vigthoria-cli 1.13.24 → 1.13.26

package/dist/utils/runtime-temp.js

@@ -99,6 +99,7 @@ export class RuntimeTempManager {
     pid;
     isProcessAlive;
     systemTempRoot;
+    sharedTempRoots;
     configuredRoot;
     source;
     maxBytes;
@@ -121,7 +122,18 @@ export class RuntimeTempManager {
         this.now = options.now || Date.now;
         this.pid = options.pid || process.pid;
         this.isProcessAlive = options.isProcessAlive || defaultProcessAlive;
-        this.systemTempRoot = options.systemTempDirectory || os.tmpdir();
+        const platformTemp = this.platform === 'win32'
+            ? String(this.environment.TEMP || this.environment.TMP || '').trim()
+            : String(this.environment.TMPDIR || '').trim();
+        this.systemTempRoot = options.systemTempDirectory || platformTemp || os.tmpdir();
+        this.sharedTempRoots = [
+            options.systemTempDirectory,
+            platformTemp,
+            this.environment.TEMP,
+            this.environment.TMP,
+            this.environment.TMPDIR,
+            this.platform === process.platform ? os.tmpdir() : undefined,
+        ].filter((value) => typeof value === 'string' && value.trim().length > 0);
         const resolved = resolveRuntimeTempRoot({ ...options, environment: this.environment, platform: this.platform, homeDirectory: this.homeDirectory });
         this.configuredRoot = resolved.root;
         this.source = resolved.source;
@@ -134,6 +146,14 @@ export class RuntimeTempManager {
         if (this.initializedRoot || this.initializationError)
             return this.status();
         try {
+            // Reject the shared OS temp path before touching the filesystem. This is
+            // also what makes cross-platform policy probes deterministic: a Windows
+            // policy instance running in a non-Windows test host must not attempt to
+            // create a drive-letter path before it can reject `%TEMP%`.
+            if (this.sharedTempRoots.some((root) => pathsEqual(this.configuredRoot, root, this.platform))
+                || (this.platform !== 'win32' && isKnownSharedPosixTemp(this.configuredRoot))) {
+                throw new RuntimeTempError('The shared operating-system temporary directory cannot be used for Vigthoria runtime storage.', 'TEMP_ROOT_SHARED');
+            }
             if (this.source === 'per-user-default' && !fs.existsSync(this.homeDirectory)) {
                 throw new RuntimeTempError('The user home directory does not exist; managed temporary storage cannot be initialized.', 'TEMP_HOME_UNAVAILABLE');
             }
@@ -154,7 +174,7 @@ export class RuntimeTempManager {
                 }
             }
             const pathApi = this.platform === 'win32' ? path.win32 : path.posix;
-            if (pathsEqual(realRoot, this.systemTempRoot, this.platform)
+            if (this.sharedTempRoots.some((root) => pathsEqual(realRoot, root, this.platform))
                 || (this.platform !== 'win32' && isKnownSharedPosixTemp(realRoot))) {
                 throw new RuntimeTempError('The shared operating-system temporary directory cannot be used for Vigthoria runtime storage.', 'TEMP_ROOT_SHARED');
             }

package/dist/utils/secret-policy.js

@@ -104,7 +104,10 @@ export function installConsoleRedaction() {
 }
 export function scanOutboundContext(input) {
     const findings = new Set();
-    const seen = new WeakSet();
+    // Track only the active recursion path. A WeakSet of every previously seen
+    // object incorrectly rejects ordinary DAGs where compatibility aliases point
+    // at the same context object. Only an ancestor reference is a real cycle.
+    const ancestors = new WeakSet();
     const visit = (value, location, depth) => {
         if (depth > 24)
             throw new OutboundContextError([`${location}: depth limit exceeded`]);
@@ -119,26 +122,32 @@ export function scanOutboundContext(input) {
         }
         if (!value || typeof value !== 'object')
             return value;
-        if (seen.has(value))
+        const objectValue = value;
+        if (ancestors.has(objectValue))
             throw new OutboundContextError([`${location}: cyclic value`]);
-        seen.add(value);
-        if (Array.isArray(value))
-            return value.map((entry, index) => visit(entry, `${location}[${index}]`, depth + 1));
-        const output = {};
-        for (const [key, entry] of Object.entries(value)) {
-            const child = `${location}.${key}`;
-            if (isSensitivePath(key)) {
-                findings.add(`${child}: sensitive path excluded`);
-                continue;
+        ancestors.add(objectValue);
+        try {
+            if (Array.isArray(value))
+                return value.map((entry, index) => visit(entry, `${location}[${index}]`, depth + 1));
+            const output = {};
+            for (const [key, entry] of Object.entries(value)) {
+                const child = `${location}.${key}`;
+                if (isSensitivePath(key)) {
+                    findings.add(`${child}: sensitive path excluded`);
+                    continue;
+                }
+                if (SENSITIVE_KEY.test(key)) {
+                    findings.add(`${child}: credential field redacted`);
+                    output[key] = REDACTED;
+                    continue;
+                }
+                output[key] = visit(entry, child, depth + 1);
             }
-            if (SENSITIVE_KEY.test(key)) {
-                findings.add(`${child}: credential field redacted`);
-                output[key] = REDACTED;
-                continue;
-            }
-            output[key] = visit(entry, child, depth + 1);
+            return output;
+        }
+        finally {
+            ancestors.delete(objectValue);
         }
-        return output;
     };
     const value = visit(input, '$', 0);
     if (containsHighConfidenceSecret(JSON.stringify(value))) {

package/dist/utils/subscription-policy.d.ts

@@ -0,0 +1,11 @@
+export interface NormalizedSubscription {
+    plan: string;
+    status: string;
+    expiresAt?: string;
+}
+/**
+ * Normalize the subscription shapes emitted by the Coder, User Hub, and
+ * legacy authentication contracts. Missing plan data is never synthesized:
+ * callers must retain their prior authoritative value or fail closed.
+ */
+export declare function normalizeSubscriptionResponse(payload: unknown): NormalizedSubscription | null;

package/dist/utils/subscription-policy.js

@@ -0,0 +1,32 @@
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function firstString(...values) {
+    for (const value of values) {
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+/**
+ * Normalize the subscription shapes emitted by the Coder, User Hub, and
+ * legacy authentication contracts. Missing plan data is never synthesized:
+ * callers must retain their prior authoritative value or fail closed.
+ */
+export function normalizeSubscriptionResponse(payload) {
+    const body = record(payload);
+    const subscription = record(body.subscription);
+    const user = record(body.user);
+    const userSubscription = record(user.subscription);
+    const plan = firstString(body.plan, body.subscription_plan, body.subscriptionPlan, body.subscriptionTier, body.tier, subscription.plan, subscription.name, subscription.subscription_plan, subscription.subscriptionPlan, subscription.subscriptionTier, subscription.tier, user.plan, user.subscription_plan, user.subscriptionPlan, user.subscriptionTier, user.tier, userSubscription.plan, userSubscription.name, userSubscription.subscription_plan, userSubscription.subscriptionPlan, userSubscription.subscriptionTier, userSubscription.tier);
+    if (!plan)
+        return null;
+    const explicitStatus = firstString(body.status, body.subscription_status, body.subscriptionStatus, subscription.status, subscription.subscription_status, subscription.subscriptionStatus, user.status, user.subscription_status, user.subscriptionStatus, userSubscription.status, userSubscription.subscription_status, userSubscription.subscriptionStatus);
+    const activeFlag = [body.active, subscription.active, user.active, userSubscription.active]
+        .find((value) => typeof value === 'boolean');
+    const status = explicitStatus || (activeFlag === false ? 'inactive' : 'active');
+    const expiresAt = firstString(body.expiresAt, body.expires_at, subscription.expiresAt, subscription.expires_at, user.expiresAt, user.expires_at, userSubscription.expiresAt, userSubscription.expires_at);
+    return { plan, status: status.toLowerCase(), ...(expiresAt ? { expiresAt } : {}) };
+}

package/dist/utils/v3-stream-events.d.ts

@@ -3,3 +3,11 @@
  * connections alive — not substantive work the CLI should surface as progress.
  */
 export declare function isV3StreamKeepaliveEvent(event: unknown): boolean;
+export declare class AgentPlanContractError extends Error {
+    readonly code = "AGENT_PLAN_INVALID";
+    constructor(message: string);
+}
+/** Validate a server-authored execution graph before any task can be credited.
+ * A cyclic, duplicate, self-referencing, or dangling graph is never runnable
+ * and must not reach the UI callback where it could later be counted as 2/2. */
+export declare function assertValidAgentPlanEvent(event: unknown): void;

package/dist/utils/v3-stream-events.js

@@ -39,3 +39,65 @@ export function isV3StreamKeepaliveEvent(event) {
     }
     return false;
 }
+export class AgentPlanContractError extends Error {
+    code = 'AGENT_PLAN_INVALID';
+    constructor(message) {
+        super(message);
+        this.name = 'AgentPlanContractError';
+    }
+}
+function dependencyId(value) {
+    if (typeof value === 'string' || typeof value === 'number')
+        return String(value).trim();
+    if (!value || typeof value !== 'object')
+        return '';
+    const record = value;
+    return String(record.id || record.task_id || record.taskId || '').trim();
+}
+/** Validate a server-authored execution graph before any task can be credited.
+ * A cyclic, duplicate, self-referencing, or dangling graph is never runnable
+ * and must not reach the UI callback where it could later be counted as 2/2. */
+export function assertValidAgentPlanEvent(event) {
+    if (!event || typeof event !== 'object')
+        return;
+    const record = event;
+    if (record.type !== 'plan' || !Array.isArray(record.plan?.tasks))
+        return;
+    const tasks = record.plan.tasks;
+    const ids = tasks.map((task, index) => {
+        const id = dependencyId(task.id ?? task.task_id ?? task.taskId);
+        if (!id)
+            throw new AgentPlanContractError(`Agent plan task at index ${index} has no stable ID.`);
+        return id;
+    });
+    if (new Set(ids).size !== ids.length)
+        throw new AgentPlanContractError('Agent plan contains duplicate task IDs.');
+    const idSet = new Set(ids);
+    const graph = new Map();
+    tasks.forEach((task, index) => {
+        const raw = task.depends_on ?? task.dependsOn ?? task.dependencies ?? [];
+        const dependencies = (Array.isArray(raw) ? raw : [raw]).map(dependencyId).filter(Boolean);
+        for (const dependency of dependencies) {
+            if (dependency === ids[index])
+                throw new AgentPlanContractError(`Agent plan task ${ids[index]} depends on itself.`);
+            if (!idSet.has(dependency))
+                throw new AgentPlanContractError(`Agent plan task ${ids[index]} depends on missing task ${dependency}.`);
+        }
+        graph.set(ids[index], dependencies);
+    });
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (id, trail) => {
+        if (visiting.has(id))
+            throw new AgentPlanContractError(`Agent plan contains a dependency cycle: ${[...trail, id].join(' -> ')}.`);
+        if (visited.has(id))
+            return;
+        visiting.add(id);
+        for (const dependency of graph.get(id) || [])
+            visit(dependency, [...trail, id]);
+        visiting.delete(id);
+        visited.add(id);
+    };
+    for (const id of ids)
+        visit(id, []);
+}

package/dist/utils/v3-workspace-service.js

@@ -135,7 +135,11 @@ export class V3WorkspaceService {
         const candidates = new Set();
         for (const value of [message, context.rawMessage, context.agentPrompt]) {
             const text = String(value || '');
-            for (const pattern of [/`([^`]+\.(?:html|css|js|jsx|ts|tsx|json|md|py|sh))`/gi, /\b([A-Za-z0-9_./-]+\.(?:html|css|js|jsx|ts|tsx|json|md|py|sh))\b/g]) {
+            const extensions = 'c|cc|cpp|cxx|h|hpp|cs|css|go|html|htm|ini|java|js|jsx|json|kt|kts|md|mjs|cjs|php|ps1|py|rb|rs|scss|sh|sql|svelte|toml|ts|tsx|txt|vue|xml|yaml|yml';
+            for (const pattern of [
+                new RegExp('`([^`]+\\.(?:' + extensions + '))`', 'gi'),
+                new RegExp('\\b([A-Za-z0-9_./-]+\\.(?:' + extensions + '))\\b', 'gi'),
+            ]) {
                 let match;
                 while ((match = pattern.exec(text)) !== null) {
                     const filePath = match[1].trim().replace(/^\.\//, '');

package/dist/utils/vigflow-client.js

@@ -16,8 +16,8 @@ export class VigFlowClient {
         const authToken = this.dependencies.getAccessToken();
         if (!authToken)
             throw new Error('Not authenticated. Run vigthoria login first.');
-        const response = await this.transport.post(`${baseUrl}/api/auth/sso`, { token: authToken }, {
-            headers: { 'Content-Type': 'application/json' }, timeout: 30_000,
+        const response = await this.transport.post(`${baseUrl}/api/auth/sso`, {}, {
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` }, timeout: 30_000,
         });
         const token = String(response.data.token || '').trim();
         if (!token)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.13.24",
+  "version": "1.13.26",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",
@@ -93,7 +93,7 @@
     "test:pitfall:context": "npm run build && node scripts/test-pitfall-context-smoke.js",
     "test:game:command": "node scripts/test-game-command.mjs",
     "test:security:dependencies": "node scripts/test-dependency-security.mjs",
-    "test:security:network": "npm run build && node scripts/test-network-policy.mjs && node scripts/test-installer-trust-policy.mjs",
+    "test:security:network": "npm run build && node scripts/test-network-policy.mjs && node scripts/test-installer-trust-policy.mjs && node scripts/test-local-security-service.mjs",
     "test:security:workspace": "npm run build && node scripts/test-workspace-archive-containment.mjs",
     "test:security:process": "npm run build && node scripts/test-process-approval-safety.mjs",
     "test:security:mutation-preview": "npm run build && node scripts/test-mutation-preview-transaction.mjs",
@@ -131,6 +131,7 @@
     "marked": "^11.0.0",
     "marked-terminal": "^6.2.0",
     "ora": "^7.0.1",
+    "puppeteer": "^24.40.0",
     "ws": "^8.14.2"
   },
   "devDependencies": {
@@ -138,18 +139,9 @@
     "@types/inquirer": "^9.0.7",
     "@types/node": "^20.10.0",
     "@types/ws": "^8.5.10",
-    "puppeteer": "^24.40.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.3.2"
   },
-  "peerDependencies": {
-    "puppeteer": "^24.40.0"
-  },
-  "peerDependenciesMeta": {
-    "puppeteer": {
-      "optional": true
-    }
-  },
   "engines": {
     "node": ">=20.19.0"
   },

package/release-policy.json

@@ -27,7 +27,8 @@
   "signature": {
     "algorithm": "Ed25519",
     "trustedKeys": {
-      "vigthoria-release-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAotTXdcHwZ+D1z5lJMdgAAeMU99BRdMCaCZ465DN2aug=\n-----END PUBLIC KEY-----\n"
+      "vigthoria-release-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAotTXdcHwZ+D1z5lJMdgAAeMU99BRdMCaCZ465DN2aug=\n-----END PUBLIC KEY-----\n",
+      "vigthoria-release-2026-02": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAwzjKsJCJhF387ZPbQoGTciJtOLyJFXp4zpOKrrhQm8I=\n-----END PUBLIC KEY-----\n"
     }
   },
   "channels": {

package/scripts/release/generate-release-evidence.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+
+const archive = path.resolve(String(process.argv[2] || ''));
+const outputDirectory = path.resolve(String(process.argv[3] || ''));
+if (!fs.statSync(archive, { throwIfNoEntry: false })?.isFile()) throw new Error('Usage: generate-release-evidence.mjs <archive.tgz> <output-directory>');
+fs.mkdirSync(outputDirectory, { recursive: true });
+const sha256 = createHash('sha256').update(fs.readFileSync(archive)).digest('hex');
+const readPackage = spawnSync('tar', ['-xOf', archive, 'package/package.json'], { encoding: 'utf8', maxBuffer: 1024 * 1024 });
+if (readPackage.status !== 0) throw new Error(`Unable to inspect archive: ${readPackage.stderr || readPackage.stdout}`);
+const pkg = JSON.parse(readPackage.stdout);
+if (pkg.name !== 'vigthoria-cli' || !pkg.version) throw new Error('Archive package identity is invalid');
+const timestamp = new Date().toISOString();
+const component = {
+  type: 'application',
+  'bom-ref': `pkg:npm/${pkg.name}@${pkg.version}`,
+  name: pkg.name,
+  version: pkg.version,
+  purl: `pkg:npm/${pkg.name}@${pkg.version}`,
+  hashes: [{ alg: 'SHA-256', content: sha256 }],
+};
+const components = Object.entries(pkg.dependencies || {}).sort(([left], [right]) => left.localeCompare(right)).map(([name, version]) => ({
+  type: 'library', name, version: String(version), purl: `pkg:npm/${encodeURIComponent(name)}@${encodeURIComponent(String(version))}`,
+  scope: 'required',
+}));
+const sbom = {
+  bomFormat: 'CycloneDX', specVersion: '1.5', serialNumber: `urn:uuid:${randomUUID()}`, version: 1,
+  metadata: { timestamp, tools: { components: [{ type: 'application', name: 'vigthoria-cli-release-evidence', version: '1' }] }, component },
+  components,
+};
+const provenance = {
+  _type: 'https://in-toto.io/Statement/v1',
+  subject: [{ name: path.basename(archive), digest: { sha256 } }],
+  predicateType: 'https://vigthoria.io/provenance/verified-existing-artifact/v1',
+  predicate: {
+    package: { name: pkg.name, version: pkg.version },
+    verification: { method: 'sha256-and-embedded-package-identity', verifiedAt: timestamp },
+    claimBoundary: 'This record verifies an existing immutable artifact; it does not reconstruct or attest to its original build environment.',
+  },
+};
+const stem = `${pkg.name}-${pkg.version}.tgz`;
+const sbomPath = path.join(outputDirectory, `${stem}.sbom.json`);
+const provenancePath = path.join(outputDirectory, `${stem}.provenance.json`);
+fs.writeFileSync(sbomPath, `${JSON.stringify(sbom, null, 2)}\n`, { mode: 0o644 });
+fs.writeFileSync(provenancePath, `${JSON.stringify(provenance, null, 2)}\n`, { mode: 0o644 });
+console.log(JSON.stringify({ packageName: pkg.name, version: pkg.version, sha256, size: fs.statSync(archive).size, sbomPath, provenancePath }, null, 2));

package/scripts/release/publish-cli-release.mjs

@@ -20,6 +20,9 @@ const privateKeyFile = String(process.env.RELEASE_SIGNING_PRIVATE_KEY_FILE || ''
 const keyId = String(process.env.RELEASE_SIGNING_KEY_ID || '');
 const sbomFile = String(process.env.RELEASE_SBOM_FILE || '');
 const provenanceFile = String(process.env.RELEASE_PROVENANCE_FILE || '');
+const externalArchive = String(process.env.RELEASE_ARCHIVE_FILE || '');
+const republishExisting = process.env.RELEASE_REPUBLISH_EXISTING === '1';
+const resetManifest = process.env.RELEASE_RESET_MANIFEST === '1';
 const policy = getReleasePolicy();
 
 function stop(message) { throw new Error(message); }
@@ -41,14 +44,17 @@ requiredFile(sbomFile, 'RELEASE_SBOM_FILE');
 requiredFile(provenanceFile, 'RELEASE_PROVENANCE_FILE');
 if (!Object.hasOwn(policy.signature.trustedKeys, keyId)) stop(`RELEASE_SIGNING_KEY_ID is not trusted by release-policy.json: ${keyId || '(unset)'}`);
 
-const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
-const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
-if ([pkg.version, lock.version, lock.packages?.['']?.version].some((identity) => identity !== version)) stop('Requested version conflicts with package.json or package-lock.json.');
-const runtime = spawnSync(process.execPath, ['dist/index.js', '--version'], { cwd: root, encoding: 'utf8', env: { ...process.env, VIGTHORIA_OFFLINE: '1', VIGTHORIA_NO_BANNER: '1' } });
-if (runtime.status !== 0 || runtime.stdout.trim() !== version) stop('Requested version conflicts with the built CLI banner.');
+if (externalArchive && !republishExisting) stop('RELEASE_ARCHIVE_FILE requires RELEASE_REPUBLISH_EXISTING=1.');
+if (!externalArchive) {
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
+  if ([pkg.version, lock.version, lock.packages?.['']?.version].some((identity) => identity !== version)) stop('Requested version conflicts with package.json or package-lock.json.');
+  const runtime = spawnSync(process.execPath, ['dist/index.js', '--version'], { cwd: root, encoding: 'utf8', env: { ...process.env, VIGTHORIA_OFFLINE: '1', VIGTHORIA_NO_BANNER: '1' } });
+  if (runtime.status !== 0 || runtime.stdout.trim() !== version) stop('Requested version conflicts with the built CLI banner.');
+}
 
 const archiveFilename = `${policy.packageName}-${version}.tgz`;
-const archive = path.join(root, archiveFilename);
+const archive = externalArchive ? path.resolve(externalArchive) : path.join(root, archiveFilename);
 requiredFile(archive, 'Release archive');
 const metadata = exactPackageMetadata(archive);
 if (metadata.name !== policy.packageName || metadata.version !== version) stop('Requested version conflicts with archive metadata.');
@@ -87,16 +93,21 @@ try {
   verifyReleaseSignature(channel, entry, detached);
 
   let manifest = { schemaVersion: policy.manifest.schemaVersion, channels: {} };
-  if (fs.existsSync(manifestFile)) manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+  if (!resetManifest && fs.existsSync(manifestFile)) manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
   manifest.channels = { ...manifest.channels, [channel]: entry };
   parseReleaseManifest(manifest, channel);
 
   const inputs = [[archive, archiveFilename], [sbomFile, sbomFilename], [provenanceFile, provenanceFilename]];
   const staged = [];
   for (const [source, filename] of inputs) {
+    const destination = path.join(downloadsDirectory, filename);
+    if (fs.existsSync(destination)) {
+      if (republishExisting && digest(destination) === digest(source) && fs.statSync(destination).size === fs.statSync(source).size) continue;
+      stop(`Refusing to overwrite published release component: ${destination}`);
+    }
     const temporary = path.join(downloadsDirectory, `.${filename}.${suffix}.tmp`);
     fs.copyFileSync(source, temporary, fs.constants.COPYFILE_EXCL);
-    staged.push([temporary, path.join(downloadsDirectory, filename)]);
+    staged.push([temporary, destination]);
   }
   const signatureTemporary = path.join(downloadsDirectory, `.${signatureFilename}.${suffix}.tmp`);
   fs.writeFileSync(signatureTemporary, `${detached}\n`, { flag: 'wx', mode: 0o644 });

package/scripts/release/validate-no-go-gates.sh

@@ -66,6 +66,8 @@ node scripts/verify-package-hygiene.js
 echo "[0.7] authoritative Phase 1 security contracts"
 node scripts/test-dependency-security.mjs
 node scripts/test-network-policy.mjs
+node scripts/test-local-security-service.mjs
+node scripts/test-config-noninteractive.mjs
 node scripts/test-installer-trust-policy.mjs
 node scripts/test-workspace-archive-containment.mjs
 node scripts/test-public-repo-clone.mjs