vigthoria-cli 1.13.24 → 1.13.26

package/dist/commands/preview.js

@@ -51,6 +51,9 @@ const MIME_TYPES = {
     '.txt': 'text/plain',
     '.map': 'application/json',
 };
+export function isPreviewProofRequested(options) {
+    return options.proof === true || options.screenshot === true;
+}
 export class PreviewCommand {
     logger;
     api;
@@ -76,11 +79,17 @@ export class PreviewCommand {
             await this.showConsolidatedDiff(projectPath);
         }
         // Run Template Service preview proof gate
-        if (options.proof) {
-            await this.runProofGate(projectPath, options.screenshot);
+        if (isPreviewProofRequested(options)) {
+            try {
+                await this.runProofGate(projectPath, options.screenshot);
+            }
+            catch (error) {
+                this.api.destroy();
+                throw error;
+            }
         }
         // If only --diff or --proof was requested (no explicit entry/port), just exit
-        if (options.diff || options.proof) {
+        if (options.diff || isPreviewProofRequested(options)) {
             if (!options.entry && !options.port) {
                 this.api.destroy();
                 return;
@@ -90,7 +99,7 @@ export class PreviewCommand {
         const entryFile = this.detectEntryFile(projectPath, options.entry);
         if (!entryFile) {
             this.logger.warn('No HTML entry file found. Use --entry <file> to specify one.');
-            if (!options.diff && !options.proof) {
+            if (!options.diff && !options.proof && !options.screenshot) {
                 this.api.destroy();
                 throw new CliCommandError('No HTML entry file found. Use --entry <file> to specify one.', {
                     code: 'PREVIEW_ENTRY_NOT_FOUND', category: 'configuration',
@@ -162,7 +171,7 @@ export class PreviewCommand {
      * Start a local HTTP server for preview
      */
     async startServer(projectPath, entryFile, port, autoOpen) {
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             this.server = http.createServer((req, res) => {
                 let filePath;
                 try {
@@ -210,6 +219,20 @@ export class PreviewCommand {
                     res.end('Internal server error');
                 }
             });
+            const finish = (error) => {
+                process.removeListener('SIGINT', shutdown);
+                process.removeListener('SIGTERM', shutdown);
+                this.api.destroy();
+                this.server = null;
+                error ? reject(error) : resolve();
+            };
+            const shutdown = () => {
+                console.log(chalk.gray('\n  Stopping preview server...'));
+                if (!this.server)
+                    return finish();
+                this.server.close((error) => finish(error || undefined));
+            };
+            this.server.once('error', finish);
             this.server.listen(port, () => {
                 const url = `http://localhost:${port}/${entryFile}`;
                 console.log(chalk.green(`  ${CH.success} Preview server running`));
@@ -221,15 +244,8 @@ export class PreviewCommand {
                     this.openBrowser(url);
                 }
             });
-            // Handle graceful shutdown
-            const shutdown = () => {
-                console.log(chalk.gray('\n  Stopping preview server...'));
-                this.server?.close();
-                this.api.destroy();
-                resolve();
-            };
-            process.on('SIGINT', shutdown);
-            process.on('SIGTERM', shutdown);
+            process.once('SIGINT', shutdown);
+            process.once('SIGTERM', shutdown);
         });
     }
     /**

package/dist/commands/product-run-registration.js

@@ -142,11 +142,13 @@ export function registerProductAndRunCommands(program, config, logger) {
     });
     repoCommand
         .command('review [reviewId]')
-        .description('Show repository security review status, findings, and retry guidance')
+        .description('Show or clean repository security review state')
+        .option('--cleanup', 'Remove the quarantined payload and review object while retaining a hash-only audit record', false)
+        .option('-y, --yes', 'Confirm cleanup without an interactive prompt', false)
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (reviewId, options) => {
         const repo = new RepoCommand(config, logger);
-        await repo.review(reviewId, { json: options.json });
+        await repo.review(reviewId, { json: options.json, cleanup: options.cleanup, yes: options.yes });
     });
     repoCommand
         .command('pull <name>')

package/dist/commands/repo.d.ts

@@ -14,6 +14,22 @@
  */
 import { Config } from '../utils/config.js';
 import { Logger } from '../utils/logger.js';
+interface Project {
+    id: number;
+    project_name: string;
+    project_path: string;
+    description: string;
+    tech_stack: string;
+    visibility: 'public' | 'private' | 'restricted';
+    is_public: boolean;
+    demo_url: string | null;
+    repo_url: string | null;
+    status: string;
+    storage_usage_mb: number;
+    created_at: string;
+    updated_at: string;
+    last_synced_at: string | null;
+}
 interface PushOptions {
     path?: string;
     name?: string;
@@ -34,6 +50,25 @@ interface ListOptions {
 interface ShareOptions {
     expires?: string;
 }
+interface RepositoryMaterialization {
+    project?: Project;
+    projectName?: string;
+    description?: string;
+    downloadUrl?: string;
+    inlineComplete?: boolean;
+    files?: Array<{
+        path: string;
+        content?: string;
+        encoding?: 'utf8' | 'base64';
+        size?: number;
+        binary?: boolean;
+    }>;
+}
+export declare function isCompleteRepositoryInlinePayload(data: RepositoryMaterialization): boolean;
+export declare function resolveRepositoryDownloadRoute(rawUrl: string, coderApiBase: string, publicDownload?: boolean): {
+    url: string;
+    audience: 'coder' | 'community';
+};
 export declare class RepositoryMutationAmbiguousError extends Error {
     readonly operationId: string;
     readonly mutationOutcome = "unknown";
@@ -48,8 +83,6 @@ export declare class RepoCommand {
     private communityToken;
     constructor(config: Config, _logger: Logger);
     private getAuthHeaders;
-    private getRepositoryAudienceForUrl;
-    private getAuthHeadersForUrl;
     private ensureCommunityAuth;
     private repoFetch;
     private collectProjectFiles;
@@ -72,6 +105,8 @@ export declare class RepoCommand {
      */
     review(reviewId?: string, options?: {
         json?: boolean;
+        cleanup?: boolean;
+        yes?: boolean;
     }): Promise<void>;
     private materializeProject;
     /**

package/dist/commands/repo.js

@@ -23,6 +23,35 @@ import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/com
 import { createRuntimeTempDirectory, removeRuntimeTempDirectory } from '../utils/runtime-temp.js';
 import { assertSafeDestinationPath, assertSafeRelativePath, inspectZipArchive, mergeValidatedWorkspace, resolveWorkspacePath, validateExtractedWorkspace, } from '../utils/workspace-boundary.js';
 import inquirer from 'inquirer';
+export function isCompleteRepositoryInlinePayload(data) {
+    if (!Array.isArray(data.files) || data.files.length === 0 || data.inlineComplete === false)
+        return false;
+    return data.files.every((file) => typeof file?.path === 'string'
+        && typeof file?.content === 'string'
+        && (file.encoding === undefined || file.encoding === 'utf8' || file.encoding === 'base64')
+        && file.binary !== true);
+}
+export function resolveRepositoryDownloadRoute(rawUrl, coderApiBase, publicDownload = false) {
+    const parsed = new URL(rawUrl);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port) {
+        throw new Error('Repository download URL is not an exact trusted HTTPS origin');
+    }
+    if (parsed.hostname.toLowerCase() === 'coder.vigthoria.io')
+        return { url: parsed.href, audience: 'coder' };
+    if (parsed.hostname.toLowerCase() !== 'community.vigthoria.io') {
+        throw new Error('Repository download URL is outside the Coder and Community trust boundary');
+    }
+    if (publicDownload)
+        return { url: parsed.href, audience: 'community' };
+    const match = parsed.pathname.match(/^\/api\/showcase\/(\d+)\/download$/);
+    if (!match || parsed.search || parsed.hash) {
+        throw new Error('Authenticated repository archive URL has an unsupported path');
+    }
+    return {
+        url: `${coderApiBase.replace(/\/$/, '')}/api/community-repo/archive/${encodeURIComponent(match[1])}`,
+        audience: 'coder',
+    };
+}
 const MAX_REPOSITORY_CONTENT_BYTES = 100 * 1024 * 1024;
 const MAX_REPOSITORY_REQUEST_BYTES = 120 * 1024 * 1024;
 class RepositoryApiError extends Error {
@@ -87,17 +116,6 @@ export class RepoCommand {
             'Content-Type': 'application/json',
         };
     }
-    getRepositoryAudienceForUrl(rawUrl) {
-        const hostname = new URL(rawUrl).hostname.toLowerCase();
-        if (hostname === 'coder.vigthoria.io')
-            return 'coder';
-        if (hostname === 'community.vigthoria.io')
-            return 'community';
-        throw new Error('Repository download URL is outside the Coder and Community trust boundary');
-    }
-    getAuthHeadersForUrl(rawUrl) {
-        return this.getAuthHeaders(this.getRepositoryAudienceForUrl(rawUrl));
-    }
     async ensureCommunityAuth() {
         if (this.communityToken) {
             return;
@@ -502,6 +520,43 @@ export class RepoCommand {
      */
     async review(reviewId, options = {}) {
         this.requireAuth();
+        if (options.cleanup) {
+            if (!reviewId) {
+                throw new CliCommandError('A review ID is required with --cleanup', {
+                    code: 'REPOSITORY_REVIEW_ID_REQUIRED', category: 'usage',
+                });
+            }
+            if (!options.yes) {
+                if (options.json || !process.stdin.isTTY) {
+                    throw new CliCommandError('Repository review cleanup requires --yes in JSON or non-interactive mode', {
+                        code: 'CONFIRMATION_REQUIRED', category: 'usage',
+                    });
+                }
+                const answer = await inquirer.prompt([{
+                        type: 'confirm',
+                        name: 'confirmed',
+                        message: `Permanently remove quarantined payload for review ${reviewId}?`,
+                        default: false,
+                    }]);
+                if (!answer.confirmed) {
+                    throw new CliCommandError('Repository security review cleanup cancelled', {
+                        code: 'REPOSITORY_REVIEW_CLEANUP_CANCELLED', category: 'cancelled',
+                    });
+                }
+            }
+            const response = await this.repoFetch(`/api/repo/security-reviews/${encodeURIComponent(reviewId)}`, { method: 'DELETE' });
+            const payload = await readResponsePayload(response);
+            if (!response.ok) {
+                throw new RepositoryApiError(response.status, payload, 'Failed to clean repository security review');
+            }
+            if (options.json) {
+                console.log(formatSuccessJson('repo review', payload));
+            }
+            else {
+                console.log(chalk.green(`\n✓ Removed quarantined repository review ${reviewId}; a hash-only audit record was retained.\n`));
+            }
+            return;
+        }
         const spinner = createSpinner(reviewId ? 'Loading security review...' : 'Loading security reviews...').start();
         try {
             const apiPath = reviewId
@@ -559,12 +614,38 @@ export class RepoCommand {
         try {
             if (fs.existsSync(outputPath))
                 validateExtractedWorkspace(outputPath);
-            if (data.downloadUrl) {
-                const archiveResponse = await guardedFetch(data.downloadUrl, {
+            if (isCompleteRepositoryInlinePayload(data)) {
+                const stagingRoot = createRuntimeTempDirectory('repo-inline-');
+                try {
+                    let totalBytes = 0;
+                    for (const file of data.files) {
+                        const filePath = resolveWorkspacePath(stagingRoot, file.path, { allowMissing: true });
+                        const content = file.encoding === 'base64'
+                            ? Buffer.from(file.content, 'base64')
+                            : Buffer.from(file.content, 'utf8');
+                        if (typeof file.size === 'number' && file.size !== content.byteLength) {
+                            throw new Error(`Repository file size mismatch: ${file.path}`);
+                        }
+                        totalBytes += content.byteLength;
+                        if (totalBytes > MAX_REPOSITORY_CONTENT_BYTES)
+                            throw new Error('Repository inline payload exceeds the materialization limit');
+                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                        fs.writeFileSync(filePath, content, { mode: 0o600 });
+                    }
+                    validateExtractedWorkspace(stagingRoot);
+                    mergeValidatedWorkspace(stagingRoot, outputPath);
+                }
+                finally {
+                    removeRuntimeTempDirectory(stagingRoot);
+                }
+            }
+            else if (data.downloadUrl) {
+                const route = resolveRepositoryDownloadRoute(data.downloadUrl, this.apiBase, publicDownload);
+                const archiveResponse = await guardedFetch(route.url, {
                     headers: publicDownload
                         ? { 'Content-Type': 'application/json' }
-                        : this.getAuthHeadersForUrl(data.downloadUrl)
-                }, { audience: this.getRepositoryAudienceForUrl(data.downloadUrl) });
+                        : this.getAuthHeaders(route.audience)
+                }, { audience: route.audience });
                 if (!archiveResponse.ok)
                     throw new Error('Failed to download project archive');
                 const archiveBuffer = Buffer.from(await archiveResponse.arrayBuffer());
@@ -601,23 +682,8 @@ export class RepoCommand {
                     removeRuntimeTempDirectory(stagingRoot);
                 }
             }
-            else if (data.files) {
-                const stagingRoot = createRuntimeTempDirectory('repo-inline-');
-                try {
-                    for (const file of data.files) {
-                        const filePath = resolveWorkspacePath(stagingRoot, file.path, { allowMissing: true });
-                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-                        fs.writeFileSync(filePath, file.content, { mode: 0o600 });
-                    }
-                    validateExtractedWorkspace(stagingRoot);
-                    mergeValidatedWorkspace(stagingRoot, outputPath);
-                }
-                finally {
-                    removeRuntimeTempDirectory(stagingRoot);
-                }
-            }
             else {
-                throw new Error('Repository response contained neither an archive nor inline files');
+                throw new Error('Repository response contained neither a complete inline payload nor an archive');
             }
             downloadSpinner.succeed(chalk.green('Project materialized successfully!'));
             console.log(chalk.cyan('\n📁 Project extracted to:'));
@@ -854,7 +920,8 @@ export class RepoCommand {
         const spinner = createSpinner('Deleting project...').start();
         try {
             const operationId = createOperationId();
-            const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(projectName)}`, {
+            const repo = await this.resolveRepoByName(projectName);
+            const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(String(repo.id))}`, {
                 method: 'DELETE',
                 headers: { 'X-Vigthoria-Operation-Id': operationId },
             }, { operationId });

package/dist/commands/security.d.ts

@@ -8,10 +8,13 @@ interface SecurityOptions {
 }
 export declare class SecurityCommand {
     private logger;
+    private client;
     constructor(_config: Config, logger: Logger);
     private getMcpBaseUrl;
     private resolveDir;
     private execute;
+    private useRemoteMcp;
+    private runScan;
     scan(options: SecurityOptions): Promise<void>;
     score(options: SecurityOptions): Promise<void>;
     fix(options: SecurityOptions): Promise<void>;

package/dist/commands/security.js

@@ -2,11 +2,13 @@ import axios from 'axios';
 import path from 'path';
 import { assertTrustedEndpoint, installAxiosNetworkPolicy } from '../utils/network-policy.js';
 import { formatSuccessJson } from '../utils/command-contract.js';
+import { localSecurityFixPlan, scanLocalWorkspace } from '../utils/local-security-service.js';
 export class SecurityCommand {
     logger;
+    client = axios.create({ timeout: 120000 });
     constructor(_config, logger) {
         this.logger = logger;
-        installAxiosNetworkPolicy(axios, 'mcp');
+        installAxiosNetworkPolicy(this.client, 'mcp');
     }
     getMcpBaseUrl() {
         const fromEnv = process.env.VIGTHORIA_MCP_URL || process.env.MCP_SERVER_URL;
@@ -25,7 +27,7 @@ export class SecurityCommand {
         if (!loopback && typeof parameters.dir === 'string' && path.isAbsolute(parameters.dir)) {
             throw new Error('Remote MCP security execution requires an uploaded workspace binding; refusing to send a local absolute path.');
         }
-        const response = await axios.post(`${baseUrl}/mcp/execute`, {
+        const response = await this.client.post(`${baseUrl}/mcp/execute`, {
             tool,
             parameters,
             context: {
@@ -43,9 +45,17 @@ export class SecurityCommand {
         const result = response.data?.result || {};
         return result.result || result;
     }
+    useRemoteMcp() {
+        return Boolean((process.env.VIGTHORIA_MCP_URL || process.env.MCP_SERVER_URL || '').trim());
+    }
+    async runScan(dir) {
+        if (this.useRemoteMcp())
+            return this.execute('security_scan', { dir });
+        return scanLocalWorkspace(dir);
+    }
     async scan(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_scan', { dir });
+        const result = await this.runScan(dir);
         if (options.json) {
             console.log(formatSuccessJson('security scan', result));
             return;
@@ -64,7 +74,15 @@ export class SecurityCommand {
     }
     async score(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_score', { dir });
+        const scan = await this.runScan(dir);
+        const result = {
+            score: scan.score,
+            grade: scan.grade,
+            issueCount: scan.issueCount,
+            scannedFiles: scan.scannedFiles,
+            summary: `Security score ${scan.score}/100 (${scan.grade}) with ${scan.issueCount} issues`,
+            localOnly: scan.localOnly === true,
+        };
         if (options.json) {
             console.log(formatSuccessJson('security score', result));
             return;
@@ -75,11 +93,13 @@ export class SecurityCommand {
     }
     async fix(options) {
         const dir = this.resolveDir(options.dir);
-        const result = await this.execute('security_fix', {
-            dir,
-            issue_id: options.issueId,
-            confirm: Boolean(options.apply),
-        });
+        const result = this.useRemoteMcp()
+            ? await this.execute('security_fix', {
+                dir,
+                issue_id: options.issueId,
+                confirm: Boolean(options.apply),
+            })
+            : localSecurityFixPlan(scanLocalWorkspace(dir), options.issueId, Boolean(options.apply));
         if (options.json) {
             console.log(formatSuccessJson('security fix', result));
             return;

package/dist/commands/update-registration.js

@@ -252,7 +252,7 @@ export function registerUpdateCommand(program, version) {
                 if (!signatureResponse.ok)
                     throw new Error(`Detached signature returned HTTP ${signatureResponse.status}`);
                 verifyReleaseSignature(channel, manifestEntry, await signatureResponse.text());
-                assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
+                console.log(chalk.gray(`Verified ${channel} manifest: version=${manifestEntry.version} package=${manifestEntry.packageName}@${manifestEntry.packageVersion} size=${manifestEntry.size} sha256=${manifestEntry.sha256}`));
             }
             catch (error) {
                 if (error instanceof CliCommandError)
@@ -303,6 +303,7 @@ export function registerUpdateCommand(program, version) {
             && compareVersions(manifestEntry.version, effectiveLatest) >= 0
             && compareVersions(manifestEntry.version, currentVersion) > 0);
         if (manifestIsAuthoritative && manifestEntry) {
+            assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
             const updateTempDirectory = createRuntimeTempDirectory('update-');
             const tmpFile = path.join(updateTempDirectory, 'candidate.tgz');
             try {

package/dist/index.js

@@ -454,6 +454,7 @@ export async function main(args) {
         .option('-g, --get <key>', 'Get a configuration value')
         .option('-l, --list', 'List all settings')
         .option('-r, --reset', 'Reset to defaults')
+        .option('-y, --yes', 'Confirm reset without an interactive prompt')
         .action(async (options) => {
         const configCmd = new ConfigCommand(config, logger);
         await configCmd.run(options);
@@ -495,9 +496,22 @@ export async function main(args) {
     program
         .command('init')
         .description('Initialize Vigthoria in current project')
-        .action(async () => {
+        .option('--model <model>', 'Default model for non-interactive initialization')
+        .option('--ignore-patterns <patterns>', 'Additional comma-separated ignore patterns')
+        .option('--auto-apply-fixes', 'Enable automatic fix application in the generated project config')
+        .option('--profile <profile>', 'Initialization profile: safe, balanced, or fast')
+        .option('-y, --yes', 'Confirm overwrite and run non-interactively')
+        .option('--non-interactive', 'Disable prompts and use supplied/profile defaults')
+        .action(async (options) => {
         const configCmd = new ConfigCommand(config, logger);
-        await configCmd.init();
+        await configCmd.init({
+            model: options.model,
+            ignorePatterns: options.ignorePatterns,
+            autoApplyFixes: options.autoApplyFixes,
+            profile: options.profile,
+            yes: options.yes,
+            nonInteractive: options.nonInteractive,
+        });
     });
     program
         .command('menu')

package/dist/utils/api.js

@@ -15,14 +15,15 @@ import { buildSemanticContext } from './context-ranker.js';
 import { getChangedFiles } from './workspace-cache.js';
 import { isSubstantiveAgentAnswer, isToolEvidenceStubAnswer } from './agentRunOutcome.js';
 import { buildExecutionHints, isPlannerBuildTask, resolvePlannerAgentTimeoutMs } from './requestIntent.js';
-import { isV3StreamKeepaliveEvent } from './v3-stream-events.js';
+import { assertValidAgentPlanEvent, isV3StreamKeepaliveEvent } from './v3-stream-events.js';
 import { resolveV3ContextCharLimit, WORKSPACE_FILE_CHAR_CAP, } from './contextBudget.js';
 import { isLocalTestfarmMode, fetchWithServiceTimeout } from './localTestMode.js';
 import { buildClientManifest } from './clientManifest.js';
-import { assertTrustedEndpoint, installAxiosNetworkPolicy, installGlobalFetchPolicy } from './network-policy.js';
+import { assertTrustedEndpoint, guardedFetch, installAxiosNetworkPolicy, installGlobalFetchPolicy } from './network-policy.js';
 import { assertSafeRelativePath, resolveWorkspacePath } from './workspace-boundary.js';
 import { parseSupportedProcess } from './process-policy.js';
 import { OptionalPuppeteerScreenshotAdapter } from './preview-screenshot-adapter.js';
+import { normalizeSubscriptionResponse } from './subscription-policy.js';
 import { ModelGovernance } from './model-governance.js';
 import { OperatorClient, OperatorClientError } from './operator-client.js';
 import { CodeOperationsService } from './code-operations-service.js';
@@ -341,7 +342,7 @@ export class APIClient {
         this.mcpContextClient = new McpContextClient({
             getBaseUrls: () => this.getMcpBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'mcp' }),
             sanitizeError: sanitizeUserFacingErrorText,
             debug: (message, detail) => this.logger.debug(message, detail),
         });
@@ -357,7 +358,7 @@ export class APIClient {
                 return response.data?.v3ServiceKey || null;
             },
             refreshToken: () => this.refreshToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'v3' }),
             sanitizeError: sanitizeUserFacingErrorText,
             debug: (message) => this.logger.debug(message),
         });
@@ -412,23 +413,26 @@ export class APIClient {
         this.operatorClient = new OperatorClient({
             getBaseUrls: () => this.getOperatorBaseUrls(),
             getAuthToken: () => this.config.get('authToken'),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'operator' }),
             sanitizeError: sanitizeUserFacingErrorText,
         });
         this.frontendPreviewService = new FrontendPreviewService({
             getBaseUrls: () => this.getTemplateServiceBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
-            fetch: (input, init) => this.fetch(input, init),
+            fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'template' }),
             resolveTargetPath: (context) => this.resolveAgentTargetPath(context),
             extractExpectedFiles: (message, context) => this.extractExpectedWorkspaceFiles(message, context),
             isAnalysisOnlyTask: (message, context) => this.isAnalysisOnlyTask(message, context),
             sanitizeError: sanitizeUserFacingErrorText,
             screenshotAdapter: dependencies.screenshotAdapter || new OptionalPuppeteerScreenshotAdapter(),
         });
+        const vigFlowTransport = axios.create({ timeout: 30_000 });
+        installAxiosNetworkPolicy(vigFlowTransport, 'vigflow');
         this.vigFlowClient = new VigFlowClient({
             getBaseUrls: () => this.getVigFlowBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
             debug: (message, detail) => this.logger.debug(message, detail),
+            transport: vigFlowTransport,
         });
         this.unsubscribeAuthInvalidation = subscribeAuthInvalidation(() => {
             this.vigFlowClient.clearCredentials();
@@ -598,12 +602,10 @@ export class APIClient {
     async getSubscriptionStatus() {
         try {
             const response = await this.client.get('/api/user/subscription');
-            const data = response.data;
-            this.config.setSubscription({
-                plan: data.plan || data.subscription_plan || 'community',
-                status: data.status || 'active',
-                expiresAt: data.expiresAt || data.expires_at
-            });
+            const subscription = normalizeSubscriptionResponse(response.data);
+            if (!subscription)
+                throw new Error('Subscription response did not contain a plan');
+            this.config.setSubscription(subscription);
         }
         catch (error) {
             this.logger.debug('Failed to get subscription status:', error.message);
@@ -708,13 +710,10 @@ export class APIClient {
         return this.v3AgentClient.approvalUrl(baseUrl);
     }
     getOperatorBaseUrls() {
-        const configuredModelsApiUrl = String(this.config.get('modelsApiUrl') || 'https://api.vigthoria.io').replace(/\/$/, '');
         const urls = [
             process.env.VIGTHORIA_OPERATOR_URL,
             process.env.OPERATOR_URL,
-            'http://127.0.0.1:4009',
-            configuredModelsApiUrl,
-            'https://api.vigthoria.io',
+            'https://agent.vigthoria.io',
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -747,6 +746,7 @@ export class APIClient {
             process.env.VIGTHORIA_VIGFLOW_URL,
             process.env.VIGFLOW_URL,
             process.env.WORKFLOW_BUILDER_URL,
+            'https://workflow.vigthoria.io',
             `${configuredApiUrl}/api/vigflow`,
             'http://127.0.0.1:5060',
             'http://127.0.0.1:5050',
@@ -3106,6 +3106,7 @@ document.addEventListener('DOMContentLoaded', () => {
                     if (explicitEventType && (!event.type || event.type === 'message')) {
                         event.type = explicitEventType;
                     }
+                    assertValidAgentPlanEvent(event);
                     const userEvent = this.sanitizeV3AgentEventForUser(event);
                     events.push(userEvent);
                     if (!contextId && typeof event.context_id === 'string' && event.context_id.trim()) {
@@ -3357,12 +3358,15 @@ document.addEventListener('DOMContentLoaded', () => {
                             // A pre-existing local project is not proof that this run produced
                             // valid output. A terminal planner/executor error fails proof and
                             // causes the operation journal to roll back streamed mutations.
-                            const failedPreviewGate = {
-                                required: true,
-                                passed: false,
-                                skipped: true,
-                                error: 'Agent execution failed before preview validation.',
-                            };
+                            const analysisOnly = this.isAnalysisOnlyTask(message, executionContext);
+                            const failedPreviewGate = analysisOnly
+                                ? { required: false, passed: true, skipped: false }
+                                : {
+                                    required: true,
+                                    passed: false,
+                                    skipped: true,
+                                    error: 'Agent execution failed before preview validation.',
+                                };
                             return this.finalizeV3AgentWorkflowResponse(data, {
                                 content: '',
                                 taskId: data.task_id || null,

package/dist/utils/chat-prompt-policy.js

@@ -22,7 +22,7 @@ export class ChatPromptPolicy {
     isRepoGrounded(prompt) {
         const text = prompt.trim();
         return /\b(src\/|\.js\b|\.ts\b|\.py\b|\.jsx\b|\.tsx\b|\.css\b|\.html\b|\.json\b|\.yaml\b|\.yml\b)/i.test(text)
-            || /\b(file|folder|directory|module|class|function|method|variable|handler|listener|binding|conflict|bug|issue|error)\b/i.test(text)
+            || /\b(file|folder|directory|project|workspace|repo|repository|codebase|module|class|function|method|variable|handler|listener|binding|conflict|bug|issue|error)\b/i.test(text)
             || /\b(inspect|analyze|analyse|audit|review|find|diagnose|debug|trace|compare|diff|check|investigate)\b/i.test(text)
             || /\b(Camera|InputManager|keydown|KeyS|KeyA|KeyW|stopPropagation|addEventListener|handleKeyDown)\b/.test(text)
             || /\/[a-zA-Z]/.test(text)