vigthoria-cli 1.12.3 → 1.13.7

package/dist/commands/repo.js

@@ -1,7 +1,7 @@
 /**
  * Vigthoria CLI - Repo Commands
  *
- * Push and pull projects to/from Vigthoria Repository
+ * Push and pull projects to/from Vigthoria Community Repository
  * Enables version control and project sharing through the Vigthoria platform
  *
  * Usage:
@@ -19,8 +19,34 @@ import { createRequire } from 'node:module';
 import { createSpinner, CH } from '../utils/logger.js';
 const require = createRequire(import.meta.url);
 import inquirer from 'inquirer';
-import archiver from 'archiver';
+import * as archiverModule from 'archiver';
 import { createWriteStream } from 'fs';
+const MAX_REPOSITORY_CONTENT_BYTES = 100 * 1024 * 1024;
+const MAX_REPOSITORY_REQUEST_BYTES = 120 * 1024 * 1024;
+class RepositoryApiError extends Error {
+    status;
+    payload;
+    constructor(status, payload, fallback) {
+        super(payload?.error || payload?.message || fallback);
+        this.name = 'RepositoryApiError';
+        this.status = status;
+        this.payload = payload || {};
+    }
+}
+function formatBytes(bytes) {
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+}
+async function readResponsePayload(response) {
+    const rawBody = await response.text();
+    if (!rawBody)
+        return {};
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch {
+        return { error: rawBody };
+    }
+}
 export class RepoCommand {
     config;
     logger;
@@ -73,7 +99,11 @@ export class RepoCommand {
                     ...(init.headers || {})
                 }
             });
-            if (response.status === 401 && allowCommunityAuthRetry && !this.communityToken) {
+            // Both 401 (missing/expired credentials) and 403 (a valid Coder
+            // token that Community cannot accept) must activate the explicit
+            // Community credential fallback. Previously a stale/incompatible
+            // Coder token made configured Community credentials unreachable.
+            if ([401, 403].includes(response.status) && allowCommunityAuthRetry && !this.communityToken) {
                 await this.ensureCommunityAuth();
                 if (this.communityToken) {
                     return attempt(url, false);
@@ -83,9 +113,16 @@ export class RepoCommand {
         };
         try {
             const proxyResponse = await attempt(proxyPath, true);
-            if (proxyResponse.ok || proxyResponse.status < 500) {
+            // A large repository payload can exceed the Coder API's general
+            // 50 MiB parser while remaining valid under Community's 100 MiB
+            // repository contract. Retry that one status directly.
+            const shouldTryDirectCommunity = [401, 403, 404, 413].includes(proxyResponse.status);
+            if (proxyResponse.ok || (proxyResponse.status < 500 && !shouldTryDirectCommunity)) {
                 return proxyResponse;
             }
+            if (shouldTryDirectCommunity) {
+                await proxyResponse.body?.cancel();
+            }
         }
         catch {
             // fall through to direct community endpoint
@@ -111,13 +148,32 @@ export class RepoCommand {
                     continue;
                 }
                 try {
+                    const raw = fs.readFileSync(fullPath);
+                    let content;
+                    let encoding;
+                    try {
+                        const sample = new TextDecoder('utf-8', { fatal: true }).decode(raw.subarray(0, Math.min(raw.length, 64 * 1024)));
+                        const controlCharacters = sample.match(/[\u0000-\u0008\u000B\u000C\u000E-\u001F]/g)?.length || 0;
+                        const looksBinary = sample.includes('\u0000')
+                            || (sample.length > 0 && controlCharacters / sample.length > 0.01);
+                        if (looksBinary)
+                            throw new Error('binary content');
+                        content = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+                        encoding = 'utf8';
+                    }
+                    catch {
+                        content = raw.toString('base64');
+                        encoding = 'base64';
+                    }
                     files.push({
                         path: relativePath,
-                        content: fs.readFileSync(fullPath, 'utf8')
+                        content,
+                        encoding,
+                        size: raw.length,
                     });
                 }
                 catch {
-                    // Skip binary or unreadable files.
+                    // Skip unreadable files. Binary files are transported as base64.
                 }
             }
         };
@@ -129,7 +185,7 @@ export class RepoCommand {
             method: 'GET'
         });
         if (!response.ok) {
-            const error = await response.json().catch(async () => ({ error: await response.text() }));
+            const error = await readResponsePayload(response);
             throw new Error(error.error || error.message || 'Failed to fetch repositories');
         }
         const data = await response.json();
@@ -152,6 +208,9 @@ export class RepoCommand {
         return match;
     }
     formatRepoError(error) {
+        if (error instanceof RepositoryApiError && error.payload?.code === 'REPOSITORY_SECURITY_REVIEW') {
+            return 'Repository is isolated pending security review. See the review details above.';
+        }
         const message = error instanceof Error ? error.message : 'Unknown error';
         if (/invalid or expired session/i.test(message)) {
             return 'Repo memory service is not deployed or not reachable. Check `vigthoria status` for details.';
@@ -159,8 +218,37 @@ export class RepoCommand {
         if (/ECONNREFUSED|ENOTFOUND|ETIMEDOUT|socket hang up/i.test(message)) {
             return 'Repo memory service is not reachable. Check `vigthoria status` for details.';
         }
+        if (/PayloadTooLargeError|request entity too large|PAYLOAD_TOO_LARGE|REPOSITORY_CONTENT_TOO_LARGE|exceeds the .*MiB/i.test(message)) {
+            return 'Project is too large for a single Community repository push. The limit is 100 MiB of readable project content and 120 MiB for the encoded request. Exclude generated output or split large assets, then retry.';
+        }
         return message;
     }
+    printSecurityReview(review) {
+        console.log(chalk.yellow('\n🛡  Repository security review required'));
+        console.log(chalk.gray(`   Review ID: ${review.reviewId}`));
+        console.log(chalk.gray(`   Status: ${review.status}`));
+        if (review.projectName)
+            console.log(chalk.gray(`   Project: ${review.projectName}`));
+        if (review.riskScore !== undefined)
+            console.log(chalk.gray(`   Risk score: ${review.riskScore}/100`));
+        if (review.reviewerFeedback) {
+            console.log(chalk.white(`\n   Reviewer feedback: ${review.reviewerFeedback}`));
+        }
+        for (const entry of review.findings || []) {
+            for (const finding of entry.findings || []) {
+                const location = entry.path ? `${entry.path}: ` : '';
+                console.log(chalk.yellow(`   • ${location}${finding.message || finding.type || 'Review required'}`));
+            }
+        }
+        if ((review.actionItems || []).length > 0) {
+            console.log(chalk.cyan('\n   What to fix:'));
+            for (const item of review.actionItems || []) {
+                console.log(chalk.gray(`   - ${item}`));
+            }
+        }
+        console.log(chalk.cyan(`\n   Check status: vigthoria repo review ${review.reviewId}`));
+        console.log(chalk.cyan(`   Retry fixed content: ${review.retryCommand || `vigthoria repo push --retry ${review.reviewId}`}\n`));
+    }
     isAuthenticated() {
         const token = this.config.get('authToken');
         return !!token;
@@ -243,7 +331,9 @@ export class RepoCommand {
         }
         const archivePath = path.join(tempDir, `project-${Date.now()}.zip`);
         const output = createWriteStream(archivePath);
-        const archive = archiver('zip', { zlib: { level: 9 } });
+        // Archiver 8 is ESM-only and exposes format-specific constructors
+        // instead of the legacy default factory.
+        const archive = new archiverModule.ZipArchive({ zlib: { level: 9 } });
         return new Promise((resolve, reject) => {
             output.on('close', () => resolve(archivePath));
             archive.on('error', (err) => reject(err));
@@ -321,7 +411,7 @@ export class RepoCommand {
                     {
                         type: 'confirm',
                         name: 'confirm',
-                        message: 'Push project to Vigthoria Repo?',
+                        message: 'Push project to Vigthoria Community Repository?',
                         default: true
                     }
                 ]);
@@ -332,24 +422,35 @@ export class RepoCommand {
             const uploadSpinner = createSpinner('Preparing project files...').start();
             const files = this.collectProjectFiles(projectPath);
             if (files.length === 0) {
-                throw new Error('No readable text files found to push');
+                throw new Error('No readable project files found to push');
             }
-            uploadSpinner.text = 'Uploading to Vigthoria Community...';
+            const contentBytes = files.reduce((sum, file) => sum + file.size, 0);
+            if (contentBytes > MAX_REPOSITORY_CONTENT_BYTES) {
+                throw new Error(`Repository content is ${formatBytes(contentBytes)} and exceeds the ${formatBytes(MAX_REPOSITORY_CONTENT_BYTES)} limit`);
+            }
+            const pushPayload = JSON.stringify({
+                projectName: answers.name,
+                description: answers.description,
+                techStack: projectInfo.techStack.join(', '),
+                visibility: answers.visibility,
+                force: options.force || false,
+                files,
+                retryOf: options.retry || undefined,
+                clientSource: process.env.VIGTHORIA_CLIENT_SOURCE || 'community-cli',
+                commitMessage: `Push from Vigthoria CLI: ${files.length} file(s)`
+            });
+            const requestBytes = Buffer.byteLength(pushPayload, 'utf8');
+            if (requestBytes > MAX_REPOSITORY_REQUEST_BYTES) {
+                throw new Error(`Encoded repository request is ${formatBytes(requestBytes)} and exceeds the ${formatBytes(MAX_REPOSITORY_REQUEST_BYTES)} limit`);
+            }
+            uploadSpinner.text = `Uploading ${files.length} file(s), ${formatBytes(contentBytes)} to Vigthoria Community...`;
             const registerResponse = await this.repoFetch('/api/repo/push', {
                 method: 'POST',
-                body: JSON.stringify({
-                    projectName: answers.name,
-                    description: answers.description,
-                    techStack: projectInfo.techStack.join(', '),
-                    visibility: answers.visibility,
-                    force: options.force || false,
-                    files,
-                    commitMessage: `Push from Vigthoria CLI: ${files.length} file(s)`
-                })
+                body: pushPayload
             });
             if (!registerResponse.ok) {
-                const error = await registerResponse.json().catch(async () => ({ error: await registerResponse.text() }));
-                throw new Error(error.error || error.message || 'Failed to push project');
+                const error = await readResponsePayload(registerResponse);
+                throw new RepositoryApiError(registerResponse.status, error, 'Failed to push project');
             }
             const registerData = await registerResponse.json();
             uploadSpinner.succeed(chalk.green('Project pushed successfully!'));
@@ -362,15 +463,65 @@ export class RepoCommand {
             if ((registerData.project?.visibility || answers.visibility) === 'public') {
                 console.log(chalk.cyan(`\n🔗 Public URL: ${registerData.url || `https://community.vigthoria.io/showcase/${registerData.project?.id || registerData.projectId}`}`));
             }
-            console.log(chalk.gray('\nTip: Use `vigthoria repo pull <name>` to restore this project anywhere.\n'));
+            console.log(chalk.gray('\nStored in Vigthoria Community. Use `vigthoria repo pull <name>` to restore this project anywhere.\n'));
         }
         catch (error) {
             spinner.stop();
             this.logger.error('Push failed');
+            if (error instanceof RepositoryApiError && error.payload?.code === 'REPOSITORY_SECURITY_REVIEW') {
+                this.printSecurityReview({
+                    reviewId: error.payload.reviewId,
+                    status: error.payload.status || 'pending_review',
+                    riskScore: error.payload.riskScore,
+                    findings: error.payload.findings,
+                    actionItems: error.payload.actionItems,
+                    retryCommand: error.payload.retryCommand,
+                });
+            }
             const errMsg = this.formatRepoError(error);
             console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
         }
     }
+    /**
+     * Show the current user's repository security review queue or one review.
+     */
+    async review(reviewId, options = {}) {
+        this.requireAuth();
+        const spinner = createSpinner(reviewId ? 'Loading security review...' : 'Loading security reviews...').start();
+        try {
+            const apiPath = reviewId
+                ? `/api/repo/security-reviews/${encodeURIComponent(reviewId)}`
+                : '/api/repo/security-reviews?mine=true';
+            const response = await this.repoFetch(apiPath, { method: 'GET' });
+            const payload = await readResponsePayload(response);
+            if (!response.ok) {
+                throw new RepositoryApiError(response.status, payload, 'Failed to load repository security review');
+            }
+            spinner.stop();
+            if (options.json) {
+                console.log(JSON.stringify(reviewId ? payload.review : payload.reviews, null, 2));
+                return;
+            }
+            if (reviewId) {
+                this.printSecurityReview(payload.review);
+                return;
+            }
+            const reviews = (payload.reviews || []);
+            if (reviews.length === 0) {
+                console.log(chalk.green('\n✓ No repository security reviews found.\n'));
+                return;
+            }
+            console.log(chalk.cyan(`\nRepository security reviews (${reviews.length})`));
+            for (const review of reviews) {
+                console.log(chalk.gray(`  ${review.reviewId}  ${review.status}  ${review.projectName || 'repository'}`));
+            }
+            console.log(chalk.gray('\nUse `vigthoria repo review <review-id>` for findings and repair steps.\n'));
+        }
+        catch (error) {
+            spinner.stop();
+            console.log(chalk.red(`\n❌ Error: ${this.formatRepoError(error)}\n`));
+        }
+    }
     /**
      * Pull a project from Vigthoria Repository
      */
@@ -384,7 +535,7 @@ export class RepoCommand {
                 body: JSON.stringify({ projectId: repo.id })
             });
             if (!response.ok) {
-                const error = await response.json().catch(async () => ({ error: await response.text() }));
+                const error = await readResponsePayload(response);
                 throw new Error(error.error || error.message || 'Project not found');
             }
             const data = await response.json();
@@ -478,14 +629,14 @@ export class RepoCommand {
             };
             spinner.stop();
             if (data.projects.length === 0) {
-                console.log(chalk.yellow('\n📦 No projects in your Vigthoria Repo yet.\n'));
+                console.log(chalk.yellow('\n📦 No projects in your Vigthoria Community Repository yet.\n'));
                 console.log(chalk.gray('Use `vigthoria repo push` to upload your first project.\n'));
                 return;
             }
             // Separate owned and shared projects
             const ownedProjects = data.owned || data.projects.filter((p) => p.access_level === 'owner');
             const sharedProjects = data.shared || data.projects.filter((p) => p.access_level !== 'owner');
-            console.log(chalk.cyan(`\n📦 Your Vigthoria Repository (${data.total} project${data.total !== 1 ? 's' : ''})\n`));
+            console.log(chalk.cyan(`\n📦 Your Vigthoria Community Repository (${data.total} project${data.total !== 1 ? 's' : ''})\n`));
             // Display owned projects grouped by visibility
             if (ownedProjects.length > 0) {
                 console.log(chalk.bold.cyan('  📁 YOUR PROJECTS'));
@@ -572,8 +723,8 @@ export class RepoCommand {
                 headers: this.getAuthHeaders()
             });
             if (!response.ok) {
-                spinner.succeed('Project not tracked in Vigthoria Repo');
-                console.log(chalk.yellow('\n📦 Current project is not synced with Vigthoria Repo.\n'));
+                spinner.succeed('Project not tracked in Vigthoria Community Repository');
+                console.log(chalk.yellow('\n📦 Current project is not synced with Vigthoria Community Repository.\n'));
                 console.log(chalk.gray('Use `vigthoria repo push` to upload it.\n'));
                 return;
             }
@@ -650,7 +801,7 @@ export class RepoCommand {
         const { confirm } = await inquirer.prompt([{
                 type: 'confirm',
                 name: 'confirm',
-                message: chalk.red(`Are you sure you want to delete "${projectName}" from Vigthoria Repo?`),
+                message: chalk.red(`Are you sure you want to delete "${projectName}" from Vigthoria Community Repository?`),
                 default: false
             }]);
         if (!confirm) {
@@ -667,7 +818,7 @@ export class RepoCommand {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to delete project');
             }
-            spinner.succeed(chalk.green('Project deleted from Vigthoria Repo'));
+            spinner.succeed(chalk.green('Project deleted from Vigthoria Community Repository'));
             console.log(chalk.gray('\nNote: Your local files are not affected.\n'));
         }
         catch (error) {
@@ -704,7 +855,7 @@ export class RepoCommand {
                 })
             });
             if (!response.ok) {
-                const err = await response.json().catch(async () => ({ error: await response.text() }));
+                const err = await readResponsePayload(response);
                 throw new Error(err.error || `Engine import failed (${response.status})`);
             }
             const data = await response.json();

package/dist/commands/v4.d.ts

@@ -11,6 +11,9 @@ type V4Options = {
     transport?: 'auto' | 'ws' | 'sse';
     harnessStreamUrl?: string;
     harnessControlUrl?: string;
+    gatewayUrl?: string;
+    prompt?: string;
+    workspace?: string;
     sessionId?: string;
     nonInteractive?: boolean;
     python?: string;

package/dist/commands/v4.js

@@ -38,6 +38,9 @@ export class V4Command {
             .option('--transport <mode>', 'Bridge transport: auto | ws | sse', 'auto')
             .option('--harness-stream-url <url>', 'Override harness stream URL')
             .option('--harness-control-url <url>', 'Override harness control URL')
+            .option('--gateway-url <url>', 'DeerFlow Gateway URL')
+            .option('--prompt <text>', 'Task prompt to execute')
+            .option('--workspace <path>', 'Workspace path', process.cwd())
             .option('--session-id <id>', 'Explicit V4 session id')
             .option('--non-interactive', 'Disable interactive menu and use CLI options', false)
             .option('--python <bin>', 'Python binary to use', defaultV4PythonBin())
@@ -82,6 +85,15 @@ export class V4Command {
         if (options.harnessControlUrl) {
             args.push('--harness-control-url', String(options.harnessControlUrl));
         }
+        if (options.gatewayUrl) {
+            args.push('--gateway-url', String(options.gatewayUrl));
+        }
+        if (options.prompt) {
+            args.push('--prompt', String(options.prompt));
+        }
+        if (options.workspace) {
+            args.push('--workspace', path.resolve(String(options.workspace)));
+        }
         if (options.sessionId) {
             args.push('--session-id', String(options.sessionId));
         }