@vibgrate/cli 2026.708.2 → 2026.708.3

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-AWEAREOE.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-2DJ3UXG7.js';
 import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-GHLYQZWT.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-ICBBG6U3.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-JXGVMXYE.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-QUELGOCR.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import * as fs5 from 'fs';
-import fs5__default, { realpathSync } from 'fs';
+import fs5__default, { realpathSync, existsSync, readFileSync } from 'fs';
 import * as path from 'path';
-import path__default from 'path';
+import path__default, { join } from 'path';
 import { fileURLToPath } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
@@ -2367,7 +2367,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-AMQ7VEB5.js');
+    const { runBaseline } = await import('./baseline-AUC3HAXW.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -3193,11 +3193,11 @@ function estimateDriftScore(artifact, upgraded) {
   }
   return computeDriftScore(projects).score;
 }
-function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
+function pmCommandFor(ecosystem, pkg, version, pm = "npm", opts = {}) {
   switch (ecosystem) {
     case "npm":
-      if (pm === "pnpm") return { cmd: "pnpm", args: ["add", `${pkg}@${version}`] };
-      if (pm === "yarn") return { cmd: "yarn", args: ["add", `${pkg}@${version}`] };
+      if (pm === "pnpm") return { cmd: "pnpm", args: opts.workspaceRoot ? ["add", "-w", `${pkg}@${version}`] : ["add", `${pkg}@${version}`] };
+      if (pm === "yarn") return { cmd: "yarn", args: opts.workspaceRoot ? ["add", "-W", `${pkg}@${version}`] : ["add", `${pkg}@${version}`] };
       if (pm === "bun") return { cmd: "bun", args: ["add", `${pkg}@${version}`] };
       return { cmd: "npm", args: ["install", `${pkg}@${version}`] };
     case "pypi":
@@ -3224,19 +3224,37 @@ function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
 }
 function defaultRun(cmd, cwd) {
   const res = spawnSync(cmd.cmd, cmd.args, { cwd, stdio: "inherit", shell: false });
-  if (res.error) return { ok: false, detail: res.error.message };
+  if (res.error) {
+    if (res.error.code === "ENOENT") {
+      return { ok: false, toolMissing: true, detail: `${cmd.cmd} is not installed or not on PATH` };
+    }
+    return { ok: false, detail: res.error.message };
+  }
   if (res.status !== 0) return { ok: false, detail: `exit ${res.status ?? "signal"}` };
   return { ok: true };
 }
+function isWorkspaceRoot(dir) {
+  try {
+    if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+      if (pkg?.workspaces) return true;
+    }
+  } catch {
+  }
+  return false;
+}
 function applyPlan(rootDir, upgrades, opts = {}) {
   const run = opts.run ?? defaultRun;
+  const workspaceRoot = isWorkspaceRoot(rootDir);
   const results = [];
   for (const u of upgrades) {
     if (!u.to) {
       results.push({ package: u.package, to: u.to, status: "skipped", detail: "no target version" });
       continue;
     }
-    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager);
+    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot });
     if (!command) {
       results.push({ package: u.package, to: u.to, status: "manual", detail: `${u.ecosystem}: update the manifest to ${u.to} manually` });
       continue;
@@ -3249,8 +3267,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     results.push({
       package: u.package,
       to: u.to,
-      status: outcome.ok ? "applied" : "failed",
-      detail: outcome.detail
+      status: outcome.ok ? "applied" : outcome.toolMissing ? "manual" : "failed",
+      detail: outcome.toolMissing && outcome.detail ? `${outcome.detail} \u2014 upgrade manually` : outcome.detail
     });
   }
   return results;
@@ -3490,6 +3508,44 @@ function npmPackageManager(artifact) {
   }
   return "npm";
 }
+function toNpmPackageManager(pm) {
+  return pm === "pnpm" || pm === "yarn" || pm === "bun" ? pm : "npm";
+}
+function projectsDeclaring(rootDir, artifact, pkg, ecosystem) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const project of artifact.projects ?? []) {
+    if (ecosystemId(project.type) !== ecosystem) continue;
+    if (!(project.dependencies ?? []).some((d) => d.package === pkg)) continue;
+    const dir = path.resolve(rootDir, project.path && project.path !== "." ? project.path : ".");
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    out2.push({ dir, pm: toNpmPackageManager(project.packageManager) });
+  }
+  return out2;
+}
+function applyChosenPlan(rootDir, artifact, upgrades, opts) {
+  const fallbackPm = npmPackageManager(artifact);
+  const groups = /* @__PURE__ */ new Map();
+  for (const u of upgrades) {
+    let targets = projectsDeclaring(rootDir, artifact, u.package, u.ecosystem);
+    if (targets.length === 0) targets = [{ dir: rootDir, pm: fallbackPm }];
+    for (const t of targets) {
+      const group = groups.get(t.dir) ?? { dir: t.dir, pm: t.pm, upgrades: [] };
+      group.upgrades.push(u);
+      groups.set(t.dir, group);
+    }
+  }
+  const results = [];
+  for (const group of groups.values()) {
+    const applied = applyPlan(group.dir, group.upgrades, { dryRun: opts.dryRun, packageManager: group.pm });
+    const rel3 = path.relative(rootDir, group.dir) || ".";
+    for (const r of applied) {
+      results.push(rel3 === "." ? r : { ...r, detail: [r.detail, `in ${rel3}`].filter(Boolean).join(" \xB7 ") });
+    }
+  }
+  return results;
+}
 function promptPlanSelection(response) {
   const plans = response.plans.filter((p) => p.upgrades.length > 0);
   console.log(chalk7.bold("\nSelect a plan to apply:"));
@@ -3544,8 +3600,7 @@ async function runApplyFlow(rootDir, artifact, response, opts) {
     console.log(chalk7.dim("Selected plan has no upgrades."));
     return;
   }
-  const pm = npmPackageManager(artifact);
-  const results = applyPlan(rootDir, chosen.upgrades, { dryRun: opts.dryRun, packageManager: pm });
+  const results = applyChosenPlan(rootDir, artifact, chosen.upgrades, { dryRun: opts.dryRun });
   if (opts.dryRun) {
     console.log(chalk7.bold(`
 Dry run \u2014 ${chosen.label} plan (${chosen.upgrades.length} upgrade(s)):`));