vigthoria-cli 1.9.9 → 1.9.19

package/dist/utils/api.js

@@ -1,27 +1,15 @@
-"use strict";
 /**
  * API Client for Vigthoria Backend
  * Connects to coder.vigthoria.io API endpoints
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.APIClient = exports.CLIError = void 0;
-exports.classifyError = classifyError;
-exports.formatCLIError = formatCLIError;
-exports.sanitizeUserFacingErrorText = sanitizeUserFacingErrorText;
-exports.isServerRuntime = isServerRuntime;
-exports.describeUpstreamStatus = describeUpstreamStatus;
-exports.propagateError = propagateError;
-const axios_1 = __importDefault(require("axios"));
-const crypto_1 = require("crypto");
-const fs_1 = __importDefault(require("fs"));
-const https_1 = __importDefault(require("https"));
-const net_1 = __importDefault(require("net"));
-const path_1 = __importDefault(require("path"));
-const ws_1 = __importDefault(require("ws"));
-class CLIError extends Error {
+import axios from 'axios';
+import { randomUUID } from 'crypto';
+import fs from 'fs';
+import https from 'https';
+import net from 'net';
+import path from 'path';
+import WebSocket from 'ws';
+export class CLIError extends Error {
     category;
     statusCode;
     endpoint;
@@ -35,9 +23,8 @@ class CLIError extends Error {
             this.cause = opts.cause;
     }
 }
-exports.CLIError = CLIError;
 /** Classify an axios or fetch error into a structured CLIError. */
-function classifyError(error, fallbackCategory = 'network') {
+export function classifyError(error, fallbackCategory = 'network') {
     if (error instanceof CLIError)
         return error;
     const axErr = error;
@@ -69,7 +56,7 @@ function classifyError(error, fallbackCategory = 'network') {
     return new CLIError(message, fallbackCategory, { statusCode: status, endpoint, cause: error instanceof Error ? error : undefined });
 }
 /** Format a CLIError for user-facing display. */
-function formatCLIError(err) {
+export function formatCLIError(err) {
     const tag = `[${err.category}]`;
     switch (err.category) {
         case 'auth':
@@ -92,13 +79,76 @@ function formatCLIError(err) {
             return `${tag} ${err.message}`;
     }
 }
-function sanitizeUserFacingErrorText(input) {
+export function sanitizeUserFacingPathText(input) {
+    let text = String(input || '');
+    if (!text) {
+        return text;
+    }
+    // Path token used for "<service>/<sub>" captures.  Excludes whitespace and
+    // any character that commonly terminates a path in CLI output.
+    const pathToken = String.raw `[^\s"'\)\]\}<>]+`;
+    // The replacements are applied in order — more specific patterns first.
+    // Every entry must cover the case WITH AND WITHOUT a trailing slash so
+    // bracketed paths like `[/tmp/vig-remote-xyz]` are also caught.
+    const replacements = [
+        // ── Temp-workspace directories used for remote (Windows/macOS) clients
+        [new RegExp(String.raw `/var/www/\.vigthoria/v3-temp/vig-remote-[A-Za-z0-9._-]+(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `\.vigthoria/v3-temp/vig-remote-[A-Za-z0-9._-]+(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `/tmp/vig-remote(?:-server)?-[A-Za-z0-9._-]+(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `/var/tmp/vig-remote(?:-server)?-[A-Za-z0-9._-]+(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `/tmp/vig-fork-[A-Za-z0-9._-]+(?:/${pathToken})?`, 'gi'), 'workspace'],
+        // ── Bare temp basenames after their /tmp/ prefix is already gone
+        [/\bvig-remote(?:-server)?-[A-Za-z0-9._-]+/gi, 'workspace'],
+        [/\bvig-fork-[A-Za-z0-9._-]+/gi, 'workspace'],
+        // ── V3 Code Agent installation tree and sibling services
+        [new RegExp(String.raw `/var/www/V3-Code-Agent(?:/${pathToken})?`, 'gi'), '[Vigthoria Agent]'],
+        [new RegExp(String.raw `/var/www/(?:agent-vigthoria|vigthoria-model-router|vigthoria-devtools-bridge|vigthoria-hyper-loop|vigthoria-mcp-server|vigthoria-template-service|vigthoria-security-devops|vigthoria-coder|vigthoria-code|Vigthoria-Code-2|vigthoria-asset-storage|vigthoria-storage-service|vigthoria-hosted)(?:/${pathToken})?`, 'gi'), '[Vigthoria service]'],
+        // ── User workspace mount + long-term storage backing path
+        [new RegExp(String.raw `/var/www/(?:vigthoria-user-workspaces|\.vigthoria)(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `/var/lib/vigthoria-workspaces(?:/${pathToken})?`, 'gi'), 'workspace'],
+        [new RegExp(String.raw `/mnt/storage-box/vigthoria(?:/${pathToken})?`, 'gi'), '[Vigthoria storage]'],
+        // ── Home / root leaks
+        [/\/home\/[A-Za-z0-9._-]+/gi, '[home]'],
+        [new RegExp(String.raw `/root(?:/${pathToken})?`, 'gi'), '[home]'],
+        // ── Backstop: any other /var/www tree
+        [new RegExp(String.raw `/var/www(?:/${pathToken})?`, 'gi'), '[Vigthoria service]'],
+        // ── Generic temp roots (after the more specific vig- patterns above)
+        [new RegExp(String.raw `/tmp(?:/${pathToken})?`, 'gi'), '[temp]'],
+        [new RegExp(String.raw `/var/tmp(?:/${pathToken})?`, 'gi'), '[temp]'],
+    ];
+    text = text.replace(/\\/g, '/');
+    for (const [pattern, replacement] of replacements) {
+        text = text.replace(pattern, replacement);
+    }
+    // Normalise abstract boundary URIs for human-friendly display.
+    text = text
+        .replace(/vigthoria:\/\/workspace\/?/gi, 'workspace/')
+        .replace(/vigthoria:\/\/temp\/?/gi, '[temp]/')
+        .replace(/vigthoria:\/\/(?:agent|service|storage|home|server-internal)\/?[^\s"'\)\]\}<>]*/gi, '[internal]');
+    // Strip server-internal phrasing so the LLM/CLI never says "server filesystem".
+    text = text
+        .replace(/outside bound workspace root(?:\s+[^\s.,;:)\]]+)?/gi, 'outside the workspace')
+        .replace(/\bbound workspace root(?:\s+[^\s.,;:)\]]+)?/gi, 'workspace')
+        .replace(/\boutside the active workspace sandbox(?::\s*[^\s.,;:)\]]+)?/gi, 'outside the workspace')
+        .replace(/\bescapes workspace root(?:\s+[^\s.,;:)\]]+)?/gi, 'escapes the workspace')
+        .replace(/\boutside allowed roots[^.]*\./gi, 'outside the workspace.')
+        .replace(/\bAllowed (?:server )?roots:[^\n]*/gi, 'Allowed locations: workspace only')
+        .replace(/\bBound server workspace:\s*\S+/gi, 'Bound workspace: workspace/')
+        .replace(/\bserver filesystem\b/gi, 'workspace sandbox')
+        .replace(/\bon the server\b/gi, 'in the workspace')
+        .replace(/\[(?:\s*)\]/g, '[workspace]')
+        .replace(/(^|\s)\.\//g, '$1')
+        .replace(/([^:])\/\/+/g, '$1/')
+        .replace(/[ \t]+/g, ' ');
+    return text;
+}
+export function sanitizeUserFacingErrorText(input) {
     const raw = String(input || '').trim();
     if (!raw) {
         return '';
     }
     const withoutTags = raw.replace(/<[^>]+>/g, ' ');
-    return withoutTags.replace(/\s+/g, ' ').trim();
+    return sanitizeUserFacingPathText(withoutTags).replace(/\s+/g, ' ').trim();
 }
 const TRUSTED_TOKEN_HOST_PATTERN = /(^|\.)vigthoria\.io$/i;
 function isLoopbackHost(hostname) {
@@ -132,7 +182,7 @@ function resolveAxiosRequestUrl(req) {
     }
     return direct;
 }
-function isServerRuntime() {
+export function isServerRuntime() {
     if (process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1') {
         return true;
     }
@@ -140,7 +190,7 @@ function isServerRuntime() {
     const cwd = String(process.cwd() || '').toLowerCase();
     return host.includes('ubuntu') || cwd.startsWith('/var/www');
 }
-function describeUpstreamStatus(status) {
+export function describeUpstreamStatus(status) {
     if (status >= 500)
         return 'upstream internal error';
     if (status === 429)
@@ -155,7 +205,7 @@ function describeUpstreamStatus(status) {
         return 'bad request';
     return 'ok';
 }
-function propagateError(err) {
+export function propagateError(err) {
     const status = typeof err?.statusCode === 'number'
         ? err.statusCode
         : typeof err?.status === 'number'
@@ -198,7 +248,7 @@ const DEFAULT_OPERATOR_TIMEOUT_MS = (() => {
     const parsed = Number.parseInt(rawValue, 10);
     return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
 })();
-class APIClient {
+export class APIClient {
     client;
     modelRouterClient;
     selfHostedModelRouterClient;
@@ -212,14 +262,14 @@ class APIClient {
         this.config = config;
         this.logger = logger;
         // Create HTTPS agent with proper settings for cross-platform compatibility
-        const httpsAgent = new https_1.default.Agent({
+        const httpsAgent = new https.Agent({
             rejectUnauthorized: true, // Enforce SSL verification
             keepAlive: true,
             timeout: 30000,
         });
         this._httpsAgent = httpsAgent;
         // Main Vigthoria Coder API (coder.vigthoria.io)
-        this.client = axios_1.default.create({
+        this.client = axios.create({
             baseURL: config.get('apiUrl'),
             timeout: 300000, // 5 minutes — covers review, fix, and agent relay flows
             httpsAgent,
@@ -230,7 +280,7 @@ class APIClient {
         });
         // Direct AI Models API - bypasses Coder for direct model access
         // This is the centralized Vigthoria API that routes to Model Router
-        this.modelRouterClient = axios_1.default.create({
+        this.modelRouterClient = axios.create({
             baseURL: config.get('modelsApiUrl') || 'https://api.vigthoria.io',
             timeout: 180000, // 3 minutes for model inference
             httpsAgent,
@@ -241,7 +291,7 @@ class APIClient {
         });
         // Self-hosted model router is opt-in only.
         const selfHostedModelsApiUrl = this.getSelfHostedModelsApiUrl();
-        this.selfHostedModelRouterClient = selfHostedModelsApiUrl ? axios_1.default.create({
+        this.selfHostedModelRouterClient = selfHostedModelsApiUrl ? axios.create({
             baseURL: selfHostedModelsApiUrl,
             timeout: 240000,
             headers: {
@@ -338,7 +388,7 @@ class APIClient {
             });
             // Set subscription from user data
             this.config.setSubscription({
-                plan: user.subscription?.plan || 'developer',
+                plan: user.subscription?.plan || 'community',
                 status: 'active',
                 expiresAt: undefined,
             });
@@ -413,7 +463,7 @@ class APIClient {
             || rawUser.subscription?.plan
             || rawUser.subscription_plan
             || data.subscription_plan
-            || 'developer';
+            || 'community';
         return {
             id: userId,
             email,
@@ -445,7 +495,7 @@ class APIClient {
             const response = await this.client.get('/api/user/subscription');
             const data = response.data;
             this.config.setSubscription({
-                plan: data.plan || data.subscription_plan || 'developer',
+                plan: data.plan || data.subscription_plan || 'community',
                 status: data.status || 'active',
                 expiresAt: data.expiresAt || data.expires_at
             });
@@ -467,19 +517,20 @@ class APIClient {
     async validateToken(options = {}) {
         const allowNetworkFailOpen = options.allowNetworkFailOpen !== false;
         const enforceTokenShape = options.enforceTokenShape !== false;
+        const explicitEnvToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
         const token = this.getAccessToken();
         if (!token) {
             return { valid: false, error: 'No auth token configured. Run: vigthoria login' };
         }
-        // Fast-fail obviously malformed tokens so invalid-token checks don't get
-        // masked by unrelated transport outages.
-        if (enforceTokenShape) {
+        // Fast-fail obviously malformed ENV override tokens so invalid-token checks
+        // don't get masked by unrelated transport outages. Persisted login tokens may
+        // be non-JWT in some deployments and must still be gateway-validated server-side.
+        if (enforceTokenShape && explicitEnvToken) {
             const looksLikeJwt = token.split('.').length === 3;
             if (!looksLikeJwt || token.length < 40) {
                 return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
             }
         }
-        const explicitEnvToken = Boolean(process.env.VIGTHORIA_TOKEN || process.env.VIGTHORIA_AUTH_TOKEN);
         const headers = {
             Authorization: `Bearer ${token}`,
             Cookie: `vigthoria-auth-token=${token}`,
@@ -488,23 +539,37 @@ class APIClient {
         // Probe protected canonical endpoints in parallel so stale local endpoint overrides
         // cannot mask an invalid gateway token during preflight.
         const results = await Promise.allSettled([
-            axios_1.default.get(`${canonicalBaseUrl}/api/user/profile`, { timeout: 5000, headers, httpsAgent: this._httpsAgent ?? undefined }),
-            axios_1.default.get(`${canonicalBaseUrl}/api/user/subscription`, { timeout: 5000, headers, httpsAgent: this._httpsAgent ?? undefined }),
+            axios.get(`${canonicalBaseUrl}/api/user/profile`, { timeout: 5000, headers, httpsAgent: this._httpsAgent ?? undefined }),
+            axios.get(`${canonicalBaseUrl}/api/user/subscription`, { timeout: 5000, headers, httpsAgent: this._httpsAgent ?? undefined }),
         ]);
         for (const r of results) {
             if (r.status === 'fulfilled')
                 return { valid: true };
         }
-        for (const r of results) {
-            if (r.status === 'rejected') {
-                const err = r.reason;
-                if (err.response?.status === 401 || err.response?.status === 403) {
-                    return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
-                }
-                if (err instanceof CLIError && err.category === 'auth') {
-                    return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
+        const sawUnauthorized = results.some((r) => r.status === 'rejected' && ((r.reason?.response?.status === 401) || (r.reason?.response?.status === 403) || (r.reason instanceof CLIError && r.reason.category === 'auth')));
+        if (sawUnauthorized) {
+            // For persisted CLI sessions, attempt one refresh before failing auth.
+            if (!explicitEnvToken) {
+                const refreshed = await this.refreshToken();
+                if (refreshed) {
+                    const retryToken = this.getAccessToken();
+                    if (retryToken) {
+                        const retryHeaders = {
+                            Authorization: `Bearer ${retryToken}`,
+                            Cookie: `vigthoria-auth-token=${retryToken}`,
+                        };
+                        const retryResults = await Promise.allSettled([
+                            axios.get(`${canonicalBaseUrl}/api/user/profile`, { timeout: 5000, headers: retryHeaders, httpsAgent: this._httpsAgent ?? undefined }),
+                            axios.get(`${canonicalBaseUrl}/api/user/subscription`, { timeout: 5000, headers: retryHeaders, httpsAgent: this._httpsAgent ?? undefined }),
+                        ]);
+                        for (const rr of retryResults) {
+                            if (rr.status === 'fulfilled')
+                                return { valid: true };
+                        }
+                    }
                 }
             }
+            return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
         }
         if (explicitEnvToken || !allowNetworkFailOpen) {
             return { valid: false, error: 'Auth token expired or invalid. Run: vigthoria login' };
@@ -624,11 +689,11 @@ class APIClient {
             if (!current) {
                 continue;
             }
-            for (const entry of fs_1.default.readdirSync(current, { withFileTypes: true })) {
+            for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
                 if (entry.name === '.git' || entry.name === 'node_modules') {
                     continue;
                 }
-                const fullPath = path_1.default.join(current, entry.name);
+                const fullPath = path.join(current, entry.name);
                 if (entry.isDirectory()) {
                     stack.push(fullPath);
                     continue;
@@ -636,7 +701,7 @@ class APIClient {
                 if (!entry.isFile()) {
                     continue;
                 }
-                const relativePath = this.normalizeWorkspaceRelativePath(path_1.default.relative(rootPath, fullPath));
+                const relativePath = this.normalizeWorkspaceRelativePath(path.relative(rootPath, fullPath));
                 if (relativePath) {
                     results.push(relativePath);
                 }
@@ -655,7 +720,7 @@ class APIClient {
             }
         }
         const scored = htmlPaths.map((relativePath) => {
-            const baseName = path_1.default.posix.basename(relativePath).toLowerCase();
+            const baseName = path.posix.basename(relativePath).toLowerCase();
             const depth = relativePath.split('/').length - 1;
             let score = 0;
             if (relativePath.toLowerCase() === 'index.html') {
@@ -677,7 +742,7 @@ class APIClient {
     extractLinkedFrontendAssets(html, entryPath) {
         const css = new Set();
         const js = new Set();
-        const entryDir = path_1.default.posix.dirname(this.normalizeWorkspaceRelativePath(entryPath) || '.');
+        const entryDir = path.posix.dirname(this.normalizeWorkspaceRelativePath(entryPath) || '.');
         const normalizeAsset = (assetPath) => {
             const clean = String(assetPath || '').trim();
             if (!clean || clean.startsWith('http://') || clean.startsWith('https://') || clean.startsWith('//') || clean.startsWith('data:') || clean.startsWith('#')) {
@@ -690,7 +755,7 @@ class APIClient {
             if (withoutQuery.startsWith('/')) {
                 return this.normalizeWorkspaceRelativePath(withoutQuery.slice(1));
             }
-            return this.normalizeWorkspaceRelativePath(path_1.default.posix.normalize(path_1.default.posix.join(entryDir, withoutQuery)));
+            return this.normalizeWorkspaceRelativePath(path.posix.normalize(path.posix.join(entryDir, withoutQuery)));
         };
         const cssPattern = /<link[^>]+href=["']([^"']+\.css(?:[?#][^"']*)?)["'][^>]*>/gi;
         const jsPattern = /<script[^>]+src=["']([^"']+\.(?:js|mjs|cjs)(?:[?#][^"']*)?)["'][^>]*>/gi;
@@ -714,7 +779,7 @@ class APIClient {
     }
     gatherFrontendPreviewArtifacts(message = '', context = {}) {
         const rootPath = this.resolveAgentTargetPath(context);
-        if (!rootPath || !fs_1.default.existsSync(rootPath)) {
+        if (!rootPath || !fs.existsSync(rootPath)) {
             return { error: 'Frontend preview gate requires a readable project workspace.' };
         }
         const workspaceFiles = this.listFrontendWorkspaceFiles(rootPath);
@@ -727,7 +792,7 @@ class APIClient {
         if (!htmlPath) {
             return { error: 'Frontend preview gate could not determine a primary HTML entry file.' };
         }
-        const html = fs_1.default.readFileSync(path_1.default.join(rootPath, htmlPath), 'utf8');
+        const html = fs.readFileSync(path.join(rootPath, htmlPath), 'utf8');
         const linkedAssets = this.extractLinkedFrontendAssets(html, htmlPath);
         const cssFiles = workspaceFiles.filter((filePath) => /\.css$/i.test(filePath));
         const jsFiles = workspaceFiles.filter((filePath) => /\.(?:js|mjs|cjs)$/i.test(filePath));
@@ -744,7 +809,7 @@ class APIClient {
                 if (!normalized || selected.has(normalized)) {
                     continue;
                 }
-                if (!fs_1.default.existsSync(path_1.default.join(rootPath, normalized))) {
+                if (!fs.existsSync(path.join(rootPath, normalized))) {
                     continue;
                 }
                 selected.add(normalized);
@@ -753,8 +818,8 @@ class APIClient {
         };
         const selectedCssFiles = chooseExisting(linkedAssets.css, [...expectedCss, ...cssFiles]).slice(0, 12);
         const selectedJsFiles = chooseExisting(linkedAssets.js, [...expectedJs, ...jsFiles]).slice(0, 12);
-        const css = selectedCssFiles.map((filePath) => fs_1.default.readFileSync(path_1.default.join(rootPath, filePath), 'utf8')).join('\n\n');
-        const js = selectedJsFiles.map((filePath) => fs_1.default.readFileSync(path_1.default.join(rootPath, filePath), 'utf8')).join('\n\n');
+        const css = selectedCssFiles.map((filePath) => fs.readFileSync(path.join(rootPath, filePath), 'utf8')).join('\n\n');
+        const js = selectedJsFiles.map((filePath) => fs.readFileSync(path.join(rootPath, filePath), 'utf8')).join('\n\n');
         return { htmlPath, html, css, js, cssPaths: selectedCssFiles, jsPaths: selectedJsFiles };
     }
     async captureFrontendPreviewScreenshot(entryAbsolutePath, screenshotPath) {
@@ -807,14 +872,14 @@ class APIClient {
             return previewGate;
         }
         try {
-            const artifactsDir = path_1.default.join(rootPath, '.vigthoria', 'proof', 'preview');
-            fs_1.default.mkdirSync(artifactsDir, { recursive: true });
+            const artifactsDir = path.join(rootPath, '.vigthoria', 'proof', 'preview');
+            fs.mkdirSync(artifactsDir, { recursive: true });
             const contextId = String(context.contextId || 'preview').trim() || 'preview';
             const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
             const baseName = `${timestamp}-${contextId}`;
-            const manifestPath = path_1.default.join(artifactsDir, `${baseName}.json`);
-            const screenshotPath = path_1.default.join(artifactsDir, `${baseName}.png`);
-            const entryAbsolutePath = path_1.default.join(rootPath, previewGate.entryPath);
+            const manifestPath = path.join(artifactsDir, `${baseName}.json`);
+            const screenshotPath = path.join(artifactsDir, `${baseName}.png`);
+            const entryAbsolutePath = path.join(rootPath, previewGate.entryPath);
             const previewFileUrl = `file://${entryAbsolutePath}`;
             const screenshot = await this.captureFrontendPreviewScreenshot(entryAbsolutePath, screenshotPath);
             const manifest = {
@@ -839,7 +904,7 @@ class APIClient {
                     error: screenshot.error || null,
                 },
             };
-            fs_1.default.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+            fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
             return {
                 ...previewGate,
                 artifacts: {
@@ -889,7 +954,7 @@ class APIClient {
                     css,
                     js,
                     entryPath: artifacts.htmlPath,
-                    workspaceName: path_1.default.basename(rootPath),
+                    workspaceName: path.basename(rootPath),
                 });
                 // Skip preview proof if payload is still too large (> 4 MB)
                 if (Buffer.byteLength(proofPayload, 'utf8') > 4 * 1024 * 1024) {
@@ -1021,7 +1086,7 @@ class APIClient {
         if (!authToken) {
             throw new Error('Not authenticated. Run vigthoria login first.');
         }
-        const response = await axios_1.default.post(`${baseUrl}/api/auth/sso`, { token: authToken }, {
+        const response = await axios.post(`${baseUrl}/api/auth/sso`, { token: authToken }, {
             headers: {
                 'Content-Type': 'application/json',
             },
@@ -1081,7 +1146,7 @@ class APIClient {
                 query.set('search', options.search);
             }
             const url = `${this.vigFlowEndpoint(baseUrl, '/templates')}${query.size > 0 ? `?${query.toString()}` : ''}`;
-            const response = await axios_1.default.get(url, {
+            const response = await axios.get(url, {
                 headers,
                 timeout: 30000,
             });
@@ -1091,7 +1156,7 @@ class APIClient {
     }
     async listVigFlowWorkflows() {
         return this.withVigFlow('list workflows', async (baseUrl, headers) => {
-            const response = await axios_1.default.get(this.vigFlowEndpoint(baseUrl, '/workflows'), {
+            const response = await axios.get(this.vigFlowEndpoint(baseUrl, '/workflows'), {
                 headers,
                 timeout: 30000,
             });
@@ -1143,7 +1208,7 @@ class APIClient {
     }
     async useVigFlowTemplate(templateId, options = {}) {
         return this.withVigFlow('use template', async (baseUrl, headers) => {
-            const response = await axios_1.default.post(`${this.vigFlowEndpoint(baseUrl, `/templates/${encodeURIComponent(templateId)}/use`)}`, {
+            const response = await axios.post(`${this.vigFlowEndpoint(baseUrl, `/templates/${encodeURIComponent(templateId)}/use`)}`, {
                 name: options.name,
                 variables: options.variables || {},
             }, {
@@ -1159,7 +1224,7 @@ class APIClient {
     }
     async runVigFlowWorkflow(workflowId, options = {}) {
         return this.withVigFlow('run workflow', async (baseUrl, headers) => {
-            const response = await axios_1.default.post(`${this.vigFlowEndpoint(baseUrl, `/executions/run/${encodeURIComponent(workflowId)}`)}`, {
+            const response = await axios.post(`${this.vigFlowEndpoint(baseUrl, `/executions/run/${encodeURIComponent(workflowId)}`)}`, {
                 data: options.data || {},
                 options: options.executionOptions || {},
             }, {
@@ -1175,7 +1240,7 @@ class APIClient {
     }
     async getVigFlowExecutionStatus(executionId) {
         return this.withVigFlow('execution status', async (baseUrl, headers) => {
-            const response = await axios_1.default.get(`${this.vigFlowEndpoint(baseUrl, `/executions/${encodeURIComponent(executionId)}`)}`, {
+            const response = await axios.get(`${this.vigFlowEndpoint(baseUrl, `/executions/${encodeURIComponent(executionId)}`)}`, {
                 headers,
                 timeout: 30000,
             });
@@ -1218,7 +1283,7 @@ class APIClient {
             projectPath: effectiveWorkspacePath,
             targetPath: effectiveWorkspacePath,
             localWorkspacePath: localWorkspacePath || null,
-            localWorkspaceName: localWorkspacePath ? path_1.default.basename(localWorkspacePath) : null,
+            localWorkspaceName: localWorkspacePath ? path.basename(localWorkspacePath) : null,
             localWorkspaceSummary,
             // Signal to the server that the workspace filesystem is not locally
             // accessible — it must hydrate a temp directory from the provided
@@ -1338,7 +1403,7 @@ class APIClient {
             projectPath: resolvedContext.projectPath || targetPath,
             targetPath,
             localWorkspacePath: targetPath,
-            localWorkspaceName: targetPath ? path_1.default.basename(targetPath) : null,
+            localWorkspaceName: targetPath ? path.basename(targetPath) : null,
             contextId: resolvedContext.contextId,
             traceId: resolvedContext.traceId,
             requestStartedAt: resolvedContext.requestStartedAt,
@@ -1353,7 +1418,7 @@ class APIClient {
         if (!rootPath) {
             return null;
         }
-        fs_1.default.mkdirSync(rootPath, { recursive: true });
+        fs.mkdirSync(rootPath, { recursive: true });
         const appName = this.extractEmergencyAppName(message);
         const html = `<!DOCTYPE html>
 <html lang="en">
@@ -1795,14 +1860,14 @@ menu {
   });
 });
 `;
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'index.html'), `${html.trimEnd()}\n`, 'utf8');
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'styles.css'), `${css.trimEnd()}\n`, 'utf8');
-        fs_1.default.writeFileSync(path_1.default.join(rootPath, 'scripts.js'), `${js.trimEnd()}\n`, 'utf8');
+        fs.writeFileSync(path.join(rootPath, 'index.html'), `${html.trimEnd()}\n`, 'utf8');
+        fs.writeFileSync(path.join(rootPath, 'styles.css'), `${css.trimEnd()}\n`, 'utf8');
+        fs.writeFileSync(path.join(rootPath, 'scripts.js'), `${js.trimEnd()}\n`, 'utf8');
         return appName;
     }
     ensureExecutionContext(context = {}) {
         const existingId = String(context.contextId || context.traceId || '').trim();
-        const contextId = existingId || `vig-${Date.now()}-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
+        const contextId = existingId || `vig-${Date.now()}-${randomUUID().slice(0, 8)}`;
         return {
             ...context,
             contextId,
@@ -1906,21 +1971,21 @@ menu {
     }
     resolveServerBindableWorkspacePath(context = {}) {
         const candidate = this.resolveAgentTargetPath(context);
-        if (!candidate || this.isLikelyWindowsPath(candidate) || !path_1.default.isAbsolute(candidate) || !fs_1.default.existsSync(candidate)) {
+        if (!candidate || this.isLikelyWindowsPath(candidate) || !path.isAbsolute(candidate) || !fs.existsSync(candidate)) {
             return '';
         }
         const configuredRoots = (process.env.VIGTHORIA_SERVER_WORKSPACE_ROOTS || '/var/www/vigthoria-user-workspaces,/var/lib/vigthoria-workspaces')
             .split(',')
             .map((entry) => entry.trim())
             .filter(Boolean);
-        const resolvedCandidate = fs_1.default.realpathSync(candidate);
+        const resolvedCandidate = fs.realpathSync(candidate);
         for (const root of configuredRoots) {
-            if (!fs_1.default.existsSync(root)) {
+            if (!fs.existsSync(root)) {
                 continue;
             }
-            const resolvedRoot = fs_1.default.realpathSync(root);
+            const resolvedRoot = fs.realpathSync(root);
             try {
-                if (path_1.default.relative(resolvedRoot, resolvedCandidate) === '' || !path_1.default.relative(resolvedRoot, resolvedCandidate).startsWith('..')) {
+                if (path.relative(resolvedRoot, resolvedCandidate) === '' || !path.relative(resolvedRoot, resolvedCandidate).startsWith('..')) {
                     return resolvedCandidate;
                 }
             }
@@ -1931,21 +1996,21 @@ menu {
         return '';
     }
     buildLocalWorkspaceSummary(rootPath) {
-        if (!rootPath || !fs_1.default.existsSync(rootPath)) {
+        if (!rootPath || !fs.existsSync(rootPath)) {
             return null;
         }
         try {
             const summary = {
                 path: rootPath,
-                name: path_1.default.basename(rootPath),
+                name: path.basename(rootPath),
                 files: [],
             };
             const snapshot = this.getAgentWorkspaceSnapshot(rootPath);
             summary.fileCount = snapshot.fileCount;
             summary.files = snapshot.paths.slice(0, 40);
-            const packageJsonPath = path_1.default.join(rootPath, 'package.json');
-            if (fs_1.default.existsSync(packageJsonPath)) {
-                const pkg = JSON.parse(fs_1.default.readFileSync(packageJsonPath, 'utf8'));
+            const packageJsonPath = path.join(rootPath, 'package.json');
+            if (fs.existsSync(packageJsonPath)) {
+                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
                 summary.packageJson = {
                     name: pkg.name || null,
                     version: pkg.version || null,
@@ -1954,9 +2019,9 @@ menu {
                     devDependencies: Object.keys(pkg.devDependencies || {}).slice(0, 20),
                 };
             }
-            const readmePath = path_1.default.join(rootPath, 'README.md');
-            if (fs_1.default.existsSync(readmePath)) {
-                summary.readmeExcerpt = fs_1.default.readFileSync(readmePath, 'utf8').slice(0, 2500);
+            const readmePath = path.join(rootPath, 'README.md');
+            if (fs.existsSync(readmePath)) {
+                summary.readmeExcerpt = fs.readFileSync(readmePath, 'utf8').slice(0, 2500);
             }
             // Hydrate workspace: include actual file contents so the V3 server
             // can populate the remote workspace before the agent starts.
@@ -1991,17 +2056,17 @@ menu {
         for (const relativePath of filePaths) {
             if (totalBytes >= MAX_TOTAL_BYTES)
                 break;
-            const ext = path_1.default.extname(relativePath).toLowerCase();
+            const ext = path.extname(relativePath).toLowerCase();
             if (BINARY_EXTENSIONS.has(ext))
                 continue;
             if (/(^|[\/\\])\.(git|hg)([\/\\]|$)/.test(relativePath))
                 continue;
-            const absolutePath = path_1.default.join(rootPath, relativePath);
+            const absolutePath = path.join(rootPath, relativePath);
             try {
-                const stat = fs_1.default.statSync(absolutePath);
+                const stat = fs.statSync(absolutePath);
                 if (!stat.isFile() || stat.size > MAX_FILE_BYTES || stat.size === 0)
                     continue;
-                const content = fs_1.default.readFileSync(absolutePath, 'utf8');
+                const content = fs.readFileSync(absolutePath, 'utf8');
                 // Skip likely binary content (high ratio of non-printable chars)
                 if (/[\x00-\x08\x0e-\x1f]/.test(content.slice(0, 512)))
                     continue;
@@ -2017,7 +2082,7 @@ menu {
     hasAgentWorkspaceOutput(context = {}) {
         try {
             const root = this.resolveAgentTargetPath(context);
-            if (!root || !fs_1.default.existsSync(root)) {
+            if (!root || !fs.existsSync(root)) {
                 return false;
             }
             const stack = [root];
@@ -2025,12 +2090,12 @@ menu {
                 const current = stack.pop();
                 if (!current)
                     continue;
-                const entries = fs_1.default.readdirSync(current, { withFileTypes: true });
+                const entries = fs.readdirSync(current, { withFileTypes: true });
                 for (const entry of entries) {
                     if (entry.name === '.git' || entry.name === 'node_modules') {
                         continue;
                     }
-                    const fullPath = path_1.default.join(current, entry.name);
+                    const fullPath = path.join(current, entry.name);
                     if (entry.isFile()) {
                         return true;
                     }
@@ -2054,11 +2119,11 @@ menu {
             if (!current) {
                 continue;
             }
-            for (const entry of fs_1.default.readdirSync(current, { withFileTypes: true })) {
+            for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
                 if (entry.name === '.git' || entry.name === 'node_modules') {
                     continue;
                 }
-                const fullPath = path_1.default.join(current, entry.name);
+                const fullPath = path.join(current, entry.name);
                 if (entry.isDirectory()) {
                     stack.push(fullPath);
                     continue;
@@ -2067,8 +2132,8 @@ menu {
                     continue;
                 }
                 fileCount += 1;
-                const stat = fs_1.default.statSync(fullPath);
-                entries.push(`${path_1.default.relative(rootPath, fullPath)}:${stat.size}:${stat.mtimeMs}`);
+                const stat = fs.statSync(fullPath);
+                entries.push(`${path.relative(rootPath, fullPath)}:${stat.size}:${stat.mtimeMs}`);
             }
         }
         entries.sort();
@@ -2080,7 +2145,7 @@ menu {
     }
     async waitForAgentWorkspaceSettle(context = {}, options = {}) {
         const rootPath = this.resolveAgentTargetPath(context);
-        if (!rootPath || !fs_1.default.existsSync(rootPath)) {
+        if (!rootPath || !fs.existsSync(rootPath)) {
             return;
         }
         const timeoutMs = options.timeoutMs || 15000;
@@ -2145,7 +2210,36 @@ menu {
         return Array.from(candidates);
     }
     captureV3AgentStreamMutation(event, streamedFiles, serverRoot) {
-        if (!event || event.type !== 'tool_call' || !streamedFiles) {
+        if (!event || !streamedFiles) {
+            return;
+        }
+        if (event.type === 'file_mutation' && typeof event.path === 'string') {
+            const filePath = this.normalizeAgentWorkspaceRelativePath(event.path, serverRoot || undefined);
+            if (!filePath) {
+                return;
+            }
+            if (event.action === 'delete') {
+                delete streamedFiles[filePath];
+                return;
+            }
+            if (typeof event.content === 'string') {
+                streamedFiles[filePath] = event.content;
+            }
+            return;
+        }
+        if (event.type === 'workspace_snapshot' && event.files && typeof event.files === 'object') {
+            for (const [rawPath, content] of Object.entries(event.files)) {
+                if (typeof content !== 'string') {
+                    continue;
+                }
+                const filePath = this.normalizeAgentWorkspaceRelativePath(rawPath, serverRoot || undefined);
+                if (filePath) {
+                    streamedFiles[filePath] = content;
+                }
+            }
+            return;
+        }
+        if (event.type !== 'tool_call') {
             return;
         }
         const args = event.arguments || {};
@@ -2166,18 +2260,95 @@ menu {
             }
         }
     }
+    applyV3AgentStreamEventToWorkspace(event, context = {}, serverRoot) {
+        if (!event || !['file_mutation', 'workspace_snapshot'].includes(String(event.type || ''))) {
+            return false;
+        }
+        const rootPath = this.resolveAgentTargetPath(context);
+        if (!rootPath) {
+            return false;
+        }
+        if (event.type === 'workspace_snapshot' && event.files && typeof event.files === 'object') {
+            let applied = false;
+            for (const [rawPath, content] of Object.entries(event.files)) {
+                if (typeof content !== 'string') {
+                    continue;
+                }
+                applied = this.writeV3AgentWorkspaceFile(rootPath, rawPath, content, serverRoot || undefined) || applied;
+            }
+            return applied;
+        }
+        if (event.type === 'file_mutation' && typeof event.path === 'string') {
+            const relativePath = this.normalizeAgentWorkspaceRelativePath(event.path, serverRoot || undefined);
+            if (!relativePath) {
+                return false;
+            }
+            if (event.action === 'delete') {
+                return this.deleteV3AgentWorkspaceFile(rootPath, relativePath);
+            }
+            if (typeof event.content === 'string') {
+                return this.writeV3AgentWorkspaceFile(rootPath, relativePath, event.content, rootPath);
+            }
+        }
+        return false;
+    }
+    writeV3AgentWorkspaceFile(rootPath, rawPath, content, sourceRoot) {
+        const relativePath = this.normalizeAgentWorkspaceRelativePath(rawPath, sourceRoot || rootPath);
+        if (!relativePath) {
+            return false;
+        }
+        const absolutePath = path.resolve(rootPath, relativePath);
+        const resolvedRoot = path.resolve(rootPath);
+        if (absolutePath !== resolvedRoot && !absolutePath.startsWith(resolvedRoot + path.sep)) {
+            this.logger.warn(`Refusing to write V3 file outside workspace: ${rawPath}`);
+            return false;
+        }
+        try {
+            fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+            if (fs.existsSync(absolutePath)) {
+                const existing = fs.readFileSync(absolutePath, 'utf8');
+                if (existing === content) {
+                    return false;
+                }
+            }
+            fs.writeFileSync(absolutePath, content, 'utf8');
+            return true;
+        }
+        catch (error) {
+            this.logger.warn(`Failed to write V3 file ${relativePath}: ${error.message}`);
+            return false;
+        }
+    }
+    deleteV3AgentWorkspaceFile(rootPath, rawPath) {
+        const relativePath = this.normalizeAgentWorkspaceRelativePath(rawPath, rootPath);
+        if (!relativePath) {
+            return false;
+        }
+        const absolutePath = path.resolve(rootPath, relativePath);
+        const resolvedRoot = path.resolve(rootPath);
+        if (absolutePath !== resolvedRoot && !absolutePath.startsWith(resolvedRoot + path.sep)) {
+            this.logger.warn(`Refusing to delete V3 file outside workspace: ${rawPath}`);
+            return false;
+        }
+        try {
+            if (fs.existsSync(absolutePath) && fs.statSync(absolutePath).isFile()) {
+                fs.unlinkSync(absolutePath);
+                return true;
+            }
+        }
+        catch (error) {
+            this.logger.warn(`Failed to delete V3 file ${relativePath}: ${error.message}`);
+        }
+        return false;
+    }
     recoverAgentWorkspaceFiles(context = {}, streamedFiles = {}, expectedFiles = []) {
         const rootPath = this.resolveAgentTargetPath(context);
         if (!rootPath || Object.keys(streamedFiles).length === 0) {
             return;
         }
-        // Create the local workspace directory if it doesn't exist yet.
-        // This is needed for remote CLI clients where the user specified a
-        // path (e.g., C:\vigthoria\Apps\pacman_rogue) that may not have
-        // been created before the V3 run.
-        if (!fs_1.default.existsSync(rootPath)) {
+        if (!fs.existsSync(rootPath)) {
             try {
-                fs_1.default.mkdirSync(rootPath, { recursive: true });
+                fs.mkdirSync(rootPath, { recursive: true });
             }
             catch {
                 return;
@@ -2193,12 +2364,7 @@ menu {
             if (typeof content !== 'string') {
                 continue;
             }
-            const absolutePath = path_1.default.join(rootPath, relativePath);
-            if (fs_1.default.existsSync(absolutePath)) {
-                continue;
-            }
-            fs_1.default.mkdirSync(path_1.default.dirname(absolutePath), { recursive: true });
-            fs_1.default.writeFileSync(absolutePath, content, 'utf8');
+            this.writeV3AgentWorkspaceFile(rootPath, relativePath, content, rootPath);
         }
     }
     normalizeAgentWorkspaceRelativePath(rawPath, rootPath) {
@@ -2206,10 +2372,35 @@ menu {
         if (!input) {
             return '';
         }
+        const safeRelative = (candidate) => {
+            const stripped = String(candidate || '').replace(/^\/+/, '');
+            if (!stripped || /^[a-zA-Z]:\//.test(stripped)) {
+                return '';
+            }
+            const normalized = path.posix.normalize(stripped);
+            if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../') || path.posix.isAbsolute(normalized)) {
+                return '';
+            }
+            return normalized;
+        };
+        const internalWorkspacePatterns = [
+            /^\/?var\/www\/\.vigthoria\/v3-temp\/vig-remote-[^/]+\/(.+)$/i,
+            /^\.vigthoria\/v3-temp\/vig-remote-[^/]+\/(.+)$/i,
+            /^\/?tmp\/vig-remote(?:-server)?-[^/]+\/(.+)$/i,
+            /^\/?tmp\/vig-fork-[^/]+\/(.+)$/i,
+            /^\/?home\/user\/(.+)$/i,
+            /^\/?root\/(.+)$/i,
+        ];
+        for (const pattern of internalWorkspacePatterns) {
+            const match = input.match(pattern);
+            if (match && match[1]) {
+                return safeRelative(match[1]);
+            }
+        }
         const normalizedRoot = String(rootPath || '').trim().replace(/\\/g, '/').replace(/\/+$/g, '');
         if (normalizedRoot) {
             const rootNoLeadingSlash = normalizedRoot.replace(/^\//, '');
-            const rootBase = path_1.default.posix.basename(normalizedRoot);
+            const rootBase = path.posix.basename(normalizedRoot);
             const prefixes = [
                 `${normalizedRoot}/`,
                 `${rootNoLeadingSlash}/`,
@@ -2217,20 +2408,20 @@ menu {
             ];
             for (const prefix of prefixes) {
                 if (input.startsWith(prefix)) {
-                    return input.slice(prefix.length).replace(/^\//, '');
+                    return safeRelative(input.slice(prefix.length));
                 }
             }
             const embeddedRoot = `/${rootBase}/`;
             const embeddedIndex = input.indexOf(embeddedRoot);
             if (embeddedIndex >= 0) {
-                return input.slice(embeddedIndex + embeddedRoot.length).replace(/^\//, '');
+                return safeRelative(input.slice(embeddedIndex + embeddedRoot.length));
             }
         }
-        return input.replace(/^\//, '');
+        return safeRelative(input);
     }
     async ensureAgentFrontendPolish(message = '', context = {}) {
         const rootPath = this.resolveAgentTargetPath(context);
-        if (!rootPath || !fs_1.default.existsSync(rootPath)) {
+        if (!rootPath || !fs.existsSync(rootPath)) {
             return;
         }
         const prompt = String(message || '');
@@ -2240,20 +2431,20 @@ menu {
         if (!looksLikeFrontendTask) {
             return;
         }
-        const htmlPath = path_1.default.join(rootPath, 'index.html');
-        if (!fs_1.default.existsSync(htmlPath)) {
+        const htmlPath = path.join(rootPath, 'index.html');
+        if (!fs.existsSync(htmlPath)) {
             return;
         }
-        const html = fs_1.default.readFileSync(htmlPath, 'utf8');
+        const html = fs.readFileSync(htmlPath, 'utf8');
         const ensuredAssets = this.ensureReferencedFrontendAssets(rootPath, html, prompt, 'Vigthoria CLI');
         const cssPath = ensuredAssets.cssPath;
         const jsPath = ensuredAssets.jsPath;
         let nextHtml = ensuredAssets.html;
-        if (!cssPath || !fs_1.default.existsSync(cssPath)) {
+        if (!cssPath || !fs.existsSync(cssPath)) {
             return;
         }
-        let css = fs_1.default.readFileSync(cssPath, 'utf8');
-        let js = fs_1.default.existsSync(jsPath) ? fs_1.default.readFileSync(jsPath, 'utf8') : '';
+        let css = fs.readFileSync(cssPath, 'utf8');
+        let js = fs.existsSync(jsPath) ? fs.readFileSync(jsPath, 'utf8') : '';
         const keyframesBlocks = Array.from(js.matchAll(/@keyframes[\s\S]*?\n\}/g)).map((match) => match[0]);
         if (keyframesBlocks.length > 0) {
             const migrated = keyframesBlocks.filter((block) => !css.includes(block));
@@ -2261,8 +2452,8 @@ menu {
                 css = `${css.trimEnd()}\n\n/* Vigthoria CLI Recovered CSS */\n${migrated.join('\n\n')}\n`;
             }
             js = js.replace(/\n?@keyframes[\s\S]*?\n\}/g, '').trim();
-            fs_1.default.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
-            fs_1.default.writeFileSync(jsPath, js ? `${js.trimEnd()}\n` : '', 'utf8');
+            fs.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
+            fs.writeFileSync(jsPath, js ? `${js.trimEnd()}\n` : '', 'utf8');
         }
         const wantsPricing = /(pay-as-you-go|pricing)/i.test(prompt);
         if (wantsPricing && !/(id="pricing"|Pay-as-you-go|pay-as-you-go|pricing tiers)/i.test(nextHtml)) {
@@ -2305,24 +2496,24 @@ menu {
         nextHtml = repairedAssets.html;
         css = repairedAssets.css;
         if (nextHtml !== html) {
-            fs_1.default.writeFileSync(htmlPath, `${nextHtml.trimEnd()}\n`, 'utf8');
-            nextHtml = fs_1.default.readFileSync(htmlPath, 'utf8');
+            fs.writeFileSync(htmlPath, `${nextHtml.trimEnd()}\n`, 'utf8');
+            nextHtml = fs.readFileSync(htmlPath, 'utf8');
         }
-        if (css !== fs_1.default.readFileSync(cssPath, 'utf8')) {
-            fs_1.default.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
+        if (css !== fs.readFileSync(cssPath, 'utf8')) {
+            fs.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
         }
         if (/classList\.add\('hidden'\)|classList\.add\("hidden"\)|classList\.add\('revealed'\)|classList\.add\("revealed"\)/.test(js)
             && !/\.hidden\b|\.revealed\b/.test(css)) {
             css = `${css.trimEnd()}\n\n/* Vigthoria CLI Visibility States */\n.hidden {\n    opacity: 0;\n    transform: translateY(24px);\n}\n\n.revealed {\n    opacity: 1;\n    transform: translateY(0);\n    transition: opacity 0.7s ease, transform 0.7s ease;\n}\n`;
-            fs_1.default.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
+            fs.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
         }
         if (/^\s*sections\./m.test(js) && !/(?:const|let|var)\s+sections\s*=/.test(js)) {
             js = `const sections = document.querySelectorAll('section');\n\n${js.trimStart()}`;
-            fs_1.default.writeFileSync(jsPath, `${js.trimEnd()}\n`, 'utf8');
+            fs.writeFileSync(jsPath, `${js.trimEnd()}\n`, 'utf8');
         }
         if (!/@media|matchMedia|mobile-nav|hamburger|menu-toggle/i.test(`${nextHtml}\n${css}\n${js}`)) {
             css = `${css.trimEnd()}\n\n/* Vigthoria CLI Responsive Baseline */\n@media (max-width: 900px) {\n    .nav-links, .nav-list, nav ul {\n        display: none;\n        flex-direction: column;\n        gap: 0.75rem;\n    }\n\n    .nav-links.is-open, .nav-list.is-open, nav ul.is-open {\n        display: flex;\n    }\n\n    .mobile-nav-toggle, #menu-toggle, .menu-toggle {\n        display: inline-flex;\n    }\n}\n`;
-            fs_1.default.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
+            fs.writeFileSync(cssPath, `${css.trimEnd()}\n`, 'utf8');
         }
         const combined = `${nextHtml}\n${css}\n${js}`;
         if (/IntersectionObserver|motion-reveal|\.revealed\b|vigCliFadeIn|classList\.add\('is-visible'\)|classList\.add\("is-visible"\)/i.test(combined)) {
@@ -2331,10 +2522,10 @@ menu {
         const cssMarker = '/* Vigthoria CLI Motion Enhancement */';
         const jsMarker = '/* Vigthoria CLI Motion Enhancement */';
         if (!css.includes(cssMarker)) {
-            fs_1.default.appendFileSync(cssPath, `\n\n${cssMarker}\n.hero, section {\n    opacity: 0;\n    transform: translateY(24px);\n    animation: vigCliFadeIn 0.8s ease forwards;\n}\n\nsection {\n    animation-delay: 0.12s;\n}\n\nbutton, .cta, a {\n    transition: transform 0.25s ease, opacity 0.25s ease;\n}\n\nbutton:hover, .cta:hover, a:hover {\n    transform: translateY(-2px);\n}\n\n.motion-reveal {\n    opacity: 0;\n    transform: translateY(24px);\n    transition: opacity 0.7s ease, transform 0.7s ease;\n}\n\n.motion-reveal.is-visible {\n    opacity: 1;\n    transform: translateY(0);\n}\n\n@keyframes vigCliFadeIn {\n    from {\n        opacity: 0;\n        transform: translateY(24px);\n    }\n    to {\n        opacity: 1;\n        transform: translateY(0);\n    }\n}\n`, 'utf8');
+            fs.appendFileSync(cssPath, `\n\n${cssMarker}\n.hero, section {\n    opacity: 0;\n    transform: translateY(24px);\n    animation: vigCliFadeIn 0.8s ease forwards;\n}\n\nsection {\n    animation-delay: 0.12s;\n}\n\nbutton, .cta, a {\n    transition: transform 0.25s ease, opacity 0.25s ease;\n}\n\nbutton:hover, .cta:hover, a:hover {\n    transform: translateY(-2px);\n}\n\n.motion-reveal {\n    opacity: 0;\n    transform: translateY(24px);\n    transition: opacity 0.7s ease, transform 0.7s ease;\n}\n\n.motion-reveal.is-visible {\n    opacity: 1;\n    transform: translateY(0);\n}\n\n@keyframes vigCliFadeIn {\n    from {\n        opacity: 0;\n        transform: translateY(24px);\n    }\n    to {\n        opacity: 1;\n        transform: translateY(0);\n    }\n}\n`, 'utf8');
         }
         if (!js.includes(jsMarker)) {
-            fs_1.default.appendFileSync(jsPath, `\n\n${jsMarker}\ndocument.addEventListener('DOMContentLoaded', () => {\n    const revealTargets = document.querySelectorAll('section, .hero, .project-grid > *, .journal-preview > *');\n    if (typeof IntersectionObserver !== 'function') {\n        revealTargets.forEach((element) => element.classList.add('is-visible'));\n        return;\n    }\n\n    const observer = new IntersectionObserver((entries) => {\n        entries.forEach((entry) => {\n            if (entry.isIntersecting) {\n                entry.target.classList.add('is-visible');\n                observer.unobserve(entry.target);\n            }\n        });\n    }, { threshold: 0.16 });\n\n    revealTargets.forEach((element, index) => {\n        element.classList.add('motion-reveal');\n        element.style.transitionDelay = String(Math.min(index * 60, 320)) + 'ms';\n        observer.observe(element);\n    });\n});\n`, 'utf8');
+            fs.appendFileSync(jsPath, `\n\n${jsMarker}\ndocument.addEventListener('DOMContentLoaded', () => {\n    const revealTargets = document.querySelectorAll('section, .hero, .project-grid > *, .journal-preview > *');\n    if (typeof IntersectionObserver !== 'function') {\n        revealTargets.forEach((element) => element.classList.add('is-visible'));\n        return;\n    }\n\n    const observer = new IntersectionObserver((entries) => {\n        entries.forEach((entry) => {\n            if (entry.isIntersecting) {\n                entry.target.classList.add('is-visible');\n                observer.unobserve(entry.target);\n            }\n        });\n    }, { threshold: 0.16 });\n\n    revealTargets.forEach((element, index) => {\n        element.classList.add('motion-reveal');\n        element.style.transitionDelay = String(Math.min(index * 60, 320)) + 'ms';\n        observer.observe(element);\n    });\n});\n`, 'utf8');
         }
     }
     injectSectionBeforeFooter(html, sectionMarkup) {
@@ -2368,10 +2559,10 @@ menu {
             if (!normalized) {
                 return '';
             }
-            const absolutePath = path_1.default.join(rootPath, normalized);
-            if (!fs_1.default.existsSync(absolutePath)) {
-                fs_1.default.mkdirSync(path_1.default.dirname(absolutePath), { recursive: true });
-                fs_1.default.writeFileSync(absolutePath, content, 'utf8');
+            const absolutePath = path.join(rootPath, normalized);
+            if (!fs.existsSync(absolutePath)) {
+                fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+                fs.writeFileSync(absolutePath, content, 'utf8');
             }
             return absolutePath;
         };
@@ -2381,8 +2572,8 @@ menu {
         const jsRefs = Array.from(html.matchAll(/<script[^>]+src=["']([^"']+\.(?:js|mjs)(?:\?[^"']*)?)["']/gi))
             .map((match) => localAssetPath(match[1]))
             .filter(Boolean);
-        let cssPath = cssRefs.map((ref) => path_1.default.join(rootPath, ref)).find((candidate) => fs_1.default.existsSync(candidate)) || '';
-        let jsPath = jsRefs.map((ref) => path_1.default.join(rootPath, ref)).find((candidate) => fs_1.default.existsSync(candidate)) || '';
+        let cssPath = cssRefs.map((ref) => path.join(rootPath, ref)).find((candidate) => fs.existsSync(candidate)) || '';
+        let jsPath = jsRefs.map((ref) => path.join(rootPath, ref)).find((candidate) => fs.existsSync(candidate)) || '';
         const cssTemplate = this.buildFallbackFrontendCss(surfaceLabel);
         const jsTemplate = this.buildFallbackFrontendJs(surfaceLabel);
         if (!cssPath && cssRefs.length > 0) {
@@ -2410,7 +2601,7 @@ menu {
         return {
             html,
             cssPath,
-            jsPath: jsPath || path_1.default.join(rootPath, 'scripts.js'),
+            jsPath: jsPath || path.join(rootPath, 'scripts.js'),
         };
     }
     buildFallbackFrontendCss(surfaceLabel) {
@@ -2561,7 +2752,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 return true;
             }
             const sanitized = candidate.split('?')[0].split('#')[0].replace(/^\//, '');
-            return !sanitized || fs_1.default.existsSync(path_1.default.join(rootPath, sanitized));
+            return !sanitized || fs.existsSync(path.join(rootPath, sanitized));
         };
         const repairedHtml = html.replace(/(<img\b[^>]*\ssrc=["'])([^"']+)(["'][^>]*>)/gi, (match, prefix, assetPath, suffix) => {
             if (hasLocalAsset(assetPath)) {
@@ -2583,22 +2774,22 @@ document.addEventListener('DOMContentLoaded', () => {
     formatV3AgentResponse(data) {
         const result = data?.result || {};
         if (typeof result === 'string') {
-            return result;
+            return sanitizeUserFacingPathText(result);
         }
         if (typeof result?.summary === 'string' && result.summary.trim()) {
-            return result.summary;
+            return sanitizeUserFacingPathText(result.summary);
         }
         if (typeof result?.message === 'string' && result.message.trim()) {
-            return result.message;
+            return sanitizeUserFacingPathText(result.message);
         }
         if (Array.isArray(data?.events)) {
             const completionEvent = [...data.events].reverse().find((event) => event && event.type === 'complete' && typeof event.summary === 'string' && event.summary.trim());
             if (completionEvent) {
-                return completionEvent.summary;
+                return sanitizeUserFacingPathText(completionEvent.summary);
             }
             const messageEvent = [...data.events].reverse().find((event) => event && event.type === 'message' && typeof event.content === 'string' && event.content.trim());
             if (messageEvent) {
-                return messageEvent.content;
+                return sanitizeUserFacingPathText(messageEvent.content);
             }
             // Synthesize a grounded answer from the tool-call evidence the
             // agent produced, rather than dumping the raw event trace.
@@ -2610,9 +2801,9 @@ document.addEventListener('DOMContentLoaded', () => {
         // Last resort: if data has files written, report them.
         if (data?.files && typeof data.files === 'object' && Object.keys(data.files).length > 0) {
             const fileList = Object.keys(data.files).join(', ');
-            return `Agent wrote workspace files: ${fileList}`;
+            return `Agent wrote workspace files: ${sanitizeUserFacingPathText(fileList)}`;
         }
-        const text = JSON.stringify(data, null, 2);
+        const text = sanitizeUserFacingPathText(JSON.stringify(data, null, 2));
         return text.length > 12000 ? `${text.slice(0, 12000)}\n\n[V3 agent output truncated]` : text;
     }
     /**
@@ -2630,27 +2821,27 @@ document.addEventListener('DOMContentLoaded', () => {
             if (event.type === 'tool_result' && event.success && typeof event.output === 'string') {
                 const name = event.name || 'unknown_tool';
                 if (name === 'read_file' && typeof event.target === 'string') {
-                    filesRead.push(event.target);
+                    filesRead.push(sanitizeUserFacingPathText(event.target));
                 }
                 else if ((name === 'write_file' || name === 'create_file') && typeof event.target === 'string') {
-                    filesWritten.push(event.target);
+                    filesWritten.push(sanitizeUserFacingPathText(event.target));
                 }
                 else {
                     // Keep last ~300 chars of output for context
                     const excerpt = event.output.length > 300 ? event.output.slice(-300) : event.output;
-                    toolResults.push(`[${name}] ${excerpt}`);
+                    toolResults.push(`[${name}] ${sanitizeUserFacingPathText(excerpt)}`);
                 }
             }
             if (event.type === 'assistant' && typeof event.content === 'string' && event.content.trim()) {
-                assistantFragments.push(event.content.trim());
+                assistantFragments.push(sanitizeUserFacingPathText(event.content.trim()));
             }
             // Some servers emit 'text' events for incremental assistant text
             if (event.type === 'text' && typeof event.content === 'string' && event.content.trim()) {
-                assistantFragments.push(event.content.trim());
+                assistantFragments.push(sanitizeUserFacingPathText(event.content.trim()));
             }
             // Some servers emit content_block_delta for streamed text
             if (event.type === 'content_block_delta' && typeof event.delta?.text === 'string' && event.delta.text.trim()) {
-                assistantFragments.push(event.delta.text.trim());
+                assistantFragments.push(sanitizeUserFacingPathText(event.delta.text.trim()));
             }
         }
         // Concatenate ALL assistant text fragments in order — keeps full
@@ -2674,6 +2865,25 @@ document.addEventListener('DOMContentLoaded', () => {
             ? sections.join('\n\n')
             : '';
     }
+    sanitizeV3AgentEventForUser(event) {
+        const sanitizeValue = (value) => {
+            if (typeof value === 'string') {
+                return sanitizeUserFacingPathText(value);
+            }
+            if (Array.isArray(value)) {
+                return value.map((entry) => sanitizeValue(entry));
+            }
+            if (value && typeof value === 'object') {
+                const copy = {};
+                for (const [key, entry] of Object.entries(value)) {
+                    copy[key] = sanitizeValue(entry);
+                }
+                return copy;
+            }
+            return value;
+        };
+        return sanitizeValue(event);
+    }
     async collectV3AgentStream(response, context = {}) {
         if (!response.body || typeof response.body.getReader !== 'function') {
             return response.json();
@@ -2747,7 +2957,8 @@ document.addEventListener('DOMContentLoaded', () => {
                     continue;
                 }
                 const event = JSON.parse(payload);
-                events.push(event);
+                const userEvent = this.sanitizeV3AgentEventForUser(event);
+                events.push(userEvent);
                 if (!contextId && typeof event.context_id === 'string' && event.context_id.trim()) {
                     contextId = event.context_id.trim();
                 }
@@ -2755,6 +2966,7 @@ document.addEventListener('DOMContentLoaded', () => {
                     serverWorkspaceRoot = event.workspace_root.trim();
                 }
                 this.captureV3AgentStreamMutation(event, streamedFiles, serverWorkspaceRoot);
+                this.applyV3AgentStreamEventToWorkspace(event, context, serverWorkspaceRoot);
                 // Empty workspace guard: if the remote agent lists its root
                 // and finds nothing while our local workspace has files, the
                 // workspace was not hydrated. Abort early with a clear error
@@ -2771,7 +2983,7 @@ document.addEventListener('DOMContentLoaded', () => {
                         || /^\[\/tmp\/vig-remote-server-[^\]]+\]\s*$/.test(listOutput);
                     if (looksEmpty) {
                         const localPath = this.resolveAgentTargetPath(context);
-                        const localHasFiles = localPath && fs_1.default.existsSync(localPath) && this.hasAgentWorkspaceOutput({ ...context, projectPath: localPath, targetPath: localPath });
+                        const localHasFiles = localPath && fs.existsSync(localPath) && this.hasAgentWorkspaceOutput({ ...context, projectPath: localPath, targetPath: localPath });
                         if (localHasFiles) {
                             throw new Error('Remote workspace is empty — the V3 server did not receive your project files. '
                                 + 'Your local workspace has files but the remote agent sees an empty directory. '
@@ -2781,7 +2993,7 @@ document.addEventListener('DOMContentLoaded', () => {
                 }
                 if (typeof context.onStreamEvent === 'function') {
                     try {
-                        context.onStreamEvent(event);
+                        context.onStreamEvent(userEvent);
                     }
                     catch {
                         // Ignore UI callback failures; never break the agent stream for them.
@@ -3095,6 +3307,8 @@ document.addEventListener('DOMContentLoaded', () => {
                             mcp_context_id: executionContext.mcpContextId || null,
                             rawPrompt: executionContext.rawPrompt || null,
                             requestStartedAt: executionContext.requestStartedAt,
+                            vigthoriaBrain: executionContext.vigthoriaBrain || null,
+                            vigthoria_brain: executionContext.vigthoriaBrain || null,
                         },
                         workflow_type: executionContext.workflowType || 'full',
                         options: {
@@ -3335,7 +3549,7 @@ document.addEventListener('DOMContentLoaded', () => {
             try {
                 this.logger.debug(`Canonical Vigthoria Cloud fallback: ${resolvedModel}`);
                 const token = this.getAccessToken();
-                const response = await axios_1.default.post('https://coder.vigthoria.io/api/ai/chat', {
+                const response = await axios.post('https://coder.vigthoria.io/api/ai/chat', {
                     messages,
                     model: resolvedModel,
                     maxTokens: this.config.get('preferences').maxTokens,
@@ -3469,13 +3683,20 @@ document.addEventListener('DOMContentLoaded', () => {
         const selfHostedModels = new Set([
             'vigthoria-v3-code-35b',
             'vigthoria-v3-code-35b:latest',
+            'vigthoria-v3-code-9b',
+            'vigthoria-v3-code-9b:latest',
+            'vigthoria-v3-balanced-4b',
+            'vigthoria-v3-balanced-4b:latest',
             'qwen3-coder:latest',
-            'vigthoria-v2-code-8b',
         ]);
         return selfHostedModels.has(resolvedModel)
             || normalizedRequested === 'agent'
             || normalizedRequested === 'code'
             || normalizedRequested === 'code-30b'
+            || normalizedRequested === 'code-35b'
+            || normalizedRequested === 'code-9b'
+            || normalizedRequested === 'balanced'
+            || normalizedRequested === 'balanced-4b'
             || normalizedRequested === 'pro';
     }
     getSelfHostedFallbackModelId(resolvedModel, requestedModel) {
@@ -3489,7 +3710,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const wsUrl = this.config.get('wsUrl');
         const token = this.config.get('authToken');
         return new Promise((resolve, reject) => {
-            const ws = new ws_1.default(`${wsUrl}/chat`, {
+            const ws = new WebSocket(`${wsUrl}/chat`, {
                 headers: { Authorization: `Bearer ${token}` },
             });
             ws.on('open', () => {
@@ -3518,7 +3739,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const wsUrl = this.config.get('wsUrl');
         const token = this.config.get('authToken');
         return new Promise((resolve, reject) => {
-            const ws = new ws_1.default(`${wsUrl}/chat`, {
+            const ws = new WebSocket(`${wsUrl}/chat`, {
                 headers: { Authorization: `Bearer ${token}` },
             });
             ws.on('open', () => {
@@ -4415,15 +4636,17 @@ document.addEventListener('DOMContentLoaded', () => {
             // ═══════════════════════════════════════════════════════════════
             // VIGTHORIA LOCAL - Self-hosted models
             // ═══════════════════════════════════════════════════════════════
-            'fast': 'vigthoria-fast-1.7b',
+            'fast': 'vigthoria-v3-balanced-4b',
             'mini': 'vigthoria-mini-0.6b',
-            'balanced': 'vigthoria-balanced-4b',
-            'balanced-4b': 'vigthoria-balanced-4b',
+            'balanced': 'vigthoria-v3-balanced-4b',
+            'balanced-4b': 'vigthoria-v3-balanced-4b',
             'creative': 'vigthoria-creative-9b-v4',
-            // Code Models - 30B is the default powerhouse
+            // Code Models - 35B is the default powerhouse
             'code': 'vigthoria-v3-code-35b', // Internal: self-hosted 35B on Blackwell
             'code-30b': 'vigthoria-v3-code-35b',
-            'code-8b': 'vigthoria-v2-code-8b',
+            'code-35b': 'vigthoria-v3-code-35b',
+            'code-8b': 'vigthoria-v3-code-9b',
+            'code-9b': 'vigthoria-v3-code-9b',
             'pro': 'vigthoria-v3-code-35b',
             'agent': 'vigthoria-v3-code-35b',
             'vigthoria-code': 'vigthoria-v3-code-35b',
@@ -4723,7 +4946,7 @@ document.addEventListener('DOMContentLoaded', () => {
         const port = Number.parseInt(process.env.VIGTHORIA_DEVTOOLS_BRIDGE_PORT || '4016', 10);
         const endpoint = `ws://${host}:${port}/ws`;
         return new Promise((resolve) => {
-            const socket = net_1.default.connect({ host, port, timeout: 1500 }, () => {
+            const socket = net.connect({ host, port, timeout: 1500 }, () => {
                 socket.end();
                 resolve({
                     name: 'DevTools Bridge',
@@ -4792,4 +5015,3 @@ document.addEventListener('DOMContentLoaded', () => {
         return status.overallOk;
     }
 }
-exports.APIClient = APIClient;