vigthoria-cli 1.13.20 → 1.13.22

package/dist/commands/review.js

@@ -5,8 +5,9 @@ import chalk from 'chalk';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
 import { createSpinner, CH } from '../utils/logger.js';
-import { APIClient, CLIError, classifyError, formatCLIError } from '../utils/api.js';
+import { createAPIClient } from '../utils/api-client-factory.js';
 import { FileUtils } from '../utils/files.js';
+import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/command-contract.js';
 export class ReviewCommand {
     config;
     logger;
@@ -16,7 +17,7 @@ export class ReviewCommand {
     constructor(config, logger) {
         this.config = config;
         this.logger = logger;
-        this.api = new APIClient(config, logger);
+        this.api = createAPIClient(config, logger);
         this.fileUtils = new FileUtils(process.cwd(), config.get('project').ignorePatterns);
         this.marked = new Marked();
         this.marked.use(markedTerminal({
@@ -29,20 +30,17 @@ export class ReviewCommand {
     async run(filePath, options) {
         // Check auth
         if (!this.config.isAuthenticated()) {
-            this.logger.error('Not authenticated. Run: vigthoria login');
-            return;
+            throw new CliCommandError('Not authenticated. Run: vigthoria login', { code: 'AUTH_REQUIRED', category: 'authentication' });
         }
         // Server-side token validation — fail fast instead of waiting for 401
         const tokenCheck = await this.api.validateToken();
         if (!tokenCheck.valid) {
-            this.logger.error(tokenCheck.error || 'Auth token is invalid. Run: vigthoria login');
-            return;
+            throw new CliCommandError(tokenCheck.error || 'Auth token is invalid. Run: vigthoria login', { code: 'AUTH_SESSION_INVALID', category: 'authentication' });
         }
         // Read file
         const file = this.fileUtils.readFile(filePath);
         if (!file) {
-            this.logger.error(`File not found: ${filePath}`);
-            return;
+            throw new CliCommandError(`File not found: ${filePath}`, { code: 'FILE_NOT_FOUND', category: 'configuration' });
         }
         this.logger.section(`Reviewing: ${file.relativePath}`);
         console.log(chalk.gray(`Language: ${file.language} | Lines: ${file.lines}`));
@@ -57,7 +55,7 @@ export class ReviewCommand {
             // Format output
             switch (options.format) {
                 case 'json':
-                    console.log(JSON.stringify(review, null, 2));
+                    console.log(formatSuccessJson('review', review));
                     break;
                 case 'markdown':
                     this.printMarkdownReview(review, file.relativePath);
@@ -70,8 +68,7 @@ export class ReviewCommand {
         }
         catch (error) {
             spinner.stop();
-            const cliErr = error instanceof CLIError ? error : classifyError(error);
-            this.logger.error(formatCLIError(cliErr));
+            throw commandFailure(error, { code: 'REVIEW_FAILED' });
         }
     }
     printTextReview(review) {
@@ -84,7 +81,7 @@ export class ReviewCommand {
         // Issues
         if (review.issues.length > 0) {
             this.logger.section(`Issues (${review.issues.length})`);
-            review.issues.forEach((issue, i) => {
+            review.issues.forEach((issue) => {
                 const severityIcon = this.getSeverityIcon(issue.severity);
                 const severityColor = this.getSeverityColor(issue.severity);
                 console.log(severityColor(`${severityIcon} [${issue.type}]`) +

package/dist/commands/security.d.ts

@@ -7,9 +7,8 @@ interface SecurityOptions {
     apply?: boolean;
 }
 export declare class SecurityCommand {
-    private config;
     private logger;
-    constructor(config: Config, logger: Logger);
+    constructor(_config: Config, logger: Logger);
     private getMcpBaseUrl;
     private resolveDir;
     private execute;

package/dist/commands/security.js

@@ -1,11 +1,12 @@
 import axios from 'axios';
 import path from 'path';
+import { assertTrustedEndpoint, installAxiosNetworkPolicy } from '../utils/network-policy.js';
+import { formatSuccessJson } from '../utils/command-contract.js';
 export class SecurityCommand {
-    config;
     logger;
-    constructor(config, logger) {
-        this.config = config;
+    constructor(_config, logger) {
         this.logger = logger;
+        installAxiosNetworkPolicy(axios, 'mcp');
     }
     getMcpBaseUrl() {
         const fromEnv = process.env.VIGTHORIA_MCP_URL || process.env.MCP_SERVER_URL;
@@ -19,6 +20,11 @@ export class SecurityCommand {
     }
     async execute(tool, parameters) {
         const baseUrl = this.getMcpBaseUrl();
+        const endpoint = assertTrustedEndpoint(baseUrl, { audience: 'mcp' });
+        const loopback = ['localhost', '127.0.0.1', '::1'].includes(endpoint.hostname.toLowerCase());
+        if (!loopback && typeof parameters.dir === 'string' && path.isAbsolute(parameters.dir)) {
+            throw new Error('Remote MCP security execution requires an uploaded workspace binding; refusing to send a local absolute path.');
+        }
         const response = await axios.post(`${baseUrl}/mcp/execute`, {
             tool,
             parameters,
@@ -41,7 +47,7 @@ export class SecurityCommand {
         const dir = this.resolveDir(options.dir);
         const result = await this.execute('security_scan', { dir });
         if (options.json) {
-            console.log(JSON.stringify(result, null, 2));
+            console.log(formatSuccessJson('security scan', result));
             return;
         }
         this.logger.info(`Security scan complete for: ${dir}`);
@@ -60,7 +66,7 @@ export class SecurityCommand {
         const dir = this.resolveDir(options.dir);
         const result = await this.execute('security_score', { dir });
         if (options.json) {
-            console.log(JSON.stringify(result, null, 2));
+            console.log(formatSuccessJson('security score', result));
             return;
         }
         this.logger.info(`Security score for ${dir}`);
@@ -75,7 +81,7 @@ export class SecurityCommand {
             confirm: Boolean(options.apply),
         });
         if (options.json) {
-            console.log(JSON.stringify(result, null, 2));
+            console.log(formatSuccessJson('security fix', result));
             return;
         }
         this.logger.info(`Security fix plan for ${dir}`);

package/dist/commands/update-registration.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function checkForUpdatesQuietly(version: string): Promise<void>;
+export declare function registerUpdateCommand(program: Command, version: string): void;

package/dist/commands/update-registration.js

@@ -0,0 +1,338 @@
+import { createHash } from 'node:crypto';
+import { execFileSync as execFileSyncProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import axios from 'axios';
+import chalk from 'chalk';
+import { CH } from '../utils/logger.js';
+import { isOfflineMode, isUpdateCheckSuppressed, readCachedLatestVersion, writeCachedLatestVersion } from '../utils/cli-state.js';
+import { guardedFetch } from '../utils/network-policy.js';
+import { safeChildProcessEnv } from '../utils/secret-policy.js';
+import { CliCommandError, commandFailure } from '../utils/command-contract.js';
+import { compareSemanticVersions as compareVersions, resolveUpdateSource } from '../utils/update-policy.js';
+import { assertReleaseTransition, assertReleaseUrl, getReleasePolicy, parseReleaseManifestText, verifyReleaseSignature } from '../utils/release-policy.js';
+import { installReleaseTransaction } from '../utils/release-install.js';
+function maxVersion(...versions) {
+    let best = null;
+    for (const version of versions) {
+        if (!version)
+            continue;
+        if (!best || compareVersions(version, best) > 0)
+            best = version;
+    }
+    return best;
+}
+async function fetchNpmLatestVersion() {
+    try {
+        // Hard 5s timeout: a slow/blocked path to the public npm registry must
+        // never hang the caller (e.g. the Workbench's blocking `vigthoria update`
+        // invocation) indefinitely.
+        const latest = execFileSyncProcess(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['view', 'vigthoria-cli', 'version'], {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+            timeout: 5000,
+            env: safeChildProcessEnv(),
+        }).trim();
+        return latest || null;
+    }
+    catch {
+        return null;
+    }
+}
+const VIGTHORIA_DEFAULT_MANIFEST_URL = getReleasePolicy().origins.manifest;
+async function downloadFile(url, targetPath, explicitLocal = false) {
+    let bytes;
+    if (explicitLocal) {
+        const response = await axios.get(url, {
+            responseType: 'arraybuffer',
+            timeout: 20000,
+            maxRedirects: 0,
+            validateStatus: (status) => status >= 200 && status < 300,
+        });
+        bytes = Buffer.from(response.data);
+    }
+    else {
+        const response = await guardedFetch(url, {}, { audience: 'release' });
+        if (!response.ok)
+            throw new Error(`Release download returned HTTP ${response.status}`);
+        bytes = Buffer.from(await response.arrayBuffer());
+    }
+    fs.writeFileSync(targetPath, bytes, { mode: 0o600, flag: 'wx' });
+}
+function sha256File(filePath) {
+    const hash = createHash('sha256');
+    const data = fs.readFileSync(filePath);
+    hash.update(data);
+    return hash.digest('hex');
+}
+function inspectReleaseArchive(archivePath) {
+    const output = execFileSyncProcess('tar', ['-xOf', archivePath, 'package/package.json'], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        timeout: 15_000,
+        env: safeChildProcessEnv(),
+        maxBuffer: 1024 * 1024,
+    });
+    const manifest = JSON.parse(output);
+    return { name: String(manifest.name || ''), version: String(manifest.version || '') };
+}
+function renderUpdateBanner(latestVersion, version) {
+    if (compareVersions(latestVersion, '1.4.0') >= 0 && compareVersions(version, '1.4.0') < 0) {
+        console.log(chalk.red.bold(`\n${CH.warnEmoji}  SECURITY UPDATE AVAILABLE`));
+        console.log(chalk.red(`   Version ${version} has security vulnerabilities.`));
+        console.log(chalk.yellow(`   Please update to ${latestVersion} immediately:`));
+        console.log(chalk.white.bold('   npm install -g vigthoria-cli@latest\n'));
+    }
+    else {
+        console.log(chalk.yellow(`\n${CH.warnEmoji}  Update available: ${version} -> ${latestVersion}`));
+        console.log(chalk.gray('   Run `vigthoria update` to install\n'));
+    }
+}
+// Check for updates quietly on startup. Cached (24 h) so we never block
+// startup on `npm view`. Honours VIGTHORIA_OFFLINE / VIGTHORIA_NO_UPDATE_CHECK.
+export async function checkForUpdatesQuietly(version) {
+    if (isUpdateCheckSuppressed()) {
+        return;
+    }
+    const cached = readCachedLatestVersion();
+    if (cached) {
+        if (compareVersions(cached, version) > 0) {
+            renderUpdateBanner(cached, version);
+        }
+        return;
+    }
+    // Cache miss: probe npm registry in the background, with a hard 5 s
+    // timeout. Result is cached for 24 h so subsequent runs are instant.
+    try {
+        const npmVersion = execFileSyncProcess(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['view', 'vigthoria-cli', 'version'], {
+            encoding: 'utf8',
+            timeout: 5000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+            env: safeChildProcessEnv(),
+        }).trim();
+        if (!npmVersion) {
+            return;
+        }
+        writeCachedLatestVersion(npmVersion);
+        if (compareVersions(npmVersion, version) > 0) {
+            renderUpdateBanner(npmVersion, version);
+        }
+    }
+    catch {
+        // Network or npm failure should never block CLI; do not cache failure.
+    }
+}
+export function registerUpdateCommand(program, version) {
+    // Update command - Check for and install updates
+    program
+        .command('update')
+        .alias('upgrade')
+        .description('Check for updates and upgrade Vigthoria CLI. Default manifest: https://extension.vigthoria.io/downloads/manifest.json')
+        .option('-c, --check', 'Only check for updates, don\'t install')
+        .option('-f, --from <target>', 'Install from exact vigthoria-cli@version, local .tgz, or trusted HTTPS .tgz')
+        .option('--sha256 <hex>', 'Required SHA-256 for HTTPS archives; optional verification for local archives')
+        .option('-m, --manifest <url>', 'Update manifest URL for server-driven releases')
+        .option('--channel <name>', 'Release channel to use from manifest (default: stable)', 'stable')
+        .option('--allow-downgrade', 'Allow installing an older version from custom update source')
+        .action(async (options) => {
+        const updateTarget = typeof options.from === 'string' ? options.from.trim() : '';
+        const manifestUrl = typeof options.manifest === 'string' ? options.manifest.trim() : VIGTHORIA_DEFAULT_MANIFEST_URL.trim();
+        const channel = typeof options.channel === 'string' ? options.channel.trim() : 'stable';
+        const allowDowngrade = !!options.allowDowngrade;
+        if (updateTarget) {
+            const source = resolveUpdateSource(updateTarget, { sha256: options.sha256 });
+            try {
+                if (options.check) {
+                    console.log(chalk.cyan(`Update source validated (${source.kind}): ${updateTarget}`));
+                    console.log(chalk.gray('Run `vigthoria update --from <target>` to install from this source'));
+                    return;
+                }
+                console.log(chalk.cyan(`Installing update from ${updateTarget}...`));
+                let installTarget = source.kind === 'remote' ? '' : source.installTarget;
+                let updateTempDirectory = null;
+                try {
+                    if (source.kind === 'remote') {
+                        updateTempDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'vigthoria-update-'));
+                        installTarget = path.join(updateTempDirectory, 'candidate.tgz');
+                        await downloadFile(source.downloadUrl, installTarget);
+                    }
+                    if (source.expectedSha256) {
+                        const actual = sha256File(installTarget).toLowerCase();
+                        if (actual !== source.expectedSha256) {
+                            throw new CliCommandError('Update archive checksum verification failed.', {
+                                code: 'UPDATE_CHECKSUM_MISMATCH',
+                                details: { expected: source.expectedSha256, actual },
+                            });
+                        }
+                    }
+                    const identity = source.kind === 'registry'
+                        ? { name: getReleasePolicy().packageName, version: installTarget.slice(installTarget.lastIndexOf('@') + 1) }
+                        : inspectReleaseArchive(installTarget);
+                    if (identity.name !== getReleasePolicy().packageName) {
+                        throw new CliCommandError('Update archive package identity is not vigthoria-cli.', { code: 'UPDATE_PACKAGE_IDENTITY_INVALID' });
+                    }
+                    if (!allowDowngrade && compareVersions(identity.version, version) < 0) {
+                        throw new CliCommandError(`Downgrade from ${version} to ${identity.version} requires --allow-downgrade.`, { code: 'UPDATE_DOWNGRADE_PROHIBITED' });
+                    }
+                    const installed = installReleaseTransaction(installTarget, identity.version, {
+                        ...(source.kind === 'registry' ? { npmRegistry: 'https://registry.npmjs.org/' } : {}),
+                    });
+                    console.log(chalk.gray(`Versioned installation: ${installed.versionDirectory}`));
+                    console.log(chalk.gray(`Active pointer: ${installed.currentLink}`));
+                }
+                finally {
+                    if (updateTempDirectory)
+                        fs.rmSync(updateTempDirectory, { recursive: true, force: true });
+                }
+                console.log(chalk.green('Update installed successfully'));
+                console.log(chalk.gray('Please restart the CLI to use the new version'));
+                return;
+            }
+            catch (error) {
+                throw commandFailure(error, {
+                    code: 'UPDATE_INSTALL_FAILED',
+                    message: `Failed to install the validated ${source.kind} update source.`,
+                });
+            }
+        }
+        if (isOfflineMode()) {
+            console.log(chalk.yellow('Offline mode (VIGTHORIA_OFFLINE=1): skipping update check.'));
+            return;
+        }
+        const currentVersion = version;
+        let manifestEntry = null;
+        if (manifestUrl) {
+            try {
+                assertReleaseUrl(manifestUrl, 'manifest');
+                console.log(chalk.cyan(`Checking manifest channel ${channel}...`));
+                const response = await guardedFetch(manifestUrl, {
+                    headers: { Accept: 'application/json' },
+                }, { audience: 'release', maxRedirects: getReleasePolicy().origins.maximumRedirects });
+                if (!response.ok)
+                    throw new Error(`Manifest returned HTTP ${response.status}`);
+                const manifestText = await response.text();
+                manifestEntry = parseReleaseManifestText(manifestText, channel);
+                const signatureResponse = await guardedFetch(manifestEntry.signature.url, {
+                    headers: { Accept: 'application/octet-stream' },
+                }, { audience: 'release', maxRedirects: getReleasePolicy().origins.maximumRedirects });
+                if (!signatureResponse.ok)
+                    throw new Error(`Detached signature returned HTTP ${signatureResponse.status}`);
+                verifyReleaseSignature(channel, manifestEntry, await signatureResponse.text());
+                assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
+            }
+            catch (error) {
+                if (error instanceof CliCommandError)
+                    throw error;
+                console.log(chalk.yellow(`Manifest check failed: ${error.message}`));
+                console.log(chalk.gray('Continuing with the exact-version npm registry fallback...'));
+            }
+        }
+        // The release manifest (server-curated, sha256-verified) is the
+        // authoritative source of truth for this private CLI. Only fall back
+        // to probing the public npm registry when the manifest itself has no
+        // usable entry - never let an npm version number override a valid,
+        // verified manifest entry (npm install -g against the public registry
+        // is slower, unverified, and has previously caused the Workbench's
+        // update button to hang for minutes).
+        let npmVersion = null;
+        if (manifestEntry?.version && manifestEntry?.url) {
+            console.log(chalk.gray('Release manifest has a valid entry; skipping public npm registry lookup.'));
+        }
+        else {
+            console.log(chalk.cyan('Checking npm registry...'));
+            npmVersion = await fetchNpmLatestVersion();
+            if (!npmVersion) {
+                console.log(chalk.yellow('Could not read latest version from npm registry.'));
+            }
+        }
+        const effectiveLatest = maxVersion(manifestEntry?.version, npmVersion);
+        if (!effectiveLatest) {
+            throw new CliCommandError('Unable to determine the latest CLI version from manifest or npm.', {
+                code: 'UPDATE_VERSION_UNAVAILABLE',
+                category: 'network',
+            });
+        }
+        if (!allowDowngrade && compareVersions(effectiveLatest, currentVersion) <= 0) {
+            console.log(chalk.green(`You are running the latest version (${currentVersion})`));
+            return;
+        }
+        console.log(chalk.yellow(`Update available: ${currentVersion} -> ${effectiveLatest}`));
+        if (manifestEntry?.notes && compareVersions(manifestEntry.version, effectiveLatest) >= 0) {
+            console.log(chalk.gray(`   ${manifestEntry.notes}`));
+        }
+        if (options.check) {
+            console.log(chalk.gray('Run `vigthoria update` to install the update'));
+            return;
+        }
+        const manifestIsAuthoritative = Boolean(manifestEntry
+            && manifestEntry.url
+            && compareVersions(manifestEntry.version, effectiveLatest) >= 0
+            && compareVersions(manifestEntry.version, currentVersion) > 0);
+        if (manifestIsAuthoritative && manifestEntry) {
+            const updateTempDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'vigthoria-update-'));
+            const tmpFile = path.join(updateTempDirectory, 'candidate.tgz');
+            try {
+                console.log(chalk.cyan(`Downloading release package (${manifestEntry.version})...`));
+                await downloadFile(manifestEntry.url, tmpFile);
+                const expected = String(manifestEntry.sha256).toLowerCase();
+                const actual = sha256File(tmpFile).toLowerCase();
+                if (actual !== expected) {
+                    throw new CliCommandError('Release checksum verification failed.', {
+                        code: 'UPDATE_CHECKSUM_MISMATCH',
+                        details: { expected, actual },
+                    });
+                }
+                if (fs.statSync(tmpFile).size !== manifestEntry.size) {
+                    throw new CliCommandError('Release archive size does not match signed manifest metadata.', {
+                        code: 'UPDATE_SIZE_MISMATCH',
+                    });
+                }
+                console.log(chalk.green('Checksum verification passed'));
+                console.log(chalk.cyan('Installing update...'));
+                const identity = inspectReleaseArchive(tmpFile);
+                if (identity.name !== manifestEntry.packageName || identity.version !== manifestEntry.packageVersion) {
+                    throw new CliCommandError('Release archive package metadata conflicts with signed manifest identity.', {
+                        code: 'UPDATE_PACKAGE_IDENTITY_INVALID',
+                    });
+                }
+                const installed = installReleaseTransaction(tmpFile, manifestEntry.version);
+                console.log(chalk.gray(`Versioned installation: ${installed.versionDirectory}`));
+                console.log(chalk.green(`Updated to version ${manifestEntry.version}`));
+                console.log(chalk.gray('Please restart the CLI to use the new version'));
+                return;
+            }
+            finally {
+                fs.rmSync(updateTempDirectory, { recursive: true, force: true });
+            }
+        }
+        const npmSpec = npmVersion && compareVersions(npmVersion, currentVersion) > 0
+            ? `vigthoria-cli@${npmVersion}`
+            : `vigthoria-cli@${effectiveLatest}`;
+        try {
+            const registrySource = resolveUpdateSource(npmSpec);
+            if (registrySource.kind !== 'registry') {
+                throw new CliCommandError('Registry fallback did not resolve to an exact package version.', {
+                    code: 'UPDATE_REGISTRY_SOURCE_INVALID',
+                    category: 'configuration',
+                });
+            }
+            console.log(chalk.cyan(`Installing update from npm registry (${npmSpec})...`));
+            const installed = installReleaseTransaction(registrySource.installTarget, effectiveLatest, {
+                npmRegistry: 'https://registry.npmjs.org/',
+            });
+            console.log(chalk.gray(`Versioned installation: ${installed.versionDirectory}`));
+            console.log(chalk.green(`Updated to version ${effectiveLatest}`));
+            console.log(chalk.gray('Please restart the CLI to use the new version'));
+        }
+        catch (error) {
+            throw commandFailure(error, {
+                code: 'UPDATE_REGISTRY_INSTALL_FAILED',
+                message: `Failed to install the exact registry package ${npmSpec}.`,
+            });
+        }
+    });
+}

package/dist/commands/v4-registration.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Config } from '../utils/config.js';
+import type { Logger } from '../utils/logger.js';
+export declare function registerV4Commands(program: Command, config: Config, logger: Logger): void;

package/dist/commands/v4-registration.js

@@ -0,0 +1,24 @@
+import { V4Command } from './v4.js';
+import { runV4Menu } from './v4-menu.js';
+export function registerV4Commands(program, config, logger) {
+    new V4Command(config, logger).register(program);
+    program
+        .command('v4-menu')
+        .description('Internal: interactive V3/V4 agent + provider picker used by the V4 Operating Agent launcher')
+        .option('--default-agent <agent>', 'v3 | v4', 'v3')
+        .option('--default-provider <provider>', 'cloud | v3_local | byok', 'cloud')
+        .option('--byok-api-key <key>', 'Existing BYOK api key', '')
+        .option('--byok-base-url <url>', 'Existing BYOK base url', '')
+        .option('--byok-model <name>', 'Existing BYOK model', '')
+        .requiredOption('--out-file <path>', 'Write JSON selection result to this file')
+        .action(async (options) => {
+        await runV4Menu({
+            defaultAgent: options.defaultAgent,
+            defaultProvider: options.defaultProvider,
+            byokApiKey: options.byokApiKey,
+            byokBaseUrl: options.byokBaseUrl,
+            byokModel: options.byokModel,
+            outFile: options.outFile,
+        });
+    });
+}

package/dist/commands/v4.d.ts

@@ -18,9 +18,9 @@ type V4Options = {
     nonInteractive?: boolean;
     python?: string;
     v4Path?: string;
+    timeoutMs?: string | number;
 };
 export declare class V4Command {
-    private readonly _config;
     private readonly logger;
     constructor(_config: Config, logger: Logger);
     register(program: Command): void;

package/dist/commands/v4.js

@@ -2,6 +2,8 @@ import { spawn } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
+import { safeChildProcessEnv } from '../utils/secret-policy.js';
+import { CliCommandError } from '../utils/command-contract.js';
 const DEFAULT_V4_AGENT_DIR_UNIX = '/var/www/V4-Operating-Agent';
 export function defaultV4PythonBin() {
     return process.env.VIGTHORIA_V4_PYTHON || (process.platform === 'win32' ? 'python' : 'python3');
@@ -20,10 +22,8 @@ export function defaultV4AgentDir() {
     return undefined;
 }
 export class V4Command {
-    _config;
     logger;
     constructor(_config, logger) {
-        this._config = _config;
         this.logger = logger;
     }
     register(program) {
@@ -45,6 +45,7 @@ export class V4Command {
             .option('--non-interactive', 'Disable interactive menu and use CLI options', false)
             .option('--python <bin>', 'Python binary to use', defaultV4PythonBin())
             .option('--v4-path <path>', 'V4 agent root path (or set VIGTHORIA_V4_AGENT_DIR)', defaultV4AgentDir())
+            .option('--timeout-ms <ms>', 'Maximum V4 process runtime in milliseconds', process.env.VIGTHORIA_V4_TIMEOUT_MS || '1800000')
             .action(async (options) => {
             await this.run(options);
         });
@@ -98,17 +99,54 @@ export class V4Command {
             args.push('--session-id', String(options.sessionId));
         }
         this.logger.info(chalk.cyan(`Launching V4 Operating Agent from ${v4Path}`));
+        const requestedTimeout = Number(options.timeoutMs ?? process.env.VIGTHORIA_V4_TIMEOUT_MS ?? 1_800_000);
+        if (!Number.isFinite(requestedTimeout) || requestedTimeout < 1_000 || requestedTimeout > 86_400_000) {
+            throw new CliCommandError('V4 timeout must be between 1000 and 86400000 milliseconds.', {
+                code: 'V4_TIMEOUT_INVALID',
+                category: 'usage',
+            });
+        }
+        const timeoutMs = Math.floor(requestedTimeout);
         const child = spawn(pythonBin, args, {
             cwd: v4Path,
             stdio: 'inherit',
-            env: {
-                ...process.env,
-                PYTHONUNBUFFERED: '1',
-            },
+            env: safeChildProcessEnv(process.env, { PYTHONUNBUFFERED: '1' }),
         });
         const exitCode = await new Promise((resolve, reject) => {
-            child.on('error', reject);
-            child.on('close', (code) => resolve(code ?? 1));
+            let interrupted = false;
+            let timedOut = false;
+            let forceKillTimer;
+            const onInterrupt = () => {
+                interrupted = true;
+                child.kill('SIGINT');
+            };
+            process.once('SIGINT', onInterrupt);
+            const timeout = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGTERM');
+                forceKillTimer = setTimeout(() => child.kill('SIGKILL'), 5_000);
+                forceKillTimer.unref();
+            }, timeoutMs);
+            timeout.unref();
+            const finish = () => {
+                clearTimeout(timeout);
+                if (forceKillTimer)
+                    clearTimeout(forceKillTimer);
+                process.removeListener('SIGINT', onInterrupt);
+            };
+            child.on('error', (error) => {
+                finish();
+                reject(error);
+            });
+            child.on('close', (code) => {
+                finish();
+                if (interrupted)
+                    reject(new CliCommandError('V4 agent cancelled by user.', { code: 'V4_CANCELLED', category: 'cancelled' }));
+                else if (timedOut)
+                    reject(new CliCommandError(`V4 agent timed out after ${timeoutMs}ms.`, { code: 'V4_TIMEOUT', category: 'execution' }));
+                else
+                    resolve(code ?? 1);
+            });
         });
         if (exitCode !== 0) {
             throw new Error(`V4 agent exited with status ${exitCode}`);

package/dist/commands/wallet.d.ts

@@ -12,13 +12,11 @@ export interface WalletOptions {
 }
 export declare class WalletCommand {
     private config;
-    private logger;
+    private authSession;
     constructor();
     register(program: Command): void;
     private getBaseUrl;
     private getToken;
-    private getRefreshToken;
-    private refreshAccessToken;
     private parseResponseBody;
     private apiFetch;
     showBalance(opts?: WalletOptions): Promise<void>;