 @@ export class ChatCommand {
         if (!this.config.isAuthenticated()) {
             if (options.json) {
                 process.exitCode = 1;
-                console.log(JSON.stringify({ success: false, error: 'Not authenticated. Run: vigthoria login' }, null, 2));
+                emitAgentJsonOutput({ success: false, error: 'Not authenticated. Run: vigthoria login' });
             }
             else {
                 this.logger.error('Not authenticated. Run: vigthoria login');
@@ -1422,7 +1481,7 @@ export class ChatCommand {
         this.jsonOutput = options.json === true;
         this.autoApprove = options.autoApprove === true || this.jsonOutput;
         this.personaOverride = options.grant === true ? 'wiener_grant' : null;
-        this.modelExplicitlySelected = Boolean(String(options.model || '').trim());
+        this.modelExplicitlySelected = this.isHardExplicitAgentModelSelection(options);
         this.currentModel = this.resolveInitialModel(options);
         this.applyNoAgentGovernance(String(options.model || this.currentModel || ''));
         this.currentProjectPath = this.resolveProjectPath(options);
@@ -2788,6 +2847,28 @@ export class ChatCommand {
             console.log(chalk.gray('  Run: vigthoria preview'));
             this.printAgentRunSummary(this.lastAgentRunOutcome, evaluation, 1);
         }
+        else {
+            const routingPolicy = this.resolveAgentExecutionPolicy(prompt);
+            console.log(JSON.stringify({
+                success: evaluation.executorSucceeded,
+                mode: 'agent',
+                model: routingPolicy.selectedModel,
+                routingPolicy,
+                taskId: null,
+                contextId: null,
+                partial: false,
+                content: summary,
+                statusHeadline: evaluation.statusHeadline,
+                tasksSucceeded: 1,
+                tasksTotal: 1,
+                metadata: {
+                    source: 'template-instant',
+                    templateName: result.templateName,
+                    processingMs: result.processingMs,
+                    route: this.lastAgentRoute,
+                },
+            }, null, 2));
+        }
         return true;
     }
     async tryDirectSingleFileFlow(prompt) {
@@ -3328,7 +3409,8 @@ export class ChatCommand {
                     console.log(this.renderAgentAnswerForTerminal(finalAnswer));
                 }
             }
-            if (!executorSucceeded && requiresWorkspaceChanges && changedFileCount === 0 && !liveOutcome.executorError) {
+            const plannerFailedBeforeTasks = Boolean(liveOutcome.plannerError) && liveOutcome.tasksTotal === 0;
+            if (!executorSucceeded && requiresWorkspaceChanges && changedFileCount === 0 && !liveOutcome.executorError && !plannerFailedBeforeTasks) {
                 const clientToolErrors = this.api.getClientToolErrors();
                 const transportErrors = this.api.getLastChatTransportErrors();
                 if (clientToolErrors.length > 0) {
@@ -3344,6 +3426,12 @@ export class ChatCommand {
                     liveOutcome.plannerError = transportErrors[0];
                 }
             }
+            if (plannerFailedBeforeTasks && !liveOutcome.executorError) {
+                const transportErrors = this.api.getLastChatTransportErrors();
+                if (transportErrors.length > 0) {
+                    liveOutcome.executorError = transportErrors[0];
+                }
+            }
             if (executorSucceeded) {
                 taskDisplay.complete(1);
             }
@@ -3437,7 +3525,7 @@ export class ChatCommand {
                 if (!executorSucceeded) {
                     process.exitCode = 1;
                 }
-                console.log(JSON.stringify({
+                emitAgentJsonOutput({
                     success: executorSucceeded,
                     mode: 'agent',
                     model: routingPolicy.selectedModel,
@@ -3459,7 +3547,7 @@ export class ChatCommand {
                         },
                         previewGate,
                     },
-                }, null, 2));
+                });
             }
             this.messages.push({ role: 'assistant', content: finalAnswer || runEvaluation.statusHeadline });
             this.stopV3IdleWatch();

package/dist/index.js

@@ -54,6 +54,8 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 import { APIClient, sanitizeUserFacingErrorText } from './utils/api.js';
 import { getCliStateFile, isOfflineMode, isSafeNpmPackageSpec, isUpdateCheckSuppressed, readCachedLatestVersion, readGatewayPreflightCache, writeCachedLatestVersion, writeGatewayPreflightCache, } from './utils/cli-state.js';
+import { applyLocalTestfarmDefaults, isLocalTestfarmMode } from './utils/localTestMode.js';
+applyLocalTestfarmDefaults();
 function isApiError(error) {
     return Boolean(error &&
         typeof error === 'object' &&
@@ -398,6 +400,9 @@ function isAuthProtectedCommand(command) {
     return protectedCommands.has(command);
 }
 async function enforceGatewayAuthSession(config, logger, jsonOutputRequested) {
+    if (isLocalTestfarmMode()) {
+        return true;
+    }
     if (!config.isAuthenticated()) {
         return true;
     }

package/dist/utils/agentRoute.js

@@ -3,6 +3,13 @@
  */
 import { inferAgentTaskType, isTrivialHtmlPageRequest, isAgentContinuePrompt, isAgentRetryPrompt, hasGameIntent, hasWebPageIntent, taskRequiresWorkspaceChanges, stripExecutionShaping, } from './requestIntent.js';
 import { isFastInferenceRouterAvailable, routeWithBalanced4b, shouldUseBalancedRouter, } from './fastAgentRouter.js';
+function forceTemplateScaffold() {
+    const v = String(process.env.VIGTHORIA_FORCE_TEMPLATE_SCAFFOLD || '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes';
+}
+function wantsInstantTemplatePath(prompt) {
+    return /instant[- ]template|template[- ]instant|use the instant-template path/i.test(prompt);
+}
 function normalizeTaskKind(value, fallback) {
     const kind = String(value || fallback).trim().toLowerCase();
     const allowed = new Set([
@@ -115,6 +122,16 @@ export async function resolveAgentRoute(api, prompt) {
         };
     }
     if (hasGameIntent(stripped) && regexTask === 'game-build') {
+        if (forceTemplateScaffold() || wantsInstantTemplatePath(stripped)) {
+            return {
+                path: 'template-instant',
+                taskKind: 'game-build',
+                fastPath: 'template-instant',
+                confidence: 0.98,
+                reason: 'express game template scaffold',
+                source: 'regex',
+            };
+        }
         return {
             path: 'v3-agent',
             taskKind: 'game-build',

package/dist/utils/api.d.ts

@@ -256,6 +256,7 @@ export declare class APIClient {
         valid: boolean;
         error?: string;
     }>;
+    private isDirectV3AgentBaseUrl;
     getV3AgentBaseUrls(preferLocal?: boolean): string[];
     getV3AgentRunUrl(baseUrl: string): string;
     getV3AgentContinueUrl(baseUrl: string): string;

package/dist/utils/api.js

@@ -12,10 +12,12 @@ import WebSocket from 'ws';
 import { buildSemanticContext } from './context-ranker.js';
 import { getChangedFiles } from './workspace-cache.js';
 import { isSubstantiveAgentAnswer, isToolEvidenceStubAnswer } from './agentRunOutcome.js';
-import { joinV3WorkspacePath, normalizeV3WorkspaceRelativePath } from './v3-workspace-path.js';
+import { isV3WorkspaceRootAliasPath, joinV3WorkspacePath, normalizeV3WorkspaceRelativePath } from './v3-workspace-path.js';
 import { buildExecutionHints, isPlannerBuildTask, resolvePlannerAgentTimeoutMs } from './requestIntent.js';
 import { isV3StreamKeepaliveEvent } from './v3-stream-events.js';
 import { resolveV3ContextCharLimit, WORKSPACE_FILE_CHAR_CAP, } from './contextBudget.js';
+import { isLocalTestfarmMode, fetchWithServiceTimeout } from './localTestMode.js';
+import { buildClientManifest } from './clientManifest.js';
 export const VIGTHORIA_HUB_CREDITS_URL = 'https://hub.vigthoria.io/credits';
 export const VIGTHORIA_SERVER_TEMPORARILY_UNAVAILABLE_MESSAGE = 'Vigthoria Server is temporarily not available. Please try again later. If the issue persists, please contact support.';
 export class CLIError extends Error {
@@ -258,21 +260,25 @@ export function propagateError(err) {
         },
     };
 }
+// Production safety net — see matching comment in src/commands/chat.ts.
+// These previously defaulted to 0 (disabled), letting a stalled model stream
+// hang the CLI forever with no abort. Set the env vars to 0 to restore the
+// old unbounded behavior for debugging.
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS;
     if (!rawValue) {
-        return 0;
+        return 1_200_000; // 20 min hard cap on the whole agent request
     }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 1_200_000;
 })();
 const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS;
     if (!rawValue) {
-        return 0;
+        return 60_000; // 60s with zero new stream data => abort/retry
     }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 60_000;
 })();
 const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS;
@@ -559,6 +565,16 @@ export class APIClient {
         const enforceTokenShape = options.enforceTokenShape !== false;
         const explicitEnvToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
         const token = this.getAccessToken();
+        if (isLocalTestfarmMode()) {
+            if (!token) {
+                return { valid: false, error: 'Local test mode requires VIGTHORIA_LOCAL_TEST_TOKEN or VIGTHORIA_AUTH_TOKEN' };
+            }
+            const expected = String(process.env.VIGTHORIA_LOCAL_TEST_TOKEN || '').trim();
+            if (expected && token !== expected) {
+                return { valid: false, error: 'VIGTHORIA_LOCAL_TEST_TOKEN mismatch' };
+            }
+            return { valid: true };
+        }
         if (!token) {
             return { valid: false, error: 'No auth token configured. Run: vigthoria login' };
         }
@@ -617,8 +633,18 @@ export class APIClient {
         // Both unreachable — don't assume the stored token is bad when running offline.
         return { valid: true };
     }
+    isDirectV3AgentBaseUrl(baseUrl) {
+        try {
+            const parsed = new URL(String(baseUrl));
+            return parsed.port === '8030' || parsed.port.endsWith('8030');
+        }
+        catch {
+            return /(?:127\.0\.0\.1|localhost|172\.19\.0\.1|host\.lan):(?:\d*8030|8030)/.test(String(baseUrl));
+        }
+    }
     getV3AgentBaseUrls(preferLocal = false) {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
+        const localTestMode = isLocalTestfarmMode();
         const includeLoopbackV3Agent = process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1'
             || (preferLocal && isServerRuntime());
         const localCandidates = [
@@ -626,30 +652,32 @@ export class APIClient {
             process.env.V3_AGENT_URL,
             ...(includeLoopbackV3Agent ? ['http://127.0.0.1:8030'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
-        const remoteCandidates = [
-            configuredApiUrl,
-            'https://coder.vigthoria.io',
-        ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
+        const remoteCandidates = localTestMode
+            ? [configuredApiUrl]
+            : [configuredApiUrl, 'https://coder.vigthoria.io'];
+        const normalizedRemote = remoteCandidates
+            .filter(Boolean)
+            .map((url) => String(url).replace(/\/$/, ''));
         const urls = preferLocal && localCandidates.length > 0
-            ? [...localCandidates, ...remoteCandidates]
-            : [...remoteCandidates, ...localCandidates];
+            ? [...localCandidates, ...normalizedRemote]
+            : [...normalizedRemote, ...localCandidates];
         return [...new Set(urls)];
     }
     getV3AgentRunUrl(baseUrl) {
-        if (/127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)) {
+        if (this.isDirectV3AgentBaseUrl(baseUrl)) {
             return `${baseUrl}/api/agent/run`;
         }
         return `${baseUrl}/api/v3-agent/run`;
     }
     getV3AgentContinueUrl(baseUrl) {
-        if (/127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)) {
+        if (this.isDirectV3AgentBaseUrl(baseUrl)) {
             return `${baseUrl}/api/agent/continue`;
         }
         return `${baseUrl}/api/v3-agent/continue`;
     }
     getV3AgentBackgroundUrl(baseUrl, suffix = '') {
         const cleanSuffix = suffix ? `/${suffix.replace(/^\/+/, '')}` : '';
-        if (/127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)) {
+        if (this.isDirectV3AgentBaseUrl(baseUrl)) {
             return `${baseUrl}/api/agent/background${cleanSuffix}`;
         }
         return `${baseUrl}/api/v3-agent/background${cleanSuffix}`;
@@ -670,13 +698,20 @@ export class APIClient {
     }
     getMcpBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const urls = [
-            process.env.VIGTHORIA_MCP_URL,
-            process.env.MCP_SERVER_URL,
-            'http://127.0.0.1:4008',
-            configuredApiUrl,
-        ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
-        return [...new Set(urls)];
+        const localTestMode = isLocalTestfarmMode();
+        const urls = localTestMode
+            ? [
+                process.env.VIGTHORIA_MCP_URL,
+                process.env.MCP_SERVER_URL,
+                configuredApiUrl,
+            ]
+            : [
+                process.env.VIGTHORIA_MCP_URL,
+                process.env.MCP_SERVER_URL,
+                'http://127.0.0.1:4008',
+                configuredApiUrl,
+            ];
+        return [...new Set(urls.filter(Boolean).map((url) => String(url).replace(/\/$/, '')))];
     }
     getVigFlowBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
@@ -1165,44 +1200,52 @@ export class APIClient {
     async runV3HealthCheck() {
         const endpoints = this.getV3AgentBaseUrls(false);
         const headers = await this.getV3AgentHeaders();
+        const failures = [];
         for (const baseUrl of endpoints) {
             const runUrl = this.getV3AgentRunUrl(baseUrl);
             // Use the lightweight GET /health endpoint — no LLM invocation, responds instantly.
             // For local 8030 the path is /health directly; for remote it's /api/v3-agent/health via proxy.
-            const healthUrl = /127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)
+            const healthUrl = this.isDirectV3AgentBaseUrl(baseUrl)
                 ? `${baseUrl}/health`
                 : `${baseUrl}/api/v3-agent/health`;
-            try {
-                const response = await fetch(healthUrl, {
-                    method: 'GET',
-                    headers,
-                    signal: AbortSignal.timeout(8000),
-                });
-                if (response.status === 401 || response.status === 403) {
-                    return {
-                        healthy: false,
-                        endpoint: runUrl,
-                        error: 'V3 service rejected authentication. Please re-login to refresh your token.',
-                    };
+            for (let attempt = 1; attempt <= 3; attempt += 1) {
+                try {
+                    const response = await fetch(healthUrl, {
+                        method: 'GET',
+                        headers,
+                        signal: AbortSignal.timeout(8000),
+                    });
+                    if (response.status === 401 || response.status === 403) {
+                        return {
+                            healthy: false,
+                            endpoint: runUrl,
+                            error: 'V3 service rejected authentication. Please re-login to refresh your token.',
+                        };
+                    }
+                    // 200 OK or 405 Method Not Allowed both mean V3 is reachable.
+                    if (response.ok || response.status === 405) {
+                        return { healthy: true, endpoint: runUrl };
+                    }
+                    failures.push(`${healthUrl} attempt ${attempt}: HTTP ${response.status}`);
+                }
+                catch (error) {
+                    const reason = sanitizeUserFacingErrorText(error?.message || String(error)).slice(0, 160);
+                    failures.push(`${healthUrl} attempt ${attempt}: ${reason || 'network error'}`);
                 }
-                // 200 OK or 405 Method Not Allowed both mean V3 is reachable
-                if (response.ok || response.status === 405) {
-                    return { healthy: true, endpoint: runUrl };
+                if (attempt < 3) {
+                    await new Promise((resolve) => setTimeout(resolve, 1000 * attempt));
                 }
             }
-            catch {
-                continue;
-            }
         }
         return {
             healthy: false,
             endpoint: endpoints[0] ? this.getV3AgentRunUrl(endpoints[0]) : 'unknown',
-            error: 'V3 service is not reachable during startup preflight. Check if V3 Code Agent is online and reachable.',
+            error: `V3 service is not reachable during startup preflight. Checked ${endpoints.length} endpoint(s). ${failures.slice(-3).join(' | ')}`,
         };
     }
     async runV3AgentAuthPreflight(baseUrl, body, executionContext) {
         const endpoint = this.getV3AgentRunUrl(baseUrl);
-        const healthEndpoint = /127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)
+        const healthEndpoint = this.isDirectV3AgentBaseUrl(baseUrl)
             ? `${baseUrl}/health`
             : `${baseUrl}/api/v3-agent/health`;
         const headers = await this.getV3AgentHeaders();
@@ -1579,6 +1622,9 @@ export class APIClient {
             codebaseContext: resolvedContext.codebaseContext || '',
             accountBrainContext: resolvedContext.accountBrainContext || '',
             projectMemory: resolvedContext.projectMemory || '',
+            clientManifest: buildClientManifest(resolvedContext.clientManifest && typeof resolvedContext.clientManifest === 'object'
+                ? resolvedContext.clientManifest
+                : {}),
         };
         return this.compactV3Context(payload);
     }
@@ -2853,7 +2899,10 @@ menu {
             }
         }
         if (!relativePath && raw !== '.' && raw !== '') {
-            return null;
+            const treatAsWorkspaceRoot = roots.some((sourceRoot) => isV3WorkspaceRootAliasPath(raw, sourceRoot));
+            if (!treatAsWorkspaceRoot) {
+                return null;
+            }
         }
         const absolutePath = relativePath ? joinV3WorkspacePath(rootPath, relativePath) : path.resolve(rootPath);
         const resolvedRoot = path.resolve(rootPath);
@@ -3776,6 +3825,14 @@ document.addEventListener('DOMContentLoaded', () => {
                     else {
                         chunk = await new Promise((resolve, reject) => {
                             let idleTimer = null;
+                            // Hard backstop for the reschedule branches below: even when the
+                            // workspace looks empty (nothing to recover yet) or client tools
+                            // are pending, we must not reschedule forever. Cap total
+                            // unproductive idle time at 10x the idle window (10 min at the
+                            // 60s default) before giving up with a clean timeout instead of
+                            // hanging the CLI indefinitely (TestFarm incident 2026-07-04).
+                            let idleRescheduleCount = 0;
+                            const maxIdleReschedules = 10;
                             const clearIdleTimer = () => {
                                 if (idleTimer) {
                                     clearTimeout(idleTimer);
@@ -3785,7 +3842,8 @@ document.addEventListener('DOMContentLoaded', () => {
                             const scheduleIdleTimer = () => {
                                 clearIdleTimer();
                                 idleTimer = setTimeout(() => {
-                                    if (this.pendingV3ClientToolTasks.size > 0) {
+                                    if (this.pendingV3ClientToolTasks.size > 0 && idleRescheduleCount < maxIdleReschedules) {
+                                        idleRescheduleCount += 1;
                                         scheduleIdleTimer();
                                         return;
                                     }
@@ -3803,6 +3861,22 @@ document.addEventListener('DOMContentLoaded', () => {
                                         reject(stalledError);
                                         return;
                                     }
+                                    if (idleRescheduleCount >= maxIdleReschedules) {
+                                        const timeoutError = new Error(`V3 agent stream timed out after ${Math.round((idleTimeoutMs * (maxIdleReschedules + 1)) / 1000)}s with no data ` +
+                                            '(model likely stopped after a thinking block without emitting a tool call or final answer).');
+                                        timeoutError.name = 'AbortError';
+                                        timeoutError.partialData = {
+                                            task_id: events.find((event) => event && event.task_id)?.task_id || null,
+                                            context_id: contextId,
+                                            result: final,
+                                            events,
+                                            files: streamedFiles,
+                                        };
+                                        clearIdleTimer();
+                                        reject(timeoutError);
+                                        return;
+                                    }
+                                    idleRescheduleCount += 1;
                                     scheduleIdleTimer();
                                 }, idleTimeoutMs);
                             };
@@ -4382,6 +4456,8 @@ document.addEventListener('DOMContentLoaded', () => {
         // ground its analysis in real files rather than returning files_analyzed: 0.
         const workspacePath = executionContext.workspacePath || executionContext.projectPath || executionContext.targetPath || process.cwd();
         const workspaceSummary = this.buildLocalWorkspaceSummary(workspacePath);
+        const requestedModel = String(executionContext.model || 'code');
+        const resolvedModel = this.resolveModelId(requestedModel);
         for (const baseUrl of this.getOperatorBaseUrls()) {
             const controller = new AbortController();
             const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
@@ -4401,6 +4477,8 @@ document.addEventListener('DOMContentLoaded', () => {
                         prompt: message,
                         task: message,
                         raw_prompt: executionContext.rawPrompt || null,
+                        model: requestedModel,
+                        preferred_model: resolvedModel,
                         context_id: executionContext.contextId,
                         trace_id: executionContext.traceId,
                         mcp_context_id: executionContext.mcpContextId || null,
@@ -4408,7 +4486,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             workspace: { path: workspacePath },
                             workspace_path: workspacePath,
                             workspace_summary: workspaceSummary,
-                            model: this.resolveModelId(executionContext.model || 'code'),
+                            model: resolvedModel,
                             history: executionContext.history || [],
                             executionSurface: executionContext.executionSurface || 'cli',
                             clientSurface: executionContext.clientSurface || 'cli',
@@ -5915,7 +5993,7 @@ document.addEventListener('DOMContentLoaded', () => {
             return;
         }
         const headers = await this.getV3AgentHeaders();
-        const endpoint = /127\.0\.0\.1:8030|localhost:8030/.test(baseUrl)
+        const endpoint = this.isDirectV3AgentBaseUrl(baseUrl)
             ? `${baseUrl}/api/agent/client-tool-result`
             : `${baseUrl}/api/v3-agent/client-tool-result`;
         const body = JSON.stringify({
@@ -6132,7 +6210,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const endpoint = process.env.VIGTHORIA_HYPERLOOP_URL || `${configuredApiUrl}/api/hyperloop/health`;
         try {
             const token = this.getAccessToken();
-            const response = await fetch(endpoint, {
+            const response = await fetchWithServiceTimeout(endpoint, {
                 method: 'GET',
                 headers: token ? { Authorization: `Bearer ${token}` } : undefined,
             });
@@ -6164,7 +6242,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const token = this.getAccessToken();
         const projectPath = this.resolveAgentTargetPath(context);
         try {
-            const modulesResponse = await fetch(modulesEndpoint, {
+            const modulesResponse = await fetchWithServiceTimeout(modulesEndpoint, {
                 method: 'GET',
                 headers: {
                     ...(token ? { Authorization: `Bearer ${token}` } : {}),
@@ -6178,7 +6256,7 @@ document.addEventListener('DOMContentLoaded', () => {
             const compactor = modules.find((entry) => entry && entry.name === 'repo_context_compactor');
             let compactContextLength = 0;
             try {
-                const probeResponse = await fetch(endpoint, {
+                const probeResponse = await fetchWithServiceTimeout(endpoint, {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
@@ -6260,6 +6338,33 @@ document.addEventListener('DOMContentLoaded', () => {
         const host = process.env.VIGTHORIA_DEVTOOLS_BRIDGE_HOST || '127.0.0.1';
         const port = Number.parseInt(process.env.VIGTHORIA_DEVTOOLS_BRIDGE_PORT || '4016', 10);
         const endpoint = `ws://${host}:${port}/ws`;
+        const healthEndpoint = `http://${host}:${port}/health`;
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 1500);
+            const response = await fetch(healthEndpoint, {
+                signal: controller.signal,
+                headers: { Accept: 'application/json' },
+            });
+            clearTimeout(timer);
+            if (response.ok) {
+                return {
+                    name: 'DevTools Bridge',
+                    endpoint,
+                    ok: true,
+                    details: { host, port, healthEndpoint },
+                };
+            }
+            return {
+                name: 'DevTools Bridge',
+                endpoint,
+                ok: false,
+                error: `HTTP ${response.status}`,
+            };
+        }
+        catch {
+            // Fall back to a raw TCP probe for older bridge builds without /health.
+        }
         return new Promise((resolve) => {
             const socket = net.connect({ host, port, timeout: 1500 }, () => {
                 socket.end();

package/dist/utils/clientManifest.d.ts

@@ -0,0 +1,12 @@
+export type ClientManifestPayload = {
+    product_id: string;
+    version: string;
+    os: string;
+    execution_mode: string;
+    features_allowed: string[];
+};
+/** Detect iSH/Blink-style iOS terminal sandboxes (override, UA, or Linux-on-iOS release string). */
+export declare function isIOSEnvironment(): boolean;
+/** Map Node process.platform/arch to dispatcher gate OS slug. */
+export declare function resolveClientOsSlug(): string;
+export declare function buildClientManifest(overrides?: Partial<ClientManifestPayload>): ClientManifestPayload;

package/dist/utils/clientManifest.js

@@ -0,0 +1,68 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { fileURLToPath } from 'url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const DEFAULT_FEATURES = ['template-instant', 'hyperloop-stream'];
+function readPackageVersion() {
+    const candidates = [
+        path.join(__dirname, '..', '..', 'package.json'),
+        path.join(__dirname, '..', 'package.json'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            if (!fs.existsSync(candidate))
+                continue;
+            const parsed = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+            if (parsed.version)
+                return String(parsed.version);
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    return '0.0.0';
+}
+/** Detect iSH/Blink-style iOS terminal sandboxes (override, UA, or Linux-on-iOS release string). */
+export function isIOSEnvironment() {
+    const override = (process.env.VIGTHORIA_OS_OVERRIDE || '').trim().toLowerCase();
+    if (override === 'ios')
+        return true;
+    const userAgent = (process.env.VIGTHORIA_CLIENT_USER_AGENT || '').trim();
+    if (/ipad|iphone|ios/i.test(userAgent))
+        return true;
+    if (process.platform === 'linux') {
+        const release = os.release().toLowerCase();
+        if (/ipad|iphone|ios/.test(release))
+            return true;
+    }
+    return false;
+}
+/** Map Node process.platform/arch to dispatcher gate OS slug. */
+export function resolveClientOsSlug() {
+    if (isIOSEnvironment()) {
+        return process.arch === 'arm64' ? 'ios-arm64' : 'ios-x64';
+    }
+    if (process.platform === 'win32')
+        return 'windows-x86_64';
+    if (process.platform === 'darwin') {
+        return process.arch === 'arm64' ? 'macos-arm64' : 'macos-x86_64';
+    }
+    if (process.platform === 'linux') {
+        return process.arch === 'arm64' ? 'linux-arm64' : 'linux-x86_64';
+    }
+    return `${process.platform}-${process.arch}`;
+}
+export function buildClientManifest(overrides = {}) {
+    const ios = isIOSEnvironment() && !overrides.os;
+    return {
+        product_id: overrides.product_id || 'vigthoria-cli',
+        version: overrides.version || readPackageVersion(),
+        os: overrides.os || resolveClientOsSlug(),
+        execution_mode: overrides.execution_mode || (ios ? 'mobile-terminal-sandbox' : 'local-user-machine'),
+        features_allowed: overrides.features_allowed?.length
+            ? [...overrides.features_allowed]
+            : [...DEFAULT_FEATURES],
+    };
+}

package/dist/utils/localTestMode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Testfarm / Admin Factory local E2E — bypass public coder.vigthoria.io gateway
+ * when VIGTHORIA_LOCAL_TEST_MODE=1 or VIGTHORIA_LOCAL_TEST_TOKEN is set.
+ */
+export declare function isLocalTestfarmMode(): boolean;
+/** Apply once at CLI startup — idempotent via ??= */
+export declare function applyLocalTestfarmDefaults(): void;
+export declare function resolveHyperloopTimeoutMs(): number;
+export declare function fetchWithServiceTimeout(url: string, init?: RequestInit): Promise<Response>;

package/dist/utils/localTestMode.js

@@ -0,0 +1,42 @@
+/**
+ * Testfarm / Admin Factory local E2E — bypass public coder.vigthoria.io gateway
+ * when VIGTHORIA_LOCAL_TEST_MODE=1 or VIGTHORIA_LOCAL_TEST_TOKEN is set.
+ */
+export function isLocalTestfarmMode() {
+    const flag = String(process.env.VIGTHORIA_LOCAL_TEST_MODE || '').trim().toLowerCase();
+    if (flag === '1' || flag === 'true' || flag === 'yes') {
+        return true;
+    }
+    return Boolean(String(process.env.VIGTHORIA_LOCAL_TEST_TOKEN || '').trim());
+}
+/** Apply once at CLI startup — idempotent via ??= */
+export function applyLocalTestfarmDefaults() {
+    if (!isLocalTestfarmMode()) {
+        return;
+    }
+    process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES ??= '1';
+    process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT ??= '1';
+    process.env.VIGTHORIA_SELF_HOSTED_MODELS_API_URL ??= 'http://127.0.0.1:4009';
+    process.env.VIGTHORIA_HYPERLOOP_URL ??= 'http://127.0.0.1:8020';
+    process.env.VIGTHORIA_HYPERLOOP_EXECUTE_URL ??= 'http://127.0.0.1:8020/execute';
+    process.env.VIGTHORIA_HYPERLOOP_MODULES_URL ??= 'http://127.0.0.1:8020/modules';
+    process.env.VIGTHORIA_V3_AGENT_URL ??= 'http://127.0.0.1:8030';
+    process.env.VIGTHORIA_TEMPLATE_SERVICE_URL ??= 'http://127.0.0.1:4011';
+    process.env.VIGTHORIA_HYPERLOOP_TIMEOUT_MS ??= '180000';
+    const testToken = String(process.env.VIGTHORIA_LOCAL_TEST_TOKEN || '').trim();
+    if (testToken && !process.env.VIGTHORIA_AUTH_TOKEN && !process.env.VIGTHORIA_TOKEN) {
+        process.env.VIGTHORIA_AUTH_TOKEN = testToken;
+    }
+}
+export function resolveHyperloopTimeoutMs() {
+    const raw = process.env.VIGTHORIA_HYPERLOOP_TIMEOUT_MS
+        || process.env.VIGTHORIA_HTTP_TIMEOUT_MS
+        || '120000';
+    const parsed = Number.parseInt(String(raw), 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 120000;
+}
+export async function fetchWithServiceTimeout(url, init = {}) {
+    const ms = resolveHyperloopTimeoutMs();
+    const signal = init.signal ?? AbortSignal.timeout(ms);
+    return fetch(url, { ...init, signal });
+}

package/dist/utils/session.d.ts

@@ -83,6 +83,7 @@ export declare class SessionManager {
      * Load session by ID
      */
     load(id: string): Session | null;
+    private normalizeProjectKey;
     /**
      * Get the most recent session for a project
      */

package/dist/utils/session.js

@@ -251,15 +251,48 @@ export class SessionManager {
             return null;
         }
     }
+    normalizeProjectKey(projectPath) {
+        const raw = String(projectPath || '').trim();
+        if (!raw) {
+            return '';
+        }
+        // Normalize separators and collapse trailing slashes.
+        let normalized = raw.replace(/\\/g, '/').replace(/\/+$/g, '');
+        // Canonicalize obvious Windows drive prefix casing (C:/... === c:/...).
+        const driveMatch = normalized.match(/^([a-zA-Z]):\//);
+        if (driveMatch) {
+            normalized = `${driveMatch[1].toUpperCase()}:${normalized.slice(2)}`;
+        }
+        // Windows paths are case-insensitive in practice for this CLI matching purpose.
+        if (/^[a-zA-Z]:\//.test(normalized) || normalized.startsWith('//')) {
+            return normalized.toLowerCase();
+        }
+        return normalized;
+    }
     /**
      * Get the most recent session for a project
      */
     getLatest(project) {
         const sessions = this.list();
-        const projectSessions = sessions
-            .filter(s => s.project === project)
+        const projectKey = this.normalizeProjectKey(project);
+        const projectBase = path.basename(projectKey || '').toLowerCase();
+        const exactMatches = sessions
+            .filter((s) => this.normalizeProjectKey(s.project) === projectKey)
             .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
-        return projectSessions.length > 0 ? this.load(projectSessions[0].id) : null;
+        if (exactMatches.length > 0) {
+            return this.load(exactMatches[0].id);
+        }
+        // Fallback: if old sessions stored inconsistent slash/case forms, allow
+        // latest same-folder match (e.g., C:\Proj and C:/proj) to preserve /retry UX.
+        if (projectBase) {
+            const softMatches = sessions
+                .filter((s) => path.basename(this.normalizeProjectKey(s.project) || '').toLowerCase() === projectBase)
+                .sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+            if (softMatches.length > 0) {
+                return this.load(softMatches[0].id);
+            }
+        }
+        return null;
     }
     /**
      * List all sessions (metadata only) — corrupt or unreadable files are

package/dist/utils/templateInstantPath.js

@@ -170,6 +170,24 @@ export async function runTemplateInstantPath(api, vision, workspacePath, options
     const target = path.join(workspacePath, entryPath);
     const cleanVision = stripExecutionShaping(vision);
     const preferMinimal = options.forceMinimalFallback === true;
+    const keepScaffold = String(process.env.VIGTHORIA_EXPRESS_KEEP_SCAFFOLD || process.env.CLI_EXPRESS_KEEP_SCAFFOLD || '').trim().toLowerCase();
+    if (['1', 'true', 'yes'].includes(keepScaffold)) {
+        try {
+            const stat = fs.statSync(target);
+            if (stat.isFile() && stat.size >= 8000) {
+                return {
+                    ok: true,
+                    entryPath,
+                    templateName: 'express-preserved-scaffold',
+                    confidence: 1,
+                    processingMs: 0,
+                };
+            }
+        }
+        catch {
+            // fall through to normal template match
+        }
+    }
     let html;
     let usedFallback = false;
     let match = {};

package/dist/utils/tools.js

@@ -2549,6 +2549,21 @@ export class AgenticTools {
             if (!candidate) {
                 return candidate;
             }
+            const redactedWorkspaceAliases = [
+                'www/[internal]/',
+                'var/www/[internal]/',
+                '/var/www/[internal]/',
+                '[internal]/',
+            ];
+            for (const alias of redactedWorkspaceAliases) {
+                if (candidate.startsWith(alias)) {
+                    candidate = candidate.slice(alias.length);
+                    break;
+                }
+            }
+            if (candidate === 'www/[internal]' || candidate === 'var/www/[internal]' || candidate === '/var/www/[internal]' || candidate === '[internal]') {
+                return '';
+            }
             const normalizedRootNoSlash = workspaceRootPosix.replace(/^\//, '');
             const prefixes = [
                 `${workspaceRootPosix}/`,
@@ -2568,13 +2583,14 @@ export class AgenticTools {
             }
             return candidate.replace(/^\//, '');
         };
-        // Resolve the full path (handles both relative and absolute)
+        // Resolve the full path after removing workspace aliases emitted by remote models.
+        const safeInput = stripWorkspacePrefix(normalizedInput);
         let resolvedPath;
-        if (path.isAbsolute(normalizedInput)) {
-            resolvedPath = path.normalize(normalizedInput);
+        if (path.isAbsolute(safeInput)) {
+            resolvedPath = path.normalize(safeInput);
         }
         else {
-            resolvedPath = path.normalize(path.join(this.cwd, stripWorkspacePrefix(normalizedInput)));
+            resolvedPath = path.normalize(path.join(this.cwd, safeInput));
         }
         // SECURITY CHECK: Ensure path is within workspace
         if (!resolvedPath.startsWith(workspaceRoot + path.sep) && resolvedPath !== workspaceRoot) {

package/dist/utils/v3-workspace-path.d.ts

@@ -5,3 +5,5 @@
 export declare function normalizeV3WorkspaceRelativePath(rawPath: string, rootPath?: string): string;
 /** Join workspace root + relative path without path.resolve URI corruption on Windows. */
 export declare function joinV3WorkspacePath(rootPath: string, relativePath: string): string;
+/** True when rawPath points to workspace root via aliases or scrubbed placeholders. */
+export declare function isV3WorkspaceRootAliasPath(rawPath: string, rootPath?: string): boolean;

package/dist/utils/v3-workspace-path.js

@@ -1,4 +1,12 @@
 import path from 'path';
+const WORKSPACE_PLACEHOLDER_SEGMENT = /\[(?:internal|Vigthoria service|Vigthoria Agent|Vigthoria storage|temp|home|workspace)\]/ig;
+function stripInlineWorkspacePlaceholders(value) {
+    // Only strip placeholders when they were appended to a segment (e.g. pitfall[Vigthoria service]).
+    // Keep canonical scrubbed segments like /[internal]/ intact for dedicated mapping logic.
+    return String(value || '')
+        .replace(/(^|[^/])\[(?:internal|Vigthoria service|Vigthoria Agent|Vigthoria storage|temp|home|workspace)\](?=(?:\/|$))/ig, '$1')
+        .replace(/\/+$/g, '');
+}
 /**
  * Normalize V3 SSE / tool paths to a safe workspace-relative POSIX path.
  * Decodes vigthoria:// boundary URIs from server scrubbing before local writes.
@@ -8,6 +16,7 @@ export function normalizeV3WorkspaceRelativePath(rawPath, rootPath) {
     if (!input) {
         return '';
     }
+    input = stripInlineWorkspacePlaceholders(input);
     const safeRelative = (candidate) => {
         const stripped = String(candidate || '').replace(/^\/+/, '');
         if (!stripped) {
@@ -43,7 +52,7 @@ export function normalizeV3WorkspaceRelativePath(rawPath, rootPath) {
         return null;
     };
     const stripScrubbedPlaceholder = (value) => {
-        let candidate = String(value || '').replace(/^\/+/, '');
+        let candidate = stripInlineWorkspacePlaceholders(String(value || '')).replace(/^\/+/, '');
         // Hybrid paths models echo back after SSE scrubbing, e.g. C:/var/www/[internal]/game.js
         const hybridWin = candidate.match(/^[a-zA-Z]:\/(?:var\/)?www\/\[internal\](?:\/(.*))?$/i);
         if (hybridWin) {
@@ -70,7 +79,7 @@ export function normalizeV3WorkspaceRelativePath(rawPath, rootPath) {
                 return safeRelative(match[groupIndex] || '');
             }
         }
-        const bracketSplit = candidate.split(/\[(?:internal|Vigthoria service|Vigthoria Agent|temp|home|workspace)\]/i);
+        const bracketSplit = candidate.split(WORKSPACE_PLACEHOLDER_SEGMENT);
         if (bracketSplit.length > 1) {
             const tail = bracketSplit[bracketSplit.length - 1].replace(/^\/+/, '');
             return safeRelative(tail);
@@ -152,3 +161,34 @@ export function joinV3WorkspacePath(rootPath, relativePath) {
     const segments = relativePath.split('/').filter((segment) => segment && segment !== '.');
     return path.join(rootPath, ...segments);
 }
+/** True when rawPath points to workspace root via aliases or scrubbed placeholders. */
+export function isV3WorkspaceRootAliasPath(rawPath, rootPath) {
+    const original = String(rawPath || '').trim();
+    if (!original || original === '.') {
+        return true;
+    }
+    const sanitized = stripInlineWorkspacePlaceholders(original).replace(/\\/g, '/').trim();
+    if (!sanitized || sanitized === '.' || sanitized === '/') {
+        return true;
+    }
+    const candidate = sanitized.replace(/^\/+/, '');
+    if (!candidate) {
+        return true;
+    }
+    const lowered = candidate.toLowerCase();
+    if (lowered === 'workspace'
+        || lowered === '[workspace]'
+        || lowered === '[internal]'
+        || lowered === 'www/[internal]'
+        || lowered === 'var/www/[internal]'
+        || lowered === '[vigthoria service]'
+        || lowered === 'var/www/[vigthoria service]') {
+        return true;
+    }
+    const normalizedRoot = String(rootPath || '').trim().replace(/\\/g, '/').replace(/\/+$/g, '');
+    if (!normalizedRoot) {
+        return false;
+    }
+    const normalizedInput = sanitized.replace(/\/+$/g, '');
+    return normalizedInput.toLowerCase() === normalizedRoot.toLowerCase();
+}

package/install.ps1

@@ -5,7 +5,7 @@
 $ErrorActionPreference = "Stop"
 
 # Configuration
-$CLI_VERSION = "1.11.25"
+$CLI_VERSION = "1.11.42"
 $INSTALL_DIR = "$env:USERPROFILE\.vigthoria"
 $NPM_PACKAGE = "vigthoria-cli"
 $GIT_PACKAGE_URL = "git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"

package/install.sh

@@ -26,7 +26,7 @@ else
 fi
 
 # Configuration
-CLI_VERSION="1.11.25"
+CLI_VERSION="1.11.42"
 INSTALL_DIR="$HOME/.vigthoria"
 REPO_URL="https://market.vigthoria.io/vigthoria/vigthoria-cli"
 GIT_PACKAGE_URL="git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.11.36",
+  "version": "1.11.43",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",
@@ -70,6 +70,7 @@
     "test:legion:billing:e2e": "npm run build && node scripts/test-legion-godmode-billing-e2e.js",
     "test:windows:v3-sync": "npm run build && node scripts/test-windows-v3-sync-recovery.js",
     "test:v3-workspace-path": "npm run build && node scripts/test-v3-workspace-path.js",
+    "test:session:project-match": "npm run build && node scripts/test-session-project-match.mjs",
     "test:v3-stream-mutation": "npm run build && node scripts/test-v3-stream-mutation.js",
     "test:context:budget": "npm run build && node scripts/test-context-budget.js",
     "test:pitfall:context": "npm run build && node scripts/test-pitfall-context-smoke.js"

package/scripts/release/validate-no-go-gates.sh

@@ -122,7 +122,10 @@ PY
 echo "[7.5 policy] secured hyperloop endpoint"
 code=$(curl -s -o /dev/null -w "%{http_code}" https://coder.vigthoria.io/api/hyperloop/health)
 echo "unauth_hyperloop_code=$code"
-[[ "$code" == "401" ]]
+# 401 = correct JSON auth error for API callers. 302 (redirect to /login) is
+# also acceptable defense-in-depth: it still requires auth, just via the
+# browser-session redirect path some legacy middleware uses.
+[[ "$code" == "401" || "$code" == "302" ]]
 
 echo "[8.2] runtime symlink guard signals"
 rg -n "realpathSync|results.length >= maxFiles|pattern = kw.length <= 4" dist/utils/context-ranker.js >/tmp/vig-ranker-signals.txt