vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/logger.js

@@ -3,6 +3,7 @@
  */
 import chalk from 'chalk';
 import ora from 'ora';
+import { redactSensitiveText, redactSensitiveValue } from './secret-policy.js';
 /**
  * Platform-aware character map.
  *
@@ -68,56 +69,60 @@ export function createSpinner(textOrOpts) {
 }
 export class Logger {
     verbose = false;
+    safeArgs(args) {
+        return args.map((value) => redactSensitiveValue(value));
+    }
     setVerbose(verbose) {
         this.verbose = verbose;
     }
     debug(...args) {
         if (this.verbose) {
-            console.log(chalk.gray('[DEBUG]'), ...args);
+            console.log(chalk.gray('[DEBUG]'), ...this.safeArgs(args));
         }
     }
     info(...args) {
-        console.log(chalk.blue(CH.info), ...args);
+        console.log(chalk.blue(CH.info), ...this.safeArgs(args));
     }
     warn(...args) {
-        console.log(chalk.yellow(CH.warn), ...args);
+        console.log(chalk.yellow(CH.warn), ...this.safeArgs(args));
     }
     error(...args) {
         // Write error messages to stdout (not stderr) to avoid triggering
         // PowerShell NativeCommandError styling.  The red ✗ prefix already
         // signals an error visually; stderr redirection is unnecessary.
-        console.log(chalk.red(CH.error), ...args);
+        console.log(chalk.red(CH.error), ...this.safeArgs(args));
     }
     success(...args) {
-        console.log(chalk.green(CH.success), ...args);
+        console.log(chalk.green(CH.success), ...this.safeArgs(args));
     }
     // AI response formatting
     ai(message) {
-        console.log(chalk.cyan(CH.ai), message);
+        console.log(chalk.cyan(CH.ai), redactSensitiveText(message));
     }
     // User input formatting
     user(message) {
-        console.log(chalk.white(CH.user), message);
+        console.log(chalk.white(CH.user), redactSensitiveText(message));
     }
     // Code block
-    code(code, language) {
+    code(code, _language) {
         console.log(chalk.gray(CH.hLine.repeat(60)));
-        console.log(chalk.yellow(code));
+        console.log(chalk.yellow(redactSensitiveText(code)));
         console.log(chalk.gray(CH.hLine.repeat(60)));
     }
     // Diff output - enhanced with syntax-highlighted unified diff
     diff(added, removed) {
-        removed.forEach(line => console.log(chalk.red(`- ${line}`)));
-        added.forEach(line => console.log(chalk.green(`+ ${line}`)));
+        removed.forEach(line => console.log(chalk.red(`- ${redactSensitiveText(line)}`)));
+        added.forEach(line => console.log(chalk.green(`+ ${redactSensitiveText(line)}`)));
     }
     // Unified diff display with file context
     unifiedDiff(filePath, oldText, newText) {
-        const oldLines = oldText.split('\n');
-        const newLines = newText.split('\n');
-        const fileName = filePath.split('/').pop() || filePath;
+        const oldLines = redactSensitiveText(oldText).split('\n');
+        const newLines = redactSensitiveText(newText).split('\n');
+        const safeFilePath = redactSensitiveText(filePath);
+        const fileName = safeFilePath.split('/').pop() || safeFilePath;
         console.log(chalk.bold.white(`\n  ${CH.hLine.repeat(3)} ${fileName} ${CH.hLine.repeat(Math.max(1, 50 - fileName.length))}`));
-        console.log(chalk.gray(`  --- a/${filePath}`));
-        console.log(chalk.gray(`  +++ b/${filePath}`));
+        console.log(chalk.gray(`  --- a/${safeFilePath}`));
+        console.log(chalk.gray(`  +++ b/${safeFilePath}`));
         // Find diff ranges with context
         const contextLines = 3;
         let i = 0;
@@ -130,7 +135,6 @@ export class Logger {
             }
             // Found a difference - show context
             const startOld = Math.max(0, i - contextLines);
-            const startNew = Math.max(0, j - contextLines);
             // Context before
             for (let c = startOld; c < i; c++) {
                 console.log(chalk.gray(`  ${String(c + 1).padStart(4)} │ ${oldLines[c] || ''}`));
@@ -168,7 +172,7 @@ export class Logger {
         // conservative width so the separator line never overflows even when
         // the reported column count is larger than the real usable width.
         const width = Math.max(24, Number(process.stdout.columns || 80));
-        const cleanTitle = String(title || '').replace(/\s+/g, ' ').trim();
+        const cleanTitle = redactSensitiveText(String(title || '')).replace(/\s+/g, ' ').trim();
         const maxTitle = Math.max(10, width - 10);
         const fittedTitle = cleanTitle.length > maxTitle ? `${cleanTitle.slice(0, maxTitle - 1)}…` : cleanTitle;
         const side = Math.max(3, Math.floor((Math.min(width, 44) - fittedTitle.length - 2) / 2));
@@ -178,7 +182,7 @@ export class Logger {
     }
     // Progress
     progress(message) {
-        process.stdout.write(chalk.gray(`${message}\r`));
+        process.stdout.write(chalk.gray(`${redactSensitiveText(message)}\r`));
     }
     // Clear line
     clearLine() {
@@ -186,7 +190,8 @@ export class Logger {
     }
     // Box output
     box(content, title) {
-        const lines = content.split('\n');
+        const lines = redactSensitiveText(content).split('\n');
+        title = title ? redactSensitiveText(title) : title;
         // Strip ANSI codes when calculating length for proper alignment
         const stripAnsi = (str) => str.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
         const maxLen = Math.max(...lines.map(l => stripAnsi(l).length), title?.length || 0);
@@ -206,6 +211,8 @@ export class Logger {
     }
     // Table output
     table(headers, rows) {
+        headers = headers.map((entry) => redactSensitiveText(entry));
+        rows = rows.map((row) => row.map((entry) => redactSensitiveText(entry)));
         const colWidths = headers.map((h, i) => {
             const maxData = Math.max(...rows.map(r => (r[i] || '').length));
             return Math.max(h.length, maxData);

package/dist/utils/mcp-context-client.d.ts

@@ -0,0 +1,24 @@
+export interface McpContextBinding {
+    mcpContextId: string;
+    backendUrl: string;
+}
+export interface McpContextBindInput {
+    existing?: McpContextBinding | null;
+    userId: string;
+    metadata: Record<string, unknown>;
+    data: Record<string, unknown>;
+}
+export interface McpContextClientDependencies {
+    getBaseUrls(): string[];
+    getAccessToken(): string | null;
+    fetch(input: string, init: RequestInit): Promise<Response>;
+    sanitizeError(text: string): string;
+    debug(message: string, detail?: unknown): void;
+}
+export declare class McpContextClient {
+    private readonly dependencies;
+    constructor(dependencies: McpContextClientDependencies);
+    private headers;
+    private update;
+    bind(input: McpContextBindInput): Promise<McpContextBinding | null>;
+}

package/dist/utils/mcp-context-client.js

@@ -0,0 +1,58 @@
+import { scanOutboundContext } from './secret-policy.js';
+export class McpContextClient {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    headers() {
+        const headers = { 'Content-Type': 'application/json', Accept: 'application/json' };
+        const token = this.dependencies.getAccessToken();
+        if (token) {
+            headers.Authorization = `Bearer ${token}`;
+            headers.Cookie = `vigthoria-auth-token=${token}`;
+            headers['X-Vigthoria-Token'] = token;
+            headers['X-Auth-Token'] = token;
+        }
+        return headers;
+    }
+    async update(binding, data) {
+        const response = await this.dependencies.fetch(`${binding.backendUrl}/mcp/context/${encodeURIComponent(binding.mcpContextId)}`, { method: 'PUT', headers: this.headers(), body: JSON.stringify(scanOutboundContext({ data }).value) });
+        if (!response.ok) {
+            const detail = await response.text().catch(() => '');
+            throw new Error(`MCP context update ${response.status}: ${this.dependencies.sanitizeError(detail).slice(0, 200)}`);
+        }
+        return binding;
+    }
+    async bind(input) {
+        if (input.existing) {
+            try {
+                return await this.update(input.existing, input.data);
+            }
+            catch (error) {
+                this.dependencies.debug('Failed to refresh existing MCP context binding', error);
+            }
+        }
+        for (const baseUrl of this.dependencies.getBaseUrls()) {
+            try {
+                const response = await this.dependencies.fetch(`${baseUrl}/mcp/context/create`, {
+                    method: 'POST',
+                    headers: this.headers(),
+                    body: JSON.stringify(scanOutboundContext({ userId: input.userId, metadata: input.metadata }).value),
+                });
+                if (!response.ok) {
+                    const detail = await response.text().catch(() => '');
+                    throw new Error(`MCP context create ${response.status}: ${this.dependencies.sanitizeError(detail).slice(0, 200)}`);
+                }
+                const payload = await response.json();
+                const mcpContextId = String(payload.contextId || '').trim();
+                if (!mcpContextId)
+                    throw new Error('MCP context create response did not include a contextId');
+                return await this.update({ mcpContextId, backendUrl: baseUrl }, input.data);
+            }
+            catch (error) {
+                this.dependencies.debug(`Failed to bind MCP context via ${baseUrl}`, error);
+            }
+        }
+        return null;
+    }
+}

package/dist/utils/model-governance.d.ts

@@ -0,0 +1,18 @@
+export interface ModelGovernanceDependencies {
+    hasCloudAccess(): boolean;
+    hasSelfHostedEndpoint(): boolean;
+    simulateCloudFailure(): boolean;
+    debug(message: string): void;
+}
+export declare class ModelGovernance {
+    private readonly dependencies;
+    constructor(dependencies: ModelGovernanceDependencies);
+    resolveModelId(shortName: string): string;
+    isCloudModelId(modelId: string): boolean;
+    resolvePermittedModelId(shortName: string): string;
+    shouldSkipCloudRoutes(modelId: string): boolean;
+    getFallbackModelId(modelId: string): string | null;
+    isSelfHostedPreferredModel(modelId: string, requestedModel: string): boolean;
+    shouldTrySelfHostedFallback(modelId: string, requestedModel: string): boolean;
+    getSelfHostedFallbackModelId(modelId: string, requestedModel: string): string;
+}

package/dist/utils/model-governance.js

@@ -0,0 +1,75 @@
+const MODEL_ALIASES = {
+    fast: 'Vigthoria-v4-Assistant-9B', mini: 'vigthoria-mini-0.6b', balanced: 'Vigthoria-v4-Assistant-9B',
+    'balanced-4b': 'Vigthoria-v4-Assistant-9B', assistant: 'Vigthoria-v4-Assistant-9B', creative: 'Vigthoria-v4-Creative-27B',
+    architect: 'Vigthoria-v4-Creative-27B', code: 'Vigthoria-v4-Code-27B', 'code-30b': 'Vigthoria-v4-Code-27B',
+    'code-35b': 'Vigthoria-v4-Code-27B', 'code-8b': 'Vigthoria-v4-Assistant-9B', 'code-9b': 'Vigthoria-v4-Assistant-9B',
+    pro: 'Vigthoria-v4-Code-27B', agent: 'Vigthoria-v4-Code-27B', 'vigthoria-code': 'Vigthoria-v4-Code-27B',
+    'vigthoria-agent': 'Vigthoria-v4-Code-27B', cloud: 'vigthoria-cloud-balanced', 'cloud-code': 'vigthoria-cloud-code',
+    'cloud-balanced': 'vigthoria-cloud-balanced', 'cloud-fast': 'vigthoria-cloud-fast', 'cloud-power': 'vigthoria-cloud-power',
+    'cloud-maximum': 'vigthoria-cloud-maximum', 'cloud-reason': 'vigthoria-cloud-power', ultra: 'vigthoria-cloud-maximum',
+    'cloud-pro': 'vigthoria-cloud-power', 'cloud-k2': 'vigthoria-cloud-power', 'cloud-ultra': 'vigthoria-cloud-maximum',
+};
+const RETIRED_MODELS = new Set(['mini', 'creative-v3', 'creative-v4']);
+const LEGACY_CLOUD_IDS = new Set(['deepseek-v3.1:671b-cloud', 'moonshotai/kimi-k2.5']);
+const SELF_HOSTED_MODELS = new Set([
+    'Vigthoria-v4-Creative-27B', 'Vigthoria-v4-Code-27B', 'Vigthoria-v4-Assistant-9B',
+    'vigthoria-v3-code-35b', 'vigthoria-v3-code-35b:latest', 'vigthoria-v3-code-9b',
+    'vigthoria-v3-code-9b:latest', 'vigthoria-v3-balanced-4b', 'vigthoria-v3-balanced-4b:latest', 'qwen3-coder:latest',
+]);
+const SELF_HOSTED_ALIASES = new Set([
+    'agent', 'architect', 'assistant', 'code', 'code-30b', 'code-35b', 'code-9b', 'balanced', 'balanced-4b', 'pro',
+]);
+export class ModelGovernance {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    resolveModelId(shortName) {
+        const requested = String(shortName || '');
+        const normalized = requested.toLowerCase();
+        if (normalized.includes('vigthoria') || requested.includes('/') || requested.includes(':')) {
+            return MODEL_ALIASES[normalized] || requested;
+        }
+        return MODEL_ALIASES[normalized] || 'Vigthoria-v4-Code-27B';
+    }
+    isCloudModelId(modelId) {
+        const normalized = String(modelId || '').toLowerCase();
+        return normalized.startsWith('vigthoria-cloud-') || LEGACY_CLOUD_IDS.has(normalized);
+    }
+    resolvePermittedModelId(shortName) {
+        const normalized = String(shortName || '').trim().toLowerCase();
+        if (RETIRED_MODELS.has(normalized)) {
+            this.dependencies.debug(`Blocked retired model ${shortName}; using fallback Vigthoria-v4-Code-27B`);
+            return 'Vigthoria-v4-Code-27B';
+        }
+        const resolved = this.resolveModelId(shortName);
+        if (this.isCloudModelId(resolved) && !this.dependencies.hasCloudAccess()) {
+            const fallback = this.getSelfHostedFallbackModelId(resolved, shortName);
+            this.dependencies.debug(`Blocked unauthorized cloud model ${shortName}; using fallback ${fallback}`);
+            return fallback;
+        }
+        return resolved;
+    }
+    shouldSkipCloudRoutes(modelId) {
+        return this.dependencies.simulateCloudFailure() && this.isCloudModelId(modelId);
+    }
+    getFallbackModelId(modelId) {
+        return this.isCloudModelId(modelId) ? 'Vigthoria-v4-Code-27B' : null;
+    }
+    isSelfHostedPreferredModel(modelId, requestedModel) {
+        return SELF_HOSTED_MODELS.has(modelId) || SELF_HOSTED_ALIASES.has(String(requestedModel || '').toLowerCase());
+    }
+    shouldTrySelfHostedFallback(modelId, requestedModel) {
+        if (!this.dependencies.hasSelfHostedEndpoint())
+            return false;
+        const requested = String(requestedModel || '').toLowerCase();
+        return this.isSelfHostedPreferredModel(modelId, requestedModel)
+            || requested === 'cloud' || requested === 'cloud-reason' || requested === 'ultra';
+    }
+    getSelfHostedFallbackModelId(modelId, requestedModel) {
+        if (this.isSelfHostedPreferredModel(modelId, requestedModel)) {
+            return modelId === 'qwen3-coder:latest' ? 'Vigthoria-v4-Code-27B' : modelId;
+        }
+        return 'Vigthoria-v4-Code-27B';
+    }
+}

package/dist/utils/model-transport-service.d.ts

@@ -0,0 +1,44 @@
+export interface ChatMessage {
+    role: 'user' | 'assistant' | 'system';
+    content: string;
+}
+export interface ChatResponse {
+    id: string;
+    message: string;
+    model: string;
+    usage?: {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    };
+}
+export interface ModelTransportDependencies {
+    resolveModelId(model: string): string;
+    resolvePermittedModelId(model: string): string;
+    hasCloudAccess(): boolean;
+    isAuthenticated(): boolean;
+    isCloudModelId(model: string): boolean;
+    shouldSkipCloudRoutes(model: string): boolean;
+    isSelfHostedPreferred(model: string, requested: string): boolean;
+    shouldTrySelfHosted(model: string, requested: string): boolean;
+    getSelfHostedFallback(model: string, requested: string): string;
+    getFallbackModel(model: string): string | null;
+    getMaxTokens(): number;
+    hasSelfHostedTransport(): boolean;
+    postModels(body: Record<string, unknown>): Promise<any>;
+    postCoder(body: Record<string, unknown>): Promise<any>;
+    postCanonicalCoder(body: Record<string, unknown>): Promise<any>;
+    postSelfHosted(body: Record<string, unknown>): Promise<any>;
+    debug(message: string): void;
+}
+export declare class ModelTransportService {
+    private readonly dependencies;
+    private lastErrors;
+    constructor(dependencies: ModelTransportDependencies);
+    getLastErrors(): string[];
+    chat(messages: ChatMessage[], requestedModel: string): Promise<ChatResponse | null>;
+    complete(systemPrompt: string, userPrompt: string, model?: string, maxTokens?: number): Promise<string>;
+    private response;
+    private tryModel;
+    private trySelfHosted;
+}

package/dist/utils/model-transport-service.js

@@ -0,0 +1,111 @@
+import { scanOutboundContext } from './secret-policy.js';
+export class ModelTransportService {
+    dependencies;
+    lastErrors = [];
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    getLastErrors() { return [...this.lastErrors]; }
+    async chat(messages, requestedModel) {
+        this.lastErrors = [];
+        const safeMessages = scanOutboundContext(messages).value;
+        const resolvedModel = this.dependencies.resolveModelId(requestedModel);
+        const candidateModels = this.dependencies.isCloudModelId(resolvedModel) && !this.dependencies.hasCloudAccess()
+            ? [this.dependencies.getSelfHostedFallback(resolvedModel, requestedModel)]
+            : [resolvedModel];
+        const fallback = this.dependencies.getFallbackModel(resolvedModel);
+        if (fallback && fallback !== resolvedModel)
+            candidateModels.push(fallback);
+        for (const candidate of candidateModels) {
+            const response = await this.tryModel(safeMessages, candidate, requestedModel);
+            if (response) {
+                if (candidate !== resolvedModel)
+                    this.dependencies.debug(`Recovered chat request using fallback model: ${candidate}`);
+                return response;
+            }
+        }
+        return null;
+    }
+    async complete(systemPrompt, userPrompt, model, maxTokens) {
+        const resolvedModel = model ? this.dependencies.resolvePermittedModelId(model) : 'Vigthoria-v4-Code-27B';
+        const response = await this.dependencies.postModels({
+            model: resolvedModel,
+            messages: scanOutboundContext([{ role: 'system', content: systemPrompt }, { role: 'user', content: userPrompt }]).value,
+            max_tokens: maxTokens || this.dependencies.getMaxTokens() || 4096,
+            temperature: 0.3,
+            stream: false,
+        });
+        const content = response?.choices?.[0]?.message?.content || response?.choices?.[0]?.text || '';
+        return typeof content === 'string' ? content : '';
+    }
+    response(data, model, requested, prefix) {
+        const content = data?.choices?.[0]?.message?.content || data?.choices?.[0]?.text || data?.response || data?.message || data?.content;
+        if (typeof content !== 'string' || !content.trim() || data?.success === false)
+            return null;
+        return { id: data.id || `${prefix}-${Date.now()}`, message: content, model: data.model || model || requested, usage: data.usage };
+    }
+    async tryModel(messages, resolvedModel, requestedModel) {
+        const failures = [];
+        const preferSelfHosted = this.dependencies.isSelfHostedPreferred(resolvedModel, requestedModel);
+        if (preferSelfHosted) {
+            const local = await this.trySelfHosted(messages, resolvedModel, requestedModel);
+            if (local)
+                return local;
+        }
+        const body = { model: resolvedModel, messages, max_tokens: this.dependencies.getMaxTokens(), temperature: 0.7, stream: false };
+        if (!this.dependencies.shouldSkipCloudRoutes(resolvedModel) && !this.dependencies.isCloudModelId(resolvedModel)) {
+            try {
+                const response = this.response(await this.dependencies.postModels(body), resolvedModel, requestedModel, 'vigthoria');
+                if (response)
+                    return response;
+            }
+            catch (error) {
+                failures.push(`models:${String(error?.response?.data?.error || error?.message || 'Unknown error').slice(0, 120)}`);
+            }
+        }
+        if (this.dependencies.isAuthenticated() && !this.dependencies.shouldSkipCloudRoutes(resolvedModel)) {
+            const coderBody = {
+                messages, model: resolvedModel, maxTokens: this.dependencies.getMaxTokens(), temperature: 0.7,
+                cloudConsent: this.dependencies.isCloudModelId(resolvedModel),
+            };
+            try {
+                const response = this.response(await this.dependencies.postCoder(coderBody), resolvedModel, requestedModel, 'vigthoria-coder');
+                if (response)
+                    return response;
+            }
+            catch (error) {
+                failures.push(`coder:${String(error?.response?.data?.error || error?.message || 'Unknown error').slice(0, 120)}`);
+            }
+            try {
+                const response = this.response(await this.dependencies.postCanonicalCoder(coderBody), resolvedModel, requestedModel, 'vigthoria-coder-canonical');
+                if (response)
+                    return response;
+            }
+            catch (error) {
+                failures.push(`coder-canonical:${String(error?.response?.data?.error || error?.message || 'Unknown error').slice(0, 120)}`);
+            }
+        }
+        if (!preferSelfHosted) {
+            const local = await this.trySelfHosted(messages, resolvedModel, requestedModel);
+            if (local)
+                return local;
+        }
+        if (failures.length > 0)
+            this.lastErrors = failures;
+        return null;
+    }
+    async trySelfHosted(messages, resolvedModel, requestedModel) {
+        if (!this.dependencies.hasSelfHostedTransport() || !this.dependencies.shouldTrySelfHosted(resolvedModel, requestedModel))
+            return null;
+        const model = this.dependencies.getSelfHostedFallback(resolvedModel, requestedModel);
+        try {
+            return this.response(await this.dependencies.postSelfHosted({
+                model, messages, max_tokens: this.dependencies.getMaxTokens(), temperature: 0.7, stream: false,
+            }), model, requestedModel, 'vigthoria-dedicated');
+        }
+        catch (error) {
+            this.dependencies.debug(`Dedicated model endpoint failed for ${model}: ${error?.message || 'Unknown error'}`);
+            return null;
+        }
+    }
+}

package/dist/utils/mutation-journal.d.ts

@@ -0,0 +1,42 @@
+export type MutationJournalStatus = 'open' | 'committed' | 'rolled_back' | 'partial_mutation';
+export interface MutationJournalReport {
+    operationId: string;
+    status: MutationJournalStatus;
+    affectedPaths: string[];
+    rolledBack: boolean;
+    partialMutation: boolean;
+    rollbackFailures: string[];
+    snapshotIssues: string[];
+    manifestPath: string;
+}
+export declare function createOperationId(value?: string): string;
+export declare class MutationJournal {
+    private readonly limits;
+    readonly operationId: string;
+    readonly rootPath: string;
+    readonly manifestPath: string;
+    private readonly journalDirectory;
+    private readonly backupDirectory;
+    private readonly baseline;
+    private readonly baselineDirectories;
+    private readonly snapshotIssues;
+    private status;
+    constructor(rootPath: string, requestedOperationId?: string, limits?: {
+        maxBackupBytes: number;
+        maxFileBytes: number;
+        maxFiles: number;
+    });
+    private listWorkspaceDirectories;
+    private captureBaselineDirectories;
+    private listWorkspaceFiles;
+    private captureBaseline;
+    private changedPaths;
+    hasMutations(): boolean;
+    private resolveRollbackDestination;
+    private removeRollbackDestination;
+    private persist;
+    private report;
+    commit(): MutationJournalReport;
+    rollback(): MutationJournalReport;
+}
+export declare function finalizeMutationTransaction(journal: MutationJournal, proofSucceeded: boolean): MutationJournalReport;