vigthoria-cli 1.13.31 → 1.13.42

package/dist/utils/frontend-preview-service.d.ts

@@ -1,5 +1,5 @@
 import type { MutationJournalReport } from './mutation-journal.js';
-import type { PreviewScreenshotPort } from './preview-screenshot-adapter.js';
+import type { PreviewRuntimeInteractionResult, PreviewScreenshotPort } from './preview-screenshot-adapter.js';
 export interface FrontendPreviewGateResult {
     required: boolean;
     passed: boolean;
@@ -19,6 +19,7 @@ export interface FrontendPreviewGateResult {
         previewFileUrl?: string;
         screenshotCaptured?: boolean;
         screenshotError?: string;
+        runtimeInteraction?: PreviewRuntimeInteractionResult;
     };
     modes?: {
         design?: {
@@ -43,6 +44,7 @@ export interface FrontendPreviewGateResult {
 export interface FrontendPreviewServiceDependencies {
     getBaseUrls(): string[];
     getAccessToken(): string | null;
+    getServiceKey?(): string | null;
     fetch(input: string, init: RequestInit): Promise<Response>;
     resolveTargetPath(context: Record<string, any>): string;
     extractExpectedFiles(message: string, context: Record<string, any>): string[];
@@ -51,10 +53,17 @@ export interface FrontendPreviewServiceDependencies {
     screenshotAdapter: PreviewScreenshotPort;
 }
 export declare function isConstrainedStaticFrontendRequest(message?: string): boolean;
+/**
+ * A code artifact can belong to a browser product without itself being a
+ * previewable application. Requiring an HTML entry for an explicitly scoped
+ * module/library request turns a successful native verification into a false
+ * failure and rolls the requested file back.
+ */
+export declare function isFocusedNonPreviewableCodeArtifactRequest(message?: string, expectedFiles?: string[]): boolean;
 export declare class FrontendPreviewService {
     private readonly dependencies;
     constructor(dependencies: FrontendPreviewServiceDependencies);
-    private isFrontendTask;
+    isFrontendTask(message?: string, context?: Record<string, any>): boolean;
     /**
      * Returns true when the prompt describes a read-only / analysis task.
      * Used to suppress preview gate and other write-oriented side effects.
@@ -69,6 +78,7 @@ export declare class FrontendPreviewService {
         js: string[];
         assets: string[];
     };
+    private expandLinkedFrontendDependencyGraph;
     private buildFrontendForPreview;
     private gatherFrontendPreviewArtifacts;
     private evaluateFrontendVisualProof;

package/dist/utils/frontend-preview-service.js

@@ -11,6 +11,47 @@ export function isConstrainedStaticFrontendRequest(message = '') {
         && /\b(?:single[- ]file|one\s+paragraph|exactly\s+one|current\s+directory\s+only|write\s+the\s+file\b[^.\n]{0,80}\bonly)\b/.test(prompt)
         && !/\b(?:premium|signature|showcase|redesign|overhaul|dashboard|portal|saas|interactive|animation|motion|form|checkout|booking|commerce)\b/.test(prompt);
 }
+/**
+ * A code artifact can belong to a browser product without itself being a
+ * previewable application. Requiring an HTML entry for an explicitly scoped
+ * module/library request turns a successful native verification into a false
+ * failure and rolls the requested file back.
+ */
+export function isFocusedNonPreviewableCodeArtifactRequest(message = '', expectedFiles = []) {
+    const prompt = String(message || '').toLowerCase();
+    const normalizedFiles = Array.from(new Set(expectedFiles
+        .map((filePath) => String(filePath || '').trim().replace(/\\/g, '/').replace(/^\.\//, ''))
+        .filter(Boolean)));
+    if (normalizedFiles.length === 0 || normalizedFiles.length > 4)
+        return false;
+    if (normalizedFiles.some((filePath) => /\.(?:html?|css|scss|sass|less)$/i.test(filePath)))
+        return false;
+    if (!normalizedFiles.every((filePath) => /\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|swift|rb|php|cs|cpp|cc|c|h|hpp)$/i.test(filePath))) {
+        return false;
+    }
+    const explicitArtifactScope = /\b(?:es\s+module|module|library|utility|helper|class|function|service|adapter|middleware|route|schema)\b/i.test(prompt)
+        || /\bexport\s+(?:exactly|only)\b/i.test(prompt)
+        || /\b(?:create|write|implement|update|fix|repair)\b[^.\n]{0,120}\b(?:file|files)\b/i.test(prompt);
+    if (!explicitArtifactScope)
+        return false;
+    const wholeProductScope = /\b(?:build|create|implement|deliver|make)\b[^.\n]{0,100}\b(?:complete|full|entire|end-to-end|from scratch|production-ready)\b[^.\n]{0,80}\b(?:website|site|page|dashboard|portal|app|application|game)\b/i.test(prompt)
+        || /\b(?:complete|full|entire|end-to-end|playable)\s+(?:website|site|page|dashboard|portal|app|application|game)\b/i.test(prompt);
+    return !wholeProductScope;
+}
+function htmlAttributeValue(openingTag, name) {
+    const match = String(openingTag || '').match(new RegExp(`\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s'"\\x60=<>]+))`, 'i'));
+    return match ? String(match[1] ?? match[2] ?? match[3] ?? '') : '';
+}
+function hasViewportMeta(html) {
+    return Array.from(String(html || '').matchAll(/<meta\b[^>]*>/gi)).some((match) => htmlAttributeValue(match[0], 'name').toLowerCase() === 'viewport');
+}
+function canonicalizePreviewHtmlAttributes(html) {
+    // The browser accepts valid unquoted attributes. Some older preview-service
+    // deployments still parse only quoted name/src/href/type tokens. Send a
+    // semantically equivalent canonical proof document without rewriting the
+    // user's source file, so standards-compliant markup is not falsely rejected.
+    return String(html || '').replace(/\b(name|href|src|rel|type)\s*=\s*([^\s'"\x60=<>]+)/gi, (_match, name, value) => `${name}="${value}"`);
+}
 export class FrontendPreviewService {
     dependencies;
     constructor(dependencies) {
@@ -28,6 +69,9 @@ export class FrontendPreviewService {
         const prompt = String(message || '');
         const expectedFiles = this.dependencies.extractExpectedFiles(message, context);
         const hasHtmlEntry = expectedFiles.some((filePath) => /\.html?$/i.test(filePath));
+        if (isFocusedNonPreviewableCodeArtifactRequest(prompt, expectedFiles)) {
+            return false;
+        }
         return /(premium|polished|landing|site|page|dashboard|saas|frontend|ui|pricing|showcase|hero|responsive|interactive|game|canvas)/i.test(prompt)
             || hasHtmlEntry;
     }
@@ -156,24 +200,30 @@ export class FrontendPreviewService {
             }
             return this.normalizeWorkspaceRelativePath(path.posix.normalize(path.posix.join(entryDir, withoutQuery)));
         };
-        const cssPattern = /<link[^>]+href=["']([^"']+\.css(?:[?#][^"']*)?)["'][^>]*>/gi;
-        const jsPattern = /<script[^>]+src=["']([^"']+\.(?:js|mjs|cjs)(?:[?#][^"']*)?)["'][^>]*>/gi;
         let match;
-        while ((match = cssPattern.exec(String(html || ''))) !== null) {
-            const resolved = normalizeAsset(match[1]);
+        const linkPattern = /<link\b[^>]*>/gi;
+        while ((match = linkPattern.exec(String(html || ''))) !== null) {
+            const href = htmlAttributeValue(match[0], 'href');
+            if (!/\.css(?:[?#]|$)/i.test(href))
+                continue;
+            const resolved = normalizeAsset(href);
             if (resolved) {
                 css.add(resolved);
             }
         }
-        while ((match = jsPattern.exec(String(html || ''))) !== null) {
-            const resolved = normalizeAsset(match[1]);
+        const scriptPattern = /<script\b[^>]*>/gi;
+        while ((match = scriptPattern.exec(String(html || ''))) !== null) {
+            const src = htmlAttributeValue(match[0], 'src');
+            if (!/\.(?:js|mjs|cjs)(?:[?#]|$)/i.test(src))
+                continue;
+            const resolved = normalizeAsset(src);
             if (resolved) {
                 js.add(resolved);
             }
         }
-        const assetPattern = /<(?:link|img|source|video|audio)\b[^>]+(?:href|src)=["']([^"']+)["'][^>]*>/gi;
+        const assetPattern = /<(?:link|img|source|video|audio)\b[^>]*>/gi;
         while ((match = assetPattern.exec(String(html || ''))) !== null) {
-            const resolved = normalizeAsset(match[1]);
+            const resolved = normalizeAsset(htmlAttributeValue(match[0], 'href') || htmlAttributeValue(match[0], 'src'));
             if (resolved)
                 assets.add(resolved);
         }
@@ -183,6 +233,93 @@ export class FrontendPreviewService {
             assets: Array.from(assets),
         };
     }
+    expandLinkedFrontendDependencyGraph(rootPath, entryFiles, kind) {
+        const selected = [];
+        const seen = new Set();
+        const queued = new Set();
+        const queue = entryFiles
+            .map((filePath) => this.normalizeWorkspaceRelativePath(filePath))
+            .filter(Boolean);
+        for (const filePath of queue)
+            queued.add(filePath);
+        const extensions = kind === 'css' ? ['.css'] : ['.js', '.mjs', '.cjs'];
+        const resolveImport = (ownerPath, specifier) => {
+            const clean = String(specifier || '').trim().split('?')[0].split('#')[0];
+            if (!clean
+                || clean.startsWith('#')
+                || clean.startsWith('//')
+                || /^(?:https?:|data:|node:)/i.test(clean)
+                || (!clean.startsWith('.') && !clean.startsWith('/'))) {
+                return null;
+            }
+            const ownerDir = path.posix.dirname(this.normalizeWorkspaceRelativePath(ownerPath) || '.');
+            const base = this.normalizeWorkspaceRelativePath(path.posix.normalize(clean.startsWith('/')
+                ? clean.slice(1)
+                : path.posix.join(ownerDir, clean)));
+            const candidates = [base];
+            if (!path.posix.extname(base)) {
+                for (const extension of extensions)
+                    candidates.push(`${base}${extension}`);
+                for (const extension of extensions)
+                    candidates.push(path.posix.join(base, `index${extension}`));
+            }
+            for (const candidate of candidates) {
+                if (!extensions.includes(path.posix.extname(candidate).toLowerCase()))
+                    continue;
+                try {
+                    const absolute = resolveWorkspacePath(rootPath, candidate);
+                    if (fs.statSync(absolute).isFile())
+                        return candidate;
+                }
+                catch {
+                    // The candidate is absent or outside the workspace boundary.
+                }
+            }
+            return null;
+        };
+        // A dependency graph is authoritative because every admitted file is
+        // reachable from the HTML entry. The cap prevents cyclic or adversarial
+        // graphs from inflating a preview payload; the final payload has its own
+        // byte limit as a second boundary.
+        while (queue.length > 0 && selected.length < 64) {
+            const ownerPath = queue.shift();
+            if (!ownerPath || seen.has(ownerPath))
+                continue;
+            seen.add(ownerPath);
+            let source = '';
+            try {
+                source = fs.readFileSync(resolveWorkspacePath(rootPath, ownerPath), 'utf8');
+            }
+            catch {
+                continue;
+            }
+            selected.push(ownerPath);
+            const specifiers = [];
+            if (kind === 'css') {
+                const importPattern = /@import\s+(?:url\(\s*)?(?:["']([^"']+)["']|([^\s)'";]+))\s*\)?/gi;
+                let match;
+                while ((match = importPattern.exec(source)) !== null)
+                    specifiers.push(match[1] || match[2]);
+            }
+            else {
+                const staticPattern = /\b(?:import|export)\s+(?:[^'";]*?\sfrom\s*)?["']([^"']+)["']/g;
+                const dynamicPattern = /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g;
+                let match;
+                while ((match = staticPattern.exec(source)) !== null)
+                    specifiers.push(match[1]);
+                while ((match = dynamicPattern.exec(source)) !== null)
+                    specifiers.push(match[1]);
+            }
+            for (const specifier of specifiers) {
+                const dependency = resolveImport(ownerPath, specifier);
+                if (dependency && !seen.has(dependency) && !queued.has(dependency)) {
+                    queue.push(dependency);
+                    queued.add(dependency);
+                }
+            }
+        }
+        return selected;
+    }
     async buildFrontendForPreview(rootPath) {
         const packagePath = path.join(rootPath, 'package.json');
         if (!fs.existsSync(packagePath)) {
@@ -256,12 +393,14 @@ export class FrontendPreviewService {
         // Pulling every CSS/JS file from the workspace also ingested audit copies,
         // rejected model drafts, and test harnesses into the production proof body.
         // Fall back to expected/workspace files only for documents without links.
-        const selectedCssFiles = (linkedAssets.css.length > 0
+        const directCssFiles = (linkedAssets.css.length > 0
             ? chooseExisting(linkedAssets.css, [])
             : chooseExisting(expectedCss, cssFiles)).slice(0, 12);
-        const selectedJsFiles = (linkedAssets.js.length > 0
+        const directJsFiles = (linkedAssets.js.length > 0
             ? chooseExisting(linkedAssets.js, [])
             : chooseExisting(expectedJs, jsFiles)).slice(0, 12);
+        const selectedCssFiles = this.expandLinkedFrontendDependencyGraph(rootPath, directCssFiles, 'css');
+        const selectedJsFiles = this.expandLinkedFrontendDependencyGraph(rootPath, directJsFiles, 'js');
         const css = selectedCssFiles.map((filePath) => fs.readFileSync(resolveWorkspacePath(rootPath, filePath), 'utf8')).join('\n\n');
         const js = selectedJsFiles.map((filePath) => fs.readFileSync(resolveWorkspacePath(rootPath, filePath), 'utf8')).join('\n\n');
         return { htmlPath, html, css, js, cssPaths: selectedCssFiles, jsPaths: selectedJsFiles };
@@ -272,6 +411,14 @@ export class FrontendPreviewService {
         const html = String(artifacts.html || '');
         const css = String(artifacts.css || '');
         const js = String(artifacts.js || '');
+        // runtime_check proves that an existing page can be opened by a real local
+        // browser. It is not a responsive-design audit. Requiring viewport metadata,
+        // stylesheets, and responsive CSS made focused JavaScript/CORS repairs fail
+        // even after Chromium produced the required screenshot. The screenshot and
+        // artifact persistence remain fail-closed in persistFrontendPreviewArtifacts.
+        if (options.functionalRuntime) {
+            return { ok: true, reasons: [] };
+        }
         if (!summary.hasViewportMeta) {
             reasons.push('missing viewport metadata');
         }
@@ -305,13 +452,30 @@ export class FrontendPreviewService {
             const screenshotPath = resolveWorkspacePath(rootPath, `.vigthoria/proof/preview/${baseName}.png`, { allowMissing: true });
             const entryAbsolutePath = resolveWorkspacePath(rootPath, previewGate.entryPath);
             const previewFileUrl = `file://${entryAbsolutePath}`;
-            const screenshot = await this.dependencies.screenshotAdapter.capture(entryAbsolutePath, screenshotPath);
+            const runtimeOptions = context.runtimeInteractionProof && typeof context.runtimeInteractionProof === 'object'
+                ? context.runtimeInteractionProof
+                : null;
+            const runtimeInteraction = runtimeOptions
+                ? (typeof this.dependencies.screenshotAdapter.captureRuntime === 'function'
+                    ? await this.dependencies.screenshotAdapter.captureRuntime(entryAbsolutePath, screenshotPath, { ...runtimeOptions, workspaceRoot: rootPath })
+                    : {
+                        captured: false,
+                        passed: false,
+                        error: 'required loopback browser interaction adapter is unavailable',
+                    })
+                : null;
+            const screenshot = runtimeInteraction
+                || await this.dependencies.screenshotAdapter.capture(entryAbsolutePath, screenshotPath);
             const screenshotRequired = context.requireScreenshot === true;
-            const effectivePreviewGate = screenshotRequired && !screenshot.captured
+            const screenshotFailure = screenshotRequired && !screenshot.captured;
+            const runtimeFailure = runtimeInteraction !== null && !runtimeInteraction.passed;
+            const effectivePreviewGate = screenshotFailure || runtimeFailure
                 ? {
                     ...previewGate,
                     passed: false,
-                    error: `${previewGate.error ? `${previewGate.error} ` : ''}Required screenshot proof is unavailable: ${screenshot.error || 'capture failed'}.`,
+                    error: `${previewGate.error ? `${previewGate.error} ` : ''}${runtimeFailure
+                        ? (runtimeInteraction.error || 'Required loopback browser interaction proof failed.')
+                        : `Required screenshot proof is unavailable: ${screenshot.error || 'capture failed'}.`}`,
                 }
                 : previewGate;
             const manifest = {
@@ -335,6 +499,16 @@ export class FrontendPreviewService {
                     captured: screenshot.captured,
                     error: screenshot.error || null,
                 },
+                runtimeInteraction: runtimeInteraction ? {
+                    passed: runtimeInteraction.passed,
+                    action: runtimeInteraction.action || null,
+                    initialBodyText: runtimeInteraction.initialBodyText || '',
+                    finalBodyText: runtimeInteraction.finalBodyText || '',
+                    bodyChanged: runtimeInteraction.bodyChanged === true,
+                    visualChanged: runtimeInteraction.visualChanged === true,
+                    runtimeErrors: runtimeInteraction.runtimeErrors || [],
+                    error: runtimeInteraction.error || null,
+                } : null,
             };
             fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
             return {
@@ -345,6 +519,7 @@ export class FrontendPreviewService {
                     previewFileUrl,
                     screenshotCaptured: screenshot.captured,
                     screenshotError: screenshot.error,
+                    ...(runtimeInteraction ? { runtimeInteraction } : {}),
                 },
             };
         }
@@ -408,14 +583,17 @@ export class FrontendPreviewService {
         const errors = [];
         if (context.localScreenshotProof === true) {
             const summary = {
-                hasViewportMeta: /<meta\b[^>]*name=["']viewport["'][^>]*>/i.test(html),
+                hasViewportMeta: hasViewportMeta(html),
                 hasResponsiveSignals: /@media\b/i.test(`${html}\n${css}`),
                 hasInteractiveSignals: /<script[\s>]/i.test(html) || js.trim().length > 0,
                 sectionCount: (html.match(/<section\b/gi) || []).length,
                 proofSource: 'local-screenshot-adapter',
             };
             const constrainedStatic = isConstrainedStaticFrontendRequest(String(context.rawPrompt || message || ''));
-            const visualProof = this.evaluateFrontendVisualProof(summary, artifacts, { constrainedStatic });
+            const visualProof = this.evaluateFrontendVisualProof(summary, artifacts, {
+                constrainedStatic,
+                functionalRuntime: context.functionalRuntimeProof === true,
+            });
             const localGate = {
                 required: true,
                 passed: visualProof.ok,
@@ -447,7 +625,7 @@ export class FrontendPreviewService {
                     qualityProfile: isConstrainedStaticFrontendRequest(String(context.rawPrompt || message || ''))
                         ? 'constrained-static'
                         : 'auto',
-                    html,
+                    html: canonicalizePreviewHtmlAttributes(html),
                     css,
                     js,
                     entryPath: artifacts.htmlPath,
@@ -466,8 +644,14 @@ export class FrontendPreviewService {
                         error: 'Preview proof skipped: payload exceeds size limit.',
                     };
                 }
-                const internalServiceKey = process.env.VIGTHORIA_TEMPLATE_SERVICE_KEY
-                    || process.env.V3_SERVICE_KEY;
+                const internalServiceKeyCandidate = process.env.VIGTHORIA_TEMPLATE_SERVICE_KEY
+                    || process.env.VIGTHORIA_V3_SERVICE_KEY
+                    || process.env.V3_SERVICE_KEY
+                    || this.dependencies.getServiceKey?.();
+                const internalServiceKey = String(internalServiceKeyCandidate || '').trim();
+                if (internalServiceKey && /[\r\n\0]/.test(internalServiceKey)) {
+                    throw new Error('Stored Template Service capability contains invalid header characters.');
+                }
                 const authToken = this.dependencies.getAccessToken();
                 const response = await this.dependencies.fetch(`${baseUrl}/preview-proof`, {
                     method: 'POST',
@@ -491,12 +675,18 @@ export class FrontendPreviewService {
                 const summary = payload?.summary || {};
                 const constrainedStatic = isConstrainedStaticFrontendRequest(String(context.rawPrompt || message || ''))
                     && modes?.production?.qualityTier === 'scope-complete';
-                const visualProof = this.evaluateFrontendVisualProof(summary, artifacts, { constrainedStatic });
-                const passed = payload?.success === true
-                    && modes?.design?.ready === true
-                    && modes?.live?.ready === true
-                    && modes?.production?.ready === true
-                    && visualProof.ok;
+                const functionalRuntime = context.functionalRuntimeProof === true;
+                const visualProof = this.evaluateFrontendVisualProof(summary, artifacts, {
+                    constrainedStatic,
+                    functionalRuntime,
+                });
+                const modeProofReady = functionalRuntime
+                    ? payload?.success === true && modes?.live?.ready === true
+                    : payload?.success === true
+                        && modes?.design?.ready === true
+                        && modes?.live?.ready === true
+                        && modes?.production?.ready === true;
+                const passed = modeProofReady && visualProof.ok;
                 const previewGate = {
                     required: true,
                     passed,

package/dist/utils/javascript-syntax.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Detect static ESM syntax even when a compact generator places exports after
+ * declarations on the same line. Dynamic import() alone remains valid in
+ * CommonJS syntax mode and does not require ESM parsing.
+ */
+export declare function usesJavaScriptModuleSyntax(source: string, filePath?: string): boolean;
+export type JavaScriptSyntaxMode = 'script' | 'module';
+/**
+ * Return the grammars that may legitimately own a JavaScript source file.
+ *
+ * A plain `.js` file is ambiguous until its package or HTML loader is known.
+ * In particular, top-level await can make otherwise valid browser-module code
+ * fail a CommonJS-only preflight without leaving a static import/export token
+ * for the lightweight detector above. Trying both grammars keeps the gate
+ * strict (one parser must accept the complete source) without rejecting valid
+ * browser modules or classic scripts. Explicit `.mjs` and `.cjs` identities
+ * remain single-grammar and therefore fail closed.
+ */
+export declare function resolveJavaScriptSyntaxModes(source: string, filePath?: string): JavaScriptSyntaxMode[];

package/dist/utils/javascript-syntax.js

@@ -0,0 +1,35 @@
+import path from 'node:path';
+/**
+ * Detect static ESM syntax even when a compact generator places exports after
+ * declarations on the same line. Dynamic import() alone remains valid in
+ * CommonJS syntax mode and does not require ESM parsing.
+ */
+export function usesJavaScriptModuleSyntax(source, filePath = '.js') {
+    const extension = path.extname(filePath).toLowerCase();
+    if (extension === '.mjs')
+        return true;
+    if (extension === '.cjs')
+        return false;
+    return /(?:^|[;}\n]|\*\/)[ \t]*(?:import(?!\s*\()|export\b)/m.test(source);
+}
+/**
+ * Return the grammars that may legitimately own a JavaScript source file.
+ *
+ * A plain `.js` file is ambiguous until its package or HTML loader is known.
+ * In particular, top-level await can make otherwise valid browser-module code
+ * fail a CommonJS-only preflight without leaving a static import/export token
+ * for the lightweight detector above. Trying both grammars keeps the gate
+ * strict (one parser must accept the complete source) without rejecting valid
+ * browser modules or classic scripts. Explicit `.mjs` and `.cjs` identities
+ * remain single-grammar and therefore fail closed.
+ */
+export function resolveJavaScriptSyntaxModes(source, filePath = '.js') {
+    const extension = path.extname(filePath).toLowerCase();
+    if (extension === '.mjs')
+        return ['module'];
+    if (extension === '.cjs')
+        return ['script'];
+    if (usesJavaScriptModuleSyntax(source, filePath))
+        return ['module'];
+    return ['script', 'module'];
+}

package/dist/utils/localTestMode.js

@@ -20,7 +20,7 @@ export function applyLocalTestfarmDefaults() {
     process.env.VIGTHORIA_HYPERLOOP_URL ??= 'http://127.0.0.1:8020/api/hyperloop/health';
     process.env.VIGTHORIA_HYPERLOOP_EXECUTE_URL ??= 'http://127.0.0.1:8020/api/hyperloop/execute';
     process.env.VIGTHORIA_HYPERLOOP_MODULES_URL ??= 'http://127.0.0.1:8020/api/hyperloop/modules';
-    process.env.VIGTHORIA_V3_AGENT_URL ??= 'http://127.0.0.1:8030';
+    process.env.VIGTHORIA_V3_AGENT_URL ??= 'http://127.0.0.1:8032';
     process.env.VIGTHORIA_TEMPLATE_SERVICE_URL ??= 'http://127.0.0.1:4011';
     process.env.VIGTHORIA_HYPERLOOP_TIMEOUT_MS ??= '180000';
     const testToken = String(process.env.VIGTHORIA_LOCAL_TEST_TOKEN || '').trim();

package/dist/utils/mutation-journal.d.ts

@@ -39,4 +39,14 @@ export declare class MutationJournal {
     commit(): MutationJournalReport;
     rollback(): MutationJournalReport;
 }
+/**
+ * Last-resort synchronous rollback for process signals.
+ *
+ * APIClient normally owns the foreground journal, but command teardown or a
+ * second lifecycle wrapper must never be able to detach an open transaction
+ * from SIGINT/SIGTERM protection.  Journals register at construction and
+ * unregister only after commit/rollback, so this fallback closes every still
+ * open workspace transaction before the original signal is re-raised.
+ */
+export declare function rollbackActiveMutationJournals(): MutationJournalReport[];
 export declare function finalizeMutationTransaction(journal: MutationJournal, proofSucceeded: boolean): MutationJournalReport;