vigthoria-cli 1.13.20 → 1.13.23

package/dist/commands/repo.js

@@ -15,12 +15,14 @@
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
-import { createRequire } from 'node:module';
+import { guardedFetch } from '../utils/network-policy.js';
 import { createSpinner, CH } from '../utils/logger.js';
-const require = createRequire(import.meta.url);
+import { createOperationId } from '../utils/mutation-journal.js';
+import { containsHighConfidenceSecret, isSensitivePath, safeChildProcessEnv } from '../utils/secret-policy.js';
+import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/command-contract.js';
+import { createRuntimeTempDirectory, removeRuntimeTempDirectory } from '../utils/runtime-temp.js';
+import { assertSafeDestinationPath, assertSafeRelativePath, inspectZipArchive, mergeValidatedWorkspace, resolveWorkspacePath, validateExtractedWorkspace, } from '../utils/workspace-boundary.js';
 import inquirer from 'inquirer';
-import * as archiverModule from 'archiver';
-import { createWriteStream } from 'fs';
 const MAX_REPOSITORY_CONTENT_BYTES = 100 * 1024 * 1024;
 const MAX_REPOSITORY_REQUEST_BYTES = 120 * 1024 * 1024;
 class RepositoryApiError extends Error {
@@ -33,6 +35,24 @@ class RepositoryApiError extends Error {
         this.payload = payload || {};
     }
 }
+export class RepositoryMutationAmbiguousError extends Error {
+    operationId;
+    mutationOutcome = 'unknown';
+    partialMutation = 'unknown';
+    constructor(operationId, cause) {
+        super(`Repository mutation outcome is unknown for operation ${operationId}; no alternate backend retry was attempted.`);
+        this.name = 'RepositoryMutationAmbiguousError';
+        this.operationId = operationId;
+        if (cause instanceof Error)
+            this.cause = cause;
+    }
+}
+export function canFallbackRepositoryRequest(method, status) {
+    const normalized = method.toUpperCase();
+    if (normalized === 'GET' || normalized === 'HEAD')
+        return true;
+    return status !== undefined && [401, 403, 404, 413].includes(status);
+}
 function formatBytes(bytes) {
     return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
 }
@@ -49,24 +69,35 @@ async function readResponsePayload(response) {
 }
 export class RepoCommand {
     config;
-    logger;
     apiBase;
     communityBase;
     communityToken;
-    constructor(config, logger) {
+    constructor(config, _logger) {
         this.config = config;
-        this.logger = logger;
         this.apiBase = this.config.get('apiUrl') || 'https://coder.vigthoria.io';
         this.communityBase = process.env.VIGTHORIA_COMMUNITY_API_URL || 'https://community.vigthoria.io';
         this.communityToken = process.env.VIGTHORIA_COMMUNITY_TOKEN || null;
     }
-    getAuthHeaders() {
-        const token = this.communityToken || this.config.get('authToken');
+    getAuthHeaders(audience) {
+        const token = audience === 'coder'
+            ? process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN || this.config.get('authToken')
+            : this.communityToken;
         return {
-            'Authorization': `Bearer ${token}`,
-            'Content-Type': 'application/json'
+            ...(token ? { 'Authorization': `Bearer ${token}` } : {}),
+            'Content-Type': 'application/json',
         };
     }
+    getRepositoryAudienceForUrl(rawUrl) {
+        const hostname = new URL(rawUrl).hostname.toLowerCase();
+        if (hostname === 'coder.vigthoria.io')
+            return 'coder';
+        if (hostname === 'community.vigthoria.io')
+            return 'community';
+        throw new Error('Repository download URL is outside the Coder and Community trust boundary');
+    }
+    getAuthHeadersForUrl(rawUrl) {
+        return this.getAuthHeaders(this.getRepositoryAudienceForUrl(rawUrl));
+    }
     async ensureCommunityAuth() {
         if (this.communityToken) {
             return;
@@ -76,58 +107,62 @@ export class RepoCommand {
         if (!email || !password) {
             return;
         }
-        const response = await fetch(`${this.communityBase}/api/auth/login`, {
+        const response = await guardedFetch(`${this.communityBase}/api/auth/login`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email, password })
-        });
+        }, { audience: 'community' });
         const data = await response.json();
         if (!response.ok || !data.token) {
             throw new Error(data.error || data.message || 'Community login failed');
         }
         this.communityToken = data.token;
     }
-    async repoFetch(apiPath, init = {}) {
+    async repoFetch(apiPath, init = {}, options = {}) {
         const normalizedApiPath = apiPath.startsWith('/api/repo') ? apiPath : `/api/repo${apiPath.startsWith('/') ? apiPath : `/${apiPath}`}`;
         const proxyPath = `${this.apiBase}/api/community-repo${normalizedApiPath.replace('/api/repo', '')}`;
         const directPath = `${this.communityBase}${normalizedApiPath}`;
-        const attempt = async (url, allowCommunityAuthRetry) => {
-            const response = await fetch(url, {
+        const method = String(init.method || 'GET').toUpperCase();
+        const readOnly = options.readOnly === true || method === 'GET' || method === 'HEAD';
+        const mutationId = readOnly ? undefined : createOperationId(options.operationId);
+        const attempt = async (url, audience) => {
+            if (audience === 'community' && !this.communityToken)
+                await this.ensureCommunityAuth();
+            const response = await guardedFetch(url, {
                 ...init,
                 headers: {
-                    ...this.getAuthHeaders(),
+                    ...this.getAuthHeaders(audience),
+                    ...(mutationId ? {
+                        'Idempotency-Key': mutationId,
+                        'X-Vigthoria-Operation-Id': mutationId,
+                    } : {}),
                     ...(init.headers || {})
                 }
-            });
-            // Both 401 (missing/expired credentials) and 403 (a valid Coder
-            // token that Community cannot accept) must activate the explicit
-            // Community credential fallback. Previously a stale/incompatible
-            // Coder token made configured Community credentials unreachable.
-            if ([401, 403].includes(response.status) && allowCommunityAuthRetry && !this.communityToken) {
-                await this.ensureCommunityAuth();
-                if (this.communityToken) {
-                    return attempt(url, false);
-                }
-            }
+            }, { audience });
             return response;
         };
         try {
-            const proxyResponse = await attempt(proxyPath, true);
+            const proxyResponse = await attempt(proxyPath, 'coder');
             // A large repository payload can exceed the Coder API's general
             // 50 MiB parser while remaining valid under Community's 100 MiB
             // repository contract. Retry that one status directly.
-            const shouldTryDirectCommunity = [401, 403, 404, 413].includes(proxyResponse.status);
+            const shouldTryDirectCommunity = readOnly || canFallbackRepositoryRequest(method, proxyResponse.status);
             if (proxyResponse.ok || (proxyResponse.status < 500 && !shouldTryDirectCommunity)) {
                 return proxyResponse;
             }
             if (shouldTryDirectCommunity) {
                 await proxyResponse.body?.cancel();
             }
+            else {
+                return proxyResponse;
+            }
         }
-        catch {
-            // fall through to direct community endpoint
+        catch (error) {
+            if (!readOnly) {
+                throw new RepositoryMutationAmbiguousError(mutationId, error);
+            }
         }
-        return attempt(directPath, true);
+        return attempt(directPath, 'community');
     }
     collectProjectFiles(projectPath) {
         const files = [];
@@ -140,15 +175,26 @@ export class RepoCommand {
                 }
                 const fullPath = path.join(dir, entry.name);
                 const relativePath = path.relative(projectPath, fullPath);
+                if (isSensitivePath(relativePath)) {
+                    continue;
+                }
+                if (entry.isSymbolicLink()) {
+                    throw new Error(`Repository push refused symbolic link or junction: ${relativePath}`);
+                }
                 if (entry.isDirectory()) {
+                    resolveWorkspacePath(projectPath, relativePath);
                     walk(fullPath);
                     continue;
                 }
-                if (!entry.isFile() || ignoreSuffixes.some((suffix) => entry.name.endsWith(suffix))) {
+                if (!entry.isFile()) {
+                    throw new Error(`Repository push refused special or unreadable entry: ${relativePath}`);
+                }
+                if (ignoreSuffixes.some((suffix) => entry.name.endsWith(suffix))) {
                     continue;
                 }
                 try {
-                    const raw = fs.readFileSync(fullPath);
+                    const containedPath = resolveWorkspacePath(projectPath, relativePath);
+                    const raw = fs.readFileSync(containedPath);
                     let content;
                     let encoding;
                     try {
@@ -159,9 +205,14 @@ export class RepoCommand {
                         if (looksBinary)
                             throw new Error('binary content');
                         content = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+                        if (containsHighConfidenceSecret(content)) {
+                            throw new Error(`Repository push refused ${relativePath}: detected secret material`);
+                        }
                         encoding = 'utf8';
                     }
-                    catch {
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith('Repository push refused'))
+                            throw error;
                         content = raw.toString('base64');
                         encoding = 'base64';
                     }
@@ -172,8 +223,8 @@ export class RepoCommand {
                         size: raw.length,
                     });
                 }
-                catch {
-                    // Skip unreadable files. Binary files are transported as base64.
+                catch (error) {
+                    throw new Error(`Repository push could not safely read ${relativePath}: ${error.message}`);
                 }
             }
         };
@@ -250,13 +301,14 @@ export class RepoCommand {
         console.log(chalk.cyan(`   Retry fixed content: ${review.retryCommand || `vigthoria repo push --retry ${review.reviewId}`}\n`));
     }
     isAuthenticated() {
-        const token = this.config.get('authToken');
+        const token = process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN || this.config.get('authToken');
         return !!token;
     }
     requireAuth() {
         if (!this.isAuthenticated()) {
-            console.log(chalk.red('\n❌ Authentication required. Run: vigthoria login\n'));
-            process.exit(1);
+            throw new CliCommandError('Authentication required. Run: vigthoria login', {
+                code: 'AUTH_REQUIRED', category: 'authentication',
+            });
         }
     }
     /**
@@ -321,44 +373,6 @@ export class RepoCommand {
         }
         return { name, description, techStack: [...new Set(techStack)] };
     }
-    /**
-     * Create a zip archive of a project
-     */
-    async createProjectArchive(projectPath) {
-        const tempDir = path.join(require('os').tmpdir(), 'vigthoria-cli');
-        if (!fs.existsSync(tempDir)) {
-            fs.mkdirSync(tempDir, { recursive: true });
-        }
-        const archivePath = path.join(tempDir, `project-${Date.now()}.zip`);
-        const output = createWriteStream(archivePath);
-        // Archiver 8 is ESM-only and exposes format-specific constructors
-        // instead of the legacy default factory.
-        const archive = new archiverModule.ZipArchive({ zlib: { level: 9 } });
-        return new Promise((resolve, reject) => {
-            output.on('close', () => resolve(archivePath));
-            archive.on('error', (err) => reject(err));
-            archive.pipe(output);
-            // Ignore patterns
-            const ignorePatterns = [
-                'node_modules/**',
-                '.git/**',
-                'dist/**',
-                'build/**',
-                '__pycache__/**',
-                '.venv/**',
-                'venv/**',
-                '*.log',
-                '.env',
-                '.DS_Store'
-            ];
-            archive.glob('**/*', {
-                cwd: projectPath,
-                ignore: ignorePatterns,
-                dot: true
-            });
-            archive.finalize();
-        });
-    }
     /**
      * Push a project to Vigthoria Repository
      */
@@ -366,8 +380,9 @@ export class RepoCommand {
         this.requireAuth();
         const projectPath = options.path ? path.resolve(options.path) : process.cwd();
         if (!fs.existsSync(projectPath)) {
-            console.log(chalk.red(`\n❌ Path does not exist: ${projectPath}\n`));
-            return;
+            throw new CliCommandError(`Path does not exist: ${projectPath}`, {
+                code: 'PROJECT_PATH_NOT_FOUND', category: 'configuration',
+            });
         }
         const spinner = createSpinner('Analyzing project...').start();
         try {
@@ -428,7 +443,9 @@ export class RepoCommand {
             if (contentBytes > MAX_REPOSITORY_CONTENT_BYTES) {
                 throw new Error(`Repository content is ${formatBytes(contentBytes)} and exceeds the ${formatBytes(MAX_REPOSITORY_CONTENT_BYTES)} limit`);
             }
+            const operationId = createOperationId();
             const pushPayload = JSON.stringify({
+                operationId,
                 projectName: answers.name,
                 description: answers.description,
                 techStack: projectInfo.techStack.join(', '),
@@ -447,7 +464,7 @@ export class RepoCommand {
             const registerResponse = await this.repoFetch('/api/repo/push', {
                 method: 'POST',
                 body: pushPayload
-            });
+            }, { operationId });
             if (!registerResponse.ok) {
                 const error = await readResponsePayload(registerResponse);
                 throw new RepositoryApiError(registerResponse.status, error, 'Failed to push project');
@@ -467,7 +484,6 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Push failed');
             if (error instanceof RepositoryApiError && error.payload?.code === 'REPOSITORY_SECURITY_REVIEW') {
                 this.printSecurityReview({
                     reviewId: error.payload.reviewId,
@@ -478,8 +494,7 @@ export class RepoCommand {
                     retryCommand: error.payload.retryCommand,
                 });
             }
-            const errMsg = this.formatRepoError(error);
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_PUSH_FAILED', message: this.formatRepoError(error) });
         }
     }
     /**
@@ -499,7 +514,7 @@ export class RepoCommand {
             }
             spinner.stop();
             if (options.json) {
-                console.log(JSON.stringify(reviewId ? payload.review : payload.reviews, null, 2));
+                console.log(formatSuccessJson('repo review', reviewId ? payload.review : payload.reviews));
                 return;
             }
             if (reviewId) {
@@ -519,7 +534,101 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            console.log(chalk.red(`\n❌ Error: ${this.formatRepoError(error)}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_REVIEW_FAILED', message: this.formatRepoError(error) });
+        }
+    }
+    async materializeProject(data, repo, requestedName, options, publicDownload = false) {
+        const remoteProjectName = String(data.project?.project_name || data.projectName || repo.name || repo.project_name || requestedName);
+        const outputPath = options.output
+            ? assertSafeDestinationPath(path.resolve(options.output))
+            : resolveWorkspacePath(process.cwd(), assertSafeRelativePath(remoteProjectName), { allowMissing: true });
+        if (fs.existsSync(outputPath) && !options.force) {
+            const { overwrite } = await inquirer.prompt([{
+                    type: 'confirm',
+                    name: 'overwrite',
+                    message: `Directory ${outputPath} exists. Overwrite?`,
+                    default: false
+                }]);
+            if (!overwrite) {
+                throw new CliCommandError('Repository materialization cancelled by user', {
+                    code: 'REPOSITORY_PULL_CANCELLED', category: 'cancelled',
+                });
+            }
+        }
+        const downloadSpinner = createSpinner('Downloading project files...').start();
+        try {
+            if (fs.existsSync(outputPath))
+                validateExtractedWorkspace(outputPath);
+            if (data.downloadUrl) {
+                const archiveResponse = await guardedFetch(data.downloadUrl, {
+                    headers: publicDownload
+                        ? { 'Content-Type': 'application/json' }
+                        : this.getAuthHeadersForUrl(data.downloadUrl)
+                }, { audience: this.getRepositoryAudienceForUrl(data.downloadUrl) });
+                if (!archiveResponse.ok)
+                    throw new Error('Failed to download project archive');
+                const archiveBuffer = Buffer.from(await archiveResponse.arrayBuffer());
+                inspectZipArchive(archiveBuffer);
+                const stagingRoot = createRuntimeTempDirectory('repo-pull-');
+                const tempArchive = path.join(stagingRoot, 'archive.zip');
+                const extractedPath = path.join(stagingRoot, 'extracted');
+                try {
+                    fs.mkdirSync(extractedPath, { mode: 0o700 });
+                    fs.writeFileSync(tempArchive, archiveBuffer, { mode: 0o600 });
+                    if (process.platform === 'win32') {
+                        const { execFileSync } = await import('child_process');
+                        execFileSync('powershell', [
+                            '-NoProfile', '-NonInteractive', '-Command',
+                            'Expand-Archive -LiteralPath $env:VIGTHORIA_ARCHIVE_PATH -DestinationPath $env:VIGTHORIA_ARCHIVE_DESTINATION -Force'
+                        ], {
+                            stdio: 'ignore',
+                            timeout: 120_000,
+                            windowsHide: true,
+                            env: safeChildProcessEnv(process.env, {
+                                VIGTHORIA_ARCHIVE_PATH: tempArchive,
+                                VIGTHORIA_ARCHIVE_DESTINATION: extractedPath,
+                            }),
+                        });
+                    }
+                    else {
+                        const { execFileSync } = await import('child_process');
+                        execFileSync('unzip', ['-o', tempArchive, '-d', extractedPath], { stdio: 'ignore', timeout: 120_000, env: safeChildProcessEnv() });
+                    }
+                    validateExtractedWorkspace(extractedPath);
+                    mergeValidatedWorkspace(extractedPath, outputPath);
+                }
+                finally {
+                    removeRuntimeTempDirectory(stagingRoot);
+                }
+            }
+            else if (data.files) {
+                const stagingRoot = createRuntimeTempDirectory('repo-inline-');
+                try {
+                    for (const file of data.files) {
+                        const filePath = resolveWorkspacePath(stagingRoot, file.path, { allowMissing: true });
+                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                        fs.writeFileSync(filePath, file.content, { mode: 0o600 });
+                    }
+                    validateExtractedWorkspace(stagingRoot);
+                    mergeValidatedWorkspace(stagingRoot, outputPath);
+                }
+                finally {
+                    removeRuntimeTempDirectory(stagingRoot);
+                }
+            }
+            else {
+                throw new Error('Repository response contained neither an archive nor inline files');
+            }
+            downloadSpinner.succeed(chalk.green('Project materialized successfully!'));
+            console.log(chalk.cyan('\n📁 Project extracted to:'));
+            console.log(chalk.white(`   ${outputPath}`));
+            console.log(chalk.gray(`\n   Tech Stack: ${data.project?.tech_stack || repo.tech_stack || 'Unknown'}`));
+            console.log(chalk.gray(`   Description: ${data.project?.description || data.description || repo.description || '(none)'}`));
+            console.log();
+        }
+        catch (error) {
+            downloadSpinner.stop();
+            throw error;
         }
     }
     /**
@@ -533,81 +642,18 @@ export class RepoCommand {
             const response = await this.repoFetch('/api/repo/pull', {
                 method: 'POST',
                 body: JSON.stringify({ projectId: repo.id })
-            });
+            }, { readOnly: true });
             if (!response.ok) {
                 const error = await readResponsePayload(response);
                 throw new Error(error.error || error.message || 'Project not found');
             }
             const data = await response.json();
             spinner.succeed(`Found project: ${chalk.cyan(data.project?.project_name || data.projectName || repo.name || repo.project_name || projectName)}`);
-            const outputPath = options.output
-                ? path.resolve(options.output)
-                : path.join(process.cwd(), data.project?.project_name || data.projectName || repo.name || repo.project_name || projectName);
-            if (fs.existsSync(outputPath) && !options.force) {
-                const { overwrite } = await inquirer.prompt([{
-                        type: 'confirm',
-                        name: 'overwrite',
-                        message: `Directory ${outputPath} exists. Overwrite?`,
-                        default: false
-                    }]);
-                if (!overwrite) {
-                    console.log(chalk.yellow(`\n${CH.warnEmoji}  Pull cancelled.\n`));
-                    return;
-                }
-            }
-            const downloadSpinner = createSpinner('Downloading project files...').start();
-            // Create output directory
-            fs.mkdirSync(outputPath, { recursive: true });
-            // If we have a download URL, fetch and extract
-            if (data.downloadUrl) {
-                const archiveResponse = await fetch(data.downloadUrl, {
-                    headers: this.getAuthHeaders()
-                });
-                if (!archiveResponse.ok) {
-                    throw new Error('Failed to download project archive');
-                }
-                // Save and extract the archive
-                const tempArchive = path.join(require('os').tmpdir(), `vigthoria-pull-${Date.now()}.zip`);
-                const archiveBuffer = Buffer.from(await archiveResponse.arrayBuffer());
-                fs.writeFileSync(tempArchive, archiveBuffer);
-                // Extract archive - cross-platform
-                const os = require('os');
-                const platform = os.platform();
-                if (platform === 'win32') {
-                    // Use PowerShell's Expand-Archive — args as array to prevent injection
-                    const { execFileSync } = await import('child_process');
-                    execFileSync('powershell', [
-                        '-NoProfile', '-NonInteractive', '-Command',
-                        `Expand-Archive -Path '${tempArchive.replace(/'/g, "''")}' -DestinationPath '${outputPath.replace(/'/g, "''")}' -Force`
-                    ], { stdio: 'ignore', windowsHide: true });
-                }
-                else {
-                    // Use unzip on Unix-like systems — args as array to prevent injection
-                    const { execFileSync } = await import('child_process');
-                    execFileSync('unzip', ['-o', tempArchive, '-d', outputPath], { stdio: 'ignore' });
-                }
-                fs.unlinkSync(tempArchive);
-            }
-            else if (data.files) {
-                // If we have files inline (small projects)
-                for (const file of data.files) {
-                    const filePath = path.join(outputPath, file.path);
-                    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-                    fs.writeFileSync(filePath, file.content);
-                }
-            }
-            downloadSpinner.succeed(chalk.green('Project pulled successfully!'));
-            console.log(chalk.cyan('\n📁 Project extracted to:'));
-            console.log(chalk.white(`   ${outputPath}`));
-            console.log(chalk.gray(`\n   Tech Stack: ${data.project?.tech_stack || repo.tech_stack || 'Unknown'}`));
-            console.log(chalk.gray(`   Description: ${data.project?.description || data.description || repo.description || '(none)'}`));
-            console.log();
+            await this.materializeProject(data, repo, projectName, options);
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Pull failed');
-            const errMsg = this.formatRepoError(error);
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_PULL_FAILED', message: this.formatRepoError(error) });
         }
     }
     /**
@@ -704,9 +750,7 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('List failed');
-            const errMsg = this.formatRepoError(error);
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_LIST_FAILED', message: this.formatRepoError(error) });
         }
     }
     /**
@@ -718,10 +762,10 @@ export class RepoCommand {
         const projectInfo = this.detectProjectInfo(projectPath);
         const spinner = createSpinner('Checking sync status...').start();
         try {
-            const response = await fetch(`${this.apiBase}/api/repo/status/${encodeURIComponent(projectInfo.name)}`, {
+            const response = await guardedFetch(`${this.apiBase}/api/repo/status/${encodeURIComponent(projectInfo.name)}`, {
                 method: 'GET',
-                headers: this.getAuthHeaders()
-            });
+                headers: this.getAuthHeaders('coder')
+            }, { audience: 'coder' });
             if (!response.ok) {
                 spinner.succeed('Project not tracked in Vigthoria Community Repository');
                 console.log(chalk.yellow('\n📦 Current project is not synced with Vigthoria Community Repository.\n'));
@@ -755,9 +799,7 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Status check failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_STATUS_FAILED' });
         }
     }
     /**
@@ -767,14 +809,15 @@ export class RepoCommand {
         this.requireAuth();
         const spinner = createSpinner('Generating share link...').start();
         try {
-            const response = await fetch(`${this.apiBase}/api/repo/share`, {
+            const operationId = createOperationId();
+            const response = await this.repoFetch('/api/repo/share', {
                 method: 'POST',
-                headers: this.getAuthHeaders(),
                 body: JSON.stringify({
+                    operationId,
                     projectName,
                     expiresIn: options.expires || '7d'
                 })
-            });
+            }, { operationId });
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to generate share link');
@@ -788,32 +831,33 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Share failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_SHARE_FAILED' });
         }
     }
     /**
      * Delete a project from Vigthoria Repository
      */
-    async delete(projectName) {
+    async delete(projectName, options = {}) {
         this.requireAuth();
-        const { confirm } = await inquirer.prompt([{
-                type: 'confirm',
-                name: 'confirm',
-                message: chalk.red(`Are you sure you want to delete "${projectName}" from Vigthoria Community Repository?`),
-                default: false
-            }]);
+        const confirm = options.yes === true
+            ? true
+            : (await inquirer.prompt([{
+                    type: 'confirm',
+                    name: 'confirm',
+                    message: chalk.red(`Are you sure you want to delete "${projectName}" from Vigthoria Community Repository?`),
+                    default: false
+                }])).confirm;
         if (!confirm) {
             console.log(chalk.yellow(`\n${CH.warnEmoji}  Delete cancelled.\n`));
             return;
         }
         const spinner = createSpinner('Deleting project...').start();
         try {
-            const response = await fetch(`${this.apiBase}/api/repo/projects/${encodeURIComponent(projectName)}`, {
+            const operationId = createOperationId();
+            const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(projectName)}`, {
                 method: 'DELETE',
-                headers: this.getAuthHeaders()
-            });
+                headers: { 'X-Vigthoria-Operation-Id': operationId },
+            }, { operationId });
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to delete project');
@@ -823,9 +867,7 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Delete failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_DELETE_FAILED' });
         }
     }
     /**
@@ -844,16 +886,22 @@ export class RepoCommand {
         const resolvedName = projectName || this.detectProjectInfo(process.cwd()).name;
         const spinner = createSpinner(`Opening "${resolvedName}" in ${label}...`).start();
         try {
-            const response = await fetch(`${this.apiBase}/api/engine-import`, {
+            const operationId = createOperationId();
+            const response = await guardedFetch(`${this.apiBase}/api/engine-import`, {
                 method: 'POST',
-                headers: this.getAuthHeaders(),
+                headers: {
+                    ...this.getAuthHeaders('coder'),
+                    'Idempotency-Key': operationId,
+                    'X-Vigthoria-Operation-Id': operationId,
+                },
                 body: JSON.stringify({
+                    operationId,
                     engine,
                     projectName: resolvedName,
                     shopId: options.shopId || 'default',
                     source: 'repo'
                 })
-            });
+            }, { audience: 'coder' });
             if (!response.ok) {
                 const err = await readResponsePayload(response);
                 throw new Error(err.error || `Engine import failed (${response.status})`);
@@ -873,11 +921,11 @@ export class RepoCommand {
                     }
                     const safeUrl = parsedUrl.href;
                     if (platform === 'win32')
-                        execFileSync('cmd', ['/c', 'start', '', safeUrl], { stdio: 'ignore', windowsHide: true });
+                        execFileSync('rundll32.exe', ['url.dll,FileProtocolHandler', safeUrl], { stdio: 'ignore', timeout: 10_000, windowsHide: true, env: safeChildProcessEnv() });
                     else if (platform === 'darwin')
-                        execFileSync('open', [safeUrl], { stdio: 'ignore' });
+                        execFileSync('open', [safeUrl], { stdio: 'ignore', timeout: 10_000, env: safeChildProcessEnv() });
                     else
-                        execFileSync('xdg-open', [safeUrl], { stdio: 'ignore' });
+                        execFileSync('xdg-open', [safeUrl], { stdio: 'ignore', timeout: 10_000, env: safeChildProcessEnv() });
                 }
                 catch { /* browser open is optional */ }
             }
@@ -887,9 +935,7 @@ export class RepoCommand {
         }
         catch (error) {
             spinner.stop();
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ ${label} import failed: ${errMsg}\n`));
-            console.log(chalk.gray('Tip: Make sure your project is pushed first with `vigthoria repo push`\n'));
+            throw commandFailure(error, { code: 'REPOSITORY_ENGINE_IMPORT_FAILED' });
         }
     }
     /**
@@ -901,24 +947,24 @@ export class RepoCommand {
         const projectId = projectIdMatch ? projectIdMatch[1] : projectUrl;
         const spinner = createSpinner(`Cloning project...`).start();
         try {
-            const response = await fetch(`${this.apiBase}/api/repo/clone/${projectId}`, {
+            const response = await guardedFetch(`${this.apiBase}/api/repo/clone/${projectId}`, {
                 method: 'GET',
-                headers: this.isAuthenticated() ? this.getAuthHeaders() : { 'Content-Type': 'application/json' }
-            });
+                headers: this.isAuthenticated() ? this.getAuthHeaders('coder') : { 'Content-Type': 'application/json' }
+            }, { audience: 'coder' });
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Project not found or not public');
             }
             const data = await response.json();
             spinner.succeed(`Found project: ${chalk.cyan(data.project.project_name)}`);
-            // Use pull logic for the rest
-            await this.pull(data.project.project_name, options);
+            // Public clones materialize the clone response directly. They must
+            // not route through authenticated `pull`, and public archive
+            // downloads must not inherit a user credential.
+            await this.materializeProject(data, data.project, data.project.project_name, options, true);
         }
         catch (error) {
             spinner.stop();
-            this.logger.error('Clone failed');
-            const errMsg = error instanceof Error ? error.message : 'Unknown error';
-            console.log(chalk.red(`\n❌ Error: ${errMsg}\n`));
+            throw commandFailure(error, { code: 'REPOSITORY_CLONE_FAILED' });
         }
     }
 }