vigthoria-cli 1.13.31 → 1.13.42

package/dist/utils/api.js

@@ -4,6 +4,7 @@
  */
 import axios from 'axios';
 import { createHash, randomUUID } from 'crypto';
+import { execFileSync } from 'child_process';
 import fs from 'fs';
 import https from 'https';
 import net from 'net';
@@ -22,7 +23,7 @@ import { buildClientManifest } from './clientManifest.js';
 import { assertTrustedEndpoint, guardedFetch, installAxiosNetworkPolicy, installGlobalFetchPolicy } from './network-policy.js';
 import { assertSafeRelativePath, resolveWorkspacePath } from './workspace-boundary.js';
 import { parseSupportedProcess } from './process-policy.js';
-import { SystemBrowserScreenshotAdapter } from './preview-screenshot-adapter.js';
+import { SystemBrowserScreenshotAdapter, } from './preview-screenshot-adapter.js';
 import { normalizeSubscriptionResponse } from './subscription-policy.js';
 import { ModelGovernance } from './model-governance.js';
 import { OperatorClient, OperatorClientError } from './operator-client.js';
@@ -37,9 +38,22 @@ import { VigFlowClient, } from './vigflow-client.js';
 import { MutationJournal, finalizeMutationTransaction, } from './mutation-journal.js';
 import { containsHighConfidenceSecret, isSensitivePath, redactSensitiveText, safeChildProcessEnv, scanOutboundContext, } from './secret-policy.js';
 import { buildLocalWorkspaceReference } from './workspace-reference.js';
+import { resolveJavaScriptSyntaxModes } from './javascript-syntax.js';
 export const VIGTHORIA_HUB_CREDITS_URL = 'https://hub.vigthoria.io/credits';
 export const VIGTHORIA_SERVER_TEMPORARILY_UNAVAILABLE_MESSAGE = 'Vigthoria Server is temporarily not available. Please try again later. If the issue persists, please contact support.';
+export function resolveSelfHostedModelAuthToken(environment = process.env, userToken = '') {
+    const serviceToken = String(environment.VIGTHORIA_INFERENCE_SERVICE_TOKEN || '').trim();
+    return serviceToken || String(userToken || '').trim();
+}
 const MAX_V3_CLIENT_MUTATION_BYTES = 512 * 1024;
+// These are the authoritative V3 request-schema ceilings.  A local tool can
+// produce a very long parser diagnostic (for example when a generated module
+// contains one large unterminated line).  Sending that diagnostic verbatim
+// makes FastAPI reject the result with HTTP 422 while the server-side tool
+// future continues waiting.  Normalize before the first submission so every
+// local outcome, including failure, is deliverable.
+const MAX_V3_CLIENT_RESULT_OUTPUT_CHARS = 500_000;
+const MAX_V3_CLIENT_RESULT_ERROR_CHARS = 10_000;
 export class CLIError extends Error {
     category;
     statusCode;
@@ -152,7 +166,7 @@ export function sanitizeUserFacingPathText(input) {
         [/\bvig-remote(?:-server)?-[A-Za-z0-9._-]+/gi, 'workspace'],
         [/\bvig-fork-[A-Za-z0-9._-]+/gi, 'workspace'],
         // ── V3 Code Agent installation tree and sibling services
-        [new RegExp(String.raw `/var/www/V3-Code-Agent(?:/${pathToken})?`, 'gi'), '[Vigthoria Agent]'],
+        [new RegExp(String.raw `/var/www/V3-Code-Agent(?:-(?:IDE|CLI|VIBE))?(?:/${pathToken})?`, 'gi'), '[Vigthoria Agent]'],
         [new RegExp(String.raw `/var/www/(?:agent-vigthoria|vigthoria-model-router|vigthoria-devtools-bridge|vigthoria-hyper-loop|vigthoria-mcp-server|vigthoria-template-service|vigthoria-security-devops|vigthoria-coder|vigthoria-code|Vigthoria-Code-2|vigthoria-asset-storage|vigthoria-storage-service|vigthoria-hosted)(?:/${pathToken})?`, 'gi'), '[Vigthoria service]'],
         // ── User workspace mount + long-term storage backing path
         [new RegExp(String.raw `/var/www/(?:vigthoria-user-workspaces|\.vigthoria)(?:/${pathToken})?`, 'gi'), 'workspace'],
@@ -320,6 +334,13 @@ export class APIClient {
     pendingV3ClientToolTasks = new Set();
     /** Tracks files mutated via client_tool_request during an active V3 SSE stream. */
     activeV3StreamedFiles = null;
+    /**
+     * Owns the currently open local workspace transaction for a foreground V3
+     * run.  This must live on the API lifecycle rather than only in the async
+     * call stack: SIGINT/SIGTERM can otherwise terminate Node before the
+     * workflow catch block gets a chance to restore the workspace.
+     */
+    activeMutationJournal = null;
     lifecycleAbortController = new AbortController();
     frontendPreviewService;
     withLifecycleSignal(signal) {
@@ -421,6 +442,7 @@ export class APIClient {
         this.frontendPreviewService = new FrontendPreviewService({
             getBaseUrls: () => this.getTemplateServiceBaseUrls(),
             getAccessToken: () => this.getAccessToken(),
+            getServiceKey: () => this.config.get('v3ServiceKey'),
             fetch: (input, init) => guardedFetch(input, { ...init, signal: this.withLifecycleSignal(init.signal) }, { audience: 'template' }),
             resolveTargetPath: (context) => this.resolveAgentTargetPath(context),
             extractExpectedFiles: (message, context) => this.extractExpectedWorkspaceFiles(message, context),
@@ -510,7 +532,7 @@ export class APIClient {
             return req;
         });
         this.selfHostedModelRouterClient?.interceptors.request.use((req) => {
-            const token = this.getAccessToken();
+            const token = resolveSelfHostedModelAuthToken(process.env, this.getAccessToken() || '');
             const destination = resolveAxiosRequestUrl(req);
             if (token) {
                 assertTrustedEndpoint(destination, { audience: 'models', credentialBearing: true });
@@ -519,9 +541,9 @@ export class APIClient {
             return req;
         });
         // Add response interceptors for token refresh + structured errors
-        const createAuthRetryInterceptor = (client) => {
+        const createAuthRetryInterceptor = (client, refreshableCredential = true) => {
             client.interceptors.response.use((res) => res, async (error) => {
-                if (error.response?.status === 401) {
+                if (error.response?.status === 401 && refreshableCredential) {
                     const refreshed = await this.refreshToken();
                     if (refreshed && error.config) {
                         return client.request(error.config);
@@ -534,7 +556,8 @@ export class APIClient {
         createAuthRetryInterceptor(this.client);
         createAuthRetryInterceptor(this.modelRouterClient);
         if (this.selfHostedModelRouterClient) {
-            createAuthRetryInterceptor(this.selfHostedModelRouterClient);
+            const usesServiceIdentity = Boolean(String(process.env.VIGTHORIA_INFERENCE_SERVICE_TOKEN || '').trim());
+            createAuthRetryInterceptor(this.selfHostedModelRouterClient, !usesServiceIdentity);
         }
     }
     /**
@@ -544,6 +567,7 @@ export class APIClient {
      * on Windows / Node 25+.
      */
     destroy() {
+        const mutation = this.rollbackActiveMutationTransaction();
         this.lifecycleAbortController.abort();
         this.unsubscribeAuthInvalidation?.();
         this.unsubscribeAuthInvalidation = null;
@@ -551,6 +575,45 @@ export class APIClient {
             this._httpsAgent.destroy();
             this._httpsAgent = null;
         }
+        return mutation;
+    }
+    trackMutationTransaction(journal) {
+        if (this.activeMutationJournal && this.activeMutationJournal !== journal) {
+            throw new Error('A V3 workspace mutation transaction is already active.');
+        }
+        this.activeMutationJournal = journal;
+    }
+    releaseMutationTransaction(journal) {
+        if (this.activeMutationJournal === journal) {
+            this.activeMutationJournal = null;
+        }
+    }
+    rollbackMutationTransaction(journal) {
+        try {
+            return journal.rollback();
+        }
+        finally {
+            this.releaseMutationTransaction(journal);
+        }
+    }
+    rollbackActiveMutationTransaction() {
+        const journal = this.activeMutationJournal;
+        if (!journal)
+            return null;
+        try {
+            const mutation = this.rollbackMutationTransaction(journal);
+            if (mutation.partialMutation) {
+                this.logger.error(`Interrupted V3 operation ${mutation.operationId} left a partial workspace mutation: ${mutation.rollbackFailures.join('; ')}`);
+            }
+            else if (mutation.affectedPaths.length > 0) {
+                this.logger.warn(`Interrupted V3 operation ${mutation.operationId}; restored ${mutation.affectedPaths.length} workspace path(s).`);
+            }
+            return mutation;
+        }
+        catch (error) {
+            this.logger.error(`Interrupted V3 workspace rollback failed: ${error.message}`);
+            return null;
+        }
     }
     /** Exposed for Balanced 4B agent routing (local inference :8016). */
     getSelfHostedModelsApiUrl() {
@@ -896,9 +959,11 @@ export class APIClient {
         const localWorkspaceSummary = this.buildLocalWorkspaceSummary(localWorkspacePath, promptFocus, !clientToolExecution);
         if (clientToolExecution && localWorkspaceSummary) {
             localWorkspaceSummary.workspaceHydration = {
-                delivery: 'client-tool-bridge',
+                delivery: resolvedContext.workspaceFilesOutOfBand === true
+                    ? 'client-tool-bridge+validation-mirror'
+                    : 'client-tool-bridge',
                 fileCount: Number(localWorkspaceSummary.fileCount || 0),
-                complete: false,
+                complete: resolvedContext.workspaceFilesOutOfBand === true,
                 authoritativeLocation: 'client',
             };
             delete localWorkspaceSummary.workspaceFiles;
@@ -917,9 +982,11 @@ export class APIClient {
             serverWorkspacePath,
         });
         // A local CLI/Workbench workspace remains authoritative on that machine.
-        // Only server-owned/background runs may hydrate a bounded server copy.
+        // Its bounded server scratch copy is validation-only and is hydrated from
+        // the out-of-band request payload so established cross-file interfaces are
+        // available before the first delegated mutation is mirrored.
         const effectiveWorkspacePath = serverWorkspacePath || null;
-        const needsHydration = !clientToolExecution && !serverWorkspacePath && !!localWorkspacePath;
+        const needsHydration = !serverWorkspacePath && !!localWorkspacePath;
         const agentTaskType = resolvedContext.agentTaskType || 'general';
         const rawPrompt = resolvedContext.rawPrompt || resolvedContext.prompt || '';
         const executionHints = (resolvedContext.executionHints && typeof resolvedContext.executionHints === 'object')
@@ -973,13 +1040,15 @@ export class APIClient {
             projectPath: effectiveWorkspacePath,
             targetPath: effectiveWorkspacePath,
             // Never send a client-local absolute path to the V3 model boundary.
-            // The server only receives a stable label. Local bridge runs retrieve
-            // file contents on demand through authenticated client tool requests.
+            // The server only receives a stable label. Local bridge runs still
+            // execute reads and writes on the client; the separate bounded file map
+            // exists only to keep the server's validation mirror graph-complete.
             localWorkspacePath: serverWorkspacePath ? serverWorkspacePath : localWorkspaceRef,
             localWorkspaceRef,
             localWorkspaceName,
             localWorkspaceSummary,
-            // This is true only for explicit server-owned/background execution.
+            // A remote local-workspace run also requires its validation-only mirror
+            // to be hydrated before execution starts.
             workspaceHydrationRequired: needsHydration,
             contextId: resolvedContext.contextId,
             traceId: resolvedContext.traceId,
@@ -1288,462 +1357,6 @@ export class APIClient {
             contextState: resolvedContext.contextState || null,
         });
     }
-    extractEmergencyAppName(message = '', fallback = 'Signal Desk') {
-        const match = String(message || '').match(/called\s+([A-Z][A-Za-z0-9&\- ]{2,40})/i);
-        return match?.[1]?.trim() || fallback;
-    }
-    materializeEmergencySaaSWorkspace(message = '', context = {}) {
-        const rootPath = this.resolveAgentTargetPath(context);
-        if (!rootPath) {
-            return null;
-        }
-        fs.mkdirSync(rootPath, { recursive: true });
-        const appName = this.extractEmergencyAppName(message);
-        const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${appName}</title>
-  <link rel="stylesheet" href="styles.css">
-</head>
-<body>
-  <div class="app-shell">
-    <aside class="sidebar">
-      <div class="brand">${appName}</div>
-      <button class="menu-toggle" id="menu-toggle" aria-label="Toggle navigation">Menu</button>
-      <nav>
-        <a href="#dashboard" class="nav-link active">Dashboard</a>
-        <a href="#team" class="nav-link">Team</a>
-        <a href="#billing" class="nav-link">Billing</a>
-        <a href="#settings" class="nav-link">Settings</a>
-      </nav>
-    </aside>
-    <main class="content">
-      <section class="hero-card panel active-panel" id="dashboard">
-        <div class="hero-copy">
-          <p class="eyebrow">Dashboard</p>
-          <h1>${appName} revenue command center</h1>
-          <p>Track login activity, campaign velocity, billing state, and team performance from one responsive SaaS workspace.</p>
-        </div>
-        <form class="login-card">
-          <h2>Login</h2>
-          <label>Email<input type="email" placeholder="ops@${appName.toLowerCase().replace(/[^a-z0-9]+/g, '') || 'signaldesk'}.io"></label>
-          <label>Password<input type="password" placeholder="Enter password"></label>
-          <button type="submit">Enter dashboard</button>
-        </form>
-      </section>
-
-      <section class="stats-grid">
-        <article class="stat-card"><span>MRR</span><strong>$284K</strong><em>+12.4%</em></article>
-        <article class="stat-card"><span>Activation</span><strong>74%</strong><em>+6.1%</em></article>
-        <article class="stat-card"><span>Team Seats</span><strong>128</strong><em>8 pending</em></article>
-        <article class="stat-card"><span>Churn Risk</span><strong>2.1%</strong><em>Low</em></article>
-      </section>
-
-      <section class="workspace-grid">
-        <article class="panel chart-panel">
-          <div class="panel-header">
-            <h2>Analytics</h2>
-            <button id="open-modal" type="button">Add campaign</button>
-          </div>
-          <div class="chart-bars" aria-label="Revenue chart">
-            <div class="bar" style="--value: 52%"><span>Mon</span></div>
-            <div class="bar" style="--value: 68%"><span>Tue</span></div>
-            <div class="bar" style="--value: 74%"><span>Wed</span></div>
-            <div class="bar" style="--value: 59%"><span>Thu</span></div>
-            <div class="bar" style="--value: 88%"><span>Fri</span></div>
-          </div>
-        </article>
-
-        <article class="panel activity-panel">
-          <div class="panel-header"><h2>Activity Feed</h2><span>Live</span></div>
-          <ul class="activity-feed">
-            <li><strong>Billing</strong><span>Enterprise invoice paid</span></li>
-            <li><strong>Team</strong><span>New strategist invited to workspace</span></li>
-            <li><strong>Dashboard</strong><span>KPI threshold updated for activation alerts</span></li>
-          </ul>
-        </article>
-
-        <article class="panel" id="team">
-          <div class="panel-header"><h2>Team Management</h2><span>Owners and operators</span></div>
-          <div class="team-list">
-            <div><strong>Ana</strong><span>Growth lead</span></div>
-            <div><strong>Marcus</strong><span>Billing admin</span></div>
-            <div><strong>Lina</strong><span>Lifecycle analyst</span></div>
-          </div>
-        </article>
-
-        <article class="panel" id="billing">
-          <div class="panel-header"><h2>Billing</h2><span>Current plan</span></div>
-          <div class="billing-card">
-            <strong>Scale Annual</strong>
-            <p>Renews on 12 Oct with usage-based analytics overages.</p>
-            <button type="button" class="secondary-action">Update payment method</button>
-          </div>
-        </article>
-
-        <article class="panel" id="settings">
-          <div class="panel-header"><h2>Settings</h2><span>Automation and alerts</span></div>
-          <form class="settings-form">
-            <label>Alert threshold<input type="number" value="18"></label>
-            <label>Weekly digest<select><option>Enabled</option><option>Paused</option></select></label>
-            <button type="submit">Save settings</button>
-          </form>
-        </article>
-      </section>
-    </main>
-  </div>
-
-  <dialog id="campaign-modal">
-    <form method="dialog" class="modal-form">
-      <h2>Launch campaign</h2>
-      <label>Name<input type="text" placeholder="Retention push"></label>
-      <label>Owner<input type="text" placeholder="Lina"></label>
-      <menu>
-        <button value="cancel">Cancel</button>
-        <button value="confirm">Create</button>
-      </menu>
-    </form>
-  </dialog>
-
-  <script src="scripts.js"></script>
-</body>
-</html>
-`;
-        const css = `:root {
-  --bg: #f2ede4;
-  --ink: #18222f;
-  --muted: #5c6674;
-  --panel: rgba(255, 255, 255, 0.82);
-  --line: rgba(24, 34, 47, 0.08);
-  --accent: #b6542c;
-  --accent-strong: #7f3417;
-  --shadow: 0 24px 60px rgba(24, 34, 47, 0.12);
-}
-
-* { box-sizing: border-box; }
-
-body {
-  margin: 0;
-  font-family: "Georgia", "Times New Roman", serif;
-  color: var(--ink);
-  background:
-    radial-gradient(circle at top left, rgba(182, 84, 44, 0.18), transparent 28%),
-    radial-gradient(circle at bottom right, rgba(24, 34, 47, 0.14), transparent 30%),
-    var(--bg);
-}
-
-.app-shell {
-  min-height: 100vh;
-  display: grid;
-  grid-template-columns: 260px 1fr;
-}
-
-.sidebar {
-  padding: 2rem 1.25rem;
-  background: rgba(24, 34, 47, 0.94);
-  color: #f7f2eb;
-  position: sticky;
-  top: 0;
-  min-height: 100vh;
-}
-
-.brand {
-  font-size: 1.6rem;
-  font-weight: 700;
-  margin-bottom: 1.5rem;
-}
-
-.menu-toggle {
-  display: none;
-  margin-bottom: 1rem;
-}
-
-nav {
-  display: grid;
-  gap: 0.6rem;
-}
-
-.nav-link {
-  color: inherit;
-  text-decoration: none;
-  padding: 0.8rem 0.95rem;
-  border-radius: 999px;
-  transition: transform 0.25s ease, background-color 0.25s ease;
-}
-
-.nav-link:hover,
-.nav-link.active {
-  background: rgba(255, 255, 255, 0.12);
-  transform: translateX(4px);
-}
-
-.content {
-  padding: 2rem;
-}
-
-.hero-card,
-.panel,
-.stat-card,
-.login-card,
-dialog {
-  background: var(--panel);
-  backdrop-filter: blur(16px);
-  border: 1px solid var(--line);
-  box-shadow: var(--shadow);
-}
-
-.hero-card {
-  display: grid;
-  grid-template-columns: 1.3fr 0.9fr;
-  gap: 1.5rem;
-  border-radius: 32px;
-  padding: 2rem;
-  margin-bottom: 1.5rem;
-}
-
-.eyebrow {
-  text-transform: uppercase;
-  letter-spacing: 0.14em;
-  color: var(--accent-strong);
-  font-size: 0.78rem;
-}
-
-.hero-card h1,
-.panel h2,
-.login-card h2 {
-  margin: 0 0 0.75rem;
-}
-
-.login-card,
-.panel,
-.stat-card {
-  border-radius: 24px;
-}
-
-.login-card,
-.settings-form,
-.modal-form {
-  display: grid;
-  gap: 0.85rem;
-}
-
-.stats-grid,
-.workspace-grid {
-  display: grid;
-  gap: 1rem;
-}
-
-.stats-grid {
-  grid-template-columns: repeat(4, minmax(0, 1fr));
-  margin-bottom: 1rem;
-}
-
-.workspace-grid {
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-}
-
-.stat-card,
-.panel {
-  padding: 1.2rem;
-  animation: riseIn 0.7s ease forwards;
-}
-
-.stat-card span,
-.panel-header span,
-.activity-feed span,
-.team-list span,
-.billing-card p {
-  color: var(--muted);
-}
-
-.panel-header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  margin-bottom: 1rem;
-}
-
-.chart-bars {
-  display: grid;
-  grid-template-columns: repeat(5, minmax(0, 1fr));
-  gap: 0.9rem;
-  align-items: end;
-  min-height: 220px;
-}
-
-.bar {
-  position: relative;
-  min-height: 180px;
-  border-radius: 20px 20px 8px 8px;
-  background: linear-gradient(180deg, rgba(182, 84, 44, 0.92), rgba(127, 52, 23, 0.68));
-  transform-origin: bottom;
-  transform: scaleY(calc(var(--value) / 100));
-  transition: transform 0.6s ease;
-}
-
-.bar span {
-  position: absolute;
-  left: 50%;
-  bottom: -1.6rem;
-  transform: translateX(-50%);
-}
-
-.activity-feed,
-.team-list {
-  display: grid;
-  gap: 0.8rem;
-  padding: 0;
-  margin: 0;
-  list-style: none;
-}
-
-.activity-feed li,
-.team-list div,
-.billing-card {
-  padding: 0.9rem 1rem;
-  border-radius: 18px;
-  background: rgba(255, 255, 255, 0.7);
-  border: 1px solid var(--line);
-}
-
-label {
-  display: grid;
-  gap: 0.35rem;
-  font-size: 0.95rem;
-}
-
-input,
-select,
-button {
-  font: inherit;
-}
-
-input,
-select {
-  width: 100%;
-  padding: 0.85rem 1rem;
-  border-radius: 14px;
-  border: 1px solid var(--line);
-  background: rgba(255, 255, 255, 0.92);
-}
-
-button {
-  border: none;
-  border-radius: 999px;
-  padding: 0.85rem 1.2rem;
-  background: var(--accent);
-  color: #fff9f3;
-  cursor: pointer;
-  transition: transform 0.25s ease, background-color 0.25s ease;
-}
-
-button:hover {
-  background: var(--accent-strong);
-  transform: translateY(-2px);
-}
-
-.secondary-action,
-menu button:first-child {
-  background: rgba(24, 34, 47, 0.12);
-  color: var(--ink);
-}
-
-dialog {
-  border-radius: 28px;
-  padding: 0;
-  width: min(420px, calc(100% - 2rem));
-}
-
-dialog::backdrop {
-  background: rgba(24, 34, 47, 0.3);
-}
-
-.modal-form {
-  padding: 1.4rem;
-}
-
-menu {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.75rem;
-  padding: 0;
-  margin: 0.5rem 0 0;
-}
-
-@keyframes riseIn {
-  from {
-    opacity: 0;
-    transform: translateY(18px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-@media (max-width: 980px) {
-  .app-shell,
-  .hero-card,
-  .stats-grid,
-  .workspace-grid {
-    grid-template-columns: 1fr;
-  }
-
-  .sidebar {
-    position: static;
-    min-height: auto;
-  }
-
-  .menu-toggle {
-    display: inline-flex;
-  }
-
-  nav {
-    display: none;
-  }
-
-  nav.is-open {
-    display: grid;
-  }
-}
-`;
-        const js = `document.addEventListener('DOMContentLoaded', () => {
-  const menuToggle = document.getElementById('menu-toggle');
-  const nav = document.querySelector('nav');
-  const modal = document.getElementById('campaign-modal');
-  const openModal = document.getElementById('open-modal');
-  const navLinks = document.querySelectorAll('.nav-link');
-
-  menuToggle?.addEventListener('click', () => nav?.classList.toggle('is-open'));
-  openModal?.addEventListener('click', () => modal?.showModal());
-  modal?.addEventListener('close', () => document.body.classList.remove('modal-open'));
-
-  navLinks.forEach((link) => {
-    link.addEventListener('click', (event) => {
-      event.preventDefault();
-      navLinks.forEach((entry) => entry.classList.remove('active'));
-      link.classList.add('active');
-      document.querySelector(link.getAttribute('href'))?.scrollIntoView({ behavior: 'smooth', block: 'start' });
-      nav?.classList.remove('is-open');
-    });
-  });
-
-  document.querySelectorAll('.bar').forEach((bar, index) => {
-    bar.animate([
-      { transform: 'scaleY(0.15)' },
-      { transform: getComputedStyle(bar).transform || 'scaleY(1)' }
-    ], { duration: 600 + index * 80, fill: 'forwards', easing: 'ease-out' });
-  });
-});
-`;
-        fs.writeFileSync(path.join(rootPath, 'index.html'), `${html.trimEnd()}\n`, 'utf8');
-        fs.writeFileSync(path.join(rootPath, 'styles.css'), `${css.trimEnd()}\n`, 'utf8');
-        fs.writeFileSync(path.join(rootPath, 'scripts.js'), `${js.trimEnd()}\n`, 'utf8');
-        return appName;
-    }
     ensureExecutionContext(context = {}) {
         const existingId = String(context.contextId || context.traceId || '').trim();
         const contextId = existingId || `vig-${Date.now()}-${randomUUID().slice(0, 8)}`;
@@ -1993,9 +1606,9 @@ menu {
                 summary.readmeExcerpt = fs.readFileSync(readmePath, 'utf8').slice(0, 2500);
             }
             if (includeWorkspaceFiles) {
-                // Explicit server-owned/background execution may hydrate a bounded
-                // copy. Interactive CLI/Workbench runs retrieve files on demand via
-                // the local tool bridge and never upload a workspace mirror.
+                // The context-embedded form is reserved for server-owned/background
+                // execution. Interactive CLI/Workbench hydration is sent separately
+                // from model context and remains a bounded validation-only mirror.
                 summary.workspaceFiles = this.collectWorkspaceFileContents(rootPath, orderedPaths);
             }
             return summary;
@@ -2013,15 +1626,7 @@ menu {
         const resolvedContext = this.ensureExecutionContext(context);
         const localWorkspacePath = this.resolveAgentTargetPath(resolvedContext);
         const serverWorkspacePath = this.resolveServerBindableWorkspacePath(resolvedContext);
-        const executionSurface = String(resolvedContext.executionSurface || resolvedContext.clientSurface || 'cli');
-        const localMachineCapable = resolvedContext.localMachineCapable !== false;
-        const clientToolExecution = resolvedContext.clientToolExecution === false
-            ? false
-            : (resolvedContext.clientToolExecution === true
-                || (!serverWorkspacePath
-                    && localMachineCapable
-                    && ['cli', 'fork', 'local-ide', 'desktop', 'local'].includes(executionSurface)));
-        if (clientToolExecution || serverWorkspacePath || !localWorkspacePath)
+        if (serverWorkspacePath || !localWorkspacePath)
             return undefined;
         const promptFocus = String(resolvedContext.rawPrompt || resolvedContext.contextualPrompt || resolvedContext.prompt || '');
         const summary = this.buildLocalWorkspaceSummary(localWorkspacePath, promptFocus);
@@ -2084,7 +1689,7 @@ menu {
             return;
         }
         const name = String(event.name || event.tool || '').trim();
-        if (name !== 'write_file' && name !== 'edit_file') {
+        if (name !== 'write_file' && name !== 'edit_file' && name !== 'delete_file') {
             return;
         }
         const args = event.arguments || {};
@@ -2100,6 +1705,10 @@ menu {
         if (!bucket) {
             return;
         }
+        if (name === 'delete_file') {
+            delete bucket[target.relativePath];
+            return;
+        }
         if (name === 'write_file' && typeof args.content === 'string') {
             bucket[target.relativePath] = args.content;
             return;
@@ -2130,6 +1739,71 @@ menu {
             sha256: createHash('sha256').update(content, 'utf8').digest('hex'),
         };
     }
+    validateV3ClientJavaScript(relativePath, source) {
+        const extension = path.extname(relativePath).toLowerCase();
+        if (!['.js', '.mjs', '.cjs'].includes(extension)) {
+            return null;
+        }
+        let firstError = null;
+        for (const mode of resolveJavaScriptSyntaxModes(source, relativePath)) {
+            const argv = mode === 'module'
+                ? ['--input-type=module', '--check', '-']
+                : ['--check', '-'];
+            try {
+                execFileSync(process.execPath, argv, {
+                    input: source,
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                    timeout: 10_000,
+                    windowsHide: true,
+                    env: safeChildProcessEnv(),
+                });
+                return null;
+            }
+            catch (error) {
+                const detail = error?.stderr?.toString?.().trim() || error?.message || 'JavaScript syntax check failed.';
+                firstError ||= this.compactV3ClientJavaScriptSyntaxError(relativePath, String(detail));
+            }
+        }
+        return firstError || 'JavaScript syntax check failed.';
+    }
+    compactV3ClientJavaScriptSyntaxError(relativePath, detail) {
+        const normalized = String(detail || '').replaceAll('[stdin]', relativePath).replaceAll('\r\n', '\n');
+        const lines = normalized.split('\n').map((line) => line.trim()).filter(Boolean);
+        const escapedPath = relativePath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const location = lines.find((line) => new RegExp(`^${escapedPath}:\\d+(?::\\d+)?$`).test(line))
+            || lines.find((line) => /:\d+(?::\d+)?$/.test(line));
+        const syntax = [...lines].reverse().find((line) => /^(?:[A-Za-z]*SyntaxError|SyntaxError):/i.test(line))
+            || [...lines].reverse().find((line) => /(?:unexpected|missing|unterminated|invalid)/i.test(line));
+        if (location || syntax) {
+            return [location, syntax].filter(Boolean).join(' ').slice(0, 900);
+        }
+        const nonStack = lines.find((line) => !/^at\s/.test(line) && !/^node:/.test(line));
+        return (nonStack || 'JavaScript syntax check failed.').slice(0, 900);
+    }
+    isV3ReleaseVerificationRequest(event) {
+        const taskId = String(event?.task_id || '').trim().toUpperCase();
+        const phaseKind = String(event?.phase_kind || '').trim().toLowerCase();
+        const taskKind = String(event?.task_kind || '').trim().toLowerCase();
+        return taskId === 'TUX'
+            || taskId.startsWith('HEAL-FIX-')
+            || phaseKind === 'verify'
+            || phaseKind === 'verification'
+            || taskKind === 'verify'
+            || taskKind === 'verification';
+    }
+    describeV3AuthoritativePreviewFailure(gate) {
+        const production = (gate.modes?.production || {});
+        const summary = (gate.summary || {});
+        const blockers = [
+            ...(Array.isArray(production.blockers) ? production.blockers : []),
+            ...(Array.isArray(summary.blockers) ? summary.blockers : []),
+        ].map((value) => String(value || '').trim()).filter(Boolean);
+        const details = [...new Set([
+                String(gate.error || '').trim(),
+                ...blockers,
+            ].filter(Boolean))];
+        return `Authoritative Template Service production preview failed${details.length ? `: ${details.join('; ')}` : '.'}`;
+    }
     async executeV3ClientToolRequest(event, context = {}) {
         const rootPath = this.resolveAgentTargetPath(context);
         if (!rootPath) {
@@ -2150,7 +1824,7 @@ menu {
             return { success: false, output: '', error: 'Tool path is outside the workspace.' };
         }
         const existingPathTools = new Set([
-            'read_file', 'edit_file', 'list_directory', 'glob', 'search_files', 'grep',
+            'read_file', 'edit_file', 'delete_file', 'list_directory', 'glob', 'search_files', 'grep',
             'syntax_check', 'preview_check', 'runtime_check',
         ]);
         if (existingPathTools.has(name) && !fs.existsSync(target.absolutePath)) {
@@ -2179,10 +1853,10 @@ menu {
                 }
                 const missingAssets = [];
                 const checkedAssets = [];
-                const assetPattern = /<(?:script|link|img|source|video|audio)\b[^>]+(?:src|href)=["']([^"']+)["']/gi;
+                const assetPattern = /<(?:script|link|img|source|video|audio)\b[^>]+(?:src|href)\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s'"`=<>]+))/gi;
                 let match;
                 while ((match = assetPattern.exec(html)) !== null && checkedAssets.length < 200) {
-                    const rawAsset = String(match[1] || '').trim();
+                    const rawAsset = String(match[1] || match[2] || match[3] || '').trim();
                     if (!rawAsset || /^(?:https?:|data:|blob:|mailto:|tel:|javascript:|#)/i.test(rawAsset))
                         continue;
                     let decoded;
@@ -2215,6 +1889,37 @@ menu {
                         error: `Missing local preview assets: ${missingAssets.slice(0, 12).join(', ')}`,
                     };
                 }
+                if (this.isV3ReleaseVerificationRequest(event)) {
+                    const releasePrompt = String(context.rawPrompt || context.contextualPrompt || context.prompt
+                        || 'Verify the complete responsive frontend application for production release.');
+                    const gate = await this.frontendPreviewService.runTemplateServicePreviewGate(releasePrompt, {
+                        ...context,
+                        targetPath: rootPath,
+                        workspacePath: rootPath,
+                        projectPath: rootPath,
+                        rawPrompt: releasePrompt,
+                        forceFrontendPreview: true,
+                        functionalRuntimeProof: false,
+                        requireScreenshot: false,
+                    });
+                    if (!gate.passed || gate.skipped === true) {
+                        return {
+                            success: false,
+                            output: '',
+                            error: this.describeV3AuthoritativePreviewFailure(gate),
+                        };
+                    }
+                    return {
+                        success: true,
+                        output: JSON.stringify({
+                            entry: gate.entryPath || path.relative(rootPath, entryPath).replace(/\\/g, '/'),
+                            checkedAssets: checkedAssets.length,
+                            expectedTextMatched: Boolean(expectedText),
+                            authoritativeProductionPreview: true,
+                            qualityTier: gate.modes?.production?.qualityTier || null,
+                        }),
+                    };
+                }
                 return {
                     success: true,
                     output: JSON.stringify({
@@ -2225,19 +1930,25 @@ menu {
                 };
             }
             if (name === 'runtime_check') {
-                const previewResult = await this.executeV3ClientToolRequest({ ...event, name: 'preview_check', arguments: args }, context);
+                const previewArgs = { ...args };
+                delete previewArgs.expect_text;
+                const previewResult = await this.executeV3ClientToolRequest({ ...event, name: 'preview_check', arguments: previewArgs }, context);
                 if (!previewResult.success)
                     return previewResult;
                 const relativeTarget = target.relativePath && target.relativePath !== '.' ? target.relativePath : 'index.html';
-                const gate = await this.frontendPreviewService.runTemplateServicePreviewGate(`Verify the interactive frontend runtime at ${relativeTarget}.`, {
+                const runtimePrompt = String(context.rawPrompt || context.contextualPrompt || context.prompt
+                    || `Verify the interactive frontend runtime at ${relativeTarget}.`);
+                const gate = await this.frontendPreviewService.runTemplateServicePreviewGate(runtimePrompt, {
                     ...context,
                     targetPath: rootPath,
                     workspacePath: rootPath,
                     projectPath: rootPath,
-                    rawPrompt: `Verify the interactive frontend runtime at ${relativeTarget}.`,
+                    rawPrompt: runtimePrompt,
                     forceFrontendPreview: true,
                     localScreenshotProof: true,
+                    functionalRuntimeProof: true,
                     requireScreenshot: true,
+                    runtimeInteractionProof: this.buildLoopbackRuntimeInteraction(runtimePrompt, args),
                 });
                 if (!gate.passed || gate.artifacts?.screenshotCaptured !== true) {
                     return {
@@ -2251,13 +1962,35 @@ menu {
                     output: JSON.stringify({
                         entry: gate.entryPath || relativeTarget,
                         screenshotCaptured: true,
-                        proof: 'local-system-browser',
+                        proof: 'loopback-http-browser-interaction',
+                        runtimeInteraction: gate.artifacts?.runtimeInteraction || null,
                     }),
                 };
             }
+            if (name === 'delete_file') {
+                const stat = fs.statSync(target.absolutePath);
+                if (!stat.isFile()) {
+                    return {
+                        success: false,
+                        output: '',
+                        error: `delete_file only removes a single workspace file: ${target.relativePath}`,
+                    };
+                }
+                fs.unlinkSync(target.absolutePath);
+                const result = {
+                    success: true,
+                    output: `Removed ${target.relativePath}`,
+                };
+                this.recordV3ClientToolMutation(event, context, result);
+                return result;
+            }
             if (name === 'write_file') {
                 if (typeof args.content !== 'string')
                     return { success: false, output: '', error: 'write_file requires string content.' };
+                const syntaxError = this.validateV3ClientJavaScript(target.relativePath, args.content);
+                if (syntaxError) {
+                    return { success: false, output: '', error: `JavaScript mutation rejected before write: ${syntaxError}` };
+                }
                 const mutation = this.buildV3ClientToolMutation(target.relativePath, args.content);
                 if ('error' in mutation)
                     return { success: false, output: '', error: mutation.error };
@@ -2294,6 +2027,10 @@ menu {
                 const nextContent = replaceAll
                     ? existing.split(oldString).join(newString)
                     : existing.replace(oldString, newString);
+                const syntaxError = this.validateV3ClientJavaScript(target.relativePath, nextContent);
+                if (syntaxError) {
+                    return { success: false, output: '', error: `JavaScript mutation rejected before edit: ${syntaxError}` };
+                }
                 const mutation = this.buildV3ClientToolMutation(target.relativePath, nextContent);
                 if ('error' in mutation)
                     return { success: false, output: '', error: mutation.error };
@@ -2417,15 +2154,11 @@ menu {
                     return { success: true, output: `Syntax check passed: ${target.relativePath}` };
                 }
                 if (ext === '.js' || ext === '.mjs' || ext === '.cjs') {
-                    const { execFileSync } = await import('child_process');
-                    try {
-                        execFileSync(process.execPath, ['--check', target.absolutePath], { stdio: 'pipe', timeout: 10_000, windowsHide: true, env: safeChildProcessEnv() });
-                        return { success: true, output: `Syntax check passed: ${target.relativePath}` };
-                    }
-                    catch (error) {
-                        const stderr = error?.stderr?.toString?.() || error?.message || String(error);
-                        return { success: false, output: '', error: stderr.trim() || `Syntax check failed: ${target.relativePath}` };
-                    }
+                    const source = fs.readFileSync(target.absolutePath, 'utf8');
+                    const syntaxError = this.validateV3ClientJavaScript(target.relativePath, source);
+                    return syntaxError
+                        ? { success: false, output: '', error: syntaxError }
+                        : { success: true, output: `Syntax check passed: ${target.relativePath}` };
                 }
                 fs.readFileSync(target.absolutePath, 'utf8');
                 return { success: true, output: `Syntax check passed: ${target.relativePath}` };
@@ -2561,12 +2294,84 @@ menu {
             || /\b[a-z0-9_./-]+\.html?\b[^.\n]{0,100}\b(?:only|alone)\b/i.test(request);
         return explicitOneFileLanguage;
     }
+    isFocusedAgentRepair(context = {}) {
+        const taskKinds = [
+            context.agentTaskType,
+            context.executionHints?.task_kind,
+            context.agentRoute?.taskKind,
+        ].map((value) => String(value || '').trim().toLowerCase());
+        return taskKinds.includes('repair');
+    }
+    buildLoopbackRuntimeInteraction(prompt, args = {}) {
+        const request = String(prompt || '');
+        const keyMatch = request.match(/\b(?:press|hit|tap)\s+(?:the\s+)?(?:key\s+)?(space(?:bar)?|enter|return|esc(?:ape)?|arrow\s*(?:up|down|left|right)|[a-z0-9])\b/i);
+        const rawKey = String(keyMatch?.[1] || '').replace(/\s+/g, '');
+        const keyAliases = {
+            return: 'Enter',
+            esc: 'Escape',
+            spacebar: 'Space',
+        };
+        const key = rawKey
+            ? (keyAliases[rawKey.toLowerCase()] || rawKey)
+            : undefined;
+        const expectText = String(args.expect_text || '').trim() || undefined;
+        const supportedActions = new Set(['assert', 'click', 'fill', 'select', 'press', 'focus', 'wait', 'reload']);
+        const steps = Array.isArray(args.steps)
+            ? args.steps.slice(0, 64).filter((step) => (Boolean(step) && typeof step === 'object' && !Array.isArray(step))).map((step) => ({
+                ...step,
+                action: supportedActions.has(String(step.action || '').trim().toLowerCase())
+                    ? String(step.action || '').trim().toLowerCase()
+                    : 'assert',
+            }))
+            : [];
+        const requestedTimeoutSeconds = Math.max(1, Math.min(Number(args.timeout) || 30, 120));
+        return {
+            ...(steps.length > 0 ? { steps } : (key ? { key } : {})),
+            ...(expectText ? { expectText } : {}),
+            requireStateChange: steps.length === 0 && Boolean(key),
+            waitMs: 1_750,
+            timeoutMs: requestedTimeoutSeconds * 1_000,
+        };
+    }
+    buildAgentFinalPreviewContext(message, context = {}) {
+        const classificationContext = {
+            ...context,
+            forceFrontendPreview: false,
+        };
+        if (!this.isFocusedAgentRepair(context)
+            || !this.frontendPreviewService.isFrontendTask(message, classificationContext)) {
+            return context;
+        }
+        return {
+            ...context,
+            rawPrompt: context.rawPrompt || message,
+            forceFrontendPreview: true,
+            localScreenshotProof: true,
+            functionalRuntimeProof: true,
+            requireScreenshot: true,
+            runtimeInteractionProof: this.buildLoopbackRuntimeInteraction(String(context.rawPrompt || message || '')),
+        };
+    }
     async ensureAgentFrontendPolish(message = '', context = {}) {
+        // V3 owns application source. Legacy post-processing is retained only as
+        // an explicit compatibility hook; normal Agent runs must never mutate a
+        // successful or read-only result behind the model's back.
+        if (context.allowLegacyClientFrontendPolish !== true) {
+            return;
+        }
         const rootPath = this.resolveAgentTargetPath(context);
         if (!rootPath || !fs.existsSync(rootPath)) {
             return;
         }
         const prompt = String(message || '');
+        // A focused repair owns only the evidence-proven source mutation. It is
+        // not authorization for the CLI to add responsive CSS, motion helpers, or
+        // fallback script files after the agent has finished. The final repair
+        // gate below still captures a real browser screenshot, but it must remain
+        // read-only with respect to the user's application files.
+        if (this.isFocusedAgentRepair(context)) {
+            return;
+        }
         const expectedFiles = this.extractExpectedWorkspaceFiles(message, context);
         const looksLikeFrontendTask = /(premium|polished|landing|site|page|dashboard|saas|frontend|ui|pricing|showcase|responsive|interactive|game|canvas)/i.test(prompt)
             || expectedFiles.some((filePath) => /\.(html|css|js)$/i.test(filePath));
@@ -3195,7 +3000,12 @@ document.addEventListener('DOMContentLoaded', () => {
             const proofSucceeded = previewGate?.required === true
                 ? previewGate.passed === true && previewGate.skipped !== true
                 : true;
-            mutation = finalizeMutationTransaction(journal, proofSucceeded);
+            try {
+                mutation = finalizeMutationTransaction(journal, proofSucceeded);
+            }
+            finally {
+                this.releaseMutationTransaction(journal);
+            }
             if (!proofSucceeded)
                 changedFiles = {};
         }
@@ -3431,7 +3241,11 @@ document.addEventListener('DOMContentLoaded', () => {
                             }
                         }
                     }
-                    if (typeof context.onStreamEvent === 'function' && !isV3StreamKeepaliveEvent(userEvent)) {
+                    const userVisibleEvent = userEvent?.user_visible !== false
+                        && String(userEvent?.visibility || '').toLowerCase() !== 'internal';
+                    if (typeof context.onStreamEvent === 'function'
+                        && !isV3StreamKeepaliveEvent(userEvent)
+                        && userVisibleEvent) {
                         try {
                             context.onStreamEvent(userEvent);
                         }
@@ -3453,21 +3267,24 @@ document.addEventListener('DOMContentLoaded', () => {
                                 checkpointed_task_id: event.task_id,
                             };
                         }
-                        if (this.hasAgentWorkspaceOutput(context)) {
-                            return {
-                                task_id: events.find((entry) => entry && entry.task_id)?.task_id || null,
-                                context_id: contextId,
-                                result: final || event,
-                                events,
-                                files: streamedFiles,
-                                partial: true,
-                                terminal_error: {
-                                    message: event.message || 'V3 agent returned an error',
-                                    code: event.code || event.error_code || null,
-                                },
-                            };
-                        }
-                        throw new Error(event.message || 'V3 agent returned an error');
+                        // A parsed terminal SSE error is an authoritative server outcome,
+                        // including when an empty-workspace build failed before its first
+                        // accepted mutation. Return typed workflow data so the caller can
+                        // report the real executor failure. Throwing here made the outer
+                        // accepted-stream safety guard misclassify a known clean failure as
+                        // AGENT_OUTCOME_UNKNOWN and misleadingly recommend a resume.
+                        return {
+                            task_id: events.find((entry) => entry && entry.task_id)?.task_id || null,
+                            context_id: contextId,
+                            result: final || event,
+                            events,
+                            files: streamedFiles,
+                            partial: true,
+                            terminal_error: {
+                                message: event.message || 'V3 agent returned an error',
+                                code: event.code || event.error_code || null,
+                            },
+                        };
                     }
                     if (event.type === 'complete' || event.type === 'message') {
                         final = event;
@@ -3498,6 +3315,7 @@ document.addEventListener('DOMContentLoaded', () => {
         let mutationJournal = null;
         if (mutationRoot && fs.existsSync(mutationRoot) && fs.statSync(mutationRoot).isDirectory()) {
             mutationJournal = new MutationJournal(mutationRoot, executionContext.operationId);
+            this.trackMutationTransaction(mutationJournal);
             executionContext.operationId = mutationJournal.operationId;
             executionContext.__mutationJournal = mutationJournal;
         }
@@ -3554,20 +3372,30 @@ document.addEventListener('DOMContentLoaded', () => {
                     const requestBody = buildRequestBody(contextIdOverride);
                     const controller = new AbortController();
                     const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
+                    let runRequestDispatched = false;
+                    let runResponseReceived = false;
+                    let runResponseAccepted = false;
                     try {
+                        // POST /run is a mutating operation. A transport failure after the
+                        // request leaves this process is ambiguous even when no streamed
+                        // file has reached the local mirror yet: the server can already be
+                        // planning or writing its managed workspace. Never turn that
+                        // ambiguity into a second whole-agent execution.
+                        runRequestDispatched = true;
                         const response = await this.executeV3AgentRunRequest(baseUrl, requestBody, requestExecutionContext, controller.signal);
+                        runResponseReceived = true;
                         if (!response.ok) {
                             const errorText = await response.text().catch(() => '');
                             const sanitized = sanitizeUserFacingErrorText(errorText).slice(0, 200);
-                            const isContextCollision = response.status === 409 && /already in progress/i.test(errorText);
                             const isTransientWorkspaceHydration = /remote workspace is empty|workspace sync failure/i.test(errorText);
-                            if ((isContextCollision || isTransientWorkspaceHydration) && contextRetry === 0) {
+                            if (isTransientWorkspaceHydration && contextRetry === 0) {
                                 contextIdOverride = `${requestExecutionContext.contextId || 'vig'}-retry-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
                                 this.logger?.debug?.(`V3 transient agent error on ${baseUrl}; retrying with fresh context id.`);
                                 continue;
                             }
                             throw new Error(`V3 agent ${response.status}: ${sanitized}`);
                         }
+                        runResponseAccepted = true;
                         const data = await this.collectV3AgentStream(response, requestExecutionContext);
                         // Auto-continuation: if the agent checkpointed (budget exceeded), continue automatically
                         if (data.checkpointed && data.checkpointed_task_id) {
@@ -3623,7 +3451,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             this.recoverAgentWorkspaceFiles(executionContext, continuationData.files || {}, expectedFiles);
                             await this.waitForAgentWorkspaceSettle(executionContext, { expectedFiles });
                             await this.ensureAgentFrontendPolish(message, executionContext);
-                            const previewGate = await this.runTemplateServicePreviewGate(message, executionContext);
+                            const previewGate = await this.runTemplateServicePreviewGate(message, this.buildAgentFinalPreviewContext(message, executionContext));
                             const finalContextId = continuationData.context_id || data.context_id || response.headers.get('x-context-id') || requestExecutionContext.contextId || null;
                             return this.finalizeV3AgentWorkflowResponse(continuationData, {
                                 content: this.formatV3AgentResponse(continuationData) || this.formatV3AgentResponse(data),
@@ -3642,7 +3470,11 @@ document.addEventListener('DOMContentLoaded', () => {
                             // valid output. A terminal planner/executor error fails proof and
                             // causes the operation journal to roll back streamed mutations.
                             const analysisOnly = this.isAnalysisOnlyTask(message, executionContext);
-                            const failedPreviewGate = analysisOnly
+                            const frontendTask = this.frontendPreviewService.isFrontendTask(message, {
+                                ...executionContext,
+                                forceFrontendPreview: false,
+                            });
+                            const failedPreviewGate = analysisOnly || !frontendTask
                                 ? { required: false, passed: true, skipped: false }
                                 : {
                                     required: true,
@@ -3668,7 +3500,7 @@ document.addEventListener('DOMContentLoaded', () => {
                         }
                         await this.waitForAgentWorkspaceSettle(executionContext, { expectedFiles });
                         await this.ensureAgentFrontendPolish(message, executionContext);
-                        const previewGate = await this.runTemplateServicePreviewGate(message, executionContext);
+                        const previewGate = await this.runTemplateServicePreviewGate(message, this.buildAgentFinalPreviewContext(message, executionContext));
                         return this.finalizeV3AgentWorkflowResponse(data, {
                             content: this.formatV3AgentResponse(data),
                             taskId: data.task_id || null,
@@ -3679,8 +3511,8 @@ document.addEventListener('DOMContentLoaded', () => {
                     }
                     catch (error) {
                         if (error?.code === 'AGENT_PLAN_INVALID') {
-                            if (mutationJournal?.hasMutations()) {
-                                const mutation = mutationJournal.rollback();
+                            if (mutationJournal) {
+                                const mutation = this.rollbackMutationTransaction(mutationJournal);
                                 mutationJournal = null;
                                 error.operationId = mutation.operationId;
                                 error.mutation = mutation;
@@ -3699,7 +3531,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             this.recoverAgentWorkspaceFiles(executionContext, error.partialData.files || {}, expectedFiles);
                             await this.waitForAgentWorkspaceSettle(executionContext, { expectedFiles });
                             await this.ensureAgentFrontendPolish(message, executionContext);
-                            const previewGate = await this.runTemplateServicePreviewGate(message, executionContext);
+                            const previewGate = await this.runTemplateServicePreviewGate(message, this.buildAgentFinalPreviewContext(message, executionContext));
                             return this.finalizeV3AgentWorkflowResponse(error.partialData, {
                                 content: this.formatV3AgentResponse(error.partialData) || 'V3 agent wrote workspace files before the request timed out waiting for a final summary.',
                                 taskId: error.partialData.task_id || null,
@@ -3710,7 +3542,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             }, mutationJournal);
                         }
                         if (mutationJournal?.hasMutations()) {
-                            const mutation = mutationJournal.rollback();
+                            const mutation = this.rollbackMutationTransaction(mutationJournal);
                             mutationJournal = null;
                             this.activeV3StreamedFiles = null;
                             const ambiguousError = new Error(`V3 mutation outcome is ambiguous for operation ${mutation.operationId}; workspace rollback was attempted and no alternate backend retry was allowed.`);
@@ -3719,6 +3551,22 @@ document.addEventListener('DOMContentLoaded', () => {
                             ambiguousError.partialMutation = mutation.partialMutation;
                             throw ambiguousError;
                         }
+                        if (runResponseAccepted || (runRequestDispatched && !runResponseReceived)) {
+                            const mutation = mutationJournal
+                                ? this.rollbackMutationTransaction(mutationJournal)
+                                : null;
+                            mutationJournal = null;
+                            this.activeV3StreamedFiles = null;
+                            const ambiguousError = new Error(`Agent connection was interrupted after operation ${executionContext.operationId || 'unknown'} started. `
+                                + 'The task was not submitted again because that could duplicate changes. Use /continue to resume the saved run.');
+                            ambiguousError.name = 'AgentOutcomeUnknownError';
+                            ambiguousError.code = 'AGENT_OUTCOME_UNKNOWN';
+                            ambiguousError.operationId = executionContext.operationId || null;
+                            ambiguousError.contextId = requestBody.context_id || requestExecutionContext.contextId || null;
+                            ambiguousError.mutation = mutation || undefined;
+                            ambiguousError.partialMutation = mutation?.partialMutation || false;
+                            throw ambiguousError;
+                        }
                         errors.push(`${baseUrl}: ${error?.message || String(error)}`);
                     }
                     finally {
@@ -3759,27 +3607,9 @@ document.addEventListener('DOMContentLoaded', () => {
                 : '';
             throw new Error(`V3 agent authentication failed at the V3 service layer while your gateway login token is still valid.${endpointSummary} Please retry shortly.`);
         }
-        if (preferLocalV3
-            && !this.hasAgentWorkspaceOutput(executionContext)
-            && /(saas|dashboard|analytics|billing|team management|activity feed)/i.test(message)) {
-            const appName = this.materializeEmergencySaaSWorkspace(message, executionContext);
-            if (appName) {
-                await this.waitForAgentWorkspaceSettle(executionContext, { expectedFiles: ['index.html', 'styles.css', 'scripts.js'] });
-                await this.ensureAgentFrontendPolish(message, executionContext);
-                const previewGate = await this.runTemplateServicePreviewGate(message, executionContext);
-                return this.finalizeV3AgentWorkflowResponse({}, {
-                    content: `Recovered a local SaaS workspace scaffold for ${appName} after repeated V3 materialization failures.`,
-                    taskId: null,
-                    contextId: executionContext.contextId || null,
-                    backendUrl: 'local-emergency-scaffold',
-                    partial: true,
-                    metadata: { source: 'v3-agent-emergency-scaffold', mode: 'agent', previewGate, emergencyScaffold: true },
-                }, mutationJournal);
-            }
-        }
         const finalError = new Error(errors.join(' | '));
         if (mutationJournal) {
-            const mutation = mutationJournal.rollback();
+            const mutation = this.rollbackMutationTransaction(mutationJournal);
             mutationJournal = null;
             finalError.operationId = mutation.operationId;
             finalError.mutation = mutation;
@@ -4124,13 +3954,13 @@ document.addEventListener('DOMContentLoaded', () => {
         const headers = await this.getV3AgentHeaders();
         const endpoint = this.isDirectV3AgentBaseUrl(baseUrl)
             ? `${baseUrl}/api/agent/client-tool-result`
-            : `${baseUrl}/api/v3-agent/client-tool-result`;
+            : `${baseUrl}/api/v3-agent-cli/client-tool-result`;
         const body = JSON.stringify({
             context_id: trimmedContextId,
             call_id: trimmedCallId,
             success: result.success === true,
-            output: String(result.output || ''),
-            error: String(result.error || ''),
+            output: String(result.output || '').slice(0, MAX_V3_CLIENT_RESULT_OUTPUT_CHARS),
+            error: String(result.error || '').slice(0, MAX_V3_CLIENT_RESULT_ERROR_CHARS),
             mutation: result.mutation || null,
         });
         for (let attempt = 0; attempt < 3; attempt += 1) {
@@ -4254,12 +4084,11 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async getV3AgentHealth() {
         const baseUrl = this.getV3AgentBaseUrls()[0];
-        // Try multiple health endpoint patterns — the V3 backend may expose
-        // different paths depending on whether it's local (8030) or remote.
+        // Direct requests use the isolated CLI runtime on 8032; authenticated
+        // gateway requests use the named CLI lane.
         const candidates = [
-            `${baseUrl}/api/v3-agent/health`,
+            `${baseUrl}${this.isDirectV3AgentBaseUrl(baseUrl) ? '/health' : '/api/v3-agent-cli/health'}`,
             `${baseUrl}/api/health`,
-            `${baseUrl}/health`,
         ];
         const headers = await this.getV3AgentHeaders();
         for (const endpoint of candidates) {