vigthoria-cli 1.8.4 → 1.8.5

package/dist/commands/chat.d.ts

@@ -75,6 +75,11 @@ export declare class ChatCommand {
     private v3ToolCallCount;
     private v3LastActivity;
     private v3StreamingStarted;
+    /**
+     * Strip server-internal path prefixes from tool output strings.
+     * Prevents exposing paths like /var/www/V3-Code-Agent/... to end users.
+     */
+    private sanitizeServerPath;
     private describeV3AgentTool;
     private updateV3AgentSpinner;
     private updateOperatorSpinner;

package/dist/commands/chat.js

@@ -299,6 +299,20 @@ class ChatCommand {
     v3ToolCallCount = 0;
     v3LastActivity = Date.now();
     v3StreamingStarted = false;
+    /**
+     * Strip server-internal path prefixes from tool output strings.
+     * Prevents exposing paths like /var/www/V3-Code-Agent/... to end users.
+     */
+    sanitizeServerPath(text) {
+        if (!text)
+            return text;
+        // Strip common server path prefixes from output
+        return text
+            .replace(/\/var\/www\/V3-Code-Agent\//g, '')
+            .replace(/\/var\/www\/[a-zA-Z0-9_-]+\//g, '')
+            .replace(/\/tmp\/vig-remote-[a-zA-Z0-9_-]+\//g, '')
+            .replace(/\/opt\/vigthoria[a-zA-Z0-9_/-]*\//g, '');
+    }
     describeV3AgentTool(toolName) {
         const normalized = String(toolName || '').toLowerCase();
         if (/read|grep|search|list|find|glob/.test(normalized)) {
@@ -324,7 +338,8 @@ class ChatCommand {
             this.v3ToolCallCount += 1;
             const toolDesc = this.describeV3AgentTool(event.tool || event.name || event.tool_name);
             const toolTarget = event.arguments?.path || event.arguments?.file_path || event.arguments?.pattern || '';
-            const shortTarget = toolTarget ? ` → ${String(toolTarget).split('/').slice(-2).join('/')}` : '';
+            const sanitizedTarget = this.sanitizeServerPath(String(toolTarget));
+            const shortTarget = sanitizedTarget ? ` → ${sanitizedTarget.replace(/\\/g, '/').split('/').slice(-2).join('/')}` : '';
             const stepLabel = chalk_1.default.cyan(`  [${this.v3IterationCount}/${this.v3ToolCallCount}]`) + ` ${toolDesc}${shortTarget}`;
             if (spinner.isSpinning)
                 spinner.stop();
@@ -350,10 +365,12 @@ class ChatCommand {
             if (spinner.isSpinning)
                 spinner.stop();
             process.stderr.write(`${indicator} ${toolName}\n`);
-            // Show output for failures, or brief summary for successes
-            const output = typeof event.output === 'string' ? event.output.trim() : '';
+            // Show output for failures, or brief summary for successes — sanitize server paths
+            const rawOutput = typeof event.output === 'string' ? event.output.trim() : '';
+            const output = this.sanitizeServerPath(rawOutput);
             if (!success && output) {
-                const lines = output.split('\n').slice(0, 4);
+                const sanitizedError = this.sanitizeServerPath(typeof event.error === 'string' ? event.error : output);
+                const lines = sanitizedError.split('\n').slice(0, 4);
                 process.stderr.write(chalk_1.default.red(`      ${lines.join('\n      ')}\n`));
             }
             else if (success && output && output.length > 0) {
@@ -452,7 +469,8 @@ class ChatCommand {
             return;
         }
         if (event.type === 'file_mutation') {
-            const filePath = typeof event.path === 'string' ? event.path.split('/').slice(-2).join('/') : '';
+            const rawPath = typeof event.path === 'string' ? this.sanitizeServerPath(event.path) : '';
+            const filePath = rawPath ? rawPath.replace(/\\/g, '/').split('/').slice(-2).join('/') : '';
             const action = event.action === 'delete' ? chalk_1.default.red('deleted') : chalk_1.default.green('wrote');
             if (filePath) {
                 if (spinner.isSpinning)
@@ -1606,7 +1624,7 @@ class ChatCommand {
                 clientSurface: 'cli',
                 localMachineCapable: true,
                 agentTimeoutMs: DEFAULT_V3_AGENT_TIMEOUT_MS,
-                agentIdleTimeoutMs: 0,
+                agentIdleTimeoutMs: 90000,
                 model: routingPolicy.selectedModel,
                 requestedModel: this.currentModel,
                 agentExecutionPolicy: routingPolicy,
@@ -1616,9 +1634,14 @@ class ChatCommand {
                 ...runtimeContext,
                 onStreamEvent: spinner ? (event) => this.updateV3AgentSpinner(spinner, event) : undefined,
             });
-            // No hard timeout — SSE stream stays open until the server
-            // sends complete/error/[DONE]. We never cut off a working workflow.
-            const response = await workflowPromise;
+            const response = await (rescueEligible
+                ? Promise.race([
+                    workflowPromise,
+                    new Promise((_, reject) => {
+                        setTimeout(() => reject(new Error('V3_SAAS_SOFT_TIMEOUT')), 240000);
+                    }),
+                ])
+                : workflowPromise);
             if (spinner) {
                 spinner.stop();
             }

package/dist/commands/repo.d.ts

@@ -81,6 +81,14 @@ export declare class RepoCommand {
      * Delete a project from Vigthoria Repository
      */
     delete(projectName: string): Promise<void>;
+    /**
+     * Open a project in a Vigthoria engine (shop, visual, game).
+     * Pushes to community if not yet there, then triggers engine import.
+     */
+    openIn(engine: 'shop' | 'visual' | 'game', projectName?: string, options?: {
+        browser?: boolean;
+        shopId?: string;
+    }): Promise<void>;
     /**
      * Clone a public project from Vigthoria Repository
      */

package/dist/commands/repo.js

@@ -714,6 +714,64 @@ class RepoCommand {
             console.log(chalk_1.default.red(`\n❌ Error: ${errMsg}\n`));
         }
     }
+    /**
+     * Open a project in a Vigthoria engine (shop, visual, game).
+     * Pushes to community if not yet there, then triggers engine import.
+     */
+    async openIn(engine, projectName, options = {}) {
+        this.requireAuth();
+        const engineLabels = {
+            shop: 'Shop Engine',
+            visual: 'Visual Editor',
+            game: 'Gaming Engine'
+        };
+        const label = engineLabels[engine] || engine;
+        // Resolve project name from arg or current directory
+        const resolvedName = projectName || this.detectProjectInfo(process.cwd()).name;
+        const spinner = (0, logger_js_1.createSpinner)(`Opening "${resolvedName}" in ${label}...`).start();
+        try {
+            const response = await fetch(`${this.apiBase}/api/engine-import`, {
+                method: 'POST',
+                headers: this.getAuthHeaders(),
+                body: JSON.stringify({
+                    engine,
+                    projectName: resolvedName,
+                    shopId: options.shopId || 'default',
+                    source: 'repo'
+                })
+            });
+            if (!response.ok) {
+                const err = await response.json().catch(async () => ({ error: await response.text() }));
+                throw new Error(err.error || `Engine import failed (${response.status})`);
+            }
+            const data = await response.json();
+            spinner.succeed(chalk_1.default.green(`Project imported into ${label}!`));
+            console.log(chalk_1.default.cyan(`\n🚀 Open in browser:`));
+            console.log(chalk_1.default.bold(`   ${data.url}\n`));
+            if (options.browser) {
+                try {
+                    const { execSync } = await import('child_process');
+                    const platform = process.platform;
+                    if (platform === 'win32')
+                        execSync(`start "" "${data.url}"`, { stdio: 'ignore' });
+                    else if (platform === 'darwin')
+                        execSync(`open "${data.url}"`, { stdio: 'ignore' });
+                    else
+                        execSync(`xdg-open "${data.url}"`, { stdio: 'ignore' });
+                }
+                catch { /* browser open is optional */ }
+            }
+            if (data.message) {
+                console.log(chalk_1.default.gray(`   ${data.message}\n`));
+            }
+        }
+        catch (error) {
+            spinner.stop();
+            const errMsg = error instanceof Error ? error.message : 'Unknown error';
+            console.log(chalk_1.default.red(`\n❌ ${label} import failed: ${errMsg}\n`));
+            console.log(chalk_1.default.gray('Tip: Make sure your project is pushed first with `vigthoria repo push`\n'));
+        }
+    }
     /**
      * Clone a public project from Vigthoria Repository
      */

package/dist/index.js

@@ -514,6 +514,8 @@ async function main() {
         .option('-d, --description <text>', 'Project description')
         .option('-f, --force', 'Overwrite existing project', false)
         .option('-y, --yes', 'Run non-interactively with provided/default values', false)
+        .option('--open-in <engine>', 'After push, open project in engine: shop, visual, game')
+        .option('--browser', 'Open result URL in default browser', false)
         .action(async (pathArg, options) => {
         const repo = new repo_js_1.RepoCommand(config, logger);
         await repo.push({
@@ -524,6 +526,15 @@ async function main() {
             force: options.force,
             yes: options.yes
         });
+        if (options.openIn) {
+            const engine = options.openIn;
+            if (!['shop', 'visual', 'game'].includes(engine)) {
+                logger.warn(`Unknown engine "${engine}". Use: shop, visual, game`);
+            }
+            else {
+                await repo.openIn(engine, options.name || undefined, { browser: options.browser });
+            }
+        }
     });
     repoCommand
         .command('pull <name>')
@@ -582,6 +593,27 @@ async function main() {
             force: options.force
         });
     });
+    repoCommand
+        .command('open-in <engine> [projectName]')
+        .description('Open a Vigthoria Repo project in the Shop Engine, Visual Editor, or Gaming Engine')
+        .option('--browser', 'Open result URL in default browser', false)
+        .option('--shop-id <id>', 'Target shop ID (for shop engine)', 'default')
+        .addHelpText('after', `
+Examples:
+  vigthoria repo open-in shop my-store
+  vigthoria repo open-in visual my-website
+  vigthoria repo open-in game my-game --browser`)
+        .action(async (engine, projectName, options) => {
+        if (!['shop', 'visual', 'game'].includes(engine)) {
+            logger.error(`Unknown engine "${engine}". Valid options: shop, visual, game`);
+            process.exit(1);
+        }
+        const repo = new repo_js_1.RepoCommand(config, logger);
+        await repo.openIn(engine, projectName, {
+            browser: options.browser,
+            shopId: options.shopId
+        });
+    });
     // Default repo action shows help with available subcommands
     repoCommand.action(() => {
         repoCommand.outputHelp();

package/dist/utils/api.js

@@ -89,24 +89,20 @@ function formatCLIError(err) {
             return `${tag} ${err.message}`;
     }
 }
-// SSE-based architecture: NO hard timeouts. Streams stay open until
-// complete/error/disconnect. Liveness is checked via heartbeat events.
-// Set to 0 (disabled) by default. Only use a timeout as an emergency
-// safety net when explicitly configured via env vars.
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '0';
+    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '1200000';
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 1200000;
 })();
 const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS || '0';
+    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS || '90000';
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 90000;
 })();
 const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS || '0';
+    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS || '300000';
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 300000;
 })();
 class APIClient {
     client;
@@ -2736,6 +2732,7 @@ document.addEventListener('DOMContentLoaded', () => {
             && context.localMachineCapable !== false;
         const rescueEligibleSaaS = preferLocalV3
             && /(saas|dashboard|analytics|billing|team management|activity feed|login screen)/i.test(message);
+        const timeoutMs = rescueEligibleSaaS ? Math.min(baseTimeoutMs, 210000) : baseTimeoutMs;
         const maxAttempts = preferLocalV3 ? 2 : 1;
         let lastErrors = [];
         for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
@@ -2768,9 +2765,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 stream: true,
             };
             for (const baseUrl of this.getV3AgentBaseUrls(preferLocalV3)) {
-                // No hard timeout — SSE stream stays alive until server sends
-                // complete/error/[DONE] or the TCP connection drops.
                 const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
                 try {
                     const response = await this.executeV3AgentRunRequest(baseUrl, requestBody, requestExecutionContext, controller.signal);
                     if (!response.ok) {
@@ -2802,6 +2798,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                 stream: true,
                             };
                             const continueController = new AbortController();
+                            const continueTimeoutId = setTimeout(() => continueController.abort(), timeoutMs);
                             try {
                                 const continueHeaders = await this.getV3AgentHeaders();
                                 const continueResponse = await fetch(this.getV3AgentContinueUrl(baseUrl), {
@@ -2819,7 +2816,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                 break; // Fall through to normal completion with partial data
                             }
                             finally {
-                                // no timeout to clear — SSE stream ends naturally
+                                clearTimeout(continueTimeoutId);
                             }
                         }
                         // Use the final continuation data for workspace recovery
@@ -2875,6 +2872,9 @@ document.addEventListener('DOMContentLoaded', () => {
                     }
                     errors.push(`${baseUrl}: ${error?.message || String(error)}`);
                 }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
             lastErrors = errors;
             const shouldRetry = attempt < maxAttempts
@@ -2940,6 +2940,7 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async runOperatorWorkflow(message, context = {}) {
         const executionContext = await this.bindExecutionContext(context);
+        const timeoutMs = context.operatorTimeoutMs || DEFAULT_OPERATOR_TIMEOUT_MS;
         const errors = [];
         const authToken = this.config.get('authToken');
         // Collect a lightweight workspace file listing so the operator can
@@ -2947,10 +2948,8 @@ document.addEventListener('DOMContentLoaded', () => {
         const workspacePath = executionContext.workspacePath || executionContext.projectPath || executionContext.targetPath || process.cwd();
         const workspaceSummary = this.buildLocalWorkspaceSummary(workspacePath);
         for (const baseUrl of this.getOperatorBaseUrls()) {
-            // No hard timeout — SSE stream stays open until result/error/disconnect.
-            // BMAD sends heartbeat events every 15s; if the TCP connection drops,
-            // the fetch will throw naturally.
             const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
             try {
                 const response = await fetch(this.getOperatorStreamUrl(baseUrl), {
                     method: 'POST',
@@ -3089,8 +3088,16 @@ document.addEventListener('DOMContentLoaded', () => {
                 };
             }
             catch (error) {
+                const isAbort = error?.name === 'AbortError' || error?.code === 'ABORT_ERR';
+                if (isAbort) {
+                    const mins = Math.round(timeoutMs / 60000);
+                    throw new CLIError(`Operator workflow timed out after ${mins} minute(s). You can increase the timeout with VIGTHORIA_OPERATOR_TIMEOUT_MS.`, 'timeout', error);
+                }
                 errors.push(`${baseUrl}: ${error?.message || String(error)}`);
             }
+            finally {
+                clearTimeout(timeoutId);
+            }
         }
         throw new CLIError(`Operator workflow failed on all endpoints: ${errors.join(' | ')}`, 'model_backend');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.8.4",
+  "version": "1.8.5",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "main": "dist/index.js",
   "files": [
@@ -43,7 +43,8 @@
     "test:repo:live": "npm run build && node scripts/test-live-repo-e2e.js",
     "test:game:live": "npm run build && node scripts/test-live-game-push.js",
     "proof:agent": "npm run build && node scripts/proof-agent-mode.js",
-    "test:fresh-install": "node scripts/test-fresh-install.js"
+    "test:fresh-install": "node scripts/test-fresh-install.js",
+    "prepublishOnly": "npm run build && node scripts/verify-package-hygiene.js && node scripts/test-fresh-install.js"
   },
   "keywords": [
     "ai",