@vibgrate/cli 2026.711.1 → 2026.711.2

package/DOCS.md

@@ -1,6 +1,6 @@
 # Vibgrate CLI — Full Documentation
 
-> Continuous Drift Intelligence for Node, .NET, Python, and Java (all supported in the CLI today)
+> [Code Drift Intelligence](https://vibgrate.com/code-drift-intelligence) across ~19 ecosystems — Node, .NET, Python, Java, Go, Rust, and more
 
 For a quick overview, see the [README](./README.md). This document covers everything in detail.
 
@@ -100,10 +100,10 @@ Vibgrate recursively scans your repository for `package.json` (Node/TypeScript),
 1. **Detects** the runtime version, target framework, and all dependencies
 2. **Queries** the npm/NuGet registry for latest stable versions (with built-in caching and concurrency control)
 3. **Computes** how far behind each component is — major version lag, EOL proximity, dependency age distribution
-4. **Generates** a deterministic DriftScore (0–100)
+4. **Generates** a deterministic [DriftScore](https://vibgrate.com/driftscore) (0–100)
 5. **Produces** findings, a full JSON artifact, and optional SARIF output
 
-Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. Vibgrate Cloud upload remains optional.
+Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. [Vibgrate Cloud](https://vibgrate.com/cloud) upload remains optional.
 
 ---
 
@@ -291,9 +291,9 @@ breaking-change signals, and considers the API surface — the classes and
 functions your code imports — that a new version must preserve.
 
 Security is folded in with **real-world exploitability**. Each upgrade is checked
-against OSV in both directions (advisories **remediated** vs. **introduced**), and
-current-version advisories are cross-referenced with the **CISA KEV** (known-
-exploited) list and **FIRST EPSS** (exploit-probability) scores. A package with a
+against [OSV](https://vibgrate.com/glossary/osv) in both directions (advisories **remediated** vs. **introduced**), and
+current-version advisories are cross-referenced with the [**CISA KEV**](https://vibgrate.com/glossary/kev) (known-
+exploited) list and [**FIRST EPSS**](https://vibgrate.com/glossary/epss) (exploit-probability) scores. A package with a
 known-exploited advisory is treated as must-fix, so the recommendation prioritises
 "fix these few" over churning everything. Advisories with no upgrade path in any
 plan are called out as unresolved.
@@ -409,7 +409,7 @@ vg report [--in <file>] [--format md|text|json]
 
 ### vg sbom
 
-Export SBOMs from an existing scan artifact or compare two artifacts.
+Export [SBOMs](https://vibgrate.com/glossary/sbom) from an existing scan artifact or compare two artifacts.
 
 ```bash
 vg sbom export [--in <file>] [--format cyclonedx|spdx] [--out <file>]
@@ -491,7 +491,7 @@ Expected results:
 
 `vg scan --vulns` matches your installed dependencies against the public OSV database and records each known vulnerability — advisory id and CVE, severity, CVSS, and the fixing version — in the scan artifact, as findings, and in SARIF. Supply advisories in a `--package-manifest` bundle to run it offline.
 
-In a git repository the scan also attributes each finding: the commit, author, and date that introduced the vulnerable version, and how long you have been exposed. These exposure windows aggregate into remediation metrics framed around the EU Cyber Resilience Act (CRA): open counts by severity, mean and maximum time exposed, and per-severity SLA breaches (defaults: critical 7 days, high 30, moderate 90, low 180). The metrics are descriptive — they show whether remediation keeps pace; they are not a compliance certification.
+In a git repository the scan also attributes each finding: the commit, author, and date that introduced the vulnerable version, and how long you have been exposed. These exposure windows aggregate into remediation metrics framed around the [EU Cyber Resilience Act (CRA)](https://vibgrate.com/compliance/cra): open counts by severity, mean and maximum time exposed, and per-severity SLA breaches (defaults: critical 7 days, high 30, moderate 90, low 180). The metrics are descriptive — they show whether remediation keeps pace; they are not a compliance certification.
 
 The scan also reconstructs **closed** exposure windows from history — a vulnerable version that was later bumped out of the affected range or removed from the lockfile entirely — and reports real remediation time (MTTR) from them: measured, not estimated. Offline, a package-version manifest extends this to advisories that are fully fixed today, so a dependency that is clean now but was once vulnerable still counts toward your remediation record.
 
@@ -855,7 +855,7 @@ Add `--json` for machine-readable output.
 
 ### vg serve
 
-Start Vibgrate AI Context — a local-first MCP serving your code map, drift, and version-correct docs to your AI assistant (fully offline under `--local`).
+Start [Vibgrate AI Context](https://vibgrate.com/library) — a local-first [MCP](https://vibgrate.com/glossary/model-context-protocol) serving your code map, drift, and version-correct docs to your AI assistant (fully offline under `--local`).
 
 ```bash
 vg serve
@@ -1027,6 +1027,8 @@ The DriftScore is a deterministic, versioned metric (0–100) that represents ho
 
 **Lower score = healthier upgrade posture.** 0 means no drift (fully current); 100 means maximum drift. Higher is worse.
 
+The methodology is published: see the [public scoring specification](./docs/public/SCORING-METHODOLOGY-PUBLIC.md) in this repository and the overview at [vibgrate.com/driftscore](https://vibgrate.com/driftscore).
+
 ### Risk Levels
 
 | Score  | Risk Level                           |
@@ -1482,7 +1484,7 @@ import type {
 
 ## Requirements
 
-- **Node.js** >= 20.0.0
+- **Node.js** >= 22.0.0
 - Works on macOS, Linux, and Windows
 
 ---
@@ -1490,6 +1492,17 @@ import type {
 ## Links
 
 - [Website](https://vibgrate.com)
+- [Vibgrate CLI — live demo and simulator](https://vibgrate.com/cli)
+- [CLI benchmarks](https://vibgrate.com/cli/benchmarks) · [methodology](https://vibgrate.com/cli/benchmarks/methodology) · [token savings](https://vibgrate.com/cli/benchmarks/token-savings)
+- [DriftScore](https://vibgrate.com/driftscore)
+- [Vibgrate AI Context (local-first MCP)](https://vibgrate.com/library)
+- [Vibgrate Graph](https://vibgrate.com/graph)
+- [Vibgrate Cloud](https://vibgrate.com/cloud) · [create a free workspace](https://dash.vibgrate.com)
+- [Vibgrate MCP (hosted)](https://vibgrate.com/mcp)
+- [AI agent skills](https://vibgrate.com/skills)
+- [Glossary](https://vibgrate.com/glossary)
+- [Help center](https://vibgrate.com/help)
+- [Changelog](https://vibgrate.com/changelog)
 - [npm](https://www.npmjs.com/package/@vibgrate/cli)
 
 ---

package/README.md

@@ -19,8 +19,8 @@
 
 `vg` answers two questions for any repo:
 
-1. **What is this codebase?** — A deterministic code graph: call trees, import paths, impact surfaces, dependency facts.
-2. **How far behind is it?** — A ranked **DriftScore** (0–100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list.
+1. **What is this codebase?** — A deterministic [code graph](https://vibgrate.com/graph): call trees, import paths, impact surfaces, dependency facts.
+2. **How far behind is it?** — A ranked **[DriftScore](https://vibgrate.com/driftscore)** (0–100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list.
 
 Everything runs **on your machine**. No API key, no network call, no data leaving your repo unless you explicitly push. The `vibgrate` command is an alias for `vg` — they are interchangeable.
 
@@ -68,7 +68,7 @@ npx vg scan                     # vg is the primary command; vibgrate is an alia
 
 ## Use it with your AI assistant
 
-`vg serve` starts **Vibgrate AI Context** — a local-first MCP server that
+`vg serve` starts **[Vibgrate AI Context](https://vibgrate.com/library)** — a local-first [MCP](https://vibgrate.com/glossary/model-context-protocol) server that
 gives any MCP-compatible assistant (Claude, Cursor, Windsurf, Copilot, Gemini
 CLI, …) your code map, **offline drift**, local models, and **version-correct
 library docs**, all from your machine (no account, nothing uploaded; thin
@@ -85,7 +85,7 @@ vg install                      # interactive: pick your assistant(s) and done
 vg install --all                # install for every detected assistant at once
 ```
 
-This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs — all from local data.
+This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs — all from local data. The token savings are measured and published, methodology included, at [vibgrate.com/cli/benchmarks/token-savings](https://vibgrate.com/cli/benchmarks/token-savings).
 
 Browse all 21+ supported assistants and their skill descriptions at **[vibgrate.com/skills](https://vibgrate.com/skills)**.
 
@@ -129,21 +129,21 @@ One scan gives you:
 - **Score breakdown** — runtime, frameworks, dependencies, EOL
 - **Per-project detail** across Node.js/TypeScript, .NET, Python, and Java
 - **Actionable findings** ranked by likely impact
-- **SBOM export** (CycloneDX / SPDX)
+- **[SBOM](https://vibgrate.com/glossary/sbom) export** (CycloneDX / SPDX)
 - **Known vulnerabilities** (opt in with `--vulns`) — severity, CVSS, the fixing version, and, in a git repo, who introduced them
 
 ---
 
 ## Find known vulnerabilities and who introduced them
 
-`vg scan --vulns` checks your installed dependencies against the public OSV database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it — as text, JSON, or SARIF. Add `--package-manifest` to run it fully offline from a local advisory bundle.
+`vg scan --vulns` checks your installed dependencies against the public [OSV](https://vibgrate.com/glossary/osv) database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it — as text, JSON, or SARIF. Add `--package-manifest` to run it fully offline from a local advisory bundle.
 
 ```bash
 vg scan --vulns                 # drift score + known vulnerabilities
 vg scan --full                  # drift + vulnerabilities + a banned-dependency report
 ```
 
-In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA) — per-severity time-exposed and SLA breaches — so "are we fixing things fast enough?" has a number.
+In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the [EU Cyber Resilience Act (CRA)](https://vibgrate.com/compliance/cra) — per-severity time-exposed and SLA breaches — so "are we fixing things fast enough?" has a number.
 
 ```bash
 vg why lodash                   # who added a dependency, every version since, and any open vulnerabilities
@@ -158,7 +158,7 @@ Your AI assistant sees this too: `vg serve` exposes `list_vulnerabilities`, `vul
 
 ## Track drift over time → create a free workspace
 
-The CLI is fully useful offline. When you want **trends across runs and repos** — so drift becomes a metric you manage, not a surprise you discover — push scans to a workspace:
+The CLI is fully useful offline. When you want **trends across runs and repos** — so drift becomes a metric you manage, not a surprise you discover — push scans to a [Vibgrate Cloud](https://vibgrate.com/cloud) workspace:
 
 1. **Create a workspace** at **[dash.vibgrate.com](https://dash.vibgrate.com)** and copy your DSN.
 2. **Connect and push:**
@@ -244,6 +244,8 @@ vg scan --offline --package-manifest ./package-versions.zip --max-privacy --form
 
 Add `.vibgrate/` to your `.gitignore` — those are regenerated local outputs.
 
+More on how Vibgrate handles code and data: [vibgrate.com/security](https://vibgrate.com/security).
+
 ---
 
 ## Quick start with AI assistants
@@ -325,7 +327,7 @@ Full flag and configuration reference: **[DOCS.md](./DOCS.md)** · **[vibgrate.c
 
 ## Why teams adopt Vibgrate
 
-Most systems don't fail all at once — they accumulate upgrade debt and architectural drift silently until migrations become expensive. `vg` makes that debt measurable and repeatable, and gives AI assistants the local context they need to be useful:
+Most systems don't fail all at once — they accumulate upgrade debt and architectural [drift](https://vibgrate.com/glossary/code-drift) silently until migrations become expensive. `vg` makes that debt measurable and repeatable — the practice we call [Code Drift Intelligence](https://vibgrate.com/code-drift-intelligence) — and gives AI assistants the local context they need to be useful:
 
 | Mode | What you get | Best for |
 | --- | --- | --- |
@@ -363,7 +365,9 @@ When `@vibgrate/cli` is installed, it registers **both** bin entries uncondition
    · 
   <a href="https://vibgrate.com/cli">Try the live demo</a>
   &nbsp;·&nbsp;
-  <a href="./DOCS.md">Vibgrate AI Context (local MCP)</a>
+  <a href="https://vibgrate.com/cli/benchmarks">Benchmarks</a>
+  &nbsp;·&nbsp;
+  <a href="https://vibgrate.com/library">Vibgrate AI Context (local MCP)</a>
   &nbsp;·&nbsp;
   <a href="https://vibgrate.com/mcp">Vibgrate MCP (hosted)</a>
   &nbsp;·&nbsp;

package/dist/baseline-SRVG4ZAD.js

@@ -0,0 +1,6 @@
+export { baselineCommand, runBaseline } from './chunk-4IHO6VUL.js';
+import './chunk-NNU2PW2H.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+//# sourceMappingURL=baseline-SRVG4ZAD.js.map
+//# sourceMappingURL=baseline-SRVG4ZAD.js.map

package/dist/{baseline-V5XGS76K.js.map → baseline-SRVG4ZAD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-V5XGS76K.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-SRVG4ZAD.js"}

package/dist/{chunk-3BWPEPWH.js → chunk-4IHO6VUL.js}

@@ -1,4 +1,4 @@
-import { runCoreScan, writeJsonFile, compactUiPurpose } from './chunk-2PCL4ZME.js';
+import { runCoreScan, writeJsonFile, compactUiPurpose } from './chunk-NNU2PW2H.js';
 import { findPackageJsonFiles, readJsonFile, findFiles, readTextFile, pathExists } from './chunk-GI6W53LM.js';
 import * as path3 from 'path';
 import { Command } from 'commander';
@@ -3731,5 +3731,5 @@ var baselineCommand = new Command("baseline").description("Create a drift baseli
 });
 
 export { baselineCommand, loadAdvancedScanHook, runBaseline };
-//# sourceMappingURL=chunk-3BWPEPWH.js.map
-//# sourceMappingURL=chunk-3BWPEPWH.js.map
+//# sourceMappingURL=chunk-4IHO6VUL.js.map
+//# sourceMappingURL=chunk-4IHO6VUL.js.map