vigthoria-cli 1.13.18 → 1.13.22

package/dist/commands/music.js

@@ -1,29 +1,30 @@
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
+import { guardedFetch } from '../utils/network-policy.js';
+import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/command-contract.js';
+import { setTimeout as delay } from 'node:timers/promises';
 export class MusicCommand {
     config;
-    logger;
-    constructor(config, logger) {
+    constructor(config, _logger) {
         this.config = config;
-        this.logger = logger;
     }
     apiBase() {
         const configured = String(this.config.getAll().musicApiUrl || '').trim();
         return (process.env.VIGTHORIA_MUSIC_API_URL || configured || 'https://music.vigthoria.io').replace(/\/+$/, '');
     }
     authHeaders() {
-        const token = this.config.get('authToken');
+        const token = process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN || this.config.get('authToken');
         return token ? { Authorization: `Bearer ${token}` } : {};
     }
     async request(endpoint, init = {}) {
-        const response = await fetch(`${this.apiBase()}${endpoint}`, {
+        const response = await guardedFetch(`${this.apiBase()}${endpoint}`, {
             ...init,
             headers: {
                 ...this.authHeaders(),
                 ...init.headers,
             },
-        });
+        }, { audience: 'music' });
         const text = await response.text();
         let data = {};
         try {
@@ -58,7 +59,7 @@ export class MusicCommand {
     async generate(promptArg, options) {
         const prompt = String(promptArg || options.prompt || '').trim();
         if (!prompt) {
-            throw new Error('Music generation requires a prompt.');
+            throw new CliCommandError('Music generation requires a prompt.', { code: 'MUSIC_PROMPT_REQUIRED', category: 'usage' });
         }
         let referenceAudioPath = '';
         if (options.voice) {
@@ -88,10 +89,7 @@ export class MusicCommand {
             body: JSON.stringify(payload),
         });
         const taskId = String(data.task_id || data.session_id || '').trim();
-        if (options.json) {
-            console.log(JSON.stringify({ ...data, task_id: taskId || data.task_id }, null, 2));
-        }
-        else {
+        if (!options.json) {
             console.log(chalk.green('Music generation queued.'));
             console.log(chalk.cyan('Task ID: ') + (taskId || '(pending)'));
             if (data.queue_position)
@@ -100,13 +98,18 @@ export class MusicCommand {
                 console.log(chalk.gray(`Estimated wait: ${data.estimated_wait_seconds}s`));
         }
         if (options.wait && taskId) {
-            await this.waitForStatus(taskId, Number(options.pollInterval || 5), Boolean(options.json));
+            const terminal = await this.waitForStatus(taskId, Number(options.pollInterval || 5), options.json === true);
+            if (options.json)
+                console.log(formatSuccessJson('music generate', terminal, { stage: 'terminal' }));
+            return;
         }
+        if (options.json)
+            console.log(formatSuccessJson('music generate', { ...data, task_id: taskId || data.task_id }, { stage: 'queued' }));
     }
     async status(taskId, options = {}) {
         const data = await this.request(`/api/status/${encodeURIComponent(taskId)}`);
         if (options.json) {
-            console.log(JSON.stringify(data, null, 2));
+            console.log(formatSuccessJson('music status', data));
             return;
         }
         console.log(chalk.cyan(`Music task ${taskId}`));
@@ -117,21 +120,53 @@ export class MusicCommand {
         if (downloadUrl)
             console.log(`Download: ${downloadUrl}`);
     }
-    async waitForStatus(taskId, intervalSeconds, json) {
-        const delay = Math.max(1, intervalSeconds) * 1000;
-        for (;;) {
-            await new Promise((resolve) => setTimeout(resolve, delay));
-            const data = await this.request(`/api/status/${encodeURIComponent(taskId)}`);
-            const status = String(data.status || '').toLowerCase();
-            if (!json) {
-                const progress = data.progress !== undefined ? ` (${data.progress}%)` : '';
-                console.log(chalk.gray(`Status: ${status || 'unknown'}${progress}`));
-            }
-            if (['completed', 'complete', 'finished', 'failed', 'error', 'cancelled'].includes(status)) {
-                if (json)
-                    console.log(JSON.stringify(data, null, 2));
-                return;
+    async waitForStatus(taskId, intervalSeconds, quiet) {
+        const pollDelayMs = Math.max(1, intervalSeconds) * 1000;
+        const configuredTimeout = Number.parseInt(process.env.VIGTHORIA_MUSIC_WAIT_TIMEOUT_MS || '', 10);
+        const timeoutMs = Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : 30 * 60_000;
+        const deadline = Date.now() + timeoutMs;
+        const cancellation = new AbortController();
+        let interrupted = false;
+        const onInterrupt = () => {
+            interrupted = true;
+            cancellation.abort();
+        };
+        process.once('SIGINT', onInterrupt);
+        try {
+            for (;;) {
+                if (Date.now() >= deadline) {
+                    throw new CliCommandError(`Music generation did not finish within ${timeoutMs}ms.`, {
+                        code: 'MUSIC_WAIT_TIMEOUT', category: 'network', details: { taskId, timeoutMs },
+                    });
+                }
+                await delay(Math.min(pollDelayMs, Math.max(1, deadline - Date.now())), undefined, { signal: cancellation.signal });
+                const data = await this.request(`/api/status/${encodeURIComponent(taskId)}`, { signal: cancellation.signal });
+                const status = String(data.status || '').toLowerCase();
+                if (!quiet) {
+                    const progress = data.progress !== undefined ? ` (${data.progress}%)` : '';
+                    console.log(chalk.gray(`Status: ${status || 'unknown'}${progress}`));
+                }
+                if (['failed', 'error'].includes(status)) {
+                    throw new CliCommandError(String(data.error || data.message || 'Music generation failed.'), {
+                        code: 'MUSIC_GENERATION_FAILED', details: data,
+                    });
+                }
+                if (status === 'cancelled') {
+                    throw new CliCommandError('Music generation was cancelled.', {
+                        code: 'MUSIC_GENERATION_CANCELLED', category: 'cancelled', details: data,
+                    });
+                }
+                if (['completed', 'complete', 'finished'].includes(status))
+                    return data;
             }
         }
+        catch (error) {
+            if (interrupted)
+                throw new CliCommandError('Music wait cancelled by user.', { code: 'MUSIC_WAIT_CANCELLED', category: 'cancelled', cause: error });
+            throw commandFailure(error, { code: 'MUSIC_WAIT_FAILED' });
+        }
+        finally {
+            process.removeListener('SIGINT', onInterrupt);
+        }
     }
 }

package/dist/commands/platform-registration.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Config } from '../utils/config.js';
+import type { Logger } from '../utils/logger.js';
+export declare function registerPlatformCommands(program: Command, config: Config, logger: Logger): void;

package/dist/commands/platform-registration.js

@@ -0,0 +1,45 @@
+import { BridgeCommand } from './bridge.js';
+import { DeviceCommand } from './device.js';
+import { SecurityCommand } from './security.js';
+export function registerPlatformCommands(program, config, logger) {
+    program.command('bridge').description('Inspect local DevTools Bridge availability for browser debugging tasks')
+        .command('status').description('Show live DevTools Bridge status')
+        .action(async () => new BridgeCommand(config, logger).status());
+    const device = program.command('device').alias('adb').description('Android Developer Bridge commands via local ADB');
+    device.command('status').description('Show ADB availability and connected Android devices').option('--json', 'Emit JSON output', false)
+        .action(async (options) => new DeviceCommand(config, logger).status(options));
+    device.command('list').description('List connected Android devices').option('--json', 'Emit JSON output', false)
+        .action(async (options) => new DeviceCommand(config, logger).list(options));
+    device.command('screenshot').description('Capture a screenshot from an Android device')
+        .option('-d, --device <id>', 'ADB device id').option('-o, --output <path>', 'Output PNG path')
+        .action(async (options) => new DeviceCommand(config, logger).screenshot(options));
+    device.command('install <apk>').description('Install or update an APK on an Android device')
+        .option('-d, --device <id>', 'ADB device id').option('--json', 'Emit JSON output', false)
+        .action(async (apk, options) => new DeviceCommand(config, logger).install(apk, options));
+    device.command('launch <package>').description('Launch an Android app by package name')
+        .option('-d, --device <id>', 'ADB device id').option('-a, --activity <activity>', 'Activity class, for example .MainActivity')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (packageName, options) => new DeviceCommand(config, logger).launch(packageName, options));
+    device.command('logs').description('Read Android logcat output').option('-d, --device <id>', 'ADB device id')
+        .option('-n, --lines <count>', 'Number of log lines for snapshot mode', '250').option('-f, --follow', 'Follow logcat until interrupted', false)
+        .option('--json', 'Emit JSON output for snapshot mode', false)
+        .action(async (options) => new DeviceCommand(config, logger).logs(options));
+    device.command('tcpip').description('Enable wireless ADB tcpip mode on the selected USB-connected device')
+        .option('-d, --device <id>', 'ADB device id').option('-p, --port <port>', 'Wireless ADB port', '5555')
+        .option('--json', 'Emit JSON output', false).action(async (options) => new DeviceCommand(config, logger).tcpip(options));
+    device.command('connect <address>').description('Connect to a wireless ADB device, for example 192.168.1.30:5555')
+        .option('--json', 'Emit JSON output', false).action(async (address, options) => new DeviceCommand(config, logger).connect(address, options));
+    device.command('disconnect [address]').description('Disconnect a wireless ADB device')
+        .option('--json', 'Emit JSON output', false).action(async (address, options) => new DeviceCommand(config, logger).disconnect(address, options));
+    device.action(async () => new DeviceCommand(config, logger).status({}));
+    const security = program.command('security').alias('vsec')
+        .description('Run security scans, scores, and fix plans via Vigthoria MCP security tools');
+    security.command('scan').description('Scan project for security issues').option('-d, --dir <path>', 'Directory to scan (default: current directory)')
+        .option('--json', 'Emit JSON output', false).action(async (options) => new SecurityCommand(config, logger).scan({ dir: options.dir, json: options.json }));
+    security.command('score').description('Calculate project security score').option('-d, --dir <path>', 'Directory to score (default: current directory)')
+        .option('--json', 'Emit JSON output', false).action(async (options) => new SecurityCommand(config, logger).score({ dir: options.dir, json: options.json }));
+    security.command('fix').description('Generate security fix plan').option('-d, --dir <path>', 'Directory to inspect (default: current directory)')
+        .option('-i, --issue-id <id>', 'Single issue id to target').option('--apply', 'Request auto-apply mode (safe mode still requires explicit patching)', false)
+        .option('--json', 'Emit JSON output', false)
+        .action(async (options) => new SecurityCommand(config, logger).fix({ dir: options.dir, issueId: options.issueId, apply: options.apply, json: options.json }));
+}

package/dist/commands/preview.d.ts

@@ -21,7 +21,6 @@ interface PreviewOptions {
     screenshot?: boolean;
 }
 export declare class PreviewCommand {
-    private config;
     private logger;
     private api;
     private server;

package/dist/commands/preview.js

@@ -13,10 +13,15 @@ import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as http from 'http';
+import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { structuredPatch } from 'diff';
 import { createSpinner, CH } from '../utils/logger.js';
-import { APIClient } from '../utils/api.js';
+import { createAPIClient } from '../utils/api-client-factory.js';
+import { resolveWorkspacePath } from '../utils/workspace-boundary.js';
+import { hardenGitArguments, safeGitEnvironment } from '../utils/process-policy.js';
+import { safeChildProcessEnv } from '../utils/secret-policy.js';
+import { CliCommandError, commandFailure } from '../utils/command-contract.js';
 const require = createRequire(import.meta.url);
 // Common MIME types for static file serving
 const MIME_TYPES = {
@@ -47,21 +52,20 @@ const MIME_TYPES = {
     '.map': 'application/json',
 };
 export class PreviewCommand {
-    config;
     logger;
     api;
     server = null;
     constructor(config, logger) {
-        this.config = config;
         this.logger = logger;
-        this.api = new APIClient(config, logger);
+        this.api = createAPIClient(config, logger);
     }
     async run(options) {
         const projectPath = path.resolve(options.project || process.cwd());
         if (!fs.existsSync(projectPath) || !fs.statSync(projectPath).isDirectory()) {
-            this.logger.error(`Project directory not found: ${projectPath}`);
             this.api.destroy();
-            return;
+            throw new CliCommandError(`Project directory not found: ${projectPath}`, {
+                code: 'PROJECT_DIRECTORY_NOT_FOUND', category: 'usage',
+            });
         }
         console.log();
         console.log(chalk.bold.white(`  ${CH.hLine.repeat(3)} Vigthoria Preview ${CH.hLine.repeat(40)}`));
@@ -88,7 +92,9 @@ export class PreviewCommand {
             this.logger.warn('No HTML entry file found. Use --entry <file> to specify one.');
             if (!options.diff && !options.proof) {
                 this.api.destroy();
-                return;
+                throw new CliCommandError('No HTML entry file found. Use --entry <file> to specify one.', {
+                    code: 'PREVIEW_ENTRY_NOT_FOUND', category: 'configuration',
+                });
             }
             this.api.destroy();
             return;
@@ -102,9 +108,15 @@ export class PreviewCommand {
      */
     detectEntryFile(projectPath, specified) {
         if (specified) {
-            const fullPath = path.join(projectPath, specified);
-            if (fs.existsSync(fullPath))
-                return specified;
+            try {
+                const fullPath = resolveWorkspacePath(projectPath, specified);
+                if (fs.statSync(fullPath).isFile())
+                    return specified.replace(/\\/g, '/');
+            }
+            catch {
+                this.logger.warn(`Refused entry file outside project boundary: ${specified}`);
+                return null;
+            }
             this.logger.warn(`Specified entry file not found: ${specified}`);
             return null;
         }
@@ -152,28 +164,35 @@ export class PreviewCommand {
     async startServer(projectPath, entryFile, port, autoOpen) {
         return new Promise((resolve) => {
             this.server = http.createServer((req, res) => {
-                // Sanitize URL to prevent path traversal
-                const urlPath = decodeURIComponent(new URL(req.url || '/', `http://localhost:${port}`).pathname);
-                const safePath = path.normalize(urlPath).replace(/^(\.\.[/\\])+/, '');
-                let filePath = path.join(projectPath, safePath);
-                // Ensure the resolved path is within the project directory
-                const resolvedPath = path.resolve(filePath);
-                if (!resolvedPath.startsWith(path.resolve(projectPath))) {
+                let filePath;
+                try {
+                    const urlPath = decodeURIComponent(new URL(req.url || '/', `http://localhost:${port}`).pathname);
+                    const relativeRequest = urlPath.replace(/^\/+/, '') || entryFile;
+                    filePath = resolveWorkspacePath(projectPath, relativeRequest, { allowMissing: true });
+                }
+                catch {
                     res.writeHead(403);
                     res.end('Forbidden');
                     return;
                 }
                 // Directory → serve index.html
                 if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
-                    filePath = path.join(filePath, 'index.html');
+                    try {
+                        filePath = resolveWorkspacePath(projectPath, `${path.relative(projectPath, filePath).replace(/\\/g, '/')}/index.html`, { allowMissing: true });
+                    }
+                    catch {
+                        res.writeHead(403);
+                        res.end('Forbidden');
+                        return;
+                    }
                 }
                 // SPA fallback
                 if (!fs.existsSync(filePath)) {
-                    const spaFallback = path.join(projectPath, entryFile);
-                    if (fs.existsSync(spaFallback)) {
+                    try {
+                        const spaFallback = resolveWorkspacePath(projectPath, entryFile);
                         filePath = spaFallback;
                     }
-                    else {
+                    catch {
                         res.writeHead(404);
                         res.end('Not found');
                         return;
@@ -225,20 +244,21 @@ export class PreviewCommand {
             if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')
                 return;
             const safeUrl = parsed.href;
+            const options = { env: safeChildProcessEnv(), windowsHide: true, timeout: 10_000 };
             if (platform === 'darwin') {
-                execFile('open', [safeUrl], (err) => {
+                execFile('open', [safeUrl], options, (err) => {
                     if (err)
                         this.logger.debug(`Could not auto-open browser: ${err.message}`);
                 });
             }
             else if (platform === 'win32') {
-                execFile('cmd', ['/c', 'start', '', safeUrl], (err) => {
+                execFile('rundll32.exe', ['url.dll,FileProtocolHandler', safeUrl], options, (err) => {
                     if (err)
                         this.logger.debug(`Could not auto-open browser: ${err.message}`);
                 });
             }
             else {
-                execFile('xdg-open', [safeUrl], (err) => {
+                execFile('xdg-open', [safeUrl], options, (err) => {
                     if (err)
                         this.logger.debug(`Could not auto-open browser: ${err.message}`);
                 });
@@ -254,15 +274,20 @@ export class PreviewCommand {
     async showConsolidatedDiff(projectPath) {
         console.log(chalk.bold.white(`  ${CH.hLine.repeat(3)} Change Summary ${CH.hLine.repeat(43)}`));
         console.log();
-        const proofDir = path.join(projectPath, '.vigthoria', 'proof', 'preview');
+        const proofDir = resolveWorkspacePath(projectPath, '.vigthoria/proof/preview', { allowMissing: true });
         const hasProof = fs.existsSync(proofDir);
         // Try git diff first (most reliable)
         try {
-            const { execSync } = require('child_process');
             const isGit = fs.existsSync(path.join(projectPath, '.git'));
             if (isGit) {
                 // Get list of changed files (unstaged + staged)
-                const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                const statusOutput = execFileSync('git', hardenGitArguments(['status', '--porcelain']), {
+                    cwd: projectPath,
+                    encoding: 'utf8',
+                    windowsHide: true,
+                    timeout: 30_000,
+                    env: safeChildProcessEnv(safeGitEnvironment()),
+                }).trim();
                 if (!statusOutput) {
                     console.log(chalk.gray('  No changes detected (working tree clean).'));
                     console.log();
@@ -295,9 +320,13 @@ export class PreviewCommand {
                 // Show unified diffs for modified and created files (limit to keep terminal manageable)
                 const diffTargets = [...modified, ...created].slice(0, 20);
                 for (const relPath of diffTargets) {
-                    const absPath = path.join(projectPath, relPath);
-                    if (!fs.existsSync(absPath))
+                    let absPath;
+                    try {
+                        absPath = resolveWorkspacePath(projectPath, relPath);
+                    }
+                    catch {
                         continue;
+                    }
                     const ext = path.extname(relPath).toLowerCase();
                     const textExts = ['.html', '.css', '.js', '.ts', '.jsx', '.tsx', '.json', '.md', '.yml', '.yaml', '.txt', '.xml', '.svg', '.py', '.sh', '.env'];
                     if (!textExts.includes(ext))
@@ -309,7 +338,13 @@ export class PreviewCommand {
                             try {
                                 // Validate relPath is a safe relative path before interpolating — prevents injection
                                 if (/^[a-zA-Z0-9_\-./]+$/.test(relPath) && !relPath.includes('..')) {
-                                    oldContent = execSync(`git show HEAD:${relPath}`, { cwd: projectPath, encoding: 'utf-8' });
+                                    oldContent = execFileSync('git', hardenGitArguments(['show', `HEAD:${relPath}`]), {
+                                        cwd: projectPath,
+                                        encoding: 'utf8',
+                                        windowsHide: true,
+                                        timeout: 30_000,
+                                        env: safeChildProcessEnv(safeGitEnvironment()),
+                                    });
                                 }
                             }
                             catch {
@@ -363,7 +398,8 @@ export class PreviewCommand {
                 console.log(chalk.white('  Recent proof bundles:'));
                 for (const m of manifests) {
                     try {
-                        const manifest = JSON.parse(fs.readFileSync(path.join(proofDir, m), 'utf-8'));
+                        const manifestPath = resolveWorkspacePath(projectPath, `.vigthoria/proof/preview/${m}`);
+                        const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
                         const passed = manifest.previewGate?.passed ? chalk.green('passed') : chalk.red('failed');
                         console.log(chalk.gray(`    ${manifest.createdAt || m}  `) + passed + chalk.gray(`  ${manifest.entryPath || '-'}`));
                     }
@@ -390,14 +426,17 @@ export class PreviewCommand {
                 workspacePath: projectPath,
                 projectPath: projectPath,
                 targetPath: projectPath,
+                forceFrontendPreview: true,
+                requireScreenshot: captureScreenshot === true,
             });
             spinner.stop();
             console.log(chalk.bold.white(`  ${CH.hLine.repeat(3)} Preview Proof Gate ${CH.hLine.repeat(39)}`));
             console.log();
             if (!result.required) {
-                console.log(chalk.gray('  Preview gate: not required (no frontend artifacts detected)'));
-                console.log();
-                return;
+                throw new CliCommandError('Preview proof was explicitly requested, but the proof service did not require or validate it.', {
+                    code: 'PREVIEW_PROOF_SKIPPED',
+                    details: result,
+                });
             }
             const statusIcon = result.passed ? chalk.green(CH.success) : chalk.red(CH.error);
             console.log(`  ${statusIcon} Preview gate: ${result.passed ? chalk.green('PASSED') : chalk.red('FAILED')}`);
@@ -458,10 +497,18 @@ export class PreviewCommand {
                 }
             }
             console.log();
+            if (!result.passed || result.skipped === true) {
+                throw new CliCommandError(result.error || 'Preview proof did not pass.', {
+                    code: 'PREVIEW_PROOF_FAILED',
+                    category: result.partialMutation === false ? 'execution' : 'partial_mutation',
+                    partialMutation: result.partialMutation ?? false,
+                    details: result,
+                });
+            }
         }
         catch (error) {
             spinner.stop();
-            this.logger.error(`Preview proof gate failed: ${error?.message || String(error)}`);
+            throw commandFailure(error, { code: 'PREVIEW_PROOF_FAILED' });
         }
     }
 }

package/dist/commands/product-run-registration.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Config } from '../utils/config.js';
+import type { Logger } from '../utils/logger.js';
+export declare function registerProductAndRunCommands(program: Command, config: Config, logger: Logger): void;