vigthoria-cli 1.6.20 → 1.6.22

package/dist/utils/api.d.ts

@@ -217,6 +217,13 @@ export declare class APIClient {
     private getVigFlowAccessToken;
     private getVigFlowHeaders;
     private withVigFlow;
+    /**
+     * Build the correct sub-path for VigFlow endpoints.
+     * Local servers (e.g. localhost:5060) need `/api/…` prefix.
+     * The remote gateway URL already ends with `/api/vigflow`, so appending
+     * another `/api/…` would double the prefix and cause 404s.
+     */
+    private vigFlowEndpoint;
     listVigFlowTemplates(options?: {
         category?: string;
         search?: string;
@@ -339,6 +346,11 @@ export declare class APIClient {
         }[];
         suggestions: string[];
     }>;
+    /**
+     * Lightweight client-side heuristic scan: catches common code smells
+     * AND logic/arithmetic bugs so review never returns "score 30, no issues".
+     */
+    private heuristicCodeIssues;
     fixCode(code: string, language: string, fixType: string): Promise<{
         fixed: string;
         changes: {

package/dist/utils/api.js

@@ -307,13 +307,19 @@ class APIClient {
     }
     getVigFlowBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
+        // Put the remote gateway first, since local VigFlow servers are
+        // rarely running for end-user CLI installations. This avoids
+        // wasting connection-attempt time on 127.0.0.1 and hitting the
+        // remote gateway only after the local attempts have already
+        // errored — which surfaces as a confusing "last error" 404 in
+        // some setups.
         const urls = [
             process.env.VIGTHORIA_VIGFLOW_URL,
             process.env.VIGFLOW_URL,
             process.env.WORKFLOW_BUILDER_URL,
+            `${configuredApiUrl}/api/vigflow`,
             'http://127.0.0.1:5060',
             'http://127.0.0.1:5050',
-            `${configuredApiUrl}/api/vigflow`,
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -793,6 +799,19 @@ class APIClient {
         }
         throw lastError || new Error(`No VigFlow backend available for ${operation}.`);
     }
+    /**
+     * Build the correct sub-path for VigFlow endpoints.
+     * Local servers (e.g. localhost:5060) need `/api/…` prefix.
+     * The remote gateway URL already ends with `/api/vigflow`, so appending
+     * another `/api/…` would double the prefix and cause 404s.
+     */
+    vigFlowEndpoint(baseUrl, subPath) {
+        if (/\/api\/vigflow\/?$/i.test(baseUrl)) {
+            // Remote gateway – subPath like '/templates' is enough
+            return `${baseUrl.replace(/\/$/, '')}${subPath}`;
+        }
+        return `${baseUrl}/api${subPath}`;
+    }
     async listVigFlowTemplates(options = {}) {
         return this.withVigFlow('list templates', async (baseUrl, headers) => {
             const query = new URLSearchParams();
@@ -802,7 +821,7 @@ class APIClient {
             if (options.search) {
                 query.set('search', options.search);
             }
-            const url = `${baseUrl}/api/templates${query.size > 0 ? `?${query.toString()}` : ''}`;
+            const url = `${this.vigFlowEndpoint(baseUrl, '/templates')}${query.size > 0 ? `?${query.toString()}` : ''}`;
             const response = await axios_1.default.get(url, {
                 headers,
                 timeout: 30000,
@@ -813,7 +832,7 @@ class APIClient {
     }
     async listVigFlowWorkflows() {
         return this.withVigFlow('list workflows', async (baseUrl, headers) => {
-            const response = await axios_1.default.get(`${baseUrl}/api/workflows`, {
+            const response = await axios_1.default.get(this.vigFlowEndpoint(baseUrl, '/workflows'), {
                 headers,
                 timeout: 30000,
             });
@@ -865,7 +884,7 @@ class APIClient {
     }
     async useVigFlowTemplate(templateId, options = {}) {
         return this.withVigFlow('use template', async (baseUrl, headers) => {
-            const response = await axios_1.default.post(`${baseUrl}/api/templates/${encodeURIComponent(templateId)}/use`, {
+            const response = await axios_1.default.post(`${this.vigFlowEndpoint(baseUrl, `/templates/${encodeURIComponent(templateId)}/use`)}`, {
                 name: options.name,
                 variables: options.variables || {},
             }, {
@@ -881,7 +900,7 @@ class APIClient {
     }
     async runVigFlowWorkflow(workflowId, options = {}) {
         return this.withVigFlow('run workflow', async (baseUrl, headers) => {
-            const response = await axios_1.default.post(`${baseUrl}/api/executions/run/${encodeURIComponent(workflowId)}`, {
+            const response = await axios_1.default.post(`${this.vigFlowEndpoint(baseUrl, `/executions/run/${encodeURIComponent(workflowId)}`)}`, {
                 data: options.data || {},
                 options: options.executionOptions || {},
             }, {
@@ -897,7 +916,7 @@ class APIClient {
     }
     async getVigFlowExecutionStatus(executionId) {
         return this.withVigFlow('execution status', async (baseUrl, headers) => {
-            const response = await axios_1.default.get(`${baseUrl}/api/executions/${encodeURIComponent(executionId)}`, {
+            const response = await axios_1.default.get(`${this.vigFlowEndpoint(baseUrl, `/executions/${encodeURIComponent(executionId)}`)}`, {
                 headers,
                 timeout: 30000,
             });
@@ -918,6 +937,11 @@ class APIClient {
         const localWorkspaceSummary = this.buildLocalWorkspaceSummary(localWorkspacePath);
         const requestedModel = String(resolvedContext.model || resolvedContext.requestedModel || 'agent');
         const resolvedModel = this.resolvePermittedModelId(requestedModel);
+        // When the server cannot directly access the workspace (e.g. Windows
+        // client), use the local path as a hint and flag that the workspace
+        // files are provided inline in localWorkspaceSummary.workspaceFiles.
+        const effectiveWorkspacePath = serverWorkspacePath || localWorkspacePath || null;
+        const needsHydration = !serverWorkspacePath && !!localWorkspacePath;
         const payload = {
             workspace: resolvedContext.workspace || null,
             activeFile: resolvedContext.activeFile || null,
@@ -931,12 +955,16 @@ class APIClient {
             executionSurface: resolvedContext.executionSurface || 'cli',
             clientSurface: resolvedContext.clientSurface || 'cli',
             localMachineCapable: resolvedContext.localMachineCapable !== false,
-            workspacePath: serverWorkspacePath || null,
-            projectPath: serverWorkspacePath || null,
-            targetPath: serverWorkspacePath || null,
+            workspacePath: effectiveWorkspacePath,
+            projectPath: effectiveWorkspacePath,
+            targetPath: effectiveWorkspacePath,
             localWorkspacePath: localWorkspacePath || null,
             localWorkspaceName: localWorkspacePath ? path_1.default.basename(localWorkspacePath) : null,
             localWorkspaceSummary,
+            // Signal to the server that the workspace filesystem is not locally
+            // accessible — it must hydrate a temp directory from the provided
+            // workspaceFiles before the agent starts using tools.
+            workspaceHydrationRequired: needsHydration,
             contextId: resolvedContext.contextId,
             traceId: resolvedContext.traceId,
             mcpContextId: resolvedContext.mcpContextId || null,
@@ -2302,11 +2330,11 @@ document.addEventListener('DOMContentLoaded', () => {
             return result.message;
         }
         if (Array.isArray(data?.events)) {
-            const completionEvent = [...data.events].reverse().find((event) => event && event.type === 'complete' && typeof event.summary === 'string');
+            const completionEvent = [...data.events].reverse().find((event) => event && event.type === 'complete' && typeof event.summary === 'string' && event.summary.trim());
             if (completionEvent) {
                 return completionEvent.summary;
             }
-            const messageEvent = [...data.events].reverse().find((event) => event && event.type === 'message' && typeof event.content === 'string');
+            const messageEvent = [...data.events].reverse().find((event) => event && event.type === 'message' && typeof event.content === 'string' && event.content.trim());
             if (messageEvent) {
                 return messageEvent.content;
             }
@@ -2333,7 +2361,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const toolResults = [];
         const filesRead = [];
         const filesWritten = [];
-        let lastAssistantText = '';
+        const assistantFragments = [];
         for (const event of events) {
             if (!event)
                 continue;
@@ -2352,16 +2380,22 @@ document.addEventListener('DOMContentLoaded', () => {
                 }
             }
             if (event.type === 'assistant' && typeof event.content === 'string' && event.content.trim()) {
-                lastAssistantText = event.content.trim();
+                assistantFragments.push(event.content.trim());
             }
             // Some servers emit 'text' events for incremental assistant text
             if (event.type === 'text' && typeof event.content === 'string' && event.content.trim()) {
-                lastAssistantText = event.content.trim();
+                assistantFragments.push(event.content.trim());
+            }
+            // Some servers emit content_block_delta for streamed text
+            if (event.type === 'content_block_delta' && typeof event.delta?.text === 'string' && event.delta.text.trim()) {
+                assistantFragments.push(event.delta.text.trim());
             }
         }
-        // Prefer the last assistant text the model emitted
-        if (lastAssistantText.length > 20) {
-            return lastAssistantText;
+        // Concatenate ALL assistant text fragments in order — keeps full
+        // multi-turn reasoning instead of only the last fragment.
+        const fullAssistantText = assistantFragments.join('\n\n').trim();
+        if (fullAssistantText.length > 20) {
+            return fullAssistantText;
         }
         // Otherwise build a summary from tool evidence
         const sections = [];
@@ -2722,6 +2756,13 @@ document.addEventListener('DOMContentLoaded', () => {
         throw new Error(errors.join(' | '));
     }
     formatOperatorResponse(data = {}) {
+        // If the server returned a direct answer field, prefer it (for lookup tasks)
+        if (typeof data.answer === 'string' && data.answer.trim()) {
+            return data.answer.trim();
+        }
+        if (typeof data.result === 'string' && data.result.trim()) {
+            return data.result.trim();
+        }
         const lines = [];
         if (data.summary) {
             lines.push(String(data.summary).trim());
@@ -3200,13 +3241,19 @@ document.addEventListener('DOMContentLoaded', () => {
         // Prepend a forceful scope-enforcement instruction so the model
         // doesn't expand a small task into an oversized glossy page.
         const scopedPrompt = [
-            'IMPORTANT — SCOPE CONSTRAINTS:',
-            '1. Follow the user\'s scope literally. Output ONLY what was requested.',
-            '2. If the user says "tiny", "small", "simple", or "minimal", produce ≤ 50 lines of code.',
-            '3. Do NOT add: hero sections, animations, gradients, Google Fonts, Font Awesome, responsive breakpoints, or landing-page patterns UNLESS the user explicitly requests them.',
-            '4. Do NOT add external CDN links or dependencies unless the user asks for them.',
-            '5. Prefer inline styles or a small <style> block.  No large CSS frameworks.',
-            '6. Return raw code only — no markdown fences, no explanations.',
+            'IMPORTANT — MANDATORY SCOPE CONSTRAINTS (violation = failure):',
+            '1. Output ONLY what the user explicitly asked for. Nothing more.',
+            '2. If the prompt is ≤ 15 words, produce ≤ 80 lines of code maximum.',
+            '3. If the user says "tiny", "small", "simple", "minimal", or "basic", produce ≤ 50 lines.',
+            '4. NEVER add any of these unless the user EXPLICITLY requests them:',
+            '   - Hero sections, CTAs, testimonials, pricing tables, footers, navbars',
+            '   - CSS animations, gradients, neon effects, glass-morphism, particles',
+            '   - Google Fonts, Font Awesome, external CDN links, icon libraries',
+            '   - Responsive breakpoints, media queries (unless asked)',
+            '   - Multiple pages or components when one was requested',
+            '5. Prefer inline styles or a small <style> block. No CSS frameworks.',
+            '6. Return raw code only — no markdown fences, no explanations, no comments about what could be added.',
+            '7. Match the complexity of the request: a "hello world" is 1-5 lines, a "button" is 5-15 lines.',
             '',
             prompt,
         ].join('\n');
@@ -3243,22 +3290,109 @@ document.addEventListener('DOMContentLoaded', () => {
         const response = await this.client.post('/api/ai/review', {
             code,
             language,
+            instructions: [
+                'Return concrete, line-specific issues with severity.',
+                'Every issue MUST reference a line number.',
+                'If the score is below 50, you MUST list at least 2 specific issues.',
+                'Prioritize REAL BUGS over style issues:',
+                '- Wrong arithmetic operators (+ instead of -, * instead of /, etc.)',
+                '- Logic errors (function named "add" using subtraction, wrong comparisons)',
+                '- Off-by-one errors, incorrect return values',
+                '- Type mismatches, null/undefined access',
+                'Only report style issues (console.log, naming) AFTER listing all real bugs.',
+            ].join(' '),
         });
         const raw = response.data ?? {};
         const score = typeof raw.score === 'number' ? raw.score : 0;
         const issues = Array.isArray(raw.issues) ? raw.issues : [];
         const suggestions = Array.isArray(raw.suggestions) ? raw.suggestions : [];
-        // Prevent contradictory output: low score but zero issues
+        // Always run client-side heuristics and merge any findings the
+        // server missed.  This ensures arithmetic/logic bugs are surfaced
+        // even when the server only reports style issues like console.log.
+        const heuristic = this.heuristicCodeIssues(code, language);
+        for (const h of heuristic) {
+            // Avoid duplicating issues the server already reported on the same line
+            const isDuplicate = issues.some((existing) => existing.line === h.line && existing.type === h.type);
+            if (!isDuplicate) {
+                issues.push(h);
+            }
+        }
+        // Sort: errors first, then warnings, then info
+        const severityOrder = { error: 0, warning: 1, info: 2 };
+        issues.sort((a, b) => (severityOrder[a.severity] ?? 3) - (severityOrder[b.severity] ?? 3));
+        // Prevent contradictory output: low score but zero issues.
         if (score < 50 && issues.length === 0) {
             issues.push({
                 type: 'quality',
-                line: 0,
-                message: `The analysis returned a low quality score (${score}/100) but did not enumerate specific issues. This typically means the review model returned incomplete data. Consider re-running the review or inspecting the file manually.`,
+                line: 1,
+                message: `The analysis returned a low quality score (${score}/100) but did not enumerate specific issues. Re-run the review or inspect the file manually.`,
                 severity: 'warning',
             });
         }
         return { score, issues, suggestions };
     }
+    /**
+     * Lightweight client-side heuristic scan: catches common code smells
+     * AND logic/arithmetic bugs so review never returns "score 30, no issues".
+     */
+    heuristicCodeIssues(code, language) {
+        const issues = [];
+        const lines = code.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const lineNum = i + 1;
+            // console.log left in production code
+            if (/\bconsole\.(log|debug|info)\b/.test(line) && !/\/\//.test(line.slice(0, line.indexOf('console')))) {
+                issues.push({ type: 'quality', line: lineNum, message: 'console.log/debug statement — remove or replace with proper logging.', severity: 'warning' });
+            }
+            // TODO/FIXME/HACK comments
+            if (/\b(TODO|FIXME|HACK|XXX)\b/.test(line)) {
+                issues.push({ type: 'maintainability', line: lineNum, message: `Unresolved ${line.match(/\b(TODO|FIXME|HACK|XXX)\b/)?.[0]} comment.`, severity: 'info' });
+            }
+            // Empty catch blocks
+            if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
+                issues.push({ type: 'error-handling', line: lineNum, message: 'Empty catch block — errors are silently swallowed.', severity: 'warning' });
+            }
+            // Very long lines (> 200 chars)
+            if (line.length > 200) {
+                issues.push({ type: 'style', line: lineNum, message: `Line exceeds 200 characters (${line.length}).`, severity: 'info' });
+            }
+            // Arithmetic / logic bugs: function named 'add' but using subtraction
+            if (/\breturn\s+\w+\s*-\s*\w+/.test(line)) {
+                // Check if the enclosing function name implies addition
+                for (let j = i; j >= Math.max(0, i - 5); j--) {
+                    if (/function\s+add\b/i.test(lines[j]) || /\badd\s*[=(]/.test(lines[j])) {
+                        issues.push({ type: 'logic', line: lineNum, message: 'Subtraction operator in a function named "add" — likely should be addition (+).', severity: 'error' });
+                        break;
+                    }
+                }
+            }
+            // Multiplication where addition is expected
+            if (/\breturn\s+\w+\s*\*\s*\w+/.test(line)) {
+                for (let j = i; j >= Math.max(0, i - 5); j--) {
+                    if (/function\s+add\b/i.test(lines[j]) || /\badd\s*[=(]/.test(lines[j])) {
+                        issues.push({ type: 'logic', line: lineNum, message: 'Multiplication operator in a function named "add" — likely should be addition (+).', severity: 'error' });
+                        break;
+                    }
+                }
+            }
+            // Division where subtraction/addition is expected in subtract
+            if (/\breturn\s+\w+\s*\+\s*\w+/.test(line)) {
+                for (let j = i; j >= Math.max(0, i - 5); j--) {
+                    if (/function\s+subtract\b/i.test(lines[j]) || /\bsubtract\s*[=(]/.test(lines[j])) {
+                        issues.push({ type: 'logic', line: lineNum, message: 'Addition operator in a function named "subtract" — likely should be subtraction (-).', severity: 'error' });
+                        break;
+                    }
+                }
+            }
+            // Off-by-one: comparing with === where <= or >= may be needed
+            // (not implemented yet — would require more complex AST analysis)
+            // Limit to 15 heuristic issues
+            if (issues.length >= 15)
+                break;
+        }
+        return issues;
+    }
     async fixCode(code, language, fixType) {
         // Client-side syntax pre-check: detect obvious errors and include
         // them in the request so the model has concrete signals.

package/dist/utils/bridge-client.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Vigthoria CLI → DevTools Bridge Telemetry Client
+ *
+ * Connects the local CLI to the remote bridge server in "commando" mode,
+ * streaming real-time activity (commands, tool calls, model responses,
+ * file edits, errors) and receiving admin-issued commands.
+ *
+ * Design principles:
+ *  - Fire-and-forget: never blocks the CLI main flow
+ *  - Auto-reconnects with exponential back-off
+ *  - Opt-in via --bridge <url> flag
+ *  - Sensitive data (API keys, tokens) is never transmitted
+ */
+export type TelemetryEventType = 'cli:start' | 'cli:command' | 'cli:prompt' | 'cli:model-response' | 'cli:tool-call' | 'cli:tool-result' | 'cli:file-edit' | 'cli:error' | 'cli:end' | 'cli:mode-change' | 'cli:heartbeat';
+export interface TelemetryEvent {
+    type: TelemetryEventType;
+    payload: Record<string, unknown>;
+    ts: number;
+    clientId: string;
+}
+export interface AdminCommand {
+    type: 'admin:command';
+    action: string;
+    params?: Record<string, unknown>;
+    requestId?: string;
+}
+export interface BridgeClientOptions {
+    bridgeUrl: string;
+    apiKey?: string;
+    machineLabel?: string;
+    onAdminCommand?: (cmd: AdminCommand) => void;
+}
+/** Get the active bridge client (may be null if --bridge was not used). */
+export declare function getBridgeClient(): BridgeClient | null;
+export declare class BridgeClient {
+    private ws;
+    private url;
+    private apiKey;
+    private machineLabel;
+    private clientId;
+    private connected;
+    private reconnectTimer;
+    private heartbeatTimer;
+    private queue;
+    private maxQueueSize;
+    private reconnectDelay;
+    private destroyed;
+    private onAdminCommand?;
+    constructor(opts: BridgeClientOptions);
+    connect(): Promise<void>;
+    destroy(): void;
+    get isConnected(): boolean;
+    /** CLI session started (command, flags, cwd). */
+    emitStart(data: {
+        command: string;
+        flags: Record<string, unknown>;
+        cwd: string;
+    }): void;
+    /** User entered a prompt / message. */
+    emitPrompt(data: {
+        prompt: string;
+        mode: string;
+        model: string;
+    }): void;
+    /** Model response received (summary only, not full content). */
+    emitModelResponse(data: {
+        model: string;
+        chars: number;
+        hasToolCalls: boolean;
+        preview: string;
+    }): void;
+    /** Tool is being called. */
+    emitToolCall(data: {
+        tool: string;
+        args: Record<string, string>;
+    }): void;
+    /** Tool finished executing. */
+    emitToolResult(data: {
+        tool: string;
+        success: boolean;
+        preview: string;
+    }): void;
+    /** File was written or edited. */
+    emitFileEdit(data: {
+        file: string;
+        action: 'write' | 'edit';
+        linesChanged: number;
+    }): void;
+    /** Error occurred. */
+    emitError(data: {
+        message: string;
+        code?: string;
+    }): void;
+    /** Mode changed (agent / operator / chat). */
+    emitModeChange(data: {
+        mode: string;
+        model: string;
+    }): void;
+    /** Session ended. */
+    emitEnd(data: {
+        reason: string;
+    }): void;
+    private emit;
+    private sendRaw;
+    private bufferEvent;
+    private flushQueue;
+    private scheduleReconnect;
+    private startHeartbeat;
+    private stopHeartbeat;
+}