@vibgrate/cli 2026.703.5 → 2026.703.7

package/dist/{chunk-W2QP2YH6.js → chunk-WGXDYBAN.js}

@@ -1,6 +1,7 @@
 import { langById, shortId, canonicalize, grammarSetVersion, hashBytes, hashString, langForExtension, setGrammarsOverride, parseSource } from './chunk-X5YT263H.js';
-import { writeTextFile, pathExists, readJsonFile, VERSION, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-L7YBNIBF.js';
-import * as fs17 from 'fs';
+import { writeTextFile, pathExists, readJsonFile, VERSION, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-QWS7M7DG.js';
+import * as fs18 from 'fs';
+import { execFileSync } from 'child_process';
 import * as path18 from 'path';
 import ignore from 'ignore';
 import Graph from 'graphology';
@@ -12,7 +13,6 @@ import * as os from 'os';
 import { fileURLToPath } from 'url';
 import ts from 'typescript';
 import { bidirectional } from 'graphology-shortest-path/unweighted.js';
-import { execFileSync } from 'child_process';
 import * as crypto from 'crypto';
 import { Command } from 'commander';
 import chalk from 'chalk';
@@ -23,6 +23,43 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 
+var NPX_INVOCATION = "npx @vibgrate/cli";
+function whichOnPath(cmd) {
+  try {
+    const out = execFileSync(process.platform === "win32" ? "where" : "which", [cmd], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim().split(/\r?\n/)[0];
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function isOwnBinary(binPath) {
+  try {
+    const real = fs18.realpathSync(binPath);
+    if (/[\\/]@vibgrate[\\/]cli[\\/]/.test(real)) return true;
+    const head = fs18.readFileSync(real, { encoding: "utf8" }).slice(0, 2048);
+    return head.includes("@vibgrate/cli") || head.includes("vibgrate");
+  } catch {
+    return false;
+  }
+}
+var cached;
+function resolveCliInvocation(which) {
+  if (!which && cached !== void 0) return cached;
+  const lookup = which ?? whichOnPath;
+  const vg = lookup("vg");
+  let result;
+  if (vg && isOwnBinary(vg)) {
+    result = "vg";
+  } else {
+    const vibgrate = lookup("vibgrate");
+    result = vibgrate && isOwnBinary(vibgrate) ? "vibgrate" : NPX_INVOCATION;
+  }
+  if (!which) cached = result;
+  return result;
+}
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -56,8 +93,8 @@ function toPosix(p) {
 function buildRootIgnore(root, exclude) {
   const ig = ignore();
   const gitignorePath = path18.join(root, ".gitignore");
-  if (fs17.existsSync(gitignorePath)) {
-    ig.add(fs17.readFileSync(gitignorePath, "utf8"));
+  if (fs18.existsSync(gitignorePath)) {
+    ig.add(fs18.readFileSync(gitignorePath, "utf8"));
   }
   if (exclude.length) ig.add(exclude);
   return ig;
@@ -72,7 +109,7 @@ function discover(options) {
     }
   }
   const rootIg = buildRootIgnore(root, options.exclude ?? []);
-  const scopeAbs = (options.paths && options.paths.length ? options.paths.map((p) => path18.resolve(root, p)) : [root]).filter((p) => fs17.existsSync(p));
+  const scopeAbs = (options.paths && options.paths.length ? options.paths.map((p) => path18.resolve(root, p)) : [root]).filter((p) => fs18.existsSync(p));
   const found = /* @__PURE__ */ new Map();
   const considerFile = (abs) => {
     const rel2 = toPosix(path18.relative(root, abs));
@@ -85,7 +122,7 @@ function discover(options) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = fs17.readdirSync(dir, { withFileTypes: true });
+      entries = fs18.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -102,7 +139,7 @@ function discover(options) {
     }
   };
   for (const scope of scopeAbs) {
-    const stat = fs17.statSync(scope);
+    const stat = fs18.statSync(scope);
     if (stat.isDirectory()) walk2(scope);
     else if (stat.isFile()) considerFile(scope);
   }
@@ -336,7 +373,7 @@ function matchPattern(pattern, source) {
 function loadTsconfigPaths(root) {
   for (const name of ["tsconfig.base.json", "tsconfig.json"]) {
     const file = path18.join(root, name);
-    if (fs17.existsSync(file)) {
+    if (fs18.existsSync(file)) {
       const merged = readTsconfigChain(root, file, /* @__PURE__ */ new Set());
       if (merged && merged.paths.length) return merged;
     }
@@ -348,7 +385,7 @@ function readTsconfigChain(root, file, seen) {
   seen.add(file);
   let cfg;
   try {
-    cfg = parseJsonc(fs17.readFileSync(file, "utf8"));
+    cfg = parseJsonc(fs18.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
@@ -356,7 +393,7 @@ function readTsconfigChain(root, file, seen) {
   let base = { baseUrlRel: "", paths: [] };
   if (cfg.extends && cfg.extends.startsWith(".")) {
     const extPath = path18.resolve(dir, cfg.extends.endsWith(".json") ? cfg.extends : `${cfg.extends}.json`);
-    if (fs17.existsSync(extPath)) {
+    if (fs18.existsSync(extPath)) {
       const inherited = readTsconfigChain(root, extPath, seen);
       if (inherited) base = inherited;
     }
@@ -371,17 +408,17 @@ function loadWorkspacePackages(root) {
   const map = /* @__PURE__ */ new Map();
   const globs = [];
   const rootPkg = path18.join(root, "package.json");
-  if (fs17.existsSync(rootPkg)) {
+  if (fs18.existsSync(rootPkg)) {
     try {
-      const pkg = JSON.parse(fs17.readFileSync(rootPkg, "utf8"));
+      const pkg = JSON.parse(fs18.readFileSync(rootPkg, "utf8"));
       const ws = Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages;
       if (ws) globs.push(...ws);
     } catch {
     }
   }
   const pnpmWs = path18.join(root, "pnpm-workspace.yaml");
-  if (fs17.existsSync(pnpmWs)) {
-    for (const line of fs17.readFileSync(pnpmWs, "utf8").split("\n")) {
+  if (fs18.existsSync(pnpmWs)) {
+    for (const line of fs18.readFileSync(pnpmWs, "utf8").split("\n")) {
       const m = /^\s*-\s*['"]?([^'"\n]+)['"]?\s*$/.exec(line);
       if (m) globs.push(m[1].trim());
     }
@@ -389,7 +426,7 @@ function loadWorkspacePackages(root) {
   for (const dir of expandWorkspaceGlobs(root, globs)) {
     const pj = path18.join(dir, "package.json");
     try {
-      const name = JSON.parse(fs17.readFileSync(pj, "utf8")).name;
+      const name = JSON.parse(fs18.readFileSync(pj, "utf8")).name;
       if (name) map.set(name, path18.relative(root, dir).split(path18.sep).join("/"));
     } catch {
     }
@@ -403,7 +440,7 @@ function expandWorkspaceGlobs(root, globs) {
     const baseDir = path18.join(root, clean);
     const recurse = glob.endsWith("**");
     if (glob === clean) {
-      if (fs17.existsSync(path18.join(baseDir, "package.json"))) out.add(baseDir);
+      if (fs18.existsSync(path18.join(baseDir, "package.json"))) out.add(baseDir);
       continue;
     }
     collectPackageDirs(baseDir, recurse ? 4 : 1, out);
@@ -414,14 +451,14 @@ function collectPackageDirs(dir, depth, out) {
   if (depth < 0) return;
   let entries;
   try {
-    entries = fs17.readdirSync(dir, { withFileTypes: true });
+    entries = fs18.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const e of entries) {
     if (!e.isDirectory() || e.name === "node_modules" || e.name.startsWith(".")) continue;
     const child = path18.join(dir, e.name);
-    if (fs17.existsSync(path18.join(child, "package.json"))) out.add(child);
+    if (fs18.existsSync(path18.join(child, "package.json"))) out.add(child);
     else collectPackageDirs(child, depth - 1, out);
   }
 }
@@ -921,12 +958,12 @@ function loadCoverage(root, explicit) {
   const candidates = (explicit && explicit.length ? explicit : DEFAULT_PATHS).map(
     (p) => path18.resolve(root, p)
   );
-  const found = candidates.filter((p) => fs17.existsSync(p));
+  const found = candidates.filter((p) => fs18.existsSync(p));
   if (found.length === 0) return null;
   const map = /* @__PURE__ */ new Map();
   for (const file of found) {
     try {
-      const text = fs17.readFileSync(file, "utf8");
+      const text = fs18.readFileSync(file, "utf8");
       if (file.endsWith(".json")) mergeIstanbul(map, text, root);
       else mergeLcov(map, text, root);
     } catch {
@@ -1272,7 +1309,7 @@ async function parseInline(files, onProgress) {
   onProgress?.(0, files.length);
   for (const file of files) {
     try {
-      const source = fs17.readFileSync(file.abs, "utf8");
+      const source = fs18.readFileSync(file.abs, "utf8");
       out.push(await parseSource(file.rel, file.lang.id, source));
     } catch (err) {
       out.push(emptyParse(file, `parse failed: ${err.message}`));
@@ -1309,7 +1346,7 @@ async function parsePooled(files, jobs, workerFile, onProgress, grammarsDir) {
 function resolveWorkerFile() {
   const here = path18.dirname(fileURLToPath(import.meta.url));
   const candidate = path18.join(here, "parse-worker.js");
-  return fs17.existsSync(candidate) ? candidate : null;
+  return fs18.existsSync(candidate) ? candidate : null;
 }
 function chunk(items, buckets) {
   const out = Array.from({ length: Math.min(buckets, items.length || 1) }, () => []);
@@ -1769,9 +1806,9 @@ function loadCache(root, opts) {
     grammars: opts.grammars,
     entries: {}
   };
-  if (!opts.disabled && fs17.existsSync(file)) {
+  if (!opts.disabled && fs18.existsSync(file)) {
     try {
-      const loaded = JSON.parse(fs17.readFileSync(file, "utf8"));
+      const loaded = JSON.parse(fs18.readFileSync(file, "utf8"));
       if (loaded.version === CACHE_VERSION && loaded.toolVersion === opts.toolVersion && loaded.grammars === opts.grammars && loaded.entries) {
         data = loaded;
       }
@@ -1792,8 +1829,8 @@ function loadCache(root, opts) {
       }
     },
     save() {
-      fs17.mkdirSync(cacheDir(root), { recursive: true });
-      fs17.writeFileSync(file, stableStringify(data, 0));
+      fs18.mkdirSync(cacheDir(root), { recursive: true });
+      fs18.writeFileSync(file, stableStringify(data, 0));
     }
   };
 }
@@ -1822,15 +1859,15 @@ async function buildGraph(options) {
     let hash = "";
     let stat;
     try {
-      stat = fs17.statSync(file.abs);
-      hash = hashBytes(fs17.readFileSync(file.abs));
+      stat = fs18.statSync(file.abs);
+      hash = hashBytes(fs18.readFileSync(file.abs));
     } catch {
       continue;
     }
     hashes.set(file.rel, hash);
     fileStats.push({ rel: file.rel, size: stat.size, mtimeMs: stat.mtimeMs, hash });
-    const cached = cache.get(file.rel, hash);
-    if (cached) reused.push(cached);
+    const cached2 = cache.get(file.rel, hash);
+    if (cached2) reused.push(cached2);
     else toParse.push(file);
   }
   const parsedNew = await parseFiles(toParse, {
@@ -1943,9 +1980,9 @@ function loadScipIndex(root, explicit) {
   ].filter((p) => Boolean(p));
   for (const file of candidates) {
     const abs = path18.isAbsolute(file) ? file : path18.resolve(root, file);
-    if (!fs17.existsSync(abs)) continue;
+    if (!fs18.existsSync(abs)) continue;
     try {
-      const index = decodeScipIndex(new Uint8Array(fs17.readFileSync(abs)));
+      const index = decodeScipIndex(new Uint8Array(fs18.readFileSync(abs)));
       if (index.documents.length) {
         return { index, tool: index.toolVersion ? `${index.toolName} ${index.toolVersion}` : index.toolName };
       }
@@ -1987,7 +2024,7 @@ function isProcessAlive(pid) {
 }
 function lockIsStale(file, staleMs) {
   try {
-    const { pid, at } = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const { pid, at } = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (typeof at === "number" && Date.now() - at > staleMs) return true;
     if (typeof pid === "number" && !isProcessAlive(pid)) return true;
     return false;
@@ -1998,10 +2035,10 @@ function lockIsStale(file, staleMs) {
 function acquireLock(file, staleMs = DEFAULT_LOCK_STALE_MS) {
   const write = () => {
     try {
-      fs17.mkdirSync(path18.dirname(file), { recursive: true });
-      const fd = fs17.openSync(file, "wx");
-      fs17.writeFileSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
-      fs17.closeSync(fd);
+      fs18.mkdirSync(path18.dirname(file), { recursive: true });
+      const fd = fs18.openSync(file, "wx");
+      fs18.writeFileSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
+      fs18.closeSync(fd);
       return true;
     } catch {
       return false;
@@ -2010,7 +2047,7 @@ function acquireLock(file, staleMs = DEFAULT_LOCK_STALE_MS) {
   if (write()) return true;
   if (lockIsStale(file, staleMs)) {
     try {
-      fs17.rmSync(file, { force: true });
+      fs18.rmSync(file, { force: true });
     } catch {
     }
     return write();
@@ -2019,7 +2056,7 @@ function acquireLock(file, staleMs = DEFAULT_LOCK_STALE_MS) {
 }
 function releaseLock(file) {
   try {
-    fs17.rmSync(file, { force: true });
+    fs18.rmSync(file, { force: true });
   } catch {
   }
 }
@@ -2036,7 +2073,7 @@ function modelReadyMarker(modelId) {
   return path18.join(modelCacheDir(), `.ready-${safe(modelId)}`);
 }
 function isModelReady(modelId = resolveEmbedModel()) {
-  return fs17.existsSync(modelReadyMarker(modelId));
+  return fs18.existsSync(modelReadyMarker(modelId));
 }
 function unavailableMessage(reason) {
   switch (reason) {
@@ -2053,13 +2090,13 @@ function unavailableMessage(reason) {
 }
 function modelCacheInfo(modelId = resolveEmbedModel()) {
   const dir = modelCacheDir();
-  return { dir, present: isModelReady(modelId) || fs17.existsSync(dir), bytes: dirSize(dir) };
+  return { dir, present: isModelReady(modelId) || fs18.existsSync(dir), bytes: dirSize(dir) };
 }
 function clearModelCache() {
   const dir = modelCacheDir();
   const bytes = dirSize(dir);
   try {
-    fs17.rmSync(dir, { recursive: true, force: true });
+    fs18.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
   return bytes;
@@ -2068,7 +2105,7 @@ function dirSize(dir) {
   let total = 0;
   let entries;
   try {
-    entries = fs17.readdirSync(dir, { withFileTypes: true });
+    entries = fs18.readdirSync(dir, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -2077,7 +2114,7 @@ function dirSize(dir) {
     if (e.isDirectory()) total += dirSize(p);
     else {
       try {
-        total += fs17.statSync(p).size;
+        total += fs18.statSync(p).size;
       } catch {
       }
     }
@@ -2089,7 +2126,7 @@ function isPermissionError(e) {
   return code === "EACCES" || code === "EPERM" || code === "EROFS";
 }
 function embeddingsCached(root, modelId) {
-  return fs17.existsSync(path18.join(cacheDir(root), `embeddings-${safe(modelId)}.json`));
+  return fs18.existsSync(path18.join(cacheDir(root), `embeddings-${safe(modelId)}.json`));
 }
 async function loadEmbedder(options = {}) {
   if (options.local) return null;
@@ -2103,7 +2140,7 @@ async function loadEmbedder(options = {}) {
   if (!mod?.FlagEmbedding) return fail("not-installed");
   const cache = modelCacheDir();
   try {
-    fs17.mkdirSync(cache, { recursive: true });
+    fs18.mkdirSync(cache, { recursive: true });
   } catch (e) {
     return fail(isPermissionError(e) ? "no-permission" : "init-failed");
   }
@@ -2118,7 +2155,7 @@ async function loadEmbedder(options = {}) {
       "embedding model init timed out"
     );
     try {
-      fs17.writeFileSync(modelReadyMarker(modelId), (/* @__PURE__ */ new Date(0)).toISOString());
+      fs18.writeFileSync(modelReadyMarker(modelId), (/* @__PURE__ */ new Date(0)).toISOString());
     } catch {
     }
     return {
@@ -2225,15 +2262,15 @@ function countPending(graph, root, modelId) {
   for (const n of graph.nodes) {
     if (n.kind === "file" || n.kind === "external") continue;
     const h = hashString(nodeEmbedText(n, areaLabel.get(n.area)));
-    const cached = entries[n.id];
-    if (!cached || cached.hash !== h) pending++;
+    const cached2 = entries[n.id];
+    if (!cached2 || cached2.hash !== h) pending++;
   }
   return pending;
 }
 function readCacheEntries(file, modelId) {
-  if (!fs17.existsSync(file)) return {};
+  if (!fs18.existsSync(file)) return {};
   try {
-    const loaded = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const loaded = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (loaded.model === modelId && loaded.entries) return loaded.entries;
   } catch {
   }
@@ -2242,9 +2279,9 @@ function readCacheEntries(file, modelId) {
 async function getNodeEmbeddings(graph, embedder, root, onProgress) {
   const file = vectorCachePath(root, embedder.id);
   let cache = { model: embedder.id, entries: {} };
-  if (fs17.existsSync(file)) {
+  if (fs18.existsSync(file)) {
     try {
-      const loaded = JSON.parse(fs17.readFileSync(file, "utf8"));
+      const loaded = JSON.parse(fs18.readFileSync(file, "utf8"));
       if (loaded.model === embedder.id && loaded.entries) cache = loaded;
     } catch {
     }
@@ -2256,16 +2293,16 @@ async function getNodeEmbeddings(graph, embedder, root, onProgress) {
   for (const n of targets) {
     const text = nodeEmbedText(n, areaLabel.get(n.area));
     const h = hashString(text);
-    const cached = cache.entries[n.id];
-    if (cached && cached.hash === h) vectors.set(n.id, cached.vec);
+    const cached2 = cache.entries[n.id];
+    if (cached2 && cached2.hash === h) vectors.set(n.id, cached2.vec);
     else toEmbed.push({ id: n.id, text, hash: h });
   }
   const persist = () => {
     try {
-      fs17.mkdirSync(cacheDir(root), { recursive: true });
+      fs18.mkdirSync(cacheDir(root), { recursive: true });
       const tmp = `${file}.tmp.${process.pid}`;
-      fs17.writeFileSync(tmp, JSON.stringify(cache));
-      fs17.renameSync(tmp, file);
+      fs18.writeFileSync(tmp, JSON.stringify(cache));
+      fs18.renameSync(tmp, file);
     } catch {
     }
   };
@@ -2421,31 +2458,31 @@ function defaultGraphPath(root) {
 }
 function writeArtifacts(graph, options) {
   const dir = vibgrateDir(options.root);
-  fs17.mkdirSync(dir, { recursive: true });
+  fs18.mkdirSync(dir, { recursive: true });
   const graphPath = options.graphPath ?? defaultGraphPath(options.root);
-  fs17.mkdirSync(path18.dirname(graphPath), { recursive: true });
+  fs18.mkdirSync(path18.dirname(graphPath), { recursive: true });
   const tmp = `${graphPath}.${process.pid}.tmp`;
   try {
-    fs17.writeFileSync(tmp, serializeGraph(graph));
-    fs17.renameSync(tmp, graphPath);
+    fs18.writeFileSync(tmp, serializeGraph(graph));
+    fs18.renameSync(tmp, graphPath);
   } catch (err) {
-    fs17.rmSync(tmp, { force: true });
+    fs18.rmSync(tmp, { force: true });
     throw err;
   }
   const written = { graphPath };
   if (options.report !== false) {
     const reportPath = path18.join(dir, "GRAPH_REPORT.md");
-    fs17.writeFileSync(reportPath, renderReport(graph));
+    fs18.writeFileSync(reportPath, renderReport(graph));
     written.reportPath = reportPath;
   }
   if (options.html !== false) {
     const htmlPath = path18.join(dir, "graph.html");
-    fs17.writeFileSync(htmlPath, renderHtml(graph));
+    fs18.writeFileSync(htmlPath, renderHtml(graph));
     written.htmlPath = htmlPath;
   }
   if (graph.facts && graph.facts.length) {
     const factsPath = path18.join(dir, "facts.jsonl");
-    fs17.writeFileSync(factsPath, graph.facts.map((f) => JSON.stringify(f)).join("\n") + "\n");
+    fs18.writeFileSync(factsPath, graph.facts.map((f) => JSON.stringify(f)).join("\n") + "\n");
     written.factsPath = factsPath;
   }
   return written;
@@ -2459,14 +2496,14 @@ function writeSnapshot(root, corpusHash, fileStats, scope = {}) {
   for (const f of fileStats) files[f.rel] = { size: f.size, mtimeMs: f.mtimeMs, hash: f.hash };
   const snapshot = { version: SNAPSHOT_VERSION, corpusHash, scope: pruneScope(scope), files };
   try {
-    fs17.mkdirSync(cacheDir(root), { recursive: true });
-    fs17.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
+    fs18.mkdirSync(cacheDir(root), { recursive: true });
+    fs18.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
   } catch {
   }
 }
 function loadSnapshot(root) {
   try {
-    const loaded = JSON.parse(fs17.readFileSync(snapshotPath(root), "utf8"));
+    const loaded = JSON.parse(fs18.readFileSync(snapshotPath(root), "utf8"));
     if (loaded.version === SNAPSHOT_VERSION && loaded.files && typeof loaded.corpusHash === "string") {
       return { ...loaded, scope: loaded.scope ?? {} };
     }
@@ -2502,7 +2539,7 @@ function probeFreshness(root) {
     }
     let stat;
     try {
-      stat = fs17.statSync(file.abs);
+      stat = fs18.statSync(file.abs);
     } catch {
       drift.removed.push(file.rel);
       continue;
@@ -2510,7 +2547,7 @@ function probeFreshness(root) {
     if (stat.size === entry.size && stat.mtimeMs === entry.mtimeMs) continue;
     let hash = "";
     try {
-      hash = hashBytes(fs17.readFileSync(file.abs));
+      hash = hashBytes(fs18.readFileSync(file.abs));
     } catch {
       drift.removed.push(file.rel);
       continue;
@@ -2527,7 +2564,7 @@ function probeFreshness(root) {
   }
   if (absorbed && !hasDrift(drift)) {
     try {
-      fs17.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
+      fs18.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
     } catch {
     }
   }
@@ -2573,8 +2610,8 @@ function usageError(message) {
 }
 function loadGraph(root, graphPath) {
   const file = graphPath ?? defaultGraphPath(root);
-  if (!fs17.existsSync(file)) return null;
-  return parseGraph(fs17.readFileSync(file, "utf8"));
+  if (!fs18.existsSync(file)) return null;
+  return parseGraph(fs18.readFileSync(file, "utf8"));
 }
 
 // src/engine/verify.ts
@@ -2583,10 +2620,10 @@ async function verifyDeterminism(opts) {
   const base = { root: opts.root, only: opts.only, exclude: opts.exclude, generatedAt: PINNED };
   const a = serializeGraph((await buildGraph({ ...base, noCache: true, jobs: opts.jobs })).graph);
   const b = serializeGraph((await buildGraph({ ...base, noCache: true, jobs: 1 })).graph);
-  const cached = serializeGraph((await buildGraph({ ...base, noCache: false })).graph);
+  const cached2 = serializeGraph((await buildGraph({ ...base, noCache: false })).graph);
   const checks = [
     { name: "run-to-run determinism", ok: a === b, detail: diffHint(a, b) },
-    { name: "cache safety (incremental == full)", ok: a === cached, detail: diffHint(a, cached) }
+    { name: "cache safety (incremental == full)", ok: a === cached2, detail: diffHint(a, cached2) }
   ];
   return {
     ok: checks.every((c) => c.ok),
@@ -2871,8 +2908,8 @@ async function refreshIfStale(root, opts = {}) {
       const dir = vibgrateDir(root);
       writeArtifacts(result.graph, {
         root,
-        report: fs17.existsSync(path18.join(dir, "GRAPH_REPORT.md")),
-        html: fs17.existsSync(path18.join(dir, "graph.html"))
+        report: fs18.existsSync(path18.join(dir, "GRAPH_REPORT.md")),
+        html: fs18.existsSync(path18.join(dir, "graph.html"))
       });
     }
     writeSnapshot(root, result.graph.provenance.corpusHash, result.fileStats, scope);
@@ -3049,9 +3086,9 @@ function testsToRun(graph, rootId, depth = 4) {
 }
 function detectRunner(root, lang) {
   const pkgPath = path18.join(root, "package.json");
-  if (fs17.existsSync(pkgPath)) {
+  if (fs18.existsSync(pkgPath)) {
     try {
-      const pkg = JSON.parse(fs17.readFileSync(pkgPath, "utf8"));
+      const pkg = JSON.parse(fs18.readFileSync(pkgPath, "utf8"));
       const deps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (deps.vitest) return { name: "vitest", command: (f) => `npx vitest run ${f.join(" ")}`.trim() };
       if (deps.jest) return { name: "jest", command: (f) => `npx jest ${f.join(" ")}`.trim() };
@@ -3059,10 +3096,10 @@ function detectRunner(root, lang) {
     } catch {
     }
   }
-  if (lang === "py" || fs17.existsSync(path18.join(root, "pyproject.toml")) || fs17.existsSync(path18.join(root, "pytest.ini"))) {
+  if (lang === "py" || fs18.existsSync(path18.join(root, "pyproject.toml")) || fs18.existsSync(path18.join(root, "pytest.ini"))) {
     return { name: "pytest", command: (f) => `pytest ${f.join(" ")}`.trim() };
   }
-  if (lang === "go" || fs17.existsSync(path18.join(root, "go.mod"))) {
+  if (lang === "go" || fs18.existsSync(path18.join(root, "go.mod"))) {
     return { name: "go test", command: () => "go test ./..." };
   }
   if (lang === "cs" || hasFile(root, /\.csproj$/) || hasFile(root, /\.sln$/)) {
@@ -3073,7 +3110,7 @@ function detectRunner(root, lang) {
 }
 function hasFile(root, re) {
   try {
-    return fs17.readdirSync(root).some((f) => re.test(f));
+    return fs18.readdirSync(root).some((f) => re.test(f));
   } catch {
     return false;
   }
@@ -3145,7 +3182,7 @@ function findManifests(root) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs17.readdirSync(dir, { withFileTypes: true });
+      entries = fs18.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3169,7 +3206,7 @@ function npmDeps(files) {
   for (const file of files) {
     let pkg;
     try {
-      pkg = JSON.parse(fs17.readFileSync(file, "utf8"));
+      pkg = JSON.parse(fs18.readFileSync(file, "utf8"));
     } catch {
       continue;
     }
@@ -3186,7 +3223,7 @@ function installedNpmVersion(dir, name) {
   for (let i = 0; i < 12; i++) {
     const p = path18.join(cur, "node_modules", name, "package.json");
     try {
-      return JSON.parse(fs17.readFileSync(p, "utf8")).version;
+      return JSON.parse(fs18.readFileSync(p, "utf8")).version;
     } catch {
     }
     const parent = path18.dirname(cur);
@@ -3206,7 +3243,7 @@ function normalizePep503(name) {
 function sitePackagesDirs(base) {
   const out = [];
   try {
-    for (const d of fs17.readdirSync(path18.join(base, "lib"))) {
+    for (const d of fs18.readdirSync(path18.join(base, "lib"))) {
       if (d.startsWith("python")) out.push(path18.join(base, "lib", d, "site-packages"));
     }
   } catch {
@@ -3220,7 +3257,7 @@ function installedPypiVersion(root, name) {
     for (const sp of sitePackagesDirs(path18.join(root, venv))) {
       let entries;
       try {
-        entries = fs17.readdirSync(sp);
+        entries = fs18.readdirSync(sp);
       } catch {
         continue;
       }
@@ -3235,7 +3272,7 @@ function installedPypiVersion(root, name) {
 function installedPhpVersion(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "vendor", "composer", "installed.json"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "vendor", "composer", "installed.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3254,7 +3291,7 @@ function pypiDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3342,7 +3379,7 @@ function goDeps(files) {
   for (const mod of files) {
     let text;
     try {
-      text = fs17.readFileSync(mod, "utf8");
+      text = fs18.readFileSync(mod, "utf8");
     } catch {
       continue;
     }
@@ -3360,7 +3397,7 @@ function cargoDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3392,7 +3429,7 @@ function rubyDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3407,7 +3444,7 @@ function phpDeps(files) {
   for (const file of files) {
     let pkg;
     try {
-      pkg = JSON.parse(fs17.readFileSync(file, "utf8"));
+      pkg = JSON.parse(fs18.readFileSync(file, "utf8"));
     } catch {
       continue;
     }
@@ -3424,7 +3461,7 @@ function dotnetDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3444,7 +3481,7 @@ function swiftDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3466,7 +3503,7 @@ function dartDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3491,7 +3528,7 @@ function javaDeps(files) {
   for (const file of files) {
     let text;
     try {
-      text = fs17.readFileSync(file, "utf8");
+      text = fs18.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -3580,7 +3617,7 @@ function walk(dir, depth, onFile) {
   if (depth < 0) return;
   let entries;
   try {
-    entries = fs17.readdirSync(dir, { withFileTypes: true });
+    entries = fs18.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -3616,7 +3653,7 @@ function lockfileVersion(root, ecosystem, name) {
 function gradleLock(root, name) {
   let text;
   try {
-    text = fs17.readFileSync(path18.join(root, "gradle.lockfile"), "utf8");
+    text = fs18.readFileSync(path18.join(root, "gradle.lockfile"), "utf8");
   } catch {
     return void 0;
   }
@@ -3626,7 +3663,7 @@ function gradleLock(root, name) {
 function packageResolved(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "Package.resolved"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "Package.resolved"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3642,7 +3679,7 @@ function packageResolved(root, name) {
 function pubspecLock(root, name) {
   let text;
   try {
-    text = fs17.readFileSync(path18.join(root, "pubspec.lock"), "utf8");
+    text = fs18.readFileSync(path18.join(root, "pubspec.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -3666,7 +3703,7 @@ function escapeRegExp(s) {
 function gemfileLock(root, name) {
   let text;
   try {
-    text = fs17.readFileSync(path18.join(root, "Gemfile.lock"), "utf8");
+    text = fs18.readFileSync(path18.join(root, "Gemfile.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -3676,7 +3713,7 @@ function gemfileLock(root, name) {
 function composerLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "composer.lock"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "composer.lock"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3691,7 +3728,7 @@ function composerLock(root, name) {
 function packagesLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "packages.lock.json"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "packages.lock.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3716,7 +3753,7 @@ function pypiLockVersion(root, name) {
 function tomlPackageLock(root, file, name, normalize3) {
   let text;
   try {
-    text = fs17.readFileSync(path18.join(root, file), "utf8");
+    text = fs18.readFileSync(path18.join(root, file), "utf8");
   } catch {
     return void 0;
   }
@@ -3733,7 +3770,7 @@ function tomlPackageLock(root, file, name, normalize3) {
 function pipfileLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "Pipfile.lock"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "Pipfile.lock"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3752,7 +3789,7 @@ function pipfileLock(root, name) {
 function packageLockVersion(root, name) {
   let data;
   try {
-    data = JSON.parse(fs17.readFileSync(path18.join(root, "package-lock.json"), "utf8"));
+    data = JSON.parse(fs18.readFileSync(path18.join(root, "package-lock.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -3764,7 +3801,7 @@ function packageLockVersion(root, name) {
 function yarnLockVersion(root, name) {
   let text;
   try {
-    text = fs17.readFileSync(path18.join(root, "yarn.lock"), "utf8");
+    text = fs18.readFileSync(path18.join(root, "yarn.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -3802,9 +3839,9 @@ function libId(name) {
 }
 function loadCatalog(root) {
   const file = catalogPath(root);
-  if (fs17.existsSync(file)) {
+  if (fs18.existsSync(file)) {
     try {
-      const data = JSON.parse(fs17.readFileSync(file, "utf8"));
+      const data = JSON.parse(fs18.readFileSync(file, "utf8"));
       if (data.schemaVersion === LIB_SCHEMA && data.libraries) return data;
     } catch {
     }
@@ -3812,7 +3849,7 @@ function loadCatalog(root) {
   return { schemaVersion: LIB_SCHEMA, libraries: {} };
 }
 function saveCatalog(root, catalog) {
-  fs17.writeFileSync(catalogPath(root), `${stableStringify(catalog, 2)}
+  fs18.writeFileSync(catalogPath(root), `${stableStringify(catalog, 2)}
 `);
 }
 function resolveLib(catalog, name) {
@@ -3889,16 +3926,16 @@ async function addLibrary(source, opts) {
     type = source.endsWith("llms.txt") ? "llms.txt" : source.endsWith(".json") ? "openapi" : "website";
   } else {
     const abs = path18.resolve(root, source);
-    if (!fs17.existsSync(abs)) throw new Error(`source not found: ${source}`);
+    if (!fs18.existsSync(abs)) throw new Error(`source not found: ${source}`);
     content = readLocal(abs);
     type = "local";
   }
   const name = opts.name ?? inferName(source);
   const id = libId(name);
   const version = opts.version ?? installedVersion(root, name) ?? "*";
-  fs17.mkdirSync(libDir(root), { recursive: true });
+  fs18.mkdirSync(libDir(root), { recursive: true });
   const docFileAbs = path18.join(libDir(root), `${id}.md`);
-  fs17.writeFileSync(docFileAbs, content);
+  fs18.writeFileSync(docFileAbs, content);
   const entry = {
     id,
     name,
@@ -3915,13 +3952,13 @@ async function addLibrary(source, opts) {
 }
 function readDoc(root, entry) {
   const abs = path18.resolve(root, entry.docFile);
-  return fs17.existsSync(abs) ? fs17.readFileSync(abs, "utf8") : "";
+  return fs18.existsSync(abs) ? fs18.readFileSync(abs, "utf8") : "";
 }
 function npmPackageDir(root, name) {
   let cur = root;
   for (let i = 0; i < 12; i++) {
     const dir = path18.join(cur, "node_modules", name);
-    if (fs17.existsSync(path18.join(dir, "package.json"))) return dir;
+    if (fs18.existsSync(path18.join(dir, "package.json"))) return dir;
     const parent = path18.dirname(cur);
     if (parent === cur) break;
     cur = parent;
@@ -3935,7 +3972,7 @@ function localPackageDocs(root, name) {
   for (const f of ["llms.txt", "README.md", "README.mdx", "README", "readme.md"]) {
     const p = path18.join(dir, f);
     try {
-      const docs = fs17.readFileSync(p, "utf8");
+      const docs = fs18.readFileSync(p, "utf8");
       if (docs.trim()) {
         return { docs, version, source: path18.relative(root, p).split(path18.sep).join("/") };
       }
@@ -3943,7 +3980,7 @@ function localPackageDocs(root, name) {
     }
   }
   try {
-    const pkg = JSON.parse(fs17.readFileSync(path18.join(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs18.readFileSync(path18.join(dir, "package.json"), "utf8"));
     if (pkg.description?.trim()) {
       return {
         docs: `# ${name}
@@ -3959,17 +3996,17 @@ ${pkg.description}`,
 }
 function dtsEntry(dir) {
   try {
-    const pkg = JSON.parse(fs17.readFileSync(path18.join(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs18.readFileSync(path18.join(dir, "package.json"), "utf8"));
     const rel2 = pkg.types ?? pkg.typings;
     if (typeof rel2 === "string") {
       const p = path18.join(dir, rel2);
-      if (fs17.existsSync(p)) return p;
+      if (fs18.existsSync(p)) return p;
     }
   } catch {
   }
   for (const c of ["index.d.ts", "dist/index.d.ts", "lib/index.d.ts", "types/index.d.ts"]) {
     const p = path18.join(dir, c);
-    if (fs17.existsSync(p)) return p;
+    if (fs18.existsSync(p)) return p;
   }
   return void 0;
 }
@@ -4002,7 +4039,7 @@ function localApiSurface(root, name) {
   if (!dts) return void 0;
   let src;
   try {
-    src = fs17.readFileSync(dts, "utf8");
+    src = fs18.readFileSync(dts, "utf8");
   } catch {
     return void 0;
   }
@@ -4010,36 +4047,36 @@ function localApiSurface(root, name) {
   return decls.length ? decls.join("\n\n") : void 0;
 }
 function cloneAndReadGit(url) {
-  const dir = fs17.mkdtempSync(path18.join(os.tmpdir(), "vg-lib-git-"));
+  const dir = fs18.mkdtempSync(path18.join(os.tmpdir(), "vg-lib-git-"));
   try {
     execFileSync("git", ["clone", "--depth", "1", "--quiet", url, dir], {
       stdio: ["ignore", "ignore", "pipe"]
     });
   } catch (err) {
-    fs17.rmSync(dir, { recursive: true, force: true });
+    fs18.rmSync(dir, { recursive: true, force: true });
     const detail = err instanceof Error && err.message ? `: ${err.message.split("\n")[0]}` : "";
     throw new Error(`git clone failed for ${url}${detail}`);
   }
   try {
     return readGitDocs(dir);
   } finally {
-    fs17.rmSync(dir, { recursive: true, force: true });
+    fs18.rmSync(dir, { recursive: true, force: true });
   }
 }
 function readGitDocs(dir) {
   const docsDir = path18.join(dir, "docs");
-  if (fs17.existsSync(docsDir) && fs17.statSync(docsDir).isDirectory()) return readLocal(docsDir);
-  const readme = ["README.md", "README.mdx", "README.txt", "README.rst", "readme.md"].map((f) => path18.join(dir, f)).find((p) => fs17.existsSync(p));
-  if (readme) return fs17.readFileSync(readme, "utf8");
+  if (fs18.existsSync(docsDir) && fs18.statSync(docsDir).isDirectory()) return readLocal(docsDir);
+  const readme = ["README.md", "README.mdx", "README.txt", "README.rst", "readme.md"].map((f) => path18.join(dir, f)).find((p) => fs18.existsSync(p));
+  if (readme) return fs18.readFileSync(readme, "utf8");
   return readLocal(dir);
 }
 function readLocal(abs) {
-  const stat = fs17.statSync(abs);
-  if (stat.isFile()) return fs17.readFileSync(abs, "utf8");
+  const stat = fs18.statSync(abs);
+  if (stat.isFile()) return fs18.readFileSync(abs, "utf8");
   const parts = [];
-  const files = fs17.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isFile() && /\.(md|mdx|txt|rst)$/i.test(e.name)).map((e) => e.name).sort();
+  const files = fs18.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isFile() && /\.(md|mdx|txt|rst)$/i.test(e.name)).map((e) => e.name).sort();
   for (const f of files) parts.push(`<!-- ${f} -->
-${fs17.readFileSync(path18.join(abs, f), "utf8")}`);
+${fs18.readFileSync(path18.join(abs, f), "utf8")}`);
   return parts.join("\n\n");
 }
 function inferName(source) {
@@ -4050,7 +4087,7 @@ function inferName(source) {
 function findGitRoot(startDir = process.cwd()) {
   let dir = path18.resolve(startDir);
   for (; ; ) {
-    if (fs17.existsSync(path18.join(dir, ".git"))) return dir;
+    if (fs18.existsSync(path18.join(dir, ".git"))) return dir;
     const parent = path18.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -4067,14 +4104,14 @@ function ensureGitignored(entry, startDir = process.cwd()) {
   let existing = "";
   let fileExisted = true;
   try {
-    existing = fs17.readFileSync(gitignorePath, "utf8");
+    existing = fs18.readFileSync(gitignorePath, "utf8");
   } catch {
     fileExisted = false;
   }
   const alreadyPresent = existing.split(/\r?\n/).some((line) => normalizeEntry(line) === target);
   if (alreadyPresent) return { status: "present", entry, gitignorePath };
   const needsLeadingNewline = existing.length > 0 && !existing.endsWith("\n");
-  fs17.appendFileSync(gitignorePath, `${needsLeadingNewline ? "\n" : ""}${entry}
+  fs18.appendFileSync(gitignorePath, `${needsLeadingNewline ? "\n" : ""}${entry}
 `, "utf8");
   return { status: fileExisted ? "added" : "created", entry, gitignorePath };
 }
@@ -4250,41 +4287,51 @@ dsnCommand.command("create").description("Create a new DSN token").option("--ing
     }
   }
 });
-function credentialsDir() {
-  return path18.join(os.homedir(), ".vibgrate");
-}
-function credentialsPath() {
-  return path18.join(credentialsDir(), "credentials.json");
-}
-function gitignoreEntryForCredentials(repoRoot) {
-  const rel2 = path18.relative(repoRoot, credentialsPath());
+var STORE_DIRNAME = ".vibgrate";
+var STORE_FILENAME = "credentials.json";
+function homeCredentialsPath() {
+  return path18.join(os.homedir(), STORE_DIRNAME, STORE_FILENAME);
+}
+function projectCredentialsPath(cwd = process.cwd()) {
+  const root = findGitRoot(cwd) ?? cwd;
+  return path18.join(root, STORE_DIRNAME, STORE_FILENAME);
+}
+function credentialsPath(opts = {}) {
+  const override = process.env.VIBGRATE_CREDENTIALS?.trim();
+  if (override) return path18.resolve(override);
+  const local = projectCredentialsPath(opts.cwd);
+  if (opts.local) return local;
+  if (fs18.existsSync(local)) return local;
+  return homeCredentialsPath();
+}
+function gitignoreEntryForCredentials(repoRoot, credsFile = credentialsPath()) {
+  const rel2 = path18.relative(repoRoot, credsFile);
   if (rel2 && !rel2.startsWith("..") && !path18.isAbsolute(rel2)) {
     return rel2.split(path18.sep).join("/");
   }
-  return ".vibgrate/credentials.json";
+  return `${STORE_DIRNAME}/${STORE_FILENAME}`;
 }
-function readStoredCredentials() {
+function readStoredCredentials(opts = {}) {
   try {
-    const raw = fs17.readFileSync(credentialsPath(), "utf8");
+    const raw = fs18.readFileSync(credentialsPath(opts), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed.dsn === "string" && parsed.dsn ? parsed : null;
   } catch {
     return null;
   }
 }
-function writeStoredCredentials(creds) {
-  const dir = credentialsDir();
-  fs17.mkdirSync(dir, { recursive: true });
-  const file = credentialsPath();
-  fs17.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+function writeStoredCredentials(creds, opts = {}) {
+  const file = credentialsPath(opts);
+  fs18.mkdirSync(path18.dirname(file), { recursive: true });
+  fs18.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
-    fs17.chmodSync(file, 384);
+    fs18.chmodSync(file, 384);
   } catch {
   }
 }
-function clearStoredCredentials() {
+function clearStoredCredentials(opts = {}) {
   try {
-    fs17.rmSync(credentialsPath());
+    fs18.rmSync(credentialsPath(opts));
     return true;
   } catch {
     return false;
@@ -4673,7 +4720,7 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
 function readScanArtifact(root) {
   try {
     const file = path18.join(root, ".vibgrate", "scan_result.json");
-    return JSON.parse(fs17.readFileSync(file, "utf8"));
+    return JSON.parse(fs18.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
@@ -5648,13 +5695,13 @@ function ledgerPath(root) {
   return path18.join(cacheDir(root), LEDGER);
 }
 function savingsRecorded(root) {
-  return fs17.existsSync(ledgerPath(root));
+  return fs18.existsSync(ledgerPath(root));
 }
 function recordSaving(root, entry, now) {
   try {
-    fs17.mkdirSync(cacheDir(root), { recursive: true });
+    fs18.mkdirSync(cacheDir(root), { recursive: true });
     const line = JSON.stringify({ ts: now, ...entry });
-    fs17.appendFileSync(ledgerPath(root), line + "\n");
+    fs18.appendFileSync(ledgerPath(root), line + "\n");
   } catch {
   }
 }
@@ -5666,8 +5713,8 @@ function readSavings(root, days, now, ratePerM = DEFAULT_RATE_PER_M) {
   let queries = 0;
   let vgTokens = 0;
   let baselineTokens = 0;
-  if (fs17.existsSync(file)) {
-    for (const line of fs17.readFileSync(file, "utf8").split("\n")) {
+  if (fs18.existsSync(file)) {
+    for (const line of fs18.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) continue;
       try {
         const e = JSON.parse(line);
@@ -5723,9 +5770,9 @@ var GraphSource = class {
   /** Current graph: auto-refreshed if the tree drifted, reloaded if the file changed. */
   async get() {
     if (this.refresh) await this.maybeRefresh();
-    const stat = fs17.statSync(this.graphPath);
+    const stat = fs18.statSync(this.graphPath);
     if (stat.mtimeMs !== this.cachedMtimeMs || !this.cached) {
-      this.cached = parseGraph(fs17.readFileSync(this.graphPath, "utf8"));
+      this.cached = parseGraph(fs18.readFileSync(this.graphPath, "utf8"));
       this.cachedMtimeMs = stat.mtimeMs;
     }
     return this.cached;
@@ -5806,8 +5853,8 @@ async function serveStdio(graphPath, opts = {}) {
   await server.connect(new StdioServerTransport());
 }
 function sleep(ms) {
-  return new Promise((resolve11) => {
-    const timer = setTimeout(resolve11, ms);
+  return new Promise((resolve12) => {
+    const timer = setTimeout(resolve12, ms);
     timer.unref?.();
   });
 }
@@ -5975,27 +6022,6 @@ function detectServeLaunch(which = whichOnPath) {
     note: "vg is not installed on PATH \u2014 registered an npx launcher. Install globally (`npm i -g @vibgrate/cli`) and rerun `vg install` for a faster startup."
   };
 }
-function whichOnPath(cmd) {
-  try {
-    const out = execFileSync(process.platform === "win32" ? "where" : "which", [cmd], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim().split(/\r?\n/)[0];
-    return out || null;
-  } catch {
-    return null;
-  }
-}
-function isOwnBinary(binPath) {
-  try {
-    const real = fs17.realpathSync(binPath);
-    if (/[\\/]@vibgrate[\\/]cli[\\/]/.test(real)) return true;
-    const head = fs17.readFileSync(real, { encoding: "utf8" }).slice(0, 2048);
-    return head.includes("@vibgrate/cli") || head.includes("vibgrate");
-  } catch {
-    return false;
-  }
-}
 function installAssistant(a, opts) {
   const wrote = [];
   const skipped = [];
@@ -6030,23 +6056,23 @@ function uninstallAssistant(a, root, purge) {
     const file = path18.join(root, a.nudge.file);
     if (a.nudge.kind === "block") {
       if (removeBlock(file)) removed.push(a.nudge.file);
-    } else if (fs17.existsSync(file)) {
-      fs17.rmSync(file);
+    } else if (fs18.existsSync(file)) {
+      fs18.rmSync(file);
       removed.push(a.nudge.file);
     }
   }
   if (purge && a.skill) {
     const file = path18.join(root, a.skill);
-    if (fs17.existsSync(file)) {
-      fs17.rmSync(file);
+    if (fs18.existsSync(file)) {
+      fs18.rmSync(file);
       removed.push(a.skill);
     }
   }
   return removed;
 }
 function writeFileEnsured(file, content) {
-  fs17.mkdirSync(path18.dirname(file), { recursive: true });
-  fs17.writeFileSync(file, content);
+  fs18.mkdirSync(path18.dirname(file), { recursive: true });
+  fs18.writeFileSync(file, content);
 }
 function upsertMcp(file, target, launch) {
   const config = readJson(file);
@@ -6059,7 +6085,7 @@ function upsertMcp(file, target, launch) {
 `);
 }
 function removeMcp(file, target) {
-  if (!fs17.existsSync(file)) return false;
+  if (!fs18.existsSync(file)) return false;
   const config = readJson(file);
   const bag = config[target.key];
   if (!bag || !(bag.vg !== void 0)) return false;
@@ -6082,8 +6108,8 @@ ${stripMarkers(nudgeMarkdown(smallRepo))}` : stripMarkers(nudgeMarkdown(smallRep
   upsertBlock(file, nudgeMarkdown(smallRepo));
 }
 function upsertBlock(file, block) {
-  fs17.mkdirSync(path18.dirname(file), { recursive: true });
-  let existing = fs17.existsSync(file) ? fs17.readFileSync(file, "utf8") : "";
+  fs18.mkdirSync(path18.dirname(file), { recursive: true });
+  let existing = fs18.existsSync(file) ? fs18.readFileSync(file, "utf8") : "";
   const re = new RegExp(`${escapeRe(NUDGE_BEGIN)}[\\s\\S]*?${escapeRe(NUDGE_END)}`);
   if (re.test(existing)) existing = existing.replace(re, block);
   else existing = existing.length ? `${existing.replace(/\s*$/, "")}
@@ -6091,20 +6117,20 @@ function upsertBlock(file, block) {
 ${block}
 ` : `${block}
 `;
-  fs17.writeFileSync(file, existing);
+  fs18.writeFileSync(file, existing);
 }
 function removeBlock(file) {
-  if (!fs17.existsSync(file)) return false;
-  const existing = fs17.readFileSync(file, "utf8");
+  if (!fs18.existsSync(file)) return false;
+  const existing = fs18.readFileSync(file, "utf8");
   const re = new RegExp(`\\n*${escapeRe(NUDGE_BEGIN)}[\\s\\S]*?${escapeRe(NUDGE_END)}\\n*`);
   if (!re.test(existing)) return false;
-  fs17.writeFileSync(file, existing.replace(re, "\n"));
+  fs18.writeFileSync(file, existing.replace(re, "\n"));
   return true;
 }
 function readJson(file) {
-  if (!fs17.existsSync(file)) return {};
+  if (!fs18.existsSync(file)) return {};
   try {
-    const parsed = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -6262,6 +6288,6 @@ function spdx(ctx) {
   return JSON.stringify(doc, null, 2) + "\n";
 }
 
-export { ASSISTANTS, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, SCHEMA_VERSION, SKIP_DIRS, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, exportGraph, fetchHostedDocs, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeSnapshot, writeStoredCredentials };
-//# sourceMappingURL=chunk-W2QP2YH6.js.map
-//# sourceMappingURL=chunk-W2QP2YH6.js.map
+export { ASSISTANTS, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, NPX_INVOCATION, SCHEMA_VERSION, SKIP_DIRS, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, exportGraph, fetchHostedDocs, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveCliInvocation, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeSnapshot, writeStoredCredentials };
+//# sourceMappingURL=chunk-WGXDYBAN.js.map
+//# sourceMappingURL=chunk-WGXDYBAN.js.map