vigthoria-cli 1.12.2 → 1.13.6

package/dist/index.js

@@ -31,6 +31,7 @@ import { BridgeCommand } from './commands/bridge.js';
 import { DeviceCommand } from './commands/device.js';
 import { WorkflowCommand } from './commands/workflow.js';
 import { PreviewCommand } from './commands/preview.js';
+import { GameCommand } from './commands/game.js';
 import { LegionCommand } from './commands/legion.js';
 import { HistoryCommand } from './commands/history.js';
 import { ReplayCommand } from './commands/replay.js';
@@ -38,7 +39,7 @@ import { ForkCommand } from './commands/fork.js';
 import { CancelCommand } from './commands/cancel.js';
 import { BackgroundCommand } from './commands/background.js';
 import { SecurityCommand } from './commands/security.js';
-import { V4Command, defaultV4PythonBin, defaultV4AgentDir } from './commands/v4.js';
+import { V4Command } from './commands/v4.js';
 import { runV4Menu } from './commands/v4-menu.js';
 import { Config } from './utils/config.js';
 import { Logger, CH } from './utils/logger.js';
@@ -49,6 +50,7 @@ import * as os from 'os';
 import { fileURLToPath } from 'url';
 import { createHash } from 'crypto';
 import axios from 'axios';
+import { renderDynamicHelp, selectInteractiveCommand } from './utils/command-menu.js';
 // ESM shim — TypeScript emits ESM under "type": "module", so __dirname
 // is not available natively.  Restore the CommonJS-style helper so the
 // pre-existing package-discovery logic continues to work unchanged.
@@ -58,6 +60,44 @@ import { APIClient, sanitizeUserFacingErrorText } from './utils/api.js';
 import { getCliStateFile, isOfflineMode, isSafeNpmPackageSpec, isUpdateCheckSuppressed, readCachedLatestVersion, readGatewayPreflightCache, writeCachedLatestVersion, writeGatewayPreflightCache, } from './utils/cli-state.js';
 import { applyLocalTestfarmDefaults, isLocalTestfarmMode } from './utils/localTestMode.js';
 applyLocalTestfarmDefaults();
+// --- Terminal column-width safety clamp -----------------------------------
+// Node's `readline` module (used for the interactive chat `> ` prompt and a
+// few other prompts) redraws the current input line on every keystroke using
+// cursor-position math derived from `process.stdout.columns`. When this CLI
+// runs inside a freshly-spawned ConPTY child (e.g. the Vigthoria Workbench's
+// embedded terminal pane on Windows), there is a brief window right after
+// process start where the console width hasn't been reported yet (or is
+// reported as an implausibly small value like 0/1) before the real terminal
+// size propagates down to the child process. Because `readline` reads
+// `columns` fresh on every redraw (not just once at startup), an early or
+// transient bad reading makes it believe the terminal is only 1 column wide,
+// so it moves the cursor to a new row (and re-indents) after every single
+// typed character -- producing a "staircase" of one-character lines that
+// looks exactly like what's reported. This has nothing to do with the host
+// terminal's real (correct) width; it's purely readline believing a bad
+// number. Clamp `columns`/`rows` to sane floors up front and keep them
+// clamped on every real resize event so readline never sees an implausible
+// value, regardless of what the host terminal actually reports.
+const MIN_TTY_COLUMNS = 30;
+const MIN_TTY_ROWS = 4;
+function clampStreamSize(stream) {
+    if (!stream || !stream.isTTY)
+        return;
+    if (!Number.isFinite(stream.columns) || (stream.columns ?? 0) < MIN_TTY_COLUMNS) {
+        stream.columns = 80;
+    }
+    if (!Number.isFinite(stream.rows) || (stream.rows ?? 0) < MIN_TTY_ROWS) {
+        stream.rows = 24;
+    }
+}
+clampStreamSize(process.stdout);
+clampStreamSize(process.stderr);
+if (process.stdout.isTTY) {
+    process.stdout.on('resize', () => clampStreamSize(process.stdout));
+}
+if (process.stderr.isTTY) {
+    process.stderr.on('resize', () => clampStreamSize(process.stderr));
+}
 function isApiError(error) {
     return Boolean(error &&
         typeof error === 'object' &&
@@ -200,10 +240,14 @@ function maxVersion(...versions) {
 async function fetchNpmLatestVersion() {
     const { execSync } = await import('child_process');
     try {
+        // Hard 5s timeout: a slow/blocked path to the public npm registry must
+        // never hang the caller (e.g. the Workbench's blocking `vigthoria update`
+        // invocation) indefinitely.
         const latest = execSync('npm view vigthoria-cli version', {
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
             windowsHide: true,
+            timeout: 5000,
         }).trim();
         return latest || null;
     }
@@ -212,7 +256,7 @@ async function fetchNpmLatestVersion() {
     }
 }
 const VERSION = getVersion();
-const VIGTHORIA_DEFAULT_MANIFEST_URL = process.env.VIGTHORIA_UPDATE_MANIFEST_URL || "https://extension.vigthoria.io/downloads/manifest.json";
+const VIGTHORIA_DEFAULT_MANIFEST_URL = process.env.VIGTHORIA_UPDATE_MANIFEST_URL || "https://coder.vigthoria.io/releases/manifest.json";
 function resolveManifestEntry(manifest, channel) {
     const normalized = String(channel || 'stable').trim() || 'stable';
     if (manifest.channels && manifest.channels[normalized]) {
@@ -321,6 +365,10 @@ async function installGlobalPackageWithNpm(packageSpec) {
                 stdio: 'inherit',
                 windowsHide: true,
                 shell: attempt.shell === true,
+                // Hard cap so a stalled/hung npm install (registry outage, network
+                // issue, etc.) can never block the caller indefinitely - especially
+                // important since the Workbench invokes this synchronously.
+                timeout: 180000,
             });
             return;
         }
@@ -585,8 +633,13 @@ export async function main(args) {
         !jsonOutputRequested &&
         !directPromptRequested &&
         !helpOrVersionRequested) {
+        // process.stdout.columns is not always a reliable indicator of how
+        // many columns actually render visually (seen mismatching badly in some
+        // embedded/split-pane terminal hosts on Windows) -- cap the box at a
+        // conservative width so it never overflows even when the reported
+        // column count is larger than the real usable width.
         const terminalWidth = Math.max(36, Number(process.stdout.columns || 80));
-        const boxWidth = Math.max(34, Math.min(61, terminalWidth - 2));
+        const boxWidth = Math.max(34, Math.min(44, terminalWidth - 8));
         const innerWidth = boxWidth;
         const fit = (text) => {
             const clean = String(text || '').replace(/\s+/g, ' ').trim();
@@ -641,7 +694,7 @@ export async function main(args) {
         .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger, program);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -670,7 +723,7 @@ export async function main(args) {
         .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger, program);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -702,7 +755,7 @@ export async function main(args) {
         .option('--auto-approve', 'Auto-approve all actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger, program);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -732,7 +785,7 @@ export async function main(args) {
         .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger, program);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -747,37 +800,7 @@ export async function main(args) {
             bridge: options.bridge,
         });
     });
-    program
-        .command('v4')
-        .alias('v4-agent')
-        .description('Launch Vigthoria V4 Operating Agent (DeerFlow 2.0 harness)')
-        .option('--provider <provider>', 'Provider: cloud | v3_local | byok')
-        .option('--api-key <key>', 'BYOK API key for non-interactive mode')
-        .option('--base-url <url>', 'Provider base URL override')
-        .option('--model <name>', 'Provider model override')
-        .option('--transport <mode>', 'Bridge transport: auto | ws | sse', 'auto')
-        .option('--harness-stream-url <url>', 'Override harness stream URL')
-        .option('--harness-control-url <url>', 'Override harness control URL')
-        .option('--session-id <id>', 'Explicit V4 session id')
-        .option('--non-interactive', 'Disable interactive menu and use CLI options', false)
-        .option('--python <bin>', 'Python binary to use', defaultV4PythonBin())
-        .option('--v4-path <path>', 'V4 agent root path (or set VIGTHORIA_V4_AGENT_DIR)', defaultV4AgentDir())
-        .action(async (options) => {
-        const v4 = new V4Command(config, logger);
-        await v4.run({
-            provider: options.provider,
-            apiKey: options.apiKey,
-            baseUrl: options.baseUrl,
-            model: options.model,
-            transport: options.transport,
-            harnessStreamUrl: options.harnessStreamUrl,
-            harnessControlUrl: options.harnessControlUrl,
-            sessionId: options.sessionId,
-            nonInteractive: options.nonInteractive,
-            python: options.python,
-            v4Path: options.v4Path,
-        });
-    });
+    new V4Command(config, logger).register(program);
     program
         .command('v4-menu')
         .description('Internal: interactive V3/V4 agent + provider picker used by the V4 Operating Agent launcher')
@@ -1138,20 +1161,21 @@ export async function main(args) {
         await music.status(taskId, options);
     });
     // ==================== REPO COMMANDS ====================
-    // Repo command - Push/Pull projects to/from Vigthoria Repository
+    // Repo command - Push/Pull projects to/from Vigthoria Community Repository
     const repoCommand = program
         .command('repo')
         .alias('repository')
-        .description('Push and pull projects to/from your Vigthoria Repository');
+        .description('Push and pull projects to/from your Vigthoria Community Repository');
     repoCommand
         .command('push [path]')
         .alias('upload')
-        .description('Push current or specified project to Vigthoria Repo')
+        .description('Push current or specified project to Vigthoria Community Repository')
         .option('-n, --name <projectName>', 'Project name override for the remote repo')
         .option('-v, --visibility <type>', 'Set visibility (private, restricted, public)', 'private')
         .option('-d, --description <text>', 'Project description')
         .option('-f, --force', 'Overwrite existing project', false)
         .option('-y, --yes', 'Run non-interactively with provided/default values', false)
+        .option('--retry <reviewId>', 'Link this corrected push to a repository security review')
         .option('--open-in <engine>', 'After push, open project in engine: shop, visual, game')
         .option('--browser', 'Open result URL in default browser', false)
         .action(async (pathArg, options) => {
@@ -1162,7 +1186,8 @@ export async function main(args) {
             visibility: options.visibility,
             description: options.description,
             force: options.force,
-            yes: options.yes
+            yes: options.yes,
+            retry: options.retry
         });
         if (options.openIn) {
             const engine = options.openIn;
@@ -1174,10 +1199,18 @@ export async function main(args) {
             }
         }
     });
+    repoCommand
+        .command('review [reviewId]')
+        .description('Show repository security review status, findings, and retry guidance')
+        .option('--json', 'Emit machine-readable JSON output', false)
+        .action(async (reviewId, options) => {
+        const repo = new RepoCommand(config, logger);
+        await repo.review(reviewId, { json: options.json });
+    });
     repoCommand
         .command('pull <name>')
         .alias('download')
-        .description('Pull a project from your Vigthoria Repo')
+        .description('Pull a project from your Vigthoria Community Repository')
         .option('-o, --output <path>', 'Output directory path')
         .option('-f, --force', 'Overwrite existing directory', false)
         .action(async (name, options) => {
@@ -1190,7 +1223,7 @@ export async function main(args) {
     repoCommand
         .command('list')
         .alias('ls')
-        .description('List all your projects in Vigthoria Repo')
+        .description('List all your projects in Vigthoria Community Repository')
         .option('-v, --visibility <type>', 'Filter by visibility (private, restricted, public)')
         .action(async (options) => {
         const repo = new RepoCommand(config, logger);
@@ -1214,14 +1247,14 @@ export async function main(args) {
     repoCommand
         .command('delete <name>')
         .alias('rm')
-        .description('Remove a project from your Vigthoria Repo')
+        .description('Remove a project from your Vigthoria Community Repository')
         .action(async (name) => {
         const repo = new RepoCommand(config, logger);
         await repo.delete(name);
     });
     repoCommand
         .command('clone <url>')
-        .description('Clone a public project from Vigthoria Repo')
+        .description('Clone a public project from Vigthoria Community')
         .option('-o, --output <path>', 'Output directory path')
         .option('-f, --force', 'Overwrite existing directory', false)
         .action(async (url, options) => {
@@ -1233,7 +1266,7 @@ export async function main(args) {
     });
     repoCommand
         .command('open-in <engine> [projectName]')
-        .description('Open a Vigthoria Repo project in the Shop Engine, Visual Editor, or Gaming Engine')
+        .description('Open a Vigthoria Community Repository project in the Shop Engine, Visual Editor, or Gaming Engine')
         .option('--browser', 'Open result URL in default browser', false)
         .option('--shop-id <id>', 'Target shop ID (for shop engine)', 'default')
         .addHelpText('after', `
@@ -1411,6 +1444,12 @@ Examples:
             screenshot: options.screenshot,
         });
     });
+    // ==================== GAME COMMAND ====================
+    const gameCommand = program.command('game').description('Create, run, and validate Babylon/VGE game projects');
+    gameCommand.command('init [name]').description('Create a production-ready client-rendered Babylon/VGE game').option('--engine <engine>', 'Game engine', 'babylon').option('--no-install', 'Create files without installing dependencies').option('--package-manager <manager>', 'npm, pnpm, yarn, or bun').action(async (name, options) => { await new GameCommand(logger).init(name, options); });
+    gameCommand.command('run').description('Run the local game development server').option('-p, --project <path>', 'Game project directory', process.cwd()).option('--port <number>', 'Development server port', parseInt).option('--no-open', 'Do not open a browser').option('--package-manager <manager>', 'npm, pnpm, yarn, or bun').action(async (options) => { await new GameCommand(logger).run(options); });
+    gameCommand.command('validate').description('Build and validate a Babylon/VGE game project').option('-p, --project <path>', 'Game project directory', process.cwd()).option('--json', 'Print machine-readable validation results').option('--package-manager <manager>', 'npm, pnpm, yarn, or bun').action(async (options) => { await new GameCommand(logger).validate(options); });
+    gameCommand.action(() => gameCommand.outputHelp());
     // ==================== LEGION COMMAND ====================
     program
         .command('legion [request]')
@@ -1671,10 +1710,23 @@ Examples:
                 console.log(chalk.gray('Continuing with npm registry check...'));
             }
         }
-        console.log(chalk.cyan('Checking npm registry...'));
-        const npmVersion = await fetchNpmLatestVersion();
-        if (!npmVersion) {
-            console.log(chalk.yellow('Could not read latest version from npm registry.'));
+        // The release manifest (server-curated, sha256-verified) is the
+        // authoritative source of truth for this private CLI. Only fall back
+        // to probing the public npm registry when the manifest itself has no
+        // usable entry - never let an npm version number override a valid,
+        // verified manifest entry (npm install -g against the public registry
+        // is slower, unverified, and has previously caused the Workbench's
+        // update button to hang for minutes).
+        let npmVersion = null;
+        if (manifestEntry?.version && manifestEntry?.url) {
+            console.log(chalk.gray('Release manifest has a valid entry; skipping public npm registry lookup.'));
+        }
+        else {
+            console.log(chalk.cyan('Checking npm registry...'));
+            npmVersion = await fetchNpmLatestVersion();
+            if (!npmVersion) {
+                console.log(chalk.yellow('Could not read latest version from npm registry.'));
+            }
         }
         const effectiveLatest = maxVersion(manifestEntry?.version, npmVersion);
         if (!effectiveLatest) {
@@ -1682,11 +1734,6 @@ Examples:
             process.exitCode = 1;
             return;
         }
-        if (manifestEntry?.version
-            && npmVersion
-            && compareVersions(npmVersion, manifestEntry.version) > 0) {
-            console.log(chalk.yellow(`Release manifest (${manifestEntry.version}) is behind npm (${npmVersion}); npm will be used when needed.`));
-        }
         if (!allowDowngrade && compareVersions(effectiveLatest, currentVersion) <= 0) {
             console.log(chalk.green(`You are running the latest version (${currentVersion})`));
             return;
@@ -1802,6 +1849,21 @@ Examples:
         const configCmd = new ConfigCommand(config, logger);
         await configCmd.init();
     });
+    program
+        .command('menu')
+        .description('Open the interactive command-family menu')
+        .action(async () => {
+        const selectedArgs = await selectInteractiveCommand(program);
+        if (selectedArgs) {
+            await program.parseAsync([args[0], args[1], ...selectedArgs]);
+        }
+    });
+    program
+        .command('commands')
+        .description('List every CLI command grouped by command family')
+        .action(() => {
+        console.log(renderDynamicHelp(program));
+    });
     const codingCommandDefinitions = [
         { name: 'edit', description: 'Edit code by describing the desired change', instruction: 'Edit the project according to this request' },
         { name: 'generate', description: 'Generate code from a prompt', instruction: 'Generate code for this request' },
@@ -1818,7 +1880,7 @@ Examples:
             .option('-p, --project <path>', 'Project directory', process.cwd())
             .action(async (requestParts = [], options) => {
             const requestText = requestParts.join(' ').trim();
-            const chat = new ChatCommand(config, logger);
+            const chat = new ChatCommand(config, logger, program);
             await chat.run({
                 model: options.model || 'code',
                 project: options.project || process.cwd(),
@@ -1829,8 +1891,10 @@ Examples:
     try {
         // Default to chat if no command
         if (args.length === 2) {
-            const chat = new ChatCommand(config, logger);
-            await chat.run({ model: 'code', project: process.cwd() });
+            const selectedArgs = await selectInteractiveCommand(program);
+            if (selectedArgs) {
+                await program.parseAsync([args[0], args[1], ...selectedArgs]);
+            }
             process.exitCode = 0;
             return;
         }

package/dist/utils/api.d.ts

@@ -277,6 +277,7 @@ export declare class APIClient {
     private listFrontendWorkspaceFiles;
     private chooseFrontendPreviewEntry;
     private extractLinkedFrontendAssets;
+    private buildFrontendForPreview;
     private gatherFrontendPreviewArtifacts;
     private captureFrontendPreviewScreenshot;
     private evaluateFrontendVisualProof;

package/dist/utils/api.js

@@ -3,6 +3,7 @@
  * Connects to coder.vigthoria.io API endpoints
  */
 import axios from 'axios';
+import { execFile } from 'child_process';
 import { randomUUID } from 'crypto';
 import fs from 'fs';
 import https from 'https';
@@ -743,8 +744,8 @@ export class APIClient {
         const urls = [
             process.env.VIGTHORIA_TEMPLATE_SERVICE_URL,
             process.env.TEMPLATE_SERVICE_URL,
-            'http://127.0.0.1:4011',
             `${configuredApiUrl}/api/template-service`,
+            'http://127.0.0.1:4011',
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -842,7 +843,15 @@ export class APIClient {
             const baseName = path.posix.basename(relativePath).toLowerCase();
             const depth = relativePath.split('/').length - 1;
             let score = 0;
-            if (relativePath.toLowerCase() === 'index.html') {
+            const normalizedPath = relativePath.toLowerCase();
+            const topLevelDir = normalizedPath.split('/')[0];
+            if (['dist', 'build', 'out'].includes(topLevelDir)) {
+                score += 320;
+            }
+            else if (topLevelDir === 'public') {
+                score += 180;
+            }
+            if (normalizedPath === 'index.html') {
                 score += 200;
             }
             if (baseName === 'index.html') {
@@ -896,6 +905,34 @@ export class APIClient {
             js: Array.from(js),
         };
     }
+    async buildFrontendForPreview(rootPath) {
+        const packagePath = path.join(rootPath, 'package.json');
+        if (!fs.existsSync(packagePath)) {
+            return { attempted: false, succeeded: false };
+        }
+        try {
+            const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+            if (!packageJson.scripts?.build) {
+                return { attempted: false, succeeded: false };
+            }
+        }
+        catch (error) {
+            return { attempted: false, succeeded: false, error: `Invalid package.json: ${error?.message || String(error)}` };
+        }
+        const npmCommand = process.platform === 'win32' ? (process.env.ComSpec || 'cmd.exe') : 'npm';
+        const npmArgs = process.platform === 'win32'
+            ? ['/d', '/s', '/c', 'npm run build']
+            : ['run', 'build'];
+        return await new Promise((resolve) => {
+            execFile(npmCommand, npmArgs, { cwd: rootPath, timeout: 150_000, windowsHide: true, maxBuffer: 2 * 1024 * 1024 }, (error) => {
+                if (error) {
+                    resolve({ attempted: true, succeeded: false, error: sanitizeUserFacingErrorText(error.message).slice(0, 300) });
+                    return;
+                }
+                resolve({ attempted: true, succeeded: true });
+            });
+        });
+    }
     gatherFrontendPreviewArtifacts(message = '', context = {}) {
         const rootPath = this.resolveAgentTargetPath(context);
         if (!rootPath || !fs.existsSync(rootPath)) {
@@ -1051,12 +1088,22 @@ export class APIClient {
             return { required: false, passed: true };
         }
         const rootPath = this.resolveAgentTargetPath(context);
-        const artifacts = this.gatherFrontendPreviewArtifacts(message, context);
+        let artifacts = this.gatherFrontendPreviewArtifacts(message, context);
+        let buildResult = null;
+        if (rootPath && artifacts.error?.includes('at least one HTML entry file')) {
+            buildResult = await this.buildFrontendForPreview(rootPath);
+            if (buildResult.attempted) {
+                artifacts = this.gatherFrontendPreviewArtifacts(message, context);
+            }
+        }
         if (artifacts.error || !artifacts.htmlPath || typeof artifacts.html !== 'string') {
+            const buildDetail = buildResult?.attempted
+                ? ` Build retry ${buildResult.succeeded ? 'completed but produced no HTML entry' : `failed: ${buildResult.error || 'unknown build error'}`}.`
+                : '';
             return {
                 required: true,
                 passed: false,
-                error: artifacts.error || 'Frontend preview gate could not collect frontend artifacts.',
+                error: `${artifacts.error || 'Frontend preview gate could not collect frontend artifacts.'}${buildDetail}`,
             };
         }
         // Cap artifact sizes to prevent 413 Payload Too Large
@@ -1083,11 +1130,19 @@ export class APIClient {
                         error: 'Preview proof skipped: payload exceeds size limit.',
                     };
                 }
+                const internalServiceKey = process.env.VIGTHORIA_TEMPLATE_SERVICE_KEY
+                    || process.env.V3_SERVICE_KEY;
+                const authToken = this.getAccessToken();
                 const response = await fetch(`${baseUrl}/preview-proof`, {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
                         Accept: 'application/json',
+                        ...(authToken ? {
+                            Authorization: `Bearer ${authToken}`,
+                            Cookie: `vigthoria-auth-token=${authToken}`,
+                        } : {}),
+                        ...(internalServiceKey ? { 'x-vigthoria-service-key': internalServiceKey } : {}),
                     },
                     body: proofPayload,
                 });
@@ -1772,10 +1827,14 @@ export class APIClient {
         return finish();
     }
     /** Normalize common Unix-only commands before Windows cmd/powershell execution. */
-    normalizeWindowsRunCommand(command) {
+    normalizeWindowsRunCommand(command, serverRoot = '') {
         let cmd = String(command || '').trim();
         if (!cmd)
             return cmd;
+        if (serverRoot) {
+            const escapedRoot = serverRoot.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            cmd = cmd.replace(new RegExp(`^\\s*cd\\s+(?:[\"']?${escapedRoot}[\"']?)\\s*(?:&&|;)\\s*`, 'i'), '');
+        }
         if (/^\/[^\s/]/.test(cmd) && !/^\/[a-z]:/i.test(cmd)) {
             throw new Error('Command starts with "/" which Windows interprets as an invalid switch. Use workspace-relative paths without a leading slash.');
         }
@@ -3082,38 +3141,35 @@ menu {
                     return { success: false, output: '', error: 'run_command requires command.' };
                 try {
                     if (process.platform === 'win32') {
-                        command = this.normalizeWindowsRunCommand(command);
+                        command = this.normalizeWindowsRunCommand(command, serverRoot);
                     }
                 }
                 catch (error) {
                     return { success: false, output: '', error: error.message };
                 }
                 const cwd = this.resolveRunCommandCwd(rootPath, args, serverRoot);
-                const usePowerShell = process.platform === 'win32'
-                    && /^(npm|npx|node|yarn|pnpm|git|python|pip|powershell)\b/i.test(command);
-                const { exec } = await import('child_process');
+                const { exec, execFile } = await import('child_process');
                 return await new Promise((resolve) => {
-                    const execOptions = {
-                        cwd,
-                        timeout: Number(args.timeout || 30000),
-                        maxBuffer: 1024 * 1024,
-                        env: process.env,
-                    };
-                    if (usePowerShell) {
-                        execOptions.shell = 'powershell.exe';
-                        execOptions.windowsHide = true;
-                        command = `-NoProfile -ExecutionPolicy Bypass -Command ${JSON.stringify(command)}`;
-                    }
-                    else if (process.platform === 'win32') {
-                        execOptions.shell = 'cmd.exe';
-                    }
-                    exec(command, execOptions, (error, stdout, stderr) => {
+                    const timeout = Number(args.timeout || 30000);
+                    const finish = (error, stdout, stderr) => {
+                        const stdoutText = String(stdout || '');
+                        const stderrText = String(stderr || '');
+                        const combined = [stdoutText, stderrText].filter(Boolean).join('\n').slice(0, 12000);
                         resolve({
                             success: !error,
-                            output: String(stdout || stderr || '').slice(0, 12000),
-                            error: error ? String(stderr || error.message) : '',
+                            output: combined,
+                            error: error ? String(error.message || error) : '',
                         });
-                    });
+                    };
+                    if (process.platform === 'win32') {
+                        const commandProcessor = process.env.ComSpec
+                            || path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe');
+                        execFile(commandProcessor, ['/d', '/s', '/c', command], {
+                            cwd, timeout, maxBuffer: 1024 * 1024, env: process.env, windowsHide: true,
+                        }, finish);
+                        return;
+                    }
+                    exec(command, { cwd, timeout, maxBuffer: 1024 * 1024, env: process.env }, finish);
                 });
             }
             return { success: false, output: '', error: `Unsupported client tool: ${name}` };

package/dist/utils/brain-hub-client.js

@@ -2,6 +2,22 @@
  * Brain Hub client — sync workspace index + fetch account brain context
  * via coder.vigthoria.io (JWT-authenticated).
  */
+// Brain Hub calls are an optional personalization enhancement to an agent
+// turn, not on the critical path. Native `fetch()` has NO default timeout,
+// so a slow/unresponsive coder.vigthoria.io backend previously caused the
+// ENTIRE agent turn to hang indefinitely with zero console output, well
+// before any "ROUTING DECISION" text is printed (2026-07-10 root-cause).
+const BRAIN_HUB_TIMEOUT_MS = 3500;
+async function fetchWithTimeout(url, init = {}, timeoutMs = BRAIN_HUB_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 export class BrainHubClient {
     apiBase;
     getAuthToken;
@@ -22,27 +38,39 @@ export class BrainHubClient {
         if (!headers.Authorization) {
             return { ok: false, skipped: true, reason: 'not_authenticated' };
         }
-        const resp = await fetch(`${this.apiBase}/api/brain/sync-index`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(payload),
-        });
-        const data = await resp.json().catch(() => ({}));
-        if (!resp.ok) {
-            return { ok: false, error: data.error || `HTTP ${resp.status}` };
+        try {
+            const resp = await fetchWithTimeout(`${this.apiBase}/api/brain/sync-index`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(payload),
+            });
+            const data = await resp.json().catch(() => ({}));
+            if (!resp.ok) {
+                return { ok: false, error: data.error || `HTTP ${resp.status}` };
+            }
+            return data;
+        }
+        catch (error) {
+            const timedOut = error instanceof Error && error.name === 'AbortError';
+            return { ok: false, error: timedOut ? `timeout after ${BRAIN_HUB_TIMEOUT_MS}ms` : String(error) };
         }
-        return data;
     }
     async fetchAccountContext(limit = 25) {
         const headers = await this.headers();
         if (!headers.Authorization) {
             return { ok: false, formattedText: '', memories: [] };
         }
-        const resp = await fetch(`${this.apiBase}/api/brain/context?limit=${limit}`, { headers });
-        const data = await resp.json().catch(() => ({}));
-        if (!resp.ok) {
-            return { ok: false, formattedText: '', error: data.error || `HTTP ${resp.status}` };
+        try {
+            const resp = await fetchWithTimeout(`${this.apiBase}/api/brain/context?limit=${limit}`, { headers });
+            const data = await resp.json().catch(() => ({}));
+            if (!resp.ok) {
+                return { ok: false, formattedText: '', error: data.error || `HTTP ${resp.status}` };
+            }
+            return data;
+        }
+        catch (error) {
+            const timedOut = error instanceof Error && error.name === 'AbortError';
+            return { ok: false, formattedText: '', error: timedOut ? `timeout after ${BRAIN_HUB_TIMEOUT_MS}ms` : String(error) };
         }
-        return data;
     }
 }