@vibgrate/cli 2026.708.1 → 2026.708.3

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-2J7DPIAL.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-2DJ3UXG7.js';
 import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-FMCI3MXH.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-SRWMZBLG.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-JXGVMXYE.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-QUELGOCR.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import * as fs5 from 'fs';
-import fs5__default, { realpathSync } from 'fs';
+import fs5__default, { realpathSync, existsSync, readFileSync } from 'fs';
 import * as path from 'path';
-import path__default from 'path';
+import path__default, { join } from 'path';
 import { fileURLToPath } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
@@ -295,7 +295,7 @@ function logoLines(root) {
     `  ${ROBOT[1]}`,
     `  ${ROBOT[2]}`,
     `  ${ROBOT[3]}`,
-    `  ${c.bold.white("vibgrate")} ${teal("graph")}  ${c.dim(`\xB7 deterministic code graph \xB7 v${VERSION}`)}`,
+    `  ${c.bold.white("Vibgrate")} ${teal("Graph")}  ${c.dim(`\xB7 Code Intelligence Engine \xB7 v${VERSION}`)}`,
     ...root ? [`  ${c.dim(root)}`] : [],
     ""
   ];
@@ -2034,23 +2034,29 @@ function registerSavings(program) {
   const cmd = program.command("savings").description("local, privacy-safe report of tokens/$ saved vs a grep baseline (estimates)").option("--days <n>", "window in days", "30").action(function() {
     const global = readGlobal(this);
     const days = Number(this.opts().days) || 30;
-    const report = readSavings(rootOf(global), days, Date.now());
+    const root = rootOf(global);
+    const now2 = Date.now();
+    const report = readSavings(root, days, now2);
+    const usage = readUsage(root, days, now2);
     if (global.json) {
-      json(report);
+      json({ ...report, usage });
       return;
     }
     info(`${c.cyan("vg savings")} \xB7 last ${days} days ${c.dim("(local, nothing left your machine)")}`);
-    if (!report.enabled && report.queries === 0) {
-      info(c.dim("  recording is off. Enable with `vg serve --savings`, then query via MCP."));
+    if (usage.totals.calls === 0) {
+      info(
+        c.dim(
+          report.enabled ? "  no calls recorded yet in this window" : "  recording is off. Enable with `vg serve --savings`, then query via MCP."
+        )
+      );
       return;
     }
-    if (report.queries === 0) {
-      info(c.dim("  no queries recorded yet in this window"));
-      return;
+    if (report.queries > 0) {
+      info(`  queries ${report.queries} \xB7 context tokens ${fmt(report.vgTokens)}  (grep/read baseline \u2248 ${fmt(report.baselineTokens)})  \u2192 ${report.ratio}\xD7 fewer`);
+      info(`  est. cost (${report.rateLabel}): $${report.estCostVg} vs $${report.estCostBaseline}  \u2192 saved \u2248 $${report.saved}`);
+      info(c.dim("  estimates with stated assumptions (~4 chars/token; ~400 tokens/file baseline); scales with repo size."));
     }
-    info(`  queries ${report.queries} \xB7 context tokens ${fmt(report.vgTokens)}  (grep/read baseline \u2248 ${fmt(report.baselineTokens)})  \u2192 ${report.ratio}\xD7 fewer`);
-    info(`  est. cost (${report.rateLabel}): $${report.estCostVg} vs $${report.estCostBaseline}  \u2192 saved \u2248 $${report.saved}`);
-    info(c.dim("  estimates with stated assumptions (~4 chars/token; ~400 tokens/file baseline); scales with repo size."));
+    printBreakdown(usage);
   });
   applyGlobalOptions(cmd);
 }
@@ -2059,6 +2065,24 @@ function fmt(n) {
   if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
   return String(n);
 }
+function printBreakdown(usage) {
+  info("");
+  info(c.bold("  by command") + c.dim("  (complete = full result \xB7 partial = capped/paginated \xB7 miss = no result)"));
+  const nameW = Math.max(7, ...usage.commands.map((cmd) => cmd.tool.length));
+  const header = "    " + "command".padEnd(nameW) + ["calls", "complete", "partial", "miss", "success%"].map((h) => h.padStart(9)).join("");
+  info(c.dim(header));
+  for (const cmd of usage.commands) {
+    info(
+      "    " + cmd.tool.padEnd(nameW) + String(cmd.calls).padStart(9) + String(cmd.complete).padStart(9) + String(cmd.partial).padStart(9) + String(cmd.miss).padStart(9) + `${cmd.successPct}%`.padStart(9)
+    );
+  }
+  const t = usage.totals;
+  info(c.dim("    " + "\u2500".repeat(nameW + 45)));
+  info(
+    "    " + c.bold("total".padEnd(nameW)) + String(t.calls).padStart(9) + String(t.complete).padStart(9) + String(t.partial).padStart(9) + String(t.miss).padStart(9) + "".padStart(9)
+  );
+  info(c.dim(`    avg success across commands: ${usage.avgSuccessPct}%`));
+}
 function registerLib(program) {
   const cmd = program.command("lib").description("library currency: version-correct, drift-annotated usage docs").argument("[args...]", "a library name, or: add <source> | publish <name> | resolve <name> | refresh").option("--name <name>", "library name for `add`").option("--version <v>", "pin the doc version for `add`/`publish`").option("--online", "(deprecated; network is on by default) allow network for add/refresh URL sources").option("-b, --budget <n>", "trim docs to ~N tokens").option("--readme <path>", "README path for `publish` (default ./README.md)").option("--dts <path>", "TypeScript declaration (.d.ts) path for `publish`").option("--language <lang>", "primary language for `publish`").option("--region <region>", "data-residency region for the hosted catalog (same as scans; default us)").option("--ingest <url>", "hosted catalog/ingest URL override (host extracted; wins over --region)").action(async function(args, opts) {
     const global = readGlobal(this);
@@ -2343,7 +2367,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-RRO4NNNF.js');
+    const { runBaseline } = await import('./baseline-AUC3HAXW.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -3169,11 +3193,11 @@ function estimateDriftScore(artifact, upgraded) {
   }
   return computeDriftScore(projects).score;
 }
-function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
+function pmCommandFor(ecosystem, pkg, version, pm = "npm", opts = {}) {
   switch (ecosystem) {
     case "npm":
-      if (pm === "pnpm") return { cmd: "pnpm", args: ["add", `${pkg}@${version}`] };
-      if (pm === "yarn") return { cmd: "yarn", args: ["add", `${pkg}@${version}`] };
+      if (pm === "pnpm") return { cmd: "pnpm", args: opts.workspaceRoot ? ["add", "-w", `${pkg}@${version}`] : ["add", `${pkg}@${version}`] };
+      if (pm === "yarn") return { cmd: "yarn", args: opts.workspaceRoot ? ["add", "-W", `${pkg}@${version}`] : ["add", `${pkg}@${version}`] };
       if (pm === "bun") return { cmd: "bun", args: ["add", `${pkg}@${version}`] };
       return { cmd: "npm", args: ["install", `${pkg}@${version}`] };
     case "pypi":
@@ -3200,19 +3224,37 @@ function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
 }
 function defaultRun(cmd, cwd) {
   const res = spawnSync(cmd.cmd, cmd.args, { cwd, stdio: "inherit", shell: false });
-  if (res.error) return { ok: false, detail: res.error.message };
+  if (res.error) {
+    if (res.error.code === "ENOENT") {
+      return { ok: false, toolMissing: true, detail: `${cmd.cmd} is not installed or not on PATH` };
+    }
+    return { ok: false, detail: res.error.message };
+  }
   if (res.status !== 0) return { ok: false, detail: `exit ${res.status ?? "signal"}` };
   return { ok: true };
 }
+function isWorkspaceRoot(dir) {
+  try {
+    if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+      if (pkg?.workspaces) return true;
+    }
+  } catch {
+  }
+  return false;
+}
 function applyPlan(rootDir, upgrades, opts = {}) {
   const run = opts.run ?? defaultRun;
+  const workspaceRoot = isWorkspaceRoot(rootDir);
   const results = [];
   for (const u of upgrades) {
     if (!u.to) {
       results.push({ package: u.package, to: u.to, status: "skipped", detail: "no target version" });
       continue;
     }
-    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager);
+    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot });
     if (!command) {
       results.push({ package: u.package, to: u.to, status: "manual", detail: `${u.ecosystem}: update the manifest to ${u.to} manually` });
       continue;
@@ -3225,8 +3267,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     results.push({
       package: u.package,
       to: u.to,
-      status: outcome.ok ? "applied" : "failed",
-      detail: outcome.detail
+      status: outcome.ok ? "applied" : outcome.toolMissing ? "manual" : "failed",
+      detail: outcome.toolMissing && outcome.detail ? `${outcome.detail} \u2014 upgrade manually` : outcome.detail
     });
   }
   return results;
@@ -3466,6 +3508,44 @@ function npmPackageManager(artifact) {
   }
   return "npm";
 }
+function toNpmPackageManager(pm) {
+  return pm === "pnpm" || pm === "yarn" || pm === "bun" ? pm : "npm";
+}
+function projectsDeclaring(rootDir, artifact, pkg, ecosystem) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const project of artifact.projects ?? []) {
+    if (ecosystemId(project.type) !== ecosystem) continue;
+    if (!(project.dependencies ?? []).some((d) => d.package === pkg)) continue;
+    const dir = path.resolve(rootDir, project.path && project.path !== "." ? project.path : ".");
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    out2.push({ dir, pm: toNpmPackageManager(project.packageManager) });
+  }
+  return out2;
+}
+function applyChosenPlan(rootDir, artifact, upgrades, opts) {
+  const fallbackPm = npmPackageManager(artifact);
+  const groups = /* @__PURE__ */ new Map();
+  for (const u of upgrades) {
+    let targets = projectsDeclaring(rootDir, artifact, u.package, u.ecosystem);
+    if (targets.length === 0) targets = [{ dir: rootDir, pm: fallbackPm }];
+    for (const t of targets) {
+      const group = groups.get(t.dir) ?? { dir: t.dir, pm: t.pm, upgrades: [] };
+      group.upgrades.push(u);
+      groups.set(t.dir, group);
+    }
+  }
+  const results = [];
+  for (const group of groups.values()) {
+    const applied = applyPlan(group.dir, group.upgrades, { dryRun: opts.dryRun, packageManager: group.pm });
+    const rel3 = path.relative(rootDir, group.dir) || ".";
+    for (const r of applied) {
+      results.push(rel3 === "." ? r : { ...r, detail: [r.detail, `in ${rel3}`].filter(Boolean).join(" \xB7 ") });
+    }
+  }
+  return results;
+}
 function promptPlanSelection(response) {
   const plans = response.plans.filter((p) => p.upgrades.length > 0);
   console.log(chalk7.bold("\nSelect a plan to apply:"));
@@ -3520,8 +3600,7 @@ async function runApplyFlow(rootDir, artifact, response, opts) {
     console.log(chalk7.dim("Selected plan has no upgrades."));
     return;
   }
-  const pm = npmPackageManager(artifact);
-  const results = applyPlan(rootDir, chosen.upgrades, { dryRun: opts.dryRun, packageManager: pm });
+  const results = applyChosenPlan(rootDir, artifact, chosen.upgrades, { dryRun: opts.dryRun });
   if (opts.dryRun) {
     console.log(chalk7.bold(`
 Dry run \u2014 ${chosen.label} plan (${chosen.upgrades.length} upgrade(s)):`));
@@ -3559,7 +3638,7 @@ function formatText(artifact) {
   lines.push("");
   lines.push("   " + teal2("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint2("\u279C"));
   lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.bold.white("vibgrate"));
-  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + "  " + chalk7.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.dim(`Drift Intelligence Engine v${VERSION}`));
+  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + "  " + chalk7.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.dim(`Code Intelligence Engine v${VERSION}`));
   lines.push("   " + teal2("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   lines.push("");
   lines.push(...titleBox("Vibgrate Drift Report", teal2));
@@ -4532,11 +4611,23 @@ async function detectPackageManager(cwd) {
   if (await pathExists(path.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
-function getInstallCommand(pm, pkg, version, isDev) {
+async function detectWorkspaceRoot(cwd) {
+  if (await pathExists(path.join(cwd, "pnpm-workspace.yaml"))) return true;
+  try {
+    const pkgPath = path.join(cwd, "package.json");
+    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return pkg.workspaces != null;
+  } catch {
+    return false;
+  }
+}
+function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
   const spec = `${pkg}@${version}`;
+  const ws = opts.workspaceRoot && pm === "pnpm" ? " -w" : "";
   switch (pm) {
     case "pnpm":
-      return isDev ? `pnpm add -D ${spec}` : `pnpm add ${spec}`;
+      return isDev ? `pnpm add${ws} -D ${spec}` : `pnpm add${ws} ${spec}`;
     case "yarn":
       return isDev ? `yarn add --dev ${spec}` : `yarn add ${spec}`;
     case "bun":
@@ -4556,45 +4647,72 @@ async function isDevDependency(cwd) {
     return true;
   }
 }
-var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
-  console.log(chalk7.dim(`Current version: ${VERSION}`));
-  console.log(chalk7.dim("Checking npm registry..."));
-  const latest = await fetchLatestVersion();
-  if (!latest) {
-    console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
-    process.exit(1);
-  }
-  const semver2 = await import('semver');
-  if (!semver2.gt(latest, VERSION)) {
-    console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
-    return;
-  }
-  console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
-  if (opts.check) {
-    console.log(chalk7.dim('Run "vibgrate update" to install.'));
-    return;
-  }
-  const cwd = process.cwd();
-  const globalPm = detectGlobalInstall();
-  const isGlobal = opts.global || globalPm !== null;
-  const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
-  let cmd;
-  if (isGlobal) {
-    cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
-    console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
-  } else {
-    const isDev = await isDevDependency(cwd);
-    cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
-    console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
-  }
-  try {
-    execSync(cmd, { cwd, stdio: "inherit" });
-    console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
-  } catch {
-    console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
-    process.exit(1);
+async function confirmWorkspaceRoot(pm) {
+  if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve16) => {
+    rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
+      rl.close();
+      const t = ans.trim().toLowerCase();
+      resolve16(t === "y" || t === "yes");
+    });
+  });
+}
+var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").option("-y, --yes", "Skip confirmation prompts (e.g. installing at a workspace root)").option("-w, --workspace-root", "Allow updating the pnpm workspace root (implies --yes for that prompt)").action(
+  async (opts) => {
+    console.log(chalk7.dim(`Current version: ${VERSION}`));
+    console.log(chalk7.dim("Checking npm registry..."));
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+      console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
+      process.exit(1);
+    }
+    const semver2 = await import('semver');
+    if (!semver2.gt(latest, VERSION)) {
+      console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+      return;
+    }
+    console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+    if (opts.check) {
+      console.log(chalk7.dim('Run "vg update" to install.'));
+      return;
+    }
+    const cwd = process.cwd();
+    const globalPm = detectGlobalInstall();
+    const isGlobal = opts.global || globalPm !== null;
+    const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
+    let cmd;
+    if (isGlobal) {
+      cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
+      console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
+    } else {
+      const isDev = await isDevDependency(cwd);
+      let workspaceRoot = false;
+      if (pm === "pnpm" && await detectWorkspaceRoot(cwd)) {
+        console.log(
+          chalk7.yellow("Detected a pnpm workspace root.") + chalk7.dim(" Installing here needs the -w flag and updates the root package.json.")
+        );
+        const proceed = opts.yes || opts.workspaceRoot || await confirmWorkspaceRoot(pm);
+        if (!proceed) {
+          const rootCmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot: true });
+          console.log(chalk7.dim(`Skipped. To update the workspace root, run: ${rootCmd}`));
+          console.log(chalk7.dim('or re-run "vg update --yes" (or --workspace-root) to let vg do it.'));
+          return;
+        }
+        workspaceRoot = true;
+      }
+      cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot });
+      console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
+    }
+    try {
+      execSync(cmd, { cwd, stdio: "inherit" });
+      console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+    } catch {
+      console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
+      process.exit(1);
+    }
   }
-});
+);
 var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 var VEX_STATUSES = ["not_affected", "affected", "fixed", "under_investigation"];
 var VEX_JUSTIFICATIONS = [