@vibgrate/cli 2026.710.1 → 2026.711.2

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-NOHVVB7K.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-75ZJYYJE.js';
 import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-OGRPKYRW.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-ZNCJZVNT.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-4IHO6VUL.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-NNU2PW2H.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import * as fs6 from 'fs';
@@ -16,8 +16,8 @@ import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
 import chalk8 from 'chalk';
 import * as os from 'os';
+import * as fs12 from 'fs/promises';
 import * as readline from 'readline';
-import * as fs15 from 'fs/promises';
 import semver from 'semver';
 
 var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
@@ -2535,7 +2535,8 @@ async function showCmd(root, name, budget, asJson, opts = {}) {
   if (online && !quality.sufficient) {
     const dsn = resolveDsn();
     const parsed = dsn ? parseDsn$1(dsn) : null;
-    hosted = await fetchHostedDocs(
+    hosted = await fetchHostedDocsCached(
+      root,
       { name: displayName, query: name, maxTokens: budget },
       { region: opts.region, ingest: opts.ingest, auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
     );
@@ -2674,7 +2675,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-EONSXRN7.js');
+    const { runBaseline } = await import('./baseline-SRVG4ZAD.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -2683,6 +2684,270 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
   console.log(`  ${chalk8.cyan("vibgrate baseline")}        Create a drift baseline`);
   console.log("");
 });
+var REACHABILITY_ANALYZER_VERSION = "vg-reach-1.0";
+var ECOSYSTEM_MATCH_CONFIDENCE = {
+  npm: 0.8,
+  Go: 0.8,
+  "crates.io": 0.7,
+  PyPI: 0.65,
+  RubyGems: 0.6
+};
+var GENERIC_SYMBOL_NAMES = /* @__PURE__ */ new Set([
+  "get",
+  "set",
+  "run",
+  "main",
+  "init",
+  "call",
+  "apply",
+  "exec",
+  "send",
+  "open",
+  "read",
+  "write",
+  "parse",
+  "load",
+  "save",
+  "start",
+  "stop",
+  "new",
+  "create",
+  "update",
+  "delete",
+  "handle",
+  "process",
+  "render",
+  "value",
+  "data",
+  "next"
+]);
+var MAX_FILES_PER_PACKAGE = 25;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_MODULES_PER_PACKAGE = 50;
+var MAX_IMPORTED_MODULE_PACKAGES = 500;
+var MAX_FINDINGS = 1e3;
+function normalizePython(name) {
+  return name.toLowerCase().replace(/[-.]/g, "_");
+}
+function specifierMatchesPackage(ecosystem, pkg, spec) {
+  switch (ecosystem) {
+    case "npm":
+    case "Go":
+    case "RubyGems":
+      return spec === pkg || spec.startsWith(`${pkg}/`);
+    case "PyPI": {
+      const top = spec.split(".")[0] ?? spec;
+      return normalizePython(top) === normalizePython(pkg);
+    }
+    case "crates.io": {
+      const top = (spec.split("::")[0] ?? spec).toLowerCase().replace(/-/g, "_");
+      return top === pkg.toLowerCase().replace(/-/g, "_");
+    }
+    default:
+      return false;
+  }
+}
+function symbolIdentifier(symbol) {
+  const cleaned = symbol.replace(/\(.*\)$/, "");
+  const segments = cleaned.split(/[./:#]|::/).filter(Boolean);
+  return segments[segments.length - 1] ?? cleaned;
+}
+function isMatchableIdentifier(identifier) {
+  return identifier.length >= 3 && !GENERIC_SYMBOL_NAMES.has(identifier.toLowerCase());
+}
+function collectPackageImports(graph, ecosystem, pkg) {
+  if (!(ecosystem in ECOSYSTEM_MATCH_CONFIDENCE)) {
+    return { supported: false, modules: [], importingFiles: [] };
+  }
+  const idx = indexFor(graph);
+  const modules = /* @__PURE__ */ new Set();
+  const files = /* @__PURE__ */ new Set();
+  for (const node of graph.nodes) {
+    if (node.kind !== "external") continue;
+    if (!specifierMatchesPackage(ecosystem, pkg, node.name)) continue;
+    modules.add(node.name);
+    for (const edge of idx.in(node.id, "import")) {
+      const src = idx.nodeById.get(edge.src);
+      if (src?.file) files.add(src.file);
+    }
+  }
+  return {
+    supported: true,
+    modules: [...modules].sort(),
+    importingFiles: [...files].sort()
+  };
+}
+async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
+  const content = await readFile3(path.join(rootDir, relFile));
+  if (!content) return false;
+  const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\b${escaped}\\b`).test(content);
+}
+async function defaultReadFile(absPath) {
+  try {
+    const stat2 = await fs12.stat(absPath);
+    if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
+    return await fs12.readFile(absPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function analyzeReachability(input) {
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const readFile3 = input.readFile ?? defaultReadFile;
+  if (!input.graph) {
+    return {
+      analyzerVersion: REACHABILITY_ANALYZER_VERSION,
+      source: "none",
+      generatedAt,
+      manifestAdvisoryCount: input.manifest.length,
+      findings: input.manifest.slice(0, MAX_FINDINGS).map((entry) => ({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "unknown",
+        evidence: "no code map available for this scan",
+        graphConfidence: 0
+      }))
+    };
+  }
+  const evidenceByPackage = /* @__PURE__ */ new Map();
+  const importedModules = [];
+  const seenPackages = /* @__PURE__ */ new Set();
+  for (const dep of input.dependencies) {
+    const key = `${dep.ecosystem}|${dep.package}`;
+    if (seenPackages.has(key)) continue;
+    seenPackages.add(key);
+    const evidence = collectPackageImports(input.graph, dep.ecosystem, dep.package);
+    evidenceByPackage.set(key, evidence);
+    if (evidence.supported && importedModules.length < MAX_IMPORTED_MODULE_PACKAGES) {
+      importedModules.push({
+        ecosystem: dep.ecosystem,
+        package: dep.package,
+        modules: evidence.modules.slice(0, MAX_MODULES_PER_PACKAGE),
+        importingFiles: evidence.importingFiles.length
+      });
+    }
+  }
+  importedModules.sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package)
+  );
+  const findings = [];
+  for (const entry of input.manifest) {
+    const key = `${entry.ecosystem}|${entry.package}`;
+    const evidence = evidenceByPackage.get(key) ?? collectPackageImports(input.graph, entry.ecosystem, entry.package);
+    const baseConfidence = ECOSYSTEM_MATCH_CONFIDENCE[entry.ecosystem] ?? 0;
+    if (!evidence.supported) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "unknown",
+        evidence: `import matching is not supported for the ${entry.ecosystem} ecosystem yet`,
+        graphConfidence: 0
+      });
+      continue;
+    }
+    if (evidence.importingFiles.length === 0) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "not_reached",
+        evidence: `no import of ${entry.package} was found in the code map`,
+        graphConfidence: baseConfidence
+      });
+      continue;
+    }
+    const matchableSymbols = entry.symbols.map((s) => ({ symbol: s.symbol, identifier: symbolIdentifier(s.symbol) })).filter((s) => isMatchableIdentifier(s.identifier));
+    if (entry.symbolCoverage !== "function" || matchableSymbols.length === 0) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "potentially_reachable",
+        evidence: `${entry.package} is imported by ${evidence.importingFiles.length} file${evidence.importingFiles.length === 1 ? "" : "s"}; vulnerable symbols unresolved (coverage: ${entry.symbolCoverage})`,
+        callPath: evidence.importingFiles.slice(0, 10),
+        graphConfidence: Math.min(baseConfidence, 0.6)
+      });
+      continue;
+    }
+    const filesToCheck = evidence.importingFiles.slice(0, MAX_FILES_PER_PACKAGE);
+    let anySymbolFound = false;
+    for (const { symbol, identifier } of matchableSymbols) {
+      const referencingFiles = [];
+      for (const relFile of filesToCheck) {
+        if (await fileReferencesIdentifier(input.rootDir, relFile, identifier, readFile3)) {
+          referencingFiles.push(relFile);
+          if (referencingFiles.length >= 5) break;
+        }
+      }
+      if (referencingFiles.length > 0) {
+        anySymbolFound = true;
+        findings.push({
+          advisoryId: entry.advisoryId,
+          ecosystem: entry.ecosystem,
+          package: entry.package,
+          version: entry.version,
+          symbol,
+          tier: "reachable",
+          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${referencingFiles.length} importing file${referencingFiles.length === 1 ? "" : "s"}`,
+          callPath: referencingFiles,
+          graphConfidence: Math.min(baseConfidence, 0.75)
+        });
+      }
+    }
+    if (!anySymbolFound) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "not_reached",
+        evidence: `${entry.package} is imported, but none of its ${matchableSymbols.length} vulnerable symbol${matchableSymbols.length === 1 ? "" : "s"} is referenced in the ${filesToCheck.length} importing file${filesToCheck.length === 1 ? "" : "s"} checked`,
+        callPath: evidence.importingFiles.slice(0, 10),
+        graphConfidence: Math.min(baseConfidence, 0.55)
+      });
+    }
+  }
+  findings.sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package) || a.advisoryId.localeCompare(b.advisoryId) || (a.symbol ?? "").localeCompare(b.symbol ?? "")
+  );
+  return {
+    analyzerVersion: REACHABILITY_ANALYZER_VERSION,
+    source: "graph",
+    generatedAt,
+    manifestAdvisoryCount: input.manifest.length,
+    importedModules,
+    findings: findings.slice(0, MAX_FINDINGS)
+  };
+}
+function collectPreflightDependencies(projects, projectTypeToEcosystem) {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const project of projects) {
+    const ecosystem = projectTypeToEcosystem[project.type];
+    if (!ecosystem) continue;
+    for (const dep of project.dependencies) {
+      const version = dep.resolvedVersion || normalizeVersionSpec(dep.currentSpec);
+      if (!version) continue;
+      const key = `${ecosystem}:${dep.package}:${version}`;
+      if (!deduped.has(key)) {
+        deduped.set(key, { ecosystem, package: dep.package, version });
+      }
+    }
+  }
+  return [...deduped.values()].sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package) || a.version.localeCompare(b.version)
+  );
+}
+function normalizeVersionSpec(spec) {
+  const match = spec.trim().match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+  return match?.[0] ?? null;
+}
 
 // src/reporting/utils/ingest-id-output.ts
 function emitIngestIdLine(ingestId, options) {
@@ -2738,6 +3003,47 @@ function printAiContextPrompt(detectedAssistant) {
 function shouldBuildCodeMap(opts) {
   return opts.graph !== false && !opts.maxPrivacy && !opts.noLocalArtifacts;
 }
+async function attachReachability(artifact, rootDir, opts, graph) {
+  try {
+    const dsn = resolveDsn(opts.dsn);
+    if (!dsn) return;
+    const parsed = parseDsn(dsn);
+    if (!parsed) return;
+    const ingestHost = opts.region ? resolveIngestHost(opts.region) : parsed.host;
+    const dependencies = collectPreflightDependencies(artifact.projects, PROJECT_TYPE_TO_OSV_ECOSYSTEM);
+    if (dependencies.length === 0) return;
+    const manifest = await fetchRiskySymbols(parsed, ingestHost, dependencies);
+    if (manifest.status !== "ok" || !manifest.advisories) return;
+    artifact.reachability = await analyzeReachability({
+      graph,
+      rootDir,
+      manifest: manifest.advisories,
+      dependencies
+    });
+    if (!opts.quiet && manifest.advisories.length > 0) {
+      const tiers = artifact.reachability.findings.reduce((acc, f) => {
+        acc[f.tier] = (acc[f.tier] ?? 0) + 1;
+        return acc;
+      }, {});
+      const parts = [
+        tiers.reachable ? `${tiers.reachable} reachable` : null,
+        tiers.potentially_reachable ? `${tiers.potentially_reachable} potentially reachable` : null,
+        tiers.not_reached ? `${tiers.not_reached} not reached` : null,
+        tiers.unknown ? `${tiers.unknown} unknown` : null
+      ].filter(Boolean);
+      console.log(
+        chalk8.dim(
+          `Reachability: ${manifest.advisories.length} advisor${manifest.advisories.length === 1 ? "y" : "ies"} checked against the code map \u2014 ${parts.join(", ")}`
+        )
+      );
+    }
+  } catch (e) {
+    if (!opts.quiet) {
+      const msg = e instanceof Error ? e.message : String(e);
+      console.log(chalk8.dim(`Reachability check skipped: ${msg}`));
+    }
+  }
+}
 async function autoPush(artifact, rootDir, opts) {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
@@ -2987,6 +3293,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     invocation: resolveCliInvocation()
   };
   const wantGraph = shouldBuildCodeMap({ graph: opts.graph, maxPrivacy: opts.maxPrivacy, noLocalArtifacts });
+  let builtGraph = null;
   if (wantGraph) {
     scanOpts.postScan = async (report) => {
       const result = await buildGraph({
@@ -2994,6 +3301,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
         exclude: opts.exclude,
         onParseProgress: (done, total) => report(done, total, "parsing")
       });
+      builtGraph = result.graph;
       writeArtifacts(result.graph, { root: rootDir });
       writeSnapshot(rootDir, result.graph.provenance.corpusHash, result.fileStats, {
         exclude: opts.exclude
@@ -3043,6 +3351,9 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
       }
     }
   }
+  if (willPush && hasDsn && builtGraph) {
+    await attachReachability(artifact, rootDir, scanOpts, builtGraph);
+  }
   if (willPush) {
     await autoPush(artifact, rootDir, scanOpts);
   }
@@ -3229,7 +3540,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 ]);
 var MAX_FILES = 8e3;
 var MAX_DEPTH = 12;
-var MAX_FILE_BYTES = 1048576;
+var MAX_FILE_BYTES2 = 1048576;
 var EXT_ECOSYSTEM = {
   ".ts": "npm",
   ".tsx": "npm",
@@ -3294,7 +3605,7 @@ function analyzeTree(root, packages) {
       const full = path.join(dir, entry.name);
       let content;
       try {
-        if (fs6.statSync(full).size > MAX_FILE_BYTES) continue;
+        if (fs6.statSync(full).size > MAX_FILE_BYTES2) continue;
         content = fs6.readFileSync(full, "utf8");
       } catch {
         continue;
@@ -3629,8 +3940,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs15.mkdir(CACHE_DIR, { recursive: true });
-    await fs15.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs12.mkdir(CACHE_DIR, { recursive: true });
+    await fs12.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }