vigthoria-cli 1.12.3 → 1.13.7

package/dist/utils/brain-hub-client.js

@@ -2,6 +2,22 @@
  * Brain Hub client — sync workspace index + fetch account brain context
  * via coder.vigthoria.io (JWT-authenticated).
  */
+// Brain Hub calls are an optional personalization enhancement to an agent
+// turn, not on the critical path. Native `fetch()` has NO default timeout,
+// so a slow/unresponsive coder.vigthoria.io backend previously caused the
+// ENTIRE agent turn to hang indefinitely with zero console output, well
+// before any "ROUTING DECISION" text is printed (2026-07-10 root-cause).
+const BRAIN_HUB_TIMEOUT_MS = 3500;
+async function fetchWithTimeout(url, init = {}, timeoutMs = BRAIN_HUB_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 export class BrainHubClient {
     apiBase;
     getAuthToken;
@@ -22,27 +38,39 @@ export class BrainHubClient {
         if (!headers.Authorization) {
             return { ok: false, skipped: true, reason: 'not_authenticated' };
         }
-        const resp = await fetch(`${this.apiBase}/api/brain/sync-index`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(payload),
-        });
-        const data = await resp.json().catch(() => ({}));
-        if (!resp.ok) {
-            return { ok: false, error: data.error || `HTTP ${resp.status}` };
+        try {
+            const resp = await fetchWithTimeout(`${this.apiBase}/api/brain/sync-index`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(payload),
+            });
+            const data = await resp.json().catch(() => ({}));
+            if (!resp.ok) {
+                return { ok: false, error: data.error || `HTTP ${resp.status}` };
+            }
+            return data;
+        }
+        catch (error) {
+            const timedOut = error instanceof Error && error.name === 'AbortError';
+            return { ok: false, error: timedOut ? `timeout after ${BRAIN_HUB_TIMEOUT_MS}ms` : String(error) };
         }
-        return data;
     }
     async fetchAccountContext(limit = 25) {
         const headers = await this.headers();
         if (!headers.Authorization) {
             return { ok: false, formattedText: '', memories: [] };
         }
-        const resp = await fetch(`${this.apiBase}/api/brain/context?limit=${limit}`, { headers });
-        const data = await resp.json().catch(() => ({}));
-        if (!resp.ok) {
-            return { ok: false, formattedText: '', error: data.error || `HTTP ${resp.status}` };
+        try {
+            const resp = await fetchWithTimeout(`${this.apiBase}/api/brain/context?limit=${limit}`, { headers });
+            const data = await resp.json().catch(() => ({}));
+            if (!resp.ok) {
+                return { ok: false, formattedText: '', error: data.error || `HTTP ${resp.status}` };
+            }
+            return data;
+        }
+        catch (error) {
+            const timedOut = error instanceof Error && error.name === 'AbortError';
+            return { ok: false, formattedText: '', error: timedOut ? `timeout after ${BRAIN_HUB_TIMEOUT_MS}ms` : String(error) };
         }
-        return data;
     }
 }

package/dist/utils/codebase-indexer.js

@@ -23,6 +23,7 @@ export class CodebaseIndexer {
         '.DS_Store', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
         '.vsix', '.map', '.min.js', '.min.css', 'coverage',
         '.cache', '.tmp', 'tmp', 'temp', '.idea', '.vscode',
+        '.vigthoria',
     ];
     supportedExtensions = new Set([
         '.js', '.ts', '.jsx', '.tsx', '.py', '.java', '.go', '.rs',
@@ -96,10 +97,23 @@ export class CodebaseIndexer {
             for (const filePath of files) {
                 this.indexFile(filePath);
             }
-            const indexHash = crypto.createHash('sha256')
-                .update(`${this.indexedFileCount}:${this.totalChunks}:${files.length}`)
-                .digest('hex')
-                .slice(0, 16);
+            // The synchronization contract is content-addressed. Stable file and
+            // chunk counts must never hide a source modification from the Brain.
+            const contentHasher = crypto.createHash('sha256');
+            const contentEntries = Array.from(this.fileHashes.entries())
+                .map(([filePath, fileHash]) => [
+                path.relative(this.workspaceRoot, filePath).split(path.sep).join('/'),
+                fileHash,
+            ])
+                .sort(([left], [right]) => left.localeCompare(right));
+            for (const [relativePath, fileHash] of contentEntries) {
+                contentHasher.update(relativePath, 'utf8');
+                contentHasher.update('\0', 'utf8');
+                contentHasher.update(fileHash, 'ascii');
+                contentHasher.update('\n', 'utf8');
+            }
+            // Empty workspaces still receive a deterministic, valid SHA-256 value.
+            const indexHash = contentHasher.digest('hex');
             const topFiles = files.slice(0, 12).map((filePath) => path.relative(this.workspaceRoot, filePath));
             const meta = {
                 indexedFileCount: this.indexedFileCount,
@@ -308,7 +322,16 @@ export class CodebaseIndexer {
     shouldIgnore(name, fullPath) {
         if (name.startsWith('.') && name !== '.env')
             return true;
-        const lowerPath = fullPath.toLowerCase();
-        return this.ignorePatterns.some((pattern) => lowerPath.includes(pattern));
+        const relativePath = path.relative(this.workspaceRoot, fullPath);
+        const segments = relativePath.split(path.sep).map((segment) => segment.toLowerCase());
+        const fileName = segments.at(-1) || '';
+        const suffixPatterns = new Set(['.vsix', '.map', '.min.js', '.min.css']);
+        return this.ignorePatterns.some((rawPattern) => {
+            const pattern = rawPattern.toLowerCase();
+            if (suffixPatterns.has(pattern)) {
+                return fileName.endsWith(pattern);
+            }
+            return segments.includes(pattern);
+        });
     }
 }

package/dist/utils/command-menu.d.ts

@@ -0,0 +1,11 @@
+import type { Command } from 'commander';
+export type CommandFamily = 'Vigthoria Repo Management' | 'Agent Mode' | 'System & Configuration';
+export interface CommandCatalogEntry {
+    path: string;
+    description: string;
+    family: CommandFamily;
+    command: Command;
+}
+export declare function buildCommandCatalog(program: Command): CommandCatalogEntry[];
+export declare function renderDynamicHelp(program: Command): string;
+export declare function selectInteractiveCommand(program: Command): Promise<string[] | null>;

package/dist/utils/command-menu.js

@@ -0,0 +1,97 @@
+import inquirer from 'inquirer';
+const AGENT_COMMANDS = new Set([
+    'agent', 'chat', 'chat-resume', 'operator', 'legion', 'workflow',
+    'history', 'replay', 'fork', 'cancel',
+]);
+function familyFor(commandPath) {
+    const root = commandPath.split(' ')[0];
+    if (root === 'repo')
+        return 'Vigthoria Repo Management';
+    if (AGENT_COMMANDS.has(root))
+        return 'Agent Mode';
+    return 'System & Configuration';
+}
+export function buildCommandCatalog(program) {
+    const entries = [];
+    const visit = (command, parents) => {
+        const commandPath = [...parents, command.name()].join(' ');
+        entries.push({
+            path: commandPath,
+            description: command.description() || '',
+            family: familyFor(commandPath),
+            command,
+        });
+        for (const child of command.commands)
+            visit(child, [...parents, command.name()]);
+    };
+    for (const command of program.commands)
+        visit(command, []);
+    return entries.sort((left, right) => left.family.localeCompare(right.family) || left.path.localeCompare(right.path));
+}
+export function renderDynamicHelp(program) {
+    const catalog = buildCommandCatalog(program);
+    const lines = ['Commands:'];
+    const families = [
+        'Vigthoria Repo Management',
+        'Agent Mode',
+        'System & Configuration',
+    ];
+    for (const family of families) {
+        lines.push('', `${family}:`);
+        for (const entry of catalog.filter((candidate) => candidate.family === family)) {
+            const aliases = entry.command.aliases();
+            const displayPath = aliases.length
+                ? `${entry.path} (${aliases.join(', ')})`
+                : entry.path;
+            lines.push(`  ${displayPath.padEnd(30)} ${entry.description}`);
+        }
+    }
+    return lines.join('\n');
+}
+async function collectRequiredArguments(entry) {
+    const values = [];
+    for (const argument of entry.command.registeredArguments) {
+        if (!argument.required)
+            continue;
+        const answer = await inquirer.prompt([{
+                type: 'input',
+                name: 'value',
+                message: `${argument.name()}:`,
+                validate: (value) => value.trim().length > 0 || `${argument.name()} is required`,
+            }]);
+        values.push(String(answer.value).trim());
+    }
+    return values;
+}
+export async function selectInteractiveCommand(program) {
+    const catalog = buildCommandCatalog(program);
+    const familyAnswer = await inquirer.prompt([{
+            type: 'list',
+            name: 'family',
+            message: 'Select a command family:',
+            choices: [
+                'Vigthoria Repo Management',
+                'Agent Mode',
+                'System & Configuration',
+                new inquirer.Separator(),
+                { name: 'Exit', value: null },
+            ],
+        }]);
+    if (!familyAnswer.family)
+        return null;
+    const entries = catalog.filter((entry) => entry.family === familyAnswer.family && entry.command.commands.length === 0);
+    const commandAnswer = await inquirer.prompt([{
+            type: 'list',
+            name: 'path',
+            message: `${familyAnswer.family}:`,
+            pageSize: 20,
+            choices: entries.map((entry) => ({
+                name: `${entry.path.padEnd(24)} ${entry.description}`,
+                value: entry.path,
+            })),
+        }]);
+    const selected = entries.find((entry) => entry.path === commandAnswer.path);
+    if (!selected)
+        return null;
+    return [...selected.path.split(' '), ...await collectRequiredArguments(selected)];
+}

package/dist/utils/deckEvents.js

@@ -14,7 +14,13 @@ export function emitDeckEvent(event) {
         ...event,
         ts: event.ts ?? Date.now(),
     };
-    process.stdout.write(`${DECK_PREFIX}${JSON.stringify(payload)}\n`);
+    // Force the marker onto its own fresh line. Callers may have just updated an
+    // in-place spinner (e.g. ora) which redraws via "\r" and never emits a
+    // trailing "\n", so without this leading newline the marker can land stuck
+    // mid-line after visible text (e.g. "Executing plan...@vigthoria-deck:{...}")
+    // and the Workbench's line-start prefix check won't strip it, leaking raw
+    // JSON into the terminal.
+    process.stdout.write(`\n${DECK_PREFIX}${JSON.stringify(payload)}\n`);
 }
 export function parseDeckLine(line) {
     const trimmed = line.trim();

package/dist/utils/requestIntent.d.ts

@@ -9,6 +9,8 @@ export type IntentContext = {
 export declare function stripExecutionShaping(prompt: string): string;
 export declare function hasBuildVerb(prompt: string): boolean;
 export declare function hasArtifactNoun(prompt: string): boolean;
+export type GameEngineHint = 'babylon' | 'three' | 'canvas-2d';
+export declare function inferGameEngine(prompt: string): GameEngineHint;
 export declare function hasGameIntent(prompt: string): boolean;
 /** True when the CLI already expanded a /continue-style follow-up prompt. */
 export declare function isBuiltContinuePrompt(prompt: string): boolean;
@@ -52,4 +54,6 @@ export declare function buildExecutionHints(agentTaskType: string, prompt: strin
     classify_from: string;
     workflow_type: 'analysis_only' | 'full';
     fast_path?: string;
+    game_engine?: GameEngineHint;
+    render_transport?: 'client-state';
 };

package/dist/utils/requestIntent.js

@@ -7,7 +7,7 @@ const READONLY_SHAPING_BLOCK = /(?:^|\n\n)(?:Read-only analysis mode is active\.
 const BUILD_VERBS = /\b(build|create|make|implement|complete|fix|repair|edit|modify|write|generate|add|finish|scaffold|develop|update|change|refactor|want|need|require|looking for|let's|let us|we need|we should|erstelle|erstellen|schreib|schreibe|bearbeite)\b/i;
 const ARTIFACT_NOUNS = /\b(file|files|project|game|spiel|app|website|html5|frontend|component|feature|code|workspace|repo|clone|replica|remake|page|site|screen|button|popup|modal|alert|canvas|sprite|level|levels|enemy|enemies|character|npc|world|scene|script|module|api|database|config|landing|dashboard|platformer|arcade|playable|collectible|scoreboard|leaderboard|pitfall|pacman|rogue|html|css|javascript|typescript)\b/i;
 /** Canvas/playable games only — bare "html5" or "website" must NOT match. */
-const GAME_INTENT = /\b(game|spiel|playable|html5\s+(?:game|canvas)|html5\s+game|canvas\s+game|game\s+canvas|arcade|platformer|side[- ]?scroller|pitfall|pac[- ]?man|tetris|snake|breakout|pong|roguelike|metroidvania|tower\s+defense|clone\s+of\s+(?:a\s+)?(?:game|pitfall|pac|mario|zelda|arcade)|gameplay|collectible|boss\s+fight|level\s+design|sprite\s+sheet|wild\s+(?:boar|pig|forest)|forest\s+pig)\b/i;
+const GAME_INTENT = /\b(game|spiel|playable|babylon(?:\.js|js)?|vge|webgl|3d\s+(?:game|runner|prototype|world|experience)|html5\s+(?:game|canvas)|html5\s+game|canvas\s+game|game\s+canvas|arcade|platformer|side[- ]?scroller|pitfall|pac[- ]?man|tetris|snake|breakout|pong|roguelike|metroidvania|tower\s+defense|clone\s+of\s+(?:a\s+)?(?:game|pitfall|pac|mario|zelda|arcade)|gameplay|collectible|boss\s+fight|level\s+design|sprite\s+sheet|wild\s+(?:boar|pig|forest)|forest\s+pig)\b/i;
 const WEB_PAGE_INTENT = /\b(website|web\s*site|webpage|web\s*page|landing\s+page|home\s*page|index\.html|html\s+page|static\s+page|single\s+page|popup|alert|modal|hello\s+world)\b/i;
 const CLONE_BUILD = /\bclone\s+of\b|\b(build|create|make)\s+(?:a|an|the|us|me)?\s*(?:clone|replica|remake|port)\b/i;
 const READ_ONLY_INTENT = /\b(analy[sz]e|analyse|analysis|audit|review|inspect|proof|understand|summari[sz]e|scan|read[\s-]?only|where we left|what is|how does|show me|tell me|identify\s+gaps?|gap\s+analysis|production\s+blockers?)\b/i;
@@ -34,6 +34,16 @@ export function hasArtifactNoun(prompt) {
 }
 /** Game clones require a game target — generic "clone of X" must not imply game-build. */
 const GAME_CLONE_TARGET = /\bclone\s+of\s+(?:a\s+)?(?:the\s+)?(?:game|pitfall|pac[- ]?man|mario|zelda|tetris|snake|arcade|spiel)\b/i;
+export function inferGameEngine(prompt) {
+    const text = stripExecutionShaping(prompt);
+    if (/\bthree(?:\.js|js)?\b/i.test(text))
+        return 'three';
+    if (/\bbabylon(?:\.js|js)?\b|\bvge\b|vigthoria gaming engine/i.test(text))
+        return 'babylon';
+    if (/\b3d\s+(?:game|runner|prototype|world|experience)\b|\bwebgl\b/i.test(text))
+        return 'babylon';
+    return 'canvas-2d';
+}
 export function hasGameIntent(prompt) {
     const text = stripExecutionShaping(prompt);
     if (GAME_INTENT.test(text)) {
@@ -370,6 +380,11 @@ export function buildExecutionHints(agentTaskType, prompt, options = {}) {
         classify_from: String(prompt || ''),
         workflow_type: workflowType,
     };
+    if (kind === 'game-build' || hasGameIntent(prompt)) {
+        hints.game_engine = inferGameEngine(prompt);
+        if (hints.game_engine === 'babylon')
+            hints.render_transport = 'client-state';
+    }
     if (options.fastPath) {
         hints.fast_path = options.fastPath;
     }

package/dist/utils/tools.js

@@ -2104,6 +2104,24 @@ export class AgenticTools {
                         result = await response.json();
                         if (response.ok && result.success)
                             break;
+                        if (result.code === 'REPOSITORY_SECURITY_REVIEW') {
+                            return {
+                                success: false,
+                                error: result.error || 'Repository security review required',
+                                metadata: {
+                                    code: result.code,
+                                    review: {
+                                        reviewId: result.reviewId,
+                                        status: result.status,
+                                        riskScore: result.riskScore,
+                                        findings: result.findings || [],
+                                        actionItems: result.actionItems || [],
+                                        retryCommand: result.retryCommand,
+                                    },
+                                },
+                                suggestion: `Inspect with "vigthoria repo review ${result.reviewId}" and retry corrected content with "${result.retryCommand || `vigthoria repo push --retry ${result.reviewId}`}".`,
+                            };
+                        }
                         lastError = result.error || result.message || `Status ${response.status}`;
                         result = null;
                     }

package/install.ps1

@@ -5,7 +5,7 @@
 $ErrorActionPreference = "Stop"
 
 # Configuration
-$CLI_VERSION = "1.11.42"
+$CLI_VERSION = "1.13.7"
 $INSTALL_DIR = "$env:USERPROFILE\.vigthoria"
 $NPM_PACKAGE = "vigthoria-cli"
 $GIT_PACKAGE_URL = "git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"
@@ -74,11 +74,12 @@ function Test-Prerequisites {
     try {
         $nodeVersion = node -v 2>$null
         if ($nodeVersion) {
-            $major = [int]($nodeVersion -replace 'v(\d+)\..*', '$1')
-            if ($major -ge 18) {
+            $versionText = $nodeVersion.TrimStart('v')
+            $parsedVersion = [version]$versionText
+            if ($parsedVersion -ge [version]"20.19.0") {
                 Write-Host "✓ Node.js $nodeVersion" -ForegroundColor Green
             } else {
-                Write-Host "✗ Node.js 18+ required (found $nodeVersion)" -ForegroundColor Red
+                Write-Host "✗ Node.js 20.19+ required (found $nodeVersion)" -ForegroundColor Red
                 Write-Host "  Download from: https://nodejs.org/" -ForegroundColor Yellow
                 return $false
             }

package/install.sh

@@ -26,7 +26,7 @@ else
 fi
 
 # Configuration
-CLI_VERSION="1.11.42"
+CLI_VERSION="1.13.7"
 INSTALL_DIR="$HOME/.vigthoria"
 REPO_URL="https://market.vigthoria.io/vigthoria/vigthoria-cli"
 GIT_PACKAGE_URL="git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"
@@ -130,7 +130,7 @@ check_requirements() {
     if ! command -v node &> /dev/null; then
         echo -e "${RED}✗ Node.js is not installed${NC}"
         echo ""
-        echo "  Please install Node.js 18 or later:"
+        echo "  Please install Node.js 20.19 or later:"
         if [ "$PLATFORM" = "macos" ]; then
             echo "    brew install node"
             echo "    or download from: https://nodejs.org/"
@@ -144,9 +144,11 @@ check_requirements() {
         exit 1
     fi
     
-    NODE_VERSION=$(node -v | cut -d'v' -f2 | cut -d'.' -f1)
-    if [ "$NODE_VERSION" -lt 18 ]; then
-        echo -e "${RED}✗ Node.js version must be 18 or higher (found: v$NODE_VERSION)${NC}"
+    NODE_VERSION_FULL=$(node -v | sed 's/^v//')
+    NODE_VERSION_MAJOR=$(printf '%s' "$NODE_VERSION_FULL" | cut -d'.' -f1)
+    NODE_VERSION_MINOR=$(printf '%s' "$NODE_VERSION_FULL" | cut -d'.' -f2)
+    if [ "$NODE_VERSION_MAJOR" -lt 20 ] || { [ "$NODE_VERSION_MAJOR" -eq 20 ] && [ "$NODE_VERSION_MINOR" -lt 19 ]; }; then
+        echo -e "${RED}✗ Node.js version must be 20.19 or higher (found: v$NODE_VERSION_FULL)${NC}"
         exit 1
     fi
     echo -e "${GREEN}✓ Node.js v$(node -v | cut -d'v' -f2)${NC}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.12.3",
+  "version": "1.13.7",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",
@@ -60,10 +60,12 @@
     "test:package:hygiene": "npm run build && node scripts/verify-package-hygiene.js",
     "test:v3:platforms": "npm run build && node scripts/test-v3-platforms-e2e.js",
     "test:repo:live": "npm run build && node scripts/test-live-repo-e2e.js",
+    "test:repo:auth-fallback": "node scripts/test-community-repo-auth-fallback.mjs",
+    "test:repo:payload-fallback": "node scripts/test-repo-payload-fallback.mjs",
     "test:game:live": "npm run build && node scripts/test-live-game-push.js",
     "proof:agent": "npm run build && node scripts/proof-agent-mode.js",
     "test:fresh-install": "node scripts/test-fresh-install.js",
-    "prepublishOnly": "npm run build && npm run validate:no-go && node scripts/verify-package-hygiene.js && node scripts/test-fresh-install.js",
+    "prepublishOnly": "npm run build && npm run validate:no-go && npm run test:repo:auth-fallback && npm run test:repo:payload-fallback && node scripts/verify-package-hygiene.js && node scripts/test-fresh-install.js",
     "precheck:services": "node scripts/precheck-local-services.js",
     "test:model:governance": "npm run build && node scripts/test-model-governance-no-agent.js",
     "validate:no-go": "bash scripts/release/validate-no-go-gates.sh",
@@ -73,7 +75,9 @@
     "test:session:project-match": "npm run build && node scripts/test-session-project-match.mjs",
     "test:v3-stream-mutation": "npm run build && node scripts/test-v3-stream-mutation.js",
     "test:context:budget": "npm run build && node scripts/test-context-budget.js",
-    "test:pitfall:context": "npm run build && node scripts/test-pitfall-context-smoke.js"
+    "test:v3-client-tool-quality": "npm run build && node scripts/test-v3-client-tool-quality.mjs",
+    "test:pitfall:context": "npm run build && node scripts/test-pitfall-context-smoke.js",
+    "test:game:command": "node scripts/test-game-command.mjs"
   },
   "keywords": [
     "ai",
@@ -87,7 +91,7 @@
   "author": "Vigthoria Technologies",
   "license": "MIT",
   "dependencies": {
-    "archiver": "^7.0.1",
+    "archiver": "^8.0.0",
     "axios": "^1.6.0",
     "chalk": "^5.3.0",
     "chokidar": "^5.0.0",
@@ -114,9 +118,10 @@
     "typescript": "^5.3.2"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "overrides": {
-    "glob": "^13.0.6"
+    "glob": "^13.0.6",
+    "brace-expansion": "^5.0.8"
   }
 }

package/scripts/release/LOCAL_MACHINE_USER_VERIFICATION.md

@@ -4,7 +4,7 @@ Use this checklist on real user machines before and after rollout. The goal is t
 
 ## 1. Preflight
 
-- [ ] Node.js `>=18` available
+- [ ] Node.js `>=20.19` available
 - [ ] `npm` available
 - [ ] No stale shell aliases shadowing `vigthoria`
 - [ ] Network access to:

package/scripts/release/validate-no-go-gates.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ROOT="/var/www/vigthoria-coder/VigthoriaCoderMain/vigthoria-cli"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
 CLI="node dist/index.js"