vigthoria-cli 1.13.34 → 1.13.42

package/dist/utils/release-install.d.ts

@@ -7,5 +7,4 @@ export type ReleaseInstallResult = {
 };
 export declare function installReleaseTransaction(packageSpec: string, expectedVersion: string, options?: {
     homeDirectory?: string;
-    npmRegistry?: string;
 }): ReleaseInstallResult;

package/dist/utils/release-install.js

@@ -6,7 +6,23 @@ import { execFileSync } from 'node:child_process';
 import { getReleasePolicy } from './release-policy.js';
 import { safeChildProcessEnv } from './secret-policy.js';
 import { assertProcessNetworkAllowed } from './process-policy.js';
-function npmExecutable() { return process.platform === 'win32' ? 'npm.cmd' : 'npm'; }
+function npmInvocation() {
+    if (process.platform !== 'win32') {
+        return { executable: 'npm', leadingArguments: [], policyExecutable: 'npm' };
+    }
+    // Node 24 rejects direct execFile/spawn of .cmd launchers on Windows with
+    // EINVAL. Invoking npm through cmd.exe would reintroduce shell parsing for
+    // the archive and prefix paths. Execute npm's JavaScript entry through the
+    // already-trusted Node binary instead.
+    const candidates = [
+        path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+        path.resolve(path.dirname(process.execPath), '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    ];
+    const npmCli = candidates.find((candidate) => fs.statSync(candidate, { throwIfNoEntry: false })?.isFile());
+    if (!npmCli)
+        throw new Error('The npm runtime bundled with Node could not be located safely.');
+    return { executable: process.execPath, leadingArguments: [npmCli], policyExecutable: 'npm.cmd' };
+}
 function readInstalledIdentity(prefix) {
     const packageDirectory = path.join(prefix, 'node_modules', 'vigthoria-cli');
     const manifest = JSON.parse(fs.readFileSync(path.join(packageDirectory, 'package.json'), 'utf8'));
@@ -25,6 +41,25 @@ function smokeCandidate(prefix, expectedVersion, homeDirectory) {
         VIGTHORIA_NO_UPDATE_CHECK: '1',
         NO_COLOR: '1',
     };
+    // The parent CLI has already redirected TEMP/TMP/TMPDIR into its managed
+    // per-user root. Seed only a known native shared-temp boundary while the
+    // child imports runtime-temp; CLI startup immediately replaces it with the
+    // managed per-user root before the command executes. On Windows Node 24,
+    // deleting TEMP/TMP is insufficient because os.tmpdir() may reconstruct the
+    // user-scoped managed value from the remaining process environment.
+    for (const key of Object.keys(environment)) {
+        if (['TEMP', 'TMP', 'TMPDIR'].includes(key.toUpperCase()))
+            delete environment[key];
+    }
+    if (process.platform === 'win32') {
+        const systemRoot = String(environment.SystemRoot || environment.SYSTEMROOT || 'C:\\Windows');
+        const nativeTempBoundary = path.win32.join(systemRoot, 'Temp');
+        environment.TEMP = nativeTempBoundary;
+        environment.TMP = nativeTempBoundary;
+    }
+    else {
+        environment.TMPDIR = '/tmp';
+    }
     for (const args of [['--version'], ['--help'], ['doctor', '--json']]) {
         const output = execFileSync(process.execPath, [identity.entry, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, timeout: 30_000, env: environment });
         if (args[0] === '--version' && output.trim() !== expectedVersion)
@@ -67,17 +102,19 @@ export function installReleaseTransaction(packageSpec, expectedVersion, options
     let switched = false;
     let previousTarget = null;
     try {
-        const npm = npmExecutable();
+        const npm = npmInvocation();
         const args = ['install', '--prefix', stage, '--ignore-scripts', '--no-audit', '--no-fund', '--install-strategy=nested'];
-        const localArchive = path.isAbsolute(packageSpec) && fs.statSync(packageSpec, { throwIfNoEntry: false })?.isFile();
+        const localArchive = path.isAbsolute(packageSpec)
+            && packageSpec.toLowerCase().endsWith('.tgz')
+            && fs.statSync(packageSpec, { throwIfNoEntry: false })?.isFile();
+        if (!localArchive)
+            throw new Error('Release activation accepts only an existing absolute local .tgz archive.');
         if (localArchive && process.env.VIGTHORIA_OFFLINE === '1')
             args.push('--offline');
-        if (options.npmRegistry)
-            args.push(`--registry=${options.npmRegistry}`);
         args.push(packageSpec);
         if (!(localArchive && args.includes('--offline')))
-            assertProcessNetworkAllowed(npm, args);
-        execFileSync(npm, args, {
+            assertProcessNetworkAllowed(npm.policyExecutable, args);
+        execFileSync(npm.executable, [...npm.leadingArguments, ...args], {
             stdio: 'pipe',
             windowsHide: true,
             timeout: 180_000,

package/dist/utils/requestIntent.d.ts

@@ -1,6 +1,6 @@
 /**
  * Shared prompt intent detection for CLI routing, V3 hints, and rescue gating.
- * Keep aligned with V3-Code-Agent/agent.py _classify_request heuristics.
+ * Keep aligned with the isolated V3 CLI lane's server-side request classifier.
  */
 export type IntentContext = {
     priorPrompt?: string | null;

package/dist/utils/requestIntent.js

@@ -1,6 +1,6 @@
 /**
  * Shared prompt intent detection for CLI routing, V3 hints, and rescue gating.
- * Keep aligned with V3-Code-Agent/agent.py _classify_request heuristics.
+ * Keep aligned with the isolated V3 CLI lane's server-side request classifier.
  */
 const CLI_SHAPING_BLOCK = /(?:^|\n\n)Platform:\s*(?:Windows|macOS|Linux)\.[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
 const READONLY_SHAPING_BLOCK = /(?:^|\n\n)(?:Read-only analysis mode is active\.|Diagnostic mode is active\.)[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
@@ -177,7 +177,15 @@ export function isBuiltWriteConfirmationPrompt(prompt) {
     return /^The user confirmed they want file changes applied/i.test(stripExecutionShaping(prompt));
 }
 export function hasFixOrCorrectIntent(prompt) {
-    return FIX_CORRECT_INTENT.test(stripExecutionShaping(prompt));
+    const text = stripExecutionShaping(prompt);
+    // An explicit repair verb is sufficient even when the user describes the
+    // exact value change instead of repeating a generic "bug" or "issue" noun.
+    // Remove negated repair clauses first so safety/scope instructions do not
+    // manufacture write intent. Comprehensive redesign intent is resolved ahead
+    // of this predicate by inferAgentTaskType.
+    const affirmative = text.replace(/\b(?:not|is\s+not|isn't|no|do\s+not|don't|without)\s+(?:an?\s+)?(?:(?:narrow|focused|small|minor|simple|atomic)\s+)?(?:fix|repair|patch|debug)(?:ing|\s+job)?\b/gi, ' ');
+    return FIX_CORRECT_INTENT.test(affirmative)
+        || /\b(?:fix|repair|patch|resolve|correct|debug)\b/i.test(affirmative);
 }
 export function isReadOnlyCheckIntent(prompt) {
     const text = stripExecutionShaping(prompt);
@@ -187,7 +195,13 @@ export function isReadOnlyCheckIntent(prompt) {
     if (hasFixOrCorrectIntent(prompt) || isWritePermissionGrant(prompt)) {
         return false;
     }
-    if (/\b(?:fix|correct|repair|implement|apply|write|change|update)\b/i.test(text)) {
+    // A build brief commonly ends with "verify syntax/runtime".  The old
+    // narrow exception list did not include build/create/generate/develop, so
+    // that trailing verification clause reclassified an explicit greenfield
+    // request as read-only debugging.  Keep the write vocabulary aligned with
+    // EXPLICIT_WRITE_VERBS so verification remains a release gate for the
+    // requested mutation rather than overriding it.
+    if (EXPLICIT_WRITE_VERBS.test(text)) {
         return false;
     }
     return true;

package/dist/utils/tools.js

@@ -29,6 +29,7 @@ import { assertProcessNetworkAllowed, buildApprovalScope, hardenGitArguments, pa
 import { containsHighConfidenceSecret, isSensitivePath, safeChildProcessEnv } from './secret-policy.js';
 import { isOfflineNetworkMode } from './network-policy.js';
 import { createRuntimeTempDirectory, removeRuntimeTempDirectory } from './runtime-temp.js';
+import { resolveJavaScriptSyntaxModes } from './javascript-syntax.js';
 import { ToolApprovalService } from './tool-approval-service.js';
 import { DelegationToolProvider, FilesystemToolProvider, NetworkBrowserToolProvider, ProcessToolProvider, RepositoryToolProvider, SearchToolProvider, SshToolProvider, ToolCapabilityRegistry, } from './tool-capability-providers.js';
 const STREAM_RESPONSE_MAX_YIELD_CHARS = 32 * 1024;
@@ -1349,25 +1350,30 @@ export class AgenticTools {
         catch (error) {
             return this.formatExternalToolError('syntax_check', 'allocate bounded temporary storage', error);
         }
-        const tempFile = path.join(tempDirectory, 'candidate.js');
+        const syntaxModes = resolveJavaScriptSyntaxModes(source);
+        const tempFiles = syntaxModes.map((mode) => path.join(tempDirectory, `candidate.${mode === 'module' ? 'mjs' : 'cjs'}`));
         try {
-            try {
-                fs.writeFileSync(tempFile, source, 'utf-8');
-            }
-            catch (writeError) {
-                return this.formatExternalToolError('syntax_check', `write temporary file ${tempFile}`, writeError);
-            }
-            try {
-                execFileSync(process.execPath, ['--check', tempFile], { stdio: 'pipe', timeout: 10_000, windowsHide: true, env: safeChildProcessEnv() });
-                return null;
-            }
-            catch (error) {
-                const stderr = error.stderr?.toString()?.trim();
-                return stderr || error.message || this.formatExternalToolError('syntax_check', `node --check ${tempFile}`, error);
+            let firstError = null;
+            for (const tempFile of tempFiles) {
+                try {
+                    fs.writeFileSync(tempFile, source, 'utf-8');
+                }
+                catch (writeError) {
+                    return this.formatExternalToolError('syntax_check', `write temporary file ${tempFile}`, writeError);
+                }
+                try {
+                    execFileSync(process.execPath, ['--check', tempFile], { stdio: 'pipe', timeout: 10_000, windowsHide: true, env: safeChildProcessEnv() });
+                    return null;
+                }
+                catch (error) {
+                    const stderr = error.stderr?.toString()?.trim();
+                    firstError ||= stderr || error.message || this.formatExternalToolError('syntax_check', `node --check ${tempFile}`, error);
+                }
             }
+            return firstError || 'JavaScript syntax check failed.';
         }
         finally {
-            this.cleanupAfterToolError('syntax_check', `remove temporary file ${tempFile}`, () => {
+            this.cleanupAfterToolError('syntax_check', 'remove temporary JavaScript syntax files', () => {
                 removeRuntimeTempDirectory(tempDirectory);
             });
         }

package/dist/utils/update-policy.d.ts

@@ -1,8 +1,4 @@
 export type ResolvedUpdateSource = {
-    kind: 'registry';
-    installTarget: string;
-    expectedSha256: null;
-} | {
     kind: 'local';
     installTarget: string;
     expectedSha256: string | null;

package/dist/utils/update-policy.js

@@ -101,14 +101,10 @@ export function resolveUpdateSource(rawTarget, options = {}) {
         });
     }
     if (target.startsWith('vigthoria-cli@')) {
-        parseSemanticVersion(target.slice('vigthoria-cli@'.length));
-        if (expectedSha256) {
-            throw new CliCommandError('--sha256 applies only to local or HTTPS archive sources.', {
-                code: 'UPDATE_CHECKSUM_NOT_APPLICABLE',
-                category: 'usage',
-            });
-        }
-        return { kind: 'registry', installTarget: target, expectedSha256: null };
+        throw new CliCommandError('Registry package sources are disabled; use the signed extension manifest or an approved local archive.', {
+            code: 'UPDATE_REGISTRY_SOURCE_DISABLED',
+            category: 'usage',
+        });
     }
     const candidatePath = path.resolve(options.cwd || process.cwd(), target);
     if (target.toLowerCase().endsWith('.tgz') || fs.existsSync(candidatePath)) {
@@ -130,7 +126,7 @@ export function resolveUpdateSource(rawTarget, options = {}) {
         }
         return { kind: 'local', installTarget: fs.realpathSync(candidatePath), expectedSha256 };
     }
-    throw new CliCommandError('Update source must be an exact vigthoria-cli@<version> package or a local/HTTPS .tgz archive.', {
+    throw new CliCommandError('Update source must be a local .tgz archive or an HTTPS .tgz archive on extension.vigthoria.io.', {
         code: 'UPDATE_SOURCE_INVALID',
         category: 'usage',
     });

package/dist/utils/v3-agent-client.js

@@ -8,35 +8,49 @@ export class V3AgentClient {
     }
     isDirectBaseUrl(baseUrl) {
         try {
-            return new URL(String(baseUrl)).port.endsWith('8030');
+            return new Set(['8032', '18032']).has(new URL(String(baseUrl)).port);
         }
         catch {
-            return /(?:127\.0\.0\.1|localhost|172\.19\.0\.1|host\.lan):(?:\d*8030|8030)/.test(String(baseUrl));
+            return /(?:127\.0\.0\.1|localhost|172\.19\.0\.1|host\.lan):(?:8032|18032)/.test(String(baseUrl));
         }
     }
     getBaseUrls(preferLocal = false) {
         const configured = String(this.dependencies.getConfiguredApiUrl() || 'https://coder.vigthoria.io').replace(/\/$/, '');
         const localTestMode = isLocalTestfarmMode();
-        const explicit = Boolean(process.env.VIGTHORIA_V3_AGENT_URL || process.env.V3_AGENT_URL);
-        const local = [
+        const explicitUrls = [
             process.env.VIGTHORIA_V3_AGENT_URL,
             process.env.V3_AGENT_URL,
-            ...(hasLocalV3AgentCapability() ? ['http://127.0.0.1:8030'] : []),
+        ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
+        const explicit = explicitUrls.length > 0;
+        const local = [
+            ...explicitUrls,
+            ...(hasLocalV3AgentCapability() ? ['http://127.0.0.1:8032'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         const remote = (localTestMode ? [configured] : [configured, 'https://coder.vigthoria.io'])
             .filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
+        // An explicit endpoint is an operator-selected runtime boundary, not a
+        // preference hint.  Falling through from a failed isolated CLI lane to the
+        // public gateway can execute the same mutation against a different runtime
+        // and also turns an internal failure into a misleading login error.
+        if (explicit)
+            return [...new Set(explicitUrls)];
         return [...new Set((preferLocal || localTestMode || explicit) && local.length ? [...local, ...remote] : [...remote, ...local])];
     }
-    runUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/run' : '/api/v3-agent/run'}`; }
-    continueUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/continue' : '/api/v3-agent/continue'}`; }
+    runUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/run' : '/api/v3-agent-cli/run'}`; }
+    continueUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/continue' : '/api/v3-agent-cli/continue'}`; }
     backgroundUrl(baseUrl, suffix = '') {
         const clean = suffix ? `/${suffix.replace(/^\/+/, '')}` : '';
-        return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/background' : '/api/v3-agent/background'}${clean}`;
+        return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/background' : '/api/v3-agent-cli/background'}${clean}`;
     }
-    approvalUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/approval' : '/api/v3-agent/approval'}`; }
-    healthUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/health' : '/api/v3-agent/health'}`; }
+    approvalUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/api/agent/approval' : '/api/v3-agent-cli/approval'}`; }
+    healthUrl(baseUrl) { return `${baseUrl}${this.isDirectBaseUrl(baseUrl) ? '/health' : '/api/v3-agent-cli/health'}`; }
     headers() {
-        const headers = { 'Content-Type': 'application/json', Accept: 'text/event-stream' };
+        const headers = {
+            'Content-Type': 'application/json',
+            Accept: 'text/event-stream',
+            'X-Vigthoria-Agent-Lane': 'cli',
+            'X-Vigthoria-Source-Product': 'vigthoria-cli',
+        };
         const token = this.dependencies.getAccessToken();
         if (token) {
             headers.Authorization = `Bearer ${token}`;

package/install.ps1

@@ -1,27 +1,23 @@
 # Vigthoria CLI Installer for Windows
-# Usage: irm https://cli.vigthoria.io/install.ps1 | iex
+# Usage: irm https://extension.vigthoria.io/downloads/install.ps1 | iex
 # Alternative: PowerShell -ExecutionPolicy Bypass -File install.ps1
 
 $ErrorActionPreference = "Stop"
 
 # Configuration
-$CLI_VERSION = "1.13.34"
+$CLI_VERSION = "1.13.42"
 $INSTALL_DIR = "$env:USERPROFILE\.vigthoria"
-$NPM_PACKAGE = "vigthoria-cli"
 $MANIFEST_URL = "https://extension.vigthoria.io/downloads/manifest.json"
 $HOSTED_TARBALL_URL = "https://extension.vigthoria.io/downloads/vigthoria-cli-$CLI_VERSION.tgz"
 # Packaged installs resolve the signed manifest. The standalone hosted script
 # is pinned after packing to the immutable archive digest; a pipe-to-iex copy
-# has no PSScriptRoot and safely falls back to the exact npm package.
-$HOSTED_TARBALL_SHA256 = ""
+# stays on the same canonical extension archive.
+$HOSTED_TARBALL_SHA256 = "d778aac8cbcf22da7ac7ca7d6007520e8996591a653dddf9b10443eaea70a4f0"
 $RELEASE_RESOLVER = if ($PSScriptRoot) { Join-Path $PSScriptRoot "scripts\release\resolve-release-manifest.mjs" } else { "" }
 $RELEASE_INSTALLER = if ($PSScriptRoot) { Join-Path $PSScriptRoot "scripts\release\install-release.mjs" } else { "" }
 
 function Assert-TrustedReleaseUrl([string]$Value) {
-    $allowed = @(
-        "extension.vigthoria.io", "landing.vigthoria.io", "cli.vigthoria.io",
-        "coder.vigthoria.io", "market.vigthoria.io", "registry.npmjs.org"
-    )
+    $allowed = @("extension.vigthoria.io")
     try { $uri = [Uri]$Value } catch { throw "Invalid release URL" }
     if ($uri.Scheme -ne "https" -or -not $uri.IsDefaultPort -or $uri.UserInfo -or $allowed -notcontains $uri.DnsSafeHost.ToLowerInvariant() -or $Value.Contains("\")) {
         throw "Release URL must use HTTPS on an exact approved host and port"
@@ -75,16 +71,7 @@ function Test-NetworkConnectivity {
         return $true
     }
     catch {
-        Write-Host "[WARN] Hosted package unavailable, checking npm registry..." -ForegroundColor Yellow
-    }
-
-    try {
-        $response = Invoke-WebRequest -Uri "https://registry.npmjs.org/vigthoria-cli" -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 10 -ErrorAction Stop
-        Write-Host "[OK] npm registry is reachable" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Host "[ERROR] Cannot reach hosted package or npm registry" -ForegroundColor Red
+        Write-Host "[ERROR] Cannot reach the canonical extension package" -ForegroundColor Red
         return $false
     }
 }
@@ -162,11 +149,11 @@ function Get-VigthoriaTempRoot {
     return $fullRoot
 }
 
-function Install-VigthoriaCLI-NPM {
+function Install-VigthoriaCLI-Package {
     Write-Host ""
     Write-Host "[INSTALL] Installing Vigthoria CLI..." -ForegroundColor Cyan
 
-    if ($HOSTED_TARBALL_SHA256 -and $RELEASE_INSTALLER -and (Test-Path -LiteralPath $RELEASE_INSTALLER)) {
+    if ($HOSTED_TARBALL_SHA256) {
         $releaseTemp = Join-Path (Get-VigthoriaTempRoot) ("install-" + [Guid]::NewGuid().ToString("N"))
         $releaseArchive = Join-Path $releaseTemp "candidate.tgz"
         try {
@@ -175,14 +162,19 @@ function Install-VigthoriaCLI-NPM {
             Invoke-WebRequest -Uri $trustedTarball -OutFile $releaseArchive -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 60 -ErrorAction Stop
             $actualSha256 = (Get-FileHash -Path $releaseArchive -Algorithm SHA256).Hash.ToLowerInvariant()
             if ($actualSha256 -ne $HOSTED_TARBALL_SHA256) { throw "Release checksum mismatch" }
-            if (-not $RELEASE_INSTALLER -or -not (Test-Path -LiteralPath $RELEASE_INSTALLER)) { throw "Transactional release installer is unavailable" }
-            & node $RELEASE_INSTALLER $releaseArchive $CLI_VERSION
-            if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+            if ($RELEASE_INSTALLER -and (Test-Path -LiteralPath $RELEASE_INSTALLER)) {
+                & node $RELEASE_INSTALLER $releaseArchive $CLI_VERSION
+                if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+            } else {
+                npm install -g --force $releaseArchive
+                if ($LASTEXITCODE -ne 0) { throw "local archive installer exited with status $LASTEXITCODE" }
+            }
             Write-Host "[OK] Vigthoria CLI installed from the checksum-verified release!" -ForegroundColor Green
             return $true
         }
         catch {
-            Write-Host "[WARN] Verified hosted package install failed, trying npm registry: $_" -ForegroundColor Yellow
+            Write-Host "[ERROR] Verified extension package install failed: $_" -ForegroundColor Red
+            return $false
         }
         finally {
             if (Test-Path $releaseTemp) { Remove-Item -Recurse -Force $releaseTemp }
@@ -191,21 +183,7 @@ function Install-VigthoriaCLI-NPM {
         Write-Host "[WARN] Hosted package has no trusted manifest SHA-256; skipping direct URL installation." -ForegroundColor Yellow
     }
 
-    try {
-        if ($RELEASE_INSTALLER -and (Test-Path -LiteralPath $RELEASE_INSTALLER)) {
-            & node $RELEASE_INSTALLER "$NPM_PACKAGE@$CLI_VERSION" $CLI_VERSION
-            if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
-        } else {
-            npm install -g --registry=https://registry.npmjs.org/ "$NPM_PACKAGE@$CLI_VERSION"
-            if ($LASTEXITCODE -ne 0) { throw "npm exited with status $LASTEXITCODE" }
-        }
-        Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Host "[ERROR] Install failed: no checksum-verified artifact or exact npm release $CLI_VERSION is available: $_" -ForegroundColor Red
-        return $false
-    }
+    return $false
 }
 
 function Install-VigthoriaCLI-Direct {
@@ -215,14 +193,18 @@ function Install-VigthoriaCLI-Direct {
     $tarballPath = Join-Path $releaseTemp "candidate.tgz"
     try {
         if (-not $HOSTED_TARBALL_SHA256) { throw "Direct installation requires a signed manifest SHA-256" }
-        if (-not $RELEASE_INSTALLER -or -not (Test-Path -LiteralPath $RELEASE_INSTALLER)) { throw "Transactional release installer is unavailable" }
         New-Item -ItemType Directory -Path $releaseTemp -ErrorAction Stop | Out-Null
         $tarballUrl = Assert-TrustedReleaseUrl $HOSTED_TARBALL_URL
         Invoke-WebRequest -Uri $tarballUrl -OutFile $tarballPath -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 60 -ErrorAction Stop
         $actualSha256 = (Get-FileHash -Path $tarballPath -Algorithm SHA256).Hash.ToLowerInvariant()
         if ($actualSha256 -ne $HOSTED_TARBALL_SHA256) { throw "Release checksum mismatch" }
-        & node $RELEASE_INSTALLER $tarballPath $CLI_VERSION
-        if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+        if ($RELEASE_INSTALLER -and (Test-Path -LiteralPath $RELEASE_INSTALLER)) {
+            & node $RELEASE_INSTALLER $tarballPath $CLI_VERSION
+            if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+        } else {
+            npm install -g --force $tarballPath
+            if ($LASTEXITCODE -ne 0) { throw "local archive installer exited with status $LASTEXITCODE" }
+        }
         Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
         return $true
     }
@@ -241,10 +223,10 @@ function Show-NetworkTroubleshooting {
     Write-Host "  NETWORK TROUBLESHOOTING" -ForegroundColor Yellow
     Write-Host "===============================================================" -ForegroundColor Yellow
     Write-Host ""
-    Write-Host "The hosted package and npm registry could not be reached. Try these solutions:" -ForegroundColor White
+    Write-Host "The canonical extension package could not be reached. Try these solutions:" -ForegroundColor White
     Write-Host ""
     Write-Host "1. Check your internet connection" -ForegroundColor Cyan
-    Write-Host "   ping registry.npmjs.org" -ForegroundColor Gray
+    Write-Host "   Test-NetConnection extension.vigthoria.io -Port 443" -ForegroundColor Gray
     Write-Host ""
     Write-Host "2. If behind a corporate proxy, configure npm:" -ForegroundColor Cyan
     Write-Host "   npm config set proxy http://proxy.company.com:8080" -ForegroundColor Gray
@@ -254,9 +236,8 @@ function Show-NetworkTroubleshooting {
     Write-Host ""
     Write-Host "4. Try using a VPN" -ForegroundColor Cyan
     Write-Host ""
-    Write-Host "5. Manual download alternative:" -ForegroundColor Cyan
+    Write-Host "5. Canonical manual download:" -ForegroundColor Cyan
     Write-Host "   Hosted package: $HOSTED_TARBALL_URL" -ForegroundColor Gray
-    Write-Host "   npm package: https://www.npmjs.com/package/vigthoria-cli" -ForegroundColor Gray
     Write-Host ""
 }
 
@@ -293,14 +274,13 @@ if (-not (Test-Prerequisites)) {
 $networkOk = Test-NetworkConnectivity
 
 if ($networkOk) {
-    # Try npm install first
-    if (Install-VigthoriaCLI-NPM) {
+    if (Install-VigthoriaCLI-Package) {
         Show-Success
         exit 0
     }
 }
 
-# Network failed or npm install failed
+# Network or canonical package installation failed
 Show-NetworkTroubleshooting
 
 Write-Host "Would you like to try the checksum-verified direct download?" -ForegroundColor Yellow

package/install.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 #
 # Vigthoria CLI Installer
-# Usage: curl -fsSL https://cli.vigthoria.io/install.sh | bash
+# Usage: curl -fsSL https://extension.vigthoria.io/downloads/install.sh | bash
 #
 # Supports: Linux, macOS (Intel and Apple Silicon)
 #
@@ -26,15 +26,15 @@ else
 fi
 
 # Configuration
-CLI_VERSION="1.13.34"
+CLI_VERSION="1.13.42"
 INSTALL_DIR="$HOME/.vigthoria"
-MANIFEST_URL="${VIGTHORIA_UPDATE_MANIFEST_URL:-https://extension.vigthoria.io/downloads/manifest.json}"
+MANIFEST_URL="https://extension.vigthoria.io/downloads/manifest.json"
 HOSTED_TARBALL_URL="https://extension.vigthoria.io/downloads/vigthoria-cli-${CLI_VERSION}.tgz"
 # The packaged installer resolves the signed manifest. The independently
 # hosted installer is rendered after packing with this release's exact digest.
-# An empty package fallback uses the exact npm version instead of trusting an
-# unsigned or circularly self-referential checksum.
-HOSTED_TARBALL_SHA256=""
+# The standalone installer uses this immutable digest when the packaged
+# signature resolver is not locally available.
+HOSTED_TARBALL_SHA256="d778aac8cbcf22da7ac7ca7d6007520e8996591a653dddf9b10443eaea70a4f0"
 INSTALLER_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
 RELEASE_RESOLVER="$INSTALLER_ROOT/scripts/release/resolve-release-manifest.mjs"
 RELEASE_INSTALLER="$INSTALLER_ROOT/scripts/release/install-release.mjs"
@@ -43,10 +43,7 @@ validate_release_url() {
     python3 - "$1" <<'PY'
 import sys
 from urllib.parse import urlsplit
-allowed = {
-    'extension.vigthoria.io', 'landing.vigthoria.io', 'cli.vigthoria.io',
-    'coder.vigthoria.io', 'market.vigthoria.io', 'registry.npmjs.org',
-}
+allowed = {'extension.vigthoria.io'}
 try:
     parsed = urlsplit(sys.argv[1])
     valid = parsed.scheme == 'https' and parsed.hostname in allowed and parsed.port in (None, 443) and not parsed.username and not parsed.password and '\\' not in sys.argv[1]
@@ -59,8 +56,8 @@ PY
 resolve_release_manifest() {
     # Direct artifacts are accepted only when the packaged shared verifier is
     # present and validates the strict manifest plus detached Ed25519 signature.
-    # A curl-piped legacy installer therefore falls back to the exact pinned npm
-    # version instead of trusting an unsigned manifest.
+    # A curl-piped installer therefore stays pinned to the immutable extension
+    # archive instead of changing package origins.
     if [[ ! -f "$RELEASE_RESOLVER" ]] || ! command -v node >/dev/null 2>&1 || ! command -v python3 >/dev/null 2>&1; then
         return 0
     fi
@@ -147,7 +144,7 @@ detect_platform() {
             ;;
         *)
             echo -e "${RED}Unsupported operating system: $OS${NC}"
-            echo "Please use the npm install method: npm install -g vigthoria-cli"
+            echo "No signed Vigthoria CLI release is available for this operating system."
             exit 1
             ;;
     esac
@@ -257,7 +254,7 @@ install_cli() {
     mkdir -p "$INSTALL_DIR"
     
     # Option 1: Download and verify the exact hosted release package.
-    if [[ -n "$HOSTED_TARBALL_SHA256" && -f "$RELEASE_INSTALLER" ]]; then
+    if [[ -n "$HOSTED_TARBALL_SHA256" ]]; then
         echo "Downloading checksum-verified hosted release package..."
         VIGTHORIA_INSTALL_TEMP_ROOT="$(prepare_temp_root)" || return 1
         RELEASE_TMP_DIR="$(mktemp -d "$VIGTHORIA_INSTALL_TEMP_ROOT/install.XXXXXX")"
@@ -288,19 +285,11 @@ install_cli() {
         if [[ -f "$RELEASE_INSTALLER" ]]; then
             node "$RELEASE_INSTALLER" "$RELEASE_ARCHIVE" "$CLI_VERSION"
         else
-            echo -e "${RED}✗ Transactional release installer is unavailable${NC}"
-            exit 1
+            npm install -g --force "$RELEASE_ARCHIVE"
         fi
         rm -rf "$RELEASE_TMP_DIR"
-    elif npm view --registry=https://registry.npmjs.org/ "vigthoria-cli@${CLI_VERSION}" version &> /dev/null; then
-        echo "Installing exact version ${CLI_VERSION} from npm registry..."
-        if [[ -f "$RELEASE_INSTALLER" ]]; then
-            node "$RELEASE_INSTALLER" "vigthoria-cli@${CLI_VERSION}" "$CLI_VERSION"
-        else
-            npm install -g --force --registry=https://registry.npmjs.org/ "vigthoria-cli@${CLI_VERSION}"
-        fi
     else
-        echo -e "${RED}✗ No checksum-verified artifact or exact npm release ${CLI_VERSION} is available${NC}"
+        echo -e "${RED}✗ No checksum-verified extension release ${CLI_VERSION} is available${NC}"
         return 1
     fi
     

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.13.34",
+  "version": "1.13.42",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",
@@ -72,10 +72,11 @@
     "test:repo:payload-fallback": "node scripts/test-repo-payload-fallback.mjs",
     "test:repo:public-clone": "npm run build && node scripts/test-public-repo-clone.mjs",
     "test:command:timeouts": "npm run build && node scripts/test-timeout-cancellation.mjs",
+    "test:agent:signal-rollback": "npm run build && node scripts/test-agent-signal-rollback.mjs",
     "test:game:live": "npm run build && node scripts/test-live-game-push.js",
     "proof:agent": "npm run build && node scripts/proof-agent-mode.js",
     "test:fresh-install": "node scripts/test-fresh-install.js",
-    "prepublishOnly": "npm run build && npm run validate:no-go && npm run test:repo:auth-fallback && npm run test:repo:payload-fallback && node scripts/verify-package-hygiene.js && node scripts/test-fresh-install.js",
+    "prepublishOnly": "npm run build && npm run test:banner && npm run validate:no-go && npm run test:repo:auth-fallback && npm run test:repo:payload-fallback && node scripts/verify-package-hygiene.js && node scripts/test-fresh-install.js",
     "precheck:services": "node scripts/precheck-local-services.js",
     "test:model:governance": "npm run build && node scripts/test-model-governance-no-agent.js",
     "validate:no-go": "bash scripts/release/validate-no-go-gates.sh",
@@ -107,6 +108,7 @@
     "test:phase3:command-contract": "npm run build && node scripts/test-command-contract.mjs",
     "test:phase3:update-policy": "npm run build && node scripts/test-update-policy.mjs",
     "test:phase6:delivery": "npm run build && node scripts/test-release-delivery.mjs",
+    "test:banner": "node scripts/test-startup-banner.mjs",
     "architecture:graph": "node scripts/architecture/verify-import-graph.mjs"
   },
   "keywords": [

package/release-policy.json

@@ -11,11 +11,7 @@
     "manifest": "https://extension.vigthoria.io/downloads/manifest.json",
     "artifacts": "https://extension.vigthoria.io/downloads/",
     "allowedHosts": [
-      "extension.vigthoria.io",
-      "cli.vigthoria.io",
-      "coder.vigthoria.io",
-      "landing.vigthoria.io",
-      "market.vigthoria.io"
+      "extension.vigthoria.io"
     ],
     "port": 443,
     "maximumRedirects": 0