@vibgrate/cli 2026.711.1 → 2026.715.1

package/dist/{chunk-MIJ3ZSSF.js → chunk-D4BPWARI.js}

@@ -1,5 +1,5 @@
-import { hashString, langById, shortId, canonicalize, grammarSetVersion, hashBytes, langForExtension, setGrammarsOverride, parseSource } from './chunk-X5YT263H.js';
-import { writeTextFile, pathExists, readJsonFile, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem, VERSION } from './chunk-2PCL4ZME.js';
+import { hashString, langById, shortId, canonicalize, grammarSetVersion, hashBytes, langForExtension, setGrammarsOverride, parseSource } from './chunk-VFO5UDAT.js';
+import { writeTextFile, pathExists, readJsonFile, loadConfig, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem, VERSION } from './chunk-C5AVF7PT.js';
 import * as fs19 from 'fs';
 import { spawnSync, execFileSync } from 'child_process';
 import * as path19 from 'path';
@@ -15,6 +15,7 @@ import { fileURLToPath } from 'url';
 import ts from 'typescript';
 import { bidirectional } from 'graphology-shortest-path/unweighted.js';
 import * as crypto from 'crypto';
+import { createHash } from 'crypto';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import * as zlib from 'zlib';
@@ -702,6 +703,73 @@ function edgeId(kind, src, dst) {
   return shortId(canonicalize({ t: "edge", kind, src, dst }));
 }
 
+// src/engine/tests.ts
+function isTestFile(rel2) {
+  const lower = rel2.toLowerCase();
+  const base = rel2.split("/").pop() ?? rel2;
+  const lbase = base.toLowerCase();
+  if (/(^|\/)(__tests__|__test__)\//.test(lower)) return true;
+  if (/(^|\/)(tests?|spec|specs)\//.test(lower)) return true;
+  if (/(^|\/)src\/test\//.test(lower)) return true;
+  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(lbase)) return true;
+  if (/^test_.*\.py$/.test(lbase) || /_test\.py$/.test(lbase)) return true;
+  if (/_test\.go$/.test(lbase)) return true;
+  if (/[A-Za-z0-9](Test|Tests|IT)\.java$/.test(base)) return true;
+  if (/_spec\.rb$/.test(lbase) || /_test\.rb$/.test(lbase)) return true;
+  if (/[A-Za-z0-9](Test|Tests)\.cs$/.test(base)) return true;
+  if (/[A-Za-z0-9](Test|Tests)\.swift$/.test(base)) return true;
+  return false;
+}
+function applyStaticTestLinkage(nodes, edges) {
+  const byId = new Map(nodes.map((n) => [n.id, n]));
+  const testFiles = /* @__PURE__ */ new Set();
+  for (const n of nodes) if (n.kind === "file" && isTestFile(n.file)) testFiles.add(n.file);
+  const fileNodeIdByRel = /* @__PURE__ */ new Map();
+  for (const n of nodes) if (n.kind === "file") fileNodeIdByRel.set(n.file, n.id);
+  const covered = /* @__PURE__ */ new Set();
+  const newEdges = /* @__PURE__ */ new Map();
+  for (const e of edges) {
+    if (e.kind !== "call") continue;
+    const src = byId.get(e.src);
+    const dst = byId.get(e.dst);
+    if (!src || !dst) continue;
+    if (testFiles.has(src.file) && !testFiles.has(dst.file) && dst.kind !== "external") {
+      const testFileId = fileNodeIdByRel.get(src.file);
+      if (!testFileId) continue;
+      const id = edgeId("test", testFileId, dst.id);
+      if (!newEdges.has(id)) {
+        newEdges.set(id, {
+          id,
+          kind: "test",
+          src: testFileId,
+          dst: dst.id,
+          resolution: e.resolution,
+          confidence: e.confidence
+        });
+      }
+      covered.add(dst.id);
+    }
+  }
+  const outNodes = nodes.map((n) => ({ ...n, tested: testedFlag(n, covered.has(n.id), testFiles) }));
+  const outEdges = [...edges, ...newEdges.values()].sort(
+    (a, b) => a.kind.localeCompare(b.kind) || a.src.localeCompare(b.src) || a.dst.localeCompare(b.dst)
+  );
+  return {
+    nodes: outNodes,
+    edges: outEdges,
+    testFiles: [...testFiles].sort(),
+    testEdgeCount: newEdges.size
+  };
+}
+function testedFlag(node, covered, testFiles) {
+  if (node.kind === "external" || node.kind === "file" || node.kind === "package" || node.kind === "module") {
+    return null;
+  }
+  if (testFiles.has(node.file)) return null;
+  if (node.kind === "function" || node.kind === "method") return covered;
+  return covered ? true : node.tested ?? null;
+}
+
 // src/engine/scip.ts
 var ROLE_DEFINITION = 1;
 var Reader = class {
@@ -1064,72 +1132,6 @@ function round(x) {
 function pairKey(a, b) {
   return a < b ? `${a}|${b}` : `${b}|${a}`;
 }
-
-// src/engine/tests.ts
-function isTestFile(rel2) {
-  const lower = rel2.toLowerCase();
-  const base = rel2.split("/").pop() ?? rel2;
-  const lbase = base.toLowerCase();
-  if (/(^|\/)(__tests__|__test__)\//.test(lower)) return true;
-  if (/(^|\/)(tests?|spec|specs)\//.test(lower)) return true;
-  if (/(^|\/)src\/test\//.test(lower)) return true;
-  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(lbase)) return true;
-  if (/^test_.*\.py$/.test(lbase) || /_test\.py$/.test(lbase)) return true;
-  if (/_test\.go$/.test(lbase)) return true;
-  if (/[A-Za-z0-9](Test|Tests|IT)\.java$/.test(base)) return true;
-  if (/_spec\.rb$/.test(lbase) || /_test\.rb$/.test(lbase)) return true;
-  if (/[A-Za-z0-9](Test|Tests)\.cs$/.test(base)) return true;
-  return false;
-}
-function applyStaticTestLinkage(nodes, edges) {
-  const byId = new Map(nodes.map((n) => [n.id, n]));
-  const testFiles = /* @__PURE__ */ new Set();
-  for (const n of nodes) if (n.kind === "file" && isTestFile(n.file)) testFiles.add(n.file);
-  const fileNodeIdByRel = /* @__PURE__ */ new Map();
-  for (const n of nodes) if (n.kind === "file") fileNodeIdByRel.set(n.file, n.id);
-  const covered = /* @__PURE__ */ new Set();
-  const newEdges = /* @__PURE__ */ new Map();
-  for (const e of edges) {
-    if (e.kind !== "call") continue;
-    const src = byId.get(e.src);
-    const dst = byId.get(e.dst);
-    if (!src || !dst) continue;
-    if (testFiles.has(src.file) && !testFiles.has(dst.file) && dst.kind !== "external") {
-      const testFileId = fileNodeIdByRel.get(src.file);
-      if (!testFileId) continue;
-      const id = edgeId("test", testFileId, dst.id);
-      if (!newEdges.has(id)) {
-        newEdges.set(id, {
-          id,
-          kind: "test",
-          src: testFileId,
-          dst: dst.id,
-          resolution: e.resolution,
-          confidence: e.confidence
-        });
-      }
-      covered.add(dst.id);
-    }
-  }
-  const outNodes = nodes.map((n) => ({ ...n, tested: testedFlag(n, covered.has(n.id), testFiles) }));
-  const outEdges = [...edges, ...newEdges.values()].sort(
-    (a, b) => a.kind.localeCompare(b.kind) || a.src.localeCompare(b.src) || a.dst.localeCompare(b.dst)
-  );
-  return {
-    nodes: outNodes,
-    edges: outEdges,
-    testFiles: [...testFiles].sort(),
-    testEdgeCount: newEdges.size
-  };
-}
-function testedFlag(node, covered, testFiles) {
-  if (node.kind === "external" || node.kind === "file" || node.kind === "package" || node.kind === "module") {
-    return null;
-  }
-  if (testFiles.has(node.file)) return null;
-  if (node.kind === "function" || node.kind === "method") return covered;
-  return covered ? true : node.tested ?? null;
-}
 var DEFAULT_PATHS = [
   "coverage/lcov.info",
   "lcov.info",
@@ -1569,6 +1571,7 @@ function emptyParse(file, warning) {
     calls: [],
     imports: [],
     heritage: [],
+    typeRefs: [],
     guards: [],
     warnings: [warning]
   };
@@ -1666,9 +1669,10 @@ function resolve4(parses, resolver) {
     const fileId = fileNodeIdByRel.get(p.rel);
     const localDefs = defsByFile.get(p.rel) ?? [];
     const imported = importedFilesByRel.get(p.rel) ?? /* @__PURE__ */ new Set();
+    const testCaller = isTestFile(p.rel);
     for (const call of p.calls) {
       const srcId = enclosingDefId(localDefs, call.byte) ?? fileId;
-      const resolved = resolveCall(call, p.rel, p.lang, imported, defsByName, srcId);
+      const resolved = resolveCall(call, p.rel, p.lang, imported, defsByName, srcId, testCaller);
       if (resolved) {
         edges.add("call", srcId, resolved.id, "heuristic", resolved.confidence);
         stats.callsResolved++;
@@ -1678,13 +1682,25 @@ function resolve4(parses, resolver) {
       }
     }
   }
+  for (const p of parses) {
+    const fileId = fileNodeIdByRel.get(p.rel);
+    const localDefs = defsByFile.get(p.rel) ?? [];
+    const imported = importedFilesByRel.get(p.rel) ?? /* @__PURE__ */ new Set();
+    const testCaller = isTestFile(p.rel);
+    for (const ref of p.typeRefs) {
+      const srcId = enclosingDefId(localDefs, ref.byte) ?? fileId;
+      const target = resolveType(ref.name, p.rel, p.lang, imported, defsByName, testCaller);
+      if (target) edges.add("references", srcId, target.id, "heuristic", 0.7);
+    }
+  }
   for (const p of parses) {
     const localDefs = defsByFile.get(p.rel) ?? [];
     const imported = importedFilesByRel.get(p.rel) ?? /* @__PURE__ */ new Set();
+    const testCaller = isTestFile(p.rel);
     for (const h of p.heritage) {
       const srcId = enclosingDefId(localDefs, h.byte);
       if (!srcId) continue;
-      const target = resolveType(h.superName, p.rel, p.lang, imported, defsByName);
+      const target = resolveType(h.superName, p.rel, p.lang, imported, defsByName, testCaller);
       if (target) edges.add(h.kind, srcId, target.id, "heuristic", 0.85);
       else bumpUnresolved(unresolved2, srcId, h.superName, h.kind, p.rel);
     }
@@ -1749,7 +1765,7 @@ function dirOf(rel2) {
   const i = rel2.lastIndexOf("/");
   return i >= 0 ? rel2.slice(0, i) : "";
 }
-function resolveCall(call, fromRel, fromLang, importedRels, defsByName, enclosingId) {
+function resolveCall(call, fromRel, fromLang, importedRels, defsByName, enclosingId, fromIsTestFile = false) {
   const candidates = defsByName.get(call.callee);
   if (!candidates || candidates.length === 0) return null;
   const callable = candidates.filter((c) => c.kind === "function" || c.kind === "method");
@@ -1770,9 +1786,12 @@ function resolveCall(call, fromRel, fromLang, importedRels, defsByName, enclosin
     if (call.qualified && enclosingId) samePkg = samePkg.filter((c) => c.id !== enclosingId);
     if (samePkg.length === 1) return { id: samePkg[0].id, confidence: 0.7 };
   }
+  if (fromLang === "swift" && fromIsTestFile && pool.length === 1) {
+    return { id: pool[0].id, confidence: 0.5 };
+  }
   return null;
 }
-function resolveType(name, fromRel, fromLang, importedRels, defsByName) {
+function resolveType(name, fromRel, fromLang, importedRels, defsByName, fromIsTestFile = false) {
   const candidates = (defsByName.get(name) ?? []).filter(
     (c) => c.kind === "class" || c.kind === "interface"
   );
@@ -1787,6 +1806,9 @@ function resolveType(name, fromRel, fromLang, importedRels, defsByName) {
     const samePkg = candidates.filter((c) => c.lang === fromLang && dirOf(c.rel) === dir);
     if (samePkg.length === 1) return { id: samePkg[0].id };
   }
+  if (fromLang === "swift" && fromIsTestFile && candidates.length === 1) {
+    return { id: candidates[0].id };
+  }
   return null;
 }
 var EdgeSet = class {
@@ -2984,13 +3006,19 @@ var GraphIndex = class {
   node(id) {
     return this.nodeById.get(id);
   }
-  /** Resolved nodes called by `id`. */
+  /**
+   * Resolved nodes called by `id` — invocations (`call`) plus structural
+   * dependency references (`references`, e.g. a constructor-injected field's
+   * type), since both represent real usage a caller/impact question cares
+   * about. `references` is otherwise only emitted by the precise SCIP/tsc
+   * rungs and (for Java DI wiring) the heuristic rung — never a guess.
+   */
   callees(id) {
-    return this.resolveTargets(this.out(id, "call"), "dst");
+    return this.resolveTargets(this.out(id).filter(isUsageEdge), "dst");
   }
-  /** Resolved nodes that call `id`. */
+  /** Resolved nodes that call or structurally reference `id`. */
   callers(id) {
-    return this.resolveTargets(this.in(id, "call"), "src");
+    return this.resolveTargets(this.in(id).filter(isUsageEdge), "src");
   }
   resolveTargets(edges, end) {
     const out = [];
@@ -3001,6 +3029,10 @@ var GraphIndex = class {
     return out;
   }
 };
+var USAGE_KINDS = /* @__PURE__ */ new Set(["call", "references"]);
+function isUsageEdge(e) {
+  return USAGE_KINDS.has(e.kind);
+}
 function push2(map, key, value) {
   const list = map.get(key);
   if (list) list.push(value);
@@ -3058,7 +3090,26 @@ var STOPWORDS = /* @__PURE__ */ new Set([
   "from",
   "by",
   "at",
-  "as"
+  "as",
+  // Discovery-question scaffolding: words a caller uses to FRAME the ask
+  // ("find the code responsible for X", "I need to modify X, where do I
+  // start?", "explain how X works in this codebase") rather than to name the
+  // target. Left in, these compete on equal footing with the real identifier
+  // terms and can outrank it outright — e.g. "find the code responsible for
+  // deleteAsync" let "find" alone drag in every FindByIdAsync/FindAll method
+  // in the repo, none of them the target (VG-LOCATE-FAILURE-ANALYSIS.md).
+  "find",
+  "code",
+  "responsible",
+  "need",
+  "modify",
+  "me",
+  "implementation",
+  "explain",
+  "works",
+  "codebase",
+  "contains",
+  "file"
 ]);
 function queryGraph(graph, question, options = {}) {
   const budget = options.budget ?? 2e3;
@@ -3114,7 +3165,7 @@ async function queryGraphSemantic(graph, question, options) {
 function tokenize(q2) {
   return [
     ...new Set(
-      q2.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 2 && !STOPWORDS.has(t))
+      q2.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((t) => t.length >= 1 && !STOPWORDS.has(t))
     )
   ];
 }
@@ -3172,7 +3223,7 @@ function termWeights(graph, terms) {
 }
 function identifierParts(name) {
   return new Set(
-    name.split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean).map((s) => s.toLowerCase())
+    name.split(/[^\p{L}\p{N}]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/u).filter(Boolean).map((s) => s.toLowerCase())
   );
 }
 function fuzzyPartMatch(term, parts) {
@@ -3675,10 +3726,10 @@ var MANIFEST_BY_FILE = {
 };
 function findManifests(root) {
   const set = Object.fromEntries(ECOSYSTEMS.map((e) => [e, []]));
-  const MAX_ENTRIES = 2e4;
+  const MAX_ENTRIES2 = 2e4;
   let scanned = 0;
   const walk2 = (dir, depth) => {
-    if (depth > 8 || scanned > MAX_ENTRIES) return;
+    if (depth > 8 || scanned > MAX_ENTRIES2) return;
     let entries;
     try {
       entries = fs19.readdirSync(dir, { withFileTypes: true });
@@ -3687,7 +3738,7 @@ function findManifests(root) {
     }
     for (const e of entries) {
       scanned++;
-      if (scanned > MAX_ENTRIES) break;
+      if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
         if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path19.join(dir, e.name), depth + 1);
         continue;
@@ -4937,6 +4988,20 @@ function dedupeRoutes(routes) {
 // src/reporting/utils/compact-artifact.ts
 var gzip2 = promisify(zlib.gzip);
 var MAX_ITEMS = 50;
+var MAX_DB_MODELS = 300;
+var MAX_DB_FIELDS_PER_MODEL = 100;
+var MAX_DB_MODEL_FILES = 5;
+var MAX_DB_FILES_SCANNED = 500;
+var DB_UPLOAD_HARD_CEILING = {
+  maxModels: 2e3,
+  maxFieldsPerModel: 500,
+  maxFilesPerModel: 20,
+  maxFilesScanned: 5e3
+};
+function clampCap(configured, fallback, ceiling) {
+  if (typeof configured !== "number" || !Number.isFinite(configured) || configured <= 0) return fallback;
+  return Math.min(Math.floor(configured), ceiling);
+}
 function extractName(entry) {
   const match = entry.match(/^(.+?)\s*\(/);
   return match ? match[1].trim() : entry.trim();
@@ -5002,7 +5067,29 @@ function compactAssetBranding(result) {
     // Don't include logos
   };
 }
-function prepareArtifactForUpload(artifact) {
+function compactDatabaseSchema(result, caps) {
+  const maxModels = clampCap(caps?.maxModels, MAX_DB_MODELS, DB_UPLOAD_HARD_CEILING.maxModels);
+  const maxFieldsPerModel = clampCap(caps?.maxFieldsPerModel, MAX_DB_FIELDS_PER_MODEL, DB_UPLOAD_HARD_CEILING.maxFieldsPerModel);
+  const maxFilesPerModel = clampCap(caps?.maxFilesPerModel, MAX_DB_MODEL_FILES, DB_UPLOAD_HARD_CEILING.maxFilesPerModel);
+  const maxFilesScanned = clampCap(caps?.maxFilesScanned, MAX_DB_FILES_SCANNED, DB_UPLOAD_HARD_CEILING.maxFilesScanned);
+  return {
+    providers: result.providers.slice(0, MAX_ITEMS),
+    models: result.models.slice(0, maxModels).map((model) => ({
+      ...model,
+      fields: model.fields.slice(0, maxFieldsPerModel),
+      files: model.files.slice(0, maxFilesPerModel)
+    })),
+    enums: result.enums.slice(0, MAX_ITEMS),
+    filesScanned: result.filesScanned.slice(0, maxFilesScanned),
+    projects: result.projects.slice(0, MAX_ITEMS).map((project) => ({
+      project: project.project,
+      filesScanned: project.filesScanned.slice(0, MAX_ITEMS),
+      models: project.models.slice(0, MAX_ITEMS),
+      enums: project.enums.slice(0, MAX_ITEMS)
+    }))
+  };
+}
+function prepareArtifactForUpload(artifact, opts) {
   const compacted = { ...artifact };
   if (compacted.extended) {
     const ext = { ...compacted.extended };
@@ -5078,6 +5165,9 @@ function prepareArtifactForUpload(artifact) {
         duplicatedPackages: ext.dependencyGraph.duplicatedPackages.slice(0, MAX_ITEMS)
       };
     }
+    if (ext.databaseSchema) {
+      ext.databaseSchema = compactDatabaseSchema(ext.databaseSchema, opts?.databaseSchemaCaps);
+    }
     compacted.extended = ext;
   }
   return compacted;
@@ -5086,8 +5176,8 @@ async function compressArtifact(artifact) {
   const json = JSON.stringify(artifact);
   return gzip2(json, { level: 9 });
 }
-async function prepareCompressedUpload(artifact) {
-  const compacted = prepareArtifactForUpload(artifact);
+async function prepareCompressedUpload(artifact, opts) {
+  const compacted = prepareArtifactForUpload(artifact, opts);
   const compressed = await compressArtifact(compacted);
   return { body: compressed, contentEncoding: "gzip" };
 }
@@ -5100,8 +5190,9 @@ function postOnce(input, host) {
       "Content-Encoding": input.contentEncoding,
       "X-Vibgrate-Timestamp": input.timestamp,
       "Authorization": `VibgrateDSN ${input.keyId}:${input.secret}`,
-      "Connection": "close"
+      "Connection": "close",
       // Prevent keep-alive delays on exit
+      ...input.runId && input.runToken ? { "X-Vibgrate-Run-Id": input.runId, "X-Vibgrate-Run-Token": input.runToken } : {}
     },
     body: input.body
   });
@@ -5169,7 +5260,9 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
     return;
   }
   const artifact = await readJsonFile(filePath);
-  const { body, contentEncoding } = await prepareCompressedUpload(artifact);
+  const config = await loadConfig(process.cwd());
+  const databaseSchemaCaps = config.scanners !== false ? config.scanners?.databaseSchema : void 0;
+  const { body, contentEncoding } = await prepareCompressedUpload(artifact, { databaseSchemaCaps });
   const timestamp = String(Date.now());
   let host = parsed.host;
   if (opts.region) {
@@ -5193,7 +5286,11 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
       secret: parsed.secret,
       body,
       contentEncoding,
-      timestamp
+      timestamp,
+      // Set only by an automated caller running the scan on the workspace's
+      // behalf (e.g. a Vibgrate-hosted remediation run) — never a customer flag.
+      runId: process.env.VIBGRATE_SCAN_RUN_ID,
+      runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN
     });
     host = uploadedHost;
     if (!response.ok) {
@@ -5604,6 +5701,65 @@ async function publishPrivateLibrary(req, opts = {}) {
   }
 }
 
+// src/engine/hosted-cache.ts
+var CACHE_VERSION2 = "vg-hosted-docs/1";
+var HOSTED_DOCS_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_ENTRIES = 64;
+function cachePath2(root) {
+  return path19.join(cacheDir(root), "hosted-docs.json");
+}
+function hostedDocsCacheKey(req, opts = {}) {
+  const material = JSON.stringify([
+    req.name ?? "",
+    req.targetId ?? "",
+    req.query ?? "",
+    req.verbosity ?? "",
+    req.maxTokens ?? 0,
+    hostedBase(opts),
+    opts.auth?.keyId ?? "anon"
+  ]);
+  return createHash("sha256").update(material).digest("hex");
+}
+function loadFile(root) {
+  try {
+    const parsed = JSON.parse(fs19.readFileSync(cachePath2(root), "utf8"));
+    if (parsed && parsed.version === CACHE_VERSION2 && parsed.entries && typeof parsed.entries === "object") return parsed;
+  } catch {
+  }
+  return { version: CACHE_VERSION2, entries: {} };
+}
+function saveFile(root, file) {
+  try {
+    const keys = Object.keys(file.entries);
+    if (keys.length > MAX_ENTRIES) {
+      for (const k of keys.sort((a, b) => file.entries[a].at - file.entries[b].at).slice(0, keys.length - MAX_ENTRIES)) {
+        delete file.entries[k];
+      }
+    }
+    fs19.mkdirSync(cacheDir(root), { recursive: true });
+    fs19.writeFileSync(cachePath2(root), JSON.stringify(file));
+  } catch {
+  }
+}
+async function fetchHostedDocsCached(root, req, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const ttl = opts.ttlMs ?? HOSTED_DOCS_TTL_MS;
+  const key = hostedDocsCacheKey(req, opts);
+  const file = loadFile(root);
+  if (!opts.bypass) {
+    const hit = file.entries[key];
+    if (hit && now() - hit.at < ttl && hit.result?.content) {
+      return { ...hit.result, metadata: { ...hit.result.metadata ?? {}, cached: true } };
+    }
+  }
+  const result = await fetchHostedDocs(req, opts);
+  if (result) {
+    file.entries[key] = { at: now(), result };
+    saveFile(root, file);
+  }
+  return result;
+}
+
 // src/mcp/response.ts
 var MAX_RESULT_TOKENS = 25e3;
 function renderToolResult(result, maxTokens = MAX_RESULT_TOKENS) {
@@ -5825,6 +5981,9 @@ async function searchSymbols(graph, root, query, limit) {
   if (!q2) return { matches: [], moreAvailable: false, hint: "query is required" };
   const isPhrase = /\s/.test(q2);
   let nodes = findNodes(graph, q2).filter((n) => n.kind !== "file");
+  if (nodes.length === 0 && isPhrase) {
+    nodes = reconstructedIdentifierNodes(graph, q2);
+  }
   if (nodes.length === 0) {
     const tokens = queryTokens(q2);
     if (tokens.length >= 2) nodes = multiTokenNodes(graph, tokens);
@@ -5867,6 +6026,14 @@ async function searchSymbols(graph, root, query, limit) {
 function queryTokens(q2) {
   return [...new Set(q2.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 2))];
 }
+function reconstructedIdentifierNodes(graph, q2) {
+  const words = q2.trim().split(/\s+/).filter(Boolean);
+  if (words.length < 2) return [];
+  const concat = findNodes(graph, words.join(""));
+  if (concat.length) return concat.filter((n) => n.kind !== "file");
+  const snake = findNodes(graph, words.join("_"));
+  return snake.filter((n) => n.kind !== "file");
+}
 function multiTokenNodes(graph, tokens) {
   const cov = /* @__PURE__ */ new Map();
   for (const t of tokens) {
@@ -6546,7 +6713,8 @@ var TOOLS = [
         return (async () => {
           const dsn = resolveDsn();
           const parsed = dsn ? parseDsn(dsn) : null;
-          const hosted = await fetchHostedDocs(
+          const hosted = await fetchHostedDocsCached(
+            ctx.root,
             { name: entry?.name ?? id, targetId: entry?.id, query: query || void 0, maxTokens: budget },
             { auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
           );
@@ -7323,6 +7491,6 @@ function spdx(ctx) {
   return JSON.stringify(doc, null, 2) + "\n";
 }
 
-export { ASSISTANTS, CLI_TOOL_ALIASES, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, NPX_INVOCATION, ResourceLimitError, SCHEMA_VERSION, SKIP_DIRS, SKIP_FILES, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, countTokens, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, epistemicBreakdown, exportGraph, fetchHostedDocs, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, indexFor, ingestHostForRegionId, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, readUsage, recordCliCall, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveCliInvocation, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveLimits, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeNavigationConfig, writeSnapshot, writeStoredCredentials };
-//# sourceMappingURL=chunk-MIJ3ZSSF.js.map
-//# sourceMappingURL=chunk-MIJ3ZSSF.js.map
+export { ASSISTANTS, CLI_TOOL_ALIASES, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, NPX_INVOCATION, ResourceLimitError, SCHEMA_VERSION, SKIP_DIRS, SKIP_FILES, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, countTokens, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, epistemicBreakdown, exportGraph, fetchHostedDocsCached, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, indexFor, ingestHostForRegionId, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, readUsage, recordCliCall, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveCliInvocation, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveLimits, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeNavigationConfig, writeSnapshot, writeStoredCredentials };
+//# sourceMappingURL=chunk-D4BPWARI.js.map
+//# sourceMappingURL=chunk-D4BPWARI.js.map