vigthoria-cli 1.13.20 → 1.13.23

package/scripts/release/publish-cli-release.sh

@@ -1,73 +1,5 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Publish Vigthoria CLI release artifact + manifest entry.
-# Usage:
-#   HOST_DOWNLOADS_DIR=/path/to/downloads \
-#   HOST_MANIFEST_FILE=/path/to/releases/manifest.json \
-#   ./scripts/release/publish-cli-release.sh 1.9.0
-
-VERSION="${1:-}"
-if [[ -z "$VERSION" ]]; then
-  echo "Usage: $0 <version>"
-  exit 1
-fi
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-PKG_FILE="$REPO_ROOT/vigthoria-cli-${VERSION}.tgz"
-HOST_DOWNLOADS_DIR="${HOST_DOWNLOADS_DIR:-}"
-HOST_MANIFEST_FILE="${HOST_MANIFEST_FILE:-}"
-PUBLIC_BASE_URL="${PUBLIC_BASE_URL:-https://extension.vigthoria.io/downloads}"
-CHANNEL="${CHANNEL:-stable}"
-
-if [[ ! -f "$PKG_FILE" ]]; then
-  echo "Artifact not found: $PKG_FILE"
-  echo "Run: npm pack"
-  exit 1
-fi
-
-if [[ -z "$HOST_DOWNLOADS_DIR" || -z "$HOST_MANIFEST_FILE" ]]; then
-  echo "Set HOST_DOWNLOADS_DIR and HOST_MANIFEST_FILE before running."
-  exit 1
-fi
-
-SHA256="$(sha256sum "$PKG_FILE" | awk '{print $1}')"
-URL="$PUBLIC_BASE_URL/vigthoria-cli-${VERSION}.tgz"
-
-echo "Publishing vigthoria-cli v${VERSION}"
-echo "Artifact: $PKG_FILE"
-echo "SHA256:   $SHA256"
-echo "URL:      $URL"
-
-install -d "$HOST_DOWNLOADS_DIR"
-cp -f "$PKG_FILE" "$HOST_DOWNLOADS_DIR/"
-
-echo "Copied artifact to $HOST_DOWNLOADS_DIR"
-
-if [[ ! -f "$HOST_MANIFEST_FILE" ]]; then
-  echo "Manifest does not exist at: $HOST_MANIFEST_FILE"
-  echo "Create it first with {\"channels\":{\"stable\":{}}}"
-  exit 1
-fi
-
-python3 - << PYEOF
-import json, pathlib
-manifest_path = pathlib.Path(r"$HOST_MANIFEST_FILE")
-data = json.loads(manifest_path.read_text())
-data.setdefault("channels", {})
-data["channels"].setdefault("$CHANNEL", {})
-data["channels"]["$CHANNEL"].update({
-  "version": "$VERSION",
-  "url": "$URL",
-  "sha256": "$SHA256",
-  "notes": "Automated publish via scripts/release/publish-cli-release.sh"
-})
-manifest_path.write_text(json.dumps(data, indent=2) + "\n")
-print("Manifest updated:", manifest_path)
-PYEOF
-
-echo "Publish complete."
-echo "Verification commands:"
-echo "  curl -I $URL"
-echo "  curl -fsSL https://coder.vigthoria.io/releases/manifest.json | head -40"
-echo "  node dist/index.js update --check --manifest https://coder.vigthoria.io/releases/manifest.json --channel $CHANNEL"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+exec node "$ROOT/scripts/release/publish-cli-release.mjs" "$@"

package/scripts/release/resolve-release-manifest.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import {
+  assertReleaseUrl,
+  getReleasePolicy,
+  parseReleaseManifestText,
+  verifyReleaseSignature,
+} from '../../dist/utils/release-policy.js';
+
+const policy = getReleasePolicy();
+const manifestUrl = process.argv[2] || policy.origins.manifest;
+const channel = process.argv[3] || 'stable';
+async function read(url, accept) {
+  assertReleaseUrl(url, url === manifestUrl ? 'manifest' : 'signature');
+  const response = await fetch(url, {
+    redirect: 'manual',
+    signal: AbortSignal.timeout(15_000),
+    headers: { Accept: accept },
+  });
+  if (!response.ok || [301, 302, 303, 307, 308].includes(response.status)) throw new Error(`Release resource returned HTTP ${response.status}; redirects are prohibited.`);
+  return response.text();
+}
+const manifestText = await read(manifestUrl, 'application/json');
+const entry = parseReleaseManifestText(manifestText, channel);
+const detached = await read(entry.signature.url, 'application/octet-stream');
+verifyReleaseSignature(channel, entry, detached);
+process.stdout.write(`${JSON.stringify(entry)}\n`);

package/scripts/release/test-balanced-model-live.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+block() {
+  echo "BLOCKED: $*" >&2
+  exit 2
+}
+
+[[ -n "${VIGTHORIA_AUTH_TOKEN:-}" ]] || block "VIGTHORIA_AUTH_TOKEN is required for the credentialed balanced-model probe"
+[[ -n "${VIGTHORIA_SELF_HOSTED_MODELS_API_URL:-}" ]] || block "VIGTHORIA_SELF_HOSTED_MODELS_API_URL is required for the live model infrastructure"
+[[ -x dist/index.js ]] || block "dist/index.js is unavailable; build the candidate first"
+
+MODELS_HEALTH="${VIGTHORIA_SELF_HOSTED_MODELS_API_URL%/}/health"
+if ! curl --silent --show-error --fail --connect-timeout 5 --max-time 15 "$MODELS_HEALTH" >/dev/null; then
+  block "balanced-model infrastructure is unavailable at the configured endpoint"
+fi
+
+PROBE_TEMP_ROOT="${VIGTHORIA_TEMP_DIR:-$HOME/.vigthoria/tmp}/live-tests"
+mkdir -p "$PROBE_TEMP_ROOT"
+chmod 700 "$PROBE_TEMP_ROOT"
+PROBE_TMP="$(mktemp -d "$PROBE_TEMP_ROOT/balanced.XXXXXX")"
+trap 'rm -rf "$PROBE_TMP"' EXIT
+
+for attempt in 1 2 3; do
+  if node dist/index.js chat --no-agent --model balanced-4b --prompt "reply exactly: ok" --json >"$PROBE_TMP/balanced.json"; then
+    break
+  fi
+  if [[ "$attempt" == "3" ]]; then
+    block "balanced-4b remained unavailable after 3 bounded attempts"
+  fi
+  echo "[retry] balanced-4b transient failure ($attempt/3)"
+  sleep 2
+done
+
+BALANCED_RESULT="$PROBE_TMP/balanced.json" node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+const result = JSON.parse(fs.readFileSync(process.env.BALANCED_RESULT, 'utf8'));
+if (result.success !== true) throw new Error(`balanced probe failed: ${JSON.stringify(result)}`);
+const allowed = new Set(['Vigthoria-v4-Assistant-9B', 'vigthoria-balanced-4b', 'vigthoria-v3-balanced-4b']);
+if (!allowed.has(result.model)) throw new Error(`unexpected balanced model: ${result.model}`);
+console.log('[pass] credentialed balanced-4b live probe');
+EOF

package/scripts/release/validate-live-service-gates.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+block() {
+  echo "BLOCKED: $*" >&2
+  exit 2
+}
+
+[[ -n "${VIGTHORIA_AUTH_TOKEN:-}" ]] || block "an authorized live-test credential is required"
+[[ -n "${VIGTHORIA_SELF_HOSTED_MODELS_API_URL:-}" ]] || block "the live models endpoint is not configured"
+[[ -n "${VIGTHORIA_V3_AGENT_URL:-}" ]] || block "the live V3 endpoint is not configured"
+[[ -n "${VIGTHORIA_TEMPLATE_SERVICE_URL:-}" ]] || block "the live Template Service endpoint is not configured"
+[[ -x dist/index.js ]] || block "dist/index.js is unavailable; build the candidate first"
+
+LIVE_TEMP_ROOT="${VIGTHORIA_TEMP_DIR:-$HOME/.vigthoria/tmp}/live-tests"
+mkdir -p "$LIVE_TEMP_ROOT"
+chmod 700 "$LIVE_TEMP_ROOT"
+LIVE_TMP="$(mktemp -d "$LIVE_TEMP_ROOT/services.XXXXXX")"
+trap 'rm -rf "$LIVE_TMP"' EXIT
+export VIGTHORIA_NO_BANNER=1
+export VIGTHORIA_NO_UPDATE_CHECK=1
+
+echo "[AUTH PREFLIGHT] invalid session message"
+VIGTHORIA_AUTH_TOKEN=invalid-token-for-preflight node dist/index.js chat --no-agent --model balanced-4b --prompt "ok" --json >"$LIVE_TMP/auth.json" 2>/dev/null || true
+AUTH_RESULT="$LIVE_TMP/auth.json" node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+const result = JSON.parse(fs.readFileSync(process.env.AUTH_RESULT, 'utf8'));
+const expected = 'Vigthoria Gate way user authentification failed. Please log out and login again.';
+if (result.success !== false || result.error !== expected) throw new Error(`unexpected auth preflight: ${JSON.stringify(result)}`);
+console.log('[pass] live auth preflight message');
+EOF
+
+echo "[6.2] balanced-4b credentialed probe"
+bash scripts/release/test-balanced-model-live.sh
+
+echo "[6.9/6.12] live aliases"
+node dist/index.js hyper-loop status >"$LIVE_TMP/hyperloop.txt"
+node dist/index.js devtools status >"$LIVE_TMP/devtools.txt"
+
+echo "[7.1/7.3/7.4] configured live service health"
+for url in "${VIGTHORIA_V3_AGENT_URL%/}/health" "${VIGTHORIA_SELF_HOSTED_MODELS_API_URL%/}/health" "${VIGTHORIA_TEMPLATE_SERVICE_URL%/}/health"; do
+  if ! code="$(curl --silent --show-error --connect-timeout 5 --max-time 15 --output /dev/null --write-out '%{http_code}' "$url")"; then
+    block "live infrastructure is unavailable at $url"
+  fi
+  echo "$url => $code"
+  [[ "$code" == "200" ]] || block "live infrastructure returned HTTP $code at $url"
+done
+
+echo "[7.2/7.8/12.3] live models inventory"
+MODELS_INVENTORY="${VIGTHORIA_SELF_HOSTED_MODELS_API_URL%/}/v1/models"
+if ! curl --silent --show-error --fail --connect-timeout 5 --max-time 15 "$MODELS_INVENTORY" >"$LIVE_TMP/models.json"; then
+  block "model inventory is unavailable"
+fi
+MODELS_RESULT="$LIVE_TMP/models.json" node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+const ids = new Set((JSON.parse(fs.readFileSync(process.env.MODELS_RESULT, 'utf8')).data || []).map((model) => model.id || ''));
+const hasRouter = ['Vigthoria-v4-Assistant-9B', 'vigthoria-balanced-4b', 'vigthoria-balanced-4b:latest', 'vigthoria-v3-balanced-4b', 'vigthoria-v3-balanced-4b:latest', 'vigthoria-fast-9b', 'vigthoria-fast-9b:latest'].some((model) => ids.has(model));
+const hasCreative = ['Vigthoria-v4-Creative-27B', 'vigthoria-creative-9b-v4', 'vigthoria-creative-9b-v4:latest', 'vigthoria-fast-9b', 'vigthoria-fast-9b:latest'].some((model) => ids.has(model));
+const hasCode = ids.has('Vigthoria-v4-Code-27B') || [...ids].some((model) => /^vigthoria-v3(?:\.\d+)?-code-35b(?:-|:|$)/.test(model));
+if (!hasRouter || !hasCreative || !hasCode) throw new Error(`required model families missing: ${JSON.stringify([...ids].sort())}`);
+console.log('[pass] live model inventory gates');
+EOF
+
+echo "[7.5 policy] secured hosted HyperLoop endpoint"
+if ! code="$(curl --silent --show-error --connect-timeout 5 --max-time 15 --output /dev/null --write-out '%{http_code}' https://coder.vigthoria.io/api/hyperloop/health)"; then
+  block "hosted HyperLoop endpoint is unavailable"
+fi
+echo "unauth_hyperloop_code=$code"
+[[ "$code" == "401" || "$code" == "302" ]]
+
+echo "[12.1] live no-agent governance fallback"
+for attempt in 1 2 3; do
+  if node dist/index.js chat --no-agent --model creative-v4 --prompt "say ok" --json >"$LIVE_TMP/creative.json"; then
+    break
+  fi
+  if [[ "$attempt" == "3" ]]; then
+    block "governance fallback remained unavailable after 3 bounded attempts"
+  fi
+  echo "[retry] governance fallback transient failure ($attempt/3)"
+  sleep 2
+done
+CREATIVE_RESULT="$LIVE_TMP/creative.json" node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+const result = JSON.parse(fs.readFileSync(process.env.CREATIVE_RESULT, 'utf8'));
+if (result.success !== true || result.model !== 'Vigthoria-v4-Code-27B') throw new Error(`unexpected governance result: ${JSON.stringify(result)}`);
+if (result.metadata?.modelFallback?.reason !== 'governance-blocked-model') throw new Error(`missing governance fallback metadata: ${JSON.stringify(result)}`);
+console.log('[pass] live governance fallback metadata');
+EOF
+
+echo "ALL CREDENTIALED LIVE SERVICE GATES PASSED"

package/scripts/release/validate-no-go-gates.sh

@@ -4,60 +4,122 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
-CLI="node dist/index.js"
-SERVICE_IDENTITY_MODE="${VIGTHORIA_TEST_SERVICE_IDENTITY:-0}"
-unset V3_SERVICE_KEY
-unset HYPERLOOP_SERVICE_KEY
-# Release validation runs against local model-router in this environment
-export VIGTHORIA_SELF_HOSTED_MODELS_API_URL="http://127.0.0.1:4009"
-
-echo "[0.1-0.6] source/dist consistency"
-node scripts/release/verify-runtime-consistency.mjs >/tmp/vig-verify-runtime.json
-cat /tmp/vig-verify-runtime.json
-
-echo "[0.2] build exits 0"
-npm run build >/tmp/vig-build.log 2>&1
-
-echo "[0.3] dist/index.js exists"
-[[ -x dist/index.js ]]
-
-echo "[AUTH PREFLIGHT] invalid session message"
-AUTH_JSON=$(VIGTHORIA_AUTH_TOKEN=invalid-token-for-preflight $CLI chat --no-agent --model balanced-4b --prompt "ok" --json 2>/dev/null || true)
-echo "$AUTH_JSON"
-printf '%s
-' "$AUTH_JSON" > /tmp/vig-auth-preflight.json
-python3 - << 'PY'
-import json
-import re
-with open('/tmp/vig-auth-preflight.json','r',encoding='utf-8') as f:
-    j=json.load(f)
-msg='Vigthoria Gate way user authentification failed. Please log out and login again.'
-assert j.get('success') is False, 'expected success=false for invalid token preflight'
-assert j.get('error') == msg, f"unexpected auth message: {j.get('error')}"
-print('[pass] auth preflight message')
-PY
-
-if [[ "$SERVICE_IDENTITY_MODE" == "1" ]]; then
-  # From this point onward the no-go suite exercises server-local model and
-  # tool routes without borrowing a human account session. The invalid-token
-  # gateway assertion above always runs against the canonical public boundary.
-  export VIGTHORIA_LOCAL_TEST_MODE=1
-  export VIGTHORIA_LOCAL_TEST_TOKEN="vigthoria-release-service-identity"
-  export VIGTHORIA_AUTH_TOKEN="$VIGTHORIA_LOCAL_TEST_TOKEN"
-fi
-
-echo "[1.1] ranker includes agent.py top10 for SSE prompt"
-node - << 'EOF2'
-import('./dist/utils/context-ranker.js').then((m)=>{
-  const r=m.buildSemanticContext('/var/www/V3-Code-Agent','fix the streaming SSE event handler',10);
-  const idx=r.topFiles.findIndex((f)=>f.path==='agent.py');
-  console.log('agent_idx_top10=' + idx);
-  if (idx < 0) process.exit(1);
-});
-EOF2
-
-echo "[2.1/2.4] tsc validator emits passing result"
-node --input-type=module - << 'EOF2'
+VALIDATION_TEMP_ROOT="${VIGTHORIA_VALIDATION_TEMP_DIR:-$(dirname "$ROOT")/.vigthoria-cli-validation}"
+mkdir -p "$VALIDATION_TEMP_ROOT"
+chmod 700 "$VALIDATION_TEMP_ROOT"
+find "$VALIDATION_TEMP_ROOT" -mindepth 1 -maxdepth 1 -type d -name 'run.*' -mmin +1440 -user "$(id -un)" -exec rm -rf -- {} +
+VALIDATION_TMP="$(mktemp -d "$VALIDATION_TEMP_ROOT/run.XXXXXX")"
+trap 'rm -rf "$VALIDATION_TMP"' EXIT
+mkdir -p "$VALIDATION_TMP/home"
+mkdir -p "$VALIDATION_TMP/runtime-tmp"
+chmod 700 "$VALIDATION_TMP/runtime-tmp"
+
+export HOME="$VALIDATION_TMP/home"
+export USERPROFILE="$HOME"
+export TMPDIR="$VALIDATION_TMP/runtime-tmp"
+export TMP="$TMPDIR"
+export TEMP="$TMPDIR"
+export npm_config_cache="$VALIDATION_TMP/npm-cache"
+export npm_config_update_notifier=false
+export VIGTHORIA_NO_BANNER=1
+export VIGTHORIA_NO_UPDATE_CHECK=1
+export VIGTHORIA_OFFLINE=1
+unset VIGTHORIA_AUTH_TOKEN VIGTHORIA_TOKEN VIGTHORIA_LOCAL_TEST_MODE
+unset VIGTHORIA_LOCAL_TEST_TOKEN V3_SERVICE_KEY HYPERLOOP_SERVICE_KEY
+unset VIGTHORIA_API_URL VIGTHORIA_MODELS_API_URL
+unset VIGTHORIA_SELF_HOSTED_MODELS_API_URL VIGTHORIA_V3_AGENT_URL
+
+echo "[0.1] clean build"
+npm run build >"$VALIDATION_TMP/build.log" 2>&1
+
+echo "[0.2] source/dist consistency"
+node scripts/release/verify-runtime-consistency.mjs >"$VALIDATION_TMP/runtime.json"
+cat "$VALIDATION_TMP/runtime.json"
+
+echo "[0.3] package, lockfile, and runtime identity"
+node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
+const runtime = spawnSync(process.execPath, ['dist/index.js', '--version'], { encoding: 'utf8' });
+if (runtime.status !== 0) throw new Error(runtime.stderr || 'runtime --version failed');
+const versions = [pkg.version, lock.version, lock.packages?.['']?.version, runtime.stdout.trim()];
+if (new Set(versions).size !== 1) throw new Error(`identity mismatch: ${versions.join(', ')}`);
+console.log(`[pass] identity ${versions[0]}`);
+EOF
+
+echo "[0.4] strict TypeScript compilation"
+./node_modules/.bin/tsc --noEmit
+
+echo "[0.5] source, import, command, JSON, and golden contracts"
+node scripts/run-test-suite.mjs check
+node scripts/architecture/verify-source-boundaries.mjs
+node scripts/architecture/verify-import-graph.mjs --check
+node scripts/architecture/capture-command-manifest.mjs --check
+node scripts/architecture/verify-json-contracts.mjs
+node scripts/architecture/capture-golden-contracts.mjs --check
+
+echo "[0.6] package hygiene"
+node scripts/verify-package-hygiene.js
+
+echo "[0.7] authoritative Phase 1 security contracts"
+node scripts/test-dependency-security.mjs
+node scripts/test-network-policy.mjs
+node scripts/test-installer-trust-policy.mjs
+node scripts/test-workspace-archive-containment.mjs
+node scripts/test-public-repo-clone.mjs
+node scripts/test-process-approval-safety.mjs
+node scripts/test-mutation-preview-transaction.mjs
+node scripts/test-preview-screenshot-adapter.mjs
+node scripts/test-frontend-preview-service.mjs
+node scripts/test-prompt-workspace-resolver.mjs
+node scripts/test-context-secret-hygiene.mjs
+node scripts/test-vigflow-client.mjs
+node scripts/test-operator-client.mjs
+node scripts/test-mcp-context-client.mjs
+node scripts/test-code-operations-service.mjs
+node scripts/test-capability-health-service.mjs
+node scripts/test-model-transport-service.mjs
+node scripts/test-chat-tool-call-parser.mjs
+node scripts/test-chat-prompt-policy.mjs
+node scripts/test-tool-capability-providers.mjs
+node scripts/test-agent-stream-state.mjs
+node scripts/test-direct-output-policy.mjs
+node scripts/test-runtime-temp.mjs
+
+echo "[0.8] authoritative Phase 2 state/auth/session contracts"
+node scripts/test-durable-json-state.mjs
+node scripts/test-auth-state.mjs
+node scripts/test-session-durable-lifecycle.mjs
+node scripts/test-session-project-match.mjs
+node scripts/test-external-client-resume.mjs
+node scripts/test-context-state-ownership.mjs
+node scripts/test-game-command.mjs
+
+echo "[0.9] Phase 3 command error/exit/JSON foundation"
+node scripts/test-command-contract.mjs
+node scripts/test-update-policy.mjs
+node scripts/test-release-delivery.mjs
+node scripts/test-timeout-cancellation.mjs
+
+echo "[1.1] ranker includes agent.py in top 10 for an SSE prompt"
+RANKER_FIXTURE="$VALIDATION_TMP/ranker" node --input-type=module - <<'EOF'
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildSemanticContext } from './dist/utils/context-ranker.js';
+const fixture = process.env.RANKER_FIXTURE;
+fs.mkdirSync(fixture, { recursive: true });
+fs.writeFileSync(path.join(fixture, 'agent.py'), 'def stream_sse_event():\n    return "event: done"\n');
+fs.writeFileSync(path.join(fixture, 'unrelated.txt'), 'static documentation\n');
+const result = buildSemanticContext(fixture, 'fix the streaming SSE event handler', 10);
+const index = result.topFiles.findIndex((file) => file.path === 'agent.py');
+console.log(`agent_idx_top10=${index}`);
+if (index < 0) process.exit(1);
+EOF
+
+echo "[2.1/2.4] TypeScript post-write validator"
+node --input-type=module - <<'EOF'
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -66,127 +128,36 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'vig-tsc-'));
 fs.mkdirSync(path.join(tmp, 'src'));
 fs.writeFileSync(path.join(tmp, 'tsconfig.json'), JSON.stringify({ compilerOptions: { target: 'ES2020', module: 'ESNext' }, include: ['src/**/*.ts'] }));
 fs.writeFileSync(path.join(tmp, 'src', 'index.ts'), 'export const ok:number = 1;\n');
-const res = await runPostWriteValidation(tmp);
-const tsc = res.find((r)=>r.tool==='tsc');
+const results = await runPostWriteValidation(tmp);
+const tsc = results.find((result) => result.tool === 'tsc');
 console.log(JSON.stringify(tsc || null));
 if (!tsc || !tsc.ran || !tsc.passed) process.exit(1);
-EOF2
-
-echo "[6.2] balanced-4b no-agent path"
-for attempt in 1 2 3; do
-  if $CLI chat --no-agent --model balanced-4b --prompt "reply exactly: ok" --json >/tmp/vig-balanced.json; then
-    break
-  fi
-  if [[ "$attempt" == "3" ]]; then
-    echo "[fail] balanced-4b remained unavailable after 3 attempts"
-    exit 1
-  fi
-  echo "[retry] balanced-4b transient failure ($attempt/3)"
-  sleep 2
-done
-python3 - << 'PY'
-import json
-j=json.load(open('/tmp/vig-balanced.json'))
-assert j.get('success') is True
-assert j.get('model') in ('Vigthoria-v4-Assistant-9B', 'vigthoria-balanced-4b', 'vigthoria-v3-balanced-4b'), j
-print('[pass] balanced-4b')
-PY
-
-echo "[6.9/6.12] aliases available"
-$CLI hyper-loop status >/tmp/vig-hyperloop.txt
-$CLI devtools connect >/tmp/vig-devtools.txt
-
-echo "[6.11] operator flow"
-if [[ "$SERVICE_IDENTITY_MODE" == "1" ]]; then
-  echo "[skip] paid-user operator probe (isolated release service identity)"
-else
-  $CLI operator --prompt "reply with exactly: OK" --json >/tmp/vig-operator.json
-  python3 - << 'PY'
-import json
-j=json.load(open('/tmp/vig-operator.json'))
-assert j.get('success') is True, j
-print('[pass] operator flow')
-PY
-fi
-
-echo "[7.1/7.3/7.4] local service health"
-for u in http://localhost:8030/health http://localhost:4009/health http://localhost:4011/health; do
-  code=$(curl -s -o /dev/null -w "%{http_code}" "$u")
-  echo "$u => $code"
-  [[ "$code" == "200" ]]
-done
-
-echo "[7.2/7.8/12.3] models inventory"
-curl -s http://localhost:4009/v1/models >/tmp/vig-models.json
-python3 - << 'PY'
-import json
-import re
-ids={m.get('id','') for m in json.load(open('/tmp/vig-models.json')).get('data',[])}
-if ids:
-  has_router = any(
-    m in ids for m in (
-      'Vigthoria-v4-Assistant-9B',
-      'vigthoria-balanced-4b', 'vigthoria-balanced-4b:latest',
-      'vigthoria-v3-balanced-4b', 'vigthoria-v3-balanced-4b:latest',
-      'vigthoria-fast-9b', 'vigthoria-fast-9b:latest',
-    )
-  )
-  has_creative = any(
-    m in ids for m in (
-      'Vigthoria-v4-Creative-27B',
-      'vigthoria-creative-9b-v4', 'vigthoria-creative-9b-v4:latest',
-      'vigthoria-fast-9b', 'vigthoria-fast-9b:latest',
-    )
-  )
-  has_code = 'Vigthoria-v4-Code-27B' in ids or any(re.search(r'^vigthoria-v3(?:\.\d+)?-code-35b(?:-|:|$)', i) for i in ids)
-  assert has_router, f'missing router model in inventory: {sorted(ids)}'
-  assert has_creative, f'missing creative/fast model in inventory: {sorted(ids)}'
-  assert has_code, f'missing code model in inventory: {sorted(ids)}'
-else:
-  print('[warn] model inventory empty on this host; route proof above is authoritative')
-print('[pass] model inventory gates')
-PY
-
-echo "[7.5 policy] secured hyperloop endpoint"
-code=$(curl -s -o /dev/null -w "%{http_code}" https://coder.vigthoria.io/api/hyperloop/health)
-echo "unauth_hyperloop_code=$code"
-# 401 = correct JSON auth error for API callers. 302 (redirect to /login) is
-# also acceptable defense-in-depth: it still requires auth, just via the
-# browser-session redirect path some legacy middleware uses.
-[[ "$code" == "401" || "$code" == "302" ]]
+EOF
+
+echo "[6.2/12.1] deterministic routing and model-governance contracts"
+node scripts/test-request-intent.js
+VIGTHORIA_AGENT_LLM_ROUTER=0 node scripts/test-agent-route.js
+VIGTHORIA_AGENT_LLM_ROUTER=0 node scripts/test-local-use-cases.js
+node scripts/test-fast-router-capability.js
+node scripts/test-agent-routing-policy.js
+node scripts/test-model-governance-no-agent.js
+node scripts/test-model-governance.mjs
+
+echo "[context] deterministic budget, path, stream, error, and outcome contracts"
+node scripts/test-context-budget.js
+node scripts/test-v3-workspace-path.js
+node scripts/test-v3-stream-events.js
+node scripts/test-v3-agent-client.mjs
+node scripts/test-v3-workspace-service.mjs
+node scripts/test-error-wording.mjs
+node scripts/test-agent-run-outcome.js
 
 echo "[8.2] runtime symlink guard signals"
-rg -n "realpathSync|results.length >= maxFiles|pattern = kw.length <= 4" dist/utils/context-ranker.js >/tmp/vig-ranker-signals.txt
-cat /tmp/vig-ranker-signals.txt
-
-echo "[9.5/9.7/9.16] release URL consistency"
-rg -n "coder.vigthoria.io/releases" install.ps1 install.sh README.md >/tmp/vig-release-urls.txt
-cat /tmp/vig-release-urls.txt
-
-echo "[12.1] no-agent governance fallback"
-for attempt in 1 2 3; do
-  if $CLI chat --no-agent --model creative-v4 --prompt "say ok" --json >/tmp/vig-creative.json; then
-    break
-  fi
-  if [[ "$attempt" == "3" ]]; then
-    echo "[fail] governance fallback remained unavailable after 3 attempts"
-    exit 1
-  fi
-  echo "[retry] governance fallback transient failure ($attempt/3)"
-  sleep 2
-done
-python3 - << 'PY'
-import json
-j=json.load(open('/tmp/vig-creative.json'))
-assert j.get('success') is True
-assert j.get('model') == 'Vigthoria-v4-Code-27B', j
-md=j.get('metadata') or {}
-fb=md.get('modelFallback') or {}
-assert fb.get('reason') == 'governance-blocked-model', j
-print('[pass] governance fallback metadata')
-PY
-
-echo "[outcome-truth] agent run outcome regression"
-npm run test:agent:outcome
-
-echo "ALL NO-GO GATES PASSED"
+rg -n "realpathSync|results.length >= maxFiles|pattern = kw.length <= 4" dist/utils/context-ranker.js >"$VALIDATION_TMP/ranker-signals.txt"
+cat "$VALIDATION_TMP/ranker-signals.txt"
+
+echo "[9.5/9.7/9.16] release policy and canonical URL consistency"
+rg -n "extension.vigthoria.io/downloads/manifest.json|release-policy.json|resolve-release-manifest" release-policy.json install.ps1 install.sh src/utils/release-policy.ts scripts/release >"$VALIDATION_TMP/release-urls.txt"
+cat "$VALIDATION_TMP/release-urls.txt"
+
+echo "ALL HERMETIC NO-GO GATES PASSED"

package/scripts/release/verify-runtime-consistency.mjs

@@ -38,6 +38,8 @@ const requiredDist = ['context-ranker.js', 'post-write-validator.js', 'task-disp
 const sourceSnapshotExpected = !isNodeModulesInstall && exists(srcUtils);
 const missingSrc = sourceSnapshotExpected ? requiredSrc.filter((f) => !exists(path.join(srcUtils, f))) : [];
 const missingDist = requiredDist.filter((f) => !exists(path.join(distUtils, f)));
+const requiredDelivery = ['release-policy.json', 'completions/vigthoria.bash', 'completions/_vigthoria', 'completions/vigthoria.fish'];
+const missingDelivery = requiredDelivery.filter((file) => !exists(path.join(projectRoot, file)));
 
 const report = {
   targetVersion,
@@ -48,6 +50,7 @@ const report = {
   distUtils,
   missingSrc,
   missingDist,
+  missingDelivery,
 };
 
 console.log(JSON.stringify(report, null, 2));
@@ -56,7 +59,7 @@ if (report.packageVersion !== targetVersion) {
   console.error(`[verify] FAIL: version mismatch (${report.packageVersion} != ${targetVersion})`);
   process.exit(1);
 }
-if (missingSrc.length > 0 || missingDist.length > 0) {
+if (missingSrc.length > 0 || missingDist.length > 0 || missingDelivery.length > 0) {
   console.error('[verify] FAIL: required utility modules missing');
   process.exit(1);
 }

package/dist/commands/index.d.ts

@@ -1,12 +0,0 @@
-import { Command } from 'commander';
-export interface CommandRegistrationResult {
-    name: string;
-    registered: boolean;
-    error?: Error;
-}
-export type CommandRegistrar = (program: Command) => void;
-export declare function resolveCommand(name: string): CommandRegistrar | null;
-export declare function registerCommands(cli: any): void;
-export declare const setupCommands: typeof registerCommands;
-export declare const configureCommands: typeof registerCommands;
-export default registerCommands;