vigthoria-cli 1.8.14 → 1.8.19

package/dist/utils/api.js

@@ -20,7 +20,6 @@ const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
 const path_1 = __importDefault(require("path"));
 const ws_1 = __importDefault(require("ws"));
-const workspace_stream_js_1 = require("./workspace-stream.js");
 class CLIError extends Error {
     category;
     statusCode;
@@ -92,36 +91,7 @@ function formatCLIError(err) {
             return `${tag} ${err.message}`;
     }
 }
-const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS;
-    if (!rawValue) {
-        // No total timeout by default for long-running SSE agent workflows.
-        return 0;
-    }
-    const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
-})();
-const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS;
-    if (!rawValue) {
-        // Keep stream open indefinitely unless user configures an idle limit.
-        return 0;
-    }
-    const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
-})();
-const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS;
-    if (!rawValue) {
-        // BMAD/operator flows can be long-running; do not cap by default.
-        return 0;
-    }
-    const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
-})();
 // Sanitize an upstream error string before exposing it to the end user.
-// Strips URLs, IPs:ports, absolute server paths, and bare hostnames so the
-// CLI never reveals internal infrastructure to remote users.
 function sanitizeUserFacingErrorText(input) {
     if (!input)
         return '';
@@ -131,19 +101,13 @@ function sanitizeUserFacingErrorText(input) {
     out = out.replace(/\b(?:localhost|127\.0\.0\.1)(?::\d+)?\b/gi, '[redacted-host]');
     out = out.replace(/\b[a-z0-9.-]+\.vigthoria\.io\b/gi, '[redacted-host]');
     out = out.replace(/(?:[A-Za-z]:)?[\\/](?:var|opt|tmp|home|root|etc|usr)[\\/][^\s'"<>)]*/gi, '[redacted-path]');
-    // Windows drive-letter paths (e.g. C:\Users\Name\AppData\...).
     out = out.replace(/[A-Za-z]:\\[^\s'"<>)]+/g, '[redacted-path]');
-    // UNC paths (\\server\share\...).
     out = out.replace(/\\\\[^\s'"<>)]+/g, '[redacted-path]');
-    out = out.replace(/\{\s*"detail"\s*:\s*"[^"]*"\s*\}/g, '');
     out = out.replace(/\s+/g, ' ').trim();
     if (out.length > 160)
         out = out.slice(0, 160) + '...';
     return out;
 }
-// True only when this CLI process is running on the Vigthoria server itself.
-// Local user installations must NEVER attempt internal loopback endpoints,
-// because the resulting fetch errors include the URL we tried (leak vector).
 function isServerRuntime() {
     if (process.env.VIGTHORIA_RUN_MODE === 'server')
         return true;
@@ -166,6 +130,21 @@ function describeUpstreamStatus(status) {
         return 'Request was rejected by the service.';
     return 'Unexpected response from service.';
 }
+const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '1200000';
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 1200000;
+})();
+const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS || '90000';
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 90000;
+})();
+const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS || '300000';
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 300000;
+})();
 class APIClient {
     client;
     modelRouterClient;
@@ -174,7 +153,6 @@ class APIClient {
     logger;
     ws = null;
     vigFlowTokens = new Map();
-    _httpsAgent = null;
     constructor(config, logger) {
         this.config = config;
         this.logger = logger;
@@ -184,7 +162,6 @@ class APIClient {
             keepAlive: true,
             timeout: 30000,
         });
-        this._httpsAgent = httpsAgent;
         // Main Vigthoria Coder API (coder.vigthoria.io)
         this.client = axios_1.default.create({
             baseURL: config.get('apiUrl'),
@@ -211,7 +188,6 @@ class APIClient {
         this.selfHostedModelRouterClient = selfHostedModelsApiUrl ? axios_1.default.create({
             baseURL: selfHostedModelsApiUrl,
             timeout: 240000,
-            httpsAgent,
             headers: {
                 'Content-Type': 'application/json',
                 'User-Agent': `Vigthoria-CLI/${process.env.npm_package_version || '1.6.9'}`,
@@ -260,22 +236,12 @@ class APIClient {
             createAuthRetryInterceptor(this.selfHostedModelRouterClient);
         }
     }
-    /**
-     * Destroy keep-alive sockets so the Node.js event loop can drain
-     * naturally.  Call this before exiting commands that run HTTP probes
-     * (e.g. `status`) to avoid the libuv UV_HANDLE_CLOSING assertion
-     * on Windows / Node 25+.
-     */
     destroy() {
-        if (this._httpsAgent) {
-            this._httpsAgent.destroy();
-            this._httpsAgent = null;
-        }
         if (this.ws) {
             try {
                 this.ws.close();
             }
-            catch { /* ok */ }
+            catch { }
             this.ws = null;
         }
     }
@@ -355,6 +321,25 @@ class APIClient {
                     }
                 }
             }
+            // All profile endpoints failed — fall back to JWT payload claims so the
+            // token is still usable without identity fields being null.
+            const jwtPayload = this.decodeJwtPayload(token);
+            const fallbackId = String(jwtPayload?.sub || jwtPayload?.user_id || jwtPayload?.id || '').trim();
+            const fallbackEmail = String(jwtPayload?.email || '').trim();
+            const fallbackPlan = String(jwtPayload?.plan || jwtPayload?.subscription_plan || 'developer').trim();
+            if (fallbackId || fallbackEmail) {
+                this.config.setAuth({
+                    token,
+                    userId: fallbackId || fallbackEmail,
+                    email: fallbackEmail || fallbackId,
+                });
+                this.config.setSubscription({
+                    plan: fallbackPlan,
+                    status: 'active',
+                    expiresAt: undefined,
+                });
+                return true;
+            }
             this.config.clearAuth();
             return false;
         }
@@ -364,6 +349,19 @@ class APIClient {
             return false;
         }
     }
+    decodeJwtPayload(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                return null;
+            }
+            const payload = Buffer.from(parts[1], 'base64url').toString('utf8');
+            return JSON.parse(payload);
+        }
+        catch {
+            return null;
+        }
+    }
     extractUserProfile(data) {
         if (!data) {
             return null;
@@ -437,35 +435,40 @@ class APIClient {
         if (!token) {
             return { valid: false, error: 'No auth token configured. Run: vigthoria login' };
         }
-        // Probe both endpoints in parallel.  If EITHER succeeds the token is
-        // valid.  Only if both return 401/403 is the token truly invalid.
-        // If both are unreachable assume the token is fine (offline scenario).
-        const results = await Promise.allSettled([
-            this.modelRouterClient.get('/v1/models', { timeout: 5000 }),
-            this.client.get('/api/user/profile', { timeout: 5000 }),
-        ]);
-        for (const r of results) {
-            if (r.status === 'fulfilled')
-                return { valid: true };
+        // Verify auth against the Model Router (api.vigthoria.io) which is
+        // the backend all AI commands actually use.  Falls back to the Coder
+        // profile endpoint when the Model Router is unreachable so that
+        // offline/degraded scenarios don't block the user.
+        try {
+            await this.modelRouterClient.get('/v1/models', { timeout: 10000 });
+            return { valid: true };
         }
-        // Both failed — check why
-        for (const r of results) {
-            if (r.status === 'rejected') {
-                const err = r.reason;
-                if (err.response?.status === 401 || err.response?.status === 403) {
+        catch (mrError) {
+            const mrAxErr = mrError;
+            if (mrAxErr.response?.status === 401 || mrAxErr.response?.status === 403) {
+                return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
+            }
+            // Model Router unreachable — try Coder profile as fallback
+            try {
+                await this.client.get('/api/user/profile', { timeout: 10000 });
+                return { valid: true };
+            }
+            catch (error) {
+                if (error instanceof CLIError && error.category === 'auth') {
                     return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
                 }
-                if (err instanceof CLIError && err.category === 'auth') {
+                const axErr = error;
+                if (axErr.response?.status === 401 || axErr.response?.status === 403) {
                     return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
                 }
+                // Both unreachable — don't assume token is bad
+                return { valid: true };
             }
         }
-        // Both unreachable — don't assume token is bad
-        return { valid: true };
     }
     getV3AgentBaseUrls(preferLocal = false) {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocalV3Agent = isServerRuntime() && (process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1' || preferLocal);
+        const allowLocalV3Agent = process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1' || preferLocal;
         const urls = [
             process.env.VIGTHORIA_V3_AGENT_URL,
             process.env.V3_AGENT_URL,
@@ -488,12 +491,11 @@ class APIClient {
     }
     getOperatorBaseUrls() {
         const configuredModelsApiUrl = String(this.config.get('modelsApiUrl') || 'https://api.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_OPERATOR_URL,
             process.env.OPERATOR_URL,
+            'http://127.0.0.1:4009',
             configuredModelsApiUrl,
-            ...(allowLocal ? ['http://127.0.0.1:4009'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -502,35 +504,39 @@ class APIClient {
     }
     getMcpBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_MCP_URL,
             process.env.MCP_SERVER_URL,
+            'http://127.0.0.1:4008',
             configuredApiUrl,
-            ...(allowLocal ? ['http://127.0.0.1:4008'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
     getVigFlowBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
+        // Put the remote gateway first, since local VigFlow servers are
+        // rarely running for end-user CLI installations. This avoids
+        // wasting connection-attempt time on 127.0.0.1 and hitting the
+        // remote gateway only after the local attempts have already
+        // errored — which surfaces as a confusing "last error" 404 in
+        // some setups.
         const urls = [
             process.env.VIGTHORIA_VIGFLOW_URL,
             process.env.VIGFLOW_URL,
             process.env.WORKFLOW_BUILDER_URL,
             `${configuredApiUrl}/api/vigflow`,
-            ...(allowLocal ? ['http://127.0.0.1:5060', 'http://127.0.0.1:5050'] : []),
+            'http://127.0.0.1:5060',
+            'http://127.0.0.1:5050',
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
     getTemplateServiceBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_TEMPLATE_SERVICE_URL,
             process.env.TEMPLATE_SERVICE_URL,
+            'http://127.0.0.1:4011',
             `${configuredApiUrl}/api/template-service`,
-            ...(allowLocal ? ['http://127.0.0.1:4011'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -855,7 +861,7 @@ class APIClient {
                 });
                 if (!response.ok) {
                     const errorText = await response.text().catch(() => '');
-                    throw new Error(`Template preview proof ${response.status}: ${describeUpstreamStatus(response.status)}`);
+                    throw new Error(`Template preview proof ${response.status}: ${sanitizeUserFacingErrorText(errorText)}`);
                 }
                 const payload = await response.json();
                 const modes = payload?.modes || {};
@@ -999,8 +1005,7 @@ class APIClient {
                 this.logger.debug(`VigFlow ${operation} via ${baseUrl} failed:`, lastError.message);
             }
         }
-        // Throw a clean message instead of the raw ECONNREFUSED from the last URL tried
-        throw new Error(`No VigFlow backend available for ${operation}. The workflow service is not deployed or not reachable.`);
+        throw lastError || new Error(`No VigFlow backend available for ${operation}.`);
     }
     /**
      * Build the correct sub-path for VigFlow endpoints.
@@ -1292,458 +1297,6 @@ class APIClient {
         const match = String(message || '').match(/called\s+([A-Z][A-Za-z0-9&\- ]{2,40})/i);
         return match?.[1]?.trim() || fallback;
     }
-    materializeEmergencySaaSWorkspace(message = '', context = {}) {
-        const rootPath = this.resolveAgentTargetPath(context);
-        if (!rootPath) {
-            return null;
-        }
-        fs_1.default.mkdirSync(rootPath, { recursive: true });
-        const appName = this.extractEmergencyAppName(message);
-        const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${appName}</title>
-  <link rel="stylesheet" href="styles.css">
-</head>
-<body>
-  <div class="app-shell">
-    <aside class="sidebar">
-      <div class="brand">${appName}</div>
-      <button class="menu-toggle" id="menu-toggle" aria-label="Toggle navigation">Menu</button>
-      <nav>
-        <a href="#dashboard" class="nav-link active">Dashboard</a>
-        <a href="#team" class="nav-link">Team</a>
-        <a href="#billing" class="nav-link">Billing</a>
-        <a href="#settings" class="nav-link">Settings</a>
-      </nav>
-    </aside>
-    <main class="content">
-      <section class="hero-card panel active-panel" id="dashboard">
-        <div class="hero-copy">
-          <p class="eyebrow">Dashboard</p>
-          <h1>${appName} revenue command center</h1>
-          <p>Track login activity, campaign velocity, billing state, and team performance from one responsive SaaS workspace.</p>
-        </div>
-        <form class="login-card">
-          <h2>Login</h2>
-          <label>Email<input type="email" placeholder="ops@${appName.toLowerCase().replace(/[^a-z0-9]+/g, '') || 'signaldesk'}.io"></label>
-          <label>Password<input type="password" placeholder="Enter password"></label>
-          <button type="submit">Enter dashboard</button>
-        </form>
-      </section>
-
-      <section class="stats-grid">
-        <article class="stat-card"><span>MRR</span><strong>$284K</strong><em>+12.4%</em></article>
-        <article class="stat-card"><span>Activation</span><strong>74%</strong><em>+6.1%</em></article>
-        <article class="stat-card"><span>Team Seats</span><strong>128</strong><em>8 pending</em></article>
-        <article class="stat-card"><span>Churn Risk</span><strong>2.1%</strong><em>Low</em></article>
-      </section>
-
-      <section class="workspace-grid">
-        <article class="panel chart-panel">
-          <div class="panel-header">
-            <h2>Analytics</h2>
-            <button id="open-modal" type="button">Add campaign</button>
-          </div>
-          <div class="chart-bars" aria-label="Revenue chart">
-            <div class="bar" style="--value: 52%"><span>Mon</span></div>
-            <div class="bar" style="--value: 68%"><span>Tue</span></div>
-            <div class="bar" style="--value: 74%"><span>Wed</span></div>
-            <div class="bar" style="--value: 59%"><span>Thu</span></div>
-            <div class="bar" style="--value: 88%"><span>Fri</span></div>
-          </div>
-        </article>
-
-        <article class="panel activity-panel">
-          <div class="panel-header"><h2>Activity Feed</h2><span>Live</span></div>
-          <ul class="activity-feed">
-            <li><strong>Billing</strong><span>Enterprise invoice paid</span></li>
-            <li><strong>Team</strong><span>New strategist invited to workspace</span></li>
-            <li><strong>Dashboard</strong><span>KPI threshold updated for activation alerts</span></li>
-          </ul>
-        </article>
-
-        <article class="panel" id="team">
-          <div class="panel-header"><h2>Team Management</h2><span>Owners and operators</span></div>
-          <div class="team-list">
-            <div><strong>Ana</strong><span>Growth lead</span></div>
-            <div><strong>Marcus</strong><span>Billing admin</span></div>
-            <div><strong>Lina</strong><span>Lifecycle analyst</span></div>
-          </div>
-        </article>
-
-        <article class="panel" id="billing">
-          <div class="panel-header"><h2>Billing</h2><span>Current plan</span></div>
-          <div class="billing-card">
-            <strong>Scale Annual</strong>
-            <p>Renews on 12 Oct with usage-based analytics overages.</p>
-            <button type="button" class="secondary-action">Update payment method</button>
-          </div>
-        </article>
-
-        <article class="panel" id="settings">
-          <div class="panel-header"><h2>Settings</h2><span>Automation and alerts</span></div>
-          <form class="settings-form">
-            <label>Alert threshold<input type="number" value="18"></label>
-            <label>Weekly digest<select><option>Enabled</option><option>Paused</option></select></label>
-            <button type="submit">Save settings</button>
-          </form>
-        </article>
-      </section>
-    </main>
-  </div>
-
-  <dialog id="campaign-modal">
-    <form method="dialog" class="modal-form">
-      <h2>Launch campaign</h2>
-      <label>Name<input type="text" placeholder="Retention push"></label>
-      <label>Owner<input type="text" placeholder="Lina"></label>
-      <menu>
-        <button value="cancel">Cancel</button>
-        <button value="confirm">Create</button>
-      </menu>
-    </form>
-  </dialog>
-
-  <script src="scripts.js"></script>
-</body>
-</html>
-`;
-        const css = `:root {
-  --bg: #f2ede4;
-  --ink: #18222f;
-  --muted: #5c6674;
-  --panel: rgba(255, 255, 255, 0.82);
-  --line: rgba(24, 34, 47, 0.08);
-  --accent: #b6542c;
-  --accent-strong: #7f3417;
-  --shadow: 0 24px 60px rgba(24, 34, 47, 0.12);
-}
-
-* { box-sizing: border-box; }
-
-body {
-  margin: 0;
-  font-family: "Georgia", "Times New Roman", serif;
-  color: var(--ink);
-  background:
-    radial-gradient(circle at top left, rgba(182, 84, 44, 0.18), transparent 28%),
-    radial-gradient(circle at bottom right, rgba(24, 34, 47, 0.14), transparent 30%),
-    var(--bg);
-}
-
-.app-shell {
-  min-height: 100vh;
-  display: grid;
-  grid-template-columns: 260px 1fr;
-}
-
-.sidebar {
-  padding: 2rem 1.25rem;
-  background: rgba(24, 34, 47, 0.94);
-  color: #f7f2eb;
-  position: sticky;
-  top: 0;
-  min-height: 100vh;
-}
-
-.brand {
-  font-size: 1.6rem;
-  font-weight: 700;
-  margin-bottom: 1.5rem;
-}
-
-.menu-toggle {
-  display: none;
-  margin-bottom: 1rem;
-}
-
-nav {
-  display: grid;
-  gap: 0.6rem;
-}
-
-.nav-link {
-  color: inherit;
-  text-decoration: none;
-  padding: 0.8rem 0.95rem;
-  border-radius: 999px;
-  transition: transform 0.25s ease, background-color 0.25s ease;
-}
-
-.nav-link:hover,
-.nav-link.active {
-  background: rgba(255, 255, 255, 0.12);
-  transform: translateX(4px);
-}
-
-.content {
-  padding: 2rem;
-}
-
-.hero-card,
-.panel,
-.stat-card,
-.login-card,
-dialog {
-  background: var(--panel);
-  backdrop-filter: blur(16px);
-  border: 1px solid var(--line);
-  box-shadow: var(--shadow);
-}
-
-.hero-card {
-  display: grid;
-  grid-template-columns: 1.3fr 0.9fr;
-  gap: 1.5rem;
-  border-radius: 32px;
-  padding: 2rem;
-  margin-bottom: 1.5rem;
-}
-
-.eyebrow {
-  text-transform: uppercase;
-  letter-spacing: 0.14em;
-  color: var(--accent-strong);
-  font-size: 0.78rem;
-}
-
-.hero-card h1,
-.panel h2,
-.login-card h2 {
-  margin: 0 0 0.75rem;
-}
-
-.login-card,
-.panel,
-.stat-card {
-  border-radius: 24px;
-}
-
-.login-card,
-.settings-form,
-.modal-form {
-  display: grid;
-  gap: 0.85rem;
-}
-
-.stats-grid,
-.workspace-grid {
-  display: grid;
-  gap: 1rem;
-}
-
-.stats-grid {
-  grid-template-columns: repeat(4, minmax(0, 1fr));
-  margin-bottom: 1rem;
-}
-
-.workspace-grid {
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-}
-
-.stat-card,
-.panel {
-  padding: 1.2rem;
-  animation: riseIn 0.7s ease forwards;
-}
-
-.stat-card span,
-.panel-header span,
-.activity-feed span,
-.team-list span,
-.billing-card p {
-  color: var(--muted);
-}
-
-.panel-header {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  margin-bottom: 1rem;
-}
-
-.chart-bars {
-  display: grid;
-  grid-template-columns: repeat(5, minmax(0, 1fr));
-  gap: 0.9rem;
-  align-items: end;
-  min-height: 220px;
-}
-
-.bar {
-  position: relative;
-  min-height: 180px;
-  border-radius: 20px 20px 8px 8px;
-  background: linear-gradient(180deg, rgba(182, 84, 44, 0.92), rgba(127, 52, 23, 0.68));
-  transform-origin: bottom;
-  transform: scaleY(calc(var(--value) / 100));
-  transition: transform 0.6s ease;
-}
-
-.bar span {
-  position: absolute;
-  left: 50%;
-  bottom: -1.6rem;
-  transform: translateX(-50%);
-}
-
-.activity-feed,
-.team-list {
-  display: grid;
-  gap: 0.8rem;
-  padding: 0;
-  margin: 0;
-  list-style: none;
-}
-
-.activity-feed li,
-.team-list div,
-.billing-card {
-  padding: 0.9rem 1rem;
-  border-radius: 18px;
-  background: rgba(255, 255, 255, 0.7);
-  border: 1px solid var(--line);
-}
-
-label {
-  display: grid;
-  gap: 0.35rem;
-  font-size: 0.95rem;
-}
-
-input,
-select,
-button {
-  font: inherit;
-}
-
-input,
-select {
-  width: 100%;
-  padding: 0.85rem 1rem;
-  border-radius: 14px;
-  border: 1px solid var(--line);
-  background: rgba(255, 255, 255, 0.92);
-}
-
-button {
-  border: none;
-  border-radius: 999px;
-  padding: 0.85rem 1.2rem;
-  background: var(--accent);
-  color: #fff9f3;
-  cursor: pointer;
-  transition: transform 0.25s ease, background-color 0.25s ease;
-}
-
-button:hover {
-  background: var(--accent-strong);
-  transform: translateY(-2px);
-}
-
-.secondary-action,
-menu button:first-child {
-  background: rgba(24, 34, 47, 0.12);
-  color: var(--ink);
-}
-
-dialog {
-  border-radius: 28px;
-  padding: 0;
-  width: min(420px, calc(100% - 2rem));
-}
-
-dialog::backdrop {
-  background: rgba(24, 34, 47, 0.3);
-}
-
-.modal-form {
-  padding: 1.4rem;
-}
-
-menu {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.75rem;
-  padding: 0;
-  margin: 0.5rem 0 0;
-}
-
-@keyframes riseIn {
-  from {
-    opacity: 0;
-    transform: translateY(18px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-@media (max-width: 980px) {
-  .app-shell,
-  .hero-card,
-  .stats-grid,
-  .workspace-grid {
-    grid-template-columns: 1fr;
-  }
-
-  .sidebar {
-    position: static;
-    min-height: auto;
-  }
-
-  .menu-toggle {
-    display: inline-flex;
-  }
-
-  nav {
-    display: none;
-  }
-
-  nav.is-open {
-    display: grid;
-  }
-}
-`;
-        const js = `document.addEventListener('DOMContentLoaded', () => {
-  const menuToggle = document.getElementById('menu-toggle');
-  const nav = document.querySelector('nav');
-  const modal = document.getElementById('campaign-modal');
-  const openModal = document.getElementById('open-modal');
-  const navLinks = document.querySelectorAll('.nav-link');
-
-  menuToggle?.addEventListener('click', () => nav?.classList.toggle('is-open'));
-  openModal?.addEventListener('click', () => modal?.showModal());
-  modal?.addEventListener('close', () => document.body.classList.remove('modal-open'));
-
-  navLinks.forEach((link) => {
-    link.addEventListener('click', (event) => {
-      event.preventDefault();
-      navLinks.forEach((entry) => entry.classList.remove('active'));
-      link.classList.add('active');
-      document.querySelector(link.getAttribute('href'))?.scrollIntoView({ behavior: 'smooth', block: 'start' });
-      nav?.classList.remove('is-open');
-    });
-  });
-
-  document.querySelectorAll('.bar').forEach((bar, index) => {
-    bar.animate([
-      { transform: 'scaleY(0.15)' },
-      { transform: getComputedStyle(bar).transform || 'scaleY(1)' }
-    ], { duration: 600 + index * 80, fill: 'forwards', easing: 'ease-out' });
-  });
-});
-`;
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'index.html'), `${html.trimEnd()}\n`, 'utf8');
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'styles.css'), `${css.trimEnd()}\n`, 'utf8');
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'scripts.js'), `${js.trimEnd()}\n`, 'utf8');
-        return appName;
-    }
     ensureExecutionContext(context = {}) {
         const existingId = String(context.contextId || context.traceId || '').trim();
         const contextId = existingId || `vig-${Date.now()}-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
@@ -1796,7 +1349,7 @@ menu {
             });
             if (!response.ok) {
                 const errorText = await response.text().catch(() => '');
-                throw new Error(`MCP context update ${response.status}: ${describeUpstreamStatus(response.status)}`);
+                throw new Error(`MCP context update ${response.status}: ${sanitizeUserFacingErrorText(errorText)}`);
             }
             return {
                 ...executionContext,
@@ -1827,7 +1380,7 @@ menu {
                 });
                 if (!createResponse.ok) {
                     const errorText = await createResponse.text().catch(() => '');
-                    throw new Error(`MCP context create ${createResponse.status}: ${describeUpstreamStatus(createResponse.status)}`);
+                    throw new Error(`MCP context create ${createResponse.status}: ${sanitizeUserFacingErrorText(errorText)}`);
                 }
                 const payload = await createResponse.json();
                 const mcpContextId = String(payload.contextId || '').trim();
@@ -2184,11 +1737,6 @@ menu {
         if (!looksLikeFrontendTask) {
             return;
         }
-        // Skip motion/scroll enhancements for games — they use canvas, not section-based layouts
-        const looksLikeGame = /\bgame\b|arcade|pac.?man|tetris|platformer|roguelike|breakout|pong|snake\s+game|tower\s+defense|playable/i.test(prompt);
-        if (looksLikeGame) {
-            return;
-        }
         const htmlPath = path_1.default.join(rootPath, 'index.html');
         if (!fs_1.default.existsSync(htmlPath)) {
             return;
@@ -2635,7 +2183,7 @@ document.addEventListener('DOMContentLoaded', () => {
         let contextId = response.headers.get('x-context-id') || String(context.contextId || '').trim() || null;
         let serverWorkspaceRoot = null;
         const streamedFiles = {};
-        const idleTimeoutMs = context.agentIdleTimeoutMs ?? DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS;
+        const idleTimeoutMs = context.agentIdleTimeoutMs || DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS;
         while (true) {
             let chunk;
             try {
@@ -2704,19 +2252,6 @@ document.addEventListener('DOMContentLoaded', () => {
                     serverWorkspaceRoot = event.workspace_root.trim();
                 }
                 this.captureV3AgentStreamMutation(event, streamedFiles, serverWorkspaceRoot);
-                // Real-time workspace streaming: apply file mutations to local disk immediately
-                if (event.type === 'file_mutation') {
-                    const localRoot = context.projectPath || context.workspacePath || context.targetPath;
-                    if (localRoot && typeof event.path === 'string') {
-                        (0, workspace_stream_js_1.applyFileMutation)(event, localRoot);
-                        if (typeof event.content === 'string') {
-                            const relPath = this.normalizeAgentWorkspaceRelativePath(event.path, serverWorkspaceRoot || undefined);
-                            if (relPath) {
-                                streamedFiles[relPath] = event.content;
-                            }
-                        }
-                    }
-                }
                 // Empty workspace guard: if the remote agent lists its root
                 // and finds nothing while our local workspace has files, the
                 // workspace was not hydrated. Abort early with a clear error
@@ -2773,7 +2308,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             partial: true,
                         };
                     }
-                    throw new Error(`V3 agent: ${sanitizeUserFacingErrorText(event.message || '') || 'returned an error'}`);
+                    throw new Error(event.message || 'V3 agent returned an error');
                 }
                 if (event.type === 'complete' || event.type === 'message') {
                     final = event;
@@ -2791,13 +2326,15 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async runV3AgentWorkflow(message, context = {}) {
         const executionContext = await this.bindExecutionContext(context);
-        const baseTimeoutMs = executionContext.agentTimeoutMs ?? DEFAULT_V3_AGENT_TIMEOUT_MS;
+        const baseTimeoutMs = executionContext.agentTimeoutMs || DEFAULT_V3_AGENT_TIMEOUT_MS;
         const expectedFiles = this.extractExpectedWorkspaceFiles(message, executionContext);
         const requestedModel = String(executionContext.model || executionContext.requestedModel || 'agent');
         const resolvedModel = this.resolvePermittedModelId(requestedModel);
         const preferLocalV3 = /(premium|polished|landing|site|page|dashboard|saas|frontend|ui|responsive|animated|create the required project files and write them to the workspace)/i.test(message)
             && context.localMachineCapable !== false;
-        const timeoutMs = baseTimeoutMs;
+        const rescueEligibleSaaS = preferLocalV3
+            && /(saas|dashboard|analytics|billing|team management|activity feed|login screen)/i.test(message);
+        const timeoutMs = rescueEligibleSaaS ? Math.min(baseTimeoutMs, 210000) : baseTimeoutMs;
         const maxAttempts = preferLocalV3 ? 2 : 1;
         let lastErrors = [];
         for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
@@ -2831,12 +2368,13 @@ document.addEventListener('DOMContentLoaded', () => {
             };
             for (const baseUrl of this.getV3AgentBaseUrls(preferLocalV3)) {
                 const controller = new AbortController();
-                const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
+                const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
                 try {
                     const response = await this.executeV3AgentRunRequest(baseUrl, requestBody, requestExecutionContext, controller.signal);
+                    clearTimeout(timeoutId);
                     if (!response.ok) {
                         const errorText = await response.text().catch(() => '');
-                        throw new Error(`V3 agent ${response.status}: ${describeUpstreamStatus(response.status)}`);
+                        throw new Error(`V3 agent ${response.status}: ${sanitizeUserFacingErrorText(errorText)}`);
                     }
                     const data = await this.collectV3AgentStream(response, requestExecutionContext);
                     // Auto-continuation: if the agent checkpointed (budget exceeded), continue automatically
@@ -2863,7 +2401,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                 stream: true,
                             };
                             const continueController = new AbortController();
-                            const continueTimeoutId = timeoutMs > 0 ? setTimeout(() => continueController.abort(), timeoutMs) : null;
+                            const continueTimeoutId = setTimeout(() => continueController.abort(), timeoutMs);
                             try {
                                 const continueHeaders = await this.getV3AgentHeaders();
                                 const continueResponse = await fetch(this.getV3AgentContinueUrl(baseUrl), {
@@ -2872,6 +2410,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                     body: JSON.stringify(continueBody),
                                     signal: continueController.signal,
                                 });
+                                clearTimeout(continueTimeoutId);
                                 if (!continueResponse.ok) {
                                     break; // Fall through to normal completion with partial data
                                 }
@@ -2881,9 +2420,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                 break; // Fall through to normal completion with partial data
                             }
                             finally {
-                                if (continueTimeoutId) {
-                                    clearTimeout(continueTimeoutId);
-                                }
+                                clearTimeout(continueTimeoutId);
                             }
                         }
                         // Use the final continuation data for workspace recovery
@@ -2898,7 +2435,6 @@ document.addEventListener('DOMContentLoaded', () => {
                             contextId: finalContextId,
                             backendUrl: baseUrl,
                             partial: continuationData.checkpointed === true,
-                            changedFiles: continuationData.files || data.files || {},
                             metadata: { source: 'v3-agent', mode: 'agent', contextId: finalContextId, continuations, previewGate },
                         };
                     }
@@ -2917,7 +2453,6 @@ document.addEventListener('DOMContentLoaded', () => {
                         taskId: data.task_id || null,
                         contextId,
                         backendUrl: baseUrl,
-                        changedFiles: data.files || {},
                         metadata: { source: 'v3-agent', mode: 'agent', contextId, mcpContextId, previewGate },
                     };
                 }
@@ -2933,16 +2468,13 @@ document.addEventListener('DOMContentLoaded', () => {
                             contextId: error.partialData.context_id || requestExecutionContext.contextId || executionContext.contextId || null,
                             backendUrl: baseUrl,
                             partial: true,
-                            changedFiles: error.partialData.files || {},
                             metadata: { source: 'v3-agent', mode: 'agent', partial: true, contextId: error.partialData.context_id || requestExecutionContext.contextId || executionContext.contextId || null, mcpContextId: requestExecutionContext.mcpContextId || executionContext.mcpContextId || null, previewGate },
                         };
                     }
                     errors.push(`${baseUrl}: ${error?.message || String(error)}`);
                 }
                 finally {
-                    if (timeoutId) {
-                        clearTimeout(timeoutId);
-                    }
+                    clearTimeout(timeoutId);
                 }
             }
             lastErrors = errors;
@@ -2964,24 +2496,6 @@ document.addEventListener('DOMContentLoaded', () => {
             this.config.clearAuth();
             throw new Error('V3 agent authentication failed. The stored CLI login token is invalid or expired. Run vigthoria login again.');
         }
-        if (preferLocalV3
-            && !this.hasAgentWorkspaceOutput(executionContext)
-            && /(saas|dashboard|analytics|billing|team management|activity feed)/i.test(message)) {
-            const appName = this.materializeEmergencySaaSWorkspace(message, executionContext);
-            if (appName) {
-                await this.waitForAgentWorkspaceSettle(executionContext, { expectedFiles: ['index.html', 'styles.css', 'scripts.js'] });
-                await this.ensureAgentFrontendPolish(message, executionContext);
-                const previewGate = await this.runTemplateServicePreviewGate(message, executionContext);
-                return {
-                    content: `Recovered a local SaaS workspace scaffold for ${appName} after repeated V3 materialization failures.`,
-                    taskId: null,
-                    contextId: executionContext.contextId || null,
-                    backendUrl: 'local-emergency-scaffold',
-                    partial: true,
-                    metadata: { source: 'v3-agent-emergency-scaffold', mode: 'agent', previewGate, emergencyScaffold: true },
-                };
-            }
-        }
         throw new Error(errors.join(' | '));
     }
     formatOperatorResponse(data = {}) {
@@ -3009,7 +2523,7 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async runOperatorWorkflow(message, context = {}) {
         const executionContext = await this.bindExecutionContext(context);
-        const timeoutMs = context.operatorTimeoutMs ?? DEFAULT_OPERATOR_TIMEOUT_MS;
+        const timeoutMs = context.operatorTimeoutMs || DEFAULT_OPERATOR_TIMEOUT_MS;
         const errors = [];
         const authToken = this.config.get('authToken');
         // Collect a lightweight workspace file listing so the operator can
@@ -3018,7 +2532,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const workspaceSummary = this.buildLocalWorkspaceSummary(workspacePath);
         for (const baseUrl of this.getOperatorBaseUrls()) {
             const controller = new AbortController();
-            const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
+            const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
             try {
                 const response = await fetch(this.getOperatorStreamUrl(baseUrl), {
                     method: 'POST',
@@ -3042,7 +2556,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             workspace: { path: workspacePath },
                             workspace_path: workspacePath,
                             workspace_summary: workspaceSummary,
-                            model: this.resolveModelId(executionContext.model || 'code'),
+                            model: this.resolveModelId(executionContext.model || 'code-8b'),
                             history: executionContext.history || [],
                             executionSurface: executionContext.executionSurface || 'cli',
                             clientSurface: executionContext.clientSurface || 'cli',
@@ -3053,7 +2567,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             rawPrompt: executionContext.rawPrompt || null,
                             requestStartedAt: executionContext.requestStartedAt,
                         },
-                        workflow_type: executionContext.workflowType || 'full',
+                        workflow_type: executionContext.workflowType || 'analysis_only',
                         options: {
                             stream: true,
                             save_to_vigflow: executionContext.savePlanToVigFlow === true,
@@ -3063,7 +2577,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 });
                 if (!response.ok) {
                     const errorText = await response.text().catch(() => '');
-                    throw new Error(`Operator stream ${response.status}: ${describeUpstreamStatus(response.status)}`);
+                    throw new Error(`Operator stream ${response.status}: ${sanitizeUserFacingErrorText(errorText)}`);
                 }
                 if (!response.body || typeof response.body.getReader !== 'function') {
                     const fallbackData = await response.json();
@@ -3165,9 +2679,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 errors.push(`${baseUrl}: ${error?.message || String(error)}`);
             }
             finally {
-                if (timeoutId) {
-                    clearTimeout(timeoutId);
-                }
+                clearTimeout(timeoutId);
             }
         }
         throw new CLIError(`Operator workflow failed on all endpoints: ${errors.join(' | ')}`, 'model_backend');
@@ -3557,76 +3069,21 @@ document.addEventListener('DOMContentLoaded', () => {
      * Ensure code has balanced curly braces by appending missing closing braces.
      */
     ensureBalancedBraces(code) {
-        // Count braces/parens/brackets outside strings and comments
-        let braces = 0, parens = 0, brackets = 0;
-        let inStr = null;
-        let inLine = false, inBlock = false;
-        for (let i = 0; i < code.length; i++) {
-            const ch = code[i], nx = code[i + 1] || '';
-            if (inLine) {
-                if (ch === '\n')
-                    inLine = false;
-                continue;
-            }
-            if (inBlock) {
-                if (ch === '*' && nx === '/') {
-                    inBlock = false;
-                    i++;
-                }
-                continue;
-            }
-            if (inStr) {
-                if (ch === inStr && code[i - 1] !== '\\')
-                    inStr = null;
-                continue;
-            }
-            if (ch === '/' && nx === '/') {
-                inLine = true;
-                continue;
-            }
-            if (ch === '/' && nx === '*') {
-                inBlock = true;
-                continue;
-            }
-            if (ch === '"' || ch === "'" || ch === '`') {
-                inStr = ch;
-                continue;
-            }
+        let depth = 0;
+        for (const ch of code) {
             if (ch === '{')
-                braces++;
+                depth++;
             else if (ch === '}')
-                braces--;
-            else if (ch === '(')
-                parens++;
-            else if (ch === ')')
-                parens--;
-            else if (ch === '[')
-                brackets++;
-            else if (ch === ']')
-                brackets--;
-        }
-        let result = code.trimEnd();
-        for (let i = 0; i < braces; i++)
-            result += '\n}';
-        for (let i = 0; i < parens; i++)
-            result += ')';
-        for (let i = 0; i < brackets; i++)
-            result += ']';
-        return braces > 0 || parens > 0 || brackets > 0 ? result : code;
-    }
-    /**
-     * Quick JS/TS syntax validation using Node's built-in parser.
-     * Returns true if the code parses without errors.
-     */
-    validateJsSyntax(code) {
-        try {
-            // Use Function constructor to check syntax without executing
-            new Function(code);
-            return true;
+                depth--;
         }
-        catch {
-            return false;
+        if (depth > 0) {
+            let result = code.trimEnd();
+            for (let i = 0; i < depth; i++) {
+                result += '\n}';
+            }
+            code = result;
         }
+        return code;
     }
     /**
      * Extract the first complete function/class from code.
@@ -3734,17 +3191,7 @@ document.addEventListener('DOMContentLoaded', () => {
         }
     }
     async explainCode(code, language) {
-        const sysPrompt = [
-            `You are a code explainer. Explain the following ${language} code clearly and concisely.`,
-            'Focus on what it does, how it works, and any notable patterns or potential issues.',
-            'Format your response as clean Markdown:',
-            '- Use ## headers for major sections (e.g. ## Overview, ## How It Works, ## Key Details).',
-            '- Use bullet points (- or *) for all lists. Do NOT use numbered lists.',
-            '- Wrap code references in backticks.',
-            '- Keep paragraphs short (2-3 sentences max).',
-            '- Do NOT use raw HTML or excessive blank lines.',
-            '- Do NOT nest numbered lists inside sections.',
-        ].join('\n');
+        const sysPrompt = `You are a code explainer. Explain the following ${language} code clearly and concisely. Focus on what it does, how it works, and any notable patterns or potential issues.`;
         return this.chatComplete(sysPrompt, code);
     }
     async reviewCode(code, language) {
@@ -3756,11 +3203,9 @@ document.addEventListener('DOMContentLoaded', () => {
             'Rules:',
             '- Return concrete, line-specific issues with severity.',
             '- Every issue MUST reference a line number.',
-            '- Report each distinct bug ONCE. Do NOT report the same bug multiple times with different wording.',
-            '- For trivial/short code (< 10 lines), report ONLY actual bugs. Do NOT pad with style, robustness, or best-practice suggestions.',
-            '- If you find a real bug (wrong operator, logic error, type mismatch), report ONLY that bug. Do NOT also suggest input validation, type checking, or error handling unless those are ACTUAL bugs.',
+            '- If the score is below 50, list at least 2 specific issues.',
             '- Prioritize REAL BUGS: wrong operators, logic errors, off-by-one, type mismatches.',
-            '- Do NOT suggest adding error handling, input validation, or documentation as issues unless the user explicitly asked for a style review.',
+            '- Only report style issues AFTER listing all real bugs.',
             '- Return ONLY the JSON object, no markdown fences or extra text.',
         ].join('\n');
         let raw = {};
@@ -3775,40 +3220,25 @@ document.addEventListener('DOMContentLoaded', () => {
         const score = typeof raw.score === 'number' ? raw.score : 0;
         const issues = Array.isArray(raw.issues) ? raw.issues : [];
         const suggestions = Array.isArray(raw.suggestions) ? raw.suggestions : [];
-        // Merge client-side heuristics, but with tight dedup to avoid
-        // redundant over-reporting when the model already found the bug.
-        const modelFoundError = issues.some(i => i.severity === 'error');
+        // Always run client-side heuristics and merge any findings the
+        // server missed.  This ensures arithmetic/logic bugs are surfaced
+        // even when the server only reports style issues like console.log.
         const heuristic = this.heuristicCodeIssues(code, language);
         for (const h of heuristic) {
-            // If the model already found a real error, skip non-error heuristics
-            // entirely — they're just padding (style, robustness, etc.)
-            if (modelFoundError && h.severity !== 'error')
-                continue;
-            // Semantic duplicate check: same line + (similar type OR overlapping
-            // keywords in the message).  This catches cases where the model
-            // and heuristic describe the same bug with different wording.
-            const hWords = new Set(h.message.toLowerCase().split(/\W+/).filter(w => w.length > 3));
-            const hTypeNorm = h.type.toLowerCase().replace(/[^a-z]/g, '');
-            const isSemanticallyDuplicate = issues.some((existing) => {
-                if (existing.line !== h.line)
-                    return false;
-                // Normalize types: "logic-error", "logic_error", "logic" all match
-                const eTypeNorm = existing.type.toLowerCase().replace(/[^a-z]/g, '');
-                if (eTypeNorm === hTypeNorm || eTypeNorm.startsWith(hTypeNorm) || hTypeNorm.startsWith(eTypeNorm))
-                    return true;
-                // Both errors on same line about the same category of problem
-                if (existing.severity === 'error' && h.severity === 'error')
-                    return true;
-                // Check keyword overlap — if ≥2 significant words match, it's the same finding
-                const eWords = existing.message.toLowerCase().split(/\W+/).filter(w => w.length > 3);
-                let overlap = 0;
-                for (const w of eWords) {
-                    if (hWords.has(w))
-                        overlap++;
+            // Always include critical logic bugs (severity error) from heuristics
+            // regardless of server results — these catch wrong-operator bugs the
+            // server frequently misses.
+            if (h.severity === 'error') {
+                const exactDuplicate = issues.some((existing) => existing.line === h.line && existing.message === h.message);
+                if (!exactDuplicate) {
+                    issues.push(h);
                 }
-                return overlap >= 2;
-            });
-            if (!isSemanticallyDuplicate) {
+                continue;
+            }
+            // For non-critical heuristics, avoid duplicating issues the server
+            // already reported on the same line with the same type.
+            const isDuplicate = issues.some((existing) => existing.line === h.line && existing.type === h.type);
+            if (!isDuplicate) {
                 issues.push(h);
             }
         }
@@ -3957,11 +3387,9 @@ document.addEventListener('DOMContentLoaded', () => {
         const sysPrompt = [
             `You are a ${language} code fixer. Fix the code for: ${fixType}.`,
             'Return a JSON object with:',
-            '  "fixed": the COMPLETE corrected source code as a string (not a snippet — the full file),',
+            '  "fixed": the corrected code as a string,',
             '  "changes": [{ "line": number, "before": string, "after": string, "reason": string }]',
             'Rules:',
-            '- The "fixed" field MUST contain the entire corrected source code with ALL lines, including unchanged lines.',
-            '- The "fixed" code MUST have balanced braces, parentheses, and brackets.',
             '- Fix ONLY the issues related to the fix type.',
             '- Do not add comments, do not restructure beyond the minimal fix.',
             '- Return ONLY the JSON object, no markdown fences.',
@@ -4001,26 +3429,6 @@ document.addEventListener('DOMContentLoaded', () => {
         if (fixType === 'syntax' && fixed !== code) {
             fixed = this.repairBracketBalance(code, fixed);
         }
-        // Final bracket-balance guarantee — ensure the emitted code has
-        // balanced braces/parens/brackets regardless of what the model returned.
-        fixed = this.ensureBalancedBraces(fixed);
-        // For JS/TS syntax fixes, validate the output actually parses.
-        // If it doesn't, attempt a more aggressive bracket repair.
-        if ((fixType === 'syntax' || fixType === 'bugs') && fixed !== code) {
-            const lang = language.toLowerCase();
-            if (['javascript', 'js', 'typescript', 'ts'].includes(lang)) {
-                if (!this.validateJsSyntax(fixed)) {
-                    // Try once more: strip any remaining injected comments and re-balance
-                    let repaired = this.stripInjectedComments(code, fixed, language);
-                    repaired = this.ensureBalancedBraces(repaired);
-                    if (this.validateJsSyntax(repaired)) {
-                        fixed = repaired;
-                    }
-                    // If still invalid, return the best-effort fix — better than
-                    // silently reverting to the original broken code.
-                }
-            }
-        }
         // If there are still no changes but the fixed code differs, compute
         // a semantic diff using LCS so inserted/removed lines don't cause
         // every subsequent line to appear as changed.
@@ -4357,7 +3765,7 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async getCoderHealth() {
         try {
-            const response = await this.client.get('/api/health', { timeout: 5000 });
+            const response = await this.client.get('/api/health', { timeout: 10000 });
             const ok = response.data?.status === 'ok' || response.data?.healthy === true;
             return {
                 name: 'Coder API',
@@ -4379,8 +3787,8 @@ document.addEventListener('DOMContentLoaded', () => {
         const modelsApiUrl = this.config.get('modelsApiUrl');
         try {
             const [healthResponse, modelsResponse] = await Promise.all([
-                this.modelRouterClient.get('/health', { timeout: 5000 }),
-                this.modelRouterClient.get('/v1/models', { timeout: 5000 }),
+                this.modelRouterClient.get('/health', { timeout: 10000 }),
+                this.modelRouterClient.get('/v1/models', { timeout: 15000 }),
             ]);
             const healthOk = healthResponse.data?.status === 'healthy'
                 || healthResponse.data?.status === 'ok'
@@ -4411,7 +3819,7 @@ document.addEventListener('DOMContentLoaded', () => {
             return null;
         }
         try {
-            const response = await this.selfHostedModelRouterClient.get('/health', { timeout: 5000 });
+            const response = await this.selfHostedModelRouterClient.get('/health', { timeout: 10000 });
             const ok = response.data?.status === 'healthy'
                 || response.data?.status === 'ok'
                 || response.data?.healthy === true;
@@ -4431,6 +3839,29 @@ document.addEventListener('DOMContentLoaded', () => {
             };
         }
     }
+    async attemptV3ServiceRecovery(reason = '', options = {}) {
+        const attempts = Math.max(1, Number(options.attempts || 2));
+        const delayMs = Math.max(0, Number(options.delayMs || 1200));
+        let lastError = '';
+        for (let attempt = 1; attempt <= attempts; attempt += 1) {
+            const health = await this.getV3AgentHealth();
+            if (health.ok) {
+                const msg = attempt === 1
+                    ? 'V3 service is reachable.'
+                    : `V3 service recovered after retry ${attempt}.`;
+                return { recovered: true, message: msg, endpoint: health.endpoint };
+            }
+            lastError = health.error || 'health probe failed';
+            if (attempt < attempts && delayMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, delayMs));
+            }
+        }
+        const reasonText = sanitizeUserFacingErrorText(reason || lastError || 'unknown failure');
+        return {
+            recovered: false,
+            message: reasonText ? `Recovery failed: ${reasonText}` : 'Recovery failed: V3 service is still unreachable.',
+        };
+    }
     async getV3AgentHealth() {
         const baseUrl = this.getV3AgentBaseUrls()[0];
         // Try multiple health endpoint patterns — the V3 backend may expose
@@ -4444,7 +3875,7 @@ document.addEventListener('DOMContentLoaded', () => {
         for (const endpoint of candidates) {
             try {
                 const controller = new AbortController();
-                const timer = setTimeout(() => controller.abort(), 3000);
+                const timer = setTimeout(() => controller.abort(), 8000);
                 const response = await fetch(endpoint, {
                     method: 'GET',
                     headers,
@@ -4492,7 +3923,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const runUrl = this.getV3AgentRunUrl(baseUrl);
         try {
             const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), 2000);
+            const timer = setTimeout(() => controller.abort(), 5000);
             const probe = await fetch(runUrl, { method: 'OPTIONS', headers, signal: controller.signal });
             clearTimeout(timer);
             if (probe.ok || probe.status === 204 || probe.status === 405) {
@@ -4649,18 +4080,11 @@ document.addEventListener('DOMContentLoaded', () => {
         });
     }
     async getCapabilityTruthStatus(context = {}) {
-        // Wrap each probe with its own 6 s timeout so they always resolve
-        // before the outer 8 s race in auth.ts, producing real error messages
-        // (ECONNREFUSED, 404, etc.) instead of the generic "Timed out (8s)".
-        const withTimeout = (p, name) => Promise.race([
-            p,
-            new Promise(resolve => setTimeout(() => resolve({ name, endpoint: '', ok: false, error: 'Service not reachable (6 s timeout)' }), 6000)),
-        ]);
         const [v3Agent, hyperLoop, repoMemory, devtoolsBridge] = await Promise.all([
-            withTimeout(this.getV3AgentHealth(), 'V3 Agent'),
-            withTimeout(this.getHyperLoopHealth(), 'Hyper Loop'),
-            withTimeout(this.getRepoMemoryHealth(context), 'Repo Memory'),
-            withTimeout(this.getDevtoolsBridgeStatus(), 'DevTools Bridge'),
+            this.getV3AgentHealth(),
+            this.getHyperLoopHealth(),
+            this.getRepoMemoryHealth(context),
+            this.getDevtoolsBridgeStatus(),
         ]);
         return {
             overallOk: v3Agent.ok && hyperLoop.ok && repoMemory.ok,