vigthoria-cli 1.13.26 → 1.13.29

package/dist/commands/game.js

@@ -46,11 +46,114 @@ export function gameProcessInvocation(pm, args, platform = process.platform, com
     const command = [executable, ...args].join(' ');
     return { executable: comSpec, args: ['/d', '/s', '/c', command] };
 }
-const run = (pm, args, cwd, timeoutMs = 10 * 60_000) => new Promise((resolve, reject) => { const invocation = gameProcessInvocation(pm, args); const child = spawn(invocation.executable, invocation.args, { cwd, stdio: 'inherit', windowsHide: true, env: safeChildProcessEnv() }); let interrupted = false; const onInterrupt = () => { interrupted = true; child.kill('SIGINT'); }; process.once('SIGINT', onInterrupt); const timer = timeoutMs > 0 ? setTimeout(() => { child.kill('SIGTERM'); reject(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })); }, timeoutMs) : null; const finish = () => { if (timer)
-    clearTimeout(timer); process.removeListener('SIGINT', onInterrupt); }; child.once('error', error => { finish(); reject(error); }); child.once('exit', (code, signal) => { finish(); if (interrupted)
-    reject(new CliCommandError(`${pm} command cancelled by user`, { code: 'GAME_PROCESS_CANCELLED', category: 'cancelled' }));
-else
-    code === 0 ? resolve() : reject(new Error(`${pm} exited with ${signal || code}`)); }); });
+export function windowsProcessTreeTerminationInvocation(pid, systemRoot = process.env.SystemRoot || 'C:\\Windows') {
+    if (!Number.isSafeInteger(pid) || pid <= 0) {
+        throw new CliCommandError('Cannot terminate a game process without a valid owned PID.', {
+            code: 'GAME_PROCESS_ID_INVALID',
+        });
+    }
+    return {
+        executable: path.win32.join(systemRoot, 'System32', 'taskkill.exe'),
+        args: ['/PID', String(pid), '/T', '/F'],
+    };
+}
+async function terminateOwnedProcessTree(child, platform) {
+    const pid = child.pid;
+    if (!pid)
+        return;
+    if (platform === 'win32') {
+        const invocation = windowsProcessTreeTerminationInvocation(pid);
+        await new Promise((resolve) => {
+            const killer = spawn(invocation.executable, invocation.args, {
+                stdio: 'ignore',
+                windowsHide: true,
+                env: safeChildProcessEnv(),
+            });
+            const timer = setTimeout(() => { try {
+                killer.kill();
+            }
+            catch { /* exact helper only */ } resolve(); }, 5_000);
+            killer.once('error', () => { clearTimeout(timer); try {
+                child.kill();
+            }
+            catch { /* already gone */ } resolve(); });
+            killer.once('exit', () => { clearTimeout(timer); resolve(); });
+        });
+        return;
+    }
+    try {
+        process.kill(-pid, 'SIGTERM');
+    }
+    catch {
+        try {
+            child.kill('SIGTERM');
+        }
+        catch { /* already gone */ }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    try {
+        process.kill(-pid, 0);
+        process.kill(-pid, 'SIGKILL');
+    }
+    catch { /* process group exited */ }
+}
+export const runGameProcess = (pm, args, cwd, timeoutMs = 10 * 60_000, outputMode = 'inherit') => new Promise((resolve, reject) => {
+    const invocation = gameProcessInvocation(pm, args);
+    const platform = process.platform;
+    const child = spawn(invocation.executable, invocation.args, {
+        cwd,
+        stdio: outputMode === 'capture' ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+        windowsHide: true,
+        env: safeChildProcessEnv(),
+        detached: platform !== 'win32',
+    });
+    let interrupted = false;
+    let timedOut = false;
+    let settled = false;
+    let stdout = '';
+    let stderr = '';
+    const appendBounded = (current, chunk) => `${current}${String(chunk)}`.slice(-64 * 1024);
+    if (outputMode === 'capture') {
+        child.stdout?.setEncoding('utf8');
+        child.stderr?.setEncoding('utf8');
+        child.stdout?.on('data', (chunk) => { stdout = appendBounded(stdout, chunk); });
+        child.stderr?.on('data', (chunk) => { stderr = appendBounded(stderr, chunk); });
+    }
+    const settle = (error) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        process.removeListener('SIGINT', onInterrupt);
+        error ? reject(error) : resolve({ stdout, stderr });
+    };
+    const onInterrupt = () => {
+        interrupted = true;
+        void terminateOwnedProcessTree(child, platform);
+    };
+    process.once('SIGINT', onInterrupt);
+    const timer = timeoutMs > 0 ? setTimeout(() => {
+        timedOut = true;
+        void terminateOwnedProcessTree(child, platform).finally(() => settle(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' })));
+    }, timeoutMs) : null;
+    child.once('error', (error) => settle(error));
+    child.once('exit', (code, signal) => {
+        if (timedOut) {
+            settle(new CliCommandError(`${pm} command timed out after ${timeoutMs}ms`, { code: 'GAME_PROCESS_TIMEOUT' }));
+        }
+        else if (interrupted) {
+            settle(new CliCommandError(`${pm} command cancelled by user`, { code: 'GAME_PROCESS_CANCELLED', category: 'cancelled' }));
+        }
+        else if (code === 0) {
+            settle();
+        }
+        else {
+            const detail = outputMode === 'capture' ? `: ${(stderr || stdout).trim().slice(-4_000)}` : '';
+            settle(new Error(`${pm} exited with ${signal || code}${detail}`));
+        }
+    });
+});
 const html = `<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>VGE Game</title></head><body><canvas id="game"></canvas><div id="hud"><strong>Vigthoria Gaming Engine</strong><span>Ready</span></div><script type="module" src="/src/main.ts"></script></body></html>\n`;
 const style = `*{box-sizing:border-box}html,body,#game{width:100%;height:100%;margin:0;overflow:hidden}body{background:#030510;color:#e8f7ff;font-family:Inter,system-ui,sans-serif}#game{display:block;touch-action:none}#hud{position:fixed;left:24px;top:24px;display:flex;gap:16px;padding:12px 16px;border:1px solid #00d4ff66;border-radius:12px;background:#070a18cc;backdrop-filter:blur(12px);box-shadow:0 0 32px #7c3aed33}#hud span{color:#5eead4}\n`;
 const main = `import { ArcRotateCamera, Color3, Color4, DirectionalLight, Engine, HemisphericLight, MeshBuilder, PBRMaterial, Scene, ShadowGenerator, Vector3 } from '@babylonjs/core';
@@ -80,21 +183,22 @@ export class GameCommand {
         if (fs.existsSync(root) && fs.readdirSync(root).length)
             throw new Error(`Target directory is not empty: ${root}`);
         fs.mkdirSync(path.join(root, 'src'), { recursive: true });
-        const pkg = { name: slug, version: '0.1.0', private: true, type: 'module', vigthoria: { kind: 'game', engine: 'babylon', renderTransport: 'client-state', schemaVersion: 1 }, scripts: { dev: 'vite', build: 'tsc --noEmit && vite build', preview: 'vite preview' }, dependencies: { '@babylonjs/core': '7.54.3', '@babylonjs/loaders': '7.54.3' }, devDependencies: { typescript: '5.8.3', vite: '6.1.0' } };
+        const pkg = { name: slug, version: '0.1.0', private: true, type: 'module', engines: { node: '>=20.19.0' }, vigthoria: { kind: 'game', engine: 'babylon', renderTransport: 'client-state', schemaVersion: 1 }, scripts: { dev: 'node ./node_modules/vite/bin/vite.js', build: 'node ./node_modules/typescript/bin/tsc --noEmit && node ./node_modules/vite/bin/vite.js build', preview: 'node ./node_modules/vite/bin/vite.js preview' }, dependencies: { '@babylonjs/core': '9.20.0', '@babylonjs/loaders': '9.20.0' }, devDependencies: { typescript: '5.9.3', vite: '7.3.6' } };
         fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
         fs.writeFileSync(path.join(root, 'index.html'), html);
         fs.writeFileSync(path.join(root, 'src/main.ts'), main);
         fs.writeFileSync(path.join(root, 'src/style.css'), style);
+        fs.writeFileSync(path.join(root, 'src/vite-env.d.ts'), '/// <reference types="vite/client" />\n');
         fs.writeFileSync(path.join(root, '.gitignore'), 'node_modules\ndist\n.vigthoria\n');
         fs.writeFileSync(path.join(root, 'tsconfig.json'), JSON.stringify({ compilerOptions: { target: 'ES2022', module: 'ESNext', lib: ['ES2022', 'DOM'], skipLibCheck: true, moduleResolution: 'Bundler', isolatedModules: true, noEmit: true, strict: true }, include: ['src'] }, null, 2) + '\n');
         if (o.install !== false)
-            await run(manager(root, o.packageManager), ['install'], root);
+            await runGameProcess(manager(root, o.packageManager), ['install'], root);
         this.logger.success(`Babylon/VGE game created: ${root}`);
         this.logger.info(`Next: cd ${slug} && vigthoria game run`);
     }
     async run(o) { const root = path.resolve(o.project || process.cwd()); this.project(root); const args = ['run', 'dev', '--', '--host', '127.0.0.1']; if (o.port)
         args.push('--port', String(o.port)); if (o.open !== false)
-        args.push('--open'); await run(manager(root, o.packageManager), args, root, 0); }
+        args.push('--open'); await runGameProcess(manager(root, o.packageManager), args, root, 0); }
     async validate(o) {
         const root = path.resolve(o.project || process.cwd());
         const checks = [];
@@ -110,7 +214,7 @@ export class GameCommand {
         const source = this.sources(root);
         checks.push({ check: 'Babylon client-state metadata', passed: pkg.vigthoria?.engine === 'babylon' && pkg.vigthoria?.renderTransport === 'client-state' }, { check: 'Pinned local Babylon dependencies', passed: /^\d/.test(pkg.dependencies?.['@babylonjs/core'] || '') && /^\d/.test(pkg.dependencies?.['@babylonjs/loaders'] || '') }, { check: 'No CDN engine imports', passed: !/https?:\/\/(cdn|unpkg|jsdelivr)[^\s"']*(babylon|three)/i.test(source) }, { check: 'Runtime diagnostics', passed: source.includes('__vgeDiagnostics') }, { check: 'Client source entry', passed: fs.existsSync(path.join(root, 'src/main.ts')) || fs.existsSync(path.join(root, 'src/main.js')) });
         try {
-            await run(manager(root, o.packageManager), ['run', 'build'], root);
+            await runGameProcess(manager(root, o.packageManager), ['run', 'build'], root, 10 * 60_000, o.json ? 'capture' : 'inherit');
             checks.push({ check: 'Production build', passed: true });
         }
         catch (e) {

package/dist/commands/history.d.ts

@@ -11,7 +11,6 @@ export declare class HistoryCommand {
     constructor(config: Config, logger: Logger);
     private getHeaders;
     private getBaseUrl;
-    private resolveWorkspaceRoot;
     run(options: HistoryOptions): Promise<void>;
 }
 export {};

package/dist/commands/history.js

@@ -3,10 +3,10 @@ import { hasLocalV3AgentCapability } from '../utils/runtime-capability.js';
  * history.ts — List recent V3 agent runs with summaries.
  */
 import chalk from 'chalk';
-import { createRequire } from 'node:module';
 import { createSpinner, CH } from '../utils/logger.js';
 import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/command-contract.js';
-const require = createRequire(import.meta.url);
+import { buildLocalWorkspaceReference } from '../utils/workspace-reference.js';
+import { guardedFetch } from '../utils/network-policy.js';
 export class HistoryCommand {
     config;
     logger;
@@ -36,36 +36,22 @@ export class HistoryCommand {
             (allowLocal ? 'http://127.0.0.1:8030' : null) ||
             configuredApiUrl);
     }
-    resolveWorkspaceRoot(project) {
-        // On Windows or non-absolute paths, send empty so the server uses its fallback root
-        if (/^[a-zA-Z]:[\\/]/.test(project) || /^\\\\/.test(project))
-            return '';
-        if (typeof require !== 'undefined') {
-            try {
-                const path = require('path');
-                if (!path.isAbsolute(project))
-                    return '';
-            }
-            catch { }
-        }
-        return project;
-    }
     async run(options) {
         const limit = options.limit || 20;
         const project = options.project || process.cwd();
-        const workspace = this.resolveWorkspaceRoot(project);
+        const workspaceRef = buildLocalWorkspaceReference(project, String(this.config.get('userId') || this.config.get('email') || ''));
         const spinner = createSpinner('Loading run history...').start();
         try {
             const baseUrl = this.getBaseUrl();
             const params = new URLSearchParams({
                 limit: String(limit),
-                workspace_root: workspace,
-                local_workspace_path: project,
-                project_path: project,
+                workspace_root: '',
+                local_workspace_path: workspaceRef,
+                project_path: workspaceRef,
             });
-            const resp = await fetch(`${baseUrl}/api/runs?${params}`, {
+            const resp = await guardedFetch(`${baseUrl}/api/runs?${params}`, {
                 headers: this.getHeaders(),
-            });
+            }, { audience: 'v3' });
             if (!resp.ok) {
                 spinner.stop();
                 if (resp.status === 404 || resp.status === 502 || resp.status === 503) {

package/dist/commands/hub.d.ts

@@ -6,6 +6,25 @@
  */
 import { Config } from '../utils/config.js';
 import { Logger } from '../utils/logger.js';
+interface Module {
+    id: string;
+    name: string;
+    description: string;
+    endpoint: string;
+    documentation: string;
+    pricing: {
+        unit: string;
+        cost: number;
+        example: string;
+    };
+    status: string;
+    category: string;
+    tags: string[];
+    unit?: string;
+    creditsPerUnit?: number | string;
+    euroPerUnit?: number | string;
+}
+export declare function moduleMatchesIdentifier(module: Pick<Module, 'id' | 'name'>, requested: string): boolean;
 export declare class HubCommand {
     private config;
     constructor(config: Config, _logger: Logger);
@@ -39,3 +58,4 @@ export declare class HubCommand {
      */
     discover(): Promise<void>;
 }
+export {};

package/dist/commands/hub.js

@@ -8,6 +8,19 @@ import chalk from 'chalk';
 import { guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
 const API_BASE = 'https://hub.vigthoria.io';
+function normalizeModuleIdentifier(value) {
+    return String(value || '').trim().toLowerCase().replace(/[\s_]+/g, '-');
+}
+export function moduleMatchesIdentifier(module, requested) {
+    const needle = normalizeModuleIdentifier(requested);
+    if (!needle)
+        return false;
+    const id = normalizeModuleIdentifier(module.id);
+    const name = normalizeModuleIdentifier(module.name);
+    return needle === id
+        || needle === name
+        || needle === id.replace(/-api$/, '');
+}
 export class HubCommand {
     config;
     constructor(config, _logger) {
@@ -76,6 +89,7 @@ export class HubCommand {
             data.results.forEach((module, index) => {
                 const statusColor = module.status === 'available' ? chalk.green : chalk.gray;
                 console.log(chalk.bold.white(`  ${index + 1}. ${module.name}`));
+                console.log(chalk.gray(`     Module ID: ${module.id}`));
                 console.log(chalk.gray(`     ${module.description.substring(0, 80)}...`));
                 console.log(chalk.cyan(`     💰 ${module.pricing.example}`));
                 console.log(statusColor(`     📊 Status: ${module.status.toUpperCase()}`));
@@ -86,7 +100,7 @@ export class HubCommand {
                 console.log(chalk.cyan(`💡 ${data.suggestion}`));
             }
             console.log(chalk.gray('\nTo activate a module: vigthoria hub activate <module-name>'));
-            console.log(chalk.gray('Example: vigthoria hub activate music\n'));
+            console.log(chalk.gray(`Example: vigthoria hub activate ${data.results[0].id}\n`));
         }
         catch (error) {
             throw commandFailure(error, { code: 'HUB_SEARCH_FAILED' });
@@ -144,7 +158,7 @@ export class HubCommand {
         this.getAuthToken();
         console.log(chalk.cyan(`\n🔌 Activating module: ${moduleId}...\n`));
         try {
-            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            const module = (await this.moduleCatalog()).find((entry) => moduleMatchesIdentifier(entry, moduleId));
             if (!module)
                 throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
             console.log(chalk.green(`✅ ${module.name} is published in the Vigthoria module catalog.`));
@@ -186,7 +200,7 @@ export class HubCommand {
     async info(moduleId) {
         console.log(chalk.cyan(`\n📖 Module Info: ${moduleId}\n`));
         try {
-            const module = (await this.moduleCatalog()).find((entry) => entry.id === moduleId);
+            const module = (await this.moduleCatalog()).find((entry) => moduleMatchesIdentifier(entry, moduleId));
             if (!module)
                 throw new CliCommandError(`Unknown Hub module: ${moduleId}`, { code: 'HUB_MODULE_NOT_FOUND', category: 'usage' });
             console.log(chalk.bold.white(`${module.name}`));

package/dist/commands/preview.js

@@ -81,7 +81,7 @@ export class PreviewCommand {
         // Run Template Service preview proof gate
         if (isPreviewProofRequested(options)) {
             try {
-                await this.runProofGate(projectPath, options.screenshot);
+                await this.runProofGate(projectPath, options.screenshot, options.screenshot === true && options.proof !== true);
             }
             catch (error) {
                 this.api.destroy();
@@ -435,7 +435,7 @@ export class PreviewCommand {
     /**
      * Run Template Service preview gate and persist proof bundle
      */
-    async runProofGate(projectPath, captureScreenshot) {
+    async runProofGate(projectPath, captureScreenshot, localScreenshotProof = false) {
         const spinner = createSpinner('Running preview proof gate...').start();
         try {
             const result = await this.api.runTemplateServicePreviewGate('', {
@@ -444,6 +444,11 @@ export class PreviewCommand {
                 targetPath: projectPath,
                 forceFrontendPreview: true,
                 requireScreenshot: captureScreenshot === true,
+                // An explicit screenshot-only command is a local operation. Do not
+                // upload the user's frontend or require an ecosystem login merely to
+                // capture local visual evidence. `--proof` retains the hosted proof
+                // contract, including when combined with `--screenshot`.
+                localScreenshotProof,
             });
             spinner.stop();
             console.log(chalk.bold.white(`  ${CH.hLine.repeat(3)} Preview Proof Gate ${CH.hLine.repeat(39)}`));

package/dist/commands/product-run-registration.js

@@ -386,7 +386,7 @@ Examples:
         .option('--no-open', 'Do not auto-open browser')
         .option('--diff', 'Show consolidated diff of recent agent changes')
         .option('--proof', 'Run Template Service preview gate and persist proof bundle')
-        .option('--screenshot', 'Capture screenshot via Puppeteer')
+        .option('--screenshot', 'Capture screenshot via an installed system browser')
         .action(async (options) => {
         const preview = new PreviewCommand(config, logger);
         await preview.run({

package/dist/commands/replay.d.ts

@@ -10,7 +10,6 @@ export declare class ReplayCommand {
     constructor(config: Config, _logger: Logger);
     private getHeaders;
     private getBaseUrl;
-    private resolveWorkspaceRoot;
     private sleep;
     run(runId: string, options: ReplayOptions): Promise<void>;
 }

package/dist/commands/replay.js

@@ -3,10 +3,10 @@ import { hasLocalV3AgentCapability } from '../utils/runtime-capability.js';
  * replay.ts — Replay events from a V3 agent run step-by-step.
  */
 import chalk from 'chalk';
-import { createRequire } from 'node:module';
 import { createSpinner, CH } from '../utils/logger.js';
 import { CliCommandError, commandFailure, formatSuccessJson } from '../utils/command-contract.js';
-const require = createRequire(import.meta.url);
+import { buildLocalWorkspaceReference } from '../utils/workspace-reference.js';
+import { guardedFetch } from '../utils/network-policy.js';
 export class ReplayCommand {
     config;
     constructor(config, _logger) {
@@ -34,33 +34,24 @@ export class ReplayCommand {
             (allowLocal ? 'http://127.0.0.1:8030' : null) ||
             configuredApiUrl);
     }
-    resolveWorkspaceRoot(project) {
-        if (/^[a-zA-Z]:[\\/]/.test(project) || /^\\\\/.test(project))
-            return '';
-        if (typeof require !== 'undefined') {
-            try {
-                const path = require('path');
-                if (!path.isAbsolute(project))
-                    return '';
-            }
-            catch { }
-        }
-        return project;
-    }
     sleep(ms) {
         return new Promise((resolve) => setTimeout(resolve, ms));
     }
     async run(runId, options) {
         const speed = options.speed || 200;
         const project = options.project || process.cwd();
-        const workspace = this.resolveWorkspaceRoot(project);
+        const workspaceRef = buildLocalWorkspaceReference(project, String(this.config.get('userId') || this.config.get('email') || ''));
         const spinner = createSpinner(`Loading events for run ${runId}...`).start();
         try {
             const baseUrl = this.getBaseUrl();
-            const params = new URLSearchParams({ workspace_root: workspace });
-            const resp = await fetch(`${baseUrl}/api/runs/${encodeURIComponent(runId)}/events?${params}`, {
-                headers: this.getHeaders(),
+            const params = new URLSearchParams({
+                workspace_root: '',
+                local_workspace_path: workspaceRef,
+                project_path: workspaceRef,
             });
+            const resp = await guardedFetch(`${baseUrl}/api/runs/${encodeURIComponent(runId)}/events?${params}`, {
+                headers: this.getHeaders(),
+            }, { audience: 'v3' });
             if (!resp.ok) {
                 spinner.stop();
                 if (resp.status === 404) {

package/dist/commands/repo.js

@@ -161,6 +161,9 @@ export class RepoCommand {
         };
         try {
             const proxyResponse = await attempt(proxyPath, 'coder');
+            if (options.terminalStatuses?.includes(proxyResponse.status)) {
+                return proxyResponse;
+            }
             // A large repository payload can exceed the Coder API's general
             // 50 MiB parser while remaining valid under Community's 100 MiB
             // repository contract. Retry that one status directly.
@@ -615,7 +618,7 @@ export class RepoCommand {
             if (fs.existsSync(outputPath))
                 validateExtractedWorkspace(outputPath);
             if (isCompleteRepositoryInlinePayload(data)) {
-                const stagingRoot = createRuntimeTempDirectory('repo-inline-');
+                const stagingRoot = createRuntimeTempDirectory('repo-inline-', 128 * 1024 * 1024);
                 try {
                     let totalBytes = 0;
                     for (const file of data.files) {
@@ -650,7 +653,7 @@ export class RepoCommand {
                     throw new Error('Failed to download project archive');
                 const archiveBuffer = Buffer.from(await archiveResponse.arrayBuffer());
                 inspectZipArchive(archiveBuffer);
-                const stagingRoot = createRuntimeTempDirectory('repo-pull-');
+                const stagingRoot = createRuntimeTempDirectory('repo-pull-', 256 * 1024 * 1024);
                 const tempArchive = path.join(stagingRoot, 'archive.zip');
                 const extractedPath = path.join(stagingRoot, 'extracted');
                 try {
@@ -920,11 +923,20 @@ export class RepoCommand {
         const spinner = createSpinner('Deleting project...').start();
         try {
             const operationId = createOperationId();
-            const repo = await this.resolveRepoByName(projectName);
+            // A numeric canonical ID is safe to retry directly even after the
+            // first deletion removed it from the active repository listing.
+            const repo = /^\d+$/.test(projectName.trim())
+                ? { id: projectName.trim() }
+                : await this.resolveRepoByName(projectName);
             const response = await this.repoFetch(`/api/repo/projects/${encodeURIComponent(String(repo.id))}`, {
                 method: 'DELETE',
                 headers: { 'X-Vigthoria-Operation-Id': operationId },
-            }, { operationId });
+            }, { operationId, terminalStatuses: /^\d+$/.test(projectName.trim()) ? [404] : undefined });
+            if (response.status === 404 && /^\d+$/.test(projectName.trim())) {
+                spinner.succeed(chalk.green('Project was already deleted from Vigthoria Community Repository'));
+                console.log(chalk.gray('\nNote: Your local files are not affected.\n'));
+                return;
+            }
             if (!response.ok) {
                 const error = await response.json();
                 throw new Error(error.error || 'Failed to delete project');

package/dist/commands/update-registration.js

@@ -186,7 +186,7 @@ export function registerUpdateCommand(program, version) {
                 let updateTempDirectory = null;
                 try {
                     if (source.kind === 'remote') {
-                        updateTempDirectory = createRuntimeTempDirectory('update-');
+                        updateTempDirectory = createRuntimeTempDirectory('update-', 320 * 1024 * 1024);
                         installTarget = path.join(updateTempDirectory, 'candidate.tgz');
                         await downloadFile(source.downloadUrl, installTarget);
                     }
@@ -304,7 +304,7 @@ export function registerUpdateCommand(program, version) {
             && compareVersions(manifestEntry.version, currentVersion) > 0);
         if (manifestIsAuthoritative && manifestEntry) {
             assertReleaseTransition(currentVersion, manifestEntry, channel, allowDowngrade);
-            const updateTempDirectory = createRuntimeTempDirectory('update-');
+            const updateTempDirectory = createRuntimeTempDirectory('update-', 320 * 1024 * 1024);
             const tmpFile = path.join(updateTempDirectory, 'candidate.tgz');
             try {
                 console.log(chalk.cyan(`Downloading release package (${manifestEntry.version})...`));

package/dist/commands/workflow.d.ts

@@ -19,6 +19,9 @@ interface WorkflowRunOptions extends WorkflowOutputOptions {
 interface WorkflowStatusOptions extends WorkflowOutputOptions {
     brain?: boolean;
 }
+interface WorkflowDeleteOptions extends WorkflowOutputOptions {
+    yes?: boolean;
+}
 export declare class WorkflowCommand {
     private config;
     private logger;
@@ -35,6 +38,7 @@ export declare class WorkflowCommand {
     useTemplate(templateId: string, options: WorkflowUseOptions): Promise<void>;
     run(workflowId: string, options: WorkflowRunOptions): Promise<void>;
     status(executionId: string, options: WorkflowStatusOptions): Promise<void>;
+    delete(selector: string, options: WorkflowDeleteOptions): Promise<void>;
 }
 export declare function registerWorkflowCommands(program: Command, config: Config, logger: Logger): void;
 export {};

package/dist/commands/workflow.js

@@ -190,6 +190,29 @@ export class WorkflowCommand {
             `Completed: ${execution.completedAt || '-'}`,
         ].join('\n'), 'Workflow Status');
     }
+    async delete(selector, options) {
+        this.ensureAuthenticated();
+        if (options.yes !== true) {
+            throw new CliCommandError('Workflow deletion requires explicit confirmation with --yes.', {
+                code: 'WORKFLOW_DELETE_CONFIRMATION_REQUIRED',
+                category: 'usage',
+            });
+        }
+        let deleted;
+        try {
+            deleted = await this.api.deleteVigFlowWorkflow(selector);
+        }
+        catch (error) {
+            throw commandFailure(error, { code: 'WORKFLOW_DELETE_FAILED' });
+        }
+        if (options.json) {
+            this.printJson('workflow delete', { deleted });
+            return;
+        }
+        this.logger.success(deleted.alreadyDeleted
+            ? `Workflow ${deleted.id} was already deleted.`
+            : `Workflow ${deleted.name || deleted.id} deleted.`);
+    }
 }
 export function registerWorkflowCommands(program, config, logger) {
     const workflowCommand = program.command('workflow').alias('flow')
@@ -215,5 +238,9 @@ export function registerWorkflowCommands(program, config, logger) {
         .option('--no-brain', 'Do not remember this workflow status in local Project Brain')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (executionId, options) => new WorkflowCommand(config, logger).status(executionId, options));
+    workflowCommand.command('delete <workflowIdOrName>').alias('rm').description('Delete an owned workflow (idempotent by workflow ID)')
+        .option('--yes', 'Confirm permanent workflow deletion', false)
+        .option('--json', 'Emit machine-readable JSON output', false)
+        .action(async (selector, options) => new WorkflowCommand(config, logger).delete(selector, options));
     workflowCommand.action(async () => new WorkflowCommand(config, logger).templates({}));
 }

package/dist/index.js

@@ -51,6 +51,7 @@ import { installConsoleRedaction } from './utils/secret-policy.js';
 import { commandNameFromArgv, failureEnvelope, normalizeCommandError, CliCommandError, } from './utils/command-contract.js';
 import { commandAuthRequirement, commanderCommandPath } from './utils/command-policy.js';
 import { initializeRuntimeTempStorage } from './utils/runtime-temp.js';
+import { hasLocalV3ServiceIdentity } from './utils/runtime-capability.js';
 initializeRuntimeTempStorage();
 applyLocalTestfarmDefaults();
 if (process.env.VIGTHORIA_CAPTURE_RUNTIME_MODEL !== '1')
@@ -534,11 +535,12 @@ export async function main(args) {
         const authRequirement = commandAuthRequirement(commandPath);
         if (authRequirement === 'none')
             return;
-        // On-box service identities are authenticated by their destination
-        // service and must not be confused with a user gateway session.
-        const hasServiceKey = Boolean(process.env.HYPERLOOP_SERVICE_KEY || process.env.V3_SERVICE_KEY);
+        // A local V3 service identity is valid only for Agent. It must never
+        // bypass session policy for coding, repository, deploy, workflow, or any
+        // other command merely because a service key exists on this host.
+        const localAgentServiceIdentity = commandPath === 'agent' && hasLocalV3ServiceIdentity();
         const legionCortex = commandPath === 'legion' && actionCommand.opts().cortex === true;
-        if (hasServiceKey || legionCortex)
+        if (localAgentServiceIdentity || legionCortex)
             return;
         const explicitEnvToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
         if (authRequirement === 'required-session' && !config.isAuthenticated() && !explicitEnvToken) {

package/dist/utils/agentRunOutcome.d.ts

@@ -37,6 +37,13 @@ export interface RunEvaluation {
     statusHeadline: string;
     uiTheme: 'success' | 'warning' | 'error';
 }
+/** Preserve mutation-journal truth while avoiding a false partial-mutation
+ * classification for a read-only run that changed no files. A failed or
+ * unknown rollback always wins over the observed final file count because a
+ * rollback can remove the changed-file snapshot while still leaving state
+ * uncertain on disk.
+ */
+export declare function resolveAgentPartialMutation(changedFileCount: number, reported: unknown): false | 'unknown';
 export declare function createLiveOutcome(): LiveOutcome;
 export declare function isExecutorTimeoutFailure(liveOutcome: LiveOutcome): boolean;
 export declare function isInferenceDegradedFailure(liveOutcome: LiveOutcome): boolean;

package/dist/utils/agentRunOutcome.js

@@ -2,6 +2,19 @@
  * Task-and-quality-validated success evaluation for V3 agent runs.
  * Decouples CLI verdict from raw file-change counts (1.11.0+).
  */
+/** Preserve mutation-journal truth while avoiding a false partial-mutation
+ * classification for a read-only run that changed no files. A failed or
+ * unknown rollback always wins over the observed final file count because a
+ * rollback can remove the changed-file snapshot while still leaving state
+ * uncertain on disk.
+ */
+export function resolveAgentPartialMutation(changedFileCount, reported) {
+    if (reported === true || reported === 'unknown')
+        return 'unknown';
+    if (reported === false)
+        return false;
+    return changedFileCount > 0 ? 'unknown' : false;
+}
 export function createLiveOutcome() {
     return {
         executorFailed: false,