vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/vigflow-client.d.ts

@@ -0,0 +1,95 @@
+import { type AxiosRequestConfig } from 'axios';
+export interface VigFlowTemplateSummary {
+    id: string;
+    name: string;
+    description: string;
+    category: string;
+    icon?: string;
+    tags: string[];
+    isBuiltin: boolean;
+    source: string;
+    createdAt?: string;
+}
+export interface VigFlowWorkflowSummary {
+    id: string;
+    name: string;
+    description: string;
+    isActive: boolean;
+    version: string;
+    tags: string[];
+    nodeCount: number;
+    executionCount: number;
+    lastExecutedAt?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface VigFlowWorkflowCreation {
+    id: string;
+    name: string;
+    fromTemplate?: string;
+}
+export interface ResolvedVigFlowWorkflowTarget {
+    id: string;
+    name: string;
+    selector: string;
+    matchedBy: 'id' | 'name' | 'search';
+}
+export interface VigFlowExecutionResult {
+    executionId: string;
+    status: string;
+    result?: unknown;
+    error?: string;
+    nodesExecuted?: number;
+}
+export interface VigFlowExecutionStatus {
+    id: string;
+    workflowId: string;
+    status: string;
+    startedAt?: string;
+    completedAt?: string;
+    nodesExecuted?: number;
+    totalNodes?: number;
+    result?: unknown;
+    error?: string;
+    progress?: Record<string, unknown>;
+    duration?: number;
+}
+export interface VigFlowTransport {
+    get<T>(url: string, config?: AxiosRequestConfig): Promise<{
+        data: T;
+    }>;
+    post<T>(url: string, data?: unknown, config?: AxiosRequestConfig): Promise<{
+        data: T;
+    }>;
+}
+export interface VigFlowClientDependencies {
+    getBaseUrls(): string[];
+    getAccessToken(): string | null;
+    debug(message: string, detail?: string): void;
+    transport?: VigFlowTransport;
+}
+export declare class VigFlowClient {
+    private readonly dependencies;
+    private readonly tokens;
+    private readonly transport;
+    constructor(dependencies: VigFlowClientDependencies);
+    clearCredentials(): void;
+    private accessToken;
+    private withBackend;
+    private endpoint;
+    listTemplates(options?: {
+        category?: string;
+        search?: string;
+    }): Promise<VigFlowTemplateSummary[]>;
+    listWorkflows(): Promise<VigFlowWorkflowSummary[]>;
+    resolveWorkflow(selector: string): Promise<ResolvedVigFlowWorkflowTarget>;
+    useTemplate(templateId: string, options?: {
+        name?: string;
+        variables?: Record<string, unknown>;
+    }): Promise<VigFlowWorkflowCreation>;
+    runWorkflow(workflowId: string, options?: {
+        data?: Record<string, unknown>;
+        executionOptions?: Record<string, unknown>;
+    }): Promise<VigFlowExecutionResult>;
+    executionStatus(executionId: string): Promise<VigFlowExecutionStatus>;
+}

package/dist/utils/vigflow-client.js

@@ -0,0 +1,105 @@
+import axios from 'axios';
+import { scanOutboundContext } from './secret-policy.js';
+export class VigFlowClient {
+    dependencies;
+    tokens = new Map();
+    transport;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+        this.transport = dependencies.transport || axios;
+    }
+    clearCredentials() { this.tokens.clear(); }
+    async accessToken(baseUrl) {
+        const cached = this.tokens.get(baseUrl);
+        if (cached)
+            return cached;
+        const authToken = this.dependencies.getAccessToken();
+        if (!authToken)
+            throw new Error('Not authenticated. Run vigthoria login first.');
+        const response = await this.transport.post(`${baseUrl}/api/auth/sso`, { token: authToken }, {
+            headers: { 'Content-Type': 'application/json' }, timeout: 30_000,
+        });
+        const token = String(response.data.token || '').trim();
+        if (!token)
+            throw new Error('VigFlow SSO response did not include a token.');
+        this.tokens.set(baseUrl, token);
+        return token;
+    }
+    async withBackend(operation, action) {
+        for (const baseUrl of this.dependencies.getBaseUrls()) {
+            try {
+                const token = await this.accessToken(baseUrl);
+                return await action(baseUrl, { 'Content-Type': 'application/json', Accept: 'application/json', Authorization: `Bearer ${token}` });
+            }
+            catch (error) {
+                this.dependencies.debug(`VigFlow ${operation} via ${baseUrl} failed:`, error instanceof Error ? error.message : String(error));
+            }
+        }
+        throw new Error(`No VigFlow backend available for ${operation}. The workflow service is not deployed or not reachable.`);
+    }
+    endpoint(baseUrl, subPath) {
+        return /\/api\/vigflow\/?$/i.test(baseUrl) ? `${baseUrl.replace(/\/$/, '')}${subPath}` : `${baseUrl}/api${subPath}`;
+    }
+    listTemplates(options = {}) {
+        return this.withBackend('list templates', async (baseUrl, headers) => {
+            const query = new URLSearchParams();
+            if (options.category)
+                query.set('category', options.category);
+            if (options.search)
+                query.set('search', options.search);
+            const response = await this.transport.get(`${this.endpoint(baseUrl, '/templates')}${query.size ? `?${query}` : ''}`, { headers, timeout: 30_000 });
+            return Array.isArray(response.data.templates) ? response.data.templates : [];
+        });
+    }
+    listWorkflows() {
+        return this.withBackend('list workflows', async (baseUrl, headers) => {
+            const response = await this.transport.get(this.endpoint(baseUrl, '/workflows'), { headers, timeout: 30_000 });
+            return Array.isArray(response.data.workflows) ? response.data.workflows : [];
+        });
+    }
+    async resolveWorkflow(selector) {
+        const normalized = String(selector || '').trim();
+        if (!normalized)
+            throw new Error('Workflow selector is required. Provide a workflow id or name.');
+        const workflows = await this.listWorkflows();
+        const byId = workflows.find((workflow) => workflow.id === normalized);
+        if (byId)
+            return { id: byId.id, name: byId.name, selector: normalized, matchedBy: 'id' };
+        const lower = normalized.toLowerCase();
+        const exact = workflows.filter((workflow) => String(workflow.name || '').trim().toLowerCase() === lower);
+        if (exact.length === 1)
+            return { id: exact[0].id, name: exact[0].name, selector: normalized, matchedBy: 'name' };
+        if (exact.length > 1)
+            throw new Error(`Multiple workflows matched the name "${normalized}". Use the workflow id instead.`);
+        const partial = workflows.filter((workflow) => String(workflow.name || '').toLowerCase().includes(lower));
+        if (partial.length === 1)
+            return { id: partial[0].id, name: partial[0].name, selector: normalized, matchedBy: 'search' };
+        if (partial.length > 1)
+            throw new Error(`Multiple workflows partially matched "${normalized}". Use a full workflow name or id.`);
+        throw new Error(`No VigFlow workflow matched "${normalized}".`);
+    }
+    useTemplate(templateId, options = {}) {
+        return this.withBackend('use template', async (baseUrl, headers) => {
+            const response = await this.transport.post(this.endpoint(baseUrl, `/templates/${encodeURIComponent(templateId)}/use`), scanOutboundContext({ name: options.name, variables: options.variables || {} }).value, { headers, timeout: 30_000 });
+            if (!response.data.workflow?.id)
+                throw new Error('VigFlow use-template response did not include a workflow id.');
+            return response.data.workflow;
+        });
+    }
+    runWorkflow(workflowId, options = {}) {
+        return this.withBackend('run workflow', async (baseUrl, headers) => {
+            const response = await this.transport.post(this.endpoint(baseUrl, `/executions/run/${encodeURIComponent(workflowId)}`), scanOutboundContext({ data: options.data || {}, options: options.executionOptions || {} }).value, { headers, timeout: 60_000 });
+            if (!response.data.executionId)
+                throw new Error('VigFlow run response did not include an execution id.');
+            return response.data;
+        });
+    }
+    executionStatus(executionId) {
+        return this.withBackend('execution status', async (baseUrl, headers) => {
+            const response = await this.transport.get(this.endpoint(baseUrl, `/executions/${encodeURIComponent(executionId)}`), { headers, timeout: 30_000 });
+            if (!response.data.execution?.id)
+                throw new Error('VigFlow execution response did not include execution details.');
+            return response.data.execution;
+        });
+    }
+}

package/dist/utils/workspace-boundary.d.ts

@@ -0,0 +1,45 @@
+export declare class WorkspaceBoundaryError extends Error {
+    readonly code: string;
+    constructor(message: string, code?: string);
+}
+export interface WorkspacePathOptions {
+    allowMissing?: boolean;
+    allowRoot?: boolean;
+    allowAbsoluteInsideRoot?: boolean;
+}
+export interface ZipInspectionLimits {
+    maxEntries?: number;
+    maxCompressedBytes?: number;
+    maxEntryUncompressedBytes?: number;
+    maxTotalUncompressedBytes?: number;
+    maxCompressionRatio?: number;
+}
+export interface ZipEntryInspection {
+    path: string;
+    compressedBytes: number;
+    uncompressedBytes: number;
+    directory: boolean;
+}
+/** Validate a path supplied by an archive, service, or model as strictly relative. */
+export declare function assertSafeRelativePath(value: string): string;
+/** Resolve an untrusted relative path beneath a real workspace root. */
+export declare function resolveWorkspacePath(rootPath: string, inputPath: string, options?: WorkspacePathOptions): string;
+export declare function assertContainedAbsolutePath(rootPath: string, candidatePath: string, options?: Omit<WorkspacePathOptions, 'allowAbsoluteInsideRoot'>): string;
+/** Reject a destination whose existing path components include a link. */
+export declare function assertSafeDestinationPath(candidatePath: string): string;
+/** Inspect ZIP metadata before any external extractor sees the archive. */
+export declare function inspectZipArchive(buffer: Buffer, limits?: ZipInspectionLimits): ZipEntryInspection[];
+/** Verify the extractor did not create links, devices, or paths outside destination. */
+export declare function validateExtractedWorkspace(rootPath: string, options?: {
+    ignoreNames?: Iterable<string>;
+}): void;
+/**
+ * Merge an already extracted, validated staging tree into a destination.
+ *
+ * External archive tools must never receive the user destination directly:
+ * they may follow links that appear safe in ZIP metadata. This routine rejects
+ * links in both trees, preflights every destination component, and installs
+ * files through a temporary sibling followed by rename so a final-component
+ * link is replaced rather than followed.
+ */
+export declare function mergeValidatedWorkspace(sourcePath: string, destinationPath: string): void;

package/dist/utils/workspace-boundary.js

@@ -0,0 +1,377 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { inflateRawSync } from 'node:zlib';
+export class WorkspaceBoundaryError extends Error {
+    code;
+    constructor(message, code = 'WORKSPACE_BOUNDARY_VIOLATION') {
+        super(message);
+        this.code = code;
+        this.name = 'WorkspaceBoundaryError';
+    }
+}
+const DEFAULT_ZIP_LIMITS = {
+    maxEntries: 10_000,
+    maxCompressedBytes: 128 * 1024 * 1024,
+    maxEntryUncompressedBytes: 64 * 1024 * 1024,
+    maxTotalUncompressedBytes: 256 * 1024 * 1024,
+    maxCompressionRatio: 100,
+};
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function rejectWindowsNamespace(value) {
+    const normalized = String(value || '').replace(/\//g, '\\');
+    if (/^[\\]{2}/.test(normalized)
+        || /^[a-zA-Z]:/.test(normalized)
+        || /^[\\]{2}[?.][\\]/.test(normalized)
+        || /^GLOBALROOT[\\]/i.test(normalized)) {
+        throw new WorkspaceBoundaryError(`Windows absolute, UNC, and device paths are not allowed: ${value}`, 'UNSAFE_WINDOWS_PATH');
+    }
+}
+/** Validate a path supplied by an archive, service, or model as strictly relative. */
+export function assertSafeRelativePath(value) {
+    const input = String(value || '');
+    if (!input || /[\0\r\n]/.test(input)) {
+        throw new WorkspaceBoundaryError('Path is empty or contains control characters', 'UNSAFE_RELATIVE_PATH');
+    }
+    rejectWindowsNamespace(input);
+    if (input.startsWith('/') || path.posix.isAbsolute(input)) {
+        throw new WorkspaceBoundaryError(`Absolute paths are not allowed: ${value}`, 'ABSOLUTE_PATH_REJECTED');
+    }
+    const slashPath = input.replace(/\\/g, '/');
+    const segments = slashPath.split('/');
+    if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+        throw new WorkspaceBoundaryError(`Traversal or empty path segment is not allowed: ${value}`, 'PATH_TRAVERSAL');
+    }
+    if (segments.some((segment) => segment.includes(':'))) {
+        throw new WorkspaceBoundaryError(`Alternate streams and drive-qualified paths are not allowed: ${value}`, 'UNSAFE_WINDOWS_PATH');
+    }
+    if (segments.some((segment) => /[. ]$/.test(segment) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i.test(segment))) {
+        throw new WorkspaceBoundaryError(`Windows device or normalization-sensitive path is not allowed: ${value}`, 'UNSAFE_WINDOWS_PATH');
+    }
+    return segments.join('/');
+}
+function resolveExistingAncestor(candidate) {
+    let current = candidate;
+    while (!fs.existsSync(current)) {
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return current;
+}
+function assertNoLinkComponents(rootReal, candidate) {
+    const relative = path.relative(rootReal, candidate);
+    if (!relative)
+        return;
+    let current = rootReal;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        if (!fs.existsSync(current))
+            break;
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink()) {
+            throw new WorkspaceBoundaryError(`Symbolic link or junction boundary is not allowed: ${current}`, 'WORKSPACE_LINK_ESCAPE');
+        }
+    }
+}
+/** Resolve an untrusted relative path beneath a real workspace root. */
+export function resolveWorkspacePath(rootPath, inputPath, options = {}) {
+    if (!rootPath)
+        throw new WorkspaceBoundaryError('Workspace root is required');
+    const rootReal = fs.realpathSync(path.resolve(rootPath));
+    const raw = String(inputPath || '');
+    let candidate;
+    if (path.isAbsolute(raw)) {
+        if (!options.allowAbsoluteInsideRoot) {
+            throw new WorkspaceBoundaryError(`Absolute paths are not allowed: ${raw}`, 'ABSOLUTE_PATH_REJECTED');
+        }
+        const windowsAbsolute = raw.replace(/\//g, '\\');
+        if (/^[\\]{2}/.test(windowsAbsolute) || /^[\\]{2}[?.][\\]/.test(windowsAbsolute)) {
+            throw new WorkspaceBoundaryError(`UNC and device paths are not allowed: ${raw}`, 'UNSAFE_WINDOWS_PATH');
+        }
+        candidate = path.resolve(raw);
+    }
+    else {
+        const safeRelative = assertSafeRelativePath(raw);
+        candidate = path.resolve(rootReal, ...safeRelative.split('/'));
+    }
+    if (!isWithin(rootReal, candidate) || (!options.allowRoot && candidate === rootReal)) {
+        throw new WorkspaceBoundaryError(`Path escapes workspace: ${inputPath}`, 'WORKSPACE_ESCAPE');
+    }
+    assertNoLinkComponents(rootReal, candidate);
+    if (fs.existsSync(candidate)) {
+        const candidateReal = fs.realpathSync(candidate);
+        if (!isWithin(rootReal, candidateReal)) {
+            throw new WorkspaceBoundaryError(`Resolved path escapes workspace: ${inputPath}`, 'WORKSPACE_LINK_ESCAPE');
+        }
+        return candidateReal;
+    }
+    if (!options.allowMissing) {
+        throw new WorkspaceBoundaryError(`Workspace path does not exist: ${inputPath}`, 'WORKSPACE_PATH_MISSING');
+    }
+    const ancestorReal = fs.realpathSync(resolveExistingAncestor(candidate));
+    if (!isWithin(rootReal, ancestorReal)) {
+        throw new WorkspaceBoundaryError(`Parent path escapes workspace: ${inputPath}`, 'WORKSPACE_LINK_ESCAPE');
+    }
+    return candidate;
+}
+export function assertContainedAbsolutePath(rootPath, candidatePath, options = {}) {
+    return resolveWorkspacePath(rootPath, candidatePath, { ...options, allowAbsoluteInsideRoot: true });
+}
+/** Reject a destination whose existing path components include a link. */
+export function assertSafeDestinationPath(candidatePath) {
+    const absolute = path.resolve(candidatePath);
+    const parsed = path.parse(absolute);
+    let current = parsed.root;
+    for (const segment of absolute.slice(parsed.root.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        if (!fs.existsSync(current))
+            break;
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink()) {
+            throw new WorkspaceBoundaryError(`Destination contains a symbolic link or junction: ${current}`, 'WORKSPACE_LINK_ESCAPE');
+        }
+    }
+    return absolute;
+}
+function decodeZipName(buffer, offset, length, utf8) {
+    const bytes = buffer.subarray(offset, offset + length);
+    // CP437 non-ASCII names are deliberately rejected. Ambiguous decoding can
+    // make validator and extractor disagree about the destination path.
+    if (!utf8 && bytes.some((byte) => byte > 0x7f)) {
+        throw new WorkspaceBoundaryError('ZIP entry name must be UTF-8 or ASCII', 'ZIP_AMBIGUOUS_NAME');
+    }
+    const name = bytes.toString('utf8');
+    if (Buffer.from(name, 'utf8').compare(bytes) !== 0 && utf8) {
+        throw new WorkspaceBoundaryError('ZIP entry contains invalid UTF-8', 'ZIP_AMBIGUOUS_NAME');
+    }
+    return name;
+}
+function findEndOfCentralDirectory(buffer) {
+    const minimum = Math.max(0, buffer.length - 65_557);
+    for (let offset = buffer.length - 22; offset >= minimum; offset -= 1) {
+        if (buffer.readUInt32LE(offset) === 0x06054b50)
+            return offset;
+    }
+    throw new WorkspaceBoundaryError('ZIP end-of-central-directory record is missing', 'ZIP_MALFORMED');
+}
+/** Inspect ZIP metadata before any external extractor sees the archive. */
+export function inspectZipArchive(buffer, limits = {}) {
+    const policy = { ...DEFAULT_ZIP_LIMITS, ...limits };
+    if (!Buffer.isBuffer(buffer) || buffer.length < 22 || buffer.length > policy.maxCompressedBytes) {
+        throw new WorkspaceBoundaryError('ZIP archive is empty, malformed, or exceeds the compressed-size limit', 'ZIP_SIZE_LIMIT');
+    }
+    const eocd = findEndOfCentralDirectory(buffer);
+    const disk = buffer.readUInt16LE(eocd + 4);
+    const centralDisk = buffer.readUInt16LE(eocd + 6);
+    const diskEntries = buffer.readUInt16LE(eocd + 8);
+    const totalEntries = buffer.readUInt16LE(eocd + 10);
+    const centralSize = buffer.readUInt32LE(eocd + 12);
+    const centralOffset = buffer.readUInt32LE(eocd + 16);
+    if (disk !== 0 || centralDisk !== 0 || diskEntries !== totalEntries || totalEntries === 0 || totalEntries > policy.maxEntries) {
+        throw new WorkspaceBoundaryError('Multi-disk, empty, ZIP64, or excessive-entry archives are not allowed', 'ZIP_ENTRY_LIMIT');
+    }
+    if (centralOffset + centralSize > eocd || centralOffset + centralSize > buffer.length) {
+        throw new WorkspaceBoundaryError('ZIP central directory is outside the archive', 'ZIP_MALFORMED');
+    }
+    const entries = [];
+    const seen = new Map();
+    const localRanges = [];
+    let totalUncompressed = 0;
+    let offset = centralOffset;
+    for (let index = 0; index < totalEntries; index += 1) {
+        if (offset + 46 > buffer.length || buffer.readUInt32LE(offset) !== 0x02014b50) {
+            throw new WorkspaceBoundaryError('ZIP central-directory entry is malformed', 'ZIP_MALFORMED');
+        }
+        const flags = buffer.readUInt16LE(offset + 8);
+        const method = buffer.readUInt16LE(offset + 10);
+        const compressedBytes = buffer.readUInt32LE(offset + 20);
+        const uncompressedBytes = buffer.readUInt32LE(offset + 24);
+        const nameLength = buffer.readUInt16LE(offset + 28);
+        const extraLength = buffer.readUInt16LE(offset + 30);
+        const commentLength = buffer.readUInt16LE(offset + 32);
+        const externalAttributes = buffer.readUInt32LE(offset + 38);
+        const localOffset = buffer.readUInt32LE(offset + 42);
+        const entryEnd = offset + 46 + nameLength + extraLength + commentLength;
+        if (entryEnd > buffer.length || nameLength === 0 || [compressedBytes, uncompressedBytes, localOffset].includes(0xffffffff)) {
+            throw new WorkspaceBoundaryError('ZIP64 or truncated entries are not allowed', 'ZIP_MALFORMED');
+        }
+        if ((flags & 0x1) !== 0 || ![0, 8].includes(method)) {
+            throw new WorkspaceBoundaryError('Encrypted or unsupported ZIP entries are not allowed', 'ZIP_UNSUPPORTED_ENTRY');
+        }
+        const rawName = decodeZipName(buffer, offset + 46, nameLength, (flags & 0x800) !== 0);
+        const directory = rawName.endsWith('/');
+        const name = directory ? rawName.slice(0, -1) : rawName;
+        const safeName = assertSafeRelativePath(name);
+        const collisionKey = safeName.normalize('NFC').toLocaleLowerCase('en-US');
+        if (seen.has(collisionKey)) {
+            throw new WorkspaceBoundaryError(`ZIP contains duplicate or case-colliding paths: ${seen.get(collisionKey)} and ${safeName}`, 'ZIP_PATH_COLLISION');
+        }
+        seen.set(collisionKey, safeName);
+        const unixType = (externalAttributes >>> 16) & 0o170000;
+        if (unixType && unixType !== 0o100000 && unixType !== 0o040000) {
+            throw new WorkspaceBoundaryError(`ZIP links and device entries are not allowed: ${safeName}`, 'ZIP_LINK_ENTRY');
+        }
+        if (uncompressedBytes > policy.maxEntryUncompressedBytes) {
+            throw new WorkspaceBoundaryError(`ZIP entry exceeds uncompressed-size limit: ${safeName}`, 'ZIP_BOMB');
+        }
+        totalUncompressed += uncompressedBytes;
+        if (totalUncompressed > policy.maxTotalUncompressedBytes) {
+            throw new WorkspaceBoundaryError('ZIP exceeds total uncompressed-size limit', 'ZIP_BOMB');
+        }
+        if (uncompressedBytes > 0 && (compressedBytes === 0 || uncompressedBytes / compressedBytes > policy.maxCompressionRatio)) {
+            throw new WorkspaceBoundaryError(`ZIP entry exceeds compression-ratio limit: ${safeName}`, 'ZIP_BOMB');
+        }
+        if (localOffset + 30 > buffer.length || buffer.readUInt32LE(localOffset) !== 0x04034b50) {
+            throw new WorkspaceBoundaryError(`ZIP local header is missing: ${safeName}`, 'ZIP_MALFORMED');
+        }
+        const localFlags = buffer.readUInt16LE(localOffset + 6);
+        const localNameLength = buffer.readUInt16LE(localOffset + 26);
+        const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+        if (localOffset + 30 + localNameLength + localExtraLength > centralOffset) {
+            throw new WorkspaceBoundaryError(`ZIP local entry overlaps metadata: ${safeName}`, 'ZIP_MALFORMED');
+        }
+        const localName = decodeZipName(buffer, localOffset + 30, localNameLength, (localFlags & 0x800) !== 0);
+        if (localName !== rawName || localFlags !== flags) {
+            throw new WorkspaceBoundaryError(`ZIP local and central entry names disagree: ${safeName}`, 'ZIP_NAME_MISMATCH');
+        }
+        const localEnd = localOffset + 30 + localNameLength + localExtraLength + compressedBytes;
+        if (localEnd > centralOffset) {
+            throw new WorkspaceBoundaryError(`ZIP local entry data overlaps metadata: ${safeName}`, 'ZIP_MALFORMED');
+        }
+        const compressedData = buffer.subarray(localOffset + 30 + localNameLength + localExtraLength, localEnd);
+        let actualUncompressedBytes;
+        if (method === 0) {
+            actualUncompressedBytes = compressedData.length;
+        }
+        else {
+            try {
+                actualUncompressedBytes = inflateRawSync(compressedData, {
+                    maxOutputLength: policy.maxEntryUncompressedBytes + 1,
+                }).length;
+            }
+            catch (error) {
+                if (error?.code === 'ERR_BUFFER_TOO_LARGE' || /larger than|output length/i.test(String(error?.message || ''))) {
+                    throw new WorkspaceBoundaryError(`ZIP entry expands beyond the enforced limit: ${safeName}`, 'ZIP_BOMB');
+                }
+                throw new WorkspaceBoundaryError(`ZIP entry compressed data is malformed: ${safeName}`, 'ZIP_MALFORMED');
+            }
+        }
+        if (actualUncompressedBytes > policy.maxEntryUncompressedBytes) {
+            throw new WorkspaceBoundaryError(`ZIP entry expands beyond the enforced limit: ${safeName}`, 'ZIP_BOMB');
+        }
+        if (actualUncompressedBytes !== uncompressedBytes) {
+            throw new WorkspaceBoundaryError(`ZIP entry size metadata does not match compressed data: ${safeName}`, 'ZIP_MALFORMED');
+        }
+        localRanges.push({ start: localOffset, end: localEnd, path: safeName });
+        entries.push({ path: safeName, compressedBytes, uncompressedBytes, directory });
+        offset = entryEnd;
+    }
+    if (offset !== centralOffset + centralSize) {
+        throw new WorkspaceBoundaryError('ZIP central-directory size does not match its entries', 'ZIP_MALFORMED');
+    }
+    localRanges.sort((left, right) => left.start - right.start);
+    for (let index = 1; index < localRanges.length; index += 1) {
+        if (localRanges[index].start < localRanges[index - 1].end) {
+            throw new WorkspaceBoundaryError(`ZIP local entries overlap: ${localRanges[index - 1].path} and ${localRanges[index].path}`, 'ZIP_MALFORMED');
+        }
+    }
+    return entries;
+}
+/** Verify the extractor did not create links, devices, or paths outside destination. */
+export function validateExtractedWorkspace(rootPath, options = {}) {
+    const rootAbsolute = path.resolve(rootPath);
+    const rootStat = fs.lstatSync(rootAbsolute);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+        throw new WorkspaceBoundaryError(`Workspace destination must be a real directory: ${rootAbsolute}`, 'WORKSPACE_LINK_ESCAPE');
+    }
+    const rootReal = fs.realpathSync(rootAbsolute);
+    const ignoreNames = new Set(options.ignoreNames || []);
+    const walk = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            if (ignoreNames.has(entry.name))
+                continue;
+            const candidate = path.join(directory, entry.name);
+            const stat = fs.lstatSync(candidate);
+            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory())) {
+                throw new WorkspaceBoundaryError(`Extracted archive contains a link or special file: ${candidate}`, 'ZIP_LINK_ENTRY');
+            }
+            const real = fs.realpathSync(candidate);
+            if (!isWithin(rootReal, real)) {
+                throw new WorkspaceBoundaryError(`Extracted path escapes destination: ${candidate}`, 'WORKSPACE_LINK_ESCAPE');
+            }
+            if (stat.isDirectory())
+                walk(candidate);
+        }
+    };
+    walk(rootReal);
+}
+/**
+ * Merge an already extracted, validated staging tree into a destination.
+ *
+ * External archive tools must never receive the user destination directly:
+ * they may follow links that appear safe in ZIP metadata. This routine rejects
+ * links in both trees, preflights every destination component, and installs
+ * files through a temporary sibling followed by rename so a final-component
+ * link is replaced rather than followed.
+ */
+export function mergeValidatedWorkspace(sourcePath, destinationPath) {
+    validateExtractedWorkspace(sourcePath);
+    const destinationAbsolute = assertSafeDestinationPath(destinationPath);
+    if (fs.existsSync(destinationAbsolute)) {
+        validateExtractedWorkspace(destinationAbsolute);
+    }
+    else {
+        fs.mkdirSync(destinationAbsolute, { recursive: true, mode: 0o700 });
+        validateExtractedWorkspace(destinationAbsolute);
+    }
+    const sourceRoot = fs.realpathSync(path.resolve(sourcePath));
+    const destinationRoot = fs.realpathSync(destinationAbsolute);
+    const entries = [];
+    const walk = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const sourceEntry = path.join(directory, entry.name);
+            const relativePath = assertSafeRelativePath(path.relative(sourceRoot, sourceEntry).replace(/\\/g, '/'));
+            if (entry.isSymbolicLink() || (!entry.isFile() && !entry.isDirectory())) {
+                throw new WorkspaceBoundaryError(`Staging tree contains a link or special file: ${relativePath}`, 'ZIP_LINK_ENTRY');
+            }
+            const destinationEntry = resolveWorkspacePath(destinationRoot, relativePath, { allowMissing: true });
+            if (fs.existsSync(destinationEntry)) {
+                const destinationStat = fs.lstatSync(destinationEntry);
+                if (destinationStat.isSymbolicLink() || (entry.isDirectory() && !destinationStat.isDirectory()) || (entry.isFile() && !destinationStat.isFile())) {
+                    throw new WorkspaceBoundaryError(`Archive entry collides with an unsafe destination: ${relativePath}`, 'ZIP_DESTINATION_COLLISION');
+                }
+            }
+            entries.push({ relativePath, sourcePath: sourceEntry, destinationPath: destinationEntry, directory: entry.isDirectory() });
+            if (entry.isDirectory())
+                walk(sourceEntry);
+        }
+    };
+    walk(sourceRoot);
+    for (const entry of entries.filter((candidate) => candidate.directory).sort((left, right) => left.relativePath.length - right.relativePath.length)) {
+        fs.mkdirSync(entry.destinationPath, { recursive: true, mode: fs.statSync(entry.sourcePath).mode & 0o777 });
+    }
+    for (const entry of entries.filter((candidate) => !candidate.directory)) {
+        const parent = path.dirname(resolveWorkspacePath(destinationRoot, entry.relativePath, { allowMissing: true }));
+        const temporary = path.join(parent, `.vigthoria-archive-${randomUUID()}.tmp`);
+        try {
+            fs.copyFileSync(entry.sourcePath, temporary, fs.constants.COPYFILE_EXCL);
+            fs.chmodSync(temporary, fs.statSync(entry.sourcePath).mode & 0o777);
+            fs.renameSync(temporary, entry.destinationPath);
+        }
+        finally {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (error) {
+                if (error?.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    validateExtractedWorkspace(destinationRoot);
+}

package/dist/utils/workspace-brain-service.d.ts

@@ -22,7 +22,9 @@ export declare class WorkspaceBrainService {
     private autoIndex;
     private brainSyncEnabled;
     private accountContextCache;
+    private unsubscribeAuthInvalidation;
     constructor(options: WorkspaceBrainOptions);
+    destroy(): void;
     getIndexer(): CodebaseIndexer;
     getStatus(): {
         workspacePath: string;

package/dist/utils/workspace-brain-service.js

@@ -4,6 +4,7 @@
 import * as path from 'path';
 import { BrainHubClient } from './brain-hub-client.js';
 import { CodebaseIndexer } from './codebase-indexer.js';
+import { subscribeAuthInvalidation } from './auth-session.js';
 export class WorkspaceBrainService {
     workspacePath;
     indexer;
@@ -11,6 +12,7 @@ export class WorkspaceBrainService {
     autoIndex;
     brainSyncEnabled;
     accountContextCache = null;
+    unsubscribeAuthInvalidation = null;
     constructor(options) {
         this.workspacePath = path.resolve(options.workspacePath);
         this.indexer = new CodebaseIndexer(this.workspacePath);
@@ -20,6 +22,14 @@ export class WorkspaceBrainService {
         });
         this.autoIndex = options.autoIndex ?? !/^(1|true|yes)$/i.test(String(process.env.VIGTHORIA_NO_AUTO_INDEX || ''));
         this.brainSyncEnabled = options.brainSyncEnabled ?? !/^(1|true|yes)$/i.test(String(process.env.VIGTHORIA_NO_BRAIN_SYNC || ''));
+        this.unsubscribeAuthInvalidation = subscribeAuthInvalidation(() => {
+            this.accountContextCache = null;
+        });
+    }
+    destroy() {
+        this.unsubscribeAuthInvalidation?.();
+        this.unsubscribeAuthInvalidation = null;
+        this.accountContextCache = null;
     }
     getIndexer() {
         return this.indexer;
@@ -110,7 +120,7 @@ export class WorkspaceBrainService {
         const summary = `Workspace "${wsName}" indexed in Vigthoria CLI: ${meta.indexedFileCount} files, ${meta.totalChunks} chunks. Key paths: ${meta.topFiles.slice(0, 6).join(', ')}`;
         await this.brainClient.syncWorkspaceIndex({
             workspaceName: wsName,
-            workspacePath: this.workspacePath,
+            workspacePath: `vigthoria://workspace/${encodeURIComponent(wsName)}`,
             fileCount: meta.indexedFileCount,
             chunkCount: meta.totalChunks,
             topFiles: meta.topFiles,