vigthoria-cli 1.13.8 → 1.13.10

package/dist/commands/index.js

@@ -18,6 +18,7 @@ import { RepoCommand } from './repo.js';
 import { ReviewCommand } from './review.js';
 import { WorkflowCommand } from './workflow.js';
 import { V4Command } from './v4.js';
+import { WalletCommand } from './wallet.js';
 function isRegisterableCommand(value) {
     return Boolean(value && typeof value === 'object');
 }
@@ -136,6 +137,10 @@ const commandRegistry = [
         name: 'history',
         handler: createClassRegistrar(HistoryCommand),
     },
+    {
+        name: 'wallet',
+        handler: createClassRegistrar(WalletCommand),
+    },
     {
         name: 'replay',
         handler: createClassRegistrar(ReplayCommand),

package/dist/commands/legion.js

@@ -144,7 +144,7 @@ export class LegionCommand {
             console.log(chalk.gray('  --repro-cmd <cmd>    Run a local reproducibility command before spend'));
             console.log(chalk.gray('  --expect-repro-fail  Require repro command to fail before execution'));
             console.log(chalk.gray('  --approve            Skip initial confirmation prompt and execute'));
-            console.log(chalk.gray('  --auto-charge        Attempt direct VigCoin top-up when balance is low'));
+            console.log(chalk.gray('  --auto-charge        Charge the canonical PAYG wallet when balance is sufficient'));
             console.log(chalk.gray('  --timeout <sec>      Abort remote execution if no result within timeout (default: 120)'));
             return;
         }
@@ -195,7 +195,7 @@ export class LegionCommand {
             if (!billingGate.canProceed) {
                 const resolved = await this.resolveBillingInsufficientFunds(currentQuote, billingGate, options);
                 if (!resolved) {
-                    console.log(chalk.yellow('Cortex cancelled due to insufficient VigCoin balance.'));
+                    console.log(chalk.yellow('Cortex cancelled due to insufficient PAYG credit balance.'));
                     return;
                 }
                 billingGate = await this.evaluateBillingGate(currentQuote);
@@ -301,7 +301,7 @@ export class LegionCommand {
             console.log(chalk.gray(`  Next round: ${nextRound}`));
             console.log(chalk.gray(`  Failed step: ${execution.failedStepId || 'unknown'} (${execution.failedWorker || 'unknown'})`));
             console.log(chalk.gray(`  Additional estimate: $${nextQuote.finalUsd.toFixed(4)} / ${nextQuote.vigcoinRequired.toFixed(3)} VIG`));
-            const answer = (await rl.question('Confirm additional VigCoin deduction and continue? (y/N): ')).trim().toLowerCase();
+            const answer = (await rl.question('Confirm additional PAYG credit deduction and continue? (y/N): ')).trim().toLowerCase();
             return answer === 'y' || answer === 'yes';
         }
         finally {
@@ -844,7 +844,7 @@ export class LegionCommand {
                 available: true,
                 vigcoinBalance: 0,
                 source: 'forced_low_credit',
-                purchaseUrl: `${baseUrl}/music/store#vigcoins`,
+                purchaseUrl: 'https://hub.vigthoria.io/credits',
             };
         }
         if (forcedBalanceRaw) {
@@ -854,7 +854,7 @@ export class LegionCommand {
                     available: true,
                     vigcoinBalance: forced,
                     source: 'forced_balance',
-                    purchaseUrl: `${baseUrl}/music/store#vigcoins`,
+                    purchaseUrl: 'https://hub.vigthoria.io/credits',
                 };
             }
         }
@@ -892,7 +892,7 @@ export class LegionCommand {
                     available: true,
                     vigcoinBalance: balance,
                     source: endpoint,
-                    purchaseUrl: this.getPurchaseUrlFromPayload(baseUrl, payloadObj) || `${baseUrl}/music/store#vigcoins`,
+                    purchaseUrl: this.getPurchaseUrlFromPayload(baseUrl, payloadObj) || 'https://hub.vigthoria.io/credits',
                 };
             }
             catch (err) {
@@ -904,7 +904,7 @@ export class LegionCommand {
             available: false,
             vigcoinBalance: null,
             source: null,
-            purchaseUrl: `${baseUrl}/music/store#vigcoins`,
+            purchaseUrl: 'https://hub.vigthoria.io/credits',
             error: sawUnauthorized
                 ? 'Wallet session expired or unauthorized. Run: vigthoria login'
                 : 'Wallet endpoint unavailable from current gateway session',
@@ -913,12 +913,10 @@ export class LegionCommand {
     async attemptDirectCharge(vigcoinNeeded) {
         const baseUrl = this.getBillingBaseUrl();
         const headers = this.getHeaders();
-        const amount = Math.max(1, Math.ceil(vigcoinNeeded));
+        const amount = Math.round(Math.max(0.01, vigcoinNeeded) * 1000000) / 1000000;
         const requestId = `cortex_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
         const chargePayloads = [
             { endpoint: '/api/viagen6/vigcoin/charge', body: { amount, reason: 'cortex_legion', requestId } },
-            { endpoint: '/api/wallet/charge', body: { amount, currency: 'VIGCOIN', reason: 'cortex_legion', requestId } },
-            { endpoint: '/api/billing/topup', body: { vigcoin: amount, reason: 'cortex_legion', requestId } },
         ];
         for (const attempt of chargePayloads) {
             try {
@@ -929,11 +927,11 @@ export class LegionCommand {
                     body: JSON.stringify(attempt.body),
                 });
                 const payload = await response.json().catch((err) => {
-                    this.logger.warn(this.formatLegionError(`direct VigCoin charge response ${attempt.endpoint}`, err));
+                    this.logger.warn(this.formatLegionError(`PAYG wallet charge response ${attempt.endpoint}`, err));
                     return {};
                 });
                 const payloadObj = (payload && typeof payload === 'object') ? payload : {};
-                const checkoutUrl = this.getPurchaseUrlFromPayload(baseUrl, payloadObj) || `${baseUrl}/music/store#vigcoins`;
+                const checkoutUrl = this.getPurchaseUrlFromPayload(baseUrl, payloadObj) || 'https://hub.vigthoria.io/credits';
                 if (!response.ok) {
                     continue;
                 }
@@ -948,13 +946,13 @@ export class LegionCommand {
                 };
             }
             catch (err) {
-                this.logger.warn(this.formatLegionError(`direct VigCoin charge request ${attempt.endpoint}`, err));
+                this.logger.warn(this.formatLegionError(`PAYG wallet charge request ${attempt.endpoint}`, err));
                 continue;
             }
         }
         return {
             ok: false,
-            checkoutUrl: `${baseUrl}/music/store#vigcoins`,
+            checkoutUrl: 'https://hub.vigthoria.io/credits',
             note: 'No direct charge endpoint accepted this request',
         };
     }
@@ -962,18 +960,19 @@ export class LegionCommand {
         if (gate.masterAdminFree) {
             return true;
         }
-        const spinner = createSpinner('Charging VigCoin wallet for Cortex execution...').start();
+        const spinner = createSpinner('Charging Vigthoria Credits for Cortex execution...').start();
         const result = await this.attemptDirectCharge(billingQuote.vigcoinRequired);
         spinner.stop();
         if (!result.ok) {
             console.log(chalk.red(result.note || 'Wallet charge failed.'));
-            console.log(chalk.yellow(`Complete purchase first: ${result.checkoutUrl || `${this.getBillingBaseUrl()}/music/store#vigcoins`}`));
+            console.log(chalk.yellow(`Complete purchase first: ${result.checkoutUrl || 'https://hub.vigthoria.io/credits'}`));
             return false;
         }
-        console.log(chalk.green('Wallet charged for Cortex execution.'));
+        console.log(chalk.green('PAYG wallet charged for Cortex execution.'));
         return true;
     }
     async resolveBillingInsufficientFunds(billingQuote, gate, options) {
+        void options;
         this.printBillingGateSummary(billingQuote, gate);
         if (!gate.wallet.available) {
             console.log(chalk.red('Unable to verify wallet balance from server. Execution is blocked.'));
@@ -982,20 +981,8 @@ export class LegionCommand {
             }
             return false;
         }
-        if (options.autoCharge) {
-            const spinner = createSpinner('Attempting direct wallet charge...').start();
-            const result = await this.attemptDirectCharge(billingQuote.vigcoinRequired - (gate.wallet.vigcoinBalance || 0));
-            spinner.stop();
-            if (result.ok) {
-                console.log(chalk.green('Direct charge succeeded. Re-checking wallet balance...'));
-                return true;
-            }
-            console.log(chalk.yellow(result.note || 'Direct charge did not complete.'));
-            console.log(chalk.yellow(`Complete purchase first: ${result.checkoutUrl || gate.wallet.purchaseUrl || `${this.getBillingBaseUrl()}/billing`}`));
-            return false;
-        }
         if (!process.stdin.isTTY || !process.stdout.isTTY) {
-            console.log(chalk.yellow('Low balance detected in non-interactive mode. Re-run with --auto-charge or top up first.'));
+            console.log(chalk.yellow('Low balance detected. Top up the PAYG wallet before retrying.'));
             if (gate.wallet.purchaseUrl) {
                 console.log(chalk.gray(`Billing portal: ${gate.wallet.purchaseUrl}`));
             }
@@ -1003,21 +990,9 @@ export class LegionCommand {
         }
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         try {
-            const answer = (await rl.question('VigCoin low. Choose action: [c]harge now, [p]urchase first, [n] cancel: ')).trim().toLowerCase();
-            if (answer === 'c' || answer === 'charge') {
-                const spinner = createSpinner('Attempting direct wallet charge...').start();
-                const result = await this.attemptDirectCharge(billingQuote.vigcoinRequired - (gate.wallet.vigcoinBalance || 0));
-                spinner.stop();
-                if (result.ok) {
-                    console.log(chalk.green('Direct charge succeeded. Re-checking wallet balance...'));
-                    return true;
-                }
-                console.log(chalk.yellow(result.note || 'Direct charge did not complete.'));
-                console.log(chalk.yellow(`Complete purchase first: ${result.checkoutUrl || gate.wallet.purchaseUrl || `${this.getBillingBaseUrl()}/billing`}`));
-                return false;
-            }
+            const answer = (await rl.question('PAYG credits low. Choose action: [p]urchase first, [n] cancel: ')).trim().toLowerCase();
             if (answer === 'p' || answer === 'purchase') {
-                console.log(chalk.yellow(`Purchase VigCoin first: ${gate.wallet.purchaseUrl || `${this.getBillingBaseUrl()}/billing`}`));
+                console.log(chalk.yellow(`Purchase Vigthoria Credits first: ${gate.wallet.purchaseUrl || 'https://hub.vigthoria.io/credits'}`));
                 return false;
             }
             return false;
@@ -1035,8 +1010,8 @@ export class LegionCommand {
         }
         console.log(chalk.gray(`    Estimated total (USD): $${billingQuote.retryAdjustedUsd.toFixed(4)}`) + chalk.gray(' (retry-adjusted expected)'));
         console.log(chalk.gray(`    Platform fee: +${billingQuote.platformFeePct.toFixed(0)}% (already included in all estimates)`));
-        console.log(chalk.gray(`    VigCoin rate: 1 VIG = $${billingQuote.vigcoinRateUsd.toFixed(4)}`));
-        console.log(chalk.gray(`    VigCoin required: ${billingQuote.vigcoinRequired.toFixed(3)}`));
+        console.log(chalk.gray(`    Credit rate: 1 credit = $${billingQuote.vigcoinRateUsd.toFixed(4)}`));
+        console.log(chalk.gray(`    Credits required: ${billingQuote.vigcoinRequired.toFixed(3)}`));
         if (gate.wallet.vigcoinBalance !== null) {
             const color = gate.wallet.vigcoinBalance >= billingQuote.vigcoinRequired ? chalk.green : chalk.red;
             console.log(chalk.gray('    Wallet balance: ') + color(gate.wallet.vigcoinBalance.toFixed(3)) + (gate.wallet.source ? chalk.gray(` (source: ${gate.wallet.source})`) : ''));

package/dist/commands/update.js

@@ -1,12 +1,22 @@
 import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
-import { installUpdateWindows } from '../utils/tools.js';
 // ESM shim — __filename is unavailable under "type": "module".
 const __filename = fileURLToPath(import.meta.url);
 const execFileAsync = promisify(execFile);
+const DEFAULT_UPDATE_MANIFEST = 'https://extension.vigthoria.io/downloads/manifest.json';
+const TRUSTED_RELEASE_HOSTS = new Set([
+    'extension.vigthoria.io',
+    'landing.vigthoria.io',
+    'cli.vigthoria.io',
+    'coder.vigthoria.io',
+    'market.vigthoria.io',
+]);
 function markSuccessExit() {
     process.exitCode = 0;
 }
@@ -99,6 +109,53 @@ async function getLatestVersion(packageName) {
         throw new Error(`Unable to check the latest published version: ${message}`);
     }
 }
+function validateTrustedHttpsUrl(value, label) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error(`${label} is not a valid URL`);
+    }
+    if (parsed.protocol !== 'https:' || !TRUSTED_RELEASE_HOSTS.has(parsed.hostname)) {
+        throw new Error(`${label} must use HTTPS on an approved Vigthoria release host`);
+    }
+    return parsed;
+}
+async function getStableRelease() {
+    const manifestUrl = process.env.VIGTHORIA_UPDATE_MANIFEST_URL
+        || DEFAULT_UPDATE_MANIFEST;
+    validateTrustedHttpsUrl(manifestUrl, 'Update manifest URL');
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 20_000);
+    try {
+        const response = await fetch(manifestUrl, {
+            headers: { Accept: 'application/json' },
+            redirect: 'follow',
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new Error(`manifest returned HTTP ${response.status}`);
+        }
+        validateTrustedHttpsUrl(response.url || manifestUrl, 'Resolved manifest URL');
+        const document = await response.json();
+        const stable = document.channels?.stable;
+        const version = String(stable?.version || '').trim();
+        const url = String(stable?.url || '').trim();
+        const sha256 = String(stable?.sha256 || '').trim().toLowerCase();
+        if (!/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(version)) {
+            throw new Error('stable manifest version is invalid');
+        }
+        validateTrustedHttpsUrl(url, 'Stable release URL');
+        if (!/^[a-f0-9]{64}$/.test(sha256)) {
+            throw new Error('stable release SHA-256 is missing or invalid');
+        }
+        return { version, url, sha256 };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 async function getVersionInfo() {
     const packageJson = readOwnPackageJson();
     const packageName = packageJson.name;
@@ -106,16 +163,28 @@ async function getVersionInfo() {
     if (!packageName || !current) {
         throw new Error('The CLI package metadata must include both name and version.');
     }
-    const latest = await getLatestVersion(packageName);
+    let release;
+    let latest;
+    try {
+        release = await getStableRelease();
+        latest = release.version;
+    }
+    catch (manifestError) {
+        const reason = manifestError instanceof Error
+            ? manifestError.message
+            : String(manifestError);
+        console.warn(`Verified release manifest unavailable (${reason}); checking npm.`);
+        latest = await getLatestVersion(packageName);
+    }
     return {
         current,
         latest,
         packageName,
         updateAvailable: compareVersions(current, latest) < 0,
+        release,
     };
 }
-function resolveInstallCommand(packageManager, packageName, installGlobal) {
-    const target = `${packageName}@latest`;
+function resolveInstallTargetCommand(packageManager, target, installGlobal) {
     switch (packageManager) {
         case 'pnpm':
             return { command: 'pnpm', args: installGlobal ? ['add', '--global', target] : ['add', '-D', target] };
@@ -128,6 +197,9 @@ function resolveInstallCommand(packageManager, packageName, installGlobal) {
             return { command: 'npm', args: installGlobal ? ['install', '--global', target] : ['install', '--save-dev', target] };
     }
 }
+function resolveInstallCommand(packageManager, packageName, installGlobal) {
+    return resolveInstallTargetCommand(packageManager, `${packageName}@latest`, installGlobal);
+}
 function formatCommand(command) {
     return [command.command, ...command.args].map(quoteCmdArg).join(' ');
 }
@@ -135,6 +207,39 @@ async function runInstall(packageManager, packageName, installGlobal) {
     const installCommand = resolveInstallCommand(packageManager, packageName, installGlobal);
     await execPackageManager(installCommand.command, installCommand.args, 120_000);
 }
+async function downloadVerifiedRelease(release) {
+    const directory = await mkdtemp(path.join(tmpdir(), 'vigthoria-cli-update-'));
+    const archive = path.join(directory, `vigthoria-cli-${release.version}.tgz`);
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 60_000);
+        let response;
+        try {
+            response = await fetch(release.url, {
+                redirect: 'follow',
+                signal: controller.signal,
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        if (!response.ok) {
+            throw new Error(`release download returned HTTP ${response.status}`);
+        }
+        validateTrustedHttpsUrl(response.url || release.url, 'Resolved release URL');
+        const bytes = Buffer.from(await response.arrayBuffer());
+        const digest = createHash('sha256').update(bytes).digest('hex');
+        if (digest !== release.sha256) {
+            throw new Error(`release checksum mismatch (expected ${release.sha256}, received ${digest})`);
+        }
+        await writeFile(archive, bytes, { mode: 0o600 });
+        return { directory, archive };
+    }
+    catch (error) {
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+}
 export async function updateCommand(options = {}) {
     try {
         const info = await getVersionInfo();
@@ -152,26 +257,21 @@ export async function updateCommand(options = {}) {
         }
         const packageManager = options.packageManager ?? 'npm';
         const installGlobal = options.global ?? true;
-        console.log(`Installing ${info.packageName}@latest with ${packageManager}...`);
-        if (process.platform === 'win32') {
-            const installerResult = await installUpdateWindows();
-            if (!installerResult.success && installerResult.error === 'ENOENT') {
-                const fallbackCommand = resolveInstallCommand(packageManager, info.packageName, installGlobal);
-                console.warn('Windows update installer was not found (ENOENT).');
-                console.warn('The bundled Windows installer may be missing from this installation.');
-                console.warn(`Manual installation command: ${formatCommand(fallbackCommand)}`);
-                console.warn('If automatic fallback fails, run the command above manually or download the latest Windows installer from the Vigthoria release page.');
-                await execPackageManager(fallbackCommand.command, fallbackCommand.args, 120_000);
-                console.log('Package manager installation finished successfully.');
-            }
-            else if (!installerResult.success) {
-                throw new Error(installerResult.error || 'Windows installer failed to start.');
+        if (info.release) {
+            console.log(`Installing checksum-verified ${info.packageName}@${info.release.version} `
+                + `with ${packageManager}...`);
+            const downloaded = await downloadVerifiedRelease(info.release);
+            try {
+                const installCommand = resolveInstallTargetCommand(packageManager, downloaded.archive, installGlobal);
+                await execPackageManager(installCommand.command, installCommand.args, 120_000);
             }
-            else {
-                console.log('Windows installer started successfully. Complete the installer prompts to finish updating.');
+            finally {
+                await rm(downloaded.directory, { recursive: true, force: true });
             }
+            console.log('Verified release installation finished successfully.');
         }
         else {
+            console.log(`Installing ${info.packageName}@latest with ${packageManager}...`);
             await runInstall(packageManager, info.packageName, installGlobal);
             console.log('Package manager installation finished successfully.');
         }

package/dist/commands/wallet.d.ts

@@ -5,6 +5,7 @@
  *   vigthoria wallet history [--n 20] — recent transactions
  *   vigthoria wallet cloud-status     — show cloud access and model pricing
  */
+import type { Command } from 'commander';
 export interface WalletOptions {
     n?: number;
     json?: boolean;
@@ -13,6 +14,7 @@ export declare class WalletCommand {
     private config;
     private logger;
     constructor();
+    register(program: Command): void;
     private getBaseUrl;
     private getToken;
     private getRefreshToken;

package/dist/commands/wallet.js

@@ -15,6 +15,31 @@ export class WalletCommand {
         this.config = new Config();
         this.logger = new Logger();
     }
+    register(program) {
+        const wallet = program
+            .command('wallet')
+            .description('Inspect monetary Vigthoria Credits used for Cloud, API, Video, and other PAYG services');
+        wallet
+            .command('balance')
+            .description('Show purchased and paid-subscription credit balances')
+            .option('--json', 'Emit machine-readable JSON output', false)
+            .action(async (options) => this.showBalance(options));
+        wallet
+            .command('history')
+            .description('Show monetary wallet transactions')
+            .option('-n, --n <count>', 'Maximum transactions to show', '20')
+            .option('--json', 'Emit machine-readable JSON output', false)
+            .action(async (options) => this.showHistory({
+            n: Number(options.n || 20),
+            json: options.json,
+        }));
+        wallet
+            .command('cloud-status')
+            .description('Show PAYG cloud eligibility and model pricing')
+            .option('--json', 'Emit machine-readable JSON output', false)
+            .action(async (options) => this.showCloudStatus(options));
+        wallet.action(async () => this.showBalance());
+    }
     getBaseUrl() {
         return String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
     }
@@ -99,16 +124,21 @@ export class WalletCommand {
                 return;
             }
             console.log('');
-            console.log(chalk.bold.cyan('  VigCoin Wallet'));
+            console.log(chalk.bold.cyan('  Vigthoria PAYG Wallet'));
             console.log(chalk.gray('  ─────────────────────────────'));
-            console.log(`  Balance:         ${chalk.bold.yellow(data.balance.toLocaleString())} ⓥ`);
-            console.log(`  Lifetime earned: ${chalk.green(data.lifetimeEarned.toLocaleString())} ⓥ`);
-            console.log(`  Lifetime spent:  ${chalk.red(data.lifetimeSpent.toLocaleString())} ⓥ`);
+            console.log(`  PAYG balance:          ${chalk.bold.yellow(data.balance.toLocaleString())} credits`);
+            const purchased = Number(data.purchasedBalance || 0);
+            const subscription = Number(data.subscriptionBalance || 0);
+            console.log(`  Purchased:             ${chalk.green(purchased.toLocaleString())} credits`);
+            console.log(`  Paid subscription:     ${chalk.cyan(subscription.toLocaleString())} credits`);
+            console.log(`  Lifetime funded:       ${chalk.green(data.lifetimeEarned.toLocaleString())} credits`);
+            console.log(`  Lifetime PAYG spend:   ${chalk.red(data.lifetimeSpent.toLocaleString())} credits`);
             if (data.lastUpdated) {
                 console.log(`  Last updated:    ${chalk.gray(new Date(data.lastUpdated).toLocaleString())}`);
             }
             console.log('');
-            console.log(chalk.gray('  Top up at: https://hub.vigthoria.io/credits'));
+            console.log(chalk.gray('  Music Points and other promotional rewards are product-only and are not included.'));
+            console.log(chalk.gray('  Top up monetary credits at: https://hub.vigthoria.io/credits'));
             console.log('');
         }
         catch (err) {

package/dist/index.js

@@ -20,7 +20,7 @@ import { ChatCommand } from './commands/chat.js';
 import { EditCommand } from './commands/edit.js';
 import { GenerateCommand } from './commands/generate.js';
 import { ExplainCommand } from './commands/explain.js';
-import { handleLogin, handleLogout, statusAction } from './commands/auth.js';
+import { handleLogin, handleLogout, registerAuthCommands, statusAction } from './commands/auth.js';
 import { ConfigCommand } from './commands/config.js';
 import { ReviewCommand } from './commands/review.js';
 import { HubCommand } from './commands/hub.js';
@@ -39,6 +39,7 @@ import { ForkCommand } from './commands/fork.js';
 import { CancelCommand } from './commands/cancel.js';
 import { BackgroundCommand } from './commands/background.js';
 import { SecurityCommand } from './commands/security.js';
+import { WalletCommand } from './commands/wallet.js';
 import { V4Command } from './commands/v4.js';
 import { runV4Menu } from './commands/v4-menu.js';
 import { Config } from './utils/config.js';
@@ -51,6 +52,7 @@ import { fileURLToPath } from 'url';
 import { createHash } from 'crypto';
 import axios from 'axios';
 import { renderDynamicHelp, selectInteractiveCommand } from './utils/command-menu.js';
+import { isIOSEnvironment, resolveClientOsSlug } from './utils/clientManifest.js';
 // ESM shim — TypeScript emits ESM under "type": "module", so __dirname
 // is not available natively.  Restore the CommonJS-style helper so the
 // pre-existing package-discovery logic continues to work unchanged.
@@ -285,6 +287,23 @@ async function downloadFile(url, targetPath) {
     });
     fs.writeFileSync(targetPath, Buffer.from(response.data));
 }
+const TRUSTED_RELEASE_HOSTS = new Set([
+    'extension.vigthoria.io',
+    'landing.vigthoria.io',
+    'coder.vigthoria.io',
+    'market.vigthoria.io',
+]);
+function validateReleaseUrl(rawUrl, allowLocalhost = false) {
+    const parsed = new URL(rawUrl);
+    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '::1';
+    if (parsed.protocol !== 'https:' && !(allowLocalhost && local && parsed.protocol === 'http:')) {
+        throw new Error('Release URLs must use HTTPS (HTTP is allowed only for an explicit localhost manifest).');
+    }
+    if (!TRUSTED_RELEASE_HOSTS.has(parsed.hostname) && !(allowLocalhost && local)) {
+        throw new Error(`Untrusted release host: ${parsed.hostname}`);
+    }
+    return parsed;
+}
 function sha256File(filePath) {
     const hash = createHash('sha256');
     const data = fs.readFileSync(filePath);
@@ -1459,7 +1478,7 @@ Examples:
         .option('--cortex', 'Vigthoria Cortex: maximum intelligence execution')
         .option('--approve', 'Auto-approve Cortex execution prompt')
         .option('--no-approve', 'Require interactive approval before execution')
-        .option('--auto-charge', 'Attempt direct VigCoin top-up when Cortex balance is low')
+        .option('--auto-charge', 'Compatibility flag; low balances still require a verified User Hub top-up')
         .option('--plan-only', 'Run Cortex estimator only; do not execute Legion job')
         .option('--force-budget', 'Allow execution when estimated budget exceeds the hard safe-stop ceiling')
         .option('--ignore-preflight', 'Bypass mandatory local preflight checks (no warranty)')
@@ -1558,6 +1577,8 @@ Examples:
         .action(async () => {
         await statusAction();
     });
+    registerAuthCommands(program);
+    new WalletCommand().register(program);
     program
         .command('doctor')
         .description('Run local Vigthoria CLI diagnostics (no network calls unless --check-api)')
@@ -1569,10 +1590,23 @@ Examples:
         const offline = isOfflineMode();
         const updateSuppressed = isUpdateCheckSuppressed();
         const subscription = config.get('subscription') || { plan: null, status: null, expiresAt: null };
+        const iosSandbox = isIOSEnvironment();
+        const platformSupport = iosSandbox
+            ? 'experimental-mobile-terminal-sandbox'
+            : process.platform === 'darwin'
+                ? 'supported-macos-desktop'
+                : process.platform === 'win32' || process.platform === 'linux'
+                    ? 'supported-desktop'
+                    : 'unsupported';
         const report = {
             cliVersion: VERSION,
             nodeVersion: process.version,
             platform: `${process.platform} ${process.arch}`,
+            clientOs: resolveClientOsSlug(),
+            platformSupport,
+            platformLimitations: iosSandbox
+                ? 'Not a native iOS app. Requires an iSH-like Linux terminal with Node.js >=20.19, npm and filesystem access; Workbench and device tooling are unavailable.'
+                : null,
             cwd: process.cwd(),
             homeDir: os.homedir(),
             configPath: config.getConfigPath(),
@@ -1693,6 +1727,9 @@ Examples:
         let manifestEntry = null;
         if (manifestUrl) {
             try {
+                const explicitLocalManifest = Boolean(options.manifest)
+                    && ['localhost', '127.0.0.1', '::1'].includes(new URL(manifestUrl).hostname);
+                validateReleaseUrl(manifestUrl, explicitLocalManifest);
                 console.log(chalk.cyan(`Checking manifest channel ${channel}...`));
                 const response = await axios.get(manifestUrl, {
                     timeout: 10000,
@@ -1704,6 +1741,13 @@ Examples:
                     console.log(chalk.yellow(`Manifest has no installable entry for channel ${channel}; will check npm.`));
                     manifestEntry = null;
                 }
+                else {
+                    validateReleaseUrl(manifestEntry.url, explicitLocalManifest);
+                    if (!/^[a-f0-9]{64}$/i.test(String(manifestEntry.sha256 || ''))) {
+                        console.log(chalk.yellow('Manifest entry has no valid SHA-256 checksum; refusing it and checking npm.'));
+                        manifestEntry = null;
+                    }
+                }
             }
             catch (error) {
                 console.log(chalk.yellow(`Manifest check failed: ${error.message}`));
@@ -1755,22 +1799,16 @@ Examples:
             try {
                 console.log(chalk.cyan(`Downloading release package (${manifestEntry.version})...`));
                 await downloadFile(manifestEntry.url, tmpFile);
-                if (manifestEntry.sha256) {
-                    const expected = manifestEntry.sha256.toLowerCase();
-                    const actual = sha256File(tmpFile).toLowerCase();
-                    if (actual !== expected) {
-                        console.error(chalk.red('Release checksum verification failed'));
-                        console.error(chalk.red(`Expected: ${expected}`));
-                        console.error(chalk.red(`Actual:   ${actual}`));
-                        process.exitCode = 1;
-                        return;
-                    }
-                    console.log(chalk.green('Checksum verification passed'));
-                }
-                else {
-                    console.log(chalk.yellow.bold('WARNING: manifest entry has no sha256.'));
-                    console.log(chalk.yellow('   The release artifact will be installed without integrity verification.'));
+                const expected = String(manifestEntry.sha256).toLowerCase();
+                const actual = sha256File(tmpFile).toLowerCase();
+                if (actual !== expected) {
+                    console.error(chalk.red('Release checksum verification failed'));
+                    console.error(chalk.red(`Expected: ${expected}`));
+                    console.error(chalk.red(`Actual:   ${actual}`));
+                    process.exitCode = 1;
+                    return;
                 }
+                console.log(chalk.green('Checksum verification passed'));
                 console.log(chalk.cyan('Installing update...'));
                 await installGlobalPackageWithNpm(tmpFile);
                 console.log(chalk.green(`Updated to version ${manifestEntry.version}`));
@@ -1864,30 +1902,6 @@ Examples:
         .action(() => {
         console.log(renderDynamicHelp(program));
     });
-    const codingCommandDefinitions = [
-        { name: 'edit', description: 'Edit code by describing the desired change', instruction: 'Edit the project according to this request' },
-        { name: 'generate', description: 'Generate code from a prompt', instruction: 'Generate code for this request' },
-        { name: 'explain', description: 'Explain code, errors, or project behavior', instruction: 'Explain this request clearly and practically' },
-        { name: 'review', description: 'Review code and suggest concrete improvements', instruction: 'Review the project or code for this request' },
-        { name: 'fix', description: 'Fix bugs, build failures, or test failures', instruction: 'Fix this issue in the project' },
-    ];
-    for (const commandDefinition of codingCommandDefinitions) {
-        program
-            .command(commandDefinition.name)
-            .description(commandDefinition.description)
-            .argument('[request...]', 'Request text for the coding assistant')
-            .option('-m, --model <model>', 'Model to use', 'code')
-            .option('-p, --project <path>', 'Project directory', process.cwd())
-            .action(async (requestParts = [], options) => {
-            const requestText = requestParts.join(' ').trim();
-            const chat = new ChatCommand(config, logger, program);
-            await chat.run({
-                model: options.model || 'code',
-                project: options.project || process.cwd(),
-                prompt: requestText ? `${commandDefinition.instruction}: ${requestText}` : commandDefinition.instruction,
-            });
-        });
-    }
     try {
         // Default to chat if no command
         if (args.length === 2) {

package/install.ps1

@@ -5,7 +5,7 @@
 $ErrorActionPreference = "Stop"
 
 # Configuration
-$CLI_VERSION = "1.13.8"
+$CLI_VERSION = "1.13.10"
 $INSTALL_DIR = "$env:USERPROFILE\.vigthoria"
 $NPM_PACKAGE = "vigthoria-cli"
 $GIT_PACKAGE_URL = "git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"

package/install.sh

@@ -26,12 +26,13 @@ else
 fi
 
 # Configuration
-CLI_VERSION="1.13.8"
+CLI_VERSION="1.13.10"
 INSTALL_DIR="$HOME/.vigthoria"
 REPO_URL="https://market.vigthoria.io/vigthoria/vigthoria-cli"
 GIT_PACKAGE_URL="git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"
 MANIFEST_URL="${VIGTHORIA_UPDATE_MANIFEST_URL:-https://extension.vigthoria.io/downloads/manifest.json}"
 HOSTED_TARBALL_URL="https://extension.vigthoria.io/downloads/vigthoria-cli-${CLI_VERSION}.tgz"
+HOSTED_TARBALL_SHA256=""
 
 resolve_release_manifest() {
     if ! command -v curl >/dev/null 2>&1 || ! command -v python3 >/dev/null 2>&1; then
@@ -52,24 +53,34 @@ try:
     stable = (data.get('channels') or {}).get('stable') or {}
     version = str(stable.get('version') or '').strip()
     url = str(stable.get('url') or '').strip()
+    sha256 = str(stable.get('sha256') or '').strip().lower()
     if version:
         print(version)
     if url:
         print(url)
+    if sha256:
+        print(sha256)
 except Exception:
     pass
 " 2>/dev/null || true)"
 
     if [[ -n "$resolved" ]]; then
-        mapfile -t _manifest_lines <<< "$resolved"
-        if [[ -n "${_manifest_lines[0]:-}" ]]; then
-            CLI_VERSION="${_manifest_lines[0]}"
+        # macOS ships Bash 3.2, which does not provide mapfile/readarray.
+        # Parse the two-line response with POSIX sed instead.
+        manifest_version="$(printf '%s\n' "$resolved" | sed -n '1p')"
+        manifest_url="$(printf '%s\n' "$resolved" | sed -n '2p')"
+        manifest_sha256="$(printf '%s\n' "$resolved" | sed -n '3p')"
+        if [[ -n "$manifest_version" ]]; then
+            CLI_VERSION="$manifest_version"
         fi
-        if [[ -n "${_manifest_lines[1]:-}" ]]; then
-            HOSTED_TARBALL_URL="${_manifest_lines[1]}"
-        elif [[ -n "${_manifest_lines[0]:-}" ]]; then
+        if [[ -n "$manifest_url" ]]; then
+            HOSTED_TARBALL_URL="$manifest_url"
+        elif [[ -n "$manifest_version" ]]; then
             HOSTED_TARBALL_URL="https://extension.vigthoria.io/downloads/vigthoria-cli-${CLI_VERSION}.tgz"
         fi
+        if [[ "$manifest_sha256" =~ ^[a-f0-9]{64}$ ]]; then
+            HOSTED_TARBALL_SHA256="$manifest_sha256"
+        fi
     fi
 }
 
@@ -177,10 +188,32 @@ install_cli() {
     # Create install directory
     mkdir -p "$INSTALL_DIR"
     
-    # Option 1: Install the hosted release package.
-    if curl -fsI "$HOSTED_TARBALL_URL" > /dev/null 2>&1; then
-        echo "Installing hosted release package..."
-        npm install -g --force "$HOSTED_TARBALL_URL"
+    # Option 1: Download and verify the exact hosted release package.
+    if [[ -n "$HOSTED_TARBALL_SHA256" ]]; then
+        echo "Downloading checksum-verified hosted release package..."
+        RELEASE_TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/vigthoria-cli-install.XXXXXX")"
+        RELEASE_ARCHIVE="$RELEASE_TMP_DIR/vigthoria-cli-${CLI_VERSION}.tgz"
+        if ! curl -fsSL "$HOSTED_TARBALL_URL" -o "$RELEASE_ARCHIVE"; then
+            rm -rf "$RELEASE_TMP_DIR"
+            echo -e "${RED}✗ Failed to download verified release package${NC}"
+            exit 1
+        fi
+        if command -v shasum >/dev/null 2>&1; then
+            ACTUAL_SHA256="$(shasum -a 256 "$RELEASE_ARCHIVE" | awk '{print $1}')"
+        elif command -v sha256sum >/dev/null 2>&1; then
+            ACTUAL_SHA256="$(sha256sum "$RELEASE_ARCHIVE" | awk '{print $1}')"
+        else
+            rm -rf "$RELEASE_TMP_DIR"
+            echo -e "${RED}✗ SHA-256 verification tool is unavailable${NC}"
+            exit 1
+        fi
+        if [[ "$ACTUAL_SHA256" != "$HOSTED_TARBALL_SHA256" ]]; then
+            rm -rf "$RELEASE_TMP_DIR"
+            echo -e "${RED}✗ Release checksum verification failed${NC}"
+            exit 1
+        fi
+        npm install -g --force "$RELEASE_ARCHIVE"
+        rm -rf "$RELEASE_TMP_DIR"
     elif npm view vigthoria-cli version &> /dev/null; then
         echo "Installing from npm registry..."
         npm install -g --force vigthoria-cli

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.13.8",
+  "version": "1.13.10",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",