vigthoria-cli 1.9.5 → 1.9.8

package/scripts/release/LOCAL_MACHINE_USER_VERIFICATION.md

@@ -0,0 +1,159 @@
+# Vigthoria CLI Local Machine Verification Checklist
+
+Use this checklist on real user machines before and after rollout. The goal is to verify install, auth, routing, update, and core command reliability in the same environment users run.
+
+## 1. Preflight
+
+- [ ] Node.js `>=18` available
+- [ ] `npm` available
+- [ ] No stale shell aliases shadowing `vigthoria`
+- [ ] Network access to:
+  - `https://coder.vigthoria.io`
+  - `https://api.vigthoria.io`
+- [ ] If running browser runtime proofs: Chrome available for Puppeteer
+
+Commands:
+
+```bash
+node -v
+npm -v
+which vigthoria || where.exe vigthoria
+```
+
+## 2. Install and Version Integrity
+
+- [ ] Install succeeds
+- [ ] Reported version matches release target
+- [ ] Binary resolves to expected package
+
+Commands:
+
+```bash
+npm install -g vigthoria-cli@latest
+vigthoria --version
+vigthoria doctor
+```
+
+Expected:
+- `vigthoria --version` shows current release version
+- `doctor` returns diagnostics without crash
+
+## 3. Auth Reliability
+
+- [ ] Login works
+- [ ] Status shows account, plan, health lines
+- [ ] Invalid token is rejected with gateway-auth message
+
+Commands:
+
+```bash
+vigthoria login
+vigthoria status
+VIGTHORIA_AUTH_TOKEN=invalid-token-for-preflight vigthoria chat --no-agent --model balanced-4b --prompt "ok" --json
+```
+
+Expected:
+- `status` includes `Account Status`, `Plan`, `Overall`, `Coder API`, `Models API`
+- Invalid-token command returns JSON with `success: false` and gateway-auth failure message
+
+## 4. Model and Routing Checks
+
+- [ ] Balanced path resolves to balanced model
+- [ ] Governance fallback maps blocked no-agent models to `vigthoria-v3-code-35b`
+- [ ] Agent direct mode prints command/tool flow (non-JSON mode)
+
+Commands:
+
+```bash
+vigthoria chat --no-agent --model balanced-4b --prompt "reply exactly: ok" --json
+vigthoria chat --no-agent --model creative --prompt "say ok" --json
+vigthoria agent --prompt "Read one file and summarize it" --auto-approve
+```
+
+Expected:
+- balanced output model: `vigthoria-balanced-4b`
+- creative output model: `vigthoria-v3-code-35b`
+- agent run shows direct prompt execution and tool activity
+
+## 5. Command Surface Smoke Tests
+
+- [ ] Aliases work
+- [ ] Bridge status prints valid section and hidden internal endpoints
+- [ ] Operator JSON command succeeds
+
+Commands:
+
+```bash
+vigthoria hyper-loop status
+vigthoria devtools connect
+vigthoria bridge status
+vigthoria operator --prompt "status check" --json
+```
+
+Expected:
+- No crashes
+- `bridge status` shows `DevTools Bridge` and either `Reachable` or `Not running`
+- Operator JSON has `success: true`
+
+## 6. Update Path
+
+- [ ] Update check works
+- [ ] Upgrade path works from npm/manifest
+
+Commands:
+
+```bash
+vigthoria update --check
+vigthoria update
+```
+
+Expected:
+- No script errors
+- Clear success/fallback guidance if update source fails
+
+## 7. Release Gate (Local Build Validation)
+
+Run this on release candidate machines when validating local package changes.
+
+```bash
+npm run build
+npm run validate:no-go
+```
+
+Expected:
+- `ALL NO-GO GATES PASSED`
+
+## 8. Environment-Specific Prerequisites
+
+These are external dependencies, not CLI code regressions:
+
+- Workflow E2E requires reachable VigFlow backend
+- Live repo/game/platform E2E requires:
+  - `VIGTHORIA_COMMUNITY_EMAIL`
+  - `VIGTHORIA_COMMUNITY_PASSWORD`
+- Browser proof requires Chrome installed for Puppeteer runtime
+
+## 9. Rollback Readiness
+
+- [ ] Previous known-good CLI version pinned
+- [ ] One-command rollback documented
+- [ ] Support note prepared for users
+
+Example rollback:
+
+```bash
+npm install -g vigthoria-cli@<known-good-version>
+```
+
+## 10. Signoff Template
+
+- Machine/OS:
+- Node/NPM versions:
+- CLI version validated:
+- Auth check: PASS/FAIL
+- Model routing check: PASS/FAIL
+- Command smoke check: PASS/FAIL
+- Update check: PASS/FAIL
+- No-go gate: PASS/FAIL
+- Approved by:
+- Timestamp:

package/scripts/release/publish-cli-release.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Publish Vigthoria CLI release artifact + manifest entry.
+# Usage:
+#   HOST_DOWNLOADS_DIR=/path/to/downloads \
+#   HOST_MANIFEST_FILE=/path/to/releases/manifest.json \
+#   ./scripts/release/publish-cli-release.sh 1.9.0
+
+VERSION="${1:-}"
+if [[ -z "$VERSION" ]]; then
+  echo "Usage: $0 <version>"
+  exit 1
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+PKG_FILE="$REPO_ROOT/vigthoria-cli-${VERSION}.tgz"
+HOST_DOWNLOADS_DIR="${HOST_DOWNLOADS_DIR:-}"
+HOST_MANIFEST_FILE="${HOST_MANIFEST_FILE:-}"
+PUBLIC_BASE_URL="${PUBLIC_BASE_URL:-https://cli.vigthoria.io/downloads}"
+CHANNEL="${CHANNEL:-stable}"
+
+if [[ ! -f "$PKG_FILE" ]]; then
+  echo "Artifact not found: $PKG_FILE"
+  echo "Run: npm pack"
+  exit 1
+fi
+
+if [[ -z "$HOST_DOWNLOADS_DIR" || -z "$HOST_MANIFEST_FILE" ]]; then
+  echo "Set HOST_DOWNLOADS_DIR and HOST_MANIFEST_FILE before running."
+  exit 1
+fi
+
+SHA256="$(sha256sum "$PKG_FILE" | awk '{print $1}')"
+URL="$PUBLIC_BASE_URL/vigthoria-cli-${VERSION}.tgz"
+
+echo "Publishing vigthoria-cli v${VERSION}"
+echo "Artifact: $PKG_FILE"
+echo "SHA256:   $SHA256"
+echo "URL:      $URL"
+
+install -d "$HOST_DOWNLOADS_DIR"
+cp -f "$PKG_FILE" "$HOST_DOWNLOADS_DIR/"
+
+echo "Copied artifact to $HOST_DOWNLOADS_DIR"
+
+if [[ ! -f "$HOST_MANIFEST_FILE" ]]; then
+  echo "Manifest does not exist at: $HOST_MANIFEST_FILE"
+  echo "Create it first with {\"channels\":{\"stable\":{}}}"
+  exit 1
+fi
+
+python3 - << PYEOF
+import json, pathlib
+manifest_path = pathlib.Path(r"$HOST_MANIFEST_FILE")
+data = json.loads(manifest_path.read_text())
+data.setdefault("channels", {})
+data["channels"].setdefault("$CHANNEL", {})
+data["channels"]["$CHANNEL"].update({
+  "version": "$VERSION",
+  "url": "$URL",
+  "sha256": "$SHA256",
+  "notes": "Automated publish via scripts/release/publish-cli-release.sh"
+})
+manifest_path.write_text(json.dumps(data, indent=2) + "\n")
+print("Manifest updated:", manifest_path)
+PYEOF
+
+echo "Publish complete."
+echo "Verification commands:"
+echo "  curl -I $URL"
+echo "  curl -fsSL https://coder.vigthoria.io/releases/manifest.json | head -40"
+echo "  node dist/index.js update --check --manifest https://coder.vigthoria.io/releases/manifest.json --channel $CHANNEL"

package/scripts/release/validate-no-go-gates.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="/var/www/vigthoria-coder/VigthoriaCoderMain/vigthoria-cli"
+cd "$ROOT"
+
+CLI="node dist/index.js"
+unset V3_SERVICE_KEY
+unset HYPERLOOP_SERVICE_KEY
+
+echo "[0.1-0.6] source/dist consistency"
+node scripts/release/verify-runtime-consistency.mjs >/tmp/vig-verify-runtime.json
+cat /tmp/vig-verify-runtime.json
+
+echo "[0.2] build exits 0"
+npm run build >/tmp/vig-build.log 2>&1
+
+echo "[0.3] dist/index.js exists"
+[[ -x dist/index.js ]]
+
+echo "[AUTH PREFLIGHT] invalid session message"
+AUTH_JSON=$(VIGTHORIA_AUTH_TOKEN=invalid-token-for-preflight $CLI chat --no-agent --model balanced-4b --prompt "ok" --json 2>/dev/null || true)
+echo "$AUTH_JSON"
+printf '%s
+' "$AUTH_JSON" > /tmp/vig-auth-preflight.json
+python3 - << 'PY'
+import json
+with open('/tmp/vig-auth-preflight.json','r',encoding='utf-8') as f:
+    j=json.load(f)
+msg='Vigthoria Gate way user authentification failed. Please log out and login again.'
+assert j.get('success') is False, 'expected success=false for invalid token preflight'
+assert j.get('error') == msg, f"unexpected auth message: {j.get('error')}"
+print('[pass] auth preflight message')
+PY
+
+echo "[1.1] ranker includes agent.py top10 for SSE prompt"
+node - << 'EOF2'
+import('./dist/utils/context-ranker.js').then((m)=>{
+  const r=m.buildSemanticContext('/var/www/V3-Code-Agent','fix the streaming SSE event handler',10);
+  const idx=r.topFiles.findIndex((f)=>f.path==='agent.py');
+  console.log('agent_idx_top10=' + idx);
+  if (idx < 0) process.exit(1);
+});
+EOF2
+
+echo "[2.1/2.4] tsc validator emits passing result"
+node - << 'EOF2'
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runPostWriteValidation } from './dist/utils/post-write-validator.js';
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'vig-tsc-'));
+fs.mkdirSync(path.join(tmp, 'src'));
+fs.writeFileSync(path.join(tmp, 'tsconfig.json'), JSON.stringify({ compilerOptions: { target: 'ES2020', module: 'ESNext' }, include: ['src/**/*.ts'] }));
+fs.writeFileSync(path.join(tmp, 'src', 'index.ts'), 'export const ok:number = 1;\n');
+const res = await runPostWriteValidation(tmp);
+const tsc = res.find((r)=>r.tool==='tsc');
+console.log(JSON.stringify(tsc || null));
+if (!tsc || !tsc.ran || !tsc.passed) process.exit(1);
+EOF2
+
+echo "[6.2] balanced-4b no-agent path"
+$CLI chat --no-agent --model balanced-4b --prompt "reply exactly: ok" --json >/tmp/vig-balanced.json
+python3 - << 'PY'
+import json
+j=json.load(open('/tmp/vig-balanced.json'))
+assert j.get('success') is True
+assert j.get('model') == 'vigthoria-balanced-4b', j
+print('[pass] balanced-4b')
+PY
+
+echo "[6.9/6.12] aliases available"
+$CLI hyper-loop status >/tmp/vig-hyperloop.txt
+$CLI devtools connect >/tmp/vig-devtools.txt
+
+echo "[6.11] operator flow"
+$CLI operator --prompt "status check" --json >/tmp/vig-operator.json
+python3 - << 'PY'
+import json
+j=json.load(open('/tmp/vig-operator.json'))
+assert j.get('success') is True, j
+print('[pass] operator flow')
+PY
+
+echo "[7.1/7.3/7.4] local service health"
+for u in http://localhost:8030/health http://localhost:4008/health http://localhost:4011/health; do
+  code=$(curl -s -o /dev/null -w "%{http_code}" "$u")
+  echo "$u => $code"
+  [[ "$code" == "200" ]]
+done
+
+echo "[7.2/7.8/12.3] models inventory"
+curl -s http://localhost:4009/v1/models >/tmp/vig-models.json
+python3 - << 'PY'
+import json
+ids={m.get('id','') for m in json.load(open('/tmp/vig-models.json')).get('data',[])}
+assert ('vigthoria-balanced-4b' in ids) or ('vigthoria-balanced-4b:latest' in ids)
+assert 'vigthoria-creative-9b-v4' in ids
+assert any('vigthoria-v3-code-35b' in i for i in ids)
+print('[pass] model inventory gates')
+PY
+
+echo "[7.5 policy] secured hyperloop endpoint"
+code=$(curl -s -o /dev/null -w "%{http_code}" https://coder.vigthoria.io/api/hyperloop/health)
+echo "unauth_hyperloop_code=$code"
+[[ "$code" == "401" ]]
+
+echo "[8.2] runtime symlink guard signals"
+rg -n "realpathSync|results.length >= maxFiles|pattern = kw.length <= 4" dist/utils/context-ranker.js >/tmp/vig-ranker-signals.txt
+cat /tmp/vig-ranker-signals.txt
+
+echo "[9.5/9.7/9.16] release URL consistency"
+rg -n "coder.vigthoria.io/releases" install.ps1 install.sh README.md >/tmp/vig-release-urls.txt
+cat /tmp/vig-release-urls.txt
+
+echo "[12.1] no-agent governance fallback"
+$CLI chat --no-agent --model creative --prompt "say ok" --json >/tmp/vig-creative.json
+python3 - << 'PY'
+import json
+j=json.load(open('/tmp/vig-creative.json'))
+assert j.get('success') is True
+assert j.get('model') == 'vigthoria-v3-code-35b', j
+md=j.get('metadata') or {}
+fb=md.get('modelFallback') or {}
+assert fb.get('reason') == 'governance-blocked-model', j
+print('[pass] governance fallback metadata')
+PY
+
+echo "ALL NO-GO GATES PASSED"

package/scripts/release/verify-runtime-consistency.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+
+function findPackageJson() {
+  const candidates = [
+    path.join(process.cwd(), 'package.json'),
+    path.join(process.cwd(), 'node_modules', 'vigthoria-cli', 'package.json'),
+    path.join(process.env.APPDATA || '', 'npm', 'node_modules', 'vigthoria-cli', 'package.json'),
+  ];
+  for (const p of candidates) {
+    if (p && fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+function exists(p) {
+  try { return fs.existsSync(p); } catch { return false; }
+}
+
+const pkgPath = findPackageJson();
+if (!pkgPath) {
+  console.error('[verify] FAIL: package.json not found in expected locations');
+  process.exit(1);
+}
+
+const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+const targetVersion = process.argv[2] || String(pkg.version || '');
+const baseDir = path.dirname(pkgPath);
+const isNodeModulesInstall = baseDir.endsWith(path.join('node_modules', 'vigthoria-cli'));
+const projectRoot = isNodeModulesInstall ? baseDir : process.cwd();
+
+const srcUtils = path.join(projectRoot, 'src', 'utils');
+const distUtils = path.join(projectRoot, 'dist', 'utils');
+const requiredSrc = ['context-ranker.ts', 'post-write-validator.ts', 'task-display.ts', 'workspace-cache.ts'];
+const requiredDist = ['context-ranker.js', 'post-write-validator.js', 'task-display.js', 'workspace-cache.js'];
+
+const sourceSnapshotExpected = !isNodeModulesInstall && exists(srcUtils);
+const missingSrc = sourceSnapshotExpected ? requiredSrc.filter((f) => !exists(path.join(srcUtils, f))) : [];
+const missingDist = requiredDist.filter((f) => !exists(path.join(distUtils, f)));
+
+const report = {
+  targetVersion,
+  packageVersion: String(pkg.version || ''),
+  packageJsonPath: pkgPath,
+  projectRoot,
+  srcUtils,
+  distUtils,
+  missingSrc,
+  missingDist,
+};
+
+console.log(JSON.stringify(report, null, 2));
+
+if (report.packageVersion !== targetVersion) {
+  console.error(`[verify] FAIL: version mismatch (${report.packageVersion} != ${targetVersion})`);
+  process.exit(1);
+}
+if (missingSrc.length > 0 || missingDist.length > 0) {
+  console.error('[verify] FAIL: required utility modules missing');
+  process.exit(1);
+}
+
+console.log('[verify] PASS: runtime/source snapshot is consistent');