vigthoria-cli 1.13.20 → 1.13.22

package/dist/commands/coding-registration.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Config } from '../utils/config.js';
+import type { Logger } from '../utils/logger.js';
+export declare function registerCodingCommands(program: Command, config: Config, logger: Logger): void;

package/dist/commands/coding-registration.js

@@ -0,0 +1,24 @@
+import { EditCommand } from './edit.js';
+import { ExplainCommand } from './explain.js';
+import { GenerateCommand } from './generate.js';
+import { ReviewCommand } from './review.js';
+export function registerCodingCommands(program, config, logger) {
+    program.command('edit <file>').alias('e').description('Edit a file with AI assistance')
+        .option('-i, --instruction <text>', 'Editing instruction').option('-m, --model <model>', 'Select AI model', 'code')
+        .option('--apply', 'Automatically apply changes without confirmation', false)
+        .action(async (file, options) => new EditCommand(config, logger).run(file, options));
+    program.command('generate <description>').alias('g').description('Generate code from description')
+        .option('-l, --language <lang>', 'Target language (auto-detected from description, or specify: javascript, typescript, python, html, etc.)')
+        .option('-o, --output <file>', 'Output file path').option('-m, --model <model>', 'Select AI model', 'code')
+        .option('-p, --pro', 'Senior Developer Mode: plan, generate, quality check (recommended)', false)
+        .action(async (description, options) => new GenerateCommand(config, logger).run(description, options));
+    program.command('explain <file>').alias('x').description('Explain code in a file')
+        .option('-l, --lines <range>', 'Line range (e.g., 1-50)').option('-d, --detail <level>', 'Detail level (brief, normal, detailed)', 'normal')
+        .action(async (file, options) => new ExplainCommand(config, logger).run(file, options));
+    program.command('fix <file>').alias('f').description('Fix issues in a file')
+        .option('-t, --type <type>', 'Fix type (bugs, style, security, performance)', 'bugs').option('--apply', 'Automatically apply fixes', false)
+        .action(async (file, options) => new EditCommand(config, logger).fix(file, options));
+    program.command('review <file>').alias('r').description('Review code quality')
+        .option('-f, --format <format>', 'Output format (text, json, markdown)', 'text')
+        .action(async (file, options) => new ReviewCommand(config, logger).run(file, options));
+}

package/dist/commands/config.js

@@ -6,7 +6,9 @@ import inquirer from 'inquirer';
 import * as fs from 'fs';
 import * as path from 'path';
 import { normalizePersonaMode } from '../utils/persona.js';
+import { assertTrustedEndpoint, assertTrustedWebSocketEndpoint } from '../utils/network-policy.js';
 import { CH } from '../utils/logger.js';
+import { CliCommandError } from '../utils/command-contract.js';
 export class ConfigCommand {
     config;
     logger;
@@ -49,8 +51,9 @@ export class ConfigCommand {
         if (fs.existsSync(configFile)) {
             if (nonInteractive) {
                 if (!options.yes) {
-                    this.logger.error('.vigthoria.json already exists. Re-run with --yes to overwrite in non-interactive mode.');
-                    return;
+                    throw new CliCommandError('.vigthoria.json already exists. Re-run with --yes to overwrite in non-interactive mode.', {
+                        code: 'PROJECT_ALREADY_INITIALIZED', category: 'usage',
+                    });
                 }
             }
             else {
@@ -79,9 +82,9 @@ export class ConfigCommand {
             const defaults = profileDefaults[profile];
             const model = options.model || defaults.defaultModel;
             if (!allowedModels.has(model)) {
-                this.logger.error(`Invalid --model: ${model}`);
-                this.logger.info('Allowed values: architect, code, assistant, code-35b, code-9b, balanced, balanced-4b');
-                return;
+                throw new CliCommandError(`Invalid --model: ${model}. Allowed values: architect, code, assistant, code-35b, code-9b, balanced, balanced-4b.`, {
+                    code: 'INVALID_MODEL', category: 'usage',
+                });
             }
             settings = {
                 defaultModel: model,
@@ -149,8 +152,9 @@ export class ConfigCommand {
         const [key, ...valueParts] = keyValue.split('=');
         const value = valueParts.join('=');
         if (!key || value === undefined) {
-            this.logger.error('Invalid format. Use: vigthoria config --set key=value');
-            return;
+            throw new CliCommandError('Invalid format. Use: vigthoria config --set key=value', {
+                code: 'INVALID_CONFIG_ASSIGNMENT', category: 'usage',
+            });
         }
         const configMap = {
             'model': (v) => this.config.set('preferences', { ...this.config.get('preferences'), defaultModel: v }),
@@ -158,10 +162,10 @@ export class ConfigCommand {
             'autoApply': (v) => this.config.set('preferences', { ...this.config.get('preferences'), autoApplyFixes: v === 'true' }),
             'showDiffs': (v) => this.config.set('preferences', { ...this.config.get('preferences'), showDiffs: v === 'true' }),
             'maxTokens': (v) => this.config.set('preferences', { ...this.config.get('preferences'), maxTokens: parseInt(v, 10) }),
-            'apiUrl': (v) => this.config.set('apiUrl', v),
-            'modelsApiUrl': (v) => this.config.set('modelsApiUrl', v),
-            'wsUrl': (v) => this.config.set('wsUrl', v),
-            'selfHostedModelsApiUrl': (v) => this.config.set('selfHostedModelsApiUrl', v === 'null' || v === 'off' ? null : v),
+            'apiUrl': (v) => this.config.set('apiUrl', assertTrustedEndpoint(v, { audience: 'coder' }).toString().replace(/\/$/, '')),
+            'modelsApiUrl': (v) => this.config.set('modelsApiUrl', assertTrustedEndpoint(v, { audience: 'models' }).toString().replace(/\/$/, '')),
+            'wsUrl': (v) => this.config.set('wsUrl', assertTrustedWebSocketEndpoint(v, 'coder').toString().replace(/\/$/, '')),
+            'selfHostedModelsApiUrl': (v) => this.config.set('selfHostedModelsApiUrl', v === 'null' || v === 'off' ? null : assertTrustedEndpoint(v, { audience: 'models' }).toString().replace(/\/$/, '')),
             'persona': (v) => {
                 const mode = normalizePersonaMode(v);
                 if (!mode)
@@ -174,8 +178,9 @@ export class ConfigCommand {
             this.logger.success(`Set ${key} = ${this.formatConfigValueForDisplay(key, value)}`);
         }
         else {
-            this.logger.error(`Unknown config key: ${key}`);
-            console.log(chalk.gray('Available keys: model, theme, autoApply, showDiffs, maxTokens, persona, apiUrl, modelsApiUrl, wsUrl, selfHostedModelsApiUrl'));
+            throw new CliCommandError(`Unknown config key: ${key}. Available keys: model, theme, autoApply, showDiffs, maxTokens, persona, apiUrl, modelsApiUrl, wsUrl, selfHostedModelsApiUrl.`, {
+                code: 'UNKNOWN_CONFIG_KEY', category: 'usage',
+            });
         }
     }
     formatConfigValueForDisplay(key, value) {
@@ -224,7 +229,7 @@ export class ConfigCommand {
             console.log(flatConfig[key]);
         }
         else {
-            this.logger.error(`Unknown config key: ${key}`);
+            throw new CliCommandError(`Unknown config key: ${key}`, { code: 'UNKNOWN_CONFIG_KEY', category: 'usage' });
         }
     }
     listConfig() {
@@ -262,21 +267,10 @@ export class ConfigCommand {
             },
         ]);
         if (confirm) {
-            // Save auth before reset
-            const authToken = this.config.get('authToken');
-            const refreshToken = this.config.get('refreshToken');
-            const userId = this.config.get('userId');
-            const email = this.config.get('email');
-            const subscription = this.config.get('subscription');
-            this.config.reset();
-            // Restore auth
-            if (authToken) {
-                this.config.set('authToken', authToken);
-                this.config.set('refreshToken', refreshToken);
-                this.config.set('userId', userId);
-                this.config.set('email', email);
-                this.config.set('subscription', subscription);
-            }
+            // Reset preferences and endpoints in one durable transaction while
+            // preserving the complete credential bundle. Separate reset/set writes
+            // can leave a partially restored login after interruption.
+            this.config.resetPreservingAuth();
             this.logger.success('Configuration reset to defaults');
         }
     }

package/dist/commands/conversation-registration.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Config } from '../utils/config.js';
+import type { Logger } from '../utils/logger.js';
+export declare function registerConversationCommands(program: Command, config: Config, logger: Logger): void;

package/dist/commands/conversation-registration.js

@@ -0,0 +1,122 @@
+import { ChatCommand } from './chat.js';
+function projectWasProvided(project) {
+    return typeof project === 'string' && project.trim().length > 0;
+}
+export function registerConversationCommands(program, config, logger) {
+    program
+        .command('chat')
+        .alias('c')
+        .description('Start interactive chat with Vigthoria AI')
+        .option('-m, --model <model>', 'Select AI model (agent, code, code-35b, code-9b, balanced, balanced-4b, cloud, ultra)')
+        .option('-p, --project <path>', 'Set project context path')
+        .option('--new-project [name]', 'Create or use a managed local workspace folder when no --project path is given')
+        .option('-a, --agent', 'Enable agentic mode (default: true for best quality)', true)
+        .option('--no-agent', 'Disable agentic mode (simple chat only)')
+        .option('-r, --resume', 'Resume last session for this project', false)
+        .option('--prompt <text>', 'Run a single prompt directly and exit')
+        .option('-w, --workflow <selector>', 'Route prompts through a named or explicit VigFlow workflow target')
+        .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
+        .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
+        .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
+        .action(async (options) => {
+        await new ChatCommand(config, logger, program).run({
+            model: options.model,
+            project: options.project,
+            projectProvided: projectWasProvided(options.project),
+            newProject: options.newProject,
+            agent: options.agent,
+            workflow: options.workflow,
+            json: options.json,
+            autoApprove: options.autoApprove,
+            resume: options.resume,
+            prompt: options.prompt,
+            bridge: options.bridge,
+        });
+    });
+    program
+        .command('chat-resume')
+        .description('Resume the latest chat session for the current or specified project')
+        .option('-m, --model <model>', 'Select AI model (agent, code, code-35b, code-9b, balanced, balanced-4b, cloud, ultra)')
+        .option('-p, --project <path>', 'Set project context path')
+        .option('--new-project [name]', 'Create or use a managed local workspace folder when no --project path is given')
+        .option('-a, --agent', 'Enable agentic mode (default: true for best quality)', true)
+        .option('--no-agent', 'Disable agentic mode (simple chat only)')
+        .option('--prompt <text>', 'Run a single prompt directly and exit after resuming context')
+        .option('-w, --workflow <selector>', 'Route prompts through a named or explicit VigFlow workflow target')
+        .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
+        .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
+        .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
+        .action(async (options) => {
+        await new ChatCommand(config, logger, program).run({
+            model: options.model,
+            project: options.project,
+            projectProvided: projectWasProvided(options.project),
+            newProject: options.newProject,
+            agent: options.agent,
+            workflow: options.workflow,
+            json: options.json,
+            autoApprove: options.autoApprove,
+            resume: true,
+            prompt: options.prompt,
+            bridge: options.bridge,
+        });
+    });
+    program
+        .command('agent')
+        .alias('a')
+        .description('Start agentic mode - AI can read/write files, run commands')
+        .option('-m, --model <model>', 'Select AI model (agent, code, cloud, ultra)')
+        .option('-p, --project <path>', 'Set project context path')
+        .option('--new-project [name]', 'Create or use a managed local workspace folder when no --project path is given')
+        .option('--prompt <text>', 'Run a single agent prompt directly and exit')
+        .option('-w, --workflow <selector>', 'Run the prompt through a named or explicit VigFlow workflow target')
+        .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
+        .option('--retry', 'Retry failed tasks from the last agent run in this workspace session', false)
+        .option('--continue', 'Continue unfinished tasks from the last agent run in this workspace session', false)
+        .option('--auto-approve', 'Auto-approve all actions (dangerous!)', false)
+        .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
+        .action(async (options) => {
+        await new ChatCommand(config, logger, program).run({
+            model: options.model,
+            project: options.project,
+            projectProvided: projectWasProvided(options.project),
+            newProject: options.newProject,
+            agent: true,
+            operator: false,
+            workflow: options.workflow,
+            json: options.json,
+            autoApprove: options.autoApprove,
+            prompt: options.prompt,
+            bridge: options.bridge,
+            retry: options.retry,
+            continue: options.continue,
+        });
+    });
+    program
+        .command('operator')
+        .alias('op')
+        .description('Start BMAD operator mode for infrastructure and system workflows')
+        .option('-m, --model <model>', 'Select operator model (code, agent, cloud)')
+        .option('-p, --project <path>', 'Set project context path')
+        .option('--new-project [name]', 'Create or use a managed local workspace folder when no --project path is given')
+        .option('--prompt <text>', 'Run a single operator prompt directly and exit')
+        .option('-w, --workflow <selector>', 'Run the prompt through a named or explicit VigFlow workflow target')
+        .option('--save-plan', 'Save the completed BMAD plan into VigFlow for rerun and audit', false)
+        .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
+        .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
+        .action(async (options) => {
+        await new ChatCommand(config, logger, program).run({
+            model: options.model,
+            project: options.project,
+            projectProvided: projectWasProvided(options.project),
+            newProject: options.newProject,
+            agent: false,
+            operator: true,
+            workflow: options.workflow,
+            savePlan: options.savePlan,
+            json: options.json,
+            prompt: options.prompt,
+            bridge: options.bridge,
+        });
+    });
+}

package/dist/commands/deploy.d.ts

@@ -21,12 +21,18 @@ interface DeployOptions {
 }
 export declare class DeployCommand {
     private config;
-    private logger;
     private apiBase;
-    constructor(config: Config, logger: Logger);
+    constructor(config: Config, _logger: Logger);
     private getAuthHeaders;
     private isAuthenticated;
     private requireAuth;
+    /**
+     * Deployment is a Coder-server operation. A client-local absolute path is
+     * neither portable nor a valid remote workspace binding, so resolve the
+     * validated local project to an existing server-owned project identifier
+     * before starting a deployment mutation.
+     */
+    private resolveServerProject;
     /**
      * Interactive deploy wizard
      */

package/dist/commands/deploy.js

@@ -15,33 +15,67 @@ import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import { createSpinner, CH } from '../utils/logger.js';
+import { validateExtractedWorkspace } from '../utils/workspace-boundary.js';
+import { guardedFetch } from '../utils/network-policy.js';
+import { CliCommandError, commandFailure } from '../utils/command-contract.js';
 import inquirer from 'inquirer';
 export class DeployCommand {
     config;
-    logger;
     apiBase;
-    constructor(config, logger) {
+    constructor(config, _logger) {
         this.config = config;
-        this.logger = logger;
         this.apiBase = this.config.get('apiUrl') || 'https://coder.vigthoria.io';
     }
     getAuthHeaders() {
-        const token = this.config.get('authToken');
-        return {
-            'Authorization': `Bearer ${token}`,
-            'Content-Type': 'application/json'
-        };
+        const token = process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN || this.config.get('authToken');
+        return token
+            ? { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' }
+            : { 'Content-Type': 'application/json' };
     }
     isAuthenticated() {
-        return !!this.config.get('authToken');
+        return !!(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN || this.config.get('authToken'));
     }
     requireAuth() {
         if (!this.isAuthenticated()) {
-            console.log(chalk.red('\n❌ Authentication required'));
-            console.log(chalk.gray('   Run `vig login` to authenticate first.\n'));
-            process.exit(1);
+            throw new CliCommandError('Authentication required. Run `vigthoria login` first.', {
+                code: 'AUTH_REQUIRED', category: 'authentication',
+            });
         }
     }
+    /**
+     * Deployment is a Coder-server operation. A client-local absolute path is
+     * neither portable nor a valid remote workspace binding, so resolve the
+     * validated local project to an existing server-owned project identifier
+     * before starting a deployment mutation.
+     */
+    async resolveServerProject(projectPath) {
+        const projectDir = fs.realpathSync(projectPath || process.cwd());
+        validateExtractedWorkspace(projectDir, { ignoreNames: ['node_modules', '.git', 'dist', 'build'] });
+        const projectInfo = this.detectProjectInfo(projectDir);
+        const response = await guardedFetch(`${this.apiBase}/api/projects`, {
+            headers: this.getAuthHeaders(),
+        }, { audience: 'coder', maxRedirects: 0 });
+        if (!response.ok) {
+            throw new Error('Unable to resolve the project in Coder before deployment');
+        }
+        const data = await response.json();
+        const localNames = new Set([
+            projectInfo.name.trim().toLowerCase(),
+            path.basename(projectDir).trim().toLowerCase(),
+        ].filter(Boolean));
+        const match = (data.projects || []).find((project) => {
+            const remoteName = String(project.project_name || project.name || '').trim().toLowerCase();
+            return localNames.has(remoteName);
+        });
+        const projectId = match?.id ?? match?.project_id;
+        if (projectId === undefined || projectId === null || String(projectId).trim() === '') {
+            throw new Error(`Project "${projectInfo.name}" is not synchronized with Coder. Upload or create it in Coder before deploying.`);
+        }
+        return {
+            projectId: typeof projectId === 'number' ? projectId : String(projectId),
+            projectName: String(match?.project_name || match?.name || projectInfo.name),
+        };
+    }
     /**
      * Interactive deploy wizard
      */
@@ -91,16 +125,15 @@ export class DeployCommand {
         this.requireAuth();
         const spinner = createSpinner('Deploying to preview...').start();
         try {
-            const projectDir = projectPath || process.cwd();
-            const projectInfo = this.detectProjectInfo(projectDir);
-            const response = await fetch(`${this.apiBase}/api/hosting/deploy/preview`, {
+            const project = await this.resolveServerProject(projectPath);
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/deploy/preview`, {
                 method: 'POST',
                 headers: this.getAuthHeaders(),
                 body: JSON.stringify({
-                    projectName: projectInfo.name,
-                    projectPath: projectDir
+                    projectId: project.projectId,
+                    projectName: project.projectName,
                 })
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to deploy');
@@ -114,49 +147,40 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Deploy failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
-            process.exitCode = 1;
+            throw commandFailure(error, { code: 'DEPLOY_PREVIEW_FAILED' });
         }
     }
     /**
      * Deploy to Vigthoria subdomain
      */
     async deployToSubdomain(subdomain, projectPath) {
+        this.requireAuth();
         const spinner = createSpinner(`Deploying to ${subdomain}.vigthoria.io...`).start();
         try {
             // Validate subdomain format
             if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(subdomain) || subdomain.length < 3) {
-                throw new Error('Subdomain must be 3+ chars, lowercase alphanumeric with hyphens');
+                throw new CliCommandError('Subdomain must be 3+ chars, lowercase alphanumeric with hyphens', {
+                    code: 'SUBDOMAIN_INVALID', category: 'usage',
+                });
             }
-            const projectDir = projectPath || process.cwd();
-            const projectInfo = this.detectProjectInfo(projectDir);
-            const response = await fetch(`${this.apiBase}/api/hosting/deploy/subdomain`, {
+            const project = await this.resolveServerProject(projectPath);
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/deploy/subdomain`, {
                 method: 'POST',
                 headers: this.getAuthHeaders(),
                 body: JSON.stringify({
                     subdomain,
-                    projectName: projectInfo.name,
-                    projectPath: projectDir
+                    projectId: project.projectId,
+                    projectName: project.projectName,
                 })
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             const data = await response.json();
             if (!response.ok || !data.success) {
                 if (data.requiresSubscription) {
                     spinner.stop();
-                    console.log(chalk.yellow(`\n${CH.warnEmoji}  Subdomain hosting requires a subscription (€4.99/mo)`));
-                    const { proceed } = await inquirer.prompt([{
-                            type: 'confirm',
-                            name: 'proceed',
-                            message: 'Would you like to subscribe now?',
-                            default: true
-                        }]);
-                    if (proceed && data.checkoutUrl) {
-                        console.log(chalk.cyan(`\n🔗 Opening checkout: ${data.checkoutUrl}`));
-                        console.log(chalk.gray('Please open this URL in your browser to subscribe.\n'));
-                    }
-                    return;
+                    throw new CliCommandError('Subdomain hosting requires a subscription (€4.99/mo)', {
+                        code: 'DEPLOY_SUBSCRIPTION_REQUIRED', category: 'authorization',
+                        details: data.checkoutUrl ? { checkoutUrl: data.checkoutUrl } : undefined,
+                    });
                 }
                 throw new Error(data.error || 'Failed to deploy');
             }
@@ -169,44 +193,34 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Deploy failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_SUBDOMAIN_FAILED' });
         }
     }
     /**
      * Deploy to custom domain
      */
     async deployToCustomDomain(domain, projectPath) {
+        this.requireAuth();
         const spinner = createSpinner(`Setting up ${domain}...`).start();
         try {
-            const projectDir = projectPath || process.cwd();
-            const projectInfo = this.detectProjectInfo(projectDir);
-            const response = await fetch(`${this.apiBase}/api/hosting/deploy/custom`, {
+            const project = await this.resolveServerProject(projectPath);
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/deploy/custom`, {
                 method: 'POST',
                 headers: this.getAuthHeaders(),
                 body: JSON.stringify({
                     domain,
-                    projectName: projectInfo.name,
-                    projectPath: projectDir
+                    projectId: project.projectId,
+                    projectName: project.projectName,
                 })
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             const data = await response.json();
             if (!response.ok || !data.success) {
                 if (data.requiresSubscription) {
                     spinner.stop();
-                    console.log(chalk.yellow(`\n${CH.warnEmoji}  Custom domain hosting requires a subscription (€9.99/mo)`));
-                    const { proceed } = await inquirer.prompt([{
-                            type: 'confirm',
-                            name: 'proceed',
-                            message: 'Would you like to subscribe now?',
-                            default: true
-                        }]);
-                    if (proceed && data.checkoutUrl) {
-                        console.log(chalk.cyan(`\n🔗 Checkout URL: ${data.checkoutUrl}`));
-                        console.log(chalk.gray('Please open this URL in your browser to subscribe.\n'));
-                    }
-                    return;
+                    throw new CliCommandError('Custom domain hosting requires a subscription (€9.99/mo)', {
+                        code: 'DEPLOY_SUBSCRIPTION_REQUIRED', category: 'authorization',
+                        details: data.checkoutUrl ? { checkoutUrl: data.checkoutUrl } : undefined,
+                    });
                 }
                 throw new Error(data.error || 'Failed to deploy');
             }
@@ -224,9 +238,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Deploy failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_CUSTOM_DOMAIN_FAILED' });
         }
     }
     /**
@@ -271,9 +283,9 @@ export class DeployCommand {
     async showPlans() {
         const spinner = createSpinner('Fetching hosting plans...').start();
         try {
-            const response = await fetch(`${this.apiBase}/api/hosting/plans`, {
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/plans`, {
                 headers: this.getAuthHeaders()
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             if (!response.ok) {
                 throw new Error('Failed to fetch plans');
             }
@@ -301,9 +313,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Failed to fetch plans');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_PLANS_FAILED' });
         }
     }
     /**
@@ -313,9 +323,9 @@ export class DeployCommand {
         this.requireAuth();
         const spinner = createSpinner('Fetching deployments...').start();
         try {
-            const response = await fetch(`${this.apiBase}/api/hosting/domains`, {
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/domains`, {
                 headers: this.getAuthHeaders()
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             if (!response.ok) {
                 throw new Error('Failed to fetch deployments');
             }
@@ -342,9 +352,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('List failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_LIST_FAILED' });
         }
     }
     /**
@@ -357,9 +365,9 @@ export class DeployCommand {
             const endpoint = domain
                 ? `${this.apiBase}/api/hosting/domain/${encodeURIComponent(domain)}/status`
                 : `${this.apiBase}/api/hosting/status`;
-            const response = await fetch(endpoint, {
+            const response = await guardedFetch(endpoint, {
                 headers: this.getAuthHeaders()
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             if (!response.ok) {
                 throw new Error('Failed to fetch status');
             }
@@ -370,9 +378,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Status check failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_STATUS_FAILED' });
         }
     }
     /**
@@ -382,11 +388,11 @@ export class DeployCommand {
         this.requireAuth();
         const spinner = createSpinner(`Verifying DNS for ${domain}...`).start();
         try {
-            const response = await fetch(`${this.apiBase}/api/hosting/domain/verify`, {
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/domain/verify`, {
                 method: 'POST',
                 headers: this.getAuthHeaders(),
                 body: JSON.stringify({ domain })
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             const data = await response.json();
             if (!response.ok || !data.success) {
                 throw new Error(data.error || 'Verification failed');
@@ -404,9 +410,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Verification failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_VERIFY_FAILED' });
         }
     }
     /**
@@ -426,10 +430,10 @@ export class DeployCommand {
         }
         const spinner = createSpinner(`Removing ${domain}...`).start();
         try {
-            const response = await fetch(`${this.apiBase}/api/hosting/domain/${encodeURIComponent(domain)}`, {
+            const response = await guardedFetch(`${this.apiBase}/api/hosting/domain/${encodeURIComponent(domain)}`, {
                 method: 'DELETE',
                 headers: this.getAuthHeaders()
-            });
+            }, { audience: 'coder', maxRedirects: 0 });
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to remove');
@@ -439,9 +443,7 @@ export class DeployCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Remove failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'DEPLOY_REMOVE_FAILED' });
         }
     }
     /**

package/dist/commands/device.d.ts

@@ -9,8 +9,7 @@ type DeviceOptions = {
     port?: string;
 };
 export declare class DeviceCommand {
-    private logger;
-    constructor(_config: Config, logger: Logger);
+    constructor(_config: Config, _logger: Logger);
     status(options?: DeviceOptions): Promise<void>;
     list(options?: DeviceOptions): Promise<void>;
     screenshot(options?: DeviceOptions): Promise<void>;