@vibgrate/cli 1.0.71 → 1.0.72

package/DOCS.md

@@ -44,7 +44,6 @@ For a quick overview, see the [README](./README.md). This document covers everyt
   - [Breaking Change Exposure](#breaking-change-exposure)
   - [File Hotspots](#file-hotspots)
   - [Security Posture](#security-posture)
-  - [Security Scanners](#security-scanners)
   - [Service Dependencies](#service-dependencies)
   - [Architecture Layers](#architecture-layers)
   - [Code Quality Metrics](#code-quality-metrics)
@@ -73,7 +72,7 @@ Vibgrate recursively scans your repository for `package.json` (Node/TypeScript),
 4. **Generates** a deterministic Upgrade Drift Score (0–100)
 5. **Produces** findings, a full JSON artifact, and optional SARIF output
 
-Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. Dashboard upload remains optional.
+Core drift analysis does not execute source code. Dashboard upload remains optional.
 
 ---
 
@@ -179,7 +178,6 @@ vibgrate scan [path] [--format text|json|sarif|md] [--out <file>] [--fail-on war
 | `--dsn <dsn>` | `VIBGRATE_DSN` env | DSN used for `--push` authentication |
 | `--region <region>` | — | Override data residency (`us`, `eu`) during push |
 | `--strict` | — | Fail scan command if push fails |
-| `--install-tools` | — | Auto-install missing local security tools via Homebrew |
 | `--ui-purpose` | — | Enable optional UI-purpose evidence extraction |
 | `--offline` | — | Disable network calls and disable upload/push behavior |
 | `--package-manifest <file>` | — | JSON or ZIP package-version manifest used for offline/latest lookups (latest bundle: `https://github.com/vibgrate/manifests/latest-packages.zip`) |
@@ -570,17 +568,6 @@ Structural security hygiene indicators (not a secret scanner):
 - `.env` files tracked outside `.gitignore`
 - Audit severity counts (via `npm audit --json`)
 
-### Security Scanners
-
-Security scanner orchestration and readiness analysis for local policy and secret-scanning workflows:
-
-- Scanner engine discovery (installed vs missing)
-- Version freshness checks to flag stale scanner engines/signatures
-- Local config discovery for scanner policy files
-- Cache-backed heuristic secret signals to add value even when binaries are unavailable
-
-> This scanner does not guarantee full secret detection or rule coverage by itself; it reports toolchain status and lightweight in-repo indicators so teams can decide how to harden CI enforcement.
-
 ### Service Dependencies
 
 Maps external service and platform dependencies by detecting SDK packages:
@@ -613,15 +600,6 @@ Fast AST-based quality checks to identify upgrade friction hotspots:
 - Circular dependencies and dead-code estimate
 - "God file" detection for oversized high-complexity modules
 
-### OWASP Category Mapping
-
-Maps security findings into OWASP Top 10 categories for security triage inside existing drift reports:
-
-- Supports `fast` and `cache-input` modes
-- Categorizes findings with severity and CWE metadata
-- Emits per-category counts in JSON output
-- Designed for CI visibility without requiring a separate report format
-
 ---
 
 ## CI Integration

package/README.md

@@ -129,7 +129,6 @@ Beyond core drift scoring, Vibgrate can also detect:
 - Full tooling inventory and build/deploy surface
 - TypeScript modernity and breaking-change exposure
 - File hotspots and structural security posture
-- Security scanner readiness and local policy coverage checks
 - Service dependency mapping (cloud, db, auth, messaging, etc.)
 - Architecture layer mapping
 - Code-quality metrics (complexity, nesting, cycles, god files)

package/dist/baseline-DXFJEV4M.js

@@ -0,0 +1,10 @@
+import {
+  baselineCommand,
+  runBaseline
+} from "./chunk-7MXWH3XU.js";
+import "./chunk-DSKISXFM.js";
+import "./chunk-JQHUH6A3.js";
+export {
+  baselineCommand,
+  runBaseline
+};

package/dist/{chunk-SEMFRCWZ.js → chunk-7MXWH3XU.js}

@@ -1,9 +1,9 @@
 import {
   runScan
-} from "./chunk-AOCAJJFK.js";
+} from "./chunk-DSKISXFM.js";
 import {
   writeJsonFile
-} from "./chunk-TBE6NQ5Z.js";
+} from "./chunk-JQHUH6A3.js";
 
 // src/commands/baseline.ts
 import * as path from "path";