vigthoria-cli 1.13.23 → 1.13.25

package/completions/_vigthoria

@@ -36,7 +36,7 @@ _vigthoria() {
     'replay:Replay events from a V3 agent run step-by-step'
     'repo:Push and pull projects to/from your Vigthoria Community Repository'
     'review:Review code quality'
-    'security:Run security scans, scores, and fix plans via Vigthoria MCP security tools'
+    'security:Run bounded local security scans, scores, and reviewed fix plans'
     'status:Show authentication and subscription status'
     'update:Check for updates and upgrade Vigthoria CLI. Default manifest: https://extension.vigthoria.io/downloads/manifest.json'
     'v4:Launch Vigthoria V4 Operating Agent (DeerFlow 2.0 harness)'

package/completions/vigthoria.fish

@@ -32,7 +32,7 @@ complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'pr
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'replay' -d 'Replay events from a V3 agent run step-by-step'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'repo' -d 'Push and pull projects to/from your Vigthoria Community Repository'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'review' -d 'Review code quality'
-complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'security' -d 'Run security scans, scores, and fix plans via Vigthoria MCP security tools'
+complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'security' -d 'Run bounded local security scans, scores, and reviewed fix plans'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'status' -d 'Show authentication and subscription status'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'update' -d 'Check for updates and upgrade Vigthoria CLI. Default manifest: https://extension.vigthoria.io/downloads/manifest.json'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'v4' -d 'Launch Vigthoria V4 Operating Agent (DeerFlow 2.0 harness)'

package/dist/commands/auth.js

@@ -2,9 +2,10 @@ import chalk from 'chalk';
 import readline from 'readline';
 import { Config } from '../utils/config.js';
 import { clearGatewayPreflightCache } from '../utils/cli-state.js';
-import { AuthSessionService } from '../utils/auth-session.js';
+import { AuthSessionService, validateTokenStructure } from '../utils/auth-session.js';
 import { assertTrustedEndpoint, guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
+import { normalizeSubscriptionResponse } from '../utils/subscription-policy.js';
 const DEFAULT_API_URL = 'https://coder.vigthoria.io';
 const KNOWN_AUTH_BASE_URLS = ['https://coder.vigthoria.io'];
 class HttpError extends Error {
@@ -228,13 +229,17 @@ export async function login(email, password) {
         }
         const authBases = getAuthBaseCandidates(getApiUrl());
         const endpointVariants = [
-            { path: '/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
-            { path: '/api/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
-            { path: '/api/login-json', body: { identifier: resolvedEmail, password: resolvedPassword } },
+            // `/api/login` is the public Coder credential exchange. Older routes are
+            // compatibility fallbacks and may only be tried when a route is absent;
+            // retrying a decisive auth response consumes rate-limit budget and can
+            // turn an authorization or server-contract failure into a false
+            // "invalid password" report.
             { path: '/api/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/login-json', body: { identifier: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
         ];
         const attempted = [];
-        const failures = [];
         for (const base of authBases) {
             for (const variant of endpointVariants) {
                 const endpoint = `${trimTrailingSlash(base)}${variant.path}`;
@@ -246,19 +251,35 @@ export async function login(email, password) {
                     });
                     const token = extractAuthToken(result);
                     if (!token) {
-                        failures.push(`${endpoint} -> success without token`);
-                        continue;
+                        throw new CliCommandError('The Vigthoria login service accepted the request but did not issue an access token.', {
+                            code: 'LOGIN_TOKEN_MISSING', category: 'authentication', status: 502,
+                        });
                     }
                     const normalizedBase = trimTrailingSlash(base);
-                    const v3ServiceKey = await fetchV3ServiceKey(normalizedBase, token);
+                    try {
+                        validateTokenStructure(token, normalizedBase);
+                    }
+                    catch (error) {
+                        throw new CliCommandError(`The Vigthoria login service issued a token that the CLI cannot safely accept: ${humanMessage(error)}`, {
+                            code: 'LOGIN_TOKEN_INVALID', category: 'authentication', status: 502, cause: error,
+                        });
+                    }
                     const identity = extractAuthUser(result, resolvedEmail);
                     const refreshToken = result.tokens?.refresh_token || undefined;
                     await new AuthSessionService(new Config()).validateAndPersistToken(token, {
                         apiUrl: normalizedBase,
                         refreshToken,
                         identity: { userId: identity?.id, email: identity?.email },
-                        v3ServiceKey: v3ServiceKey || null,
+                        v3ServiceKey: null,
                     });
+                    const issuedSubscription = normalizeSubscriptionResponse(result);
+                    if (issuedSubscription)
+                        new Config().setSubscription(issuedSubscription);
+                    // Only present the newly issued token to secondary authenticated
+                    // endpoints after its structure and Coder acceptance are proven.
+                    const v3ServiceKey = await fetchV3ServiceKey(normalizedBase, token);
+                    if (v3ServiceKey)
+                        new Config().setAuth({ token, v3ServiceKey });
                     const config = {
                         apiUrl: normalizedBase,
                         token,
@@ -270,15 +291,41 @@ export async function login(email, password) {
                     return config;
                 }
                 catch (error) {
+                    if (error instanceof CliCommandError)
+                        throw error;
                     if (error instanceof HttpError && error.code === 'SUBSCRIPTION_REQUIRED') {
                         throw error;
                     }
-                    const message = humanMessage(error);
-                    failures.push(`${endpoint} -> ${message}`);
+                    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) {
+                        continue;
+                    }
+                    if (error instanceof HttpError && error.status === 401) {
+                        throw new CliCommandError('Invalid email or password. Please check your credentials and try again.', {
+                            code: error.code || 'LOGIN_FAILED', category: 'authentication', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status === 403) {
+                        throw new CliCommandError(humanMessage(error), {
+                            code: error.code || 'LOGIN_FORBIDDEN', category: 'authorization', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status === 429) {
+                        throw new CliCommandError('Too many login attempts. Wait for the authentication rate limit to reset, then try once.', {
+                            code: 'LOGIN_RATE_LIMITED', category: 'authentication', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status >= 500) {
+                        throw new CliCommandError(`Vigthoria authentication is temporarily unavailable: ${humanMessage(error)}`, {
+                            code: error.code || 'LOGIN_SERVICE_UNAVAILABLE', category: 'network', status: error.status, cause: error,
+                        });
+                    }
+                    throw error;
                 }
             }
         }
-        throw new Error('Invalid email or password. Please check your credentials and try again.');
+        throw new CliCommandError(`No supported login route is available on the configured Vigthoria endpoint. Tried ${attempted.join(', ')}.`, {
+            code: 'LOGIN_ROUTE_UNAVAILABLE', category: 'configuration', status: 404,
+        });
     }
     catch (error) {
         const message = humanMessage(error);
@@ -426,12 +473,14 @@ export async function handleLogin(options = {}) {
             });
             if (subResponse.ok) {
                 const sub = await subResponse.json();
+                const normalizedSubscription = normalizeSubscriptionResponse(sub);
                 const subRecord = (sub.subscription && typeof sub.subscription === 'object') ? sub.subscription : {};
                 const userRecord = (sub.user && typeof sub.user === 'object') ? sub.user : {};
-                const plan = String(sub.plan || subRecord.plan || userRecord.plan || userRecord.subscription_plan || '').trim();
                 const role = String(sub.role || subRecord.role || userRecord.role || userRecord.user_role || '').trim();
-                if (plan) {
-                    console.log(`Plan:  ${plan.toUpperCase()}`);
+                if (normalizedSubscription)
+                    new Config().setSubscription(normalizedSubscription);
+                if (normalizedSubscription) {
+                    console.log(`Plan:  ${normalizedSubscription.plan.toUpperCase()}`);
                 }
                 if (role) {
                     console.log(`Role:  ${role}`);
@@ -565,8 +614,11 @@ export function registerAuthCommands(program) {
         try {
             const user = await whoami();
             if (!user) {
-                console.log(chalk.yellow('Not logged in.'));
-                return;
+                throw new CliCommandError('Not logged in.', {
+                    code: 'AUTHENTICATION_REQUIRED',
+                    category: 'authentication',
+                    status: 401,
+                });
             }
             console.log(chalk.green('Logged in.'));
             console.log(user.email || user.name || user.id || 'Authenticated user');

package/dist/commands/chat.js

@@ -20,6 +20,7 @@ import { runAgentSessionMenu, shouldShowAgentSessionMenu } from './agent-session
 import { V4Command } from './v4.js';
 import { renderDynamicHelp } from '../utils/command-menu.js';
 import { resolvePromptWorkspace } from '../utils/prompt-workspace-resolver.js';
+import { FileUtils } from '../utils/files.js';
 import { isDirectModeFollowUpQuestion, sanitizeDirectModeOutput, stripHiddenThoughtBlocks } from '../utils/direct-output-policy.js';
 import { createLiveOutcome, evaluateExecutorSuccess, handleRunCompleteEvent, handleTaskEvent, isSubstantiveAgentAnswer, isToolEvidenceStubAnswer, normalizeAgentAnswerContent, noteAnalysisToolUse, } from '../utils/agentRunOutcome.js';
 import { looksLikeMarkdownReport, renderMarkdownToTerminal, summarizeMarkdownReport, } from '../utils/terminalMarkdown.js';
@@ -2028,6 +2029,42 @@ export class ChatCommand {
         }
     }
     async runSimplePrompt(prompt) {
+        let directWorkspaceGrounding = '';
+        if (this.directPromptMode && !this.agentMode && !this.operatorMode && this.isRepoGroundedPrompt(prompt)) {
+            const expectedFiles = this.api.extractExpectedWorkspaceFiles(prompt).slice(0, 8);
+            if (expectedFiles.length === 0) {
+                throw new CliCommandError('Grounded --no-agent chat requires an explicit workspace-relative file path. Use agent mode for repository-wide inspection.', {
+                    code: 'GROUNDING_FILE_REQUIRED', category: 'usage',
+                });
+            }
+            const reader = new FileUtils(this.currentProjectPath, this.config.get('project')?.ignorePatterns || []);
+            const excerpts = [];
+            let totalBytes = 0;
+            for (const requestedPath of expectedFiles) {
+                const file = reader.readFile(requestedPath);
+                if (!file) {
+                    throw new CliCommandError(`Grounded no-agent chat could not safely read the requested file: ${path.basename(requestedPath)}`, {
+                        code: 'GROUNDING_FILE_UNAVAILABLE', category: 'execution',
+                    });
+                }
+                const remaining = 32 * 1024 - totalBytes;
+                if (remaining <= 0)
+                    break;
+                const content = file.content.slice(0, Math.min(16 * 1024, remaining));
+                totalBytes += Buffer.byteLength(content, 'utf8');
+                excerpts.push(`FILE ${file.relativePath.replace(/\\/g, '/')} (${file.lines} lines):\n${content}`);
+            }
+            if (expectedFiles.length > 0 && excerpts.length === 0) {
+                throw new CliCommandError('Grounded no-agent chat found no safe readable requested files.', {
+                    code: 'GROUNDING_FILE_UNAVAILABLE', category: 'execution',
+                });
+            }
+            directWorkspaceGrounding = [
+                'Repository grounding is provided below from the local workspace.',
+                'Treat it as the only source of truth. Never invent content that is absent.',
+                excerpts.join('\n\n'),
+            ].join('\n\n');
+        }
         if (!this.directPromptMode && !this.operatorMode) {
             const isWriteFollowUp = isConfirmationFollowUp(prompt) || isWritePermissionGrant(prompt);
             if (isWriteFollowUp && (this.lastActionableUserInput || this.getPreviousActionablePrompt())) {
@@ -2090,7 +2127,10 @@ export class ChatCommand {
             else {
                 this.messages.push({
                     role: 'system',
-                    content: 'Answer the user\'s question directly and concisely. Do not describe tools, platform constraints, or capabilities unless explicitly asked. If the user\'s instruction is to produce specific output, produce exactly that output with no preamble.',
+                    content: [
+                        'Answer the user\'s question directly and concisely. Do not describe tools, platform constraints, or capabilities unless explicitly asked. If the user\'s instruction is to produce specific output, produce exactly that output with no preamble.',
+                        directWorkspaceGrounding,
+                    ].filter(Boolean).join('\n\n'),
                 });
             }
         }

package/dist/commands/config.d.ts

@@ -8,6 +8,7 @@ interface ConfigOptions {
     get?: string;
     list?: boolean;
     reset?: boolean;
+    yes?: boolean;
 }
 interface InitOptions {
     model?: string;

package/dist/commands/config.js

@@ -18,7 +18,7 @@ export class ConfigCommand {
     }
     async run(options) {
         if (options.reset) {
-            await this.resetConfig();
+            await this.resetConfig(Boolean(options.yes));
             return;
         }
         if (options.set) {
@@ -151,17 +151,36 @@ export class ConfigCommand {
     setConfig(keyValue) {
         const [key, ...valueParts] = keyValue.split('=');
         const value = valueParts.join('=');
-        if (!key || value === undefined) {
+        if (!keyValue.includes('=') || !key || !value) {
             throw new CliCommandError('Invalid format. Use: vigthoria config --set key=value', {
                 code: 'INVALID_CONFIG_ASSIGNMENT', category: 'usage',
             });
         }
+        const parseBoolean = (v) => {
+            if (v !== 'true' && v !== 'false')
+                throw new Error('Boolean configuration values must be true or false.');
+            return v === 'true';
+        };
         const configMap = {
-            'model': (v) => this.config.set('preferences', { ...this.config.get('preferences'), defaultModel: v }),
-            'theme': (v) => this.config.set('preferences', { ...this.config.get('preferences'), theme: v }),
-            'autoApply': (v) => this.config.set('preferences', { ...this.config.get('preferences'), autoApplyFixes: v === 'true' }),
-            'showDiffs': (v) => this.config.set('preferences', { ...this.config.get('preferences'), showDiffs: v === 'true' }),
-            'maxTokens': (v) => this.config.set('preferences', { ...this.config.get('preferences'), maxTokens: parseInt(v, 10) }),
+            'model': (v) => {
+                const allowed = new Set(['architect', 'code', 'assistant', 'code-35b', 'code-9b', 'balanced', 'balanced-4b']);
+                if (!allowed.has(v))
+                    throw new Error(`Invalid model: ${v}`);
+                this.config.set('preferences', { ...this.config.get('preferences'), defaultModel: v });
+            },
+            'theme': (v) => {
+                if (v !== 'dark' && v !== 'light')
+                    throw new Error('Theme must be dark or light.');
+                this.config.set('preferences', { ...this.config.get('preferences'), theme: v });
+            },
+            'autoApply': (v) => this.config.set('preferences', { ...this.config.get('preferences'), autoApplyFixes: parseBoolean(v) }),
+            'showDiffs': (v) => this.config.set('preferences', { ...this.config.get('preferences'), showDiffs: parseBoolean(v) }),
+            'maxTokens': (v) => {
+                const parsed = Number(v);
+                if (!Number.isSafeInteger(parsed) || parsed < 256 || parsed > 1_000_000)
+                    throw new Error('maxTokens must be an integer between 256 and 1000000.');
+                this.config.set('preferences', { ...this.config.get('preferences'), maxTokens: parsed });
+            },
             'apiUrl': (v) => this.config.set('apiUrl', assertTrustedEndpoint(v, { audience: 'coder' }).toString().replace(/\/$/, '')),
             'modelsApiUrl': (v) => this.config.set('modelsApiUrl', assertTrustedEndpoint(v, { audience: 'models' }).toString().replace(/\/$/, '')),
             'wsUrl': (v) => this.config.set('wsUrl', assertTrustedWebSocketEndpoint(v, 'coder').toString().replace(/\/$/, '')),
@@ -257,8 +276,13 @@ export class ConfigCommand {
         console.log(chalk.gray(`Config file: ${this.config.getConfigPath()}`));
         console.log();
     }
-    async resetConfig() {
-        const { confirm } = await inquirer.prompt([
+    async resetConfig(confirmedByFlag = false) {
+        if (!confirmedByFlag && !process.stdin.isTTY) {
+            throw new CliCommandError('Configuration reset requires --yes in non-interactive mode.', {
+                code: 'CONFIRMATION_REQUIRED', category: 'usage',
+            });
+        }
+        const { confirm } = confirmedByFlag ? { confirm: true } : await inquirer.prompt([
             {
                 type: 'confirm',
                 name: 'confirm',

package/dist/commands/game.d.ts

@@ -4,6 +4,10 @@ type CommonOptions = {
     project?: string;
     packageManager?: Manager;
 };
+export declare function gameProcessInvocation(pm: Manager, args: readonly string[], platform?: NodeJS.Platform, comSpec?: string): {
+    executable: string;
+    args: string[];
+};
 export declare class GameCommand {
     private logger;
     constructor(logger: Logger);

package/dist/commands/game.js

@@ -24,7 +24,25 @@ const manager = (root, requested) => {
         return 'bun';
     return 'npm';
 };
-const run = (pm, args, cwd, timeoutMs = 10 * 60_000) => new Promise((resolve, reject) => { const executable = process.platform === 'win32' ? `${pm}.cmd` : pm; assertProcessNetworkAllowed(executable, args); const child = spawn(executable, args, { cwd, stdio: 'inherit', windowsHide: true, env: safeChildProcessEnv() }); let interrupted = false; const onInterrupt = () => { interrupted = true; child.kill('SIGINT'); }; process.once('SIGINT', onInterrupt); const timer = timeoutMs > 0 ? setTimeout(() => { child.kill('SIGTERM'); reject(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })); }, timeoutMs) : null; const finish = () => { if (timer)
+export function gameProcessInvocation(pm, args, platform = process.platform, comSpec = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe')) {
+    const executable = platform === 'win32' && pm !== 'bun' ? `${pm}.cmd` : pm;
+    assertProcessNetworkAllowed(executable, args);
+    if (platform !== 'win32' || !executable.endsWith('.cmd'))
+        return { executable, args: [...args] };
+    // Node does not directly execute CMD wrappers reliably on current Windows
+    // releases. This adapter is deliberately narrower than a general shell:
+    // the package manager is an enum and every token must be inert cmd.exe data.
+    const safeToken = /^[A-Za-z0-9@._:/\\=-]+$/;
+    if (!/^(?:install|run)$/.test(String(args[0] || '')) || args.some((arg) => !safeToken.test(arg))) {
+        throw new CliCommandError('Unsafe Windows package-manager argument rejected.', {
+            code: 'GAME_PROCESS_ARGUMENT_REJECTED',
+            category: 'usage',
+        });
+    }
+    const command = [executable, ...args].map((token) => `"${token}"`).join(' ');
+    return { executable: comSpec, args: ['/d', '/s', '/c', command] };
+}
+const run = (pm, args, cwd, timeoutMs = 10 * 60_000) => new Promise((resolve, reject) => { const invocation = gameProcessInvocation(pm, args); const child = spawn(invocation.executable, invocation.args, { cwd, stdio: 'inherit', windowsHide: true, env: safeChildProcessEnv() }); let interrupted = false; const onInterrupt = () => { interrupted = true; child.kill('SIGINT'); }; process.once('SIGINT', onInterrupt); const timer = timeoutMs > 0 ? setTimeout(() => { child.kill('SIGTERM'); reject(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })); }, timeoutMs) : null; const finish = () => { if (timer)
     clearTimeout(timer); process.removeListener('SIGINT', onInterrupt); }; child.once('error', error => { finish(); reject(error); }); child.once('exit', (code, signal) => { finish(); if (interrupted)
     reject(new CliCommandError(`${pm} command cancelled by user`, { code: 'GAME_PROCESS_CANCELLED', category: 'cancelled' }));
 else

package/dist/commands/hub.d.ts

@@ -10,6 +10,8 @@ export declare class HubCommand {
     private config;
     constructor(config: Config, _logger: Logger);
     private getAuthToken;
+    private normalizeModule;
+    private moduleCatalog;
     /**
      * Search for modules by natural language query
      */

package/dist/commands/hub.js

@@ -7,7 +7,7 @@
 import chalk from 'chalk';
 import { guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
-const API_BASE = 'https://api.vigthoria.io';
+const API_BASE = 'https://hub.vigthoria.io';
 export class HubCommand {
     config;
     constructor(config, _logger) {
@@ -26,23 +26,47 @@ export class HubCommand {
         }
         return token;
     }
+    normalizeModule(raw) {
+        const unit = String(raw.pricing?.unit || raw.unit || 'request');
+        const rawCost = raw.pricing?.cost ?? raw.creditsPerUnit ?? 0;
+        const cost = typeof rawCost === 'number' ? rawCost : Number.NaN;
+        const displayCost = typeof rawCost === 'string' ? rawCost : `${rawCost} credits per ${unit.toLowerCase()}`;
+        return {
+            id: String(raw.id || ''),
+            name: String(raw.name || raw.id || 'Unknown module'),
+            description: String(raw.description || ''),
+            endpoint: String(raw.endpoint || ''),
+            documentation: String(raw.documentation || 'https://hub.vigthoria.io/subscriptions'),
+            pricing: { unit, cost: Number.isFinite(cost) ? cost : 0, example: displayCost },
+            status: String(raw.status || 'available'),
+            category: String(raw.category || 'api'),
+            tags: Array.isArray(raw.tags) ? raw.tags.map(String) : [],
+            unit,
+            creditsPerUnit: raw.creditsPerUnit,
+            euroPerUnit: raw.euroPerUnit,
+        };
+    }
+    async moduleCatalog() {
+        const response = await guardedFetch(`${API_BASE}/api/modules`, {}, { audience: 'hub' });
+        if (!response.ok)
+            throw new CliCommandError(`Failed to load module catalog: ${response.statusText}`, { code: 'HUB_CATALOG_FAILED', status: response.status });
+        const data = await response.json();
+        if (!Array.isArray(data.modules))
+            throw new CliCommandError('Module Hub returned a malformed catalog.', { code: 'HUB_CATALOG_INVALID' });
+        return data.modules.map((module) => this.normalizeModule(module)).filter((module) => module.id);
+    }
     /**
      * Search for modules by natural language query
      */
     async search(query) {
         console.log(chalk.cyan('\n🔍 Searching Vigthoria Module Hub...\n'));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/search`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({ query })
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error(`Search failed: ${response.statusText}`);
-            }
-            const data = await response.json();
+            const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+            const results = (await this.moduleCatalog()).map((module) => ({
+                ...module,
+                score: terms.reduce((score, term) => score + (`${module.id} ${module.name} ${module.description}`.toLowerCase().includes(term) ? 1 : 0), 0),
+            })).filter((module) => module.score > 0).sort((a, b) => b.score - a.score);
+            const data = { results };
             if (data.results.length === 0) {
                 console.log(chalk.yellow('No modules found matching your query.'));
                 console.log(chalk.gray('Try: vigthoria hub list  to see all available modules\n'));
@@ -50,7 +74,7 @@ export class HubCommand {
             }
             console.log(chalk.green(`Found ${data.results.length} module(s):\n`));
             data.results.forEach((module, index) => {
-                const statusColor = module.status === 'active' ? chalk.green : chalk.gray;
+                const statusColor = module.status === 'available' ? chalk.green : chalk.gray;
                 console.log(chalk.bold.white(`  ${index + 1}. ${module.name}`));
                 console.log(chalk.gray(`     ${module.description.substring(0, 80)}...`));
                 console.log(chalk.cyan(`     💰 ${module.pricing.example}`));
@@ -82,7 +106,8 @@ export class HubCommand {
             if (!response.ok) {
                 throw new CliCommandError(`Failed to list modules: ${response.statusText}`, { code: 'HUB_LIST_FAILED', status: response.status });
             }
-            const data = await response.json();
+            const rawData = await response.json();
+            const data = { modules: Array.isArray(rawData.modules) ? rawData.modules.map((module) => this.normalizeModule(module)) : [] };
             console.log(chalk.bold.white('Available Modules:\n'));
             // Group by category
             const grouped = data.modules.reduce((acc, module) => {
@@ -116,36 +141,15 @@ export class HubCommand {
      * Activate a module for the current user
      */
     async activate(moduleId) {
-        const authToken = this.getAuthToken();
+        this.getAuthToken();
         console.log(chalk.cyan(`\n🔌 Activating module: ${moduleId}...\n`));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/${moduleId}/activate`, {
-                method: 'POST',
-                headers: {
-                    'Authorization': `Bearer ${authToken}`,
-                    'Content-Type': 'application/json'
-                }
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                const errorData = await response.json();
-                throw new Error(errorData.error || response.statusText);
-            }
-            const data = await response.json();
-            console.log(chalk.green(`✅ ${data.message}`));
-            console.log();
-            console.log(chalk.white('📚 Documentation:'));
-            console.log(chalk.gray(`   ${data.documentation}`));
-            console.log();
-            console.log(chalk.white('🔗 Available Endpoints:'));
-            data.endpoints.forEach((ep) => {
-                console.log(chalk.gray(`   ${ep.method.padEnd(6)} ${ep.path}`));
-                console.log(chalk.gray(`         ${ep.description}`));
-            });
-            console.log();
-            console.log(chalk.cyan('💡 Quick Start:'));
-            console.log(chalk.gray(`   Use your API key in requests:`));
-            console.log(chalk.gray(`   Authorization: Bearer ${authToken.substring(0, 8)}...`));
-            console.log();
+            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            if (!module)
+                throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
+            console.log(chalk.green(`✅ ${module.name} is published in the Vigthoria module catalog.`));
+            console.log(chalk.gray('Hub modules do not use a separate activation mutation; the destination service evaluates account authorization and billing when used.'));
+            console.log(chalk.gray(`Documentation: ${module.documentation}`));
         }
         catch (error) {
             throw commandFailure(error, { code: 'HUB_ACTIVATION_FAILED' });
@@ -155,32 +159,18 @@ export class HubCommand {
      * Show currently active modules for user
      */
     async active() {
-        const authToken = this.getAuthToken();
-        console.log(chalk.cyan('\n📦 Your Active Modules\n'));
+        this.getAuthToken();
+        console.log(chalk.cyan('\n📦 Published Vigthoria Modules\n'));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/active`, {
-                headers: {
-                    'Authorization': `Bearer ${authToken}`
-                }
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error(`Failed to fetch: ${response.statusText}`);
-            }
-            const data = await response.json();
-            if (data.allAccess) {
-                console.log(chalk.green('🌟 You have access to ALL modules!\n'));
-            }
-            console.log(chalk.white(`Tier: ${chalk.cyan.bold(data.tier.toUpperCase())}`));
-            console.log();
-            if (data.activeModules.length === 0) {
-                console.log(chalk.yellow('No modules activated yet.'));
-                console.log(chalk.gray('\nActivate modules with: vigthoria hub activate <module>'));
-            }
+            const activeModules = await this.moduleCatalog();
+            console.log(chalk.white('Available modules (final authorization occurs at execution time):'));
+            if (activeModules.length === 0)
+                console.log(chalk.yellow('No modules are currently published.'));
             else {
-                console.log(chalk.white('Active modules:'));
-                data.activeModules.forEach((module) => {
+                activeModules.forEach((module) => {
                     console.log(chalk.green(`  ✅ ${module.name}`));
-                    console.log(chalk.gray(`     Endpoint: ${module.endpoint}`));
+                    if (module.endpoint)
+                        console.log(chalk.gray(`     Endpoint: ${module.endpoint}`));
                     console.log(chalk.yellow(`     Cost: ${module.pricing.example}`));
                     console.log();
                 });
@@ -196,11 +186,9 @@ export class HubCommand {
     async info(moduleId) {
         console.log(chalk.cyan(`\n📖 Module Info: ${moduleId}\n`));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/${moduleId}`, {}, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error('Module not found');
-            }
-            const module = await response.json();
+            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            if (!module)
+                throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
             console.log(chalk.bold.white(`${module.name}`));
             console.log(chalk.gray('─'.repeat(50)));
             console.log();
@@ -247,7 +235,7 @@ export class HubCommand {
                 console.log(chalk.gray(`External URL: ${module.external}`));
             }
             console.log();
-            console.log(chalk.cyan('To activate: ') + chalk.white(`vigthoria hub activate ${moduleId}`));
+            console.log(chalk.cyan('Authorization: ') + chalk.white('evaluated by the destination service when the module is used'));
             console.log();
         }
         catch (error) {
@@ -269,12 +257,7 @@ export class HubCommand {
         console.log(chalk.gray('  • "image generation for social media"\n'));
         console.log(chalk.cyan('Use: vigthoria hub search "<your use case>"'));
         console.log(chalk.gray('The AI will find the best modules for your needs.\n'));
-        // Show pricing tiers
-        console.log(chalk.white('💳 Subscription Tiers:'));
-        console.log(chalk.gray('  Starter    €49/mo   50 credits'));
-        console.log(chalk.gray('  Business   €199/mo  500 credits'));
-        console.log(chalk.gray('  Enterprise €499/mo  2000 credits'));
-        console.log();
-        console.log(chalk.cyan('Get started: https://landing.vigthoria.io/api-keys.html\n'));
+        console.log(chalk.gray('Current unit pricing is loaded from the live module catalog; account authorization is evaluated at execution time.'));
+        console.log(chalk.cyan('Manage access: https://hub.vigthoria.io/subscriptions\n'));
     }
 }

package/dist/commands/legion.d.ts

@@ -19,6 +19,7 @@ export type LegionOptions = {
     password?: string;
     [key: string]: any;
 };
+export declare function hasMasterAdminCortexAccess(plan: string, masterAccess: boolean, isMasterAdmin: boolean): boolean;
 export declare class LegionCommand {
     private config;
     private logger;

package/dist/commands/legion.js

@@ -33,6 +33,12 @@ function buildServerHyperloopUrls() {
         `http://${internalHost}:${port}${apiPath}`,
     ];
 }
+export function hasMasterAdminCortexAccess(plan, masterAccess, isMasterAdmin) {
+    const normalizedPlan = String(plan || '').trim().toLowerCase().replace(/-/g, '_');
+    if (isMasterAdmin || normalizedPlan === 'master_admin' || normalizedPlan === 'master_admin_plan')
+        return true;
+    return masterAccess && ['admin', 'enterprise', 'enterprise_ai', 'supreme_ai'].includes(normalizedPlan);
+}
 const CORTEX_WARN_BUDGET_USD = 3.5;
 const CORTEX_HARD_BUDGET_USD = 5.0;
 const CORTEX_MAX_ROUNDS = 2;
@@ -759,13 +765,7 @@ export class LegionCommand {
         };
     }
     isMasterAdminFree(plan, masterAccess, isMasterAdmin) {
-        if (!masterAccess) {
-            return false;
-        }
-        if (isMasterAdmin) {
-            return true;
-        }
-        return plan === 'master_admin';
+        return hasMasterAdminCortexAccess(plan, masterAccess, isMasterAdmin);
     }
     isCortexTestMode() {
         return process.env.VIGTHORIA_CORTEX_TEST_MODE === '1'

package/dist/commands/platform-registration.js

@@ -33,7 +33,7 @@ export function registerPlatformCommands(program, config, logger) {
         .option('--json', 'Emit JSON output', false).action(async (address, options) => new DeviceCommand(config, logger).disconnect(address, options));
     device.action(async () => new DeviceCommand(config, logger).status({}));
     const security = program.command('security').alias('vsec')
-        .description('Run security scans, scores, and fix plans via Vigthoria MCP security tools');
+        .description('Run bounded local security scans, scores, and reviewed fix plans');
     security.command('scan').description('Scan project for security issues').option('-d, --dir <path>', 'Directory to scan (default: current directory)')
         .option('--json', 'Emit JSON output', false).action(async (options) => new SecurityCommand(config, logger).scan({ dir: options.dir, json: options.json }));
     security.command('score').description('Calculate project security score').option('-d, --dir <path>', 'Directory to score (default: current directory)')