vigthoria-cli 1.8.7 → 1.8.9

package/dist/commands/chat.js

@@ -49,9 +49,28 @@ const session_js_1 = require("../utils/session.js");
 const bridge_client_js_1 = require("../utils/bridge-client.js");
 const workspace_stream_js_1 = require("../utils/workspace-stream.js");
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '3900000';
+    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS;
+    if (!rawValue) {
+        return 0;
+    }
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+})();
+const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS;
+    if (!rawValue) {
+        return 0;
+    }
+    const parsed = Number.parseInt(rawValue, 10);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+})();
+const DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS = (() => {
+    const rawValue = process.env.VIGTHORIA_AGENT_SOFT_TIMEOUT_MS || process.env.V3_AGENT_SOFT_TIMEOUT_MS;
+    if (!rawValue) {
+        return 0;
+    }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : 3900000;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
 })();
 class ChatCommand {
     config;
@@ -122,13 +141,9 @@ class ChatCommand {
         return this.getDefaultChatModel();
     }
     isLegacyAgentFallbackAllowed() {
-        // CLI always has local file access, so fallback to local agent loop
-        // is safe and should be the default when V3 agent is unreachable or
-        // rejects the request (e.g. context too large).
-        if (process.env.VIGTHORIA_ALLOW_LEGACY_AGENT_FALLBACK === '0') {
-            return false;
-        }
-        return true;
+        // Hosted V3 Agent Mode must fail loudly by default so clients do not silently drop into legacy mode.
+        // Operators can still opt in during emergency local debugging.
+        return process.env.VIGTHORIA_ALLOW_LEGACY_AGENT_FALLBACK === '1';
     }
     resolveAgentExecutionPolicy(prompt) {
         const explicitModel = this.modelExplicitlySelected;
@@ -1624,7 +1639,7 @@ class ChatCommand {
                 clientSurface: 'cli',
                 localMachineCapable: true,
                 agentTimeoutMs: DEFAULT_V3_AGENT_TIMEOUT_MS,
-                agentIdleTimeoutMs: 90000,
+                agentIdleTimeoutMs: DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS,
                 model: routingPolicy.selectedModel,
                 requestedModel: this.currentModel,
                 agentExecutionPolicy: routingPolicy,
@@ -1634,11 +1649,11 @@ class ChatCommand {
                 ...runtimeContext,
                 onStreamEvent: spinner ? (event) => this.updateV3AgentSpinner(spinner, event) : undefined,
             });
-            const response = await (rescueEligible
+            const response = await (rescueEligible && DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS > 0
                 ? Promise.race([
                     workflowPromise,
                     new Promise((_, reject) => {
-                        setTimeout(() => reject(new Error('V3_SAAS_SOFT_TIMEOUT')), 240000);
+                        setTimeout(() => reject(new Error('V3_SAAS_SOFT_TIMEOUT')), DEFAULT_V3_AGENT_SOFT_TIMEOUT_MS);
                     }),
                 ])
                 : workflowPromise);
@@ -1758,13 +1773,16 @@ class ChatCommand {
                     spinner.stop();
                 }
                 this.logger.warn('Falling back to legacy CLI agent loop');
-                this.logger.debug(`V3 agent workflow unavailable: ${error.message}`);
+                this.logger.debug(`V3 agent workflow unavailable: ${(0, api_js_1.sanitizeUserFacingErrorText)(error.message || '')}`);
                 return false;
             }
             if (spinner) {
                 spinner.stop();
             }
-            const errorMessage = `Agent mode requires the V3 workflow and will not fall back to the legacy CLI loop. ${error.message}`;
+            const safeDetail = (0, api_js_1.sanitizeUserFacingErrorText)(error.message || '');
+            const errorMessage = safeDetail
+                ? `Agent mode is unavailable right now. ${safeDetail}`
+                : 'Agent mode is unavailable right now. Please retry shortly or run vigthoria login if the issue persists.';
             this.logger.error(errorMessage);
             this.messages.push({ role: 'assistant', content: errorMessage });
             if (this.jsonOutput) {

package/dist/utils/api.d.ts

@@ -186,6 +186,8 @@ export interface VigthoriUser {
         adminAccess: boolean;
     };
 }
+export declare function sanitizeUserFacingErrorText(input: string): string;
+export declare function describeUpstreamStatus(status: number): string;
 export declare class APIClient {
     private client;
     private modelRouterClient;

package/dist/utils/api.js

@@ -10,6 +10,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.APIClient = exports.CLIError = void 0;
 exports.classifyError = classifyError;
 exports.formatCLIError = formatCLIError;
+exports.sanitizeUserFacingErrorText = sanitizeUserFacingErrorText;
+exports.describeUpstreamStatus = describeUpstreamStatus;
 const axios_1 = __importDefault(require("axios"));
 const crypto_1 = require("crypto");
 const fs_1 = __importDefault(require("fs"));
@@ -90,20 +92,65 @@ function formatCLIError(err) {
     }
 }
 const DEFAULT_V3_AGENT_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS || '1200000';
+    const rawValue = process.env.VIGTHORIA_AGENT_TIMEOUT_MS || process.env.V3_AGENT_TIMEOUT_MS;
+    if (!rawValue) {
+        // No total timeout by default for long-running SSE agent workflows.
+        return 0;
+    }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : 1200000;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
 })();
 const DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS || '90000';
+    const rawValue = process.env.VIGTHORIA_AGENT_IDLE_TIMEOUT_MS || process.env.V3_AGENT_IDLE_TIMEOUT_MS;
+    if (!rawValue) {
+        // Keep stream open indefinitely unless user configures an idle limit.
+        return 0;
+    }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : 90000;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
 })();
 const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
-    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS || '300000';
+    const rawValue = process.env.VIGTHORIA_OPERATOR_TIMEOUT_MS || process.env.OPERATOR_TIMEOUT_MS;
+    if (!rawValue) {
+        // BMAD/operator flows can be long-running; do not cap by default.
+        return 0;
+    }
     const parsed = Number.parseInt(rawValue, 10);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : 300000;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
 })();
+// Sanitize an upstream error string before exposing it to the end user.
+// Strips URLs, IPs:ports, absolute server paths, and bare hostnames so the
+// CLI never reveals internal infrastructure to remote users.
+function sanitizeUserFacingErrorText(input) {
+    if (!input)
+        return '';
+    let out = String(input);
+    out = out.replace(/https?:\/\/[^\s'"<>)]+/gi, '[redacted-url]');
+    out = out.replace(/\b\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?\b/g, '[redacted-host]');
+    out = out.replace(/\b(?:localhost|127\.0\.0\.1)(?::\d+)?\b/gi, '[redacted-host]');
+    out = out.replace(/\b[a-z0-9.-]+\.vigthoria\.io\b/gi, '[redacted-host]');
+    out = out.replace(/(?:[A-Za-z]:)?[\\/](?:var|opt|tmp|home|root|etc|usr)[\\/][^\s'"<>)]*/gi, '[redacted-path]');
+    out = out.replace(/\{\s*"detail"\s*:\s*"[^"]*"\s*\}/g, '');
+    out = out.replace(/\s+/g, ' ').trim();
+    if (out.length > 160)
+        out = out.slice(0, 160) + '...';
+    return out;
+}
+function describeUpstreamStatus(status) {
+    if (status === 401 || status === 403)
+        return 'Authentication failed. Please run vigthoria login.';
+    if (status === 404)
+        return 'Requested service endpoint was not found.';
+    if (status === 408 || status === 504)
+        return 'Upstream service timed out.';
+    if (status === 429)
+        return 'Rate limit reached. Please retry shortly.';
+    if (status >= 500)
+        return 'Upstream service is temporarily unavailable.';
+    if (status >= 400)
+        return 'Request was rejected by the service.';
+    return 'Unexpected response from service.';
+}
 class APIClient {
     client;
     modelRouterClient;
@@ -793,7 +840,7 @@ class APIClient {
                 });
                 if (!response.ok) {
                     const errorText = await response.text().catch(() => '');
-                    throw new Error(`Template preview proof ${response.status}: ${errorText.slice(0, 200)}`);
+                    throw new Error(`Template preview proof ${response.status}: ${describeUpstreamStatus(response.status)}`);
                 }
                 const payload = await response.json();
                 const modes = payload?.modes || {};
@@ -1734,7 +1781,7 @@ menu {
             });
             if (!response.ok) {
                 const errorText = await response.text().catch(() => '');
-                throw new Error(`MCP context update ${response.status}: ${errorText.slice(0, 200)}`);
+                throw new Error(`MCP context update ${response.status}: ${describeUpstreamStatus(response.status)}`);
             }
             return {
                 ...executionContext,
@@ -1765,7 +1812,7 @@ menu {
                 });
                 if (!createResponse.ok) {
                     const errorText = await createResponse.text().catch(() => '');
-                    throw new Error(`MCP context create ${createResponse.status}: ${errorText.slice(0, 200)}`);
+                    throw new Error(`MCP context create ${createResponse.status}: ${describeUpstreamStatus(createResponse.status)}`);
                 }
                 const payload = await createResponse.json();
                 const mcpContextId = String(payload.contextId || '').trim();
@@ -2122,6 +2169,11 @@ menu {
         if (!looksLikeFrontendTask) {
             return;
         }
+        // Skip motion/scroll enhancements for games — they use canvas, not section-based layouts
+        const looksLikeGame = /\bgame\b|arcade|pac.?man|tetris|platformer|roguelike|breakout|pong|snake\s+game|tower\s+defense|playable/i.test(prompt);
+        if (looksLikeGame) {
+            return;
+        }
         const htmlPath = path_1.default.join(rootPath, 'index.html');
         if (!fs_1.default.existsSync(htmlPath)) {
             return;
@@ -2568,7 +2620,7 @@ document.addEventListener('DOMContentLoaded', () => {
         let contextId = response.headers.get('x-context-id') || String(context.contextId || '').trim() || null;
         let serverWorkspaceRoot = null;
         const streamedFiles = {};
-        const idleTimeoutMs = context.agentIdleTimeoutMs || DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS;
+        const idleTimeoutMs = context.agentIdleTimeoutMs ?? DEFAULT_V3_AGENT_IDLE_TIMEOUT_MS;
         while (true) {
             let chunk;
             try {
@@ -2706,7 +2758,7 @@ document.addEventListener('DOMContentLoaded', () => {
                             partial: true,
                         };
                     }
-                    throw new Error(event.message || 'V3 agent returned an error');
+                    throw new Error(`V3 agent: ${sanitizeUserFacingErrorText(event.message || '') || 'returned an error'}`);
                 }
                 if (event.type === 'complete' || event.type === 'message') {
                     final = event;
@@ -2724,15 +2776,13 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async runV3AgentWorkflow(message, context = {}) {
         const executionContext = await this.bindExecutionContext(context);
-        const baseTimeoutMs = executionContext.agentTimeoutMs || DEFAULT_V3_AGENT_TIMEOUT_MS;
+        const baseTimeoutMs = executionContext.agentTimeoutMs ?? DEFAULT_V3_AGENT_TIMEOUT_MS;
         const expectedFiles = this.extractExpectedWorkspaceFiles(message, executionContext);
         const requestedModel = String(executionContext.model || executionContext.requestedModel || 'agent');
         const resolvedModel = this.resolvePermittedModelId(requestedModel);
         const preferLocalV3 = /(premium|polished|landing|site|page|dashboard|saas|frontend|ui|responsive|animated|create the required project files and write them to the workspace)/i.test(message)
             && context.localMachineCapable !== false;
-        const rescueEligibleSaaS = preferLocalV3
-            && /(saas|dashboard|analytics|billing|team management|activity feed|login screen)/i.test(message);
-        const timeoutMs = rescueEligibleSaaS ? Math.min(baseTimeoutMs, 210000) : baseTimeoutMs;
+        const timeoutMs = baseTimeoutMs;
         const maxAttempts = preferLocalV3 ? 2 : 1;
         let lastErrors = [];
         for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
@@ -2766,12 +2816,12 @@ document.addEventListener('DOMContentLoaded', () => {
             };
             for (const baseUrl of this.getV3AgentBaseUrls(preferLocalV3)) {
                 const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+                const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
                 try {
                     const response = await this.executeV3AgentRunRequest(baseUrl, requestBody, requestExecutionContext, controller.signal);
                     if (!response.ok) {
                         const errorText = await response.text().catch(() => '');
-                        throw new Error(`V3 agent ${response.status}: ${errorText.slice(0, 200)}`);
+                        throw new Error(`V3 agent ${response.status}: ${describeUpstreamStatus(response.status)}`);
                     }
                     const data = await this.collectV3AgentStream(response, requestExecutionContext);
                     // Auto-continuation: if the agent checkpointed (budget exceeded), continue automatically
@@ -2798,7 +2848,7 @@ document.addEventListener('DOMContentLoaded', () => {
                                 stream: true,
                             };
                             const continueController = new AbortController();
-                            const continueTimeoutId = setTimeout(() => continueController.abort(), timeoutMs);
+                            const continueTimeoutId = timeoutMs > 0 ? setTimeout(() => continueController.abort(), timeoutMs) : null;
                             try {
                                 const continueHeaders = await this.getV3AgentHeaders();
                                 const continueResponse = await fetch(this.getV3AgentContinueUrl(baseUrl), {
@@ -2816,7 +2866,9 @@ document.addEventListener('DOMContentLoaded', () => {
                                 break; // Fall through to normal completion with partial data
                             }
                             finally {
-                                clearTimeout(continueTimeoutId);
+                                if (continueTimeoutId) {
+                                    clearTimeout(continueTimeoutId);
+                                }
                             }
                         }
                         // Use the final continuation data for workspace recovery
@@ -2873,7 +2925,9 @@ document.addEventListener('DOMContentLoaded', () => {
                     errors.push(`${baseUrl}: ${error?.message || String(error)}`);
                 }
                 finally {
-                    clearTimeout(timeoutId);
+                    if (timeoutId) {
+                        clearTimeout(timeoutId);
+                    }
                 }
             }
             lastErrors = errors;
@@ -2940,7 +2994,7 @@ document.addEventListener('DOMContentLoaded', () => {
     }
     async runOperatorWorkflow(message, context = {}) {
         const executionContext = await this.bindExecutionContext(context);
-        const timeoutMs = context.operatorTimeoutMs || DEFAULT_OPERATOR_TIMEOUT_MS;
+        const timeoutMs = context.operatorTimeoutMs ?? DEFAULT_OPERATOR_TIMEOUT_MS;
         const errors = [];
         const authToken = this.config.get('authToken');
         // Collect a lightweight workspace file listing so the operator can
@@ -2949,7 +3003,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const workspaceSummary = this.buildLocalWorkspaceSummary(workspacePath);
         for (const baseUrl of this.getOperatorBaseUrls()) {
             const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+            const timeoutId = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
             try {
                 const response = await fetch(this.getOperatorStreamUrl(baseUrl), {
                     method: 'POST',
@@ -2994,7 +3048,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 });
                 if (!response.ok) {
                     const errorText = await response.text().catch(() => '');
-                    throw new Error(`Operator stream ${response.status}: ${errorText.slice(0, 200)}`);
+                    throw new Error(`Operator stream ${response.status}: ${describeUpstreamStatus(response.status)}`);
                 }
                 if (!response.body || typeof response.body.getReader !== 'function') {
                     const fallbackData = await response.json();
@@ -3096,7 +3150,9 @@ document.addEventListener('DOMContentLoaded', () => {
                 errors.push(`${baseUrl}: ${error?.message || String(error)}`);
             }
             finally {
-                clearTimeout(timeoutId);
+                if (timeoutId) {
+                    clearTimeout(timeoutId);
+                }
             }
         }
         throw new CLIError(`Operator workflow failed on all endpoints: ${errors.join(' | ')}`, 'model_backend');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.8.7",
+  "version": "1.8.9",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "main": "dist/index.js",
   "files": [