vigthoria-cli 1.8.19 → 1.9.2

package/dist/utils/api.js

@@ -8,11 +8,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.APIClient = exports.CLIError = void 0;
+exports.handleApiError = handleApiError;
+exports.handleAuthError = handleAuthError;
+exports.propagateError = propagateError;
 exports.classifyError = classifyError;
 exports.formatCLIError = formatCLIError;
 exports.sanitizeUserFacingErrorText = sanitizeUserFacingErrorText;
 exports.isServerRuntime = isServerRuntime;
 exports.describeUpstreamStatus = describeUpstreamStatus;
+exports.validateJwtExpiry = validateJwtExpiry;
+exports.validateJwt = validateJwt;
+exports.refreshJwtIfNeeded = refreshJwtIfNeeded;
+exports.createApiClient = createApiClient;
 const axios_1 = __importDefault(require("axios"));
 const crypto_1 = require("crypto");
 const fs_1 = __importDefault(require("fs"));
@@ -20,25 +27,202 @@ const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
 const path_1 = __importDefault(require("path"));
 const ws_1 = __importDefault(require("ws"));
+const logger_js_1 = require("./logger.js");
+const context_ranker_js_1 = require("./context-ranker.js");
+const post_write_validator_js_1 = require("./post-write-validator.js");
+const workspace_cache_js_1 = require("./workspace-cache.js");
 class CLIError extends Error {
     category;
     statusCode;
     endpoint;
+    code;
+    details;
+    isCritical;
     constructor(message, category, opts) {
         super(message);
         this.name = 'CLIError';
         this.category = category;
         this.statusCode = opts?.statusCode;
         this.endpoint = opts?.endpoint;
+        this.code = category === 'auth' || category === 'repo_session' ? 'AUTH_REQUIRED' : category.toUpperCase();
+        this.details = { status: opts?.statusCode, endpoint: opts?.endpoint };
+        this.isCritical = category === 'auth' || category === 'repo_session' || category === 'model_backend' || Boolean(opts?.statusCode && opts.statusCode >= 500);
         if (opts?.cause)
             this.cause = opts.cause;
     }
 }
 exports.CLIError = CLIError;
+function toCliError(error, fallbackCode = 'API_ERROR', fallbackMessage = 'API request failed') {
+    if (isCliError(error))
+        return error;
+    const axErr = error;
+    const status = axErr?.response?.status;
+    const fetchStatus = typeof error?.status === 'number' ? error.status : undefined;
+    const effectiveStatus = status ?? fetchStatus;
+    const data = axErr?.response?.data;
+    const message = typeof data?.error === 'string'
+        ? data.error
+        : typeof data?.message === 'string'
+            ? data.message
+            : error instanceof Error && error.message
+                ? error.message
+                : fallbackMessage;
+    const code = effectiveStatus === 401 || effectiveStatus === 403
+        ? 'AUTH_REQUIRED'
+        : effectiveStatus && effectiveStatus >= 500
+            ? 'SERVER_ERROR'
+            : /timeout|ETIMEDOUT|ESOCKETTIMEDOUT|aborted/i.test(message)
+                ? 'TIMEOUT'
+                : /ECONNREFUSED|ENOTFOUND|ENETUNREACH|EAI_AGAIN|fetch failed/i.test(message)
+                    ? 'NETWORK_ERROR'
+                    : fallbackCode;
+    return {
+        code,
+        message,
+        details: {
+            status: effectiveStatus,
+            endpoint: axErr?.config?.url || axErr?.config?.baseURL,
+            data,
+        },
+        isCritical: code === 'AUTH_REQUIRED' || code === 'AUTH_REFRESH_FAILED' || code === 'SERVER_ERROR' || fallbackCode === 'API_ERROR',
+    };
+}
+function isCliError(error) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && 'message' in error && 'isCritical' in error);
+}
+function isRetryableApiError(error) {
+    const status = error instanceof CLIError
+        ? error.statusCode
+        : typeof error.details?.status === 'number'
+            ? error.details.status
+            : undefined;
+    const code = String(error.code || '').toUpperCase();
+    const message = String(error.message || '');
+    if (status === 401 || status === 403)
+        return false;
+    if (status !== undefined && status >= 500)
+        return true;
+    return code === 'TIMEOUT'
+        || code === 'NETWORK_ERROR'
+        || /timeout|timed out|ECONNRESET|ECONNREFUSED|ENOTFOUND|ENETUNREACH|EAI_AGAIN/i.test(message);
+}
+function decodeJwtPayload(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts[1])
+            return null;
+        const normalized = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');
+        const decoded = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
+        return decoded && typeof decoded === 'object' ? decoded : null;
+    }
+    catch (error) {
+        return null;
+    }
+}
+function getJwtExpiresAt(token) {
+    if (!token)
+        return null;
+    const payload = decodeJwtPayload(token);
+    const exp = payload?.exp;
+    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;
+}
+const JWT_EXPIRY_SKEW_MS = 30_000;
+function isJwtUsable(token) {
+    const expiresAt = getJwtExpiresAt(token);
+    return Boolean(token && expiresAt !== null && Date.now() + JWT_EXPIRY_SKEW_MS < expiresAt);
+}
+function isJwtExpired(token) {
+    const expiresAt = getJwtExpiresAt(token);
+    return Boolean(token && expiresAt !== null && Date.now() + JWT_EXPIRY_SKEW_MS >= expiresAt);
+}
+function shouldAttemptJwtRefresh(token) {
+    return Boolean(token && (!isJwtUsable(token) || isJwtExpired(token)));
+}
+function wrapApiError(error, fallbackCode = 'API_ERROR', fallbackMessage = 'API request failed') {
+    const cliError = toCliError(error, fallbackCode, fallbackMessage);
+    return { ...cliError, details: { ...(cliError.details || {}), retryable: isRetryableApiError(cliError) } };
+}
+function handleApiError(error) {
+    return wrapApiError(error, 'API_ERROR', 'API request failed');
+}
+function handleAuthError(error) {
+    const cliError = toCliError(error, 'AUTH_ERROR', 'Authentication failed. Please run: vigthoria login');
+    if (cliError.code === 'AUTH_REQUIRED' || cliError.code === 'AUTH_ERROR') {
+        return { ...cliError, code: 'AUTH_REQUIRED', message: cliError.message || 'Authentication failed. Please run: vigthoria login', isCritical: true };
+    }
+    return cliError;
+}
+function propagateError(err) {
+    const responseData = err?.response?.data;
+    const existingDetails = err?.details && typeof err.details === 'object' ? err.details : {};
+    const status = typeof err?.response?.status === 'number'
+        ? err.response.status
+        : typeof err?.status === 'number'
+            ? err.status
+            : typeof err?.statusCode === 'number'
+                ? err.statusCode
+                : typeof existingDetails.status === 'number'
+                    ? existingDetails.status
+                    : typeof err?.code === 'number'
+                        ? err.code
+                        : 500;
+    const endpoint = err?.endpoint || err?.config?.url || err?.config?.baseURL || existingDetails.endpoint || 'unknown';
+    const command = err?.commandName || err?.command || existingDetails.command || 'unknown';
+    const message = typeof responseData?.error === 'string'
+        ? responseData.error
+        : typeof responseData?.message === 'string'
+            ? responseData.message
+            : typeof err?.message === 'string' && err.message
+                ? err.message
+                : 'API request failed';
+    const originalCode = err?.code;
+    const isAuthError = status === 401
+        || status === 403
+        || err?.isAuthError === true
+        || String(originalCode || '').toUpperCase() === 'AUTH_REQUIRED';
+    const apiError = {
+        code: status,
+        message,
+        details: {
+            ...existingDetails,
+            command,
+            endpoint,
+            status,
+            data: responseData ?? existingDetails.data,
+            originalCode,
+            originalName: err?.name,
+        },
+        isAuthError,
+    };
+    const logPayload = {
+        code: apiError.code,
+        message: apiError.message,
+        command,
+        endpoint,
+        status,
+        isAuthError: apiError.isAuthError,
+    };
+    try {
+        console.error('[Vigthoria API Error]', JSON.stringify(logPayload));
+    }
+    catch {
+        console.error('[Vigthoria API Error]', logPayload);
+    }
+    throw apiError;
+}
 /** Classify an axios or fetch error into a structured CLIError. */
 function classifyError(error, fallbackCategory = 'network') {
     if (error instanceof CLIError)
         return error;
+    const structuredApiError = error;
+    if (structuredApiError && typeof structuredApiError.code === 'number' && typeof structuredApiError.message === 'string') {
+        return new CLIError(structuredApiError.message, structuredApiError.isAuthError ? 'auth' : structuredApiError.code >= 500 ? 'model_backend' : fallbackCategory, {
+            statusCode: structuredApiError.code,
+            endpoint: typeof structuredApiError.details?.endpoint === 'string' ? structuredApiError.details.endpoint : undefined,
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
     const axErr = error;
     const status = axErr?.response?.status;
     const endpoint = axErr?.config?.url || axErr?.config?.baseURL || '';
@@ -130,6 +314,114 @@ function describeUpstreamStatus(status) {
         return 'Request was rejected by the service.';
     return 'Unexpected response from service.';
 }
+const JWT_VALIDATE_EXPIRY_SKEW_MS = 60_000;
+function validateJwtExpiry(token) {
+    if (!token || typeof token !== 'string')
+        return false;
+    const payload = decodeJwtPayload(token);
+    const exp = payload?.exp;
+    if (typeof exp !== 'number' || !Number.isFinite(exp))
+        return false;
+    return Date.now() + JWT_VALIDATE_EXPIRY_SKEW_MS < exp * 1000;
+}
+function validateJwt(token) {
+    if (!token || typeof token !== 'string')
+        return null;
+    const payload = decodeJwtPayload(token);
+    if (!payload)
+        return null;
+    try {
+        if (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp))
+            return null;
+        if (!validateJwtExpiry(token))
+            return null;
+        return payload;
+    }
+    catch (error) {
+        if (process.env.VIGTHORIA_DEBUG_JWT === '1') {
+            // Avoid logging token contents; only expose parser failure class for diagnostics.
+            console.debug('Failed to validate JWT payload:', error instanceof Error ? error.message : String(error));
+        }
+        return null;
+    }
+}
+async function refreshJwtIfNeeded(state) {
+    const runtimeClient = state;
+    try {
+        const currentToken = runtimeClient.getAccessToken?.() || runtimeClient.config?.get('authToken') || state.token;
+        if (!currentToken) {
+            state.token = null;
+            state.expiresAt = null;
+            return null;
+        }
+        const decodedExpiresAt = getJwtExpiresAt(currentToken);
+        state.token = currentToken;
+        state.expiresAt = decodedExpiresAt;
+        const expired = (typeof state.isExpired === 'function' ? state.isExpired() : shouldAttemptJwtRefresh(currentToken)) || decodedExpiresAt === null;
+        if (!expired) {
+            return currentToken;
+        }
+        const refreshToken = runtimeClient.getRefreshToken?.() || runtimeClient.config?.get('refreshToken');
+        if (refreshToken && runtimeClient.refreshToken) {
+            const refreshed = await runtimeClient.refreshToken().catch((error) => {
+                runtimeClient.logger?.debug?.(`JWT refresh request failed: ${error instanceof Error ? error.message : String(error)}`);
+                throw error;
+            });
+            const nextToken = runtimeClient.getAccessToken?.() || runtimeClient.config?.get('authToken') || null;
+            if (refreshed && nextToken && validateJwtExpiry(nextToken)) {
+                state.token = nextToken;
+                state.expiresAt = getJwtExpiresAt(nextToken);
+                return nextToken;
+            }
+            runtimeClient.logger?.debug?.('JWT refresh endpoint did not return a usable replacement token');
+        }
+        state.token = null;
+        state.expiresAt = null;
+        runtimeClient.config?.clearAuth();
+        throw new CLIError('Authentication token is expired or invalid. Please run: vigthoria login', 'auth');
+    }
+    catch (error) {
+        if (error instanceof CLIError) {
+            throw error;
+        }
+        const cliError = toCliError(error, 'AUTH_REFRESH_FAILED', 'Authentication refresh failed. Please run: vigthoria login');
+        state.token = null;
+        state.expiresAt = null;
+        runtimeClient.config?.clearAuth();
+        throw new CLIError(cliError.message, 'auth', {
+            statusCode: typeof cliError.details?.status === 'number' ? cliError.details.status : undefined,
+            endpoint: typeof cliError.details?.endpoint === 'string' ? cliError.details.endpoint : undefined,
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+}
+function createApiClient(config) {
+    const apiClient = new APIClient(config, new logger_js_1.Logger());
+    return {
+        get: async (path) => {
+            try {
+                const response = await apiClient.client.get(path);
+                return response.data;
+            }
+            catch (err) {
+                propagateError(err);
+            }
+        },
+        post: async (path, body) => {
+            try {
+                const response = await apiClient.client.post(path, body);
+                return response.data;
+            }
+            catch (err) {
+                propagateError(err);
+            }
+        },
+        handleAuthError: (err) => {
+            const authError = handleAuthError(err);
+            throw new CLIError(authError.message, 'auth', { cause: err instanceof Error ? err : undefined });
+        },
+    };
+}
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '1200000';
     const parsed = Number.parseInt(rawValue, 10);
@@ -140,6 +432,11 @@ const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
     const parsed = Number.parseInt(rawValue, 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : 90000;
 })();
+const DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_AGENT_SOFT_TIMEOUT_MS || process.env.V3_AGENT_SOFT_TIMEOUT_MS || '300000';
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 300000;
+})();
 const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
     const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS || '300000';
     const parsed = Number.parseInt(rawValue, 10);
@@ -150,6 +447,8 @@ class APIClient {
     modelRouterClient;
     selfHostedModelRouterClient;
     config;
+    token = null;
+    expiresAt = null;
     logger;
     ws = null;
     vigFlowTokens = new Map();
@@ -193,41 +492,77 @@ class APIClient {
                 'User-Agent': `Vigthoria-CLI/${process.env.npm_package_version || '1.6.9'}`,
             },
         }) : null;
-        // Add auth interceptor
-        this.client.interceptors.request.use((req) => {
-            const token = this.config.get('authToken');
-            if (token) {
-                req.headers.Authorization = `Bearer ${token}`;
-                req.headers.Cookie = `vigthoria-auth-token=${token}`;
-            }
-            return req;
-        });
-        this.modelRouterClient.interceptors.request.use((req) => {
-            const token = this.config.get('authToken');
-            if (token) {
-                req.headers.Authorization = `Bearer ${token}`;
-                req.headers.Cookie = `vigthoria-auth-token=${token}`;
-            }
-            return req;
-        });
-        this.selfHostedModelRouterClient?.interceptors.request.use((req) => {
-            const token = this.config.get('authToken');
-            if (token) {
-                req.headers.Authorization = `Bearer ${token}`;
-            }
-            return req;
-        });
-        // Add response interceptors for token refresh + structured errors
+        // Add auth interceptors that validate JWT expiry before every request.
+        const createAuthRequestInterceptor = (client, includeCookie) => {
+            client.interceptors.request.use(async (req) => {
+                const skipAuthRefresh = Boolean(req.__skipAuthRefresh) || req.url?.includes('/api/token/refresh') || req.url?.includes('/api/login');
+                if (!skipAuthRefresh) {
+                    await refreshJwtIfNeeded(this);
+                }
+                const token = this.getAccessToken();
+                if (token) {
+                    const payload = validateJwt(token);
+                    if (!payload && !skipAuthRefresh) {
+                        throw new CLIError('Authentication token is expired or invalid. Please run: vigthoria login', 'auth', { endpoint: req.url });
+                    }
+                    req.headers.Authorization = `Bearer ${token}`;
+                    if (includeCookie) {
+                        req.headers.Cookie = `vigthoria-auth-token=${token}`;
+                    }
+                }
+                return req;
+            });
+        };
+        createAuthRequestInterceptor(this.client, true);
+        createAuthRequestInterceptor(this.modelRouterClient, true);
+        if (this.selfHostedModelRouterClient) {
+            createAuthRequestInterceptor(this.selfHostedModelRouterClient, false);
+        }
+        // Add response interceptors for token refresh + structured errors.
         const createAuthRetryInterceptor = (client) => {
             client.interceptors.response.use((res) => res, async (error) => {
-                if (error.response?.status === 401) {
-                    const refreshed = await this.refreshToken();
-                    if (refreshed && error.config) {
-                        return client.request(error.config);
+                const originalConfig = error.config;
+                try {
+                    if (error.response?.status === 401) {
+                        if (originalConfig?.__authRetry) {
+                            throw new CLIError('Authentication failed after token refresh. Please run: vigthoria login', 'auth', {
+                                statusCode: 401,
+                                endpoint: originalConfig.url,
+                                cause: error instanceof Error ? error : undefined,
+                            });
+                        }
+                        const refreshedToken = await refreshJwtIfNeeded(this);
+                        if (refreshedToken && originalConfig) {
+                            originalConfig.__authRetry = true;
+                            const token = refreshedToken;
+                            if (token) {
+                                originalConfig.headers = originalConfig.headers || {};
+                                originalConfig.headers.Authorization = `Bearer ${token}`;
+                                originalConfig.headers.Cookie = `vigthoria-auth-token=${token}`;
+                            }
+                            return client.request(originalConfig);
+                        }
+                        throw new CLIError('Authentication token expired or was rejected. Please run: vigthoria login', 'auth', {
+                            statusCode: 401,
+                            endpoint: originalConfig?.url,
+                            cause: error instanceof Error ? error : undefined,
+                        });
                     }
-                    throw classifyError(error, 'auth');
+                    throw classifyError(error);
+                }
+                catch (interceptorError) {
+                    if (interceptorError instanceof CLIError) {
+                        throw interceptorError;
+                    }
+                    const authError = error.response?.status === 401
+                        ? handleAuthError(interceptorError)
+                        : toCliError(interceptorError, 'API_ERROR', 'API request failed');
+                    throw new CLIError(authError.message, authError.code === 'AUTH_REQUIRED' ? 'auth' : 'network', {
+                        statusCode: error.response?.status,
+                        endpoint: originalConfig?.url,
+                        cause: interceptorError instanceof Error ? interceptorError : error,
+                    });
                 }
-                throw classifyError(error);
             });
         };
         createAuthRetryInterceptor(this.client);
@@ -340,6 +675,7 @@ class APIClient {
                 });
                 return true;
             }
+            this.logger.warn('Token validation failed: no profile endpoint or JWT identity claim matched');
             this.config.clearAuth();
             return false;
         }
@@ -398,9 +734,11 @@ class APIClient {
             }
             return true;
         }
-        catch {
+        catch (error) {
+            const cliError = toCliError(error, 'AUTH_REFRESH_FAILED', 'Failed to refresh authentication token');
+            this.logger.debug(`Token refresh failed: ${cliError.message}`);
             this.config.clearAuth();
-            return false;
+            throw cliError;
         }
     }
     async getSubscriptionStatus() {
@@ -435,22 +773,12 @@ class APIClient {
         if (!token) {
             return { valid: false, error: 'No auth token configured. Run: vigthoria login' };
         }
-        // Verify auth against the Model Router (api.vigthoria.io) which is
-        // the backend all AI commands actually use.  Falls back to the Coder
-        // profile endpoint when the Model Router is unreachable so that
-        // offline/degraded scenarios don't block the user.
-        try {
-            await this.modelRouterClient.get('/v1/models', { timeout: 10000 });
-            return { valid: true };
-        }
-        catch (mrError) {
-            const mrAxErr = mrError;
-            if (mrAxErr.response?.status === 401 || mrAxErr.response?.status === 403) {
-                return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
-            }
-            // Model Router unreachable — try Coder profile as fallback
+        // Validate against authenticated Coder endpoints so we verify
+        // the actual Vigthoria Gateway user session state.
+        const authEndpoints = ['/api/user/profile', '/api/user/subscription'];
+        for (const endpoint of authEndpoints) {
             try {
-                await this.client.get('/api/user/profile', { timeout: 10000 });
+                await this.client.get(endpoint, { timeout: 10000 });
                 return { valid: true };
             }
             catch (error) {
@@ -461,14 +789,19 @@ class APIClient {
                 if (axErr.response?.status === 401 || axErr.response?.status === 403) {
                     return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
                 }
-                // Both unreachable — don't assume token is bad
-                return { valid: true };
+                // Try the next authenticated endpoint before deciding this is
+                // a transient network/backend issue.
+                continue;
             }
         }
+        // Auth endpoints unreachable — do not misclassify as invalid token.
+        return { valid: true };
     }
     getV3AgentBaseUrls(preferLocal = false) {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocalV3Agent = process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1' || preferLocal;
+        const allowLocalV3Agent = process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1'
+            || this.allowLocalServiceFallbacks()
+            || preferLocal;
         const urls = [
             process.env.VIGTHORIA_V3_AGENT_URL,
             process.env.V3_AGENT_URL,
@@ -494,7 +827,7 @@ class APIClient {
         const urls = [
             process.env.VIGTHORIA_OPERATOR_URL,
             process.env.OPERATOR_URL,
-            'http://127.0.0.1:4009',
+            ...(this.allowLocalServiceFallbacks() ? ['http://127.0.0.1:4009'] : []),
             configuredModelsApiUrl,
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
@@ -507,7 +840,7 @@ class APIClient {
         const urls = [
             process.env.VIGTHORIA_MCP_URL,
             process.env.MCP_SERVER_URL,
-            'http://127.0.0.1:4008',
+            ...(this.allowLocalServiceFallbacks() ? ['http://127.0.0.1:4008'] : []),
             configuredApiUrl,
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
@@ -525,8 +858,7 @@ class APIClient {
             process.env.VIGFLOW_URL,
             process.env.WORKFLOW_BUILDER_URL,
             `${configuredApiUrl}/api/vigflow`,
-            'http://127.0.0.1:5060',
-            'http://127.0.0.1:5050',
+            ...(this.allowLocalServiceFallbacks() ? ['http://127.0.0.1:5060', 'http://127.0.0.1:5050'] : []),
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
@@ -535,11 +867,14 @@ class APIClient {
         const urls = [
             process.env.VIGTHORIA_TEMPLATE_SERVICE_URL,
             process.env.TEMPLATE_SERVICE_URL,
-            'http://127.0.0.1:4011',
+            ...(this.allowLocalServiceFallbacks() ? ['http://127.0.0.1:4011'] : []),
             `${configuredApiUrl}/api/template-service`,
         ].filter(Boolean).map((url) => String(url).replace(/\/$/, ''));
         return [...new Set(urls)];
     }
+    allowLocalServiceFallbacks() {
+        return process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1' || isServerRuntime();
+    }
     isFrontendTask(message = '', context = {}) {
         // Never treat analysis-only tasks as frontend tasks — preview gate
         // should not fire for read-only inspection prompts.
@@ -914,6 +1249,12 @@ class APIClient {
             'Content-Type': 'application/json',
             Accept: 'application/json',
         };
+        try {
+            await refreshJwtIfNeeded(this);
+        }
+        catch (error) {
+            throw toCliError(error, 'AUTH_REFRESH_FAILED', 'Failed to refresh authentication token before API request');
+        }
         const authToken = this.getAccessToken();
         if (authToken) {
             headers.Authorization = `Bearer ${authToken}`;
@@ -925,6 +1266,12 @@ class APIClient {
         const headers = {
             'Content-Type': 'application/json',
         };
+        try {
+            await refreshJwtIfNeeded(this);
+        }
+        catch (error) {
+            throw toCliError(error, 'AUTH_REFRESH_FAILED', 'Failed to refresh authentication token before API request');
+        }
         const authToken = this.getAccessToken();
         if (authToken) {
             headers.Authorization = `Bearer ${authToken}`;
@@ -1142,7 +1489,9 @@ class APIClient {
         const targetPath = resolvedContext.targetPath || resolvedContext.projectPath || resolvedContext.workspacePath || resolvedContext.projectRoot || process.cwd();
         const localWorkspacePath = this.resolveAgentTargetPath(resolvedContext);
         const serverWorkspacePath = this.resolveServerBindableWorkspacePath(resolvedContext);
-        const localWorkspaceSummary = this.buildLocalWorkspaceSummary(localWorkspacePath);
+        const localWorkspaceSummary = resolvedContext.rawPrompt
+            ? this.buildSemanticWorkspaceSummary(localWorkspacePath, String(resolvedContext.rawPrompt))
+            : this.buildLocalWorkspaceSummary(localWorkspacePath);
         const requestedModel = String(resolvedContext.model || resolvedContext.requestedModel || 'agent');
         const resolvedModel = this.resolvePermittedModelId(requestedModel);
         // When the server cannot directly access the workspace (e.g. Windows
@@ -1470,6 +1819,14 @@ class APIClient {
      * Budget: up to ~2 MB total, per-file cap 200 KB, skip binary extensions.
      */
     collectWorkspaceFileContents(rootPath, filePaths) {
+        // Prioritise files that changed since last agent run — budget goes to them first.
+        if (rootPath && filePaths.length > 0) {
+            try {
+                const { changed, unchanged } = (0, workspace_cache_js_1.getChangedFiles)(rootPath, filePaths);
+                filePaths = [...changed, ...unchanged];
+            }
+            catch { /* non-fatal */ }
+        }
         const MAX_TOTAL_BYTES = 2 * 1024 * 1024;
         const MAX_FILE_BYTES = 200 * 1024;
         const BINARY_EXTENSIONS = new Set([
@@ -2335,6 +2692,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const rescueEligibleSaaS = preferLocalV3
             && /(saas|dashboard|analytics|billing|team management|activity feed|login screen)/i.test(message);
         const timeoutMs = rescueEligibleSaaS ? Math.min(baseTimeoutMs, 210000) : baseTimeoutMs;
+        const softTimeoutMs = executionContext.agentSoftTimeoutMs || DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS;
         const maxAttempts = preferLocalV3 ? 2 : 1;
         let lastErrors = [];
         for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
@@ -2369,6 +2727,7 @@ document.addEventListener('DOMContentLoaded', () => {
             for (const baseUrl of this.getV3AgentBaseUrls(preferLocalV3)) {
                 const controller = new AbortController();
                 const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+                const softTimeoutId = softTimeoutMs > 0 ? setTimeout(() => controller.abort(), softTimeoutMs) : null;
                 try {
                     const response = await this.executeV3AgentRunRequest(baseUrl, requestBody, requestExecutionContext, controller.signal);
                     clearTimeout(timeoutId);
@@ -2402,6 +2761,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             };
                             const continueController = new AbortController();
                             const continueTimeoutId = setTimeout(() => continueController.abort(), timeoutMs);
+                            const continueSoftTimeoutId = softTimeoutMs > 0 ? setTimeout(() => continueController.abort(), softTimeoutMs) : null;
                             try {
                                 const continueHeaders = await this.getV3AgentHeaders();
                                 const continueResponse = await fetch(this.getV3AgentContinueUrl(baseUrl), {
@@ -2421,6 +2781,9 @@ document.addEventListener('DOMContentLoaded', () => {
                             }
                             finally {
                                 clearTimeout(continueTimeoutId);
+                                if (continueSoftTimeoutId) {
+                                    clearTimeout(continueSoftTimeoutId);
+                                }
                             }
                         }
                         // Use the final continuation data for workspace recovery
@@ -2475,6 +2838,9 @@ document.addEventListener('DOMContentLoaded', () => {
                 }
                 finally {
                     clearTimeout(timeoutId);
+                    if (softTimeoutId) {
+                        clearTimeout(softTimeoutId);
+                    }
                 }
             }
             lastErrors = errors;
@@ -2556,7 +2922,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             workspace: { path: workspacePath },
                             workspace_path: workspacePath,
                             workspace_summary: workspaceSummary,
-                            model: this.resolveModelId(executionContext.model || 'code-8b'),
+                            model: this.resolveModelId(executionContext.model || 'code-9b'),
                             history: executionContext.history || [],
                             executionSurface: executionContext.executionSurface || 'cli',
                             clientSurface: executionContext.clientSurface || 'cli',
@@ -2731,7 +3097,7 @@ document.addEventListener('DOMContentLoaded', () => {
         if (!this.shouldSkipCloudRoutes(resolvedModel)) {
             try {
                 this.logger.debug(`Direct Vigthoria Models API: ${resolvedModel}`);
-                const token = this.config.get('authToken');
+                const token = this.getAccessToken();
                 const response = await this.modelRouterClient.post('/v1/chat/completions', {
                     model: resolvedModel,
                     messages,
@@ -2845,20 +3211,18 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     getFallbackModelId(resolvedModel) {
         const cloudModels = new Set([
-            'deepseek-v3.1:671b-cloud',
             'moonshotai/kimi-k2.5',
             'vigthoria-cloud-pro',
             'vigthoria-cloud-k2',
             'vigthoria-cloud-ultra',
         ]);
         if (cloudModels.has(resolvedModel)) {
-            return 'vigthoria-v3-code-30b';
+            return 'vigthoria-v3-code-35b';
         }
         return null;
     }
     isCloudModelId(resolvedModel) {
-        return resolvedModel === 'deepseek-v3.1:671b-cloud'
-            || resolvedModel === 'moonshotai/kimi-k2.5'
+        return resolvedModel === 'moonshotai/kimi-k2.5'
             || resolvedModel === 'vigthoria-cloud-pro'
             || resolvedModel === 'vigthoria-cloud-k2'
             || resolvedModel === 'vigthoria-cloud-ultra';
@@ -2868,11 +3232,25 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     resolvePermittedModelId(shortName) {
         const resolvedModel = this.resolveModelId(shortName);
+        const requested = String(shortName || '').toLowerCase();
         if (this.isCloudModelId(resolvedModel) && !this.canUseCloudModel()) {
             const fallbackModel = this.getSelfHostedFallbackModelId(resolvedModel, shortName);
             this.logger.debug(`Blocked unauthorized cloud model ${shortName}; using fallback ${fallbackModel}`);
             return fallbackModel;
         }
+        const blockedRequestedModels = new Set(['fast', 'mini', 'creative', 'creative-v3', 'creative-v4']);
+        const blockedResolvedModels = new Set([
+            'vigthoria-creative-9b-v4',
+            'vigthoria-fast-1.7b',
+            'vigthoria-mini-0.6b',
+            'vigthoria_p1_m',
+            'vigthoria_r1_s'
+        ]);
+        if (blockedRequestedModels.has(requested) || blockedResolvedModels.has(resolvedModel)) {
+            const fallbackModel = 'vigthoria-v3-code-35b';
+            this.logger.warn(`Model ${shortName} is not permitted for CLI operational workflows; using ${fallbackModel}`);
+            return fallbackModel;
+        }
         return resolvedModel;
     }
     shouldSimulateCloudFailure() {
@@ -2891,27 +3269,29 @@ document.addEventListener('DOMContentLoaded', () => {
     isSelfHostedPreferredModel(resolvedModel, requestedModel) {
         const normalizedRequested = String(requestedModel || '').toLowerCase();
         const selfHostedModels = new Set([
-            'vigthoria-v3-code-30b',
-            'vigthoria-v3-code-30b:latest',
+            'vigthoria-v3-code-35b',
+            'vigthoria-v3-code-35b:latest',
             'qwen3-coder:latest',
-            'vigthoria-v2-code-8b',
+            'vigthoria_c1_m',
         ]);
         return selfHostedModels.has(resolvedModel)
             || normalizedRequested === 'agent'
             || normalizedRequested === 'code'
-            || normalizedRequested === 'code-30b'
+            || normalizedRequested === 'code-35b'
+            || normalizedRequested === 'code-35b'
+            || normalizedRequested === 'code-9b'
             || normalizedRequested === 'pro';
     }
     getSelfHostedFallbackModelId(resolvedModel, requestedModel) {
         if (this.isSelfHostedPreferredModel(resolvedModel, requestedModel)) {
-            return resolvedModel === 'qwen3-coder:latest' ? 'vigthoria-v3-code-30b' : resolvedModel;
+            return resolvedModel === 'qwen3-coder:latest' ? 'vigthoria-v3-code-35b' : resolvedModel;
         }
-        return 'vigthoria-v3-code-30b';
+        return 'vigthoria-v3-code-35b';
     }
     // Streaming chat
     async *chatStream(messages, model) {
         const wsUrl = this.config.get('wsUrl');
-        const token = this.config.get('authToken');
+        const token = this.getAccessToken();
         return new Promise((resolve, reject) => {
             const ws = new ws_1.default(`${wsUrl}/chat`, {
                 headers: { Authorization: `Bearer ${token}` },
@@ -2940,7 +3320,7 @@ document.addEventListener('DOMContentLoaded', () => {
     // Non-streaming alternative with callback
     async chatWithCallback(messages, model, onChunk, onDone, onError) {
         const wsUrl = this.config.get('wsUrl');
-        const token = this.config.get('authToken');
+        const token = this.getAccessToken();
         return new Promise((resolve, reject) => {
             const ws = new ws_1.default(`${wsUrl}/chat`, {
                 headers: { Authorization: `Bearer ${token}` },
@@ -2989,7 +3369,7 @@ document.addEventListener('DOMContentLoaded', () => {
     // (/v1/chat/completions on api.vigthoria.io) which is the only
     // backend that reliably accepts our auth token.
     async chatComplete(systemPrompt, userPrompt, model, maxTokens) {
-        const resolvedModel = model ? this.resolvePermittedModelId(model) : 'vigthoria-v3-code-30b';
+        const resolvedModel = model ? this.resolvePermittedModelId(model) : 'vigthoria-v3-code-35b';
         const response = await this.modelRouterClient.post('/v1/chat/completions', {
             model: resolvedModel,
             messages: [
@@ -3730,23 +4110,116 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     // Model resolution - maps Vigthoria model names to internal IDs
     // INTERNAL USE ONLY - users see only Vigthoria branding
+    /**
+     * Build workspace summary re-ordered by semantic relevance to the prompt.
+     * Changed files are listed first, then keyword-matched files, then the rest.
+     * Falls back to plain buildLocalWorkspaceSummary when no prompt is provided.
+     */
+    buildSemanticWorkspaceSummary(workspacePath, prompt) {
+        const summary = this.buildLocalWorkspaceSummary(workspacePath);
+        if (!summary?.workspaceFiles || !prompt)
+            return summary;
+        try {
+            const { topFiles } = (0, context_ranker_js_1.buildSemanticContext)(workspacePath, prompt, 15);
+            if (topFiles.length === 0)
+                return summary;
+            const prioritySet = new Set(topFiles.map(f => f.path));
+            const allFiles = summary.workspaceFiles;
+            const reordered = {};
+            // Semantically ranked files first
+            for (const f of topFiles) {
+                if (allFiles[f.path] !== undefined)
+                    reordered[f.path] = allFiles[f.path];
+            }
+            // Remaining files after priority set
+            for (const [p, c] of Object.entries(allFiles)) {
+                if (!prioritySet.has(p))
+                    reordered[p] = c;
+            }
+            return { ...summary, workspaceFiles: reordered };
+        }
+        catch {
+            return summary;
+        }
+    }
+    /**
+     * Self-healing cycle: run post-write validators and, if errors are found,
+     * send a targeted correction prompt to the V3 agent (max one healing round).
+     *
+     * This is a best-effort operation — failures never propagate to the user as
+     * hard errors; they are surfaced as a status line in the terminal output.
+     */
+    async runSelfHealingCycle(originalPrompt, workspacePath, context = {}) {
+        // Guard: don't heal analysis tasks or recursive healing rounds
+        if (context._isHealingRound || this.isAnalysisOnlyTask(originalPrompt, context)) {
+            return { healingAttempted: false, passed: true, tool: 'none' };
+        }
+        let validations = [];
+        try {
+            validations = await (0, post_write_validator_js_1.runPostWriteValidation)(workspacePath);
+        }
+        catch {
+            return { healingAttempted: false, passed: true, tool: 'none' };
+        }
+        const failures = validations.filter(v => v.ran && !v.passed);
+        if (failures.length === 0) {
+            // All validators passed — update cache to reflect current state
+            try {
+                const { getAgentWorkspaceSnapshot } = this;
+                if (typeof getAgentWorkspaceSnapshot === 'function') {
+                    const snap = getAgentWorkspaceSnapshot.call(this, workspacePath);
+                    if (snap?.paths?.length > 0)
+                        (0, workspace_cache_js_1.updateWorkspaceCache)(workspacePath, snap.paths);
+                }
+            }
+            catch { /* non-fatal */ }
+            return { healingAttempted: false, passed: true, tool: 'none' };
+        }
+        const errorText = (0, post_write_validator_js_1.formatValidationErrors)(failures);
+        const healPrompt = `The code you just generated has the following validation errors. Fix ONLY these errors — do not change anything else:
+
+${errorText}
+
+Apply the minimum change needed to make the validator pass.`;
+        try {
+            await this.runV3AgentWorkflow(healPrompt, {
+                ...context,
+                workspacePath,
+                projectPath: workspacePath,
+                targetPath: workspacePath,
+                agentTaskType: 'debugging',
+                agentTimeoutMs: 90_000,
+                _isHealingRound: true,
+            });
+            // Re-run validators to check healing success
+            const recheck = await (0, post_write_validator_js_1.runPostWriteValidation)(workspacePath);
+            const passed = recheck.filter(r => r.ran).every(r => r.passed);
+            return { healingAttempted: true, passed, tool: failures.map(f => f.tool).join('+') };
+        }
+        catch {
+            return { healingAttempted: true, passed: false, tool: failures.map(f => f.tool).join('+') };
+        }
+    }
     resolveModelId(shortName) {
         const modelMap = {
             // ═══════════════════════════════════════════════════════════════
             // VIGTHORIA LOCAL - Self-hosted models
             // ═══════════════════════════════════════════════════════════════
-            'fast': 'vigthoria-fast-1.7b',
-            'mini': 'vigthoria-mini-0.6b',
-            'balanced': 'vigthoria-balanced-4b',
-            'creative': 'vigthoria-creative-9b-v4',
-            // Code Models - 30B is the default powerhouse
-            'code': 'vigthoria-v3-code-30b', // Internal: self-hosted 30B on Blackwell
-            'code-30b': 'vigthoria-v3-code-30b',
-            'code-8b': 'vigthoria-v2-code-8b',
-            'pro': 'vigthoria-v3-code-30b',
-            'agent': 'vigthoria-v3-code-30b',
-            'vigthoria-code': 'vigthoria-v3-code-30b',
-            'vigthoria-agent': 'vigthoria-v3-code-30b',
+            'fast': 'vigthoria-v3-code-35b',
+            'mini': 'vigthoria-v3-code-35b',
+            'balanced': 'vigthoria_master',
+            'balanced-4b': 'vigthoria-balanced-4b',
+            'creative': 'vigthoria-v3-code-35b',
+            // Code models
+            'code': 'vigthoria-v3-code-35b',
+            'code-30b': 'vigthoria-v3-code-35b',
+            'code-35b': 'vigthoria-v3-code-35b',
+            'code-8b': 'vigthoria_c1_m',
+            'code-9b': 'vigthoria_c1_m',
+            'pro': 'vigthoria-v3-code-35b',
+            'agent': 'vigthoria-v3-code-35b',
+            'vigthoria-code': 'vigthoria-v3-code-35b',
+            'vigthoria-agent': 'vigthoria-v3-code-35b',
             // ═══════════════════════════════════════════════════════════════
             // VIGTHORIA CLOUD - Premium cloud models (internal routing)
             // ═══════════════════════════════════════════════════════════════
@@ -3754,14 +4227,13 @@ document.addEventListener('DOMContentLoaded', () => {
             'cloud-reason': 'vigthoria-cloud-k2',
             'ultra': 'vigthoria-cloud-ultra',
         };
-        // If already a full model ID, return as-is
         if (shortName.includes('vigthoria') || shortName.includes('/') || shortName.includes(':')) {
             if (modelMap[shortName]) {
                 return modelMap[shortName];
             }
             return shortName;
         }
-        return modelMap[shortName] || 'vigthoria-v3-code-30b';
+        return modelMap[shortName] || 'vigthoria-v3-code-35b';
     }
     async getCoderHealth() {
         try {