vigthoria-cli 1.13.20 → 1.13.22

package/dist/utils/frontend-preview-service.d.ts

@@ -0,0 +1,76 @@
+import type { MutationJournalReport } from './mutation-journal.js';
+import type { PreviewScreenshotPort } from './preview-screenshot-adapter.js';
+export interface FrontendPreviewGateResult {
+    required: boolean;
+    passed: boolean;
+    skipped?: boolean;
+    operationId?: string;
+    partialMutation?: boolean;
+    mutation?: MutationJournalReport;
+    backendUrl?: string;
+    entryPath?: string;
+    assetPaths?: {
+        css: string[];
+        js: string[];
+    };
+    artifacts?: {
+        manifestPath?: string;
+        screenshotPath?: string;
+        previewFileUrl?: string;
+        screenshotCaptured?: boolean;
+        screenshotError?: string;
+    };
+    modes?: {
+        design?: {
+            ready: boolean;
+            devices?: string[];
+            variantCount?: number;
+        };
+        live?: {
+            ready: boolean;
+            entryPoint?: string;
+        };
+        production?: {
+            ready: boolean;
+            deploymentTarget?: string;
+            recommendedCommand?: string;
+        };
+    };
+    summary?: Record<string, unknown>;
+    processingTimeMs?: number;
+    error?: string;
+}
+export interface FrontendPreviewServiceDependencies {
+    getBaseUrls(): string[];
+    getAccessToken(): string | null;
+    fetch(input: string, init: RequestInit): Promise<Response>;
+    resolveTargetPath(context: Record<string, any>): string;
+    extractExpectedFiles(message: string, context: Record<string, any>): string[];
+    isAnalysisOnlyTask(message: string, context: Record<string, any>): boolean;
+    sanitizeError(text: string): string;
+    screenshotAdapter: PreviewScreenshotPort;
+}
+export declare class FrontendPreviewService {
+    private readonly dependencies;
+    constructor(dependencies: FrontendPreviewServiceDependencies);
+    private isFrontendTask;
+    /**
+     * Returns true when the prompt describes a read-only / analysis task.
+     * Used to suppress preview gate and other write-oriented side effects.
+     */
+    isAnalysisOnlyTask(message?: string, context?: Record<string, any>): boolean;
+    normalizeWorkspaceRelativePath(filePath: string): string;
+    collectAgentStateSyncPaths(rootPath: string): string[];
+    private listFrontendWorkspaceFiles;
+    private chooseFrontendPreviewEntry;
+    extractLinkedFrontendAssets(html: string, entryPath: string): {
+        css: string[];
+        js: string[];
+        assets: string[];
+    };
+    private buildFrontendForPreview;
+    private gatherFrontendPreviewArtifacts;
+    private evaluateFrontendVisualProof;
+    private persistFrontendPreviewArtifacts;
+    runTemplateServicePreviewGate(message?: string, context?: Record<string, any>): Promise<FrontendPreviewGateResult>;
+}

package/dist/utils/frontend-preview-service.js

@@ -0,0 +1,482 @@
+import { execFile } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { assertProcessNetworkAllowed } from './process-policy.js';
+import { safeChildProcessEnv, scanOutboundContext } from './secret-policy.js';
+import { resolveWorkspacePath } from './workspace-boundary.js';
+export class FrontendPreviewService {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    isFrontendTask(message = '', context = {}) {
+        if (context.forceFrontendPreview === true) {
+            return true;
+        }
+        // Never treat analysis-only tasks as frontend tasks — preview gate
+        // should not fire for read-only inspection prompts.
+        if (this.dependencies.isAnalysisOnlyTask(message, context)) {
+            return false;
+        }
+        const prompt = String(message || '');
+        const expectedFiles = this.dependencies.extractExpectedFiles(message, context);
+        const hasHtmlEntry = expectedFiles.some((filePath) => /\.html?$/i.test(filePath));
+        return /(premium|polished|landing|site|page|dashboard|saas|frontend|ui|pricing|showcase|hero|responsive)/i.test(prompt)
+            || hasHtmlEntry;
+    }
+    /**
+     * Returns true when the prompt describes a read-only / analysis task.
+     * Used to suppress preview gate and other write-oriented side effects.
+     */
+    isAnalysisOnlyTask(message = '', context = {}) {
+        const prompt = String(message || '').toLowerCase();
+        const taskType = String(context.agentTaskType || '').toLowerCase();
+        if (taskType === 'debugging' || taskType === 'analysis' || taskType === 'analysis_only')
+            return true;
+        if (context.workflowType === 'analysis_only')
+            return true;
+        return /^(what|which|how many|list|show|check|inspect|analyze|analyse|audit|explain|describe|summarize|summarise|review|overview|find|count|read|look at|tell me|diagnos)/i.test(prompt.trim());
+    }
+    normalizeWorkspaceRelativePath(filePath) {
+        return String(filePath || '').trim().replace(/\\/g, '/').replace(/^\.\//, '');
+    }
+    collectAgentStateSyncPaths(rootPath) {
+        const paths = [];
+        const progressPath = path.join(rootPath, '.vigthoria', 'agent-state', 'progress.json');
+        if (!fs.existsSync(progressPath)) {
+            return paths;
+        }
+        paths.push('.vigthoria/agent-state/progress.json');
+        const tasksDir = path.join(rootPath, '.vigthoria', 'agent-state', 'tasks');
+        if (!fs.existsSync(tasksDir)) {
+            return paths;
+        }
+        try {
+            for (const entry of fs.readdirSync(tasksDir, { withFileTypes: true })) {
+                if (!entry.isFile() || !entry.name.endsWith('.json')) {
+                    continue;
+                }
+                paths.push(`.vigthoria/agent-state/tasks/${entry.name}`);
+            }
+        }
+        catch {
+            // Ignore unreadable task snapshots.
+        }
+        return paths;
+    }
+    listFrontendWorkspaceFiles(rootPath) {
+        const results = [];
+        const stack = [rootPath];
+        while (stack.length > 0) {
+            const current = stack.pop();
+            if (!current) {
+                continue;
+            }
+            for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+                if (entry.name === '.git' || entry.name === 'node_modules' || entry.name === '.vigthoria') {
+                    continue;
+                }
+                const fullPath = path.join(current, entry.name);
+                if (entry.isDirectory()) {
+                    stack.push(fullPath);
+                    continue;
+                }
+                if (!entry.isFile()) {
+                    continue;
+                }
+                const relativePath = this.normalizeWorkspaceRelativePath(path.relative(rootPath, fullPath));
+                if (relativePath) {
+                    results.push(relativePath);
+                }
+            }
+        }
+        results.sort((left, right) => left.localeCompare(right));
+        return results;
+    }
+    chooseFrontendPreviewEntry(_rootPath, htmlPaths, expectedFiles = []) {
+        const normalizedExpected = expectedFiles
+            .map((filePath) => this.normalizeWorkspaceRelativePath(filePath))
+            .filter((filePath) => /\.html?$/i.test(filePath));
+        for (const expectedPath of normalizedExpected) {
+            if (htmlPaths.includes(expectedPath)) {
+                return expectedPath;
+            }
+        }
+        const scored = htmlPaths.map((relativePath) => {
+            const baseName = path.posix.basename(relativePath).toLowerCase();
+            const depth = relativePath.split('/').length - 1;
+            let score = 0;
+            const normalizedPath = relativePath.toLowerCase();
+            const topLevelDir = normalizedPath.split('/')[0];
+            if (['dist', 'build', 'out'].includes(topLevelDir)) {
+                score += 320;
+            }
+            else if (topLevelDir === 'public') {
+                score += 180;
+            }
+            if (normalizedPath === 'index.html') {
+                score += 200;
+            }
+            if (baseName === 'index.html') {
+                score += 120;
+            }
+            if (/(landing|home|main|dashboard|app)/i.test(baseName)) {
+                score += 60;
+            }
+            if (depth === 0) {
+                score += 40;
+            }
+            return { relativePath, score, depth };
+        }).sort((left, right) => right.score - left.score || left.depth - right.depth || left.relativePath.localeCompare(right.relativePath));
+        return scored[0]?.relativePath || null;
+    }
+    extractLinkedFrontendAssets(html, entryPath) {
+        const css = new Set();
+        const js = new Set();
+        const assets = new Set();
+        const entryDir = path.posix.dirname(this.normalizeWorkspaceRelativePath(entryPath) || '.');
+        const normalizeAsset = (assetPath) => {
+            const clean = String(assetPath || '').trim();
+            if (!clean || clean.startsWith('http://') || clean.startsWith('https://') || clean.startsWith('//') || clean.startsWith('data:') || clean.startsWith('#')) {
+                return null;
+            }
+            const withoutQuery = clean.split('?')[0].split('#')[0];
+            if (!withoutQuery) {
+                return null;
+            }
+            if (withoutQuery.startsWith('/')) {
+                return this.normalizeWorkspaceRelativePath(path.posix.normalize(path.posix.join(entryDir, withoutQuery.slice(1))));
+            }
+            return this.normalizeWorkspaceRelativePath(path.posix.normalize(path.posix.join(entryDir, withoutQuery)));
+        };
+        const cssPattern = /<link[^>]+href=["']([^"']+\.css(?:[?#][^"']*)?)["'][^>]*>/gi;
+        const jsPattern = /<script[^>]+src=["']([^"']+\.(?:js|mjs|cjs)(?:[?#][^"']*)?)["'][^>]*>/gi;
+        let match;
+        while ((match = cssPattern.exec(String(html || ''))) !== null) {
+            const resolved = normalizeAsset(match[1]);
+            if (resolved) {
+                css.add(resolved);
+            }
+        }
+        while ((match = jsPattern.exec(String(html || ''))) !== null) {
+            const resolved = normalizeAsset(match[1]);
+            if (resolved) {
+                js.add(resolved);
+            }
+        }
+        const assetPattern = /<(?:link|img|source|video|audio)\b[^>]+(?:href|src)=["']([^"']+)["'][^>]*>/gi;
+        while ((match = assetPattern.exec(String(html || ''))) !== null) {
+            const resolved = normalizeAsset(match[1]);
+            if (resolved)
+                assets.add(resolved);
+        }
+        return {
+            css: Array.from(css),
+            js: Array.from(js),
+            assets: Array.from(assets),
+        };
+    }
+    async buildFrontendForPreview(rootPath) {
+        const packagePath = path.join(rootPath, 'package.json');
+        if (!fs.existsSync(packagePath)) {
+            return { attempted: false, succeeded: false };
+        }
+        try {
+            const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+            if (!packageJson.scripts?.build) {
+                return { attempted: false, succeeded: false };
+            }
+        }
+        catch (error) {
+            return { attempted: false, succeeded: false, error: `Invalid package.json: ${error?.message || String(error)}` };
+        }
+        const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+        const npmArgs = ['run', 'build'];
+        assertProcessNetworkAllowed(npmCommand, npmArgs);
+        return await new Promise((resolve) => {
+            execFile(npmCommand, npmArgs, { cwd: rootPath, timeout: 150_000, windowsHide: true, maxBuffer: 2 * 1024 * 1024, env: safeChildProcessEnv() }, (error) => {
+                if (error) {
+                    resolve({ attempted: true, succeeded: false, error: this.dependencies.sanitizeError(error.message).slice(0, 300) });
+                    return;
+                }
+                resolve({ attempted: true, succeeded: true });
+            });
+        });
+    }
+    gatherFrontendPreviewArtifacts(message = '', context = {}) {
+        const rootPath = this.dependencies.resolveTargetPath(context);
+        if (!rootPath || !fs.existsSync(rootPath)) {
+            return { error: 'Frontend preview gate requires a readable project workspace.' };
+        }
+        const workspaceFiles = this.listFrontendWorkspaceFiles(rootPath);
+        const expectedFiles = this.dependencies.extractExpectedFiles(message, context);
+        const htmlPaths = workspaceFiles.filter((filePath) => /\.html?$/i.test(filePath));
+        if (htmlPaths.length === 0) {
+            return { error: 'Frontend preview gate requires at least one HTML entry file in the workspace.' };
+        }
+        const htmlPath = this.chooseFrontendPreviewEntry(rootPath, htmlPaths, expectedFiles);
+        if (!htmlPath) {
+            return { error: 'Frontend preview gate could not determine a primary HTML entry file.' };
+        }
+        const html = fs.readFileSync(resolveWorkspacePath(rootPath, htmlPath), 'utf8');
+        const linkedAssets = this.extractLinkedFrontendAssets(html, htmlPath);
+        const cssFiles = workspaceFiles.filter((filePath) => /\.css$/i.test(filePath));
+        const jsFiles = workspaceFiles.filter((filePath) => /\.(?:js|mjs|cjs)$/i.test(filePath));
+        const expectedCss = expectedFiles
+            .map((filePath) => this.normalizeWorkspaceRelativePath(filePath))
+            .filter((filePath) => /\.css$/i.test(filePath));
+        const expectedJs = expectedFiles
+            .map((filePath) => this.normalizeWorkspaceRelativePath(filePath))
+            .filter((filePath) => /\.(?:js|mjs|cjs)$/i.test(filePath));
+        const chooseExisting = (candidates, fallback) => {
+            const selected = new Set();
+            for (const candidate of [...candidates, ...fallback]) {
+                const normalized = this.normalizeWorkspaceRelativePath(candidate);
+                if (!normalized || selected.has(normalized)) {
+                    continue;
+                }
+                try {
+                    resolveWorkspacePath(rootPath, normalized);
+                }
+                catch {
+                    continue;
+                }
+                selected.add(normalized);
+            }
+            return Array.from(selected);
+        };
+        // When the entry document declares assets, those links are authoritative.
+        // Pulling every CSS/JS file from the workspace also ingested audit copies,
+        // rejected model drafts, and test harnesses into the production proof body.
+        // Fall back to expected/workspace files only for documents without links.
+        const selectedCssFiles = (linkedAssets.css.length > 0
+            ? chooseExisting(linkedAssets.css, [])
+            : chooseExisting(expectedCss, cssFiles)).slice(0, 12);
+        const selectedJsFiles = (linkedAssets.js.length > 0
+            ? chooseExisting(linkedAssets.js, [])
+            : chooseExisting(expectedJs, jsFiles)).slice(0, 12);
+        const css = selectedCssFiles.map((filePath) => fs.readFileSync(resolveWorkspacePath(rootPath, filePath), 'utf8')).join('\n\n');
+        const js = selectedJsFiles.map((filePath) => fs.readFileSync(resolveWorkspacePath(rootPath, filePath), 'utf8')).join('\n\n');
+        return { htmlPath, html, css, js, cssPaths: selectedCssFiles, jsPaths: selectedJsFiles };
+    }
+    evaluateFrontendVisualProof(summary = {}, artifacts = {}) {
+        const reasons = [];
+        const cssPaths = Array.isArray(artifacts.cssPaths) ? artifacts.cssPaths : [];
+        const html = String(artifacts.html || '');
+        const css = String(artifacts.css || '');
+        const js = String(artifacts.js || '');
+        if (!summary.hasViewportMeta) {
+            reasons.push('missing viewport metadata');
+        }
+        const hasStyleEvidence = cssPaths.length > 0 || /<style[\s>]/i.test(html) || css.trim().length > 0;
+        if (!hasStyleEvidence) {
+            reasons.push('missing stylesheet or inline style evidence');
+        }
+        const hasInteractionOrResponsiveEvidence = Boolean(summary.hasResponsiveSignals) || Boolean(summary.hasInteractiveSignals) || /<script[\s>]/i.test(html) || js.trim().length > 0;
+        if (!hasInteractionOrResponsiveEvidence) {
+            reasons.push('missing responsive or interactive evidence');
+        }
+        return {
+            ok: reasons.length === 0,
+            reasons,
+        };
+    }
+    async persistFrontendPreviewArtifacts(previewGate, rootPath, context = {}) {
+        if (!previewGate.required || !previewGate.entryPath) {
+            return previewGate;
+        }
+        try {
+            const artifactsDir = resolveWorkspacePath(rootPath, '.vigthoria/proof/preview', { allowMissing: true });
+            fs.mkdirSync(artifactsDir, { recursive: true });
+            const contextId = String(context.contextId || 'preview').trim() || 'preview';
+            const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+            const baseName = `${timestamp}-${contextId}`;
+            const manifestPath = resolveWorkspacePath(rootPath, `.vigthoria/proof/preview/${baseName}.json`, { allowMissing: true });
+            const screenshotPath = resolveWorkspacePath(rootPath, `.vigthoria/proof/preview/${baseName}.png`, { allowMissing: true });
+            const entryAbsolutePath = resolveWorkspacePath(rootPath, previewGate.entryPath);
+            const previewFileUrl = `file://${entryAbsolutePath}`;
+            const screenshot = await this.dependencies.screenshotAdapter.capture(entryAbsolutePath, screenshotPath);
+            const screenshotRequired = context.requireScreenshot === true;
+            const effectivePreviewGate = screenshotRequired && !screenshot.captured
+                ? {
+                    ...previewGate,
+                    passed: false,
+                    error: `${previewGate.error ? `${previewGate.error} ` : ''}Required screenshot proof is unavailable: ${screenshot.error || 'capture failed'}.`,
+                }
+                : previewGate;
+            const manifest = {
+                schemaVersion: 1,
+                createdAt: new Date().toISOString(),
+                contextId: context.contextId || null,
+                workspaceRoot: rootPath,
+                entryPath: previewGate.entryPath,
+                previewFileUrl,
+                previewCommand: `vigthoria preview -p ${rootPath}`,
+                previewGate: effectivePreviewGate,
+                validationArtifacts: {
+                    summary: previewGate.summary || {},
+                    modes: previewGate.modes || {},
+                    backendUrl: previewGate.backendUrl || null,
+                    processingTimeMs: previewGate.processingTimeMs || null,
+                    assetPaths: previewGate.assetPaths || { css: [], js: [] },
+                },
+                screenshot: {
+                    path: screenshot.captured ? screenshotPath : null,
+                    captured: screenshot.captured,
+                    error: screenshot.error || null,
+                },
+            };
+            fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+            return {
+                ...effectivePreviewGate,
+                artifacts: {
+                    manifestPath,
+                    screenshotPath: screenshot.captured ? screenshotPath : undefined,
+                    previewFileUrl,
+                    screenshotCaptured: screenshot.captured,
+                    screenshotError: screenshot.error,
+                },
+            };
+        }
+        catch (error) {
+            return {
+                ...previewGate,
+                ...(context.requireScreenshot === true ? {
+                    passed: false,
+                    error: `${previewGate.error ? `${previewGate.error} ` : ''}Required screenshot proof could not be persisted.`,
+                } : {}),
+                artifacts: {
+                    ...(previewGate.artifacts || {}),
+                    screenshotCaptured: false,
+                    screenshotError: error?.message || String(error),
+                },
+            };
+        }
+    }
+    async runTemplateServicePreviewGate(message = '', context = {}) {
+        if (!this.isFrontendTask(message, context)) {
+            return { required: false, passed: true };
+        }
+        const rootPath = this.dependencies.resolveTargetPath(context);
+        let artifacts = this.gatherFrontendPreviewArtifacts(message, context);
+        let buildResult = null;
+        if (rootPath && artifacts.error?.includes('at least one HTML entry file')) {
+            buildResult = await this.buildFrontendForPreview(rootPath);
+            if (buildResult.attempted) {
+                artifacts = this.gatherFrontendPreviewArtifacts(message, context);
+            }
+        }
+        if (artifacts.error || !artifacts.htmlPath || typeof artifacts.html !== 'string') {
+            const buildDetail = buildResult?.attempted
+                ? ` Build retry ${buildResult.succeeded ? 'completed but produced no HTML entry' : `failed: ${buildResult.error || 'unknown build error'}`}.`
+                : '';
+            return {
+                required: true,
+                passed: false,
+                error: `${artifacts.error || 'Frontend preview gate could not collect frontend artifacts.'}${buildDetail}`,
+            };
+        }
+        const previewScan = scanOutboundContext({
+            html: artifacts.html,
+            css: artifacts.css || '',
+            js: artifacts.js || '',
+        });
+        if (previewScan.findings.length > 0) {
+            return {
+                required: true,
+                passed: false,
+                skipped: true,
+                entryPath: artifacts.htmlPath,
+                error: 'Preview proof blocked because frontend artifacts contain secret material.',
+            };
+        }
+        // Cap artifact sizes to prevent 413 Payload Too Large
+        const PREVIEW_MAX_ARTIFACT_BYTES = 250 * 1024;
+        const html = artifacts.html.slice(0, PREVIEW_MAX_ARTIFACT_BYTES);
+        const css = (artifacts.css || '').slice(0, PREVIEW_MAX_ARTIFACT_BYTES);
+        const js = (artifacts.js || '').slice(0, PREVIEW_MAX_ARTIFACT_BYTES);
+        const errors = [];
+        for (const baseUrl of this.dependencies.getBaseUrls()) {
+            try {
+                const proofPayload = JSON.stringify({
+                    vision: String(context.rawPrompt || message || '').slice(0, 2000),
+                    html,
+                    css,
+                    js,
+                    entryPath: artifacts.htmlPath,
+                    workspaceName: path.basename(rootPath),
+                });
+                // Skip preview proof if payload is still too large (> 4 MB)
+                const configuredLimit = Number(context.previewMaxPayloadBytes);
+                const previewPayloadLimit = Number.isFinite(configuredLimit) && configuredLimit >= 1024
+                    ? Math.min(configuredLimit, 4 * 1024 * 1024)
+                    : 4 * 1024 * 1024;
+                if (Buffer.byteLength(proofPayload, 'utf8') > previewPayloadLimit) {
+                    return {
+                        required: true,
+                        passed: false,
+                        skipped: true,
+                        error: 'Preview proof skipped: payload exceeds size limit.',
+                    };
+                }
+                const internalServiceKey = process.env.VIGTHORIA_TEMPLATE_SERVICE_KEY
+                    || process.env.V3_SERVICE_KEY;
+                const authToken = this.dependencies.getAccessToken();
+                const response = await this.dependencies.fetch(`${baseUrl}/preview-proof`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        Accept: 'application/json',
+                        ...(authToken ? {
+                            Authorization: `Bearer ${authToken}`,
+                            Cookie: `vigthoria-auth-token=${authToken}`,
+                        } : {}),
+                        ...(internalServiceKey ? { 'x-vigthoria-service-key': internalServiceKey } : {}),
+                    },
+                    body: proofPayload,
+                });
+                if (!response.ok) {
+                    const errorText = await response.text().catch(() => '');
+                    throw new Error(`Template preview proof ${response.status}: ${this.dependencies.sanitizeError(errorText).slice(0, 200)}`);
+                }
+                const payload = await response.json();
+                const modes = payload?.modes || {};
+                const summary = payload?.summary || {};
+                const visualProof = this.evaluateFrontendVisualProof(summary, artifacts);
+                const passed = payload?.success === true
+                    && modes?.design?.ready === true
+                    && modes?.live?.ready === true
+                    && modes?.production?.ready === true
+                    && visualProof.ok;
+                const previewGate = {
+                    required: true,
+                    passed,
+                    backendUrl: baseUrl,
+                    entryPath: artifacts.htmlPath,
+                    assetPaths: {
+                        css: artifacts.cssPaths || [],
+                        js: artifacts.jsPaths || [],
+                    },
+                    modes,
+                    summary,
+                    processingTimeMs: Number(payload?.processing_time || 0) || undefined,
+                    error: passed ? undefined : (visualProof.ok ? 'Template Service preview modes did not all report ready.' : `Frontend preview proof is missing required visual evidence: ${visualProof.reasons.join(', ')}.`),
+                };
+                return await this.persistFrontendPreviewArtifacts(previewGate, rootPath, context);
+            }
+            catch (error) {
+                errors.push(`${baseUrl}: ${error?.message || String(error)}`);
+            }
+        }
+        return await this.persistFrontendPreviewArtifacts({
+            required: true,
+            passed: false,
+            entryPath: artifacts.htmlPath,
+            assetPaths: {
+                css: artifacts.cssPaths || [],
+                js: artifacts.jsPaths || [],
+            },
+            error: errors.join(' | ') || 'No Template Service preview endpoint was reachable.',
+        }, rootPath, context);
+    }
+}

package/dist/utils/goaEvents.d.ts

@@ -1,7 +1,3 @@
-/**
- * Workbench GOA orchestrator context (VIGTHORIA_DECK_MODE / comfort prompt auto-route).
- * Emitted as: @vigthoria-goa:{json}
- */
 export interface GoaOrchestratorContext {
     workspace_type?: 'GREENFIELD' | 'BROWNFIELD';
     analysis?: Record<string, unknown>;

package/dist/utils/goaEvents.js

@@ -2,6 +2,7 @@
  * Workbench GOA orchestrator context (VIGTHORIA_DECK_MODE / comfort prompt auto-route).
  * Emitted as: @vigthoria-goa:{json}
  */
+import { isSensitivePath, redactSensitiveText } from './secret-policy.js';
 const GOA_PREFIX = '@vigthoria-goa:';
 export function parseGoaLine(line) {
     const trimmed = line.trim();
@@ -49,7 +50,9 @@ export function formatGoaSystemGrounding(context) {
         if (typeof a.detected_framework === 'string')
             parts.push(`- framework: ${a.detected_framework}`);
         if (Array.isArray(a.target_files) && a.target_files.length) {
-            parts.push(`- target_files: ${a.target_files.slice(0, 6).join(', ')}`);
+            const safeTargets = a.target_files.filter((entry) => typeof entry === 'string' && !isSensitivePath(entry)).slice(0, 6);
+            if (safeTargets.length > 0)
+                parts.push(`- target_files: ${safeTargets.join(', ')}`);
         }
         if (typeof a.anchor_hint === 'string')
             parts.push(`- anchor: ${a.anchor_hint}`);
@@ -59,5 +62,5 @@ export function formatGoaSystemGrounding(context) {
     if (typeof context.instruction_count === 'number') {
         parts.push(`- instructions_planned: ${context.instruction_count}`);
     }
-    return parts.join('\n');
+    return redactSensitiveText(parts.join('\n'));
 }

package/dist/utils/logger.d.ts

@@ -49,6 +49,7 @@ export declare function createSpinner(textOrOpts: string | OraOptions): Ora;
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'success';
 export declare class Logger {
     private verbose;
+    private safeArgs;
     setVerbose(verbose: boolean): void;
     debug(...args: unknown[]): void;
     info(...args: unknown[]): void;
@@ -57,7 +58,7 @@ export declare class Logger {
     success(...args: unknown[]): void;
     ai(message: string): void;
     user(message: string): void;
-    code(code: string, language?: string): void;
+    code(code: string, _language?: string): void;
     diff(added: string[], removed: string[]): void;
     unifiedDiff(filePath: string, oldText: string, newText: string): void;
     section(title: string): void;