vigthoria-cli 1.9.9 → 1.9.19

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-"use strict";
 /**
  * Vigthoria CLI - AI-Powered Terminal Coding Assistant
  *
@@ -16,76 +15,43 @@
  *   vigthoria workflow          - Manage repeatable VigFlow workflows
  *   vigthoria operator          - Start BMAD operator mode
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.__cliErrorHandlingReady = void 0;
-exports.validateReleaseMetadata = validateReleaseMetadata;
-exports.setupErrorHandlers = setupErrorHandlers;
-exports.main = main;
-const commander_1 = require("commander");
-const chat_js_1 = require("./commands/chat.js");
-const edit_js_1 = require("./commands/edit.js");
-const generate_js_1 = require("./commands/generate.js");
-const explain_js_1 = require("./commands/explain.js");
-const auth_js_1 = require("./commands/auth.js");
-const config_js_1 = require("./commands/config.js");
-const review_js_1 = require("./commands/review.js");
-const hub_js_1 = require("./commands/hub.js");
-const repo_js_1 = require("./commands/repo.js");
-const deploy_js_1 = require("./commands/deploy.js");
-const bridge_js_1 = require("./commands/bridge.js");
-const workflow_js_1 = require("./commands/workflow.js");
-const preview_js_1 = require("./commands/preview.js");
-const legion_js_1 = require("./commands/legion.js");
-const history_js_1 = require("./commands/history.js");
-const replay_js_1 = require("./commands/replay.js");
-const fork_js_1 = require("./commands/fork.js");
-const cancel_js_1 = require("./commands/cancel.js");
-const security_js_1 = require("./commands/security.js");
-const config_js_2 = require("./utils/config.js");
-const logger_js_1 = require("./utils/logger.js");
-const chalk_1 = __importDefault(require("chalk"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-const crypto_1 = require("crypto");
-const axios_1 = __importDefault(require("axios"));
-const api_js_1 = require("./utils/api.js");
+import { Command } from 'commander';
+import { ChatCommand } from './commands/chat.js';
+import { EditCommand } from './commands/edit.js';
+import { GenerateCommand } from './commands/generate.js';
+import { ExplainCommand } from './commands/explain.js';
+import { handleLogin, handleLogout, statusAction } from './commands/auth.js';
+import { ConfigCommand } from './commands/config.js';
+import { ReviewCommand } from './commands/review.js';
+import { HubCommand } from './commands/hub.js';
+import { RepoCommand } from './commands/repo.js';
+import { DeployCommand } from './commands/deploy.js';
+import { BridgeCommand } from './commands/bridge.js';
+import { DeviceCommand } from './commands/device.js';
+import { WorkflowCommand } from './commands/workflow.js';
+import { PreviewCommand } from './commands/preview.js';
+import { LegionCommand } from './commands/legion.js';
+import { HistoryCommand } from './commands/history.js';
+import { ReplayCommand } from './commands/replay.js';
+import { ForkCommand } from './commands/fork.js';
+import { CancelCommand } from './commands/cancel.js';
+import { SecurityCommand } from './commands/security.js';
+import { Config } from './utils/config.js';
+import { Logger, CH } from './utils/logger.js';
+import chalk from 'chalk';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
+import axios from 'axios';
+// ESM shim — TypeScript emits ESM under "type": "module", so __dirname
+// is not available natively.  Restore the CommonJS-style helper so the
+// pre-existing package-discovery logic continues to work unchanged.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+import { APIClient, sanitizeUserFacingErrorText } from './utils/api.js';
+import { getCliStateFile, isOfflineMode, isSafeNpmPackageSpec, isUpdateCheckSuppressed, readCachedLatestVersion, readGatewayPreflightCache, writeCachedLatestVersion, writeGatewayPreflightCache, } from './utils/cli-state.js';
 function isApiError(error) {
     return Boolean(error &&
         typeof error === 'object' &&
@@ -122,12 +88,12 @@ function getVersion() {
     catch (e) {
         const message = e instanceof Error ? e.message : String(e);
         if (process.env.VIGTHORIA_DEBUG_VERSION === '1') {
-            console.error(chalk_1.default.gray(`Unable to read package version: ${message}`));
+            console.error(chalk.gray(`Unable to read package version: ${message}`));
         }
     }
     return '0.0.0';
 }
-function validateReleaseMetadata() {
+export function validateReleaseMetadata() {
     try {
         const packagePath = getPackageMetadataPaths().find((candidate) => fs.existsSync(candidate));
         if (!packagePath) {
@@ -164,7 +130,7 @@ function validateReleaseMetadata() {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         if (process.env.VIGTHORIA_DEBUG_VERSION === '1') {
-            console.error(chalk_1.default.gray(`Release metadata validation failed: ${message}`));
+            console.error(chalk.gray(`Release metadata validation failed: ${message}`));
         }
         return false;
     }
@@ -204,7 +170,7 @@ function resolveManifestEntry(manifest, channel) {
     return null;
 }
 async function downloadFile(url, targetPath) {
-    const response = await axios_1.default.get(url, {
+    const response = await axios.get(url, {
         responseType: 'arraybuffer',
         timeout: 20000,
         maxRedirects: 5,
@@ -213,7 +179,7 @@ async function downloadFile(url, targetPath) {
     fs.writeFileSync(targetPath, Buffer.from(response.data));
 }
 function sha256File(filePath) {
-    const hash = (0, crypto_1.createHash)('sha256');
+    const hash = createHash('sha256');
     const data = fs.readFileSync(filePath);
     hash.update(data);
     return hash.digest('hex');
@@ -287,7 +253,7 @@ async function installGlobalPackageWithNpm(packageSpec) {
     let lastError = null;
     for (const attempt of attempts) {
         try {
-            console.log(chalk_1.default.gray(`[update] installer executable: ${attempt.command}${attempt.shell ? ' (shell)' : ''}`));
+            console.log(chalk.gray(`[update] installer executable: ${attempt.command}${attempt.shell ? ' (shell)' : ''}`));
             execFileSync(attempt.command, attempt.args, {
                 stdio: 'inherit',
                 windowsHide: true,
@@ -298,40 +264,57 @@ async function installGlobalPackageWithNpm(packageSpec) {
         catch (error) {
             lastError = error;
             const code = error?.code || error?.status || 'unknown';
-            console.error(chalk_1.default.yellow(`[update] install attempt failed via ${attempt.label}: ${code}`));
+            console.error(chalk.yellow(`[update] install attempt failed via ${attempt.label}: ${code}`));
         }
     }
     const finalCode = lastError?.code || lastError?.status || 'unknown';
     throw new Error(`Unable to launch npm installer after ${attempts.length} attempt(s). Last error: ${finalCode}`);
 }
-// Check for updates silently on startup (non-blocking)
+function renderUpdateBanner(latestVersion) {
+    if (compareVersions(latestVersion, '1.4.0') >= 0 && compareVersions(VERSION, '1.4.0') < 0) {
+        console.log(chalk.red.bold(`\n${CH.warnEmoji}  SECURITY UPDATE AVAILABLE`));
+        console.log(chalk.red(`   Version ${VERSION} has security vulnerabilities.`));
+        console.log(chalk.yellow(`   Please update to ${latestVersion} immediately:`));
+        console.log(chalk.white.bold('   npm install -g vigthoria-cli@latest\n'));
+    }
+    else {
+        console.log(chalk.yellow(`\n${CH.warnEmoji}  Update available: ${VERSION} -> ${latestVersion}`));
+        console.log(chalk.gray('   Run `vigthoria update` to install\n'));
+    }
+}
+// Check for updates quietly on startup. Cached (24 h) so we never block
+// startup on `npm view`. Honours VIGTHORIA_OFFLINE / VIGTHORIA_NO_UPDATE_CHECK.
 async function checkForUpdatesQuietly() {
+    if (isUpdateCheckSuppressed()) {
+        return;
+    }
+    const cached = readCachedLatestVersion();
+    if (cached) {
+        if (compareVersions(cached, VERSION) > 0) {
+            renderUpdateBanner(cached);
+        }
+        return;
+    }
+    // Cache miss: probe npm registry in the background, with a hard 5 s
+    // timeout. Result is cached for 24 h so subsequent runs are instant.
     try {
         const { execSync } = await import('child_process');
-        // Cross-platform: use stdio: 'pipe' to suppress output on Windows
         const npmVersion = execSync('npm view vigthoria-cli version', {
             encoding: 'utf8',
             timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'], // Suppress stderr on all platforms
+            stdio: ['pipe', 'pipe', 'pipe'],
             windowsHide: true,
         }).trim();
-        // Only show update message if npm version is NEWER than current (not older)
-        if (npmVersion && compareVersions(npmVersion, VERSION) > 0) {
-            // Check if this is a security update (1.4.0+)
-            if (compareVersions(npmVersion, '1.4.0') >= 0 && compareVersions(VERSION, '1.4.0') < 0) {
-                console.log(chalk_1.default.red.bold(`\n${logger_js_1.CH.warnEmoji}  SECURITY UPDATE AVAILABLE`));
-                console.log(chalk_1.default.red(`   Version ${VERSION} has security vulnerabilities.`));
-                console.log(chalk_1.default.yellow(`   Please update to ${npmVersion} immediately:`));
-                console.log(chalk_1.default.white.bold('   npm install -g vigthoria-cli@latest\n'));
-            }
-            else {
-                console.log(chalk_1.default.yellow(`\n📦 Update available: ${VERSION} → ${npmVersion}`));
-                console.log(chalk_1.default.gray('   Run `vigthoria update` to install\n'));
-            }
+        if (!npmVersion) {
+            return;
+        }
+        writeCachedLatestVersion(npmVersion);
+        if (compareVersions(npmVersion, VERSION) > 0) {
+            renderUpdateBanner(npmVersion);
         }
     }
     catch {
-        // Silently ignore - network issues shouldn't block CLI
+        // Network or npm failure should never block CLI; do not cache failure.
     }
 }
 const VIGTHORIA_GATEWAY_AUTH_FAILURE_MESSAGE = 'Vigthoria Gate way user authentification failed. Please log out and login again.';
@@ -349,7 +332,7 @@ function isAuthProtectedCommand(command) {
         'chat', 'c', 'chat-resume',
         'agent', 'a', 'operator', 'op',
         'edit', 'e', 'generate', 'g', 'explain', 'x', 'fix', 'f', 'review', 'r',
-        'workflow', 'flow', 'hub', 'marketplace', 'deploy', 'host', 'preview',
+        'workflow', 'flow', 'hub', 'marketplace', 'deploy', 'host', 'preview', 'device',
         'legion', 'history', 'runs', 'replay', 'fork', 'cancel',
         'repo', 'repository',
     ]);
@@ -359,19 +342,30 @@ async function enforceGatewayAuthSession(config, logger, jsonOutputRequested) {
     if (!config.isAuthenticated()) {
         return true;
     }
-    const api = new api_js_1.APIClient(config, logger);
+    // Offline mode disables every outbound preflight call.
+    if (isOfflineMode()) {
+        return true;
+    }
+    // Short-lived cache so back-to-back CLI invocations don't re-probe.
+    const cached = readGatewayPreflightCache();
+    if (cached === true) {
+        return true;
+    }
+    const api = new APIClient(config, logger);
     try {
         const tokenCheck = await api.validateToken();
         if (!tokenCheck.valid) {
+            writeGatewayPreflightCache(false);
             if (jsonOutputRequested) {
                 process.exitCode = 1;
                 console.log(JSON.stringify({ success: false, error: VIGTHORIA_GATEWAY_AUTH_FAILURE_MESSAGE }, null, 2));
             }
             else {
-                console.log(chalk_1.default.red(VIGTHORIA_GATEWAY_AUTH_FAILURE_MESSAGE));
+                console.log(chalk.red(VIGTHORIA_GATEWAY_AUTH_FAILURE_MESSAGE));
             }
             return false;
         }
+        writeGatewayPreflightCache(true);
         return true;
     }
     catch {
@@ -382,6 +376,14 @@ async function enforceGatewayAuthSession(config, logger, jsonOutputRequested) {
         api.destroy();
     }
 }
+function scrubMessageForUser(message) {
+    try {
+        return sanitizeUserFacingErrorText(message) || message;
+    }
+    catch {
+        return message;
+    }
+}
 function normalizeCliError(error) {
     if (error instanceof Error) {
         const extended = error;
@@ -390,8 +392,9 @@ function normalizeCliError(error) {
             : typeof extended.response?.data?.message === 'string'
                 ? extended.response.data.message
                 : undefined;
+        const rawMessage = responseMessage || extended.message || 'An unexpected CLI error occurred.';
         return {
-            message: responseMessage || extended.message || 'An unexpected CLI error occurred.',
+            message: scrubMessageForUser(rawMessage),
             code: extended.code,
             status: extended.status || extended.statusCode || extended.response?.status,
             details: extended.details || extended.response?.data,
@@ -399,15 +402,17 @@ function normalizeCliError(error) {
     }
     if (error && typeof error === 'object') {
         const value = error;
+        const rawMessage = typeof value.message === 'string' && value.message.trim() ? value.message : 'An unexpected CLI error occurred.';
         return {
-            message: typeof value.message === 'string' && value.message.trim() ? value.message : 'An unexpected CLI error occurred.',
+            message: scrubMessageForUser(rawMessage),
             code: typeof value.code === 'string' || typeof value.code === 'number' ? value.code : undefined,
             status: typeof value.status === 'number' ? value.status : undefined,
             details: value.details,
         };
     }
+    const rawMessage = typeof error === 'string' && error.trim() ? error : 'An unexpected CLI error occurred.';
     return {
-        message: typeof error === 'string' && error.trim() ? error : 'An unexpected CLI error occurred.',
+        message: scrubMessageForUser(rawMessage),
     };
 }
 function formatCliError(error, jsonOutputRequested = false) {
@@ -415,11 +420,11 @@ function formatCliError(error, jsonOutputRequested = false) {
     if (jsonOutputRequested) {
         return JSON.stringify({ success: false, error: normalized.message, code: normalized.code, status: normalized.status, details: normalized.details }, null, 2);
     }
-    const parts = [chalk_1.default.red('Error:'), normalized.message];
+    const parts = [chalk.red('Error:'), normalized.message];
     if (normalized.code)
-        parts.push(chalk_1.default.gray(`[${normalized.code}]`));
+        parts.push(chalk.gray(`[${normalized.code}]`));
     if (normalized.status)
-        parts.push(chalk_1.default.gray(`(HTTP ${normalized.status})`));
+        parts.push(chalk.gray(`(HTTP ${normalized.status})`));
     return parts.join(' ');
 }
 function reportCliError(error, jsonOutputRequested = false) {
@@ -436,7 +441,7 @@ function handleFatalCliError(error, jsonOutputRequested = false) {
     process.exitCode = 1;
 }
 let errorHandlersInstalled = false;
-function setupErrorHandlers() {
+export function setupErrorHandlers() {
     if (errorHandlersInstalled) {
         return;
     }
@@ -455,20 +460,22 @@ function setupErrorHandlers() {
         }
     });
 }
-async function main(args) {
-    const program = new commander_1.Command();
-    const config = new config_js_2.Config();
-    const logger = new logger_js_1.Logger();
+export async function main(args) {
+    const program = new Command();
+    const config = new Config();
+    const logger = new Logger();
     const invokedBinaryName = getInvokedBinaryName();
     const argv = [...args];
     const firstArg = argv[2];
     const jsonOutputRequested = argv.includes('--json');
     const directPromptRequested = argv.includes('--prompt') || argv.includes('-P');
+    const helpOrVersionRequested = argv.some((token) => token === '--help' || token === '-h' || token === '--version' || token === '-V' ||
+        token === 'help' || token === 'version');
     const isLegionCortexRequest = invokedBinaryName === 'vigthoria' && argv[2] === 'legion' && argv.includes('--cortex');
     if (invokedBinaryName === 'vigthoria-chat') {
         const knownCommands = new Set([
             'chat', 'chat-resume', 'agent', 'edit', 'generate', 'explain', 'fix', 'review', 'cancel',
-            'hub', 'repo', 'deploy', 'operator', 'workflow', 'flow', 'security', 'vsec', 'login', 'logout', 'status', 'config', 'update',
+            'hub', 'repo', 'deploy', 'operator', 'workflow', 'flow', 'device', 'security', 'vsec', 'login', 'logout', 'status', 'config', 'update',
             '--help', '-h', '--version', '-V', 'help', 'version',
         ]);
         if (!firstArg || firstArg.startsWith('-') || !knownCommands.has(firstArg)) {
@@ -494,18 +501,25 @@ async function main(args) {
     // Calculate padding for centering
     const titlePad = Math.floor((boxWidth - 4 - titleText.length) / 2);
     const versionPad = Math.floor((boxWidth - 4 - versionText.length) / 2);
-    if (process.env.VIGTHORIA_NO_BANNER !== '1' && !jsonOutputRequested && !directPromptRequested) {
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dTl + logger_js_1.CH.dH.repeat(boxWidth) + logger_js_1.CH.dTr));
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dV + ' '.repeat(boxWidth) + logger_js_1.CH.dV));
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dV) + ' '.repeat(titlePad) + chalk_1.default.bold.white('VIGTHORIA CLI') + chalk_1.default.cyan(' - AI-Powered Coding Assistant') + ' '.repeat(boxWidth - titlePad - titleText.length) + chalk_1.default.cyan(logger_js_1.CH.dV));
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dV) + ' '.repeat(versionPad) + chalk_1.default.gray(versionText) + ' '.repeat(boxWidth - versionPad - versionText.length) + chalk_1.default.cyan(logger_js_1.CH.dV));
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dV + ' '.repeat(boxWidth) + logger_js_1.CH.dV));
-        console.log(chalk_1.default.cyan(logger_js_1.CH.dBl + logger_js_1.CH.dH.repeat(boxWidth) + logger_js_1.CH.dBr));
+    if (process.env.VIGTHORIA_NO_BANNER !== '1' &&
+        !jsonOutputRequested &&
+        !directPromptRequested &&
+        !helpOrVersionRequested) {
+        console.log(chalk.cyan(CH.dTl + CH.dH.repeat(boxWidth) + CH.dTr));
+        console.log(chalk.cyan(CH.dV + ' '.repeat(boxWidth) + CH.dV));
+        console.log(chalk.cyan(CH.dV) + ' '.repeat(titlePad) + chalk.bold.white('VIGTHORIA CLI') + chalk.cyan(' - AI-Powered Coding Assistant') + ' '.repeat(boxWidth - titlePad - titleText.length) + chalk.cyan(CH.dV));
+        console.log(chalk.cyan(CH.dV) + ' '.repeat(versionPad) + chalk.gray(versionText) + ' '.repeat(boxWidth - versionPad - versionText.length) + chalk.cyan(CH.dV));
+        console.log(chalk.cyan(CH.dV + ' '.repeat(boxWidth) + CH.dV));
+        console.log(chalk.cyan(CH.dBl + CH.dH.repeat(boxWidth) + CH.dBr));
         console.log();
     }
-    // Check for updates in background (don't wait)
-    if (process.env.VIGTHORIA_NO_UPDATE_CHECK !== '1' && !jsonOutputRequested && !directPromptRequested) {
-        checkForUpdatesQuietly();
+    // Check for updates in background (don't wait).  Skip for JSON / direct
+    // prompt / help / version invocations to keep them deterministic.
+    if (!isUpdateCheckSuppressed() &&
+        !jsonOutputRequested &&
+        !directPromptRequested &&
+        !helpOrVersionRequested) {
+        void checkForUpdatesQuietly();
     }
     program
         .name(invokedBinaryName === 'vigthoria-chat' ? 'vigthoria-chat' : 'vigthoria')
@@ -528,7 +542,7 @@ async function main(args) {
         .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new chat_js_1.ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -557,7 +571,7 @@ async function main(args) {
         .option('--auto-approve', 'Auto-approve agent actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new chat_js_1.ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -587,7 +601,7 @@ async function main(args) {
         .option('--auto-approve', 'Auto-approve all actions (dangerous!)', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new chat_js_1.ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -615,7 +629,7 @@ async function main(args) {
         .option('--json', 'Emit machine-readable JSON output for direct prompt runs', false)
         .option('--bridge <url>', 'Connect to Vigthoria Commando Bridge for remote admin observability')
         .action(async (options) => {
-        const chat = new chat_js_1.ChatCommand(config, logger);
+        const chat = new ChatCommand(config, logger);
         await chat.run({
             model: options.model,
             project: options.project,
@@ -636,9 +650,98 @@ async function main(args) {
         .command('status')
         .description('Show live DevTools Bridge status')
         .action(async () => {
-        const bridge = new bridge_js_1.BridgeCommand(config, logger);
+        const bridge = new BridgeCommand(config, logger);
         await bridge.status();
     });
+    const deviceCommand = program
+        .command('device')
+        .alias('adb')
+        .description('Android Developer Bridge commands via local ADB');
+    deviceCommand
+        .command('status')
+        .description('Show ADB availability and connected Android devices')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.status(options);
+    });
+    deviceCommand
+        .command('list')
+        .description('List connected Android devices')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.list(options);
+    });
+    deviceCommand
+        .command('screenshot')
+        .description('Capture a screenshot from an Android device')
+        .option('-d, --device <id>', 'ADB device id')
+        .option('-o, --output <path>', 'Output PNG path')
+        .action(async (options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.screenshot(options);
+    });
+    deviceCommand
+        .command('install <apk>')
+        .description('Install or update an APK on an Android device')
+        .option('-d, --device <id>', 'ADB device id')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (apk, options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.install(apk, options);
+    });
+    deviceCommand
+        .command('launch <package>')
+        .description('Launch an Android app by package name')
+        .option('-d, --device <id>', 'ADB device id')
+        .option('-a, --activity <activity>', 'Activity class, for example .MainActivity')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (packageName, options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.launch(packageName, options);
+    });
+    deviceCommand
+        .command('logs')
+        .description('Read Android logcat output')
+        .option('-d, --device <id>', 'ADB device id')
+        .option('-n, --lines <count>', 'Number of log lines for snapshot mode', '250')
+        .option('-f, --follow', 'Follow logcat until interrupted', false)
+        .option('--json', 'Emit JSON output for snapshot mode', false)
+        .action(async (options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.logs(options);
+    });
+    deviceCommand
+        .command('tcpip')
+        .description('Enable wireless ADB tcpip mode on the selected USB-connected device')
+        .option('-d, --device <id>', 'ADB device id')
+        .option('-p, --port <port>', 'Wireless ADB port', '5555')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.tcpip(options);
+    });
+    deviceCommand
+        .command('connect <address>')
+        .description('Connect to a wireless ADB device, for example 192.168.1.30:5555')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (address, options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.connect(address, options);
+    });
+    deviceCommand
+        .command('disconnect [address]')
+        .description('Disconnect a wireless ADB device')
+        .option('--json', 'Emit JSON output', false)
+        .action(async (address, options) => {
+        const device = new DeviceCommand(config, logger);
+        await device.disconnect(address, options);
+    });
+    deviceCommand.action(async () => {
+        const device = new DeviceCommand(config, logger);
+        await device.status({});
+    });
     // Security command group - Security DevOps scans and fix plans
     const securityCommand = program
         .command('security')
@@ -650,7 +753,7 @@ async function main(args) {
         .option('-d, --dir <path>', 'Directory to scan (default: current directory)')
         .option('--json', 'Emit JSON output', false)
         .action(async (options) => {
-        const security = new security_js_1.SecurityCommand(config, logger);
+        const security = new SecurityCommand(config, logger);
         await security.scan({ dir: options.dir, json: options.json });
     });
     securityCommand
@@ -659,7 +762,7 @@ async function main(args) {
         .option('-d, --dir <path>', 'Directory to score (default: current directory)')
         .option('--json', 'Emit JSON output', false)
         .action(async (options) => {
-        const security = new security_js_1.SecurityCommand(config, logger);
+        const security = new SecurityCommand(config, logger);
         await security.score({ dir: options.dir, json: options.json });
     });
     securityCommand
@@ -670,7 +773,7 @@ async function main(args) {
         .option('--apply', 'Request auto-apply mode (safe mode still requires explicit patching)', false)
         .option('--json', 'Emit JSON output', false)
         .action(async (options) => {
-        const security = new security_js_1.SecurityCommand(config, logger);
+        const security = new SecurityCommand(config, logger);
         await security.fix({ dir: options.dir, issueId: options.issueId, apply: options.apply, json: options.json });
     });
     // Edit command - Edit files with AI
@@ -682,7 +785,7 @@ async function main(args) {
         .option('-m, --model <model>', 'Select AI model', 'code')
         .option('--apply', 'Automatically apply changes without confirmation', false)
         .action(async (file, options) => {
-        const edit = new edit_js_1.EditCommand(config, logger);
+        const edit = new EditCommand(config, logger);
         await edit.run(file, options);
     });
     // Generate command - Generate code
@@ -695,7 +798,7 @@ async function main(args) {
         .option('-m, --model <model>', 'Select AI model', 'code')
         .option('-p, --pro', 'Senior Developer Mode: plan, generate, quality check (recommended)', false)
         .action(async (description, options) => {
-        const generate = new generate_js_1.GenerateCommand(config, logger);
+        const generate = new GenerateCommand(config, logger);
         await generate.run(description, options);
     });
     // Explain command - Explain code
@@ -706,7 +809,7 @@ async function main(args) {
         .option('-l, --lines <range>', 'Line range (e.g., 1-50)')
         .option('-d, --detail <level>', 'Detail level (brief, normal, detailed)', 'normal')
         .action(async (file, options) => {
-        const explain = new explain_js_1.ExplainCommand(config, logger);
+        const explain = new ExplainCommand(config, logger);
         await explain.run(file, options);
     });
     // Fix command - Fix code issues
@@ -722,7 +825,7 @@ async function main(args) {
             process.exitCode = 1;
             return;
         }
-        const edit = new edit_js_1.EditCommand(config, logger);
+        const edit = new EditCommand(config, logger);
         await edit.fix(file, options);
     });
     // Review command - Code review
@@ -732,7 +835,7 @@ async function main(args) {
         .description('Review code quality')
         .option('-f, --format <format>', 'Output format (text, json, markdown)', 'text')
         .action(async (file, options) => {
-        const review = new review_js_1.ReviewCommand(config, logger);
+        const review = new ReviewCommand(config, logger);
         await review.run(file, options);
     });
     const workflowCommand = program
@@ -747,7 +850,7 @@ async function main(args) {
         .option('-s, --search <query>', 'Search template names, descriptions, and tags')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (options) => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.templates(options);
     });
     workflowCommand
@@ -756,7 +859,7 @@ async function main(args) {
         .description('List workflows created for the current account')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (options) => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.list(options);
     });
     workflowCommand
@@ -766,28 +869,30 @@ async function main(args) {
         .option('-v, --variables <json>', 'Template variables as a JSON object')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (templateId, options) => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.useTemplate(templateId, options);
     });
     workflowCommand
         .command('run <workflowId>')
         .description('Run a workflow immediately')
         .option('-d, --data <json>', 'Execution input data as a JSON object')
+        .option('--no-brain', 'Do not attach local Project Brain context to this workflow run')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (workflowId, options) => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.run(workflowId, options);
     });
     workflowCommand
         .command('status <executionId>')
         .description('Get the current or final status of a workflow execution')
+        .option('--no-brain', 'Do not remember this workflow status in local Project Brain')
         .option('--json', 'Emit machine-readable JSON output', false)
         .action(async (executionId, options) => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.status(executionId, options);
     });
     workflowCommand.action(async () => {
-        const workflow = new workflow_js_1.WorkflowCommand(config, logger);
+        const workflow = new WorkflowCommand(config, logger);
         await workflow.templates({});
     });
     // ==================== HUB / MARKETPLACE COMMANDS ====================
@@ -801,7 +906,7 @@ async function main(args) {
         .alias('d')
         .description('Interactive module discovery - find the right APIs for your project')
         .action(async () => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.discover();
     });
     hubCommand
@@ -810,7 +915,7 @@ async function main(args) {
         .description('List all available API modules')
         .option('-c, --category <category>', 'Filter by category (payments, communication, ai, creative, media)')
         .action(async (options) => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.list(options);
     });
     hubCommand
@@ -818,7 +923,7 @@ async function main(args) {
         .alias('find')
         .description('Semantic search for modules (e.g., "generate background music for my app")')
         .action(async (query) => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.search(query);
     });
     hubCommand
@@ -826,14 +931,14 @@ async function main(args) {
         .alias('enable')
         .description('Activate a module for your API key (enables pay-as-you-go)')
         .action(async (module) => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.activate(module);
     });
     hubCommand
         .command('active')
         .description('Show your currently active modules')
         .action(async () => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.active();
     });
     hubCommand
@@ -841,12 +946,12 @@ async function main(args) {
         .alias('details')
         .description('Get detailed information about a module')
         .action(async (module) => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.info(module);
     });
     // Default hub action shows discover
     hubCommand.action(async () => {
-        const hub = new hub_js_1.HubCommand(config, logger);
+        const hub = new HubCommand(config, logger);
         await hub.discover();
     });
     // ==================== REPO COMMANDS ====================
@@ -867,7 +972,7 @@ async function main(args) {
         .option('--open-in <engine>', 'After push, open project in engine: shop, visual, game')
         .option('--browser', 'Open result URL in default browser', false)
         .action(async (pathArg, options) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.push({
             path: pathArg,
             name: options.name,
@@ -893,7 +998,7 @@ async function main(args) {
         .option('-o, --output <path>', 'Output directory path')
         .option('-f, --force', 'Overwrite existing directory', false)
         .action(async (name, options) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.pull(name, {
             output: options.output,
             force: options.force
@@ -905,14 +1010,14 @@ async function main(args) {
         .description('List all your projects in Vigthoria Repo')
         .option('-v, --visibility <type>', 'Filter by visibility (private, restricted, public)')
         .action(async (options) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.list({ visibility: options.visibility });
     });
     repoCommand
         .command('status')
         .description('Show sync status of current project')
         .action(async () => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.status();
     });
     repoCommand
@@ -920,7 +1025,7 @@ async function main(args) {
         .description('Generate a shareable link for a project')
         .option('-e, --expires <duration>', 'Link expiration (e.g., 7d, 24h, 30m)', '7d')
         .action(async (name, options) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.share(name, { expires: options.expires });
     });
     repoCommand
@@ -928,7 +1033,7 @@ async function main(args) {
         .alias('rm')
         .description('Remove a project from your Vigthoria Repo')
         .action(async (name) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.delete(name);
     });
     repoCommand
@@ -937,7 +1042,7 @@ async function main(args) {
         .option('-o, --output <path>', 'Output directory path')
         .option('-f, --force', 'Overwrite existing directory', false)
         .action(async (url, options) => {
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.clone(url, {
             output: options.output,
             force: options.force
@@ -958,7 +1063,7 @@ Examples:
             logger.error(`Unknown engine "${engine}". Valid options: shop, visual, game`);
             process.exit(1);
         }
-        const repo = new repo_js_1.RepoCommand(config, logger);
+        const repo = new RepoCommand(config, logger);
         await repo.openIn(engine, projectName, {
             browser: options.browser,
             shopId: options.shopId
@@ -979,7 +1084,7 @@ Examples:
         .description('Deploy to free preview URL')
         .option('-p, --project <path>', 'Project directory path', process.cwd())
         .action(async (options) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.deployToPreview(options.project);
     });
     deployCommand
@@ -987,7 +1092,7 @@ Examples:
         .description('Deploy to yourname.vigthoria.io')
         .option('-p, --project <path>', 'Project directory path', process.cwd())
         .action(async (name, options) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.deployToSubdomain(name, options.project);
     });
     deployCommand
@@ -995,7 +1100,7 @@ Examples:
         .description('Deploy to your custom domain')
         .option('-p, --project <path>', 'Project directory path', process.cwd())
         .action(async (domain, options) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.deployToCustomDomain(domain, options.project);
     });
     deployCommand
@@ -1003,28 +1108,28 @@ Examples:
         .alias('ls')
         .description('List all your deployments')
         .action(async () => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.list();
     });
     deployCommand
         .command('plans')
         .description('Show hosting plans and pricing')
         .action(async () => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.showPlans();
     });
     deployCommand
         .command('status [domain]')
         .description('Check deployment status')
         .action(async (domain) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.status(domain);
     });
     deployCommand
         .command('verify <domain>')
         .description('Verify DNS configuration for custom domain')
         .action(async (domain) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.verify(domain);
     });
     deployCommand
@@ -1032,7 +1137,7 @@ Examples:
         .alias('rm')
         .description('Remove a deployment')
         .action(async (domain) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.remove(domain);
     });
     // Default deploy action shows interactive wizard
@@ -1041,7 +1146,7 @@ Examples:
         .option('-d, --domain <domain>', 'Deploy to custom domain')
         .option('-p, --project <path>', 'Project directory path', process.cwd())
         .action(async (options) => {
-        const deploy = new deploy_js_1.DeployCommand(config, logger);
+        const deploy = new DeployCommand(config, logger);
         await deploy.deploy({
             subdomain: options.subdomain,
             domain: options.domain,
@@ -1060,7 +1165,7 @@ Examples:
         .option('--proof', 'Run Template Service preview gate and persist proof bundle')
         .option('--screenshot', 'Capture screenshot via Puppeteer')
         .action(async (options) => {
-        const preview = new preview_js_1.PreviewCommand(config, logger);
+        const preview = new PreviewCommand(config, logger);
         await preview.run({
             project: options.project,
             entry: options.entry,
@@ -1092,7 +1197,7 @@ Examples:
         .option('-w, --worker <name>', 'Execute a specific worker')
         .option('-p, --project <path>', 'Project directory', process.cwd())
         .action(async (request, options) => {
-        const legion = new legion_js_1.LegionCommand(config, logger);
+        const legion = new LegionCommand(config, logger);
         const parsedTimeout = Number.parseInt(String(options.timeout || ''), 10);
         await legion.run(request, {
             workers: options.workers,
@@ -1122,7 +1227,7 @@ Examples:
         .option('-p, --project <path>', 'Project directory', process.cwd())
         .option('--json', 'Machine-readable JSON output', false)
         .action(async (options) => {
-        const history = new history_js_1.HistoryCommand(config, logger);
+        const history = new HistoryCommand(config, logger);
         await history.run({ limit: parseInt(options.limit, 10) || 20, json: options.json, project: options.project });
     });
     program
@@ -1132,7 +1237,7 @@ Examples:
         .option('-p, --project <path>', 'Project directory', process.cwd())
         .option('--json', 'Machine-readable JSON output', false)
         .action(async (runId, options) => {
-        const replay = new replay_js_1.ReplayCommand(config, logger);
+        const replay = new ReplayCommand(config, logger);
         await replay.run(runId, { speed: parseInt(options.speed, 10) || 200, json: options.json, project: options.project });
     });
     program
@@ -1142,7 +1247,7 @@ Examples:
         .option('-p, --project <path>', 'Project directory', process.cwd())
         .option('--json', 'Machine-readable JSON output', false)
         .action(async (runId, message, options) => {
-        const fork = new fork_js_1.ForkCommand(config, logger);
+        const fork = new ForkCommand(config, logger);
         await fork.run(runId, message || '', { eventIndex: parseInt(options.eventIndex, 10) || 0, project: options.project, json: options.json });
     });
     program
@@ -1152,7 +1257,7 @@ Examples:
         .option('-l, --list', 'List active runs without cancelling', false)
         .option('--json', 'Machine-readable JSON output', false)
         .action(async (contextId, options) => {
-        const cancel = new cancel_js_1.CancelCommand(config, logger);
+        const cancel = new CancelCommand(config, logger);
         await cancel.run(contextId, { all: options.all, list: options.list, json: options.json });
     });
     // ==================== AUTH COMMANDS ====================
@@ -1165,32 +1270,90 @@ Examples:
         .option('-p, --password <password>', 'Account password for credential-based login')
         .option('--device', 'Use OAuth device flow (requires server support)')
         .action(async (options) => {
-        await (0, auth_js_1.handleLogin)(options);
+        await handleLogin(options);
     });
     program
         .command('logout')
         .description('Logout from Vigthoria Coder')
         .action(async () => {
-        await (0, auth_js_1.handleLogout)(null);
+        await handleLogout(null);
     });
     program
         .command('status')
         .description('Show authentication and subscription status')
         .action(async () => {
-        await (0, auth_js_1.statusAction)();
+        await statusAction();
     });
     program
         .command('doctor')
-        .description('Run local Vigthoria CLI diagnostics')
-        .action(() => {
-        const checks = [
-            ['Node.js', process.version],
-            ['Platform', `${process.platform} ${process.arch}`],
-            ['Working directory', process.cwd()],
-        ];
-        console.log('Vigthoria CLI diagnostics');
-        for (const [label, value] of checks) {
-            console.log(`- ${label}: ${value}`);
+        .description('Run local Vigthoria CLI diagnostics (no network calls unless --check-api)')
+        .option('--check-api', 'Also probe Vigthoria API reachability', false)
+        .option('--json', 'Emit machine-readable JSON output', false)
+        .action(async (options) => {
+        const apiUrl = String(config.get('apiUrl') || 'https://coder.vigthoria.io').replace(/\/$/, '');
+        const modelsApiUrl = String(config.get('modelsApiUrl') || 'https://api.vigthoria.io').replace(/\/$/, '');
+        const offline = isOfflineMode();
+        const updateSuppressed = isUpdateCheckSuppressed();
+        const subscription = config.get('subscription') || { plan: null, status: null, expiresAt: null };
+        const report = {
+            cliVersion: VERSION,
+            nodeVersion: process.version,
+            platform: `${process.platform} ${process.arch}`,
+            cwd: process.cwd(),
+            homeDir: os.homedir(),
+            configPath: config.getConfigPath(),
+            stateFile: getCliStateFile(),
+            apiUrl,
+            modelsApiUrl,
+            loggedIn: config.isAuthenticated(),
+            subscriptionPlan: subscription.plan || null,
+            subscriptionStatus: subscription.status || null,
+            offlineMode: offline,
+            updateCheckSuppressed: updateSuppressed,
+            envOverrides: {
+                VIGTHORIA_API_URL: process.env.VIGTHORIA_API_URL || null,
+                VIGTHORIA_V3_AGENT_URL: process.env.VIGTHORIA_V3_AGENT_URL || null,
+                VIGTHORIA_OFFLINE: process.env.VIGTHORIA_OFFLINE || null,
+                VIGTHORIA_TOKEN: process.env.VIGTHORIA_TOKEN ? '<set>' : null,
+                HYPERLOOP_SERVICE_KEY: process.env.HYPERLOOP_SERVICE_KEY ? '<set>' : null,
+                V3_SERVICE_KEY: process.env.V3_SERVICE_KEY ? '<set>' : null,
+            },
+        };
+        if (options.checkApi && !offline) {
+            try {
+                const probe = await axios.get(`${apiUrl}/api/health`, { timeout: 4000, validateStatus: () => true });
+                report.apiHealth = probe.status >= 200 && probe.status < 400 ? 'online' : `status ${probe.status}`;
+            }
+            catch (error) {
+                report.apiHealth = `unreachable (${error.message})`;
+            }
+            try {
+                const probe = await axios.get(`${modelsApiUrl}/health`, { timeout: 4000, validateStatus: () => true });
+                report.modelsApiHealth = probe.status >= 200 && probe.status < 400 ? 'online' : `status ${probe.status}`;
+            }
+            catch (error) {
+                report.modelsApiHealth = `unreachable (${error.message})`;
+            }
+        }
+        if (options.json) {
+            console.log(JSON.stringify(report, null, 2));
+        }
+        else {
+            console.log(chalk.bold('Vigthoria CLI diagnostics'));
+            for (const [key, value] of Object.entries(report)) {
+                if (value && typeof value === 'object') {
+                    console.log(chalk.gray(`- ${key}:`));
+                    for (const [subKey, subVal] of Object.entries(value)) {
+                        console.log(chalk.gray(`    - ${subKey}: ${subVal ?? '(none)'}`));
+                    }
+                }
+                else {
+                    console.log(chalk.gray(`- ${key}: ${value ?? '(none)'}`));
+                }
+            }
+            if (!options.checkApi) {
+                console.log(chalk.gray('\nTip: pass --check-api to verify API reachability.'));
+            }
         }
         process.exitCode = 0;
     });
@@ -1203,7 +1366,7 @@ Examples:
         .option('-l, --list', 'List all settings')
         .option('-r, --reset', 'Reset to defaults')
         .action(async (options) => {
-        const configCmd = new config_js_1.ConfigCommand(config, logger);
+        const configCmd = new ConfigCommand(config, logger);
         await configCmd.run(options);
     });
     // Update command - Check for and install updates
@@ -1224,77 +1387,89 @@ Examples:
         const allowDowngrade = !!options.allowDowngrade;
         const gitPackageSpec = 'git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git';
         if (updateTarget) {
+            if (!isSafeNpmPackageSpec(updateTarget)) {
+                console.error(chalk.red('Refusing to run installer with unsafe package spec.'));
+                console.error(chalk.gray('Allowed characters: A-Z a-z 0-9 . _ - / @ : + \\ ='));
+                process.exitCode = 1;
+                return;
+            }
             try {
                 if (options.check) {
-                    console.log(chalk_1.default.cyan(`Update source configured: ${updateTarget}`));
-                    console.log(chalk_1.default.gray('Run `vigthoria update --from <target>` to install from this source'));
+                    console.log(chalk.cyan(`Update source configured: ${updateTarget}`));
+                    console.log(chalk.gray('Run `vigthoria update --from <target>` to install from this source'));
                     return;
                 }
-                console.log(chalk_1.default.cyan(`Installing update from ${updateTarget}...`));
+                console.log(chalk.cyan(`Installing update from ${updateTarget}...`));
                 await installGlobalPackageWithNpm(updateTarget);
-                console.log(chalk_1.default.green('Update installed successfully'));
-                console.log(chalk_1.default.gray('Please restart the CLI to use the new version'));
+                console.log(chalk.green('Update installed successfully'));
+                console.log(chalk.gray('Please restart the CLI to use the new version'));
                 return;
             }
             catch (error) {
-                console.error(chalk_1.default.red('Failed to install update from target:'), error.message);
-                console.log(chalk_1.default.gray(`Try manually: npm install -g ${updateTarget}`));
+                console.error(chalk.red('Failed to install update from target:'), error.message);
+                console.log(chalk.gray(`Try manually: npm install -g ${updateTarget}`));
                 process.exitCode = 1;
                 return;
             }
         }
         if (manifestUrl) {
+            if (isOfflineMode()) {
+                console.log(chalk.yellow('Offline mode (VIGTHORIA_OFFLINE=1): skipping manifest update.'));
+                return;
+            }
             try {
-                console.log(chalk_1.default.cyan(`Checking manifest channel ${channel}...`));
-                const response = await axios_1.default.get(manifestUrl, {
+                console.log(chalk.cyan(`Checking manifest channel ${channel}...`));
+                const response = await axios.get(manifestUrl, {
                     timeout: 10000,
                     maxRedirects: 5,
                     validateStatus: (status) => status >= 200 && status < 300,
                 });
                 const entry = resolveManifestEntry(response.data || {}, channel);
                 if (!entry || !entry.version || !entry.url) {
-                    console.error(chalk_1.default.red(`Manifest missing valid release entry for channel: ${channel}`));
-                    console.log(chalk_1.default.gray('Expected: channels.<channel>.version and channels.<channel>.url'));
+                    console.error(chalk.red(`Manifest missing valid release entry for channel: ${channel}`));
+                    console.log(chalk.gray('Expected: channels.<channel>.version and channels.<channel>.url'));
                     process.exitCode = 1;
                     return;
                 }
                 const currentVersion = VERSION;
                 const comparison = compareVersions(entry.version, currentVersion);
                 if (!allowDowngrade && comparison <= 0) {
-                    console.log(chalk_1.default.green(`You are running the latest version for channel ${channel} (${currentVersion})`));
+                    console.log(chalk.green(`You are running the latest version for channel ${channel} (${currentVersion})`));
                     return;
                 }
-                console.log(chalk_1.default.yellow(`Update available from manifest: ${currentVersion} -> ${entry.version} (${channel})`));
+                console.log(chalk.yellow(`Update available from manifest: ${currentVersion} -> ${entry.version} (${channel})`));
                 if (entry.notes) {
-                    console.log(chalk_1.default.gray(`   ${entry.notes}`));
+                    console.log(chalk.gray(`   ${entry.notes}`));
                 }
                 if (options.check) {
-                    console.log(chalk_1.default.gray(`Install with: vigthoria update --manifest ${manifestUrl} --channel ${channel}`));
+                    console.log(chalk.gray(`Install with: vigthoria update --manifest ${manifestUrl} --channel ${channel}`));
                     return;
                 }
                 const tmpFile = path.join(os.tmpdir(), `vigthoria-update-${Date.now()}.tgz`);
                 try {
-                    console.log(chalk_1.default.cyan('Downloading release package...'));
+                    console.log(chalk.cyan('Downloading release package...'));
                     await downloadFile(entry.url, tmpFile);
                     if (entry.sha256) {
                         const expected = entry.sha256.toLowerCase();
                         const actual = sha256File(tmpFile).toLowerCase();
                         if (actual !== expected) {
-                            console.error(chalk_1.default.red('Release checksum verification failed'));
-                            console.error(chalk_1.default.red(`Expected: ${expected}`));
-                            console.error(chalk_1.default.red(`Actual:   ${actual}`));
+                            console.error(chalk.red('Release checksum verification failed'));
+                            console.error(chalk.red(`Expected: ${expected}`));
+                            console.error(chalk.red(`Actual:   ${actual}`));
                             process.exitCode = 1;
                             return;
                         }
-                        console.log(chalk_1.default.green('Checksum verification passed'));
+                        console.log(chalk.green('Checksum verification passed'));
                     }
                     else {
-                        console.log(chalk_1.default.yellow('Manifest entry has no sha256; install proceeded without checksum verification'));
+                        console.log(chalk.yellow.bold('WARNING: manifest entry has no sha256.'));
+                        console.log(chalk.yellow('   The release artifact will be installed without integrity verification.'));
+                        console.log(chalk.gray('   Set --manifest to a trusted source, or supply sha256 in the manifest entry.'));
                     }
-                    console.log(chalk_1.default.cyan('Installing update...'));
+                    console.log(chalk.cyan('Installing update...'));
                     await installGlobalPackageWithNpm(tmpFile);
-                    console.log(chalk_1.default.green(`Updated to version ${entry.version}`));
-                    console.log(chalk_1.default.gray('Please restart the CLI to use the new version'));
+                    console.log(chalk.green(`Updated to version ${entry.version}`));
+                    console.log(chalk.gray('Please restart the CLI to use the new version'));
                     return;
                 }
                 finally {
@@ -1307,11 +1482,15 @@ Examples:
                 }
             }
             catch (error) {
-                console.error(chalk_1.default.red('Failed to process manifest update:'), error.message);
-                console.log(chalk_1.default.gray('Falling back to npm/git update channels...'));
+                console.error(chalk.red('Failed to process manifest update:'), error.message);
+                console.log(chalk.gray('Falling back to npm/git update channels...'));
             }
         }
-        console.log(chalk_1.default.cyan('Checking for updates...'));
+        if (isOfflineMode()) {
+            console.log(chalk.yellow('Offline mode (VIGTHORIA_OFFLINE=1): skipping update check.'));
+            return;
+        }
+        console.log(chalk.cyan('Checking for updates...'));
         try {
             // Get latest version from npm - cross-platform
             const latestVersion = execSync('npm view vigthoria-cli version', {
@@ -1323,35 +1502,35 @@ Examples:
             // Use semantic version comparison (1.6.0 > 1.5.9)
             const comparison = compareVersions(latestVersion, currentVersion);
             if (comparison <= 0) {
-                console.log(chalk_1.default.green(`You are running the latest version (${currentVersion})`));
+                console.log(chalk.green(`You are running the latest version (${currentVersion})`));
                 return;
             }
-            console.log(chalk_1.default.yellow(`Update available: ${currentVersion} -> ${latestVersion}`));
+            console.log(chalk.yellow(`Update available: ${currentVersion} -> ${latestVersion}`));
             if (options.check) {
-                console.log(chalk_1.default.gray('Run `vigthoria update` to install the update'));
+                console.log(chalk.gray('Run `vigthoria update` to install the update'));
                 return;
             }
-            console.log(chalk_1.default.cyan('Installing update from npm registry...'));
+            console.log(chalk.cyan('Installing update from npm registry...'));
             await installGlobalPackageWithNpm('vigthoria-cli@latest');
-            console.log(chalk_1.default.green(`Updated to version ${latestVersion}`));
-            console.log(chalk_1.default.gray('Please restart the CLI to use the new version'));
+            console.log(chalk.green(`Updated to version ${latestVersion}`));
+            console.log(chalk.gray('Please restart the CLI to use the new version'));
         }
         catch (error) {
-            console.error(chalk_1.default.red('Failed to check/install via npm registry:'), error.message);
+            console.error(chalk.red('Failed to check/install via npm registry:'), error.message);
             if (options.check) {
-                console.log(chalk_1.default.gray(`npm registry check failed; fallback install target is ${gitPackageSpec}`));
+                console.log(chalk.gray(`npm registry check failed; fallback install target is ${gitPackageSpec}`));
                 return;
             }
             try {
-                console.log(chalk_1.default.cyan('Attempting git package fallback...'));
+                console.log(chalk.cyan('Attempting git package fallback...'));
                 await installGlobalPackageWithNpm(gitPackageSpec);
-                console.log(chalk_1.default.green('Updated via git package fallback'));
-                console.log(chalk_1.default.gray('Please restart the CLI to use the new version'));
+                console.log(chalk.green('Updated via git package fallback'));
+                console.log(chalk.gray('Please restart the CLI to use the new version'));
             }
             catch (fallbackError) {
-                console.error(chalk_1.default.red('Fallback update also failed:'), fallbackError.message);
-                console.log(chalk_1.default.gray('Try manually: npm install -g vigthoria-cli@latest'));
-                console.log(chalk_1.default.gray(`Or: npm install -g ${gitPackageSpec}`));
+                console.error(chalk.red('Fallback update also failed:'), fallbackError.message);
+                console.log(chalk.gray('Try manually: npm install -g vigthoria-cli@latest'));
+                console.log(chalk.gray(`Or: npm install -g ${gitPackageSpec}`));
                 process.exitCode = 1;
             }
         }
@@ -1363,7 +1542,7 @@ Examples:
         .command('status')
         .description('Show Hyper Loop Legion infrastructure status')
         .action(async () => {
-        const legion = new legion_js_1.LegionCommand(config, logger);
+        const legion = new LegionCommand(config, logger);
         await legion.run(undefined, {
             status: true,
             workers: false,
@@ -1383,7 +1562,7 @@ Examples:
         .command('connect')
         .description('Connect to DevTools Bridge')
         .action(async () => {
-        const bridge = new bridge_js_1.BridgeCommand(config, logger);
+        const bridge = new BridgeCommand(config, logger);
         await bridge.status();
     });
     // Init command - Initialize project
@@ -1391,7 +1570,7 @@ Examples:
         .command('init')
         .description('Initialize Vigthoria in current project')
         .action(async () => {
-        const configCmd = new config_js_1.ConfigCommand(config, logger);
+        const configCmd = new ConfigCommand(config, logger);
         await configCmd.init();
     });
     const codingCommandDefinitions = [
@@ -1410,7 +1589,7 @@ Examples:
             .option('-p, --project <path>', 'Project directory', process.cwd())
             .action(async (requestParts = [], options) => {
             const requestText = requestParts.join(' ').trim();
-            const chat = new chat_js_1.ChatCommand(config, logger);
+            const chat = new ChatCommand(config, logger);
             await chat.run({
                 model: options.model || 'code',
                 project: options.project || process.cwd(),
@@ -1421,7 +1600,7 @@ Examples:
     try {
         // Default to chat if no command
         if (args.length === 2) {
-            const chat = new chat_js_1.ChatCommand(config, logger);
+            const chat = new ChatCommand(config, logger);
             await chat.run({ model: 'code', project: process.cwd() });
             process.exitCode = 0;
             return;
@@ -1437,10 +1616,6 @@ Examples:
     }
 }
 setupErrorHandlers();
-process.on('unhandledRejection', (reason) => {
-    handleFatalCliError(reason, process.argv.includes('--json'));
-    process.exit(1);
-});
 async function bootstrapCli() {
     try {
         await main(process.argv);
@@ -1459,4 +1634,4 @@ void (async () => {
         process.exit(1);
     }
 })();
-exports.__cliErrorHandlingReady = true;
+export const __cliErrorHandlingReady = true;