vigthoria-cli 1.9.9 → 1.9.19

package/dist/utils/bridge-client.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Vigthoria CLI → DevTools Bridge Telemetry Client
  *
@@ -12,57 +11,18 @@
  *  - Opt-in via --bridge <url> flag
  *  - Sensitive data (API keys, tokens) is never transmitted
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BridgeClient = void 0;
-exports.getBridgeClient = getBridgeClient;
-const ws_1 = __importDefault(require("ws"));
-const os = __importStar(require("os"));
-const chalk_1 = __importDefault(require("chalk"));
-const logger_js_1 = require("./logger.js");
+import WebSocket from 'ws';
+import * as os from 'os';
+import chalk from 'chalk';
+import { CH } from './logger.js';
 // ── Singleton accessor ───────────────────────────────────────────────
 let _instance = null;
 /** Get the active bridge client (may be null if --bridge was not used). */
-function getBridgeClient() {
+export function getBridgeClient() {
     return _instance;
 }
 // ── BridgeClient ─────────────────────────────────────────────────────
-class BridgeClient {
+export class BridgeClient {
     ws = null;
     url;
     apiKey;
@@ -93,7 +53,7 @@ class BridgeClient {
             return;
         return new Promise((resolve) => {
             try {
-                this.ws = new ws_1.default(this.url, { handshakeTimeout: 8000 });
+                this.ws = new WebSocket(this.url, { handshakeTimeout: 8000 });
                 this.ws.on('open', () => {
                     this.connected = true;
                     this.reconnectDelay = 2000;
@@ -137,7 +97,7 @@ class BridgeClient {
                     this.stopHeartbeat();
                     this.scheduleReconnect();
                     if (process.env.DEBUG || process.env.VIGTHORIA_DEBUG) {
-                        console.log(chalk_1.default.yellow(`${logger_js_1.CH.warn} Bridge: connection failed, will retry in background.`));
+                        console.log(chalk.yellow(`${CH.warn} Bridge: connection failed, will retry in background.`));
                     }
                     resolve(); // resolve even on failure – must never block CLI
                 });
@@ -225,7 +185,7 @@ class BridgeClient {
             clientId: this.clientId,
         };
         const json = JSON.stringify(event);
-        if (this.connected && this.ws?.readyState === ws_1.default.OPEN) {
+        if (this.connected && this.ws?.readyState === WebSocket.OPEN) {
             try {
                 this.ws.send(json);
             }
@@ -238,7 +198,7 @@ class BridgeClient {
         }
     }
     sendRaw(obj) {
-        if (this.ws?.readyState === ws_1.default.OPEN) {
+        if (this.ws?.readyState === WebSocket.OPEN) {
             this.ws.send(JSON.stringify(obj));
         }
     }
@@ -249,7 +209,7 @@ class BridgeClient {
         this.queue.push(json);
     }
     flushQueue() {
-        while (this.queue.length > 0 && this.ws?.readyState === ws_1.default.OPEN) {
+        while (this.queue.length > 0 && this.ws?.readyState === WebSocket.OPEN) {
             const msg = this.queue.shift();
             try {
                 this.ws.send(msg);
@@ -280,4 +240,3 @@ class BridgeClient {
         }
     }
 }
-exports.BridgeClient = BridgeClient;

package/dist/utils/cli-state.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Vigthoria CLI — shared local-state helpers.
+ *
+ * Single source for:
+ *   • Offline-mode detection (VIGTHORIA_OFFLINE=1) — suppresses every
+ *     background network call (update checks, gateway preflights, etc.).
+ *   • Telemetry opt-out (VIGTHORIA_TELEMETRY_DISABLED=1).
+ *   • Update-check cache, so `npm view` is not invoked on every CLI start.
+ *   • Cross-platform safe file mode enforcement for tokens / sessions.
+ *
+ * No external network calls — pure local helpers.  Safe to import from
+ * any command module.
+ */
+/** 24h is plenty for an update-check ping. */
+export declare const UPDATE_CHECK_TTL_MS: number;
+/** 60s gateway-preflight cache so back-to-back CLI invocations stay fast. */
+export declare const GATEWAY_PREFLIGHT_TTL_MS: number;
+export interface CliStateShape {
+    updateCheck?: {
+        checkedAt: number;
+        latestVersion: string;
+        notifiedFor?: string;
+    };
+    gatewayPreflight?: {
+        checkedAt: number;
+        valid: boolean;
+    };
+    /** Last-seen version — used to render release notes on upgrade. */
+    lastSeenVersion?: string;
+}
+export declare function ensureStateDir(): void;
+/** Best-effort lock-down: `0o600` on POSIX, no-op on Windows (NTFS ACL ≠ chmod). */
+export declare function secureFileMode(filePath: string): void;
+/** Atomic write helper — write to temp then rename, never half-written JSON. */
+export declare function atomicWriteJson(targetPath: string, value: unknown, mode?: number): void;
+export declare function loadCliState(): CliStateShape;
+export declare function saveCliState(state: CliStateShape): void;
+export declare function getCliStateFile(): string;
+/**
+ * Offline mode — set VIGTHORIA_OFFLINE=1 to skip every non-essential
+ * outbound HTTP call. Useful for restricted networks, air-gapped runs,
+ * and deterministic CI.
+ */
+export declare function isOfflineMode(): boolean;
+/** Telemetry opt-out (also implied when offline mode is on). */
+export declare function isTelemetryDisabled(): boolean;
+/** When true the startup update check is suppressed (env override or offline). */
+export declare function isUpdateCheckSuppressed(): boolean;
+/** Cached read for the latest known version — null when stale or absent. */
+export declare function readCachedLatestVersion(maxAgeMs?: number): string | null;
+export declare function writeCachedLatestVersion(latestVersion: string, notifiedFor?: string): void;
+export declare function readGatewayPreflightCache(maxAgeMs?: number): boolean | null;
+export declare function writeGatewayPreflightCache(valid: boolean): void;
+export declare function isSafeNpmPackageSpec(spec: string): boolean;

package/dist/utils/cli-state.js

@@ -0,0 +1,185 @@
+/**
+ * Vigthoria CLI — shared local-state helpers.
+ *
+ * Single source for:
+ *   • Offline-mode detection (VIGTHORIA_OFFLINE=1) — suppresses every
+ *     background network call (update checks, gateway preflights, etc.).
+ *   • Telemetry opt-out (VIGTHORIA_TELEMETRY_DISABLED=1).
+ *   • Update-check cache, so `npm view` is not invoked on every CLI start.
+ *   • Cross-platform safe file mode enforcement for tokens / sessions.
+ *
+ * No external network calls — pure local helpers.  Safe to import from
+ * any command module.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+const STATE_DIR = path.join(os.homedir(), '.vigthoria');
+const STATE_FILE = path.join(STATE_DIR, 'cli-state.json');
+/** 24h is plenty for an update-check ping. */
+export const UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1000;
+/** 60s gateway-preflight cache so back-to-back CLI invocations stay fast. */
+export const GATEWAY_PREFLIGHT_TTL_MS = 60 * 1000;
+function readStateUnchecked() {
+    try {
+        if (!fs.existsSync(STATE_FILE)) {
+            return {};
+        }
+        const text = fs.readFileSync(STATE_FILE, 'utf8');
+        if (!text.trim()) {
+            return {};
+        }
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        // Corrupt state file should never crash the CLI — treat as empty.
+        return {};
+    }
+}
+export function ensureStateDir() {
+    try {
+        if (!fs.existsSync(STATE_DIR)) {
+            fs.mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
+        }
+        if (process.platform !== 'win32') {
+            try {
+                fs.chmodSync(STATE_DIR, 0o700);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    catch {
+        // Best-effort — caller will see write failure later if it matters.
+    }
+}
+/** Best-effort lock-down: `0o600` on POSIX, no-op on Windows (NTFS ACL ≠ chmod). */
+export function secureFileMode(filePath) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // File may not exist yet, or filesystem may not support chmod.
+    }
+}
+/** Atomic write helper — write to temp then rename, never half-written JSON. */
+export function atomicWriteJson(targetPath, value, mode = 0o600) {
+    ensureStateDir();
+    const parent = path.dirname(targetPath);
+    try {
+        if (!fs.existsSync(parent))
+            fs.mkdirSync(parent, { recursive: true });
+    }
+    catch { /* ignore */ }
+    const tmpPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(value, null, 2), 'utf8');
+    if (process.platform !== 'win32') {
+        try {
+            fs.chmodSync(tmpPath, mode);
+        }
+        catch { /* ignore */ }
+    }
+    fs.renameSync(tmpPath, targetPath);
+}
+export function loadCliState() {
+    return readStateUnchecked();
+}
+export function saveCliState(state) {
+    atomicWriteJson(STATE_FILE, state);
+}
+export function getCliStateFile() {
+    return STATE_FILE;
+}
+/**
+ * Offline mode — set VIGTHORIA_OFFLINE=1 to skip every non-essential
+ * outbound HTTP call. Useful for restricted networks, air-gapped runs,
+ * and deterministic CI.
+ */
+export function isOfflineMode() {
+    const flag = String(process.env.VIGTHORIA_OFFLINE || '').trim().toLowerCase();
+    return flag === '1' || flag === 'true' || flag === 'yes';
+}
+/** Telemetry opt-out (also implied when offline mode is on). */
+export function isTelemetryDisabled() {
+    if (isOfflineMode())
+        return true;
+    const flag = String(process.env.VIGTHORIA_TELEMETRY_DISABLED || '').trim().toLowerCase();
+    return flag === '1' || flag === 'true' || flag === 'yes';
+}
+/** When true the startup update check is suppressed (env override or offline). */
+export function isUpdateCheckSuppressed() {
+    if (isOfflineMode())
+        return true;
+    const flag = String(process.env.VIGTHORIA_NO_UPDATE_CHECK || '').trim();
+    return flag === '1';
+}
+/** Cached read for the latest known version — null when stale or absent. */
+export function readCachedLatestVersion(maxAgeMs = UPDATE_CHECK_TTL_MS) {
+    const state = readStateUnchecked();
+    const entry = state.updateCheck;
+    if (!entry || !entry.latestVersion || typeof entry.checkedAt !== 'number') {
+        return null;
+    }
+    if (Date.now() - entry.checkedAt > maxAgeMs) {
+        return null;
+    }
+    return entry.latestVersion;
+}
+export function writeCachedLatestVersion(latestVersion, notifiedFor) {
+    try {
+        const state = readStateUnchecked();
+        state.updateCheck = {
+            checkedAt: Date.now(),
+            latestVersion,
+            notifiedFor: notifiedFor || state.updateCheck?.notifiedFor,
+        };
+        saveCliState(state);
+    }
+    catch {
+        // Caching is a nice-to-have, never block CLI on write failure.
+    }
+}
+export function readGatewayPreflightCache(maxAgeMs = GATEWAY_PREFLIGHT_TTL_MS) {
+    const state = readStateUnchecked();
+    const entry = state.gatewayPreflight;
+    if (!entry || typeof entry.checkedAt !== 'number' || typeof entry.valid !== 'boolean') {
+        return null;
+    }
+    if (Date.now() - entry.checkedAt > maxAgeMs) {
+        return null;
+    }
+    return entry.valid;
+}
+export function writeGatewayPreflightCache(valid) {
+    try {
+        const state = readStateUnchecked();
+        state.gatewayPreflight = { checkedAt: Date.now(), valid };
+        saveCliState(state);
+    }
+    catch {
+        // Best-effort.
+    }
+}
+/**
+ * Validate an npm package spec used by `vigthoria update --from <spec>`.
+ * Returns `true` when the spec is acceptable.  Rejects whitespace and
+ * shell metacharacters so the spec can never break out of `execFile` /
+ * a Windows `shell:true` fallback into command injection.
+ */
+const NPM_SPEC_ALLOWLIST = /^[A-Za-z0-9_./@:+\\=-]+$/;
+const DISALLOWED_SHELL_CHARS = /[;&|`$<>(){}\[\]"'\s]/;
+export function isSafeNpmPackageSpec(spec) {
+    const candidate = String(spec || '').trim();
+    if (!candidate)
+        return false;
+    if (candidate.length > 512)
+        return false;
+    if (DISALLOWED_SHELL_CHARS.test(candidate))
+        return false;
+    if (!NPM_SPEC_ALLOWLIST.test(candidate))
+        return false;
+    return true;
+}

package/dist/utils/config.d.ts

@@ -40,6 +40,11 @@ export declare class Config {
     private static readonly OPERATOR_PLANS;
     private static readonly CLOUD_PLANS;
     constructor();
+    /**
+     * Re-apply secure POSIX permissions to the on-disk config file.  Safe
+     * to call repeatedly; no-op on Windows.
+     */
+    secureOnDisk(): void;
     get<K extends keyof VigthoriaCLIConfig>(key: K): VigthoriaCLIConfig[K];
     set<K extends keyof VigthoriaCLIConfig>(key: K, value: VigthoriaCLIConfig[K]): void;
     getAll(): VigthoriaCLIConfig;

package/dist/utils/config.js

@@ -1,13 +1,8 @@
-"use strict";
 /**
  * Configuration Manager for Vigthoria CLI
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Config = void 0;
-const conf_1 = __importDefault(require("conf"));
+import Conf from 'conf';
+import { secureFileMode } from './cli-state.js';
 const defaultConfig = {
     apiUrl: 'https://coder.vigthoria.io',
     modelsApiUrl: 'https://api.vigthoria.io', // Direct AI Models API - no proxying through Coder
@@ -45,14 +40,20 @@ const defaultConfig = {
         ],
     },
 };
-class Config {
+export class Config {
     store;
-    static OPERATOR_PLANS = new Set(['pro', 'professional', 'ultra', 'enterprise', 'admin', 'master_admin']);
+    static OPERATOR_PLANS = new Set(['enterprise', 'admin', 'master_admin']);
     static CLOUD_PLANS = new Set(['pro', 'professional', 'ultra', 'enterprise', 'master_admin', 'admin']);
     constructor() {
-        this.store = new conf_1.default({
+        // `Conf` defaults to 0o644 on POSIX which would leave auth tokens
+        // readable by every local user.  We post-process the file in
+        // `secureOnDisk()` to enforce 0o600 ownership.  The `fileMode`
+        // option exists on newer `conf` releases — supply it via a cast so
+        // older type-defs do not reject the field.
+        this.store = new Conf({
             projectName: 'vigthoria-cli',
             defaults: defaultConfig,
+            ...{ fileMode: 0o600 },
             schema: {
                 apiUrl: { type: 'string' },
                 modelsApiUrl: { type: 'string' },
@@ -90,6 +91,23 @@ class Config {
                 },
             },
         });
+        // Defence-in-depth: re-apply 0600 every time we instantiate Config so
+        // that an older install which created the file with 0644 gets locked
+        // down on next startup.
+        try {
+            secureFileMode(this.store.path);
+        }
+        catch { /* best-effort */ }
+    }
+    /**
+     * Re-apply secure POSIX permissions to the on-disk config file.  Safe
+     * to call repeatedly; no-op on Windows.
+     */
+    secureOnDisk() {
+        try {
+            secureFileMode(this.store.path);
+        }
+        catch { /* best-effort */ }
     }
     get(key) {
         return this.store.get(key);
@@ -136,6 +154,10 @@ class Config {
         }
         this.store.set('userId', data.userId);
         this.store.set('email', data.email);
+        // Tighten permissions whenever the token rotates so a brand-new
+        // install (which may have created the file under a previous default
+        // umask) becomes 0600 immediately after first login.
+        this.secureOnDisk();
     }
     clearAuth() {
         this.store.set('authToken', null);
@@ -166,9 +188,9 @@ class Config {
             { id: 'agent', name: 'Vigthoria Agent GPU', description: 'Blackwell autonomous agent workflow', tier: 'local', backendModel: 'vigthoria-v3-code-35b' },
             { id: 'code', name: 'Vigthoria v3 Code 35B', description: 'Native 35B coding model on Blackwell', tier: 'local', backendModel: 'vigthoria-v3-code-35b' },
             { id: 'code-35b', name: 'Vigthoria v3 Code 35B', description: 'Same flagship model as code', tier: 'local', backendModel: 'vigthoria-v3-code-35b' },
-            { id: 'code-9b', name: 'Vigthoria C1 Code 9B', description: 'Efficient coding specialist for quick tasks', tier: 'local', backendModel: 'vigthoria_c1_m' },
-            { id: 'balanced', name: 'Vigthoria Master 7.6B', description: 'Balanced general-purpose local model', tier: 'local', backendModel: 'vigthoria_master' },
-            { id: 'balanced-4b', name: 'Vigthoria v3 Balanced 4B', description: 'Efficient 4B general-purpose model (Qwen3.5-4B based)', tier: 'local', backendModel: 'vigthoria-balanced-4b' },
+            { id: 'code-9b', name: 'Vigthoria v3 Code 9B', description: 'Efficient coding specialist for quick tasks', tier: 'local', backendModel: 'vigthoria-v3-code-9b' },
+            { id: 'balanced', name: 'Vigthoria v3 Balanced 4B', description: 'Balanced general-purpose local model', tier: 'local', backendModel: 'vigthoria-v3-balanced-4b' },
+            { id: 'balanced-4b', name: 'Vigthoria v3 Balanced 4B', description: 'Efficient 4B general-purpose model (Qwen3.5-4B based)', tier: 'local', backendModel: 'vigthoria-v3-balanced-4b' },
         ];
         // ═══════════════════════════════════════════════════════════════
         // VIGTHORIA CLOUD - Premium cloud models (Pro subscription)
@@ -202,4 +224,3 @@ class Config {
         return this.hasOperatorAccess() && this.hasCloudAccess() && this.isComplexTask(prompt);
     }
 }
-exports.Config = Config;

package/dist/utils/context-ranker.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Vigthoria CLI — Semantic Context Ranker
  *
@@ -8,13 +7,8 @@
  *
  * No external dependencies — uses only Node.js built-ins.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildSemanticContext = buildSemanticContext;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
+import fs from 'node:fs';
+import path from 'node:path';
 const IGNORED_DIRS = new Set([
     '.git', 'node_modules', 'dist', '.next', '__pycache__',
     '.vigthoria', 'coverage', '.cache', '.turbo', 'build', 'out',
@@ -45,8 +39,8 @@ function extractKeywords(prompt) {
 function scoreFile(filePath, keywords) {
     if (keywords.length === 0)
         return 0;
-    const filename = node_path_1.default.basename(filePath).toLowerCase();
-    const parentDir = node_path_1.default.basename(node_path_1.default.dirname(filePath)).toLowerCase();
+    const filename = path.basename(filePath).toLowerCase();
+    const parentDir = path.basename(path.dirname(filePath)).toLowerCase();
     let score = 0;
     for (const kw of keywords) {
         // Filename match (high weight)
@@ -57,7 +51,7 @@ function scoreFile(filePath, keywords) {
             score += 6;
     }
     try {
-        const content = node_fs_1.default.readFileSync(filePath, 'utf-8').slice(0, 300000);
+        const content = fs.readFileSync(filePath, 'utf-8').slice(0, 300000);
         const lower = content.toLowerCase();
         for (const kw of keywords) {
             const escaped = kw.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -73,14 +67,14 @@ function scoreFile(filePath, keywords) {
 function walkWorkspace(dir, maxFiles = 800) {
     const results = [];
     const stack = [dir];
-    const workspaceRoot = node_path_1.default.resolve(dir);
+    const workspaceRoot = path.resolve(dir);
     while (stack.length > 0 && results.length < maxFiles) {
         const current = stack.pop();
         if (!current)
             continue;
         let entries;
         try {
-            entries = node_fs_1.default.readdirSync(current, { withFileTypes: true });
+            entries = fs.readdirSync(current, { withFileTypes: true });
         }
         catch {
             continue;
@@ -91,12 +85,12 @@ function walkWorkspace(dir, maxFiles = 800) {
                 break;
             if (IGNORED_DIRS.has(entry.name))
                 continue;
-            const fullPath = node_path_1.default.join(current, entry.name);
+            const fullPath = path.join(current, entry.name);
             // Security: skip symlinks that escape workspace root (fixes 8.2)
             if (entry.isSymbolicLink()) {
                 try {
-                    const real = node_fs_1.default.realpathSync(fullPath);
-                    if (!real.startsWith(workspaceRoot + node_path_1.default.sep) && real !== workspaceRoot)
+                    const real = fs.realpathSync(fullPath);
+                    if (!real.startsWith(workspaceRoot + path.sep) && real !== workspaceRoot)
                         continue;
                 }
                 catch {
@@ -106,7 +100,7 @@ function walkWorkspace(dir, maxFiles = 800) {
             if (entry.isDirectory()) {
                 stack.push(fullPath);
             }
-            else if (entry.isFile() && TEXT_EXTENSIONS.has(node_path_1.default.extname(entry.name).toLowerCase())) {
+            else if (entry.isFile() && TEXT_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) {
                 results.push(fullPath);
             }
         }
@@ -117,8 +111,8 @@ function walkWorkspace(dir, maxFiles = 800) {
  * Score and rank workspace files by relevance to the given prompt.
  * Returns the top N files with path, score, and content snippet.
  */
-function buildSemanticContext(workspacePath, prompt, topN = 12) {
-    if (!workspacePath || !node_fs_1.default.existsSync(workspacePath)) {
+export function buildSemanticContext(workspacePath, prompt, topN = 12) {
+    if (!workspacePath || !fs.existsSync(workspacePath)) {
         return { topFiles: [], totalFilesScanned: 0, keywords: [] };
     }
     const keywords = extractKeywords(prompt);
@@ -134,11 +128,11 @@ function buildSemanticContext(workspacePath, prompt, topN = 12) {
     const topFiles = scored.map(({ filePath, score }) => {
         let snippet = '';
         try {
-            snippet = node_fs_1.default.readFileSync(filePath, 'utf-8').slice(0, 600);
+            snippet = fs.readFileSync(filePath, 'utf-8').slice(0, 600);
         }
         catch { /* ignore */ }
         return {
-            path: node_path_1.default.relative(workspacePath, filePath).replace(/\\/g, '/'),
+            path: path.relative(workspacePath, filePath).replace(/\\/g, '/'),
             score,
             snippet,
         };

package/dist/utils/files.js

@@ -1,46 +1,10 @@
-"use strict";
 /**
  * File utilities for Vigthoria CLI
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileUtils = void 0;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const glob_1 = require("glob");
-class FileUtils {
+import * as fs from 'fs';
+import * as path from 'path';
+import { glob } from 'glob';
+export class FileUtils {
     projectRoot;
     ignorePatterns;
     constructor(projectRoot, ignorePatterns = []) {
@@ -130,7 +94,7 @@ class FileUtils {
             if (!fs.existsSync(this.projectRoot)) {
                 return [];
             }
-            const files = await (0, glob_1.glob)(pattern, {
+            const files = await glob(pattern, {
                 cwd: this.projectRoot,
                 ignore: this.ignorePatterns,
                 nodir: true,
@@ -275,4 +239,3 @@ class FileUtils {
         return { added, removed };
     }
 }
-exports.FileUtils = FileUtils;