@vibgrate/cli 2026.708.2 → 2026.709.1

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-AWEAREOE.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-MPKMAERO.js';
 import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-GHLYQZWT.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-ICBBG6U3.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-IRZCYPFC.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-PXZ5KPVN.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import * as fs5 from 'fs';
-import fs5__default, { realpathSync } from 'fs';
+import * as fs6 from 'fs';
+import fs6__default, { realpathSync } from 'fs';
 import * as path from 'path';
 import path__default from 'path';
 import { fileURLToPath } from 'url';
@@ -14,10 +14,10 @@ import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
 import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
-import chalk7 from 'chalk';
+import chalk8 from 'chalk';
 import * as os from 'os';
 import * as readline from 'readline';
-import * as fs14 from 'fs/promises';
+import * as fs15 from 'fs/promises';
 import semver from 'semver';
 
 var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
@@ -178,14 +178,14 @@ async function signGraphAttestation(root, graph, opts) {
   const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
   const keyPath = explicitKey ? path.resolve(explicitKey) : path.join(root, ".vibgrate", DEFAULT_KEY);
   let keyGeneratedAt;
-  if (!fs5.existsSync(keyPath)) {
+  if (!fs6.existsSync(keyPath)) {
     if (explicitKey) {
       throw new CliError(`signing key not found: ${explicitKey}`, ExitCode.USAGE_ERROR);
     }
     const kp = generateKeypair();
-    fs5.mkdirSync(path.dirname(keyPath), { recursive: true });
-    fs5.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs5.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs6.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs6.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs6.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     keyGeneratedAt = keyPath;
     notices.push(
       `minted a new Ed25519 signing key at ${rel(root, keyPath)} (keyid ${kp.keyid}) \u2014 keep it, add it to .gitignore, and reuse it to re-sign reproducibly`
@@ -193,7 +193,7 @@ async function signGraphAttestation(root, graph, opts) {
   }
   let privateKey;
   try {
-    privateKey = crypto.createPrivateKey(fs5.readFileSync(keyPath, "utf8"));
+    privateKey = crypto.createPrivateKey(fs6.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${rel(root, keyPath)}`, ExitCode.USAGE_ERROR);
   }
@@ -207,8 +207,8 @@ async function signGraphAttestation(root, graph, opts) {
   const statement = buildStatement(graph, { commit });
   const envelope = signStatement(statement, privateKey);
   const outPath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  fs5.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs5.writeFileSync(outPath, serializeEnvelope(envelope));
+  fs6.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs6.writeFileSync(outPath, serializeEnvelope(envelope));
   return {
     summary: {
       keyid: envelope.signatures[0]?.keyid ?? "",
@@ -223,7 +223,7 @@ async function signGraphAttestation(root, graph, opts) {
 }
 function verifyGraphAttestation(root, opts) {
   const bundlePath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  if (!fs5.existsSync(bundlePath)) {
+  if (!fs6.existsSync(bundlePath)) {
     if (opts.attestation || opts.pub) {
       throw new CliError(
         `no attestation at ${rel(root, bundlePath)} \u2014 sign one with \`vg build --attest\``,
@@ -232,8 +232,8 @@ function verifyGraphAttestation(root, opts) {
     }
     return { bundlePath, missing: true };
   }
-  const envelope = parseEnvelope(fs5.readFileSync(bundlePath, "utf8"));
-  const publicKeyPem = opts.pub ? fs5.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
+  const envelope = parseEnvelope(fs6.readFileSync(bundlePath, "utf8"));
+  const publicKeyPem = opts.pub ? fs6.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
   const graph = loadGraph(root) ?? void 0;
   return { bundlePath, missing: false, result: verifyEnvelope(envelope, { publicKeyPem, graph }) };
 }
@@ -274,9 +274,9 @@ function json(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
-var c = chalk7;
+var c = chalk8;
 function disableColor() {
-  chalk7.level = 0;
+  chalk8.level = 0;
 }
 
 // src/util/logo.ts
@@ -346,7 +346,7 @@ var ProgressBar = class {
 
 // src/cli-options.ts
 function applyGlobalOptions(cmd) {
-  return cmd.option("-C, --cwd <dir>", "run as if started in <dir>", ".").option("--deep", "do more: precise resolution, all edges, semantic links").option("--json", "machine-readable JSON on stdout").option("--generated-at <iso>", "pin the artifact timestamp for byte-deterministic output").option("--graph <file>", "override the map path").option("--no-cache", "full rebuild (ignore the incremental cache)").option("--local", "never touch the network (lexical-only semantic)").option("--quiet", "suppress progress output").option("--no-color", "disable colored output");
+  return cmd.option("-C, --cwd <dir>", "run as if started in <dir>", ".").option("--deep", "do more: precise resolution, all edges, semantic links").option("--json", "machine-readable JSON on stdout").option("--generated-at <iso>", "pin the artifact timestamp for byte-deterministic output").option("--graph <file>", "override the map path").option("--no-cache", "full rebuild (ignore the incremental cache)").option("--local", "never touch the network (lexical-only semantic)").option("--quiet", "suppress progress output").option("--client <name>", "identify the AI client (e.g. claude) so navigation calls are counted in vg savings").option("--no-color", "disable colored output");
 }
 function readGlobal(cmd) {
   const o = cmd.opts();
@@ -358,7 +358,8 @@ function readGlobal(cmd) {
     graph: o.graph,
     noCache: o.cache === false,
     local: o.local,
-    quiet: o.quiet
+    quiet: o.quiet,
+    client: o.client
   };
 }
 
@@ -583,8 +584,8 @@ function writeExport(graph, target) {
         ExitCode.USAGE_ERROR
       );
   }
-  fs5.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
-  fs5.writeFileSync(target, content);
+  fs6.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
+  fs6.writeFileSync(target, content);
 }
 function collect(value, prev) {
   return [...prev, value];
@@ -603,7 +604,7 @@ async function runStatus(global) {
   const root = path.resolve(global.cwd ?? ".");
   const graphPath = global.graph ?? defaultGraphPath(root);
   const graph = loadGraph(root, graphPath);
-  const hasCache = fs5.existsSync(path.join(cacheDir(root), "parse-cache.json"));
+  const hasCache = fs6.existsSync(path.join(cacheDir(root), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -716,6 +717,20 @@ function registerAsk(program) {
       result = queryGraph(graph, q, { budget });
       if (global.local) note = "semantic skipped under --local; used lexical";
     }
+    if (global.client) {
+      const files = new Set(result.matches.map((m) => m.node.file).filter(Boolean));
+      recordCliCall(
+        root,
+        {
+          tool: CLI_TOOL_ALIASES.ask,
+          client: global.client,
+          outcome: result.matches.length === 0 ? "miss" : "complete",
+          vgTokens: result.tokensEstimate,
+          baselineFiles: files.size
+        },
+        Date.now()
+      );
+    }
     if (global.json) {
       json({
         question: result.question,
@@ -845,12 +860,28 @@ function registerShow(program) {
       }
       throw ambiguityError(`"${name}" is ambiguous`, candidates);
     }
-    const index = new GraphIndex(graph);
+    const index = indexFor(graph);
     const callees = dedupe(index.callees(node.id).map((x) => x.node));
     const callers = dedupe(index.callers(node.id).map((x) => x.node));
     const extendsEdges = index.out(node.id, "extends").concat(index.out(node.id, "implements"));
     const supertypes = extendsEdges.map((e) => index.node(e.dst)?.qualifiedName).filter(Boolean);
     const area = graph.areas.find((a) => a.id === node.area);
+    if (global.client) {
+      const files = /* @__PURE__ */ new Set([node.file]);
+      for (const n of [...callees, ...callers]) if (n.file) files.add(n.file);
+      const shown = node.qualifiedName + (node.signature ?? "") + callees.map((n) => n.qualifiedName).join("") + callers.map((n) => n.qualifiedName).join("");
+      recordCliCall(
+        rootOf(global),
+        {
+          tool: CLI_TOOL_ALIASES.show,
+          client: global.client,
+          outcome: "complete",
+          vgTokens: countTokens(shown),
+          baselineFiles: files.size
+        },
+        Date.now()
+      );
+    }
     if (global.json) {
       json({
         id: node.id,
@@ -904,6 +935,13 @@ function registerPath(program) {
     const rb = resolveOne(graph, b, opts.pickB ? Number(opts.pickB) : void 0);
     if (!rb.node) throw ambiguityError(`"${b}" ${rb.candidates.length ? "is ambiguous" : "not found"}`, rb.candidates, "--pick-b");
     const result = shortestPath(graph, ra.node.id, rb.node.id);
+    if (global.client) {
+      recordCliCall(
+        rootOf(global),
+        { tool: CLI_TOOL_ALIASES.path, client: global.client, outcome: result ? "complete" : "miss" },
+        Date.now()
+      );
+    }
     if (!result) {
       throw new CliError(
         `no path between ${ra.node.qualifiedName} and ${rb.node.qualifiedName}`,
@@ -929,9 +967,16 @@ function registerTree(program) {
     const { graph } = requireGraph(global);
     const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
     if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
-    const index = new GraphIndex(graph);
+    const index = indexFor(graph);
     const maxDepth = Math.max(1, Number(opts.depth) || 3);
     const direction = opts.callers ? "callers" : "callees";
+    if (global.client) {
+      recordCliCall(
+        rootOf(global),
+        { tool: CLI_TOOL_ALIASES.tree, client: global.client, outcome: "complete" },
+        Date.now()
+      );
+    }
     if (global.json) {
       json(toJsonTree(index, node, direction, maxDepth, /* @__PURE__ */ new Set()));
       return;
@@ -1091,6 +1136,13 @@ function registerImpact(program) {
     if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
     const depth = Number(opts.depth) || 4;
     const result = impactOf(graph, node.id, { depth });
+    if (global.client) {
+      recordCliCall(
+        rootOf(global),
+        { tool: CLI_TOOL_ALIASES.impact, client: global.client, outcome: "complete" },
+        Date.now()
+      );
+    }
     const withTests = opts.tests || opts.failOnUntested;
     const ti = withTests ? testsToRun(graph, node.id, depth) : void 0;
     const runner = ti ? detectRunner(rootOf(global), node.lang) : void 0;
@@ -1230,24 +1282,214 @@ function fmtRef(r) {
 function pad2(s, n) {
   return s.padStart(n, " ");
 }
+var SCHEMA_VERSION = "1";
+var OFFSET_FILE = "stats-share.json";
+var INSTALL_ID_DIR = path.join(os.homedir(), ".vibgrate");
+var INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, "install-id");
+var SEND_TIMEOUT_MS = 4e3;
+function installId() {
+  try {
+    const existing = fs6.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    if (isUuid(existing)) return existing;
+  } catch {
+  }
+  const id = randomUuid();
+  try {
+    fs6.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs6.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+  } catch {
+  }
+  return id;
+}
+function isUuid(s) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);
+}
+function randomUuid() {
+  return randomUUID();
+}
+function statsEndpoint() {
+  const override = process.env.VIBGRATE_STATS_ENDPOINT;
+  if (override && /^https?:\/\//.test(override)) return override;
+  return `https://${resolveIngestHost()}/v1/ingest/cli-mcp-usage`;
+}
+function offsetPath(root) {
+  return path.join(cacheDir(root), OFFSET_FILE);
+}
+function ledgerFilePath(root) {
+  return path.join(cacheDir(root), "savings.jsonl");
+}
+function readOffset(root) {
+  try {
+    const raw = JSON.parse(fs6.readFileSync(offsetPath(root), "utf8"));
+    return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
+  } catch {
+    return 0;
+  }
+}
+function writeOffset(root, offset) {
+  try {
+    fs6.mkdirSync(cacheDir(root), { recursive: true });
+    fs6.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + "\n");
+  } catch {
+  }
+}
+function buildBatch(root, fromOffset, id = installId()) {
+  const file = ledgerFilePath(root);
+  let size = 0;
+  try {
+    size = fs6.statSync(file).size;
+  } catch {
+    return { batch: null, newOffset: 0 };
+  }
+  const start = fromOffset > size ? 0 : fromOffset;
+  if (start >= size) return { batch: null, newOffset: size };
+  let text = "";
+  try {
+    const fd = fs6.openSync(file, "r");
+    try {
+      const buf = Buffer.alloc(size - start);
+      fs6.readSync(fd, buf, 0, buf.length, start);
+      text = buf.toString("utf8");
+    } finally {
+      fs6.closeSync(fd);
+    }
+  } catch {
+    return { batch: null, newOffset: fromOffset };
+  }
+  const lastNl = text.lastIndexOf("\n");
+  if (lastNl < 0) return { batch: null, newOffset: start };
+  const consumed = start + lastNl + 1;
+  const rows = /* @__PURE__ */ new Map();
+  let total = 0;
+  let minTs = Infinity;
+  let maxTs = -Infinity;
+  for (const line of text.slice(0, lastNl).split("\n")) {
+    if (!line.trim()) continue;
+    let e;
+    try {
+      e = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const source = e.source ?? "mcp";
+    const client = e.client ?? "unknown";
+    const outcome = e.outcome ?? "complete";
+    const key = `${source}|${client}|${e.tool}|${outcome}`;
+    const row = rows.get(key) ?? {
+      source,
+      client,
+      tool: e.tool,
+      outcome,
+      calls: 0,
+      vgTokens: 0,
+      baselineTokens: 0
+    };
+    row.calls++;
+    row.vgTokens += e.vgTokens ?? 0;
+    row.baselineTokens += e.baselineTokens ?? 0;
+    rows.set(key, row);
+    total++;
+    if (typeof e.ts === "number") {
+      if (e.ts < minTs) minTs = e.ts;
+      if (e.ts > maxTs) maxTs = e.ts;
+    }
+  }
+  if (total === 0 || !Number.isFinite(minTs)) return { batch: null, newOffset: consumed };
+  const batch = {
+    schemaVersion: SCHEMA_VERSION,
+    installId: id,
+    vgVersion: VERSION,
+    os: process.platform,
+    arch: process.arch,
+    windowStart: new Date(minTs).toISOString(),
+    windowEnd: new Date(maxTs).toISOString(),
+    totalCalls: total,
+    rows: [...rows.values()]
+  };
+  return { batch, newOffset: consumed };
+}
+async function postBatch(batch) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);
+  timer.unref?.();
+  try {
+    const res = await fetch(statsEndpoint(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Connection: "close" },
+      body: JSON.stringify(batch),
+      signal: controller.signal
+    });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var StatsSharer = class {
+  constructor(root) {
+    this.root = root;
+    this.offset = readOffset(root);
+  }
+  root;
+  id = installId();
+  offset;
+  flushing = false;
+  /**
+   * Flush any new ledger entries. Single-flight (a slow POST won't overlap the
+   * next tick). Best-effort: any failure is swallowed and retried next time.
+   */
+  async flush() {
+    if (this.flushing) return;
+    this.flushing = true;
+    try {
+      const { batch, newOffset } = buildBatch(this.root, this.offset, this.id);
+      if (!batch) {
+        if (newOffset > this.offset) {
+          this.offset = newOffset;
+          writeOffset(this.root, newOffset);
+        }
+        return;
+      }
+      const ok = await postBatch(batch);
+      if (ok) {
+        this.offset = newOffset;
+        writeOffset(this.root, newOffset);
+      }
+    } catch {
+    } finally {
+      this.flushing = false;
+    }
+  }
+};
+
+// src/commands/serve.ts
+var SHARE_FLUSH_INTERVAL_MS = 5 * 60 * 1e3;
 function registerServe(program) {
-  const cmd = program.command("serve").description("start Vibgrate AI Context \u2014 local-first MCP serving your code map, drift & version-correct docs to your AI").option("--http", "serve over streamable HTTP instead of stdio").option("--port <n>", "port for --http", "7437").option("--host <h>", "host for --http", "127.0.0.1").option("--savings", "record local, counts-only usage savings (opt-in; off by default)").option("--dedup", "collapse a node's heavy relation lists on repeat reads within a session (opt-in; saves tokens)").option("--no-refresh", "serve the map as built \u2014 skip the auto-rebuild when files change").action(async function(opts) {
+  const cmd = program.command("serve").description("start Vibgrate AI Context \u2014 local-first MCP serving your code map, drift & version-correct docs to your AI").option("--http", "serve over streamable HTTP instead of stdio").option("--port <n>", "port for --http", "7437").option("--host <h>", "host for --http", "127.0.0.1").option("--savings", "record local, counts-only usage savings (opt-in; off by default)").option("--share-stats", "ALSO upload the counts-only usage ledger to Vibgrate to improve the local MCP (opt-in; off by default; implies --savings; disabled under --local)").option("--dedup", "collapse a node's heavy relation lists on repeat reads within a session (opt-in; saves tokens)").option("--no-refresh", "serve the map as built \u2014 skip the auto-rebuild when files change").action(async function(opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
     const graphPath = global.graph ?? defaultGraphPath(root);
     const refresh = opts.refresh !== false && !global.graph;
+    const local = global.local === true;
+    const shareStats = opts.shareStats === true && !local;
     const serveOpts = {
-      savings: opts.savings === true,
-      local: global.local === true,
+      savings: opts.savings === true || shareStats,
+      shareStats,
+      local,
       dedup: opts.dedup === true,
       refresh
     };
-    if (!fs5.existsSync(graphPath)) {
+    if (!fs6.existsSync(graphPath)) {
       throw new CliError(
         `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
         ExitCode.NOT_FOUND
       );
     }
+    if (opts.shareStats === true && local) {
+      info(c.dim("vg \xB7 --share-stats ignored under --local (air-gapped): recording locally, not uploading."));
+    }
+    if (shareStats) startSharing(root);
     const freshness = refresh ? "auto-refresh" : "as built";
     if (opts.http) {
       await serveHttp(graphPath, opts.host ?? "127.0.0.1", Number(opts.port) || 7437, serveOpts, freshness);
@@ -1258,6 +1500,31 @@ function registerServe(program) {
   });
   applyGlobalOptions(cmd);
 }
+function startSharing(root) {
+  const sharer = new StatsSharer(root);
+  info(
+    c.dim(
+      `vg \xB7 sharing counts-only usage stats with Vibgrate (${statsEndpoint()}) to improve the local MCP. No code, paths, or questions are sent. Stop by omitting --share-stats.`
+    )
+  );
+  const timer = setInterval(() => void sharer.flush(), SHARE_FLUSH_INTERVAL_MS);
+  timer.unref?.();
+  let flushed = false;
+  const finalFlush = () => {
+    if (flushed) return;
+    flushed = true;
+    void sharer.flush();
+  };
+  process.once("SIGINT", () => {
+    finalFlush();
+    process.exit(0);
+  });
+  process.once("SIGTERM", () => {
+    finalFlush();
+    process.exit(0);
+  });
+  process.once("beforeExit", finalFlush);
+}
 async function serveHttp(graphPath, host, port, opts, freshness) {
   const { createServer: createHttp } = await import('http');
   const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
@@ -1361,7 +1628,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root = rootOf(global);
     const gitDir = path.join(root, ".git");
-    if (!fs5.existsSync(gitDir)) {
+    if (!fs6.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -1383,22 +1650,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root, reports) {
   const dir = path.join(root, ".vibgrate");
-  fs5.mkdirSync(dir, { recursive: true });
+  fs6.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs5.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs6.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root) {
   const file = path.join(root, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "";
+  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs5.writeFileSync(file, content);
+    fs6.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root) {
@@ -1407,7 +1674,7 @@ function configureMergeDriver(root) {
 }
 function installPreCommitHook(root) {
   const hooksDir = hookDir(root);
-  fs5.mkdirSync(hooksDir, { recursive: true });
+  fs6.mkdirSync(hooksDir, { recursive: true });
   const file = path.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -1417,7 +1684,7 @@ function installPreCommitHook(root) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -1426,21 +1693,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs5.writeFileSync(file, content);
-  fs5.chmodSync(file, 493);
+  fs6.writeFileSync(file, content);
+  fs6.chmodSync(file, 493);
 }
 function undo(root) {
   const hookFile = path.join(hookDir(root), "pre-commit");
-  if (fs5.existsSync(hookFile)) {
+  if (fs6.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs5.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs5.rmSync(hookFile);
-    else fs5.writeFileSync(hookFile, next2);
+    const next2 = fs6.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs6.rmSync(hookFile);
+    else fs6.writeFileSync(hookFile, next2);
   }
   const attr = path.join(root, ".gitattributes");
-  if (fs5.existsSync(attr)) {
-    const next2 = fs5.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs5.writeFileSync(attr, next2);
+  if (fs6.existsSync(attr)) {
+    const next2 = fs6.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs6.writeFileSync(attr, next2);
   }
   try {
     git(root, ["config", "--remove-section", "merge.vg"]);
@@ -1573,7 +1840,7 @@ function grepBaselineTokens(term, files) {
     if (f.size > 512 * 1024) continue;
     let content = "";
     try {
-      content = fs5.readFileSync(f.abs, "utf8");
+      content = fs6.readFileSync(f.abs, "utf8");
     } catch {
       continue;
     }
@@ -1583,7 +1850,7 @@ function grepBaselineTokens(term, files) {
 }
 function safeSize(abs) {
   try {
-    return fs5.statSync(abs).size;
+    return fs6.statSync(abs).size;
   } catch {
     return 0;
   }
@@ -1917,7 +2184,7 @@ function loadStandards(root) {
     const p = path__default.join(root, rel3);
     let text;
     try {
-      text = fs5__default.readFileSync(p, "utf8");
+      text = fs6__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -2046,7 +2313,7 @@ function registerSavings(program) {
     if (usage.totals.calls === 0) {
       info(
         c.dim(
-          report.enabled ? "  no calls recorded yet in this window" : "  recording is off. Enable with `vg serve --savings`, then query via MCP."
+          report.enabled ? "  no calls recorded yet in this window" : "  recording is off. Enable it for MCP with `vg serve --savings`, and for CLI calls by passing `--client=<ai>` to vg."
         )
       );
       return;
@@ -2057,6 +2324,7 @@ function registerSavings(program) {
       info(c.dim("  estimates with stated assumptions (~4 chars/token; ~400 tokens/file baseline); scales with repo size."));
     }
     printBreakdown(usage);
+    printSplit(usage);
   });
   applyGlobalOptions(cmd);
 }
@@ -2083,6 +2351,24 @@ function printBreakdown(usage) {
   );
   info(c.dim(`    avg success across commands: ${usage.avgSuccessPct}%`));
 }
+function printSplit(usage) {
+  const label = (key) => key === "mcp" ? "MCP tools" : key === "cli" ? "vg CLI" : key;
+  if (usage.sources.length) {
+    info("");
+    info(c.bold("  by source") + c.dim("  (how the call arrived)"));
+    for (const s of usage.sources) {
+      const pct = usage.totals.calls ? Math.round(s.calls / usage.totals.calls * 100) : 0;
+      info(`    ${label(s.key).padEnd(12)} ${String(s.calls).padStart(6)} calls ${c.dim(`(${pct}%)`)}`);
+    }
+  }
+  if (usage.clients.length) {
+    info("");
+    info(c.bold("  by client") + c.dim("  (which AI is calling; pass --client to vg to attribute CLI calls)"));
+    for (const cl of usage.clients) {
+      info(`    ${cl.key.padEnd(12)} ${String(cl.calls).padStart(6)} calls`);
+    }
+  }
+}
 function registerLib(program) {
   const cmd = program.command("lib").description("library currency: version-correct, drift-annotated usage docs").argument("[args...]", "a library name, or: add <source> | publish <name> | resolve <name> | refresh").option("--name <name>", "library name for `add`").option("--version <v>", "pin the doc version for `add`/`publish`").option("--online", "(deprecated; network is on by default) allow network for add/refresh URL sources").option("-b, --budget <n>", "trim docs to ~N tokens").option("--readme <path>", "README path for `publish` (default ./README.md)").option("--dts <path>", "TypeScript declaration (.d.ts) path for `publish`").option("--language <lang>", "primary language for `publish`").option("--region <region>", "data-residency region for the hosted catalog (same as scans; default us)").option("--ingest <url>", "hosted catalog/ingest URL override (host extracted; wins over --region)").action(async function(args, opts) {
     const global = readGlobal(this);
@@ -2136,7 +2422,7 @@ async function addCmd(root, rest, opts, asJson) {
 }
 function readPackageVersion(root) {
   try {
-    const pkg = JSON.parse(fs5__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs6__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -2144,7 +2430,7 @@ function readPackageVersion(root) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs5__default.readFileSync(p, "utf8");
+    const t = fs6__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -2289,8 +2575,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs5.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
-    fs5.writeFileSync(file, content);
+    fs6.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+    fs6.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -2313,24 +2599,24 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs5.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
+    fs6.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs5.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
+      fs6.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = global.graph ?? defaultGraphPath(root);
-    if (fs5.existsSync(graphSrc)) {
-      fs5.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
+    if (fs6.existsSync(graphSrc)) {
+      fs6.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
       included.push("graph.json");
     }
     const cat = catalogPath(root);
-    if (fs5.existsSync(cat)) {
-      fs5.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
+    if (fs6.existsSync(cat)) {
+      fs6.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs5.existsSync(libDir(root))) {
-        fs5.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
+      if (fs6.existsSync(libDir(root))) {
+        fs6.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -2342,7 +2628,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs5.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs6.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path.relative(root, outDir), ...manifest });
@@ -2358,22 +2644,22 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
   const rootDir = path.resolve(targetPath);
   const vibgrateDir2 = path.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
-  console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
+  console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold(".vibgrate/")} directory`);
   const configPath = path.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
-    console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
+    console.log(chalk8.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
     await writeDefaultConfig(rootDir);
-    console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
+    console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-AMQ7VEB5.js');
+    const { runBaseline } = await import('./baseline-7AFTGG3I.js');
     await runBaseline(rootDir);
   }
   console.log("");
-  console.log(chalk7.bold("Next steps:"));
-  console.log(`  ${chalk7.cyan("vibgrate scan")}            Scan for upgrade drift`);
-  console.log(`  ${chalk7.cyan("vibgrate baseline")}        Create a drift baseline`);
+  console.log(chalk8.bold("Next steps:"));
+  console.log(`  ${chalk8.cyan("vibgrate scan")}            Scan for upgrade drift`);
+  console.log(`  ${chalk8.cyan("vibgrate baseline")}        Create a drift baseline`);
   console.log("");
 });
 
@@ -2408,22 +2694,22 @@ async function detectAiAssistant(rootDir) {
   return null;
 }
 function printAiContextPrompt(detectedAssistant) {
-  const teal2 = chalk7.hex("#3FB0A4");
-  const mint2 = chalk7.hex("#4FE3C1");
+  const teal2 = chalk8.hex("#3FB0A4");
+  const mint2 = chalk8.hex("#4FE3C1");
   const cli = resolveCliInvocation();
   const installArgs = detectedAssistant ? `install ${detectedAssistant}` : "install --all";
   const installCmd = `${cli} ${installArgs}`;
-  const detectedNote = detectedAssistant ? chalk7.dim(`  (${detectedAssistant} config detected)`) : "";
+  const detectedNote = detectedAssistant ? chalk8.dim(`  (${detectedAssistant} config detected)`) : "";
   console.log("");
   console.log(teal2("  \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-  console.log(teal2("  \u2502") + "  " + mint2("\u25C6") + "  " + chalk7.bold.white("Get AI-aware answers in your editor") + "          " + teal2("\u2502"));
+  console.log(teal2("  \u2502") + "  " + mint2("\u25C6") + "  " + chalk8.bold.white("Get AI-aware answers in your editor") + "          " + teal2("\u2502"));
   console.log(teal2("  \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   console.log("");
-  console.log("  " + chalk7.bold.white(installCmd) + detectedNote);
+  console.log("  " + chalk8.bold.white(installCmd) + detectedNote);
   console.log("");
-  console.log("  " + teal2("\xB7") + " " + chalk7.white("Code map in your assistant") + chalk7.dim(" \u2014 call trees, impact surfaces, import paths"));
-  console.log("  " + teal2("\xB7") + " " + chalk7.white("Offline drift") + chalk7.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor"));
-  console.log("  " + teal2("\xB7") + " " + chalk7.white("Version-correct library docs") + chalk7.dim(" \u2014 pinned to your lockfile, no hallucinated APIs"));
+  console.log("  " + teal2("\xB7") + " " + chalk8.white("Code map in your assistant") + chalk8.dim(" \u2014 call trees, impact surfaces, import paths"));
+  console.log("  " + teal2("\xB7") + " " + chalk8.white("Offline drift") + chalk8.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor"));
+  console.log("  " + teal2("\xB7") + " " + chalk8.white("Version-correct library docs") + chalk8.dim(" \u2014 pinned to your lockfile, no hallucinated APIs"));
   console.log("");
 }
 
@@ -2434,14 +2720,14 @@ function shouldBuildCodeMap(opts) {
 async function autoPush(artifact, rootDir, opts) {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk7.red("No DSN provided for push."));
-    console.error(chalk7.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
+    console.error(chalk8.red("No DSN provided for push."));
+    console.error(chalk8.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn(dsn);
   if (!parsed) {
-    console.error(chalk7.red("Invalid DSN format."));
+    console.error(chalk8.red("Invalid DSN format."));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -2452,7 +2738,7 @@ async function autoPush(artifact, rootDir, opts) {
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk8.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
@@ -2460,7 +2746,7 @@ async function autoPush(artifact, rootDir, opts) {
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk7.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk8.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
     const { response, host: uploadedHost } = await uploadScanArtifact({
       scheme: parsed.scheme,
@@ -2480,36 +2766,36 @@ async function autoPush(artifact, rootDir, opts) {
     const result = await response.json();
     if (result.unchanged) {
       console.log(
-        chalk7.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
+        chalk8.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
       );
       if (result.previousIngestId) {
         emitIngestIdLine(result.previousIngestId, { unchanged: true });
         const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.previousIngestId}`;
-        console.log(chalk7.dim(`  Previous report: ${dashUrl}`));
+        console.log(chalk8.dim(`  Previous report: ${dashUrl}`));
       } else if (opts.strict) {
-        console.error(chalk7.red("Repository unchanged but no previous ingest id returned."));
+        console.error(chalk8.red("Repository unchanged but no previous ingest id returned."));
         process.exit(1);
       }
       return;
     }
-    console.log(chalk7.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk8.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     if (result.ingestId) {
       emitIngestIdLine(result.ingestId);
       const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.ingestId}`;
       const CLEAR_LINE = process.platform === "win32" ? "\x1B[0G\x1B[2K" : "";
       console.log("");
-      console.log(CLEAR_LINE + chalk7.dim("  Processing continues in the background. Results available shortly."));
+      console.log(CLEAR_LINE + chalk8.dim("  Processing continues in the background. Results available shortly."));
       console.log("");
-      console.log(CLEAR_LINE + chalk7.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log(CLEAR_LINE + chalk7.bold("  \u{1F4CA} View Scan Report"));
-      console.log(CLEAR_LINE + "  " + chalk7.underline.cyan(dashUrl));
-      console.log(CLEAR_LINE + chalk7.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk8.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk8.bold("  \u{1F4CA} View Scan Report"));
+      console.log(CLEAR_LINE + "  " + chalk8.underline.cyan(dashUrl));
+      console.log(CLEAR_LINE + chalk8.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       console.log("");
       console.log("");
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk7.red(`Upload failed: ${msg}`));
+    console.error(chalk8.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 }
@@ -2521,15 +2807,15 @@ function reportStandards(rootDir) {
   if (!loaded.policy) return;
   const violations = checkStandards(loaded.policy, inventory(rootDir).records);
   if (violations.length === 0) {
-    console.log(chalk7.green("\u2714") + " Standards: no banned dependencies in use");
+    console.log(chalk8.green("\u2714") + " Standards: no banned dependencies in use");
     return;
   }
-  console.log(chalk7.red(`
+  console.log(chalk8.red(`
 \u26A0 Standards: ${violations.length} banned dependency(ies) in use`));
   for (const v of violations) {
-    const fix = v.use ? chalk7.dim(` \u2192 use ${v.use}`) : "";
-    const why = v.reason ? chalk7.dim(` (${v.reason})`) : "";
-    console.log(`  ${chalk7.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk7.dim(` ${v.installed}`) : ""}${fix}${why}`);
+    const fix = v.use ? chalk8.dim(` \u2192 use ${v.use}`) : "";
+    const why = v.reason ? chalk8.dim(` (${v.reason})`) : "";
+    console.log(`  ${chalk8.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk8.dim(` ${v.installed}`) : ""}${fix}${why}`);
   }
 }
 function parseNonNegativeNumber(value, label) {
@@ -2548,7 +2834,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
-    console.error(chalk7.red(`Path does not exist: ${rootDir}`));
+    console.error(chalk8.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
   const hasDsn = !!resolveDsn(opts.dsn);
@@ -2575,9 +2861,9 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
         planTier = preflight.plan?.tier;
         upgradeUrl = preflight.upgradeUrl ?? `https://${dashHostForIngestHost(preflight.ingestHost ?? ingestHost)}/${parsed.workspaceId}`;
         if (preflight.vm && !preflight.vm.allowed) {
-          console.error(chalk7.red(preflight.error ?? "VM meter usage exhausted"));
+          console.error(chalk8.red(preflight.error ?? "VM meter usage exhausted"));
           console.error(
-            chalk7.dim(
+            chalk8.dim(
               `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
             )
           );
@@ -2585,25 +2871,25 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
         }
         if (preflight.repositories && !preflight.repositories.allowed) {
           console.error(
-            chalk7.red(
+            chalk8.red(
               preflight.error ?? `Repository limit reached for the ${preflight.plan.label} plan \u2014 cannot scan a new repository.`
             )
           );
           const max = preflight.repositories.max < 0 ? "unlimited" : String(preflight.repositories.max);
           console.error(
-            chalk7.dim(
+            chalk8.dim(
               `Repositories: ${preflight.repositories.total}/${max} (${preflight.plan.label} plan) \u2014 archive a repository or upgrade your plan.`
             )
           );
           if (preflight.upgradeUrl) {
-            console.error(chalk7.dim(`  Upgrade: ${preflight.upgradeUrl}`));
+            console.error(chalk8.dim(`  Upgrade: ${preflight.upgradeUrl}`));
           }
           process.exit(1);
         }
         if (preflight.status === "error" || !preflight.scans.allowed) {
-          console.error(chalk7.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
+          console.error(chalk8.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
           console.error(
-            chalk7.dim(
+            chalk8.dim(
               `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
             )
           );
@@ -2611,27 +2897,27 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
           process.exit(1);
         }
         console.log(
-          chalk7.dim(
+          chalk8.dim(
             `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
           )
         );
         if (preflight.repository?.unchanged && !opts.force) {
           console.log(
-            chalk7.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+            chalk8.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
           );
           if (preflight.repository.lastIngestId) {
             emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
             const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
-            console.log(chalk7.dim(`  Latest report: ${dashUrl}`));
+            console.log(chalk8.dim(`  Latest report: ${dashUrl}`));
           } else if (opts.strict) {
-            console.error(chalk7.red("Repository unchanged but no previous ingest id available."));
+            console.error(chalk8.red("Repository unchanged but no previous ingest id available."));
             process.exit(1);
           }
           return;
         }
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.error(chalk7.yellow(`Preflight check failed: ${msg}`));
+        console.error(chalk8.yellow(`Preflight check failed: ${msg}`));
         if (opts.strict) process.exit(1);
       }
     }
@@ -2705,24 +2991,24 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     const hasErrors = artifact.findings.some((f) => f.level === "error");
     const hasWarnings = artifact.findings.some((f) => f.level === "warning");
     if (opts.failOn === "error" && hasErrors) {
-      console.error(chalk7.red(`
+      console.error(chalk8.red(`
 Failing: ${artifact.findings.filter((f) => f.level === "error").length} error finding(s) detected.`));
       process.exit(2);
     }
     if (opts.failOn === "warn" && (hasErrors || hasWarnings)) {
-      console.error(chalk7.red(`
+      console.error(chalk8.red(`
 Failing: findings detected at warn level or above.`));
       process.exit(2);
     }
   }
   if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
-    console.error(chalk7.red(`
+    console.error(chalk8.red(`
 Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
     process.exit(2);
   }
   if (scanOpts.driftWorseningPercent !== void 0) {
     if (artifact.delta === void 0) {
-      console.error(chalk7.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
+      console.error(chalk8.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
       process.exit(2);
     }
     if (artifact.delta > 0) {
@@ -2730,7 +3016,7 @@ Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget
       const denominator = Math.max(Math.abs(baselineScore), 1e-4);
       const worseningPercent = artifact.delta / denominator * 100;
       if (worseningPercent > scanOpts.driftWorseningPercent) {
-        console.error(chalk7.red(`
+        console.error(chalk8.red(`
 Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (threshold ${scanOpts.driftWorseningPercent}%).`));
         process.exit(2);
       }
@@ -2808,7 +3094,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs5.statSync(artifactPath).mtimeMs;
+    ref = fs6.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -2820,7 +3106,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs5.readdirSync(dir, { withFileTypes: true });
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -2835,7 +3121,7 @@ function scanStaleness(rootDir, artifactPath) {
       const abs = path.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs5.statSync(abs).mtimeMs;
+        mtimeMs = fs6.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -2969,7 +3255,7 @@ function analyzeTree(root, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs5.readdirSync(dir, { withFileTypes: true });
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -2987,8 +3273,8 @@ function analyzeTree(root, packages) {
       const full = path.join(dir, entry.name);
       let content;
       try {
-        if (fs5.statSync(full).size > MAX_FILE_BYTES) continue;
-        content = fs5.readFileSync(full, "utf8");
+        if (fs6.statSync(full).size > MAX_FILE_BYTES) continue;
+        content = fs6.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -3061,48 +3347,48 @@ function deltaSummary(delta) {
   return parts.length ? parts.join(", ") : `${delta.total}`;
 }
 function riskLabel(score) {
-  if (score <= 15) return chalk7.green(`${score}/100 low`);
-  if (score <= 40) return chalk7.yellow(`${score}/100 moderate`);
-  return chalk7.red(`${score}/100 high`);
+  if (score <= 15) return chalk8.green(`${score}/100 low`);
+  if (score <= 40) return chalk8.yellow(`${score}/100 moderate`);
+  return chalk8.red(`${score}/100 high`);
 }
 function planBlock(plan, recommended) {
   const lines = [];
-  const marker = recommended ? chalk7.green("\u25CF recommended") : chalk7.dim("\u25CB");
-  lines.push(`${marker} ${chalk7.bold(plan.label)} \u2014 ${chalk7.dim(plan.description)}`);
+  const marker = recommended ? chalk8.green("\u25CF recommended") : chalk8.dim("\u25CB");
+  lines.push(`${marker} ${chalk8.bold(plan.label)} \u2014 ${chalk8.dim(plan.description)}`);
   const drift = typeof plan.expectedDriftScore === "number" && typeof plan.driftDelta === "number" ? `  \xB7  DriftScore \u2192${plan.expectedDriftScore} (${plan.driftDelta <= 0 ? "" : "+"}${plan.driftDelta})` : "";
   lines.push(
     `    risk ${riskLabel(plan.riskScore)}  \xB7  ${plan.upgrades.length} upgrade(s)  \xB7  fixes ${deltaSummary(plan.fixes)}${drift}`
   );
   if (plan.introduces.total) {
-    lines.push(chalk7.red(`    \u26A0 introduces ${deltaSummary(plan.introduces)} advisory(ies) in target versions`));
+    lines.push(chalk8.red(`    \u26A0 introduces ${deltaSummary(plan.introduces)} advisory(ies) in target versions`));
   }
   const shown = plan.upgrades.slice(0, 12);
   for (const u of shown) {
-    const codemod = u.playbook?.codemod ? chalk7.magenta(`  [codemod: ${u.playbook.codemod}]`) : "";
-    lines.push(`      ${chalk7.cyan(u.package)} ${chalk7.dim(`${u.from ?? "?"} \u2192 ${u.to ?? "?"}`)}  ${chalk7.dim(u.reason)}${codemod}`);
+    const codemod = u.playbook?.codemod ? chalk8.magenta(`  [codemod: ${u.playbook.codemod}]`) : "";
+    lines.push(`      ${chalk8.cyan(u.package)} ${chalk8.dim(`${u.from ?? "?"} \u2192 ${u.to ?? "?"}`)}  ${chalk8.dim(u.reason)}${codemod}`);
   }
   if (plan.upgrades.length > shown.length) {
-    lines.push(chalk7.dim(`      \u2026 and ${plan.upgrades.length - shown.length} more`));
+    lines.push(chalk8.dim(`      \u2026 and ${plan.upgrades.length - shown.length} more`));
   }
   if (plan.upgrades.length === 0) {
-    lines.push(chalk7.dim("      (no upgrades in this plan)"));
+    lines.push(chalk8.dim("      (no upgrades in this plan)"));
   }
   return lines.join("\n");
 }
 function dataNote(report) {
   if (report.vulnerabilityData === "unavailable") {
-    return chalk7.dim("Advisory data was unavailable \u2014 vulnerability impact is not shown.");
+    return chalk8.dim("Advisory data was unavailable \u2014 vulnerability impact is not shown.");
   }
   if (report.vulnerabilityData === "partial") {
-    return chalk7.dim("Advisory data was partial \u2014 some ecosystems were not checked.");
+    return chalk8.dim("Advisory data was partial \u2014 some ecosystems were not checked.");
   }
   return null;
 }
 function renderText(report) {
   const out2 = [];
-  out2.push(chalk7.bold("Vibgrate fix \u2014 upgrade plan"));
+  out2.push(chalk8.bold("Vibgrate fix \u2014 upgrade plan"));
   out2.push(
-    chalk7.dim(
+    chalk8.dim(
       `${report.totalCandidates} drifted dependency(ies) analysed \xB7 ${report.deepAnalysis ? "deep (major) analysis on" : "preflight only"}`
     )
   );
@@ -3110,18 +3396,18 @@ function renderText(report) {
   if (note) out2.push(note);
   if (report.exploitability && report.exploitability.kevPackages > 0) {
     const epss = report.exploitability.maxEpss != null ? `, peak EPSS ${(report.exploitability.maxEpss * 100).toFixed(0)}%` : "";
-    out2.push(chalk7.red(`\u26A0 ${report.exploitability.kevPackages} package(s) carry a KNOWN-EXPLOITED (KEV) advisory${epss} \u2014 prioritise these.`));
+    out2.push(chalk8.red(`\u26A0 ${report.exploitability.kevPackages} package(s) carry a KNOWN-EXPLOITED (KEV) advisory${epss} \u2014 prioritise these.`));
   }
   out2.push("");
   for (const plan of report.plans) {
     out2.push(planBlock(plan, plan.tier === report.recommended));
     out2.push("");
   }
-  out2.push(chalk7.bold("Recommendation"));
-  out2.push(`  ${chalk7.green(report.plans.find((p) => p.tier === report.recommended)?.label ?? report.recommended)} \u2014 ${report.rationale}`);
+  out2.push(chalk8.bold("Recommendation"));
+  out2.push(`  ${chalk8.green(report.plans.find((p) => p.tier === report.recommended)?.label ?? report.recommended)} \u2014 ${report.rationale}`);
   if (report.unresolved.total) {
     out2.push("");
-    out2.push(chalk7.red(`\u26A0 ${deltaSummary(report.unresolved)} advisory(ies) have no upgrade path in any plan.`));
+    out2.push(chalk8.red(`\u26A0 ${deltaSummary(report.unresolved)} advisory(ies) have no upgrade path in any plan.`));
   }
   return out2.join("\n");
 }
@@ -3193,10 +3479,14 @@ function estimateDriftScore(artifact, upgraded) {
   }
   return computeDriftScore(projects).score;
 }
-function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
+function isRootDir(dir) {
+  return dir === "" || dir === ".";
+}
+function pmCommandFor(ecosystem, pkg, version, pm = "npm", opts = {}) {
+  const ws = opts.workspaceRoot && pm === "pnpm" ? ["-w"] : [];
   switch (ecosystem) {
     case "npm":
-      if (pm === "pnpm") return { cmd: "pnpm", args: ["add", `${pkg}@${version}`] };
+      if (pm === "pnpm") return { cmd: "pnpm", args: ["add", ...ws, `${pkg}@${version}`] };
       if (pm === "yarn") return { cmd: "yarn", args: ["add", `${pkg}@${version}`] };
       if (pm === "bun") return { cmd: "bun", args: ["add", `${pkg}@${version}`] };
       return { cmd: "npm", args: ["install", `${pkg}@${version}`] };
@@ -3224,37 +3514,241 @@ function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
 }
 function defaultRun(cmd, cwd) {
   const res = spawnSync(cmd.cmd, cmd.args, { cwd, stdio: "inherit", shell: false });
-  if (res.error) return { ok: false, detail: res.error.message };
+  if (res.error) {
+    if (res.error.code === "ENOENT") {
+      return { ok: false, toolMissing: true, detail: `${cmd.cmd} is not installed or not on PATH` };
+    }
+    return { ok: false, detail: res.error.message };
+  }
   if (res.status !== 0) return { ok: false, detail: `exit ${res.status ?? "signal"}` };
   return { ok: true };
 }
+var ROOT_TARGET = [{ dir: ".", isWorkspaceRoot: false }];
 function applyPlan(rootDir, upgrades, opts = {}) {
   const run = opts.run ?? defaultRun;
+  const resolveTargets = opts.resolveTargets ?? (() => ROOT_TARGET);
   const results = [];
   for (const u of upgrades) {
     if (!u.to) {
       results.push({ package: u.package, to: u.to, status: "skipped", detail: "no target version" });
       continue;
     }
-    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager);
-    if (!command) {
+    if (!pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager)) {
       results.push({ package: u.package, to: u.to, status: "manual", detail: `${u.ecosystem}: update the manifest to ${u.to} manually` });
       continue;
     }
+    const targets = resolveTargets(u);
+    const effective = targets.length > 0 ? targets : ROOT_TARGET;
+    const labelled = effective.length > 1;
+    const where = (t) => labelled || !isRootDir(t.dir) ? `${t.dir || "."}: ` : "";
     if (opts.dryRun) {
-      results.push({ package: u.package, to: u.to, status: "skipped", detail: `would run: ${command.cmd} ${command.args.join(" ")}` });
+      const detail = effective.map((t) => {
+        const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
+        return `would run: ${c2.cmd} ${c2.args.join(" ")}${labelled || !isRootDir(t.dir) ? ` (in ${t.dir || "."})` : ""}`;
+      }).join("; ");
+      results.push({ package: u.package, to: u.to, status: "skipped", detail });
       continue;
     }
-    const outcome = run(command, rootDir);
-    results.push({
-      package: u.package,
-      to: u.to,
-      status: outcome.ok ? "applied" : "failed",
-      detail: outcome.detail
+    const outcomes = effective.map((t) => {
+      const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
+      return { t, res: run(c2, path.join(rootDir, t.dir)) };
     });
+    const failures = outcomes.filter((o) => !o.res.ok);
+    if (failures.length === 0) {
+      results.push({
+        package: u.package,
+        to: u.to,
+        status: "applied",
+        detail: labelled ? `applied in ${effective.map((t) => t.dir || ".").join(", ")}` : void 0
+      });
+    } else if (failures.every((o) => o.res.toolMissing)) {
+      results.push({
+        package: u.package,
+        to: u.to,
+        status: "manual",
+        detail: failures.map((o) => `${where(o.t)}${o.res.detail ?? "tool missing"} \u2014 upgrade manually`).join("; ")
+      });
+    } else {
+      results.push({
+        package: u.package,
+        to: u.to,
+        status: "failed",
+        detail: failures.map((o) => `${where(o.t)}${o.res.detail ?? "failed"}`).join("; ")
+      });
+    }
   }
   return results;
 }
+var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
+var CACHE_DIR = path.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path.join(CACHE_DIR, "update-check.json");
+async function fetchLatestVersion() {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    timeout.unref?.();
+    let response;
+    try {
+      response = await fetch(REGISTRY_URL, {
+        headers: { Accept: "application/json" },
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!response.ok) return null;
+    const data = await response.json();
+    const latest = data.version;
+    if (!latest || !semver.valid(latest)) return null;
+    await writeCache({ latest, checkedAt: Date.now() });
+    return latest;
+  } catch {
+    return null;
+  }
+}
+async function writeCache(data) {
+  try {
+    await fs15.mkdir(CACHE_DIR, { recursive: true });
+    await fs15.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+  } catch {
+  }
+}
+
+// src/reporting/commands/update.ts
+function detectGlobalInstall() {
+  const execPath = process.argv[1] || "";
+  if (execPath.includes("/lib/node_modules/") || execPath.includes("\\node_modules\\")) {
+    if (!execPath.includes(process.cwd())) {
+      if (execPath.includes("pnpm")) return "pnpm";
+      if (execPath.includes("yarn")) return "yarn";
+      if (execPath.includes("bun")) return "bun";
+      return "npm";
+    }
+  }
+  return null;
+}
+function getGlobalUpdateCommand(pm, pkg, version) {
+  const spec = `${pkg}@${version}`;
+  switch (pm) {
+    case "pnpm":
+      return `pnpm add -g ${spec}`;
+    case "yarn":
+      return `yarn global add ${spec}`;
+    case "bun":
+      return `bun add -g ${spec}`;
+    case "npm":
+    default:
+      return `npm install -g ${spec}`;
+  }
+}
+async function detectPackageManager(cwd) {
+  if (await pathExists(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path.join(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+async function detectWorkspaceRoot(cwd) {
+  if (await pathExists(path.join(cwd, "pnpm-workspace.yaml"))) return true;
+  try {
+    const pkgPath = path.join(cwd, "package.json");
+    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return pkg.workspaces != null;
+  } catch {
+    return false;
+  }
+}
+function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
+  const spec = `${pkg}@${version}`;
+  const ws = opts.workspaceRoot && pm === "pnpm" ? " -w" : "";
+  switch (pm) {
+    case "pnpm":
+      return isDev ? `pnpm add${ws} -D ${spec}` : `pnpm add${ws} ${spec}`;
+    case "yarn":
+      return isDev ? `yarn add --dev ${spec}` : `yarn add ${spec}`;
+    case "bun":
+      return isDev ? `bun add -d ${spec}` : `bun add ${spec}`;
+    case "npm":
+    default:
+      return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
+  }
+}
+async function isDevDependency(cwd) {
+  try {
+    const pkgPath = path.join(cwd, "package.json");
+    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
+  } catch {
+    return true;
+  }
+}
+async function confirmWorkspaceRoot(pm) {
+  if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve16) => {
+    rl.question(chalk8.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
+      rl.close();
+      const t = ans.trim().toLowerCase();
+      resolve16(t === "y" || t === "yes");
+    });
+  });
+}
+var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").option("-y, --yes", "Skip confirmation prompts (e.g. installing at a workspace root)").option("-w, --workspace-root", "Allow updating the pnpm workspace root (implies --yes for that prompt)").action(
+  async (opts) => {
+    console.log(chalk8.dim(`Current version: ${VERSION}`));
+    console.log(chalk8.dim("Checking npm registry..."));
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+      console.error(chalk8.red("Could not reach the npm registry. Check your network connection."));
+      process.exit(1);
+    }
+    const semver2 = await import('semver');
+    if (!semver2.gt(latest, VERSION)) {
+      console.log(chalk8.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+      return;
+    }
+    console.log(chalk8.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+    if (opts.check) {
+      console.log(chalk8.dim('Run "vg update" to install.'));
+      return;
+    }
+    const cwd = process.cwd();
+    const globalPm = detectGlobalInstall();
+    const isGlobal = opts.global || globalPm !== null;
+    const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
+    let cmd;
+    if (isGlobal) {
+      cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
+      console.log(chalk8.dim(`Updating global installation with ${pm}: ${cmd}`));
+    } else {
+      const isDev = await isDevDependency(cwd);
+      let workspaceRoot = false;
+      if (pm === "pnpm" && await detectWorkspaceRoot(cwd)) {
+        console.log(
+          chalk8.yellow("Detected a pnpm workspace root.") + chalk8.dim(" Installing here needs the -w flag and updates the root package.json.")
+        );
+        const proceed = opts.yes || opts.workspaceRoot || await confirmWorkspaceRoot(pm);
+        if (!proceed) {
+          const rootCmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot: true });
+          console.log(chalk8.dim(`Skipped. To update the workspace root, run: ${rootCmd}`));
+          console.log(chalk8.dim('or re-run "vg update --yes" (or --workspace-root) to let vg do it.'));
+          return;
+        }
+        workspaceRoot = true;
+      }
+      cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot });
+      console.log(chalk8.dim(`Using ${pm}: ${cmd}`));
+    }
+    try {
+      execSync(cmd, { cwd, stdio: "inherit" });
+      console.log(chalk8.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+    } catch {
+      console.error(chalk8.red(`Update failed. Run manually: ${cmd}`));
+      process.exit(1);
+    }
+  }
+);
 
 // src/reporting/commands/fix.ts
 var SEVERITY_RANK = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
@@ -3305,12 +3799,12 @@ async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
       return readJsonFile(artifactPath);
     }
     console.error(
-      chalk7.dim(
+      chalk8.dim(
         `Scan is out of date (${staleness.newestChanged ?? "a dependency manifest"} changed since the last scan) \u2014 re-running a drift scan first (code map skipped)\u2026`
       )
     );
   } else {
-    console.error(chalk7.dim("No scan found \u2014 running a drift scan first (code map skipped)\u2026"));
+    console.error(chalk8.dim("No scan found \u2014 running a drift scan first (code map skipped)\u2026"));
   }
   return scan(rootDir);
 }
@@ -3327,20 +3821,20 @@ async function repositoryIdentity(rootDir, override) {
 var fixCommand = new Command("fix").description("Analyse drift and get ranked, risk-tiered upgrade plans from the hosted planner (requires login/DSN; read-only \u2014 never edits your project)").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists(rootDir)) {
-    console.error(chalk7.red(`Path does not exist: ${rootDir}`));
+    console.error(chalk8.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
   const failOn = opts.failOnVulns;
   if (failOn && !(failOn in SEVERITY_RANK)) {
-    console.error(chalk7.red(`Invalid --fail-on-vulns value '${opts.failOnVulns}'. Use one of: low, moderate, high, critical.`));
+    console.error(chalk8.red(`Invalid --fail-on-vulns value '${opts.failOnVulns}'. Use one of: low, moderate, high, critical.`));
     process.exit(1);
   }
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
     const cli = resolveCliInvocation();
-    console.error(chalk7.red("vg fix needs a Vibgrate login."));
+    console.error(chalk8.red("vg fix needs a Vibgrate login."));
     console.error(
-      chalk7.dim(
+      chalk8.dim(
         `Run "${cli} login" (or set VIBGRATE_DSN / pass --dsn) to analyse upgrades with the hosted planner. See https://vibgrate.com/cli for details.`
       )
     );
@@ -3348,21 +3842,21 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
   }
   const parsed = parseDsn(dsn);
   if (!parsed) {
-    console.error(chalk7.red('Invalid DSN format. Re-run "vg login" or check VIBGRATE_DSN.'));
+    console.error(chalk8.red('Invalid DSN format. Re-run "vg login" or check VIBGRATE_DSN.'));
     process.exit(1);
   }
   let host;
   try {
     host = opts.region ? resolveIngestHost(opts.region) : parsed.host;
   } catch (e) {
-    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    console.error(chalk8.red(e instanceof Error ? e.message : String(e)));
     process.exit(1);
   }
   let artifact;
   try {
     artifact = await loadArtifact(rootDir, opts.in);
   } catch (e) {
-    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    console.error(chalk8.red(e instanceof Error ? e.message : String(e)));
     process.exit(1);
   }
   const raw = collectCandidates(artifact);
@@ -3405,13 +3899,13 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
     response = await parseFixPlanResponse(httpResponse);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk7.red(`Could not reach the upgrade planner: ${msg}`));
-    console.error(chalk7.dim("Check your connection and try again, or see https://vibgrate.com/help."));
+    console.error(chalk8.red(`Could not reach the upgrade planner: ${msg}`));
+    console.error(chalk8.dim("Check your connection and try again, or see https://vibgrate.com/help."));
     process.exit(1);
   }
   if (response.status === "error") {
-    console.error(chalk7.red(response.error ?? "The planner returned an error."));
-    if (response.requestId) console.error(chalk7.dim(`  (ref ${response.requestId})`));
+    console.error(chalk8.red(response.error ?? "The planner returned an error."));
+    if (response.requestId) console.error(chalk8.dim(`  (ref ${response.requestId})`));
     process.exit(1);
   }
   const currentDrift = artifact.drift?.score;
@@ -3440,7 +3934,7 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
     }
     if (stillOpen > 0) {
       console.error(
-        chalk7.red(`
+        chalk8.red(`
 Failing: the recommended plan leaves ${stillOpen} advisory(ies) at/above ${failOn} unresolved.`)
       );
       process.exit(2);
@@ -3450,21 +3944,21 @@ Failing: the recommended plan leaves ${stillOpen} advisory(ies) at/above ${failO
 function handleHttpError(response, workspaceId, host) {
   const upgradeUrl = `https://${dashHostForIngestHost(host)}/${workspaceId}`;
   if (response.status === 401 || response.status === 403) {
-    console.error(chalk7.red("Not authorised. Your DSN may be invalid or lack access to this workspace."));
-    console.error(chalk7.dim('Re-run "vg login" or check VIBGRATE_DSN.'));
+    console.error(chalk8.red("Not authorised. Your DSN may be invalid or lack access to this workspace."));
+    console.error(chalk8.dim('Re-run "vg login" or check VIBGRATE_DSN.'));
     process.exit(1);
   }
   if (response.status === 402) {
-    console.error(chalk7.red("vg fix is a paid capability that is not enabled on your current plan."));
-    console.error(chalk7.dim(`Upgrade to enable the hosted upgrade planner: ${upgradeUrl}`));
+    console.error(chalk8.red("vg fix is a paid capability that is not enabled on your current plan."));
+    console.error(chalk8.dim(`Upgrade to enable the hosted upgrade planner: ${upgradeUrl}`));
     process.exit(1);
   }
   if (response.status === 429) {
-    console.error(chalk7.red("Rate limited by the planner. Wait a moment and try again."));
+    console.error(chalk8.red("Rate limited by the planner. Wait a moment and try again."));
     process.exit(1);
   }
-  console.error(chalk7.red(`The planner returned HTTP ${response.status}.`));
-  console.error(chalk7.dim("Try again shortly, or see https://vibgrate.com/help."));
+  console.error(chalk8.red(`The planner returned HTTP ${response.status}.`));
+  console.error(chalk8.dim("Try again shortly, or see https://vibgrate.com/help."));
   process.exit(1);
 }
 function emit(report, format) {
@@ -3481,6 +3975,28 @@ function emit(report, format) {
       break;
   }
 }
+function relProjectDir(rootDir, projectPath) {
+  const rel3 = path.isAbsolute(projectPath) ? path.relative(rootDir, projectPath) : projectPath;
+  return rel3 === "" ? "." : rel3;
+}
+async function buildTargetResolver(rootDir, artifact) {
+  const rootIsWorkspace = await detectWorkspaceRoot(rootDir);
+  const owners = /* @__PURE__ */ new Map();
+  for (const project of artifact.projects ?? []) {
+    const ecosystem = ecosystemId(project.type);
+    const dir = relProjectDir(rootDir, project.path);
+    for (const dep of project.dependencies ?? []) {
+      const key = `${ecosystem}\0${dep.package}`;
+      (owners.get(key) ?? owners.set(key, /* @__PURE__ */ new Set()).get(key)).add(dir);
+    }
+  }
+  const rootFallback = [{ dir: ".", isWorkspaceRoot: rootIsWorkspace }];
+  return (upgrade) => {
+    const dirs = owners.get(`${upgrade.ecosystem}\0${upgrade.package}`);
+    if (!dirs || dirs.size === 0) return rootFallback;
+    return [...dirs].sort((a, b) => a.localeCompare(b)).map((dir) => ({ dir, isWorkspaceRoot: dir === "." && rootIsWorkspace }));
+  };
+}
 function npmPackageManager(artifact) {
   for (const p of artifact.projects ?? []) {
     if ((p.type === "node" || p.type === "typescript") && p.packageManager) {
@@ -3492,11 +4008,11 @@ function npmPackageManager(artifact) {
 }
 function promptPlanSelection(response) {
   const plans = response.plans.filter((p) => p.upgrades.length > 0);
-  console.log(chalk7.bold("\nSelect a plan to apply:"));
+  console.log(chalk8.bold("\nSelect a plan to apply:"));
   plans.forEach((p, i) => {
-    const rec = p.tier === response.recommended ? chalk7.green(" (recommended)") : "";
+    const rec = p.tier === response.recommended ? chalk8.green(" (recommended)") : "";
     const drift = typeof p.expectedDriftScore === "number" && typeof response.currentDriftScore === "number" ? ` \xB7 DriftScore ${response.currentDriftScore}\u2192${p.expectedDriftScore}` : "";
-    console.log(`  ${i + 1}) ${chalk7.bold(p.label)}${rec}  risk ${p.riskScore}/100 \xB7 ${p.upgrades.length} upgrade(s)${drift}`);
+    console.log(`  ${i + 1}) ${chalk8.bold(p.label)}${rec}  risk ${p.riskScore}/100 \xB7 ${p.upgrades.length} upgrade(s)${drift}`);
   });
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
@@ -3515,14 +4031,14 @@ function promptPlanSelection(response) {
 async function runApplyFlow(rootDir, artifact, response, opts) {
   const nonEmpty = response.plans.filter((p) => p.upgrades.length > 0);
   if (nonEmpty.length === 0) {
-    console.log(chalk7.green("\n\u2714 Nothing to upgrade \u2014 every tracked dependency is current."));
+    console.log(chalk8.green("\n\u2714 Nothing to upgrade \u2014 every tracked dependency is current."));
     return;
   }
   let chosen;
   if (opts.plan) {
     chosen = response.plans.find((p) => p.tier === opts.plan);
     if (!chosen) {
-      console.error(chalk7.red(`Unknown plan '${opts.plan}'. Use safe, balanced, or aggressive.`));
+      console.error(chalk8.red(`Unknown plan '${opts.plan}'. Use safe, balanced, or aggressive.`));
       process.exit(1);
     }
   } else if (nonEmpty.length === 1) {
@@ -3532,42 +4048,43 @@ async function runApplyFlow(rootDir, artifact, response, opts) {
   } else if (process.stdin.isTTY && process.stdout.isTTY) {
     const tier = await promptPlanSelection(response);
     if (!tier) {
-      console.log(chalk7.dim("No plan applied."));
+      console.log(chalk8.dim("No plan applied."));
       return;
     }
     chosen = response.plans.find((p) => p.tier === tier);
   } else {
-    console.log(chalk7.dim("\nMultiple plans available \u2014 re-run with --plan <tier> or --yes to apply, or --dry-run to preview."));
+    console.log(chalk8.dim("\nMultiple plans available \u2014 re-run with --plan <tier> or --yes to apply, or --dry-run to preview."));
     return;
   }
   if (!chosen || chosen.upgrades.length === 0) {
-    console.log(chalk7.dim("Selected plan has no upgrades."));
+    console.log(chalk8.dim("Selected plan has no upgrades."));
     return;
   }
   const pm = npmPackageManager(artifact);
-  const results = applyPlan(rootDir, chosen.upgrades, { dryRun: opts.dryRun, packageManager: pm });
+  const resolveTargets = await buildTargetResolver(rootDir, artifact);
+  const results = applyPlan(rootDir, chosen.upgrades, { dryRun: opts.dryRun, packageManager: pm, resolveTargets });
   if (opts.dryRun) {
-    console.log(chalk7.bold(`
+    console.log(chalk8.bold(`
 Dry run \u2014 ${chosen.label} plan (${chosen.upgrades.length} upgrade(s)):`));
     for (const r of results) {
-      if (r.status === "manual") console.log(chalk7.yellow(`  \u26A0 ${r.package}: ${r.detail}`));
-      else console.log(chalk7.dim(`  ${r.package}: ${r.detail}`));
+      if (r.status === "manual") console.log(chalk8.yellow(`  \u26A0 ${r.package}: ${r.detail}`));
+      else console.log(chalk8.dim(`  ${r.package}: ${r.detail}`));
     }
     if (typeof chosen.expectedDriftScore === "number") {
-      console.log(chalk7.dim(`Expected DriftScore after apply: ~${chosen.expectedDriftScore} (was ${response.currentDriftScore ?? "?"}).`));
+      console.log(chalk8.dim(`Expected DriftScore after apply: ~${chosen.expectedDriftScore} (was ${response.currentDriftScore ?? "?"}).`));
     }
     return;
   }
   const applied = results.filter((r) => r.status === "applied");
   const failed = results.filter((r) => r.status === "failed");
   const manual = results.filter((r) => r.status === "manual");
-  console.log(chalk7.bold(`
+  console.log(chalk8.bold(`
 Applied the ${chosen.label} plan:`));
   console.log(
-    chalk7.green(`  \u2714 ${applied.length} upgraded`) + (failed.length ? chalk7.red(`   \u2716 ${failed.length} failed`) : "") + (manual.length ? chalk7.yellow(`   \u26A0 ${manual.length} need manual work`) : "")
+    chalk8.green(`  \u2714 ${applied.length} upgraded`) + (failed.length ? chalk8.red(`   \u2716 ${failed.length} failed`) : "") + (manual.length ? chalk8.yellow(`   \u26A0 ${manual.length} need manual work`) : "")
   );
-  for (const r of failed) console.log(chalk7.red(`    \u2716 ${r.package} \u2192 ${r.to}: ${r.detail ?? "failed"}`));
-  for (const r of manual) console.log(chalk7.yellow(`    \u26A0 ${r.package} \u2192 ${r.to}: ${r.detail}`));
+  for (const r of failed) console.log(chalk8.red(`    \u2716 ${r.package} \u2192 ${r.to}: ${r.detail ?? "failed"}`));
+  for (const r of manual) console.log(chalk8.yellow(`    \u26A0 ${r.package} \u2192 ${r.to}: ${r.detail}`));
   if (typeof chosen.expectedDriftScore === "number" && typeof response.currentDriftScore === "number") {
     const delta = chosen.expectedDriftScore - response.currentDriftScore;
     console.log(
@@ -3578,20 +4095,20 @@ Applied the ${chosen.label} plan:`));
 }
 function formatText(artifact) {
   const lines = [];
-  const teal2 = chalk7.hex("#3FB0A4");
-  const mint2 = chalk7.hex("#4FE3C1");
+  const teal2 = chalk8.hex("#3FB0A4");
+  const mint2 = chalk8.hex("#4FE3C1");
   lines.push("");
   lines.push("   " + teal2("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint2("\u279C"));
-  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.bold.white("vibgrate"));
-  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + "  " + chalk7.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.dim(`Code Intelligence Engine v${VERSION}`));
+  lines.push("  " + chalk8.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk8.dim("\u251C") + "  " + chalk8.bold.white("vibgrate"));
+  lines.push("  " + chalk8.dim("\u2524") + teal2("\u2502") + "  " + chalk8.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk8.dim("\u251C") + "  " + chalk8.dim(`Code Intelligence Engine v${VERSION}`));
   lines.push("   " + teal2("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   lines.push("");
   lines.push(...titleBox("Vibgrate Drift Report", teal2));
   lines.push("");
   for (const project of artifact.projects) {
-    lines.push(chalk7.bold(`  \u2500\u2500 ${project.name} `) + chalk7.dim(`(${project.type}) ${project.path}`));
+    lines.push(chalk8.bold(`  \u2500\u2500 ${project.name} `) + chalk8.dim(`(${project.type}) ${project.path}`));
     if (project.runtime) {
-      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk7.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk7.green(" (current)");
+      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk8.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk8.green(" (current)");
       lines.push(`     Runtime: ${project.runtime}${behindStr}`);
     }
     if (project.targetFramework) {
@@ -3600,7 +4117,7 @@ function formatText(artifact) {
     if (project.frameworks.length > 0) {
       lines.push("     Frameworks:");
       for (const fw of project.frameworks) {
-        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk7.green("current") : chalk7.yellow(`${fw.majorsBehind} behind`) : chalk7.dim("unknown");
+        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk8.green("current") : chalk8.yellow(`${fw.majorsBehind} behind`) : chalk8.dim("unknown");
         lines.push(`       ${fw.name}: ${fw.currentVersion ?? "?"} \u2192 ${fw.latestVersion ?? "?"} (${lag})`);
       }
     }
@@ -3608,13 +4125,13 @@ function formatText(artifact) {
     const total = b.current + b.oneBehind + b.twoPlusBehind + b.unknown;
     if (total > 0) {
       lines.push("     Dependencies:");
-      lines.push(`       ${chalk7.green(`${b.current} current`)}  ${chalk7.yellow(`${b.oneBehind} 1-behind`)}  ${chalk7.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk7.dim(`${b.unknown} unknown`)}`);
+      lines.push(`       ${chalk8.green(`${b.current} current`)}  ${chalk8.yellow(`${b.oneBehind} 1-behind`)}  ${chalk8.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk8.dim(`${b.unknown} unknown`)}`);
     }
     lines.push("");
   }
   if (artifact.delta !== void 0) {
-    const deltaStr = artifact.delta > 0 ? chalk7.red(`+${artifact.delta}`) : artifact.delta < 0 ? chalk7.green(`${artifact.delta}`) : chalk7.dim("0");
-    lines.push(chalk7.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+    const deltaStr = artifact.delta > 0 ? chalk8.red(`+${artifact.delta}`) : artifact.delta < 0 ? chalk8.green(`${artifact.delta}`) : chalk8.dim("0");
+    lines.push(chalk8.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
     lines.push("");
   }
   if (artifact.extended) {
@@ -3625,15 +4142,15 @@ function formatText(artifact) {
     const warnings = artifact.findings.filter((f) => f.level === "warning");
     const notes = artifact.findings.filter((f) => f.level === "note");
     const summary = [
-      errors.length > 0 ? chalk7.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
-      warnings.length > 0 ? chalk7.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
-      notes.length > 0 ? chalk7.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
-    ].filter(Boolean).join(chalk7.dim(", "));
-    lines.push(chalk7.bold.underline(`  Findings`) + chalk7.dim(` (${summary})`));
+      errors.length > 0 ? chalk8.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
+      warnings.length > 0 ? chalk8.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
+      notes.length > 0 ? chalk8.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
+    ].filter(Boolean).join(chalk8.dim(", "));
+    lines.push(chalk8.bold.underline(`  Findings`) + chalk8.dim(` (${summary})`));
     for (const f of artifact.findings) {
-      const icon = f.level === "error" ? chalk7.red("\u2716") : f.level === "warning" ? chalk7.yellow("\u26A0") : chalk7.blue("\u2139");
+      const icon = f.level === "error" ? chalk8.red("\u2716") : f.level === "warning" ? chalk8.yellow("\u26A0") : chalk8.blue("\u2139");
       lines.push(`    ${icon} ${f.message}`);
-      lines.push(chalk7.dim(`      ${f.ruleId} in ${f.location}`));
+      lines.push(chalk8.dim(`      ${f.ruleId} in ${f.location}`));
     }
     lines.push("");
   }
@@ -3643,10 +4160,10 @@ function formatText(artifact) {
     lines.push("");
     for (let i = 0; i < actions.length; i++) {
       const a = actions[i];
-      const num = chalk7.bold.cyan(`  ${i + 1}.`);
-      lines.push(`${num} ${chalk7.bold(a.title)}`);
-      lines.push(chalk7.dim(`     ${a.explanation}`));
-      if (a.impact) lines.push(`     Impact: ${chalk7.green(a.impact)}`);
+      const num = chalk8.bold.cyan(`  ${i + 1}.`);
+      lines.push(`${num} ${chalk8.bold(a.title)}`);
+      lines.push(chalk8.dim(`     ${a.explanation}`));
+      if (a.impact) lines.push(`     Impact: ${chalk8.green(a.impact)}`);
       lines.push("");
     }
   }
@@ -3658,30 +4175,30 @@ function formatText(artifact) {
     lines.push("");
     for (const solution of artifact.solutions) {
       const solScore = solution.drift?.score;
-      const color = typeof solScore === "number" ? solScore <= 30 ? chalk7.green : solScore <= 60 ? chalk7.yellow : chalk7.red : chalk7.dim;
-      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk7.dim("n/a")}`);
+      const color = typeof solScore === "number" ? solScore <= 30 ? chalk8.green : solScore <= 60 ? chalk8.yellow : chalk8.red : chalk8.dim;
+      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk8.dim("n/a")}`);
     }
     lines.push("");
   }
-  const scoreColor = artifact.drift.score <= 30 ? chalk7.green : artifact.drift.score <= 60 ? chalk7.yellow : chalk7.red;
+  const scoreColor = artifact.drift.score <= 30 ? chalk8.green : artifact.drift.score <= 60 ? chalk8.yellow : chalk8.red;
   lines.push(...titleBox("DriftScore Summary"));
   lines.push("");
-  lines.push(chalk7.bold("  DriftScore:   ") + scoreColor.bold(`${artifact.drift.score}/100`));
-  lines.push(chalk7.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
-  lines.push(chalk7.bold("  Projects:     ") + `${artifact.projects.length}`);
+  lines.push(chalk8.bold("  DriftScore:   ") + scoreColor.bold(`${artifact.drift.score}/100`));
+  lines.push(chalk8.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
+  lines.push(chalk8.bold("  Projects:     ") + `${artifact.projects.length}`);
   if (artifact.vcs) {
     const vcsParts = [artifact.vcs.type];
     if (artifact.vcs.branch) vcsParts.push(artifact.vcs.branch);
-    if (artifact.vcs.shortSha) vcsParts.push(chalk7.dim(artifact.vcs.shortSha));
-    lines.push(chalk7.bold("  VCS:          ") + vcsParts.join(" "));
+    if (artifact.vcs.shortSha) vcsParts.push(chalk8.dim(artifact.vcs.shortSha));
+    lines.push(chalk8.bold("  VCS:          ") + vcsParts.join(" "));
   }
   lines.push("");
   const m = new Set(artifact.drift.measured ?? ["runtime", "framework", "dependency", "eol"]);
-  lines.push("  " + chalk7.bold.underline("Score Breakdown"));
-  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk7.dim("n/a")}`);
-  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk7.dim("n/a")}`);
-  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk7.dim("n/a")}`);
-  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk7.dim("n/a")}`);
+  lines.push("  " + chalk8.bold.underline("Score Breakdown"));
+  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk8.dim("n/a")}`);
+  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk8.dim("n/a")}`);
+  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk8.dim("n/a")}`);
+  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk8.dim("n/a")}`);
   lines.push("");
   const scannedParts = [`Scanned at ${artifact.timestamp}`];
   if (artifact.durationMs !== void 0) {
@@ -3695,18 +4212,18 @@ function formatText(artifact) {
     scannedParts.push(`${artifact.treeSummary.totalFiles.toLocaleString()} workspace files`);
     scannedParts.push(`${artifact.treeSummary.totalDirs.toLocaleString()} dirs`);
   }
-  lines.push(chalk7.dim(`  ${scannedParts.join(" \xB7 ")}`));
+  lines.push(chalk8.dim(`  ${scannedParts.join(" \xB7 ")}`));
   lines.push("");
   return lines.join("\n");
 }
 function riskBadge(level) {
   switch (level) {
     case "low":
-      return chalk7.bgGreen.black(" LOW ");
+      return chalk8.bgGreen.black(" LOW ");
     case "moderate":
-      return chalk7.bgYellow.black(" MODERATE ");
+      return chalk8.bgYellow.black(" MODERATE ");
     case "high":
-      return chalk7.bgRed.white(" HIGH ");
+      return chalk8.bgRed.white(" HIGH ");
     default:
       return level;
   }
@@ -3741,11 +4258,11 @@ function formatExtended(ext) {
     const inv = ext.toolingInventory;
     const categories = Object.entries(inv).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk7.bold.underline("  Tech Stack"));
+      lines.push(chalk8.bold.underline("  Tech Stack"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        const names = items.map((i) => chalk7.white(i.name)).join(chalk7.dim(", "));
-        lines.push(`    ${chalk7.cyan(label)}: ${names}`);
+        const names = items.map((i) => chalk8.white(i.name)).join(chalk8.dim(", "));
+        lines.push(`    ${chalk8.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -3754,14 +4271,14 @@ function formatExtended(ext) {
     const svc = ext.serviceDependencies;
     const categories = Object.entries(svc).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk7.bold.underline("  Services & Integrations"));
+      lines.push(chalk8.bold.underline("  Services & Integrations"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
         const names = items.map((i) => {
-          const ver = i.version ? chalk7.dim(` ${i.version}`) : "";
-          return chalk7.white(i.name) + ver;
-        }).join(chalk7.dim(", "));
-        lines.push(`    ${chalk7.cyan(label)}: ${names}`);
+          const ver = i.version ? chalk8.dim(` ${i.version}`) : "";
+          return chalk8.white(i.name) + ver;
+        }).join(chalk8.dim(", "));
+        lines.push(`    ${chalk8.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -3769,19 +4286,19 @@ function formatExtended(ext) {
   if (ext.breakingChangeExposure) {
     const bc = ext.breakingChangeExposure;
     if (bc.deprecatedPackages.length > 0 || bc.legacyPolyfills.length > 0) {
-      lines.push(chalk7.bold.underline("  Breaking Change Exposure"));
-      const exposureColor = bc.exposureScore >= 40 ? chalk7.red : bc.exposureScore >= 20 ? chalk7.yellow : chalk7.green;
+      lines.push(chalk8.bold.underline("  Breaking Change Exposure"));
+      const exposureColor = bc.exposureScore >= 40 ? chalk8.red : bc.exposureScore >= 20 ? chalk8.yellow : chalk8.green;
       lines.push(`    Exposure Score: ${exposureColor.bold(`${bc.exposureScore}/100`)}`);
       if (bc.deprecatedPackages.length > 0) {
-        lines.push(`    ${chalk7.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk7.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk8.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk8.dim(p)).join(", ")}`);
       }
       if (bc.legacyPolyfills.length > 0) {
-        lines.push(`    ${chalk7.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk7.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk8.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk8.dim(p)).join(", ")}`);
       }
       if (bc.peerConflictsDetected) {
-        lines.push(`    ${chalk7.red("\u26A0")} Peer dependency conflicts detected`);
+        lines.push(`    ${chalk8.red("\u26A0")} Peer dependency conflicts detected`);
       }
-      lines.push(`    Recommendation: ${chalk7.bold(bc.overallRecommendation)}`);
+      lines.push(`    Recommendation: ${chalk8.bold(bc.overallRecommendation)}`);
       const projectsWithPlans = bc.projectIntelligence.filter((p) => p.packages.length > 0).slice(0, 3);
       if (projectsWithPlans.length > 0) {
         lines.push("    Major Upgrade Intelligence:");
@@ -3797,21 +4314,21 @@ function formatExtended(ext) {
   }
   if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
     const ts = ext.tsModernity;
-    lines.push(chalk7.bold.underline("  TypeScript"));
+    lines.push(chalk8.bold.underline("  TypeScript"));
     const parts = [];
     parts.push(`v${ts.typescriptVersion}`);
-    if (ts.strict === true) parts.push(chalk7.green("strict \u2714"));
-    else if (ts.strict === false) parts.push(chalk7.yellow("strict \u2716"));
+    if (ts.strict === true) parts.push(chalk8.green("strict \u2714"));
+    else if (ts.strict === false) parts.push(chalk8.yellow("strict \u2716"));
     if (ts.moduleType) parts.push(ts.moduleType.toUpperCase());
     if (ts.target) parts.push(`target: ${ts.target}`);
-    lines.push(`    ${parts.join(chalk7.dim(" \xB7 "))}`);
+    lines.push(`    ${parts.join(chalk8.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.buildDeploy) {
     const bd = ext.buildDeploy;
     const hasSomething = bd.ci.length > 0 || bd.docker.dockerfileCount > 0 || bd.packageManagers.length > 0;
     if (hasSomething) {
-      lines.push(chalk7.bold.underline("  Build & Deploy"));
+      lines.push(chalk8.bold.underline("  Build & Deploy"));
       if (bd.ci.length > 0) lines.push(`    CI: ${bd.ci.join(", ")}`);
       if (bd.docker.dockerfileCount > 0) {
         lines.push(`    Docker: ${bd.docker.dockerfileCount} Dockerfile${bd.docker.dockerfileCount !== 1 ? "s" : ""} (${bd.docker.baseImages.join(", ")})`);
@@ -3824,42 +4341,42 @@ function formatExtended(ext) {
   }
   if (ext.uiPurpose) {
     const up = ext.uiPurpose;
-    lines.push(chalk7.bold.underline("  Product Purpose Signals"));
-    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk7.dim("unknown")}`);
-    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk7.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
+    lines.push(chalk8.bold.underline("  Product Purpose Signals"));
+    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk8.dim("unknown")}`);
+    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk8.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
     const top = up.topEvidence.slice(0, 8);
     if (top.length > 0) {
       lines.push("    Top Signals:");
       for (const item of top) {
-        lines.push(`      - [${item.kind}] ${item.value} ${chalk7.dim(`(${item.file})`)}`);
+        lines.push(`      - [${item.kind}] ${item.value} ${chalk8.dim(`(${item.file})`)}`);
       }
     }
     if (up.unknownSignals.length > 0) {
       lines.push("    Unknowns:");
       for (const u of up.unknownSignals.slice(0, 4)) {
-        lines.push(`      - ${chalk7.yellow(u)}`);
+        lines.push(`      - ${chalk8.yellow(u)}`);
       }
     }
     lines.push("");
   }
   if (ext.securityPosture) {
     const sec = ext.securityPosture;
-    lines.push(chalk7.bold.underline("  Security Posture"));
+    lines.push(chalk8.bold.underline("  Security Posture"));
     const checks = [];
-    checks.push(sec.lockfilePresent ? chalk7.green("Lockfile \u2714") : chalk7.red("Lockfile \u2716"));
-    checks.push(sec.gitignoreCoversEnv ? chalk7.green(".env \u2714") : chalk7.red(".env \u2716"));
-    checks.push(sec.gitignoreCoversNodeModules ? chalk7.green("node_modules \u2714") : chalk7.yellow("node_modules \u2716"));
-    if (sec.multipleLockfileTypes) checks.push(chalk7.yellow("Multiple lockfiles \u26A0"));
-    if (sec.envFilesTracked) checks.push(chalk7.red("Env files tracked \u2716"));
-    lines.push(`    ${checks.join(chalk7.dim(" \xB7 "))}`);
+    checks.push(sec.lockfilePresent ? chalk8.green("Lockfile \u2714") : chalk8.red("Lockfile \u2716"));
+    checks.push(sec.gitignoreCoversEnv ? chalk8.green(".env \u2714") : chalk8.red(".env \u2716"));
+    checks.push(sec.gitignoreCoversNodeModules ? chalk8.green("node_modules \u2714") : chalk8.yellow("node_modules \u2716"));
+    if (sec.multipleLockfileTypes) checks.push(chalk8.yellow("Multiple lockfiles \u26A0"));
+    if (sec.envFilesTracked) checks.push(chalk8.red("Env files tracked \u2716"));
+    lines.push(`    ${checks.join(chalk8.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.platformMatrix) {
     const pm = ext.platformMatrix;
     if (pm.nativeModules.length > 0 || pm.dockerBaseImages.length > 0) {
-      lines.push(chalk7.bold.underline("  Platform"));
+      lines.push(chalk8.bold.underline("  Platform"));
       if (pm.nativeModules.length > 0) {
-        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk7.dim(m)).join(", ")}`);
+        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk8.dim(m)).join(", ")}`);
       }
       if (pm.osAssumptions.length > 0) {
         lines.push(`    OS assumptions: ${pm.osAssumptions.join(", ")}`);
@@ -3869,25 +4386,25 @@ function formatExtended(ext) {
   }
   if (ext.codeQuality) {
     const cq = ext.codeQuality;
-    lines.push(chalk7.bold.underline("  Code Quality"));
-    lines.push(`    Files: ${chalk7.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk7.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk7.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk7.white(`${cq.avgFunctionLength}`)} lines`);
+    lines.push(chalk8.bold.underline("  Code Quality"));
+    lines.push(`    Files: ${chalk8.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk8.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk8.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk8.white(`${cq.avgFunctionLength}`)} lines`);
     lines.push(`    Max nesting: ${cq.maxNestingDepth} \xB7 Circular deps: ${cq.circularDependencies} \xB7 Dead code: ${cq.deadCodePercent}%`);
     if (cq.godFiles.length > 0) {
       const preview = cq.godFiles.slice(0, 3).map((f) => `${f.path} (${f.lines} lines)`).join(", ");
-      lines.push(`    ${chalk7.yellow("God files")}: ${preview}`);
+      lines.push(`    ${chalk8.yellow("God files")}: ${preview}`);
     }
     lines.push("");
   }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
-      lines.push(chalk7.bold.underline("  Dependency Graph"));
-      lines.push(`    ${dg.lockfileType}: ${chalk7.white(`${dg.totalUnique}`)} unique, ${chalk7.white(`${dg.totalInstalled}`)} installed`);
+      lines.push(chalk8.bold.underline("  Dependency Graph"));
+      lines.push(`    ${dg.lockfileType}: ${chalk8.white(`${dg.totalUnique}`)} unique, ${chalk8.white(`${dg.totalInstalled}`)} installed`);
       if (dg.duplicatedPackages.length > 0) {
-        lines.push(`    ${chalk7.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
+        lines.push(`    ${chalk8.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
       }
       if (dg.phantomDependencies.length > 0) {
-        lines.push(`    ${chalk7.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
+        lines.push(`    ${chalk8.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
       }
       lines.push("");
     }
@@ -3898,13 +4415,13 @@ function formatArchitectureDiagram(arch) {
   const lines = [];
   lines.push(...titleBox("Architecture Layers"));
   lines.push("");
-  lines.push(chalk7.bold("  Archetype: ") + `${arch.archetype}` + chalk7.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
-  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk7.dim(` (${arch.unclassified} unclassified)`) : ""));
+  lines.push(chalk8.bold("  Archetype: ") + `${arch.archetype}` + chalk8.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
+  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk8.dim(` (${arch.unclassified} unclassified)`) : ""));
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
-      const risk = layer.riskLevel === "none" ? chalk7.dim("none") : layer.riskLevel === "low" ? chalk7.green("low") : layer.riskLevel === "moderate" ? chalk7.yellow("moderate") : chalk7.red("high");
-      lines.push(`    ${chalk7.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
+      const risk = layer.riskLevel === "none" ? chalk8.dim("none") : layer.riskLevel === "low" ? chalk8.green("low") : layer.riskLevel === "moderate" ? chalk8.yellow("moderate") : chalk8.red("high");
+      lines.push(`    ${chalk8.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
     }
     lines.push("");
   }
@@ -4275,8 +4792,8 @@ function formatMarkdown(artifact) {
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
   const artifactPath = path.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
-    console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
-    console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
+    console.error(chalk8.red(`Artifact not found: ${artifactPath}`));
+    console.error(chalk8.dim('Run "vibgrate scan" first to generate a scan artifact.'));
     process.exit(1);
   }
   const artifact = await readJsonFile(artifactPath);
@@ -4332,7 +4849,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
   try {
     ingestHost = resolveIngestHost(opts.region, opts.ingest);
   } catch (e) {
-    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    console.error(chalk8.red(e instanceof Error ? e.message : String(e)));
     process.exit(1);
   }
   const base = `https://${ingestHost}/v1/auth/device`;
@@ -4344,28 +4861,28 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       body: "{}"
     });
     if (!res.ok) {
-      console.error(chalk7.red(`Failed to start login (HTTP ${res.status}).`));
+      console.error(chalk8.red(`Failed to start login (HTTP ${res.status}).`));
       process.exit(1);
     }
     start = await res.json();
   } catch (e) {
-    console.error(chalk7.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
+    console.error(chalk8.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
     process.exit(1);
   }
   console.log("");
   console.log("To finish signing in, open this URL and approve the request:");
   console.log("");
-  console.log("  " + chalk7.cyan(start.verificationUri));
+  console.log("  " + chalk8.cyan(start.verificationUri));
   console.log("");
-  console.log("  Your code: " + chalk7.bold(start.userCode));
+  console.log("  Your code: " + chalk8.bold(start.userCode));
   console.log("");
   if (opts.browser) {
     const opened = openUrl(start.verificationUriComplete);
     if (opened) {
-      console.log(chalk7.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
+      console.log(chalk8.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
     }
   }
-  console.log(chalk7.dim("Waiting for approval\u2026"));
+  console.log(chalk8.dim("Waiting for approval\u2026"));
   const intervalMs = Math.max(2, start.interval || 5) * 1e3;
   const deadline = Date.now() + (start.expiresIn || 900) * 1e3;
   while (Date.now() < deadline) {
@@ -4393,7 +4910,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
           savedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
       } else {
-        console.log(chalk7.dim("Setting up your workspace\u2026"));
+        console.log(chalk8.dim("Setting up your workspace\u2026"));
         try {
           const provisioned = await createWorkspaceDsn({
             region: opts.region,
@@ -4408,10 +4925,10 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
           };
         } catch (e) {
           console.error(
-            chalk7.red("\u2716 Signed in, but workspace setup failed: ") + (e instanceof Error ? e.message : String(e))
+            chalk8.red("\u2716 Signed in, but workspace setup failed: ") + (e instanceof Error ? e.message : String(e))
           );
           console.error(
-            chalk7.dim('  Finish setup with "vibgrate dsn create --workspace new".')
+            chalk8.dim('  Finish setup with "vibgrate dsn create --workspace new".')
           );
           process.exit(1);
         }
@@ -4420,40 +4937,40 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       writeStoredCredentials(creds, storeOpts);
       const credsFile = credentialsPath(storeOpts);
       console.log("");
-      console.log(chalk7.green("\u2714") + " Logged in.");
+      console.log(chalk8.green("\u2714") + " Logged in.");
       if (creds.workspaceId) {
-        console.log("  Workspace: " + chalk7.bold(creds.workspaceId));
+        console.log("  Workspace: " + chalk8.bold(creds.workspaceId));
       }
-      console.log(chalk7.dim(`  Credentials saved to ${credsFile}`));
+      console.log(chalk8.dim(`  Credentials saved to ${credsFile}`));
       try {
         const root = findGitRoot();
         if (root && isInside(root, credsFile)) {
           const res = ensureGitignored(gitignoreEntryForCredentials(root, credsFile), root);
           if (res.status === "created") {
-            console.log(chalk7.dim(`  Created .gitignore and ignored ${res.entry}`));
+            console.log(chalk8.dim(`  Created .gitignore and ignored ${res.entry}`));
           } else if (res.status === "added") {
-            console.log(chalk7.dim(`  Added ${res.entry} to .gitignore`));
+            console.log(chalk8.dim(`  Added ${res.entry} to .gitignore`));
           }
         }
       } catch {
       }
-      console.log(chalk7.dim(`  You can now run "${resolveCliInvocation()} scan --push".`));
+      console.log(chalk8.dim(`  You can now run "${resolveCliInvocation()} scan --push".`));
       return;
     }
     if (token.status === "access_denied") {
-      console.error(chalk7.red("\u2716 Login was denied in the browser."));
+      console.error(chalk8.red("\u2716 Login was denied in the browser."));
       process.exit(1);
     }
     if (token.status === "expired" || token.status === "invalid") {
-      console.error(chalk7.red('\u2716 Login request expired. Run "vibgrate login" again.'));
+      console.error(chalk8.red('\u2716 Login request expired. Run "vibgrate login" again.'));
       process.exit(1);
     }
     if (token.status === "error") {
-      console.error(chalk7.red(`\u2716 ${token.error ?? "Login failed."}`));
+      console.error(chalk8.red(`\u2716 ${token.error ?? "Login failed."}`));
       process.exit(1);
     }
   }
-  console.error(chalk7.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
+  console.error(chalk8.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
   process.exit(1);
 });
 
@@ -4474,190 +4991,20 @@ function unsetEnvCommand(varName, env = {}) {
 var logoutCommand = new Command("logout").description("Clear stored Vibgrate login credentials").action(() => {
   const cleared = clearStoredCredentials();
   if (cleared) {
-    console.log(chalk7.green("\u2714") + " Logged out. Stored credentials removed.");
+    console.log(chalk8.green("\u2714") + " Logged out. Stored credentials removed.");
   } else {
-    console.log(chalk7.dim(`No stored credentials found at ${credentialsPath()}.`));
+    console.log(chalk8.dim(`No stored credentials found at ${credentialsPath()}.`));
   }
   if (process.env.VIBGRATE_DSN) {
     console.log("");
     console.log(
-      chalk7.yellow("\u26A0") + " VIBGRATE_DSN is still set in your environment, so commands will keep using it."
+      chalk8.yellow("\u26A0") + " VIBGRATE_DSN is still set in your environment, so commands will keep using it."
     );
     console.log(
-      chalk7.dim(`  Unset it to fully sign out: ${unsetEnvCommand("VIBGRATE_DSN")}`)
+      chalk8.dim(`  Unset it to fully sign out: ${unsetEnvCommand("VIBGRATE_DSN")}`)
     );
   }
 });
-var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path.join(CACHE_DIR, "update-check.json");
-async function fetchLatestVersion() {
-  try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 1e4);
-    timeout.unref?.();
-    let response;
-    try {
-      response = await fetch(REGISTRY_URL, {
-        headers: { Accept: "application/json" },
-        signal: controller.signal
-      });
-    } finally {
-      clearTimeout(timeout);
-    }
-    if (!response.ok) return null;
-    const data = await response.json();
-    const latest = data.version;
-    if (!latest || !semver.valid(latest)) return null;
-    await writeCache({ latest, checkedAt: Date.now() });
-    return latest;
-  } catch {
-    return null;
-  }
-}
-async function writeCache(data) {
-  try {
-    await fs14.mkdir(CACHE_DIR, { recursive: true });
-    await fs14.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
-  } catch {
-  }
-}
-
-// src/reporting/commands/update.ts
-function detectGlobalInstall() {
-  const execPath = process.argv[1] || "";
-  if (execPath.includes("/lib/node_modules/") || execPath.includes("\\node_modules\\")) {
-    if (!execPath.includes(process.cwd())) {
-      if (execPath.includes("pnpm")) return "pnpm";
-      if (execPath.includes("yarn")) return "yarn";
-      if (execPath.includes("bun")) return "bun";
-      return "npm";
-    }
-  }
-  return null;
-}
-function getGlobalUpdateCommand(pm, pkg, version) {
-  const spec = `${pkg}@${version}`;
-  switch (pm) {
-    case "pnpm":
-      return `pnpm add -g ${spec}`;
-    case "yarn":
-      return `yarn global add ${spec}`;
-    case "bun":
-      return `bun add -g ${spec}`;
-    case "npm":
-    default:
-      return `npm install -g ${spec}`;
-  }
-}
-async function detectPackageManager(cwd) {
-  if (await pathExists(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path.join(cwd, "yarn.lock"))) return "yarn";
-  return "npm";
-}
-async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path.join(cwd, "pnpm-workspace.yaml"))) return true;
-  try {
-    const pkgPath = path.join(cwd, "package.json");
-    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
-    const pkg = JSON.parse(raw);
-    return pkg.workspaces != null;
-  } catch {
-    return false;
-  }
-}
-function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
-  const spec = `${pkg}@${version}`;
-  const ws = opts.workspaceRoot && pm === "pnpm" ? " -w" : "";
-  switch (pm) {
-    case "pnpm":
-      return isDev ? `pnpm add${ws} -D ${spec}` : `pnpm add${ws} ${spec}`;
-    case "yarn":
-      return isDev ? `yarn add --dev ${spec}` : `yarn add ${spec}`;
-    case "bun":
-      return isDev ? `bun add -d ${spec}` : `bun add ${spec}`;
-    case "npm":
-    default:
-      return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
-  }
-}
-async function isDevDependency(cwd) {
-  try {
-    const pkgPath = path.join(cwd, "package.json");
-    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
-    const pkg = JSON.parse(raw);
-    return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
-  } catch {
-    return true;
-  }
-}
-async function confirmWorkspaceRoot(pm) {
-  if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve16) => {
-    rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
-      rl.close();
-      const t = ans.trim().toLowerCase();
-      resolve16(t === "y" || t === "yes");
-    });
-  });
-}
-var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").option("-y, --yes", "Skip confirmation prompts (e.g. installing at a workspace root)").option("-w, --workspace-root", "Allow updating the pnpm workspace root (implies --yes for that prompt)").action(
-  async (opts) => {
-    console.log(chalk7.dim(`Current version: ${VERSION}`));
-    console.log(chalk7.dim("Checking npm registry..."));
-    const latest = await fetchLatestVersion();
-    if (!latest) {
-      console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
-      process.exit(1);
-    }
-    const semver2 = await import('semver');
-    if (!semver2.gt(latest, VERSION)) {
-      console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
-      return;
-    }
-    console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
-    if (opts.check) {
-      console.log(chalk7.dim('Run "vg update" to install.'));
-      return;
-    }
-    const cwd = process.cwd();
-    const globalPm = detectGlobalInstall();
-    const isGlobal = opts.global || globalPm !== null;
-    const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
-    let cmd;
-    if (isGlobal) {
-      cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
-      console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
-    } else {
-      const isDev = await isDevDependency(cwd);
-      let workspaceRoot = false;
-      if (pm === "pnpm" && await detectWorkspaceRoot(cwd)) {
-        console.log(
-          chalk7.yellow("Detected a pnpm workspace root.") + chalk7.dim(" Installing here needs the -w flag and updates the root package.json.")
-        );
-        const proceed = opts.yes || opts.workspaceRoot || await confirmWorkspaceRoot(pm);
-        if (!proceed) {
-          const rootCmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot: true });
-          console.log(chalk7.dim(`Skipped. To update the workspace root, run: ${rootCmd}`));
-          console.log(chalk7.dim('or re-run "vg update --yes" (or --workspace-root) to let vg do it.'));
-          return;
-        }
-        workspaceRoot = true;
-      }
-      cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot });
-      console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
-    }
-    try {
-      execSync(cmd, { cwd, stdio: "inherit" });
-      console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
-    } catch {
-      console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
-      process.exit(1);
-    }
-  }
-);
 var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 var VEX_STATUSES = ["not_affected", "affected", "fixed", "under_investigation"];
 var VEX_JUSTIFICATIONS = [
@@ -4749,7 +5096,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     if (opts.from) {
       const fromPath = path.resolve(opts.from);
       if (!await pathExists(fromPath)) {
-        process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
+        process.stderr.write(chalk8.red(`Statements file not found: ${fromPath}
 `));
         process.exit(1);
       }
@@ -4767,7 +5114,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     if (opts.out) {
       await writeTextFile(path.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path.resolve(opts.out)}
+        chalk8.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path.resolve(opts.out)}
 `
       );
     } else {
@@ -4775,7 +5122,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     }
   } catch (err) {
     if (err instanceof VexValidationError) {
-      process.stderr.write(chalk7.red(`VEX validation error: ${err.message}
+      process.stderr.write(chalk8.red(`VEX validation error: ${err.message}
 `));
       process.exit(1);
     }
@@ -4952,7 +5299,7 @@ function formatDeltaText(base, current) {
 async function readArtifactOrExit(filePath) {
   const absolutePath = path.resolve(filePath);
   if (!await pathExists(absolutePath)) {
-    console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
+    console.error(chalk8.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
   }
   return readJsonFile(absolutePath);
@@ -4961,14 +5308,14 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const artifact = await readArtifactOrExit(opts.in);
   const format = opts.format.toLowerCase();
   if (format !== "cyclonedx" && format !== "spdx") {
-    console.error(chalk7.red("Invalid SBOM format. Use cyclonedx or spdx."));
+    console.error(chalk8.red("Invalid SBOM format. Use cyclonedx or spdx."));
     process.exit(1);
   }
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
     await writeTextFile(path.resolve(opts.out), body);
-    console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
+    console.log(chalk8.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
   }
@@ -4979,7 +5326,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const report = formatDeltaText(base, current);
   if (opts.out) {
     await writeTextFile(path.resolve(opts.out), report);
-    console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
+    console.log(chalk8.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
   }
@@ -5135,7 +5482,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs5.existsSync(path.resolve(cwd, first))) {
+  if (fs6.existsSync(path.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];