@vibgrate/cli 2026.703.4 → 2026.703.7

package/dist/{chunk-O5R2MV6Z.js → chunk-ZNVLRKWK.js}

@@ -1,4 +1,4 @@
-import { runCoreScan, writeJsonFile } from './chunk-HRETUZQJ.js';
+import { runCoreScan, writeJsonFile } from './chunk-QWS7M7DG.js';
 import * as path from 'path';
 import { Command } from 'commander';
 import chalk from 'chalk';
@@ -27,5 +27,5 @@ var baselineCommand = new Command("baseline").description("Create a drift baseli
 });
 
 export { baselineCommand, loadAdvancedScanHook, runBaseline };
-//# sourceMappingURL=chunk-O5R2MV6Z.js.map
-//# sourceMappingURL=chunk-O5R2MV6Z.js.map
+//# sourceMappingURL=chunk-ZNVLRKWK.js.map
+//# sourceMappingURL=chunk-ZNVLRKWK.js.map

package/dist/{chunk-O5R2MV6Z.js.map → chunk-ZNVLRKWK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/reporting/advanced-hook.ts","../src/reporting/commands/baseline.ts"],"names":[],"mappings":";;;;;;AAUA,eAAsB,oBAAA,GAA8D;AAClF,EAAA,OAAO,MAAA;AACT;;;ACLA,eAAsB,YAAY,OAAA,EAAgC;AAChE,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,EAAS;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,WAAA,EAAa;AAAA,KACZ,QAAQ,CAAA;AAEX,EAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,eAAe,CAAA;AACpE,EAAA,MAAM,aAAA,CAAc,cAAc,QAAQ,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,CAAM,QAAG,CAAA,GAAI,sBAAsB,KAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,CAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAA,CAAI,CAAA,kBAAA,EAAqB,SAAS,KAAA,CAAM,KAAK,MAAM,CAAC,CAAA;AACxE;AAEO,IAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,UAAU,EAClD,WAAA,CAAY,kCAAkC,CAAA,CAC9C,QAAA,CAAS,UAAU,kBAAA,EAAoB,GAAG,CAAA,CAC1C,MAAA,CAAO,OAAO,UAAA,KAAuB;AACpC,EAAA,MAAM,OAAA,GAAe,aAAQ,UAAU,CAAA;AACvC,EAAA,MAAM,YAAY,OAAO,CAAA;AAC3B,CAAC","file":"chunk-O5R2MV6Z.js","sourcesContent":["import type { AdvancedScanHook } from '../core-open/index.js';\n\n/**\n * Open build: there is no proprietary advanced-analysis hook.\n *\n * In the public, Apache-2.0 distribution every reporting command runs purely on\n * the open base engine (`runCoreScan` from `@vibgrate/core-open`). This shim\n * keeps the call sites in `scan`/`baseline` unchanged while always resolving to\n * `undefined`, so the scan falls back to the open base engine.\n */\nexport async function loadAdvancedScanHook(): Promise<AdvancedScanHook | undefined> {\n  return undefined;\n}\n","import * as path from 'node:path';\nimport { Command } from 'commander';\nimport chalk from 'chalk';\nimport { runCoreScan } from '../../core-open/index.js';\nimport { writeJsonFile } from '../utils/fs.js';\nimport { loadAdvancedScanHook } from '../advanced-hook.js';\n\nexport async function runBaseline(rootDir: string): Promise<void> {\n  console.log(chalk.dim('Creating baseline...'));\n\n  const advanced = await loadAdvancedScanHook();\n  const artifact = await runCoreScan(rootDir, {\n    format: 'text',\n    concurrency: 8,\n  }, advanced);\n\n  const baselinePath = path.join(rootDir, '.vibgrate', 'baseline.json');\n  await writeJsonFile(baselinePath, artifact);\n  console.log(chalk.green('✔') + ` Baseline saved to ${chalk.bold('.vibgrate/baseline.json')}`);\n  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));\n}\n\nexport const baselineCommand = new Command('baseline')\n  .description('Create a drift baseline snapshot')\n  .argument('[path]', 'Path to baseline', '.')\n  .action(async (targetPath: string) => {\n    const rootDir = path.resolve(targetPath);\n    await runBaseline(rootDir);\n  });\n"]}
+{"version":3,"sources":["../src/reporting/advanced-hook.ts","../src/reporting/commands/baseline.ts"],"names":[],"mappings":";;;;;;AAUA,eAAsB,oBAAA,GAA8D;AAClF,EAAA,OAAO,MAAA;AACT;;;ACLA,eAAsB,YAAY,OAAA,EAAgC;AAChE,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,EAAS;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,WAAA,EAAa;AAAA,KACZ,QAAQ,CAAA;AAEX,EAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,eAAe,CAAA;AACpE,EAAA,MAAM,aAAA,CAAc,cAAc,QAAQ,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,CAAM,QAAG,CAAA,GAAI,sBAAsB,KAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,CAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAA,CAAI,CAAA,kBAAA,EAAqB,SAAS,KAAA,CAAM,KAAK,MAAM,CAAC,CAAA;AACxE;AAEO,IAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,UAAU,EAClD,WAAA,CAAY,kCAAkC,CAAA,CAC9C,QAAA,CAAS,UAAU,kBAAA,EAAoB,GAAG,CAAA,CAC1C,MAAA,CAAO,OAAO,UAAA,KAAuB;AACpC,EAAA,MAAM,OAAA,GAAe,aAAQ,UAAU,CAAA;AACvC,EAAA,MAAM,YAAY,OAAO,CAAA;AAC3B,CAAC","file":"chunk-ZNVLRKWK.js","sourcesContent":["import type { AdvancedScanHook } from '../core-open/index.js';\n\n/**\n * Open build: there is no proprietary advanced-analysis hook.\n *\n * In the public, Apache-2.0 distribution every reporting command runs purely on\n * the open base engine (`runCoreScan` from `@vibgrate/core-open`). This shim\n * keeps the call sites in `scan`/`baseline` unchanged while always resolving to\n * `undefined`, so the scan falls back to the open base engine.\n */\nexport async function loadAdvancedScanHook(): Promise<AdvancedScanHook | undefined> {\n  return undefined;\n}\n","import * as path from 'node:path';\nimport { Command } from 'commander';\nimport chalk from 'chalk';\nimport { runCoreScan } from '../../core-open/index.js';\nimport { writeJsonFile } from '../utils/fs.js';\nimport { loadAdvancedScanHook } from '../advanced-hook.js';\n\nexport async function runBaseline(rootDir: string): Promise<void> {\n  console.log(chalk.dim('Creating baseline...'));\n\n  const advanced = await loadAdvancedScanHook();\n  const artifact = await runCoreScan(rootDir, {\n    format: 'text',\n    concurrency: 8,\n  }, advanced);\n\n  const baselinePath = path.join(rootDir, '.vibgrate', 'baseline.json');\n  await writeJsonFile(baselinePath, artifact);\n  console.log(chalk.green('✔') + ` Baseline saved to ${chalk.bold('.vibgrate/baseline.json')}`);\n  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));\n}\n\nexport const baselineCommand = new Command('baseline')\n  .description('Create a drift baseline snapshot')\n  .argument('[path]', 'Path to baseline', '.')\n  .action(async (targetPath: string) => {\n    const rootDir = path.resolve(targetPath);\n    await runBaseline(rootDir);\n  });\n"]}

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, dsnCommand, pushCommand, ExitCode, CliError, verifyDeterminism, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, uninstallAssistant, buildGraph, serializeGraph, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, writeArtifacts, writeSnapshot, UsageError, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, renderHtml, isModelReady } from './chunk-SXKYCVEQ.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, dsnCommand, pushCommand, ExitCode, CliError, NPX_INVOCATION, verifyDeterminism, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, uninstallAssistant, buildGraph, serializeGraph, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, writeArtifacts, writeSnapshot, UsageError, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, renderHtml, isModelReady } from './chunk-WGXDYBAN.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-O5R2MV6Z.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, titleBox, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar } from './chunk-HRETUZQJ.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-ZNVLRKWK.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, titleBox, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar } from './chunk-QWS7M7DG.js';
 import './chunk-RXP66R2E.js';
-import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-4M2MUQRO.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-UPPWLMVD.js';
 import * as fs4 from 'fs';
 import fs4__default, { realpathSync } from 'fs';
 import * as path9 from 'path';
@@ -1882,7 +1882,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk5.green("\u2714") + ` Created ${chalk5.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-YIXK7MXF.js');
+    const { runBaseline } = await import('./baseline-HBRBXJHJ.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -1925,7 +1925,9 @@ async function detectAiAssistant(rootDir) {
 function printAiContextPrompt(detectedAssistant) {
   const teal2 = chalk5.hex("#3FB0A4");
   const mint2 = chalk5.hex("#4FE3C1");
-  const installCmd = detectedAssistant ? `vg install ${detectedAssistant}` : "vg install --all";
+  const cli = resolveCliInvocation();
+  const installArgs = detectedAssistant ? `install ${detectedAssistant}` : "install --all";
+  const installCmd = `${cli} ${installArgs}`;
   const detectedNote = detectedAssistant ? chalk5.dim(`  (${detectedAssistant} config detected)`) : "";
   console.log("");
   console.log(teal2("  \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
@@ -1941,6 +1943,9 @@ function printAiContextPrompt(detectedAssistant) {
 }
 
 // src/reporting/commands/scan.ts
+function shouldBuildCodeMap(opts) {
+  return opts.graph !== false && !opts.maxPrivacy && !opts.noLocalArtifacts;
+}
 async function autoPush(artifact, rootDir, opts) {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
@@ -2063,6 +2068,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   }
   const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
+  const noLocalArtifacts = opts.localArtifacts === false;
   const isFirstRun = !await pathExists$1(path9.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   if (willPush && hasDsn) {
@@ -2157,7 +2163,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     region: opts.region ?? pinnedRegion,
     strict: opts.strict,
     uiPurpose: opts.uiPurpose,
-    noLocalArtifacts: opts.noLocalArtifacts,
+    noLocalArtifacts,
     maxPrivacy: opts.maxPrivacy,
     offline: opts.offline,
     // `--full` is the comprehensive umbrella: it turns on vulnerability scanning.
@@ -2168,9 +2174,12 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     projectScanTimeout: opts.projectScanTimeout ? parseInt(opts.projectScanTimeout, 10) || void 0 : void 0,
     repositoryName: opts.repositoryName?.trim() || void 0,
     force: opts.force,
-    quiet: opts.quiet
+    quiet: opts.quiet,
+    // Prefix for the upsell panel's `login → push` hint — `vg` when installed,
+    // `npx @vibgrate/cli` when the user ran via npx (where bare `vg` fails).
+    invocation: resolveCliInvocation()
   };
-  const wantGraph = opts.graph !== false && !opts.maxPrivacy;
+  const wantGraph = shouldBuildCodeMap({ graph: opts.graph, maxPrivacy: opts.maxPrivacy, noLocalArtifacts });
   if (wantGraph) {
     scanOpts.postScan = async (report) => {
       const result = await buildGraph({
@@ -2230,7 +2239,7 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
   if (willPush) {
     await autoPush(artifact, rootDir, scanOpts);
   }
-  const showAiPrompt = scanOpts.format === "text" && !opts.quiet && !hasDsn && !opts.offline && !opts.noLocalArtifacts && !opts.maxPrivacy && isFirstRun;
+  const showAiPrompt = scanOpts.format === "text" && !opts.quiet && !hasDsn && !opts.offline && !noLocalArtifacts && !opts.maxPrivacy && isFirstRun;
   if (showAiPrompt) {
     const detectedAssistant = await detectAiAssistant(rootDir);
     printAiContextPrompt(detectedAssistant);
@@ -2980,7 +2989,14 @@ function openUrl(url) {
 
 // src/reporting/commands/login.ts
 var delay = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
-var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").action(async (opts) => {
+function isInside(dir, file) {
+  const rel2 = path9.relative(dir, file);
+  return !!rel2 && !rel2.startsWith("..") && !path9.isAbsolute(rel2);
+}
+var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
+  "--local",
+  "Store credentials in this project (.vibgrate/credentials.json) instead of ~/.vibgrate"
+).action(async (opts) => {
   let ingestHost;
   try {
     ingestHost = resolveIngestHost(opts.region, opts.ingest);
@@ -3069,17 +3085,19 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
           process.exit(1);
         }
       }
-      writeStoredCredentials(creds);
+      const storeOpts = { local: opts.local === true };
+      writeStoredCredentials(creds, storeOpts);
+      const credsFile = credentialsPath(storeOpts);
       console.log("");
       console.log(chalk5.green("\u2714") + " Logged in.");
       if (creds.workspaceId) {
         console.log("  Workspace: " + chalk5.bold(creds.workspaceId));
       }
-      console.log(chalk5.dim(`  Credentials saved to ${credentialsPath()}`));
+      console.log(chalk5.dim(`  Credentials saved to ${credsFile}`));
       try {
         const root = findGitRoot();
-        if (root) {
-          const res = ensureGitignored(gitignoreEntryForCredentials(root), root);
+        if (root && isInside(root, credsFile)) {
+          const res = ensureGitignored(gitignoreEntryForCredentials(root, credsFile), root);
           if (res.status === "created") {
             console.log(chalk5.dim(`  Created .gitignore and ignored ${res.entry}`));
           } else if (res.status === "added") {
@@ -3088,7 +3106,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
         }
       } catch {
       }
-      console.log(chalk5.dim('  You can now run "vibgrate scan --push".'));
+      console.log(chalk5.dim(`  You can now run "${resolveCliInvocation()} scan --push".`));
       return;
     }
     if (token.status === "access_denied") {
@@ -3646,10 +3664,14 @@ function buildProgram() {
   const program = new Command();
   program.name("vg").description(
     "vg \u2014 local codebase intelligence for AI coding agents: a deterministic, no-API-key code graph + MCP server, drift reporting, and version-correct library docs"
-  ).version(VERSION, "--version", "output the version number").showSuggestionAfterError(true).addHelpText(
-    "after",
-    '\nRun `vg` to scan + map the current folder, `vg "<question>"` to ask, `vg status`/`vg verify` for state.\nDrift: `vg scan` / `vg report`. Wire into your AI agent: `vg install`.\nThe `vibgrate` command is an alias for `vg`.\nDocs: https://vibgrate.com/help'
-  );
+  ).version(VERSION, "--version", "output the version number").showSuggestionAfterError(true).addHelpText("after", () => {
+    const cli = resolveCliInvocation();
+    const aliasNote = cli === "vg" ? "The `vibgrate` command is an alias for `vg`.\n" : cli === NPX_INVOCATION ? "Install globally (`npm i -g @vibgrate/cli`) to use the shorter `vg` command.\n" : "";
+    return `
+Run \`${cli}\` to scan + map the current folder, \`${cli} "<question>"\` to ask, \`${cli} status\`/\`${cli} verify\` for state.
+Drift: \`${cli} scan\` / \`${cli} report\`. Wire into your AI agent: \`${cli} install\`.
+${aliasNote}Docs: https://vibgrate.com/help`;
+  });
   registerBuild(program);
   registerStatus(program);
   registerVerify(program);