vigthoria-cli 1.13.13 → 1.13.20

package/dist/commands/auth.js

@@ -11,9 +11,13 @@ const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 const KNOWN_AUTH_BASE_URLS = ['https://coder.vigthoria.io'];
 class HttpError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    upgradeUrl;
+    constructor(status, message, code, upgradeUrl) {
         super(message);
         this.status = status;
+        this.code = code;
+        this.upgradeUrl = upgradeUrl;
     }
 }
 function trimTrailingSlash(value) {
@@ -206,12 +210,19 @@ async function requestJson(url, init) {
         }
     }
     if (!response.ok) {
-        const message = typeof body === 'object' && body && 'error' in body
-            ? String(body.error)
-            : typeof body === 'object' && body && 'message' in body
-                ? String(body.message)
-                : `Request failed with status ${response.status}`;
-        throw new HttpError(response.status, message);
+        const errorBody = typeof body === 'object' && body ? body : {};
+        const code = String(errorBody.code || '');
+        const planNames = Array.isArray(errorBody.requiredPlans)
+            ? errorBody.requiredPlans.map(plan => plan.name || plan.id).filter(Boolean)
+            : [];
+        const message = code === 'SUBSCRIPTION_REQUIRED'
+            ? `This project requires a paid Vigthoria subscription.${planNames.length ? ` Eligible plans: ${planNames.join(', ')}.` : ''} Upgrade: ${errorBody.upgradeUrl || 'https://hub.vigthoria.io/subscriptions?application=coder'}`
+            : 'error' in errorBody && errorBody.error
+                ? String(errorBody.error)
+                : 'message' in errorBody && errorBody.message
+                    ? String(errorBody.message)
+                    : `Request failed with status ${response.status}`;
+        throw new HttpError(response.status, message, code || undefined, errorBody.upgradeUrl);
     }
     return body;
 }
@@ -316,6 +327,9 @@ export async function login(email, password) {
                     return config;
                 }
                 catch (error) {
+                    if (error instanceof HttpError && error.code === 'SUBSCRIPTION_REQUIRED') {
+                        throw error;
+                    }
                     const message = humanMessage(error);
                     failures.push(`${endpoint} -> ${message}`);
                 }

package/dist/commands/background.d.ts

@@ -4,6 +4,8 @@ interface BackgroundOptions {
     json?: boolean;
     limit?: number;
     workspace?: string;
+    deny?: boolean;
+    model?: string;
 }
 export declare class BackgroundCommand {
     private config;
@@ -16,5 +18,6 @@ export declare class BackgroundCommand {
     apply(jobId: string, options?: BackgroundOptions): Promise<void>;
     cancel(jobId: string, options?: BackgroundOptions): Promise<void>;
     private extractBackgroundOutcome;
+    approve(jobId: string, approvalId: string, options?: BackgroundOptions): Promise<void>;
 }
 export {};

package/dist/commands/background.js

@@ -1,6 +1,7 @@
 import chalk from 'chalk';
 import { createSpinner, CH } from '../utils/logger.js';
 import { APIClient } from '../utils/api.js';
+import { buildExecutionHints, inferAgentTaskType } from '../utils/requestIntent.js';
 export class BackgroundCommand {
     config;
     logger;
@@ -17,6 +18,15 @@ export class BackgroundCommand {
             return;
         }
         const workspacePath = options.workspace || process.cwd();
+        const requestedModel = String(options.model || 'agent').trim().toLowerCase();
+        const allowedModels = new Set(['agent', 'cloud', 'cloud-reason', 'ultra']);
+        if (!allowedModels.has(requestedModel)) {
+            this.logger.error('Background model must be one of: agent, cloud, cloud-reason, ultra');
+            return;
+        }
+        const cloudSelected = ['cloud', 'cloud-reason', 'ultra'].includes(requestedModel);
+        const agentTaskType = inferAgentTaskType(prompt);
+        const routedHints = buildExecutionHints(agentTaskType, prompt);
         const spinner = createSpinner('Starting background agent job...').start();
         try {
             const job = await this.api.startV3BackgroundJob(prompt, {
@@ -27,6 +37,19 @@ export class BackgroundCommand {
                 executionSurface: 'cli',
                 clientSurface: 'cli',
                 clientToolExecution: false,
+                model: requestedModel,
+                requestedModel,
+                agentTaskType,
+                workflowType: routedHints.workflow_type,
+                executionHints: {
+                    ...routedHints,
+                    cloud_selected: cloudSelected,
+                    // Detached jobs must preserve the selected transport.  This stops a
+                    // paid cloud request from being silently reinterpreted as a local
+                    // router alias during recovery.
+                    enforce_cloud_only: cloudSelected,
+                    background_model: requestedModel,
+                },
             });
             spinner.stop();
             if (options.json) {
@@ -37,6 +60,7 @@ export class BackgroundCommand {
             console.log(chalk.gray(`  Job:       ${job.job_id}`));
             console.log(chalk.gray(`  Status:    ${job.status}`));
             console.log(chalk.gray(`  Workspace: ${workspacePath}`));
+            console.log(chalk.gray(`  Model:      ${requestedModel}`));
             console.log();
             console.log(chalk.gray(`Use ${chalk.cyan(`vigthoria background status ${job.job_id}`)} to check progress.`));
             console.log(chalk.gray(`Use ${chalk.cyan(`vigthoria background apply ${job.job_id}`)} when it is completed.`));
@@ -100,6 +124,14 @@ export class BackgroundCommand {
             }
             if (job.error)
                 console.log(chalk.red(`Error:     ${job.error}`));
+            const approvals = Array.isArray(job.pending_approvals) ? job.pending_approvals : [];
+            if (approvals.length > 0) {
+                console.log(chalk.yellow(`Gate:      ${approvals.length} command approval(s) required`));
+                for (const approval of approvals) {
+                    console.log(chalk.gray(`  ${approval.approval_id}: ${approval.command || '(empty command)'}`));
+                    console.log(chalk.gray(`  Resolve: vigthoria background approve ${job.job_id} ${approval.approval_id}`));
+                }
+            }
             console.log(chalk.gray(`\n${String(job.request || '').slice(0, 500)}`));
             if (job.status === 'completed' && (job.file_count || 0) > 0) {
                 console.log(chalk.gray(`\nUse ${chalk.cyan(`vigthoria background apply ${job.job_id}`)} to apply files locally.`));
@@ -170,6 +202,8 @@ export class BackgroundCommand {
         let tasksCompleted = Number(result.tasks_completed ?? result.tasksCompleted ?? 0);
         let tasksTotal = Number(result.tasks_total ?? result.tasksTotal ?? 0);
         let success = typeof result.success === 'boolean' ? result.success : null;
+        if (result.type === 'error')
+            success = false;
         for (const event of events) {
             if (!event || typeof event !== 'object')
                 continue;
@@ -192,7 +226,7 @@ export class BackgroundCommand {
         if (success == null && tasksTotal > 0) {
             success = tasksCompleted >= tasksTotal;
         }
-        if (success == null && job?.status === 'completed') {
+        if (success == null && job?.status === 'completed' && result.type !== 'error') {
             success = true;
         }
         if (success == null && job?.status === 'failed') {
@@ -211,4 +245,27 @@ export class BackgroundCommand {
         }
         return { tasksCompleted, tasksTotal, success, headline };
     }
+    async approve(jobId, approvalId, options = {}) {
+        if (!jobId || !approvalId) {
+            this.logger.error('Usage: vigthoria background approve <job-id> <approval-id>');
+            return;
+        }
+        const approved = !options.deny;
+        const spinner = createSpinner(`${approved ? 'Approving' : 'Denying'} background command...`).start();
+        try {
+            const result = await this.api.resolveV3BackgroundApproval(jobId, approvalId, approved, 'once');
+            spinner.stop();
+            if (options.json) {
+                console.log(JSON.stringify({ ...result, job_id: jobId, approval_id: approvalId, approved }, null, 2));
+                return;
+            }
+            console.log(approved
+                ? chalk.green(`${CH.success} Approved ${approvalId} once for ${jobId}`)
+                : chalk.yellow(`${CH.warn} Denied ${approvalId} for ${jobId}`));
+        }
+        catch (error) {
+            spinner.stop();
+            this.logger.error(error?.message || String(error));
+        }
+    }
 }

package/dist/commands/chat.d.ts

@@ -272,6 +272,8 @@ export declare class ChatCommand {
     private truncateText;
     private getLastUserPrompt;
     private saveSession;
+    private persistAgentExecutionCheckpoint;
+    private updateAgentExecutionCheckpoint;
     private requestPermission;
     getCurrentSessionInfo(): string;
     getChatHistory(): ChatMessage[];

package/dist/commands/chat.js

@@ -3,6 +3,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import * as readline from 'readline';
+import { randomUUID } from 'crypto';
 import { createSpinner } from '../utils/logger.js';
 import { APIClient, CLIError, classifyError, formatCLIError, sanitizeUserFacingErrorText, sanitizeUserFacingPathText, propagateError, VIGTHORIA_SERVER_TEMPORARILY_UNAVAILABLE_MESSAGE } from '../utils/api.js';
 import { AgenticTools, robustifyStreamResponse } from '../utils/tools.js';
@@ -1179,6 +1180,32 @@ export class ChatCommand {
             spinner.text = this.sanitizeServerPath(String(event.content || 'Routing to V3 Agent...'));
             return;
         }
+        if (event.type === 'pipeline_stage') {
+            if (spinner.isSpinning)
+                spinner.stop();
+            const stageIndex = Number.isFinite(Number(event.stage_index)) ? Number(event.stage_index) : 0;
+            const stageTotal = Number.isFinite(Number(event.stage_total)) ? Number(event.stage_total) : 3;
+            const stage = String(event.stage || '').trim().toLowerCase();
+            const label = stage === 'dispatcher'
+                ? 'Dispatcher'
+                : stage === 'architect'
+                    ? 'Architect'
+                    : stage === 'executor'
+                        ? 'Executor'
+                        : 'Pipeline';
+            const model = this.sanitizeServerPath(String(event.model || event.executor_model || ''));
+            const route = this.sanitizeServerPath(String(event.route || ''));
+            const details = [model, route ? `route=${route}` : ''].filter(Boolean).join(' · ');
+            process.stderr.write(chalk.cyan(`  [${stageIndex || '?'}\/${stageTotal} ${label}] `)
+                + `${details || 'ready'}\n`);
+            spinner.start();
+            spinner.text = stage === 'dispatcher'
+                ? 'Olivia routed the request. Starting Architect...'
+                : stage === 'architect'
+                    ? 'Architect is producing the execution plan...'
+                    : '35B Executor is executing the approved plan...';
+            return;
+        }
         if (event.type === 'thinking') {
             this.v3IterationCount += 1;
             const iterText = this.sanitizeServerPath(event.content || '');
@@ -1481,7 +1508,8 @@ export class ChatCommand {
         this.sessionManager = new SessionManager();
     }
     async run(options) {
-        if (!this.config.isAuthenticated()) {
+        const hasRuntimeToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
+        if (!this.config.isAuthenticated() && !hasRuntimeToken) {
             if (options.json) {
                 process.exitCode = 1;
                 emitAgentJsonOutput({ success: false, error: 'Not authenticated. Run: vigthoria login' });
@@ -1811,6 +1839,35 @@ export class ChatCommand {
                         originalPrompt: saved.originalPrompt ?? null,
                     };
                 }
+                else if (this.currentSession.activeAgentRun?.prompt) {
+                    const checkpoint = this.currentSession.activeAgentRun;
+                    this.lastAgentRunOutcome = {
+                        prompt: checkpoint.prompt,
+                        originalPrompt: checkpoint.originalPrompt || checkpoint.prompt,
+                        taskId: checkpoint.executionId,
+                        contextId: checkpoint.contextId,
+                        tasksSucceeded: 0,
+                        tasksTotal: 0,
+                        failedTaskIds: [...(checkpoint.failedTaskIds || [])],
+                        unfinishedTaskIds: checkpoint.unfinishedTaskIds?.length
+                            ? [...checkpoint.unfinishedTaskIds]
+                            : ['resume-interrupted-agent-run'],
+                        qualityScore: null,
+                        qualityMissing: [],
+                        qualityBlockers: checkpoint.error ? [checkpoint.error] : [],
+                        hasOutput: false,
+                        answerContent: null,
+                        selfHealStatus: 'skipped',
+                        selfHealTool: null,
+                        plannerError: null,
+                        executorError: checkpoint.error || 'The previous client process ended before the agent run completed.',
+                        clientToolErrors: [],
+                        transportErrors: [],
+                        workspacePath: checkpoint.workspacePath || this.currentProjectPath,
+                        workspaceSyncIssue: null,
+                        finishedAt: Date.parse(checkpoint.updatedAt) || Date.now(),
+                    };
+                }
                 return;
             }
         }
@@ -2337,6 +2394,12 @@ export class ChatCommand {
                 : '';
             this.logger.debug(`Agent route: ${r.path} / ${r.taskKind} [${r.source}]${routerNote} — ${r.reason}`);
         }
+        // V3 owns high-fidelity HTML and other complex single-file rewrites, but
+        // the CLI still has the authoritative local workspace. Prime the target
+        // through the client-tool bridge before handing the task to V3 so the
+        // model receives the real current file and the terminal records a
+        // verifiable read-before-write operation.
+        await this.primeBypassedTargetFileContext(resolvedPrompt);
         const handledByV3Workflow = await this.tryV3AgentWorkflow(resolvedPrompt);
         if (handledByV3Workflow) {
             this.saveSession();
@@ -3160,12 +3223,33 @@ export class ChatCommand {
                 ...(resumeTaskIds.length > 0 ? { remaining_task_ids: resumeTaskIds } : {}),
             }
             : executionHints;
+        const previousExecutionId = this.currentSession?.activeAgentRun?.executionId || null;
+        const executionId = `cli-${Date.now()}-${randomUUID().slice(0, 8)}`;
         const workspaceContext = {
             workspacePath: workspacePath,
             projectPath: workspacePath,
             targetPath: workspacePath,
+            contextId: executionId,
+            executionId,
             ...runtimeContext,
         };
+        this.persistAgentExecutionCheckpoint({
+            executionId,
+            parentExecutionId: shouldResumePlan ? previousExecutionId : null,
+            contextId: executionId,
+            prompt,
+            originalPrompt: priorOutcome?.originalPrompt || priorOutcome?.prompt || prompt,
+            workspacePath,
+            userTier: String(this.config.get('subscription')?.plan || '').trim() || null,
+            taskType: agentTaskType,
+            workflowType,
+            status: 'submitted',
+            submittedAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            failedTaskIds: resumeTaskIds,
+            unfinishedTaskIds: resumeTaskIds.length ? resumeTaskIds : ['agent-run-in-progress'],
+            error: null,
+        });
         // Start workspace watcher for bidirectional real-time sync
         let watcher = null;
         if (this.shouldStartWorkspaceWatcher(workspacePath)) {
@@ -3209,6 +3293,7 @@ export class ChatCommand {
                 requestedModel: this.currentModel,
                 agentExecutionPolicy: routingPolicy,
                 legacyFallbackAllowed: this.isLegacyAgentFallbackAllowed(),
+                approvalLevel: this.autoApprove ? 'auto' : 'confirm',
                 rawPrompt: prompt,
                 contextualPrompt,
                 history: this.getMessagesForModel(),
@@ -3218,6 +3303,7 @@ export class ChatCommand {
                         return;
                     }
                     if (event.type === 'plan') {
+                        this.updateAgentExecutionCheckpoint({ status: 'running' });
                         taskDisplay.complete(0);
                         const tasks = event?.plan?.tasks;
                         if (Array.isArray(tasks) && tasks.length > 0) {
@@ -3518,6 +3604,15 @@ export class ChatCommand {
                     : null,
                 finishedAt: Date.now(),
             }, prompt);
+            this.updateAgentExecutionCheckpoint({
+                status: executorSucceeded ? 'completed' : 'failed',
+                contextId: response.contextId || executionId,
+                failedTaskIds: [...liveOutcome.failedTaskIds],
+                unfinishedTaskIds: [...liveOutcome.unfinishedTaskIds],
+                error: executorSucceeded
+                    ? null
+                    : (liveOutcome.executorError || liveOutcome.plannerError || runEvaluation.statusHeadline),
+            });
             if (!this.jsonOutput && !this.directPromptMode) {
                 if (this.lastAgentRunOutcome) {
                     this.printAgentRunSummary(this.lastAgentRunOutcome, runEvaluation, changedFileCount);
@@ -3619,6 +3714,12 @@ export class ChatCommand {
                 workspaceSyncIssue: null,
                 finishedAt: Date.now(),
             }, prompt);
+            this.updateAgentExecutionCheckpoint({
+                status: 'failed',
+                failedTaskIds: [...liveOutcome.failedTaskIds],
+                unfinishedTaskIds: [...liveOutcome.unfinishedTaskIds],
+                error: liveOutcome.executorError || safeDetail || 'Connection aborted',
+            });
             if (!this.jsonOutput) {
                 process.exitCode = 1;
             }
@@ -3688,6 +3789,7 @@ export class ChatCommand {
                 requestedModel: this.currentModel,
                 agentExecutionPolicy: routingPolicy,
                 legacyFallbackAllowed: this.isLegacyAgentFallbackAllowed(),
+                approvalLevel: this.autoApprove ? 'auto' : 'confirm',
                 rawPrompt,
                 history: this.getMessagesForModel(),
                 onStreamEvent: spinner ? (event) => this.updateV3AgentSpinner(spinner, event) : undefined,
@@ -5021,6 +5123,24 @@ export class ChatCommand {
             sessionSummary: this.currentSession.memorySummary || '',
         });
     }
+    persistAgentExecutionCheckpoint(checkpoint) {
+        if (!this.currentSession) {
+            this.currentSession = this.sessionManager.create(this.currentProjectPath, this.currentModel, this.agentMode, this.operatorMode);
+        }
+        this.currentSession.activeAgentRun = checkpoint;
+        this.saveSession();
+    }
+    updateAgentExecutionCheckpoint(update) {
+        if (!this.currentSession?.activeAgentRun) {
+            return;
+        }
+        this.currentSession.activeAgentRun = {
+            ...this.currentSession.activeAgentRun,
+            ...update,
+            updatedAt: new Date().toISOString(),
+        };
+        this.saveSession();
+    }
     async requestPermission(action) {
         if (this.autoApprove) {
             return true;

package/dist/commands/config.js

@@ -40,7 +40,7 @@ export class ConfigCommand {
         console.log();
         const cwd = process.cwd();
         const configFile = path.join(cwd, '.vigthoria.json');
-        const allowedModels = new Set(['code', 'code-35b', 'code-9b', 'balanced', 'balanced-4b']);
+        const allowedModels = new Set(['architect', 'code', 'assistant', 'code-35b', 'code-9b', 'balanced', 'balanced-4b']);
         const hasOverrides = Boolean(options.model ||
             options.ignorePatterns !== undefined ||
             options.autoApplyFixes !== undefined ||
@@ -71,16 +71,16 @@ export class ConfigCommand {
         let settings;
         if (nonInteractive) {
             const profileDefaults = {
-                safe: { defaultModel: 'balanced', autoApplyFixes: false },
+                safe: { defaultModel: 'assistant', autoApplyFixes: false },
                 balanced: { defaultModel: 'code', autoApplyFixes: false },
-                fast: { defaultModel: 'code-9b', autoApplyFixes: true },
+                fast: { defaultModel: 'assistant', autoApplyFixes: true },
             };
             const profile = options.profile && profileDefaults[options.profile] ? options.profile : 'balanced';
             const defaults = profileDefaults[profile];
             const model = options.model || defaults.defaultModel;
             if (!allowedModels.has(model)) {
                 this.logger.error(`Invalid --model: ${model}`);
-                this.logger.info('Allowed values: code, code-35b, code-9b, balanced, balanced-4b');
+                this.logger.info('Allowed values: architect, code, assistant, code-35b, code-9b, balanced, balanced-4b');
                 return;
             }
             settings = {
@@ -98,12 +98,9 @@ export class ConfigCommand {
                     message: 'Default AI model:',
                     choices: [
                         { name: '═══ Code Models ═══', disabled: true },
-                        { name: 'Vigthoria v3 Code 35B - Flagship coding model', value: 'code' },
-                        { name: 'Vigthoria v3 Code 35B - Explicit 35B selection', value: 'code-35b' },
-                        { name: 'Vigthoria v3 Code 9B - Fast coding specialist', value: 'code-9b' },
-                        { name: '═══ General Models ═══', disabled: true },
-                        { name: 'Vigthoria Master 7.6B - Balanced general model', value: 'balanced' },
-                        { name: 'Vigthoria v3 Balanced 4B - Efficient general purpose', value: 'balanced-4b' },
+                        { name: 'Vigthoria v4 Creative 27B - Architect and planning', value: 'architect' },
+                        { name: 'Vigthoria v4 Code 27B - Production executor', value: 'code' },
+                        { name: 'Vigthoria v4 Assistant 9B - Fast FIM and diagnostics', value: 'assistant' },
                     ],
                     default: 'code',
                 },
@@ -294,10 +291,9 @@ export class ConfigCommand {
                 name: 'defaultModel',
                 message: 'Default AI model:',
                 choices: [
-                    { name: 'Vigthoria v3 Code 35B', value: 'code' },
-                    { name: 'Vigthoria v3 Code 9B', value: 'code-9b' },
-                    { name: 'Vigthoria Master 7.6B', value: 'balanced' },
-                    { name: 'Vigthoria v3 Balanced 4B', value: 'balanced-4b' },
+                    { name: 'Vigthoria v4 Creative 27B — Architect', value: 'architect' },
+                    { name: 'Vigthoria v4 Code 27B — Executor', value: 'code' },
+                    { name: 'Vigthoria v4 Assistant 9B — FIM and diagnostics', value: 'assistant' },
                 ],
                 default: current.preferences.defaultModel,
             },

package/dist/commands/legion.js

@@ -48,19 +48,31 @@ export class LegionCommand {
     }
     getHyperloopUrls() {
         const urls = new Set();
-        const configuredApiUrl = String(this.config.get('apiUrl') || '').trim().replace(/\/$/, '');
-        if (configuredApiUrl) {
-            urls.add(`${configuredApiUrl}/api/hyperloop`);
-        }
-        const envUrl = String(process.env.VIGTHORIA_HYPERLOOP_URL || '').trim().replace(/\/$/, '');
-        if (envUrl) {
-            urls.add(envUrl);
-        }
+        const normalizeBase = (raw) => {
+            let base = String(raw || '').trim().replace(/\/$/, '');
+            base = base.replace(/\/api\/hyperloop\/(?:health|modules|execute)$/i, '/api/hyperloop');
+            if (base && !/\/api\/hyperloop$/i.test(base))
+                base += '/api/hyperloop';
+            return base;
+        };
+        // On-server checks must try loopback first. The former configured 10.0.0.2
+        // route could consume the entire timeout while the same node was healthy.
         if (isServerRuntime()) {
             for (const internal of buildServerHyperloopUrls()) {
-                urls.add(internal.replace(/\/$/, ''));
+                const normalized = normalizeBase(internal);
+                if (normalized)
+                    urls.add(normalized);
             }
         }
+        const envUrl = normalizeBase(process.env.VIGTHORIA_HYPERLOOP_URL || '');
+        if (envUrl)
+            urls.add(envUrl);
+        const configuredApiUrl = String(this.config.get('apiUrl') || '').trim().replace(/\/$/, '');
+        if (configuredApiUrl) {
+            const normalized = normalizeBase(configuredApiUrl);
+            if (normalized)
+                urls.add(normalized);
+        }
         return Array.from(urls);
     }
     getHeaders() {
@@ -1495,19 +1507,42 @@ export class LegionCommand {
         for (const baseUrl of this.getHyperloopUrls()) {
             try {
                 const response = await fetch(`${baseUrl}/status`, {
-                    signal: AbortSignal.timeout(10000),
+                    signal: AbortSignal.timeout(8000),
                     headers: this.getHeaders(),
                 });
+                let data;
+                let healthOnly = false;
                 if (!response.ok) {
-                    lastError = `Legion status check at ${baseUrl} failed: ${response.status} ${describeUpstreamStatus(response.status)}`;
-                    continue;
+                    // /status is authenticated, while the root /health endpoint is the
+                    // authoritative liveness probe. A CLI without the internal service
+                    // credential must still report a live node as online rather than
+                    // falling through to a stale private-network address.
+                    const parsed = new URL(baseUrl);
+                    const healthUrl = /^(?:127\.0\.0\.1|localhost|::1)$/i.test(parsed.hostname)
+                        ? `${parsed.origin}/health`
+                        : `${baseUrl}/health`;
+                    const healthResponse = await fetch(healthUrl, {
+                        signal: AbortSignal.timeout(3000),
+                        headers: this.getHeaders(),
+                    });
+                    if (!healthResponse.ok) {
+                        lastError = `Legion status check at ${baseUrl} failed: ${response.status} ${describeUpstreamStatus(response.status)}`;
+                        continue;
+                    }
+                    data = await this.readJsonResponse(healthResponse, `health check at ${healthUrl}`);
+                    healthOnly = true;
+                }
+                else {
+                    data = await this.readJsonResponse(response, `status check at ${baseUrl}`);
                 }
-                const data = await this.readJsonResponse(response, `status check at ${baseUrl}`);
                 spinner.stop();
                 console.log();
                 console.log(chalk.bold.white(`  ${CH.hLine.repeat(3)} Legion Infrastructure ${CH.hLine.repeat(37)}`));
                 console.log();
                 console.log(chalk.gray(`  Hyper Loop: `) + chalk.green('online'));
+                if (healthOnly) {
+                    console.log(chalk.gray('  Control plane: liveness verified; authenticated worker details not exposed'));
+                }
                 if (data.workers || data.active_workers) {
                     const count = data.workers || data.active_workers;
                     console.log(chalk.gray(`  Active workers: `) + chalk.white(String(typeof count === 'number' ? count : Object.keys(count).length)));