vigthoria-cli 1.13.23 → 1.13.25

package/dist/commands/product-run-registration.js

@@ -142,11 +142,13 @@ export function registerProductAndRunCommands(program, config, logger) {
     });
     repoCommand
         .command('review [reviewId]')
-        .description('Show repository security review status, findings, and retry guidance')
+        .description('Show or clean repository security review state')
+        .option('--cleanup', 'Remove the quarantined payload and review object while retaining a hash-only audit record', false)
+        .option('-y, --yes', 'Confirm cleanup without an interactive prompt', false)
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (reviewId, options) => {
         const repo = new RepoCommand(config, logger);
-        await repo.review(reviewId, { json: options.json });
+        await repo.review(reviewId, { json: options.json, cleanup: options.cleanup, yes: options.yes });
     });
     repoCommand
         .command('pull <name>')

package/dist/commands/repo.d.ts

@@ -72,6 +72,8 @@ export declare class RepoCommand {
      */
     review(reviewId?: string, options?: {
         json?: boolean;
+        cleanup?: boolean;
+        yes?: boolean;
     }): Promise<void>;
     private materializeProject;
     /**

package/dist/commands/repo.js

@@ -502,6 +502,43 @@ export class RepoCommand {
      */
     async review(reviewId, options = {}) {
         this.requireAuth();
+        if (options.cleanup) {
+            if (!reviewId) {
+                throw new CliCommandError('A review ID is required with --cleanup', {
+                    code: 'REPOSITORY_REVIEW_ID_REQUIRED', category: 'usage',
+                });
+            }
+            if (!options.yes) {
+                if (options.json || !process.stdin.isTTY) {
+                    throw new CliCommandError('Repository review cleanup requires --yes in JSON or non-interactive mode', {
+                        code: 'CONFIRMATION_REQUIRED', category: 'usage',
+                    });
+                }
+                const answer = await inquirer.prompt([{
+                        type: 'confirm',
+                        name: 'confirmed',
+                        message: `Permanently remove quarantined payload for review ${reviewId}?`,
+                        default: false,
+                    }]);
+                if (!answer.confirmed) {
+                    throw new CliCommandError('Repository security review cleanup cancelled', {
+                        code: 'REPOSITORY_REVIEW_CLEANUP_CANCELLED', category: 'cancelled',
+                    });
+                }
+            }
+            const response = await this.repoFetch(`/api/repo/security-reviews/${encodeURIComponent(reviewId)}`, { method: 'DELETE' });
+            const payload = await readResponsePayload(response);
+            if (!response.ok) {
+                throw new RepositoryApiError(response.status, payload, 'Failed to clean repository security review');
+            }
+            if (options.json) {
+                console.log(formatSuccessJson('repo review', payload));
+            }
+            else {
+                console.log(chalk.green(`\n✓ Removed quarantined repository review ${reviewId}; a hash-only audit record was retained.\n`));
+            }
+            return;
+        }
         const spinner = createSpinner(reviewId ? 'Loading security review...' : 'Loading security reviews...').start();
         try {
             const apiPath = reviewId

package/dist/commands/security.d.ts

@@ -8,10 +8,13 @@ interface SecurityOptions {
 }
 export declare class SecurityCommand {
     private logger;
+    private client;
     constructor(_config: Config, logger: Logger);
     private getMcpBaseUrl;
     private resolveDir;
     private execute;
+    private useRemoteMcp;
+    private runScan;
     scan(options: SecurityOptions): Promise<void>;
     score(options: SecurityOptions): Promise<void>;
     fix(options: SecurityOptions): Promise<void>;

package/dist/commands/security.js

@@ -2,11 +2,13 @@ import axios from 'axios';
 import path from 'path';
 import { assertTrustedEndpoint, installAxiosNetworkPolicy } from '../utils/network-policy.js';
 import { formatSuccessJson } from '../utils/command-contract.js';
+import { localSecurityFixPlan, scanLocalWorkspace } from '../utils/local-security-service.js';
 export class SecurityCommand {
     logger;
+    client = axios.create({ timeout: 120000 });
     constructor(_config, logger) {
         this.logger = logger;
-        installAxiosNetworkPolicy(axios, 'mcp');
+        installAxiosNetworkPolicy(this.client, 'mcp');
     }
     getMcpBaseUrl() {
         const fromEnv = process.env.VIGTHORIA_MCP_URL || process.env.MCP_SERVER_URL;
@@ -25,7 +27,7 @@ export class SecurityCommand {
         if (!loopback && typeof parameters.dir === 'string' && path.isAbsolute(parameters.dir)) {
             throw new Error('Remote MCP security execution requires an uploaded workspace binding; refusing to send a local absolute path.');
         }
-        const response = await axios.post(`${baseUrl}/mcp/execute`, {
+        const response = await this.client.post(`${baseUrl}/mcp/execute`, {
             tool,
             parameters,
             context: {
@@ -43,9 +45,17 @@ export class SecurityCommand {
         const result = response.data?.result || {};
         return result.result || result;
     }
+    useRemoteMcp() {
+        return Boolean((process.env.VIGTHORIA_MCP_URL || process.env.MCP_SERVER_URL || '').trim());
+    }
+    async runScan(dir) {
+        if (this.useRemoteMcp())
+            return this.execute('security_scan', { dir });
+        return scanLocalWorkspace(dir);
+    }
     async scan(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_scan', { dir });
+        const result = await this.runScan(dir);
         if (options.json) {
             console.log(formatSuccessJson('security scan', result));
             return;
@@ -64,7 +74,15 @@ export class SecurityCommand {
     }
     async score(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_score', { dir });
+        const scan = await this.runScan(dir);
+        const result = {
+            score: scan.score,
+            grade: scan.grade,
+            issueCount: scan.issueCount,
+            scannedFiles: scan.scannedFiles,
+            summary: `Security score ${scan.score}/100 (${scan.grade}) with ${scan.issueCount} issues`,
+            localOnly: scan.localOnly === true,
+        };
         if (options.json) {
             console.log(formatSuccessJson('security score', result));
             return;
@@ -75,11 +93,13 @@ export class SecurityCommand {
     }
     async fix(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_fix', {
-            dir,
-            issue_id: options.issueId,
-            confirm: Boolean(options.apply),
-        });
+        const result = this.useRemoteMcp()
+            ? await this.execute('security_fix', {
+                dir,
+                issue_id: options.issueId,
+                confirm: Boolean(options.apply),
+            })
+            : localSecurityFixPlan(scanLocalWorkspace(dir), options.issueId, Boolean(options.apply));
         if (options.json) {
             console.log(formatSuccessJson('security fix', result));
             return;

package/dist/index.js

@@ -454,6 +454,7 @@ export async function main(args) {
         .option('-g, --get <key>', 'Get a configuration value')
         .option('-l, --list', 'List all settings')
         .option('-r, --reset', 'Reset to defaults')
+        .option('-y, --yes', 'Confirm reset without an interactive prompt')
         .action(async (options) => {
         const configCmd = new ConfigCommand(config, logger);
         await configCmd.run(options);
@@ -495,9 +496,22 @@ export async function main(args) {
     program
         .command('init')
         .description('Initialize Vigthoria in current project')
-        .action(async () => {
+        .option('--model <model>', 'Default model for non-interactive initialization')
+        .option('--ignore-patterns <patterns>', 'Additional comma-separated ignore patterns')
+        .option('--auto-apply-fixes', 'Enable automatic fix application in the generated project config')
+        .option('--profile <profile>', 'Initialization profile: safe, balanced, or fast')
+        .option('-y, --yes', 'Confirm overwrite and run non-interactively')
+        .option('--non-interactive', 'Disable prompts and use supplied/profile defaults')
+        .action(async (options) => {
         const configCmd = new ConfigCommand(config, logger);
-        await configCmd.init();
+        await configCmd.init({
+            model: options.model,
+            ignorePatterns: options.ignorePatterns,
+            autoApplyFixes: options.autoApplyFixes,
+            profile: options.profile,
+            yes: options.yes,
+            nonInteractive: options.nonInteractive,
+        });
     });
     program
         .command('menu')

package/dist/utils/api.js

@@ -19,10 +19,11 @@ import { isV3StreamKeepaliveEvent } from './v3-stream-events.js';
 import { resolveV3ContextCharLimit, WORKSPACE_FILE_CHAR_CAP, } from './contextBudget.js';
 import { isLocalTestfarmMode, fetchWithServiceTimeout } from './localTestMode.js';
 import { buildClientManifest } from './clientManifest.js';
-import { assertTrustedEndpoint, installAxiosNetworkPolicy, installGlobalFetchPolicy } from './network-policy.js';
+import { assertTrustedEndpoint, guardedFetch, installAxiosNetworkPolicy, installGlobalFetchPolicy } from './network-policy.js';
 import { assertSafeRelativePath, resolveWorkspacePath } from './workspace-boundary.js';
 import { parseSupportedProcess } from './process-policy.js';
 import { OptionalPuppeteerScreenshotAdapter } from './preview-screenshot-adapter.js';
+import { normalizeSubscriptionResponse } from './subscription-policy.js';
 import { ModelGovernance } from './model-governance.js';
 import { OperatorClient, OperatorClientError } from './operator-client.js';
 import { CodeOperationsService } from './code-operations-service.js';
@@ -341,7 +342,7 @@ export class APIClient {
         this.mcpContextClient = new McpContextClient({
             getBaseUrls: () => this.getMcpBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'mcp' }),
             sanitizeError: sanitizeUserFacingErrorText,
             debug: (message, detail) => this.logger.debug(message, detail),
         });
@@ -357,7 +358,7 @@ export class APIClient {
                 return response.data?.v3ServiceKey || null;
             },
             refreshToken: () => this.refreshToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'v3' }),
             sanitizeError: sanitizeUserFacingErrorText,
             debug: (message) => this.logger.debug(message),
         });
@@ -412,23 +413,26 @@ export class APIClient {
         this.operatorClient = new OperatorClient({
             getBaseUrls: () => this.getOperatorBaseUrls(),
             getAuthToken: () => this.config.get('authToken'),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'operator' }),
             sanitizeError: sanitizeUserFacingErrorText,
         });
         this.frontendPreviewService = new FrontendPreviewService({
             getBaseUrls: () => this.getTemplateServiceBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'template' }),
             resolveTargetPath: (context) => this.resolveAgentTargetPath(context),
             extractExpectedFiles: (message, context) => this.extractExpectedWorkspaceFiles(message, context),
             isAnalysisOnlyTask: (message, context) => this.isAnalysisOnlyTask(message, context),
             sanitizeError: sanitizeUserFacingErrorText,
             screenshotAdapter: dependencies.screenshotAdapter || new OptionalPuppeteerScreenshotAdapter(),
         });
+        const vigFlowTransport = axios.create({ timeout: 30_000 });
+        installAxiosNetworkPolicy(vigFlowTransport, 'vigflow');
         this.vigFlowClient = new VigFlowClient({
             getBaseUrls: () => this.getVigFlowBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
             debug: (message, detail) => this.logger.debug(message, detail),
+            transport: vigFlowTransport,
         });
         this.unsubscribeAuthInvalidation = subscribeAuthInvalidation(() => {
             this.vigFlowClient.clearCredentials();
@@ -598,12 +602,10 @@ export class APIClient {
     async getSubscriptionStatus() {
         try {
             const response = await this.client.get('/api/user/subscription');
-            const data = response.data;
-            this.config.setSubscription({
-                plan: data.plan || data.subscription_plan || 'community',
-                status: data.status || 'active',
-                expiresAt: data.expiresAt || data.expires_at
-            });
+            const subscription = normalizeSubscriptionResponse(response.data);
+            if (!subscription)
+                throw new Error('Subscription response did not contain a plan');
+            this.config.setSubscription(subscription);
         }
         catch (error) {
             this.logger.debug('Failed to get subscription status:', error.message);
@@ -747,6 +749,7 @@ export class APIClient {
             process.env.VIGTHORIA_VIGFLOW_URL,
             process.env.VIGFLOW_URL,
             process.env.WORKFLOW_BUILDER_URL,
+            'https://workflow.vigthoria.io',
             `${configuredApiUrl}/api/vigflow`,
             'http://127.0.0.1:5060',
             'http://127.0.0.1:5050',

package/dist/utils/chat-prompt-policy.js

@@ -22,7 +22,7 @@ export class ChatPromptPolicy {
     isRepoGrounded(prompt) {
         const text = prompt.trim();
         return /\b(src\/|\.js\b|\.ts\b|\.py\b|\.jsx\b|\.tsx\b|\.css\b|\.html\b|\.json\b|\.yaml\b|\.yml\b)/i.test(text)
-            || /\b(file|folder|directory|module|class|function|method|variable|handler|listener|binding|conflict|bug|issue|error)\b/i.test(text)
+            || /\b(file|folder|directory|project|workspace|repo|repository|codebase|module|class|function|method|variable|handler|listener|binding|conflict|bug|issue|error)\b/i.test(text)
             || /\b(inspect|analyze|analyse|audit|review|find|diagnose|debug|trace|compare|diff|check|investigate)\b/i.test(text)
             || /\b(Camera|InputManager|keydown|KeyS|KeyA|KeyW|stopPropagation|addEventListener|handleKeyDown)\b/.test(text)
             || /\/[a-zA-Z]/.test(text)

package/dist/utils/code-operations-service.js

@@ -46,6 +46,8 @@ export class CodeOperationsService {
         let code = await this.chatComplete(systemPrompt, buildScopedPrompt(false), model);
         // Strip markdown fences if model included them
         code = code.replace(/^```[\w]*\n?/gm, '').replace(/\n?```$/gm, '').trim();
+        if (!code)
+            throw new Error('Code generation backend returned an empty response.');
         // Client-side validation: reject DOM-polluted or over-engineered responses for non-HTML languages
         const needsRetry = isNonHtmlLang && (this.codeContainsDomPollution(code) ||
             this.codeIsOverEngineered(code, prompt));
@@ -53,6 +55,8 @@ export class CodeOperationsService {
             // Retry once with stronger constraint — via Model Router
             code = await this.chatComplete(systemPrompt, buildScopedPrompt(true), model);
             code = code.replace(/^```[\w]*\n?/gm, '').replace(/\n?```$/gm, '').trim();
+            if (!code)
+                throw new Error('Code generation retry returned an empty response.');
             // If still polluted, strip DOM code client-side
             if (this.codeContainsDomPollution(code)) {
                 code = this.stripDomPollution(code, language);
@@ -234,6 +238,8 @@ export class CodeOperationsService {
             'Return ONLY the JSON object, no markdown fences.',
         ].join('\n');
         const raw = await this.chatComplete(sysPrompt, prompt, model, 8192);
+        if (!raw.trim())
+            throw new Error('Project generation backend returned an empty response.');
         try {
             const cleaned = raw.replace(/^```[\w]*\n?/gm, '').replace(/\n?```$/gm, '').trim();
             const parsed = JSON.parse(cleaned);
@@ -259,7 +265,10 @@ export class CodeOperationsService {
             '- Do NOT use raw HTML or excessive blank lines.',
             '- Do NOT nest numbered lists inside sections.',
         ].join('\n');
-        return this.chatComplete(sysPrompt, code);
+        const explanation = (await this.chatComplete(sysPrompt, code)).trim();
+        if (!explanation)
+            throw new Error('Code explanation backend returned an empty response.');
+        return explanation;
     }
     async reviewCode(code, language) {
         const sysPrompt = [
@@ -277,18 +286,29 @@ export class CodeOperationsService {
             '- Do NOT suggest adding error handling, input validation, or documentation as issues unless the user explicitly asked for a style review.',
             '- Return ONLY the JSON object, no markdown fences or extra text.',
         ].join('\n');
-        let raw = {};
+        const result = await this.chatComplete(sysPrompt, code);
+        let raw;
         try {
-            const result = await this.chatComplete(sysPrompt, code);
             const cleaned = result.replace(/^```[\w]*\n?/gm, '').replace(/\n?```$/gm, '').trim();
             raw = JSON.parse(cleaned);
         }
-        catch {
-            // If parsing fails, return minimal review
+        catch (error) {
+            throw new Error('Code review backend returned malformed JSON.', { cause: error });
+        }
+        if (!raw || typeof raw !== 'object' || !Number.isFinite(raw.score) || raw.score < 0 || raw.score > 100 || !Array.isArray(raw.issues) || !Array.isArray(raw.suggestions)) {
+            throw new Error('Code review backend response does not satisfy the review contract.');
+        }
+        const lineCount = Math.max(1, code.split('\n').length);
+        const validSeverities = new Set(['error', 'warning', 'info']);
+        if (raw.issues.some((issue) => !issue || typeof issue.type !== 'string' || !Number.isInteger(issue.line) || issue.line < 1 || issue.line > lineCount || typeof issue.message !== 'string' || !validSeverities.has(issue.severity))) {
+            throw new Error('Code review backend returned an invalid or out-of-range finding.');
+        }
+        if (raw.suggestions.some((suggestion) => typeof suggestion !== 'string')) {
+            throw new Error('Code review backend returned an invalid suggestion.');
         }
-        const score = typeof raw.score === 'number' ? raw.score : 0;
-        const issues = Array.isArray(raw.issues) ? raw.issues : [];
-        const suggestions = Array.isArray(raw.suggestions) ? raw.suggestions : [];
+        const score = raw.score;
+        const issues = raw.issues;
+        const suggestions = raw.suggestions;
         // Merge client-side heuristics, but with tight dedup to avoid
         // redundant over-reporting when the model already found the bug.
         const modelFoundError = issues.some(i => i.severity === 'error');
@@ -480,17 +500,23 @@ export class CodeOperationsService {
             '- Do not add comments, do not restructure beyond the minimal fix.',
             '- Return ONLY the JSON object, no markdown fences.',
         ].join('\n');
-        let raw = {};
+        const result = await this.chatComplete(sysPrompt, augmentedCode);
+        let raw;
         try {
-            const result = await this.chatComplete(sysPrompt, augmentedCode);
             const cleaned = result.replace(/^```[\w]*\n?/gm, '').replace(/\n?```$/gm, '').trim();
             raw = JSON.parse(cleaned);
         }
-        catch {
-            // If parsing fails, fall through to client-side handling
+        catch (error) {
+            throw new Error('Code fix backend returned malformed JSON.', { cause: error });
+        }
+        if (!raw || typeof raw !== 'object' || typeof raw.fixed !== 'string' || !raw.fixed.trim() || !Array.isArray(raw.changes)) {
+            throw new Error('Code fix backend response does not satisfy the fix contract.');
         }
-        let fixed = typeof raw.fixed === 'string' ? raw.fixed : (typeof raw.code === 'string' ? raw.code : code);
-        let changes = Array.isArray(raw.changes) ? raw.changes : [];
+        if (raw.changes.some((change) => !change || !Number.isInteger(change.line) || change.line < 1 || typeof change.before !== 'string' || typeof change.after !== 'string' || typeof change.reason !== 'string')) {
+            throw new Error('Code fix backend returned invalid change evidence.');
+        }
+        let fixed = raw.fixed;
+        let changes = raw.changes;
         // If server returned no changes but we found issues, strip
         // our injected comment prefix from the returned code and attempt
         // a basic client-side repair.
@@ -545,6 +571,9 @@ export class CodeOperationsService {
                 : 'AI-suggested fix';
             changes = this.computeSemanticDiff(code, fixed, cleanReason);
         }
+        if (fixed === code && changes.length === 0) {
+            throw new Error('Code fix backend returned no verified mutation evidence.');
+        }
         return { fixed, changes };
     }
     /**

package/dist/utils/config.js

@@ -129,7 +129,10 @@ function isConfigValue(value) {
 }
 export class Config {
     store;
-    static OPERATOR_PLANS = new Set(['enterprise', 'admin', 'master_admin']);
+    static OPERATOR_PLANS = new Set([
+        'basic', 'pro', 'professional', 'professional_ai', 'enterprise',
+        'enterprise_ai', 'whale', 'admin', 'master_admin', 'master_admin_plan',
+    ]);
     constructor(options = {}) {
         const stateRoot = path.resolve(options.stateRoot || os.homedir());
         const canonicalPath = path.join(stateRoot, '.vigthoria', 'config.json');
@@ -264,7 +267,7 @@ export class Config {
         return true;
     }
     getNormalizedPlan() {
-        return (this.get('subscription').plan || '').trim().toLowerCase();
+        return (this.get('subscription').plan || '').trim().toLowerCase().replace(/-/g, '_');
     }
     hasOperatorAccess() {
         return Config.OPERATOR_PLANS.has(this.getNormalizedPlan());

package/dist/utils/local-security-service.d.ts

@@ -0,0 +1,23 @@
+export type SecuritySeverity = 'critical' | 'high' | 'medium' | 'low';
+export interface LocalSecurityIssue {
+    id: string;
+    rule: string;
+    severity: SecuritySeverity;
+    file: string;
+    line: number;
+    message: string;
+}
+export interface LocalSecurityResult {
+    rootDir: string;
+    scannedFiles: number;
+    scannedBytes: number;
+    skippedFiles: number;
+    score: number;
+    grade: string;
+    issueCount: number;
+    issues: LocalSecurityIssue[];
+    bounded: true;
+    localOnly: true;
+}
+export declare function scanLocalWorkspace(inputRoot?: string): LocalSecurityResult;
+export declare function localSecurityFixPlan(result: LocalSecurityResult, issueId?: string, requestedApply?: boolean): Record<string, unknown>;