vigthoria-cli 1.13.24 → 1.13.25

package/completions/_vigthoria

@@ -36,7 +36,7 @@ _vigthoria() {
     'replay:Replay events from a V3 agent run step-by-step'
     'repo:Push and pull projects to/from your Vigthoria Community Repository'
     'review:Review code quality'
-    'security:Run security scans, scores, and fix plans via Vigthoria MCP security tools'
+    'security:Run bounded local security scans, scores, and reviewed fix plans'
     'status:Show authentication and subscription status'
     'update:Check for updates and upgrade Vigthoria CLI. Default manifest: https://extension.vigthoria.io/downloads/manifest.json'
     'v4:Launch Vigthoria V4 Operating Agent (DeerFlow 2.0 harness)'

package/completions/vigthoria.fish

@@ -32,7 +32,7 @@ complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'pr
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'replay' -d 'Replay events from a V3 agent run step-by-step'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'repo' -d 'Push and pull projects to/from your Vigthoria Community Repository'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'review' -d 'Review code quality'
-complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'security' -d 'Run security scans, scores, and fix plans via Vigthoria MCP security tools'
+complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'security' -d 'Run bounded local security scans, scores, and reviewed fix plans'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'status' -d 'Show authentication and subscription status'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'update' -d 'Check for updates and upgrade Vigthoria CLI. Default manifest: https://extension.vigthoria.io/downloads/manifest.json'
 complete -c vigthoria -c vig -c vigthoria-chat -n '__fish_use_subcommand' -a 'v4' -d 'Launch Vigthoria V4 Operating Agent (DeerFlow 2.0 harness)'

package/dist/commands/auth.js

@@ -5,6 +5,7 @@ import { clearGatewayPreflightCache } from '../utils/cli-state.js';
 import { AuthSessionService, validateTokenStructure } from '../utils/auth-session.js';
 import { assertTrustedEndpoint, guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
+import { normalizeSubscriptionResponse } from '../utils/subscription-policy.js';
 const DEFAULT_API_URL = 'https://coder.vigthoria.io';
 const KNOWN_AUTH_BASE_URLS = ['https://coder.vigthoria.io'];
 class HttpError extends Error {
@@ -271,6 +272,9 @@ export async function login(email, password) {
                         identity: { userId: identity?.id, email: identity?.email },
                         v3ServiceKey: null,
                     });
+                    const issuedSubscription = normalizeSubscriptionResponse(result);
+                    if (issuedSubscription)
+                        new Config().setSubscription(issuedSubscription);
                     // Only present the newly issued token to secondary authenticated
                     // endpoints after its structure and Coder acceptance are proven.
                     const v3ServiceKey = await fetchV3ServiceKey(normalizedBase, token);
@@ -469,12 +473,14 @@ export async function handleLogin(options = {}) {
             });
             if (subResponse.ok) {
                 const sub = await subResponse.json();
+                const normalizedSubscription = normalizeSubscriptionResponse(sub);
                 const subRecord = (sub.subscription && typeof sub.subscription === 'object') ? sub.subscription : {};
                 const userRecord = (sub.user && typeof sub.user === 'object') ? sub.user : {};
-                const plan = String(sub.plan || subRecord.plan || userRecord.plan || userRecord.subscription_plan || '').trim();
                 const role = String(sub.role || subRecord.role || userRecord.role || userRecord.user_role || '').trim();
-                if (plan) {
-                    console.log(`Plan:  ${plan.toUpperCase()}`);
+                if (normalizedSubscription)
+                    new Config().setSubscription(normalizedSubscription);
+                if (normalizedSubscription) {
+                    console.log(`Plan:  ${normalizedSubscription.plan.toUpperCase()}`);
                 }
                 if (role) {
                     console.log(`Role:  ${role}`);
@@ -608,8 +614,11 @@ export function registerAuthCommands(program) {
         try {
             const user = await whoami();
             if (!user) {
-                console.log(chalk.yellow('Not logged in.'));
-                return;
+                throw new CliCommandError('Not logged in.', {
+                    code: 'AUTHENTICATION_REQUIRED',
+                    category: 'authentication',
+                    status: 401,
+                });
             }
             console.log(chalk.green('Logged in.'));
             console.log(user.email || user.name || user.id || 'Authenticated user');

package/dist/commands/chat.js

@@ -20,6 +20,7 @@ import { runAgentSessionMenu, shouldShowAgentSessionMenu } from './agent-session
 import { V4Command } from './v4.js';
 import { renderDynamicHelp } from '../utils/command-menu.js';
 import { resolvePromptWorkspace } from '../utils/prompt-workspace-resolver.js';
+import { FileUtils } from '../utils/files.js';
 import { isDirectModeFollowUpQuestion, sanitizeDirectModeOutput, stripHiddenThoughtBlocks } from '../utils/direct-output-policy.js';
 import { createLiveOutcome, evaluateExecutorSuccess, handleRunCompleteEvent, handleTaskEvent, isSubstantiveAgentAnswer, isToolEvidenceStubAnswer, normalizeAgentAnswerContent, noteAnalysisToolUse, } from '../utils/agentRunOutcome.js';
 import { looksLikeMarkdownReport, renderMarkdownToTerminal, summarizeMarkdownReport, } from '../utils/terminalMarkdown.js';
@@ -2028,6 +2029,42 @@ export class ChatCommand {
         }
     }
     async runSimplePrompt(prompt) {
+        let directWorkspaceGrounding = '';
+        if (this.directPromptMode && !this.agentMode && !this.operatorMode && this.isRepoGroundedPrompt(prompt)) {
+            const expectedFiles = this.api.extractExpectedWorkspaceFiles(prompt).slice(0, 8);
+            if (expectedFiles.length === 0) {
+                throw new CliCommandError('Grounded --no-agent chat requires an explicit workspace-relative file path. Use agent mode for repository-wide inspection.', {
+                    code: 'GROUNDING_FILE_REQUIRED', category: 'usage',
+                });
+            }
+            const reader = new FileUtils(this.currentProjectPath, this.config.get('project')?.ignorePatterns || []);
+            const excerpts = [];
+            let totalBytes = 0;
+            for (const requestedPath of expectedFiles) {
+                const file = reader.readFile(requestedPath);
+                if (!file) {
+                    throw new CliCommandError(`Grounded no-agent chat could not safely read the requested file: ${path.basename(requestedPath)}`, {
+                        code: 'GROUNDING_FILE_UNAVAILABLE', category: 'execution',
+                    });
+                }
+                const remaining = 32 * 1024 - totalBytes;
+                if (remaining <= 0)
+                    break;
+                const content = file.content.slice(0, Math.min(16 * 1024, remaining));
+                totalBytes += Buffer.byteLength(content, 'utf8');
+                excerpts.push(`FILE ${file.relativePath.replace(/\\/g, '/')} (${file.lines} lines):\n${content}`);
+            }
+            if (expectedFiles.length > 0 && excerpts.length === 0) {
+                throw new CliCommandError('Grounded no-agent chat found no safe readable requested files.', {
+                    code: 'GROUNDING_FILE_UNAVAILABLE', category: 'execution',
+                });
+            }
+            directWorkspaceGrounding = [
+                'Repository grounding is provided below from the local workspace.',
+                'Treat it as the only source of truth. Never invent content that is absent.',
+                excerpts.join('\n\n'),
+            ].join('\n\n');
+        }
         if (!this.directPromptMode && !this.operatorMode) {
             const isWriteFollowUp = isConfirmationFollowUp(prompt) || isWritePermissionGrant(prompt);
             if (isWriteFollowUp && (this.lastActionableUserInput || this.getPreviousActionablePrompt())) {
@@ -2090,7 +2127,10 @@ export class ChatCommand {
             else {
                 this.messages.push({
                     role: 'system',
-                    content: 'Answer the user\'s question directly and concisely. Do not describe tools, platform constraints, or capabilities unless explicitly asked. If the user\'s instruction is to produce specific output, produce exactly that output with no preamble.',
+                    content: [
+                        'Answer the user\'s question directly and concisely. Do not describe tools, platform constraints, or capabilities unless explicitly asked. If the user\'s instruction is to produce specific output, produce exactly that output with no preamble.',
+                        directWorkspaceGrounding,
+                    ].filter(Boolean).join('\n\n'),
                 });
             }
         }

package/dist/commands/config.d.ts

@@ -8,6 +8,7 @@ interface ConfigOptions {
     get?: string;
     list?: boolean;
     reset?: boolean;
+    yes?: boolean;
 }
 interface InitOptions {
     model?: string;

package/dist/commands/config.js

@@ -18,7 +18,7 @@ export class ConfigCommand {
     }
     async run(options) {
         if (options.reset) {
-            await this.resetConfig();
+            await this.resetConfig(Boolean(options.yes));
             return;
         }
         if (options.set) {
@@ -151,17 +151,36 @@ export class ConfigCommand {
     setConfig(keyValue) {
         const [key, ...valueParts] = keyValue.split('=');
         const value = valueParts.join('=');
-        if (!key || value === undefined) {
+        if (!keyValue.includes('=') || !key || !value) {
             throw new CliCommandError('Invalid format. Use: vigthoria config --set key=value', {
                 code: 'INVALID_CONFIG_ASSIGNMENT', category: 'usage',
             });
         }
+        const parseBoolean = (v) => {
+            if (v !== 'true' && v !== 'false')
+                throw new Error('Boolean configuration values must be true or false.');
+            return v === 'true';
+        };
         const configMap = {
-            'model': (v) => this.config.set('preferences', { ...this.config.get('preferences'), defaultModel: v }),
-            'theme': (v) => this.config.set('preferences', { ...this.config.get('preferences'), theme: v }),
-            'autoApply': (v) => this.config.set('preferences', { ...this.config.get('preferences'), autoApplyFixes: v === 'true' }),
-            'showDiffs': (v) => this.config.set('preferences', { ...this.config.get('preferences'), showDiffs: v === 'true' }),
-            'maxTokens': (v) => this.config.set('preferences', { ...this.config.get('preferences'), maxTokens: parseInt(v, 10) }),
+            'model': (v) => {
+                const allowed = new Set(['architect', 'code', 'assistant', 'code-35b', 'code-9b', 'balanced', 'balanced-4b']);
+                if (!allowed.has(v))
+                    throw new Error(`Invalid model: ${v}`);
+                this.config.set('preferences', { ...this.config.get('preferences'), defaultModel: v });
+            },
+            'theme': (v) => {
+                if (v !== 'dark' && v !== 'light')
+                    throw new Error('Theme must be dark or light.');
+                this.config.set('preferences', { ...this.config.get('preferences'), theme: v });
+            },
+            'autoApply': (v) => this.config.set('preferences', { ...this.config.get('preferences'), autoApplyFixes: parseBoolean(v) }),
+            'showDiffs': (v) => this.config.set('preferences', { ...this.config.get('preferences'), showDiffs: parseBoolean(v) }),
+            'maxTokens': (v) => {
+                const parsed = Number(v);
+                if (!Number.isSafeInteger(parsed) || parsed < 256 || parsed > 1_000_000)
+                    throw new Error('maxTokens must be an integer between 256 and 1000000.');
+                this.config.set('preferences', { ...this.config.get('preferences'), maxTokens: parsed });
+            },
             'apiUrl': (v) => this.config.set('apiUrl', assertTrustedEndpoint(v, { audience: 'coder' }).toString().replace(/\/$/, '')),
             'modelsApiUrl': (v) => this.config.set('modelsApiUrl', assertTrustedEndpoint(v, { audience: 'models' }).toString().replace(/\/$/, '')),
             'wsUrl': (v) => this.config.set('wsUrl', assertTrustedWebSocketEndpoint(v, 'coder').toString().replace(/\/$/, '')),
@@ -257,8 +276,13 @@ export class ConfigCommand {
         console.log(chalk.gray(`Config file: ${this.config.getConfigPath()}`));
         console.log();
     }
-    async resetConfig() {
-        const { confirm } = await inquirer.prompt([
+    async resetConfig(confirmedByFlag = false) {
+        if (!confirmedByFlag && !process.stdin.isTTY) {
+            throw new CliCommandError('Configuration reset requires --yes in non-interactive mode.', {
+                code: 'CONFIRMATION_REQUIRED', category: 'usage',
+            });
+        }
+        const { confirm } = confirmedByFlag ? { confirm: true } : await inquirer.prompt([
             {
                 type: 'confirm',
                 name: 'confirm',

package/dist/commands/game.d.ts

@@ -4,6 +4,10 @@ type CommonOptions = {
     project?: string;
     packageManager?: Manager;
 };
+export declare function gameProcessInvocation(pm: Manager, args: readonly string[], platform?: NodeJS.Platform, comSpec?: string): {
+    executable: string;
+    args: string[];
+};
 export declare class GameCommand {
     private logger;
     constructor(logger: Logger);

package/dist/commands/game.js

@@ -24,7 +24,25 @@ const manager = (root, requested) => {
         return 'bun';
     return 'npm';
 };
-const run = (pm, args, cwd, timeoutMs = 10 * 60_000) => new Promise((resolve, reject) => { const executable = process.platform === 'win32' ? `${pm}.cmd` : pm; assertProcessNetworkAllowed(executable, args); const child = spawn(executable, args, { cwd, stdio: 'inherit', windowsHide: true, env: safeChildProcessEnv() }); let interrupted = false; const onInterrupt = () => { interrupted = true; child.kill('SIGINT'); }; process.once('SIGINT', onInterrupt); const timer = timeoutMs > 0 ? setTimeout(() => { child.kill('SIGTERM'); reject(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })); }, timeoutMs) : null; const finish = () => { if (timer)
+export function gameProcessInvocation(pm, args, platform = process.platform, comSpec = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'cmd.exe')) {
+    const executable = platform === 'win32' && pm !== 'bun' ? `${pm}.cmd` : pm;
+    assertProcessNetworkAllowed(executable, args);
+    if (platform !== 'win32' || !executable.endsWith('.cmd'))
+        return { executable, args: [...args] };
+    // Node does not directly execute CMD wrappers reliably on current Windows
+    // releases. This adapter is deliberately narrower than a general shell:
+    // the package manager is an enum and every token must be inert cmd.exe data.
+    const safeToken = /^[A-Za-z0-9@._:/\\=-]+$/;
+    if (!/^(?:install|run)$/.test(String(args[0] || '')) || args.some((arg) => !safeToken.test(arg))) {
+        throw new CliCommandError('Unsafe Windows package-manager argument rejected.', {
+            code: 'GAME_PROCESS_ARGUMENT_REJECTED',
+            category: 'usage',
+        });
+    }
+    const command = [executable, ...args].map((token) => `"${token}"`).join(' ');
+    return { executable: comSpec, args: ['/d', '/s', '/c', command] };
+}
+const run = (pm, args, cwd, timeoutMs = 10 * 60_000) => new Promise((resolve, reject) => { const invocation = gameProcessInvocation(pm, args); const child = spawn(invocation.executable, invocation.args, { cwd, stdio: 'inherit', windowsHide: true, env: safeChildProcessEnv() }); let interrupted = false; const onInterrupt = () => { interrupted = true; child.kill('SIGINT'); }; process.once('SIGINT', onInterrupt); const timer = timeoutMs > 0 ? setTimeout(() => { child.kill('SIGTERM'); reject(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })); }, timeoutMs) : null; const finish = () => { if (timer)
     clearTimeout(timer); process.removeListener('SIGINT', onInterrupt); }; child.once('error', error => { finish(); reject(error); }); child.once('exit', (code, signal) => { finish(); if (interrupted)
     reject(new CliCommandError(`${pm} command cancelled by user`, { code: 'GAME_PROCESS_CANCELLED', category: 'cancelled' }));
 else

package/dist/commands/hub.d.ts

@@ -10,6 +10,8 @@ export declare class HubCommand {
     private config;
     constructor(config: Config, _logger: Logger);
     private getAuthToken;
+    private normalizeModule;
+    private moduleCatalog;
     /**
      * Search for modules by natural language query
      */

package/dist/commands/hub.js

@@ -7,7 +7,7 @@
 import chalk from 'chalk';
 import { guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
-const API_BASE = 'https://api.vigthoria.io';
+const API_BASE = 'https://hub.vigthoria.io';
 export class HubCommand {
     config;
     constructor(config, _logger) {
@@ -26,23 +26,47 @@ export class HubCommand {
         }
         return token;
     }
+    normalizeModule(raw) {
+        const unit = String(raw.pricing?.unit || raw.unit || 'request');
+        const rawCost = raw.pricing?.cost ?? raw.creditsPerUnit ?? 0;
+        const cost = typeof rawCost === 'number' ? rawCost : Number.NaN;
+        const displayCost = typeof rawCost === 'string' ? rawCost : `${rawCost} credits per ${unit.toLowerCase()}`;
+        return {
+            id: String(raw.id || ''),
+            name: String(raw.name || raw.id || 'Unknown module'),
+            description: String(raw.description || ''),
+            endpoint: String(raw.endpoint || ''),
+            documentation: String(raw.documentation || 'https://hub.vigthoria.io/subscriptions'),
+            pricing: { unit, cost: Number.isFinite(cost) ? cost : 0, example: displayCost },
+            status: String(raw.status || 'available'),
+            category: String(raw.category || 'api'),
+            tags: Array.isArray(raw.tags) ? raw.tags.map(String) : [],
+            unit,
+            creditsPerUnit: raw.creditsPerUnit,
+            euroPerUnit: raw.euroPerUnit,
+        };
+    }
+    async moduleCatalog() {
+        const response = await guardedFetch(`${API_BASE}/api/modules`, {}, { audience: 'hub' });
+        if (!response.ok)
+            throw new CliCommandError(`Failed to load module catalog: ${response.statusText}`, { code: 'HUB_CATALOG_FAILED', status: response.status });
+        const data = await response.json();
+        if (!Array.isArray(data.modules))
+            throw new CliCommandError('Module Hub returned a malformed catalog.', { code: 'HUB_CATALOG_INVALID' });
+        return data.modules.map((module) => this.normalizeModule(module)).filter((module) => module.id);
+    }
     /**
      * Search for modules by natural language query
      */
     async search(query) {
         console.log(chalk.cyan('\n🔍 Searching Vigthoria Module Hub...\n'));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/search`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({ query })
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error(`Search failed: ${response.statusText}`);
-            }
-            const data = await response.json();
+            const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+            const results = (await this.moduleCatalog()).map((module) => ({
+                ...module,
+                score: terms.reduce((score, term) => score + (`${module.id} ${module.name} ${module.description}`.toLowerCase().includes(term) ? 1 : 0), 0),
+            })).filter((module) => module.score > 0).sort((a, b) => b.score - a.score);
+            const data = { results };
             if (data.results.length === 0) {
                 console.log(chalk.yellow('No modules found matching your query.'));
                 console.log(chalk.gray('Try: vigthoria hub list  to see all available modules\n'));
@@ -50,7 +74,7 @@ export class HubCommand {
             }
             console.log(chalk.green(`Found ${data.results.length} module(s):\n`));
             data.results.forEach((module, index) => {
-                const statusColor = module.status === 'active' ? chalk.green : chalk.gray;
+                const statusColor = module.status === 'available' ? chalk.green : chalk.gray;
                 console.log(chalk.bold.white(`  ${index + 1}. ${module.name}`));
                 console.log(chalk.gray(`     ${module.description.substring(0, 80)}...`));
                 console.log(chalk.cyan(`     💰 ${module.pricing.example}`));
@@ -82,7 +106,8 @@ export class HubCommand {
             if (!response.ok) {
                 throw new CliCommandError(`Failed to list modules: ${response.statusText}`, { code: 'HUB_LIST_FAILED', status: response.status });
             }
-            const data = await response.json();
+            const rawData = await response.json();
+            const data = { modules: Array.isArray(rawData.modules) ? rawData.modules.map((module) => this.normalizeModule(module)) : [] };
             console.log(chalk.bold.white('Available Modules:\n'));
             // Group by category
             const grouped = data.modules.reduce((acc, module) => {
@@ -116,36 +141,15 @@ export class HubCommand {
      * Activate a module for the current user
      */
     async activate(moduleId) {
-        const authToken = this.getAuthToken();
+        this.getAuthToken();
         console.log(chalk.cyan(`\n🔌 Activating module: ${moduleId}...\n`));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/${moduleId}/activate`, {
-                method: 'POST',
-                headers: {
-                    'Authorization': `Bearer ${authToken}`,
-                    'Content-Type': 'application/json'
-                }
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                const errorData = await response.json();
-                throw new Error(errorData.error || response.statusText);
-            }
-            const data = await response.json();
-            console.log(chalk.green(`✅ ${data.message}`));
-            console.log();
-            console.log(chalk.white('📚 Documentation:'));
-            console.log(chalk.gray(`   ${data.documentation}`));
-            console.log();
-            console.log(chalk.white('🔗 Available Endpoints:'));
-            data.endpoints.forEach((ep) => {
-                console.log(chalk.gray(`   ${ep.method.padEnd(6)} ${ep.path}`));
-                console.log(chalk.gray(`         ${ep.description}`));
-            });
-            console.log();
-            console.log(chalk.cyan('💡 Quick Start:'));
-            console.log(chalk.gray(`   Use your API key in requests:`));
-            console.log(chalk.gray(`   Authorization: Bearer ${authToken.substring(0, 8)}...`));
-            console.log();
+            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            if (!module)
+                throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
+            console.log(chalk.green(`✅ ${module.name} is published in the Vigthoria module catalog.`));
+            console.log(chalk.gray('Hub modules do not use a separate activation mutation; the destination service evaluates account authorization and billing when used.'));
+            console.log(chalk.gray(`Documentation: ${module.documentation}`));
         }
         catch (error) {
             throw commandFailure(error, { code: 'HUB_ACTIVATION_FAILED' });
@@ -155,32 +159,18 @@ export class HubCommand {
      * Show currently active modules for user
      */
     async active() {
-        const authToken = this.getAuthToken();
-        console.log(chalk.cyan('\n📦 Your Active Modules\n'));
+        this.getAuthToken();
+        console.log(chalk.cyan('\n📦 Published Vigthoria Modules\n'));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/active`, {
-                headers: {
-                    'Authorization': `Bearer ${authToken}`
-                }
-            }, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error(`Failed to fetch: ${response.statusText}`);
-            }
-            const data = await response.json();
-            if (data.allAccess) {
-                console.log(chalk.green('🌟 You have access to ALL modules!\n'));
-            }
-            console.log(chalk.white(`Tier: ${chalk.cyan.bold(data.tier.toUpperCase())}`));
-            console.log();
-            if (data.activeModules.length === 0) {
-                console.log(chalk.yellow('No modules activated yet.'));
-                console.log(chalk.gray('\nActivate modules with: vigthoria hub activate <module>'));
-            }
+            const activeModules = await this.moduleCatalog();
+            console.log(chalk.white('Available modules (final authorization occurs at execution time):'));
+            if (activeModules.length === 0)
+                console.log(chalk.yellow('No modules are currently published.'));
             else {
-                console.log(chalk.white('Active modules:'));
-                data.activeModules.forEach((module) => {
+                activeModules.forEach((module) => {
                     console.log(chalk.green(`  ✅ ${module.name}`));
-                    console.log(chalk.gray(`     Endpoint: ${module.endpoint}`));
+                    if (module.endpoint)
+                        console.log(chalk.gray(`     Endpoint: ${module.endpoint}`));
                     console.log(chalk.yellow(`     Cost: ${module.pricing.example}`));
                     console.log();
                 });
@@ -196,11 +186,9 @@ export class HubCommand {
     async info(moduleId) {
         console.log(chalk.cyan(`\n📖 Module Info: ${moduleId}\n`));
         try {
-            const response = await guardedFetch(`${API_BASE}/api/modules/${moduleId}`, {}, { audience: 'hub' });
-            if (!response.ok) {
-                throw new Error('Module not found');
-            }
-            const module = await response.json();
+            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            if (!module)
+                throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
             console.log(chalk.bold.white(`${module.name}`));
             console.log(chalk.gray('─'.repeat(50)));
             console.log();
@@ -247,7 +235,7 @@ export class HubCommand {
                 console.log(chalk.gray(`External URL: ${module.external}`));
             }
             console.log();
-            console.log(chalk.cyan('To activate: ') + chalk.white(`vigthoria hub activate ${moduleId}`));
+            console.log(chalk.cyan('Authorization: ') + chalk.white('evaluated by the destination service when the module is used'));
             console.log();
         }
         catch (error) {
@@ -269,12 +257,7 @@ export class HubCommand {
         console.log(chalk.gray('  • "image generation for social media"\n'));
         console.log(chalk.cyan('Use: vigthoria hub search "<your use case>"'));
         console.log(chalk.gray('The AI will find the best modules for your needs.\n'));
-        // Show pricing tiers
-        console.log(chalk.white('💳 Subscription Tiers:'));
-        console.log(chalk.gray('  Starter    €49/mo   50 credits'));
-        console.log(chalk.gray('  Business   €199/mo  500 credits'));
-        console.log(chalk.gray('  Enterprise €499/mo  2000 credits'));
-        console.log();
-        console.log(chalk.cyan('Get started: https://landing.vigthoria.io/api-keys.html\n'));
+        console.log(chalk.gray('Current unit pricing is loaded from the live module catalog; account authorization is evaluated at execution time.'));
+        console.log(chalk.cyan('Manage access: https://hub.vigthoria.io/subscriptions\n'));
     }
 }

package/dist/commands/legion.d.ts

@@ -19,6 +19,7 @@ export type LegionOptions = {
     password?: string;
     [key: string]: any;
 };
+export declare function hasMasterAdminCortexAccess(plan: string, masterAccess: boolean, isMasterAdmin: boolean): boolean;
 export declare class LegionCommand {
     private config;
     private logger;

package/dist/commands/legion.js

@@ -33,6 +33,12 @@ function buildServerHyperloopUrls() {
         `http://${internalHost}:${port}${apiPath}`,
     ];
 }
+export function hasMasterAdminCortexAccess(plan, masterAccess, isMasterAdmin) {
+    const normalizedPlan = String(plan || '').trim().toLowerCase().replace(/-/g, '_');
+    if (isMasterAdmin || normalizedPlan === 'master_admin' || normalizedPlan === 'master_admin_plan')
+        return true;
+    return masterAccess && ['admin', 'enterprise', 'enterprise_ai', 'supreme_ai'].includes(normalizedPlan);
+}
 const CORTEX_WARN_BUDGET_USD = 3.5;
 const CORTEX_HARD_BUDGET_USD = 5.0;
 const CORTEX_MAX_ROUNDS = 2;
@@ -759,13 +765,7 @@ export class LegionCommand {
         };
     }
     isMasterAdminFree(plan, masterAccess, isMasterAdmin) {
-        if (!masterAccess) {
-            return false;
-        }
-        if (isMasterAdmin) {
-            return true;
-        }
-        return plan === 'master_admin';
+        return hasMasterAdminCortexAccess(plan, masterAccess, isMasterAdmin);
     }
     isCortexTestMode() {
         return process.env.VIGTHORIA_CORTEX_TEST_MODE === '1'

package/dist/commands/platform-registration.js

@@ -33,7 +33,7 @@ export function registerPlatformCommands(program, config, logger) {
         .option('--json', 'Emit JSON output', false).action(async (address, options) => new DeviceCommand(config, logger).disconnect(address, options));
     device.action(async () => new DeviceCommand(config, logger).status({}));
     const security = program.command('security').alias('vsec')
-        .description('Run security scans, scores, and fix plans via Vigthoria MCP security tools');
+        .description('Run bounded local security scans, scores, and reviewed fix plans');
     security.command('scan').description('Scan project for security issues').option('-d, --dir <path>', 'Directory to scan (default: current directory)')
         .option('--json', 'Emit JSON output', false).action(async (options) => new SecurityCommand(config, logger).scan({ dir: options.dir, json: options.json }));
     security.command('score').description('Calculate project security score').option('-d, --dir <path>', 'Directory to score (default: current directory)')

package/dist/commands/product-run-registration.js

@@ -142,11 +142,13 @@ export function registerProductAndRunCommands(program, config, logger) {
     });
     repoCommand
         .command('review [reviewId]')
-        .description('Show repository security review status, findings, and retry guidance')
+        .description('Show or clean repository security review state')
+        .option('--cleanup', 'Remove the quarantined payload and review object while retaining a hash-only audit record', false)
+        .option('-y, --yes', 'Confirm cleanup without an interactive prompt', false)
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (reviewId, options) => {
         const repo = new RepoCommand(config, logger);
-        await repo.review(reviewId, { json: options.json });
+        await repo.review(reviewId, { json: options.json, cleanup: options.cleanup, yes: options.yes });
     });
     repoCommand
         .command('pull <name>')

package/dist/commands/repo.d.ts

@@ -72,6 +72,8 @@ export declare class RepoCommand {
      */
     review(reviewId?: string, options?: {
         json?: boolean;
+        cleanup?: boolean;
+        yes?: boolean;
     }): Promise<void>;
     private materializeProject;
     /**

package/dist/commands/repo.js

@@ -502,6 +502,43 @@ export class RepoCommand {
      */
     async review(reviewId, options = {}) {
         this.requireAuth();
+        if (options.cleanup) {
+            if (!reviewId) {
+                throw new CliCommandError('A review ID is required with --cleanup', {
+                    code: 'REPOSITORY_REVIEW_ID_REQUIRED', category: 'usage',
+                });
+            }
+            if (!options.yes) {
+                if (options.json || !process.stdin.isTTY) {
+                    throw new CliCommandError('Repository review cleanup requires --yes in JSON or non-interactive mode', {
+                        code: 'CONFIRMATION_REQUIRED', category: 'usage',
+                    });
+                }
+                const answer = await inquirer.prompt([{
+                        type: 'confirm',
+                        name: 'confirmed',
+                        message: `Permanently remove quarantined payload for review ${reviewId}?`,
+                        default: false,
+                    }]);
+                if (!answer.confirmed) {
+                    throw new CliCommandError('Repository security review cleanup cancelled', {
+                        code: 'REPOSITORY_REVIEW_CLEANUP_CANCELLED', category: 'cancelled',
+                    });
+                }
+            }
+            const response = await this.repoFetch(`/api/repo/security-reviews/${encodeURIComponent(reviewId)}`, { method: 'DELETE' });
+            const payload = await readResponsePayload(response);
+            if (!response.ok) {
+                throw new RepositoryApiError(response.status, payload, 'Failed to clean repository security review');
+            }
+            if (options.json) {
+                console.log(formatSuccessJson('repo review', payload));
+            }
+            else {
+                console.log(chalk.green(`\n✓ Removed quarantined repository review ${reviewId}; a hash-only audit record was retained.\n`));
+            }
+            return;
+        }
         const spinner = createSpinner(reviewId ? 'Loading security review...' : 'Loading security reviews...').start();
         try {
             const apiPath = reviewId

package/dist/commands/security.d.ts

@@ -8,10 +8,13 @@ interface SecurityOptions {
 }
 export declare class SecurityCommand {
     private logger;
+    private client;
     constructor(_config: Config, logger: Logger);
     private getMcpBaseUrl;
     private resolveDir;
     private execute;
+    private useRemoteMcp;
+    private runScan;
     scan(options: SecurityOptions): Promise<void>;
     score(options: SecurityOptions): Promise<void>;
     fix(options: SecurityOptions): Promise<void>;