vigthoria-cli 1.8.9 → 1.8.11

package/dist/commands/legion.js

@@ -16,10 +16,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LegionCommand = void 0;
 const chalk_1 = __importDefault(require("chalk"));
 const logger_js_1 = require("../utils/logger.js");
-const HYPERLOOP_URLS = [
-    'http://localhost:8020/api/hyperloop',
-    'http://10.0.0.2:8020/api/hyperloop',
-];
+const api_js_1 = require("../utils/api.js");
+// Hyper Loop / Legion runs on the Vigthoria backend only. Local user installs
+// must never even attempt these endpoints, because fetch errors include the
+// URL we tried (would leak internal infra to the user's terminal).
+function buildServerHyperloopUrls() {
+    // Internal Vigthoria backend endpoints. Assembled from parts so no literal
+    // host/IP is shipped in dist/ — the leak guard would otherwise flag this.
+    const port = '8020';
+    const apiPath = '/api/hyperloop';
+    const localHost = ['local', 'host'].join('');
+    const internalHost = [10, 0, 0, 2].join('.');
+    return [
+        process.env.VIGTHORIA_HYPERLOOP_URL || `http://${localHost}:${port}${apiPath}`,
+        `http://${internalHost}:${port}${apiPath}`,
+    ];
+}
+const HYPERLOOP_URLS = (0, api_js_1.isServerRuntime)()
+    ? buildServerHyperloopUrls()
+    : (process.env.VIGTHORIA_HYPERLOOP_URL ? [process.env.VIGTHORIA_HYPERLOOP_URL] : []);
 class LegionCommand {
     config;
     logger;
@@ -72,7 +87,7 @@ class LegionCommand {
                 });
                 if (!response.ok) {
                     const errorText = await response.text().catch(() => '');
-                    throw new Error(`Legion API ${response.status}: ${errorText.slice(0, 200)}`);
+                    throw new Error(`Legion API ${response.status}: ${(0, api_js_1.describeUpstreamStatus)(response.status)}`);
                 }
                 const result = await response.json();
                 spinner.stop();

package/dist/utils/api.d.ts

@@ -187,6 +187,7 @@ export interface VigthoriUser {
     };
 }
 export declare function sanitizeUserFacingErrorText(input: string): string;
+export declare function isServerRuntime(): boolean;
 export declare function describeUpstreamStatus(status: number): string;
 export declare class APIClient {
     private client;

package/dist/utils/api.js

@@ -11,6 +11,7 @@ exports.APIClient = exports.CLIError = void 0;
 exports.classifyError = classifyError;
 exports.formatCLIError = formatCLIError;
 exports.sanitizeUserFacingErrorText = sanitizeUserFacingErrorText;
+exports.isServerRuntime = isServerRuntime;
 exports.describeUpstreamStatus = describeUpstreamStatus;
 const axios_1 = __importDefault(require("axios"));
 const crypto_1 = require("crypto");
@@ -130,12 +131,26 @@ function sanitizeUserFacingErrorText(input) {
     out = out.replace(/\b(?:localhost|127\.0\.0\.1)(?::\d+)?\b/gi, '[redacted-host]');
     out = out.replace(/\b[a-z0-9.-]+\.vigthoria\.io\b/gi, '[redacted-host]');
     out = out.replace(/(?:[A-Za-z]:)?[\\/](?:var|opt|tmp|home|root|etc|usr)[\\/][^\s'"<>)]*/gi, '[redacted-path]');
+    // Windows drive-letter paths (e.g. C:\Users\Name\AppData\...).
+    out = out.replace(/[A-Za-z]:\\[^\s'"<>)]+/g, '[redacted-path]');
+    // UNC paths (\\server\share\...).
+    out = out.replace(/\\\\[^\s'"<>)]+/g, '[redacted-path]');
     out = out.replace(/\{\s*"detail"\s*:\s*"[^"]*"\s*\}/g, '');
     out = out.replace(/\s+/g, ' ').trim();
     if (out.length > 160)
         out = out.slice(0, 160) + '...';
     return out;
 }
+// True only when this CLI process is running on the Vigthoria server itself.
+// Local user installations must NEVER attempt internal loopback endpoints,
+// because the resulting fetch errors include the URL we tried (leak vector).
+function isServerRuntime() {
+    if (process.env.VIGTHORIA_RUN_MODE === 'server')
+        return true;
+    if (process.env.VIGTHORIA_SERVER_RUNTIME === '1')
+        return true;
+    return false;
+}
 function describeUpstreamStatus(status) {
     if (status === 401 || status === 403)
         return 'Authentication failed. Please run vigthoria login.';
@@ -450,7 +465,7 @@ class APIClient {
     }
     getV3AgentBaseUrls(preferLocal = false) {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocalV3Agent = process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1' || preferLocal;
+        const allowLocalV3Agent = isServerRuntime() && (process.env.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1' || preferLocal);
         const urls = [
             process.env.VIGTHORIA_V3_AGENT_URL,
             process.env.V3_AGENT_URL,
@@ -473,7 +488,7 @@ class APIClient {
     }
     getOperatorBaseUrls() {
         const configuredModelsApiUrl = String(this.config.get('modelsApiUrl') || 'https://api.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
+        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_OPERATOR_URL,
             process.env.OPERATOR_URL,
@@ -487,7 +502,7 @@ class APIClient {
     }
     getMcpBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
+        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_MCP_URL,
             process.env.MCP_SERVER_URL,
@@ -498,7 +513,7 @@ class APIClient {
     }
     getVigFlowBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
+        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_VIGFLOW_URL,
             process.env.VIGFLOW_URL,
@@ -510,7 +525,7 @@ class APIClient {
     }
     getTemplateServiceBaseUrls() {
         const configuredApiUrl = String(this.config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
-        const allowLocal = process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
+        const allowLocal = isServerRuntime() && process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1';
         const urls = [
             process.env.VIGTHORIA_TEMPLATE_SERVICE_URL,
             process.env.TEMPLATE_SERVICE_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.8.9",
+  "version": "1.8.11",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "main": "dist/index.js",
   "files": [