vigthoria-cli 1.13.25 → 1.13.29

package/dist/commands/repo.js

@@ -23,6 +23,35 @@ import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/com
 import { createRuntimeTempDirectory, removeRuntimeTempDirectory } from '../utils/runtime-temp.js';
 import { assertSafeDestinationPath, assertSafeRelativePath, inspectZipArchive, mergeValidatedWorkspace, resolveWorkspacePath, validateExtractedWorkspace, } from '../utils/workspace-boundary.js';
 import inquirer from 'inquirer';
+export function isCompleteRepositoryInlinePayload(data) {
+    if (!Array.isArray(data.files) || data.files.length === 0 || data.inlineComplete === false)
+        return false;
+    return data.files.every((file) => typeof file?.path === 'string'
+        && typeof file?.content === 'string'
+        && (file.encoding === undefined || file.encoding === 'utf8' || file.encoding === 'base64')
+        && file.binary !== true);
+}
+export function resolveRepositoryDownloadRoute(rawUrl, coderApiBase, publicDownload = false) {
+    const parsed = new URL(rawUrl);
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port) {
+        throw new Error('Repository download URL is not an exact trusted HTTPS origin');
+    }
+    if (parsed.hostname.toLowerCase() === 'coder.vigthoria.io')
+        return { url: parsed.href, audience: 'coder' };
+    if (parsed.hostname.toLowerCase() !== 'community.vigthoria.io') {
+        throw new Error('Repository download URL is outside the Coder and Community trust boundary');
+    }
+    if (publicDownload)
+        return { url: parsed.href, audience: 'community' };
+    const match = parsed.pathname.match(/^\/api\/showcase\/(\d+)\/download$/);
+    if (!match || parsed.search || parsed.hash) {
+        throw new Error('Authenticated repository archive URL has an unsupported path');
+    }
+    return {
+        url: `${coderApiBase.replace(/\/$/, '')}/api/community-repo/archive/${encodeURIComponent(match[1])}`,
+        audience: 'coder',
+    };
+}
 const MAX_REPOSITORY_CONTENT_BYTES = 100 * 1024 * 1024;
 const MAX_REPOSITORY_REQUEST_BYTES = 120 * 1024 * 1024;
 class RepositoryApiError extends Error {
@@ -87,17 +116,6 @@ export class RepoCommand {
             'Content-Type': 'application/json',
         };
     }
-    getRepositoryAudienceForUrl(rawUrl) {
-        const hostname = new URL(rawUrl).hostname.toLowerCase();
-        if (hostname === 'coder.vigthoria.io')
-            return 'coder';
-        if (hostname === 'community.vigthoria.io')
-            return 'community';
-        throw new Error('Repository download URL is outside the Coder and Community trust boundary');
-    }
-    getAuthHeadersForUrl(rawUrl) {
-        return this.getAuthHeaders(this.getRepositoryAudienceForUrl(rawUrl));
-    }
     async ensureCommunityAuth() {
         if (this.communityToken) {
             return;
@@ -143,6 +161,9 @@ export class RepoCommand {
         };
         try {
             const proxyResponse = await attempt(proxyPath, 'coder');
+            if (options.terminalStatuses?.includes(proxyResponse.status)) {
+                return proxyResponse;
+            }
             // A large repository payload can exceed the Coder API's general
             // 50 MiB parser while remaining valid under Community's 100 MiB
             // repository contract. Retry that one status directly.
@@ -596,17 +617,43 @@ export class RepoCommand {
         try {
             if (fs.existsSync(outputPath))
                 validateExtractedWorkspace(outputPath);
-            if (data.downloadUrl) {
-                const archiveResponse = await guardedFetch(data.downloadUrl, {
+            if (isCompleteRepositoryInlinePayload(data)) {
+                const stagingRoot = createRuntimeTempDirectory('repo-inline-', 128 * 1024 * 1024);
+                try {
+                    let totalBytes = 0;
+                    for (const file of data.files) {
+                        const filePath = resolveWorkspacePath(stagingRoot, file.path, { allowMissing: true });
+                        const content = file.encoding === 'base64'
+                            ? Buffer.from(file.content, 'base64')
+                            : Buffer.from(file.content, 'utf8');
+                        if (typeof file.size === 'number' && file.size !== content.byteLength) {
+                            throw new Error(`Repository file size mismatch: ${file.path}`);
+                        }
+                        totalBytes += content.byteLength;
+                        if (totalBytes > MAX_REPOSITORY_CONTENT_BYTES)
+                            throw new Error('Repository inline payload exceeds the materialization limit');
+                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                        fs.writeFileSync(filePath, content, { mode: 0o600 });
+                    }
+                    validateExtractedWorkspace(stagingRoot);
+                    mergeValidatedWorkspace(stagingRoot, outputPath);
+                }
+                finally {
+                    removeRuntimeTempDirectory(stagingRoot);
+                }
+            }
+            else if (data.downloadUrl) {
+                const route = resolveRepositoryDownloadRoute(data.downloadUrl, this.apiBase, publicDownload);
+                const archiveResponse = await guardedFetch(route.url, {
                     headers: publicDownload
                         ? { 'Content-Type': 'application/json' }
-                        : this.getAuthHeadersForUrl(data.downloadUrl)
-                }, { audience: this.getRepositoryAudienceForUrl(data.downloadUrl) });
+                        : this.getAuthHeaders(route.audience)
+                }, { audience: route.audience });
                 if (!archiveResponse.ok)
                     throw new Error('Failed to download project archive');
                 const archiveBuffer = Buffer.from(await archiveResponse.arrayBuffer());
                 inspectZipArchive(archiveBuffer);
-                const stagingRoot = createRuntimeTempDirectory('repo-pull-');
+                const stagingRoot = createRuntimeTempDirectory('repo-pull-', 256 * 1024 * 1024);
                 const tempArchive = path.join(stagingRoot, 'archive.zip');
                 const extractedPath = path.join(stagingRoot, 'extracted');
                 try {
@@ -638,23 +685,8 @@ export class RepoCommand {
                     removeRuntimeTempDirectory(stagingRoot);
                 }
             }
-            else if (data.files) {
-                const stagingRoot = createRuntimeTempDirectory('repo-inline-');
-                try {
-                    for (const file of data.files) {
-                        const filePath = resolveWorkspacePath(stagingRoot, file.path, { allowMissing: true });
-                        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-                        fs.writeFileSync(filePath, file.content, { mode: 0o600 });
-                    }
-                    validateExtractedWorkspace(stagingRoot);
-                    mergeValidatedWorkspace(stagingRoot, outputPath);
-                }
-                finally {
-                    removeRuntimeTempDirectory(stagingRoot);
-                }
-            }
             else {
-                throw new Error('Repository response contained neither an archive nor inline files');
+                throw new Error('Repository response contained neither a complete inline payload nor an archive');
             }
             downloadSpinner.succeed(chalk.green('Project materialized successfully!'));
             console.log(chalk.cyan('\n📁 Project extracted to:'));
@@ -891,10 +923,20 @@ export class RepoCommand {
         const spinner = createSpinner('Deleting project...').start();
         try {
             const operationId = createOperationId();
-            const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(projectName)}`, {
+            // A numeric canonical ID is safe to retry directly even after the
+            // first deletion removed it from the active repository listing.
+            const repo = /^\d+$/.test(projectName.trim())
+                ? { id: projectName.trim() }
+                : await this.resolveRepoByName(projectName);
+            const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(String(repo.id))}`, {
                 method: 'DELETE',
                 headers: { 'X-Vigthoria-Operation-Id': operationId },
-            }, { operationId });
+            }, { operationId, terminalStatuses: /^\d+$/.test(projectName.trim()) ? [404] : undefined });
+            if (response.status === 404 && /^\d+$/.test(projectName.trim())) {
+                spinner.succeed(chalk.green('Project was already deleted from Vigthoria Community Repository'));
+                console.log(chalk.gray('\nNote: Your local files are not affected.\n'));
+                return;
+            }
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to delete project');

package/dist/commands/update-registration.js

@@ -186,7 +186,7 @@ export function registerUpdateCommand(program, version) {
                 let updateTempDirectory = null;
                 try {
                     if (source.kind === 'remote') {
-                        updateTempDirectory = createRuntimeTempDirectory('update-');
+                        updateTempDirectory = createRuntimeTempDirectory('update-', 320 * 1024 * 1024);
                         installTarget = path.join(updateTempDirectory, 'candidate.tgz');
                         await downloadFile(source.downloadUrl, installTarget);
                     }
@@ -252,7 +252,7 @@ export function registerUpdateCommand(program, version) {
                 if (!signatureResponse.ok)
                     throw new Error(`Detached signature returned HTTP ${signatureResponse.status}`);
                 verifyReleaseSignature(channel, manifestEntry, await signatureResponse.text());
-                assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
+                console.log(chalk.gray(`Verified ${channel} manifest: version=${manifestEntry.version} package=${manifestEntry.packageName}@${manifestEntry.packageVersion} size=${manifestEntry.size} sha256=${manifestEntry.sha256}`));
             }
             catch (error) {
                 if (error instanceof CliCommandError)
@@ -303,7 +303,8 @@ export function registerUpdateCommand(program, version) {
             && compareVersions(manifestEntry.version, effectiveLatest) >= 0
             && compareVersions(manifestEntry.version, currentVersion) > 0);
         if (manifestIsAuthoritative && manifestEntry) {
-            const updateTempDirectory = createRuntimeTempDirectory('update-');
+            assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
+            const updateTempDirectory = createRuntimeTempDirectory('update-', 320 * 1024 * 1024);
             const tmpFile = path.join(updateTempDirectory, 'candidate.tgz');
             try {
                 console.log(chalk.cyan(`Downloading release package (${manifestEntry.version})...`));

package/dist/commands/workflow.d.ts

@@ -19,6 +19,9 @@ interface WorkflowRunOptions extends WorkflowOutputOptions {
 interface WorkflowStatusOptions extends WorkflowOutputOptions {
     brain?: boolean;
 }
+interface WorkflowDeleteOptions extends WorkflowOutputOptions {
+    yes?: boolean;
+}
 export declare class WorkflowCommand {
     private config;
     private logger;
@@ -35,6 +38,7 @@ export declare class WorkflowCommand {
     useTemplate(templateId: string, options: WorkflowUseOptions): Promise<void>;
     run(workflowId: string, options: WorkflowRunOptions): Promise<void>;
     status(executionId: string, options: WorkflowStatusOptions): Promise<void>;
+    delete(selector: string, options: WorkflowDeleteOptions): Promise<void>;
 }
 export declare function registerWorkflowCommands(program: Command, config: Config, logger: Logger): void;
 export {};

package/dist/commands/workflow.js

@@ -190,6 +190,29 @@ export class WorkflowCommand {
             `Completed: ${execution.completedAt || '-'}`,
         ].join('\n'), 'Workflow Status');
     }
+    async delete(selector, options) {
+        this.ensureAuthenticated();
+        if (options.yes !== true) {
+            throw new CliCommandError('Workflow deletion requires explicit confirmation with --yes.', {
+                code: 'WORKFLOW_DELETE_CONFIRMATION_REQUIRED',
+                category: 'usage',
+            });
+        }
+        let deleted;
+        try {
+            deleted = await this.api.deleteVigFlowWorkflow(selector);
+        }
+        catch (error) {
+            throw commandFailure(error, { code: 'WORKFLOW_DELETE_FAILED' });
+        }
+        if (options.json) {
+            this.printJson('workflow delete', { deleted });
+            return;
+        }
+        this.logger.success(deleted.alreadyDeleted
+            ? `Workflow ${deleted.id} was already deleted.`
+            : `Workflow ${deleted.name || deleted.id} deleted.`);
+    }
 }
 export function registerWorkflowCommands(program, config, logger) {
     const workflowCommand = program.command('workflow').alias('flow')
@@ -215,5 +238,9 @@ export function registerWorkflowCommands(program, config, logger) {
         .option('--no-brain', 'Do not remember this workflow status in local Project Brain')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (executionId, options) => new WorkflowCommand(config, logger).status(executionId, options));
+    workflowCommand.command('delete <workflowIdOrName>').alias('rm').description('Delete an owned workflow (idempotent by workflow ID)')
+        .option('--yes', 'Confirm permanent workflow deletion', false)
+        .option('--json', 'Emit machine-readable JSON output', false)
+        .action(async (selector, options) => new WorkflowCommand(config, logger).delete(selector, options));
     workflowCommand.action(async () => new WorkflowCommand(config, logger).templates({}));
 }

package/dist/index.js

@@ -51,6 +51,7 @@ import { installConsoleRedaction } from './utils/secret-policy.js';
 import { commandNameFromArgv, failureEnvelope, normalizeCommandError, CliCommandError, } from './utils/command-contract.js';
 import { commandAuthRequirement, commanderCommandPath } from './utils/command-policy.js';
 import { initializeRuntimeTempStorage } from './utils/runtime-temp.js';
+import { hasLocalV3ServiceIdentity } from './utils/runtime-capability.js';
 initializeRuntimeTempStorage();
 applyLocalTestfarmDefaults();
 if (process.env.VIGTHORIA_CAPTURE_RUNTIME_MODEL !== '1')
@@ -534,11 +535,12 @@ export async function main(args) {
         const authRequirement = commandAuthRequirement(commandPath);
         if (authRequirement === 'none')
             return;
-        // On-box service identities are authenticated by their destination
-        // service and must not be confused with a user gateway session.
-        const hasServiceKey = Boolean(process.env.HYPERLOOP_SERVICE_KEY || process.env.V3_SERVICE_KEY);
+        // A local V3 service identity is valid only for Agent. It must never
+        // bypass session policy for coding, repository, deploy, workflow, or any
+        // other command merely because a service key exists on this host.
+        const localAgentServiceIdentity = commandPath === 'agent' && hasLocalV3ServiceIdentity();
         const legionCortex = commandPath === 'legion' && actionCommand.opts().cortex === true;
-        if (hasServiceKey || legionCortex)
+        if (localAgentServiceIdentity || legionCortex)
             return;
         const explicitEnvToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
         if (authRequirement === 'required-session' && !config.isAuthenticated() && !explicitEnvToken) {

package/dist/utils/agentRunOutcome.d.ts

@@ -37,6 +37,13 @@ export interface RunEvaluation {
     statusHeadline: string;
     uiTheme: 'success' | 'warning' | 'error';
 }
+/** Preserve mutation-journal truth while avoiding a false partial-mutation
+ * classification for a read-only run that changed no files. A failed or
+ * unknown rollback always wins over the observed final file count because a
+ * rollback can remove the changed-file snapshot while still leaving state
+ * uncertain on disk.
+ */
+export declare function resolveAgentPartialMutation(changedFileCount: number, reported: unknown): false | 'unknown';
 export declare function createLiveOutcome(): LiveOutcome;
 export declare function isExecutorTimeoutFailure(liveOutcome: LiveOutcome): boolean;
 export declare function isInferenceDegradedFailure(liveOutcome: LiveOutcome): boolean;

package/dist/utils/agentRunOutcome.js

@@ -2,6 +2,19 @@
  * Task-and-quality-validated success evaluation for V3 agent runs.
  * Decouples CLI verdict from raw file-change counts (1.11.0+).
  */
+/** Preserve mutation-journal truth while avoiding a false partial-mutation
+ * classification for a read-only run that changed no files. A failed or
+ * unknown rollback always wins over the observed final file count because a
+ * rollback can remove the changed-file snapshot while still leaving state
+ * uncertain on disk.
+ */
+export function resolveAgentPartialMutation(changedFileCount, reported) {
+    if (reported === true || reported === 'unknown')
+        return 'unknown';
+    if (reported === false)
+        return false;
+    return changedFileCount > 0 ? 'unknown' : false;
+}
 export function createLiveOutcome() {
     return {
         executorFailed: false,

package/dist/utils/api.d.ts

@@ -30,6 +30,17 @@ export type ChatRequestOptions = {
 export interface APIClientDependencies {
     screenshotAdapter?: PreviewScreenshotPort;
 }
+type V3ClientToolMutation = {
+    path: string;
+    content: string;
+    sha256: string;
+};
+type V3ClientToolResult = {
+    success: boolean;
+    output: string;
+    error?: string;
+    mutation?: V3ClientToolMutation;
+};
 export declare class CLIError extends Error {
     category: CLIErrorCategory;
     statusCode?: number;
@@ -167,6 +178,11 @@ export declare class APIClient {
         executionOptions?: Record<string, unknown>;
     }): Promise<VigFlowExecutionResult>;
     getVigFlowExecutionStatus(executionId: string): Promise<VigFlowExecutionStatus>;
+    deleteVigFlowWorkflow(selector: string): Promise<{
+        id: string;
+        name?: string;
+        alreadyDeleted?: boolean;
+    }>;
     getV3AgentHeaders(): Promise<Record<string, string>>;
     ensureV3ServiceKey(): Promise<void>;
     runV3HealthCheck(): Promise<{
@@ -229,12 +245,15 @@ export declare class APIClient {
     captureV3AgentStreamMutation(event: any, streamedFiles: Record<string, string>, serverRoot?: string | null): void;
     private applyV3AgentStreamEventToWorkspace;
     private resolveV3ClientToolPath;
+    private describeMissingV3ClientToolPath;
     private recordV3ClientToolMutation;
+    private buildV3ClientToolMutation;
     private executeV3ClientToolRequest;
     private handleV3ClientToolRequest;
     private writeV3AgentWorkspaceFile;
     recoverAgentWorkspaceFiles(context?: Record<string, any>, streamedFiles?: Record<string, string>, expectedFiles?: string[]): void;
     normalizeAgentWorkspaceRelativePath(rawPath: string, rootPath?: string): string;
+    private isExplicitSingleFileFrontendRequest;
     ensureAgentFrontendPolish(message?: string, context?: Record<string, any>): Promise<void>;
     private injectSectionBeforeFooter;
     private injectNavLink;
@@ -342,11 +361,7 @@ export declare class APIClient {
     getClientToolErrors(): string[];
     clearAgentRunDiagnostics(): void;
     private recordClientToolError;
-    submitClientToolResult(contextId: string, callId: string, result: {
-        success: boolean;
-        output: string;
-        error?: string;
-    }, backendUrl?: string | null): Promise<void>;
+    submitClientToolResult(contextId: string, callId: string, result: V3ClientToolResult, backendUrl?: string | null): Promise<void>;
     private isHealthyServicePayload;
     private extractModelCount;
     private probeModelList;