@vibgrate/cli 2026.711.2 → 2026.717.1

package/dist/cli.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-75ZJYYJE.js';
-import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-4IHO6VUL.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-NNU2PW2H.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, detectAssistants, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady, SKIP_DIRS, SKIP_FILES } from './chunk-L42NVMD6.js';
+import { resolvedGrammarFiles, grammarSetVersion, hashString, canonicalize, hashBytes } from './chunk-VFO5UDAT.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-WZNIDXZP.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-M62BGJMK.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import * as fs6 from 'fs';
-import fs6__default, { realpathSync } from 'fs';
+import * as fs8 from 'fs';
+import fs8__default, { realpathSync } from 'fs';
 import * as path from 'path';
 import path__default from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
 import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
 import chalk8 from 'chalk';
 import * as os from 'os';
-import * as fs12 from 'fs/promises';
+import * as fs14 from 'fs/promises';
 import * as readline from 'readline';
 import semver from 'semver';
 
@@ -178,14 +178,14 @@ async function signGraphAttestation(root, graph, opts) {
   const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
   const keyPath = explicitKey ? path.resolve(explicitKey) : path.join(root, ".vibgrate", DEFAULT_KEY);
   let keyGeneratedAt;
-  if (!fs6.existsSync(keyPath)) {
+  if (!fs8.existsSync(keyPath)) {
     if (explicitKey) {
       throw new CliError(`signing key not found: ${explicitKey}`, ExitCode.USAGE_ERROR);
     }
     const kp = generateKeypair();
-    fs6.mkdirSync(path.dirname(keyPath), { recursive: true });
-    fs6.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs6.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs8.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs8.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs8.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     keyGeneratedAt = keyPath;
     notices.push(
       `minted a new Ed25519 signing key at ${rel(root, keyPath)} (keyid ${kp.keyid}) \u2014 keep it, add it to .gitignore, and reuse it to re-sign reproducibly`
@@ -193,7 +193,7 @@ async function signGraphAttestation(root, graph, opts) {
   }
   let privateKey;
   try {
-    privateKey = crypto.createPrivateKey(fs6.readFileSync(keyPath, "utf8"));
+    privateKey = crypto.createPrivateKey(fs8.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${rel(root, keyPath)}`, ExitCode.USAGE_ERROR);
   }
@@ -207,8 +207,8 @@ async function signGraphAttestation(root, graph, opts) {
   const statement = buildStatement(graph, { commit });
   const envelope = signStatement(statement, privateKey);
   const outPath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  fs6.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs6.writeFileSync(outPath, serializeEnvelope(envelope));
+  fs8.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs8.writeFileSync(outPath, serializeEnvelope(envelope));
   return {
     summary: {
       keyid: envelope.signatures[0]?.keyid ?? "",
@@ -223,7 +223,7 @@ async function signGraphAttestation(root, graph, opts) {
 }
 function verifyGraphAttestation(root, opts) {
   const bundlePath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  if (!fs6.existsSync(bundlePath)) {
+  if (!fs8.existsSync(bundlePath)) {
     if (opts.attestation || opts.pub) {
       throw new CliError(
         `no attestation at ${rel(root, bundlePath)} \u2014 sign one with \`vg build --attest\``,
@@ -232,8 +232,8 @@ function verifyGraphAttestation(root, opts) {
     }
     return { bundlePath, missing: true };
   }
-  const envelope = parseEnvelope(fs6.readFileSync(bundlePath, "utf8"));
-  const publicKeyPem = opts.pub ? fs6.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
+  const envelope = parseEnvelope(fs8.readFileSync(bundlePath, "utf8"));
+  const publicKeyPem = opts.pub ? fs8.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
   const graph = loadGraph(root) ?? void 0;
   return { bundlePath, missing: false, result: verifyEnvelope(envelope, { publicKeyPem, graph }) };
 }
@@ -245,15 +245,15 @@ async function gitCommitInfo(root) {
   return { sha, shortSha: sha.slice(0, 7), branch, dirty: dirty === true ? true : dirty === false ? false : void 0 };
 }
 function gitBranch(root) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     execFile(
       "git",
       ["rev-parse", "--abbrev-ref", "HEAD"],
       { cwd: root, timeout: 5e3, windowsHide: true, encoding: "utf8" },
       (err, stdout) => {
-        if (err) return resolve16(void 0);
+        if (err) return resolve17(void 0);
         const name = String(stdout).trim();
-        resolve16(name && name !== "HEAD" ? name : void 0);
+        resolve17(name && name !== "HEAD" ? name : void 0);
       }
     );
   });
@@ -584,8 +584,8 @@ function writeExport(graph, target) {
         ExitCode.USAGE_ERROR
       );
   }
-  fs6.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
-  fs6.writeFileSync(target, content);
+  fs8.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
+  fs8.writeFileSync(target, content);
 }
 function collect(value, prev) {
   return [...prev, value];
@@ -604,7 +604,7 @@ async function runStatus(global) {
   const root = path.resolve(global.cwd ?? ".");
   const graphPath = global.graph ?? defaultGraphPath(root);
   const graph = loadGraph(root, graphPath);
-  const hasCache = fs6.existsSync(path.join(cacheDir(root), "parse-cache.json"));
+  const hasCache = fs8.existsSync(path.join(cacheDir(root), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -1289,14 +1289,14 @@ var INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, "install-id");
 var SEND_TIMEOUT_MS = 4e3;
 function installId() {
   try {
-    const existing = fs6.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    const existing = fs8.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
   } catch {
   }
   const id = randomUuid();
   try {
-    fs6.mkdirSync(INSTALL_ID_DIR, { recursive: true });
-    fs6.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+    fs8.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs8.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
   } catch {
   }
   return id;
@@ -1320,7 +1320,7 @@ function ledgerFilePath(root) {
 }
 function readOffset(root) {
   try {
-    const raw = JSON.parse(fs6.readFileSync(offsetPath(root), "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(offsetPath(root), "utf8"));
     return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
   } catch {
     return 0;
@@ -1328,8 +1328,8 @@ function readOffset(root) {
 }
 function writeOffset(root, offset) {
   try {
-    fs6.mkdirSync(cacheDir(root), { recursive: true });
-    fs6.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + "\n");
+    fs8.mkdirSync(cacheDir(root), { recursive: true });
+    fs8.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + "\n");
   } catch {
   }
 }
@@ -1337,7 +1337,7 @@ function buildBatch(root, fromOffset, id = installId()) {
   const file = ledgerFilePath(root);
   let size = 0;
   try {
-    size = fs6.statSync(file).size;
+    size = fs8.statSync(file).size;
   } catch {
     return { batch: null, newOffset: 0 };
   }
@@ -1345,13 +1345,13 @@ function buildBatch(root, fromOffset, id = installId()) {
   if (start >= size) return { batch: null, newOffset: size };
   let text = "";
   try {
-    const fd = fs6.openSync(file, "r");
+    const fd = fs8.openSync(file, "r");
     try {
       const buf = Buffer.alloc(size - start);
-      fs6.readSync(fd, buf, 0, buf.length, start);
+      fs8.readSync(fd, buf, 0, buf.length, start);
       text = buf.toString("utf8");
     } finally {
-      fs6.closeSync(fd);
+      fs8.closeSync(fd);
     }
   } catch {
     return { batch: null, newOffset: fromOffset };
@@ -1374,8 +1374,8 @@ function buildBatch(root, fromOffset, id = installId()) {
     const source = e.source ?? "mcp";
     const client = e.client ?? "unknown";
     const outcome = e.outcome ?? "complete";
-    const key = `${source}|${client}|${e.tool}|${outcome}`;
-    const row = rows.get(key) ?? {
+    const key2 = `${source}|${client}|${e.tool}|${outcome}`;
+    const row = rows.get(key2) ?? {
       source,
       client,
       tool: e.tool,
@@ -1387,7 +1387,7 @@ function buildBatch(root, fromOffset, id = installId()) {
     row.calls++;
     row.vgTokens += e.vgTokens ?? 0;
     row.baselineTokens += e.baselineTokens ?? 0;
-    rows.set(key, row);
+    rows.set(key2, row);
     total++;
     if (typeof e.ts === "number") {
       if (e.ts < minTs) minTs = e.ts;
@@ -1497,7 +1497,7 @@ function registerServe(program) {
 }
 async function ensureServableGraph(root, graphPath, global, refresh, opts = {}) {
   if (refresh) {
-    if (!fs6.existsSync(graphPath)) {
+    if (!fs8.existsSync(graphPath)) {
       info(c.dim("vg \xB7 no map found \u2014 building it before serving\u2026"));
       await runBuild(
         [],
@@ -1514,7 +1514,7 @@ async function ensureServableGraph(root, graphPath, global, refresh, opts = {})
       }
     }
   }
-  if (!fs6.existsSync(graphPath)) {
+  if (!fs8.existsSync(graphPath)) {
     throw new CliError(
       `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
       ExitCode.NOT_FOUND
@@ -1569,19 +1569,1153 @@ async function serveHttp(graphPath, host, port, opts, freshness) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve16) => httpServer.listen(port, host, resolve16));
+  await new Promise((resolve17) => httpServer.listen(port, host, resolve17));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   await new Promise(() => {
   });
 }
 
+// src/lsp/protocol.ts
+var ErrorCodes = {
+  MethodNotFound: -32601,
+  InternalError: -32603
+};
+var MessageReader = class {
+  buf = Buffer.alloc(0);
+  /** Feed a chunk; returns every complete message now available. */
+  push(chunk) {
+    this.buf = this.buf.length === 0 ? chunk : Buffer.concat([this.buf, chunk]);
+    const out2 = [];
+    for (; ; ) {
+      const headerEnd = this.buf.indexOf("\r\n\r\n");
+      if (headerEnd === -1) break;
+      const header = this.buf.subarray(0, headerEnd).toString("ascii");
+      const match = /content-length:\s*(\d+)/i.exec(header);
+      if (!match) {
+        this.buf = this.buf.subarray(headerEnd + 4);
+        continue;
+      }
+      const length = Number(match[1]);
+      const bodyStart = headerEnd + 4;
+      if (this.buf.length < bodyStart + length) break;
+      const body = this.buf.subarray(bodyStart, bodyStart + length).toString("utf8");
+      this.buf = this.buf.subarray(bodyStart + length);
+      try {
+        out2.push(JSON.parse(body));
+      } catch {
+      }
+    }
+    return out2;
+  }
+};
+var MessageWriter = class {
+  constructor(out2) {
+    this.out = out2;
+  }
+  out;
+  write(msg) {
+    const body = Buffer.from(JSON.stringify(msg), "utf8");
+    this.out.write(`Content-Length: ${body.length}\r
+\r
+`);
+    this.out.write(body);
+  }
+};
+var Connection = class {
+  reader = new MessageReader();
+  writer;
+  requests = /* @__PURE__ */ new Map();
+  notifications = /* @__PURE__ */ new Map();
+  constructor(input = process.stdin, output = process.stdout) {
+    this.writer = new MessageWriter(output);
+    input.on("data", (chunk) => {
+      for (const msg of this.reader.push(chunk)) void this.dispatch(msg);
+    });
+  }
+  onRequest(method, handler) {
+    this.requests.set(method, handler);
+  }
+  onNotification(method, handler) {
+    this.notifications.set(method, handler);
+  }
+  /** Push a server→client notification (diagnostics, `vibgrate/score`, …). */
+  notify(method, params) {
+    this.writer.write({ jsonrpc: "2.0", method, params });
+  }
+  async dispatch(msg) {
+    if (!msg.method) return;
+    const isRequest = msg.id !== void 0 && msg.id !== null;
+    if (!isRequest) {
+      const handler2 = this.notifications.get(msg.method);
+      if (handler2) {
+        try {
+          await handler2(msg.method, msg.params);
+        } catch {
+        }
+      }
+      return;
+    }
+    const handler = this.requests.get(msg.method);
+    if (!handler) {
+      this.writer.write({
+        jsonrpc: "2.0",
+        id: msg.id,
+        error: { code: ErrorCodes.MethodNotFound, message: `Unhandled method: ${msg.method}` }
+      });
+      return;
+    }
+    try {
+      const result = await handler(msg.method, msg.params);
+      this.writer.write({ jsonrpc: "2.0", id: msg.id, result: result ?? null });
+    } catch (err) {
+      this.writer.write({
+        jsonrpc: "2.0",
+        id: msg.id,
+        error: {
+          code: ErrorCodes.InternalError,
+          message: err instanceof Error ? err.message : "Internal error"
+        }
+      });
+    }
+  }
+};
+
+// src/lsp/manifest-positions.ts
+function manifestKind(filePath) {
+  const base = (filePath.split(/[\\/]/).pop() ?? "").toLowerCase();
+  if (base === "package.json") return "package.json";
+  if (base === "go.mod") return "go.mod";
+  if (base === "requirements.txt" || /^requirements.*\.txt$/.test(base)) return "requirements.txt";
+  if (base === "pyproject.toml") return "pyproject.toml";
+  if (base === "cargo.toml") return "Cargo.toml";
+  if (base === "pom.xml") return "pom.xml";
+  if (base === "build.gradle" || base === "build.gradle.kts") return "build.gradle";
+  if (base === "gemfile") return "Gemfile";
+  if (base === "composer.json") return "composer.json";
+  if (base === "pubspec.yaml") return "pubspec.yaml";
+  if (base === "mix.exs") return "mix.exs";
+  if (base.endsWith(".csproj") || base.endsWith(".fsproj") || base.endsWith(".vbproj")) return "csproj";
+  if (base === "dockerfile" || base.startsWith("dockerfile.")) return "Dockerfile";
+  return "unknown";
+}
+function isManifest(filePath) {
+  return manifestKind(filePath) !== "unknown";
+}
+function esc(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function findPackageLine(text, pkg, kind) {
+  const lines = text.split(/\r?\n/);
+  const p = esc(pkg);
+  const patterns = (() => {
+    switch (kind) {
+      case "package.json":
+      case "composer.json":
+        return [new RegExp(`^\\s*"${p}"\\s*:`)];
+      case "go.mod":
+        return [new RegExp(`^\\s*(?:require\\s+)?${p}\\s+v?\\d`)];
+      case "requirements.txt":
+        return [new RegExp(`^\\s*${p}\\s*(?:\\[[^\\]]*\\])?\\s*(?:[=<>!~]|$)`, "i")];
+      case "pyproject.toml":
+      case "Cargo.toml":
+        return [
+          new RegExp(`^\\s*${p}\\s*=`),
+          new RegExp(`^\\s*"${p}\\s*(?:[=<>!~\\[]|")`)
+        ];
+      case "pom.xml":
+        return [new RegExp(`<artifactId>\\s*${p}\\s*</artifactId>`)];
+      case "build.gradle":
+        return [new RegExp(`["']${p}(?:["':])`)];
+      case "Gemfile":
+        return [new RegExp(`^\\s*gem\\s+["']${p}["']`)];
+      case "pubspec.yaml":
+        return [new RegExp(`^\\s*${p}\\s*:`)];
+      case "mix.exs":
+        return [new RegExp(`\\{\\s*:${p}\\s*,`)];
+      case "csproj":
+        return [new RegExp(`Include\\s*=\\s*"${p}"`, "i")];
+      case "Dockerfile":
+        return [new RegExp(`^\\s*FROM\\s+.*${p}`, "i")];
+      default:
+        return [];
+    }
+  })();
+  for (const re of patterns) {
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) return i;
+    }
+  }
+  return -1;
+}
+function findRuntimeLine(text, kind) {
+  const lines = text.split(/\r?\n/);
+  const patterns = (() => {
+    switch (kind) {
+      case "package.json":
+        return [/^\s*"node"\s*:/, /^\s*"engines"\s*:/];
+      case "go.mod":
+        return [/^\s*go\s+\d/];
+      case "pyproject.toml":
+        return [/^\s*(?:requires-python|python)\s*=/];
+      case "pom.xml":
+        return [/<(?:java\.version|maven\.compiler\.(?:source|target|release))>/];
+      case "build.gradle":
+        return [/(?:sourceCompatibility|targetCompatibility|JavaVersion)/];
+      case "csproj":
+        return [/<TargetFrameworks?>/i];
+      case "Dockerfile":
+        return [/^\s*FROM\s+/i];
+      default:
+        return [];
+    }
+  })();
+  for (const re of patterns) {
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) return i;
+    }
+  }
+  return -1;
+}
+function endOfLine(text, line) {
+  const lines = text.split(/\r?\n/);
+  return (lines[line] ?? "").length;
+}
+var CACHE_VERSION = "vg-lsp-scan-cache/2";
+function cachePath(root) {
+  return path.join(cacheDir(root), "lsp-scan.json");
+}
+function manifestHash(root) {
+  const files = [];
+  const walk2 = (dir) => {
+    let entries;
+    try {
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        walk2(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const base = entry.name.toLowerCase();
+      if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
+      try {
+        const rel3 = path.relative(root, abs).split(path.sep).join("/");
+        files.push({ rel: rel3, hash: hashBytes(fs8.readFileSync(abs)) });
+      } catch {
+      }
+    }
+  };
+  walk2(root);
+  files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+  return hashString(canonicalize(files));
+}
+function loadScanCache(root, key2) {
+  try {
+    const raw = JSON.parse(fs8.readFileSync(cachePath(root), "utf8"));
+    if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
+      return { manifestHash: raw.manifestHash, artifact: raw.artifact };
+    }
+  } catch {
+  }
+  return null;
+}
+function writeScanCache(root, key2, artifact) {
+  try {
+    fs8.mkdirSync(cacheDir(root), { recursive: true });
+    fs8.writeFileSync(
+      cachePath(root),
+      stableStringify(
+        { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
+        0
+      )
+    );
+  } catch {
+  }
+}
+
+// src/lsp/graph-query.ts
+async function runGraphQuery(graph, params, ctx) {
+  switch (params.mode) {
+    case "ask":
+      return runAsk(graph, params, ctx);
+    case "areas":
+      return runAreas(graph, params);
+    case "hubs":
+      return runHubs(graph, params);
+    case "impact":
+      return runImpact(graph, params);
+    case "path":
+      return runPath(graph, params);
+    case "show":
+      return runShow(graph, params);
+    case "tree":
+      return runTree(graph, params);
+    default:
+      return { ok: false, mode: params.mode, error: "bad-request", message: `unknown mode "${String(params.mode)}"` };
+  }
+}
+async function runAsk(graph, params, ctx) {
+  const question = (params.question ?? "").trim();
+  if (!question) return { ok: false, mode: "ask", error: "bad-request", message: "question is required" };
+  const budget = params.budget ?? 2e3;
+  const wantSemantic = !!params.semantic && !ctx.offline && ctx.semantic !== false;
+  let result;
+  let mode = "lexical";
+  let note;
+  if (wantSemantic) {
+    let reason;
+    const embedder = await loadEmbedder({ onUnavailable: (r) => reason = r });
+    if (embedder) {
+      const vectors = await getNodeEmbeddings(graph, embedder, ctx.root);
+      result = await queryGraphSemantic(graph, question, { budget, embedder, nodeVectors: vectors });
+      mode = `semantic (${embedder.id})`;
+    } else {
+      result = queryGraph(graph, question, { budget });
+      note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
+    }
+  } else {
+    result = queryGraph(graph, question, { budget });
+    if (params.semantic && ctx.semantic === false) note = "semantic search is turned off \u2014 used lexical";
+    else if (params.semantic && ctx.offline) note = "semantic skipped \u2014 Vibgrate is running offline";
+  }
+  return {
+    ok: true,
+    mode: "ask",
+    data: {
+      question: result.question,
+      mode,
+      note,
+      tokensEstimate: result.tokensEstimate,
+      matches: result.matches.map((m) => ({
+        name: m.node.qualifiedName,
+        kind: m.node.kind,
+        file: m.node.file,
+        line: m.node.span.start,
+        score: m.score,
+        why: m.why
+      })),
+      context: result.context
+    }
+  };
+}
+function runAreas(graph, params) {
+  const limit = params.limit ?? 30;
+  const list = [...graph.areas].sort((a, b) => b.size - a.size || a.id - b.id).slice(0, limit);
+  return { ok: true, mode: "areas", data: list };
+}
+function runHubs(graph, params) {
+  const limit = params.limit ?? 20;
+  const list = graph.nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)).slice(0, limit).map(nodeSummary2);
+  return { ok: true, mode: "hubs", data: list };
+}
+function nodeSummary2(n) {
+  return {
+    id: n.id,
+    name: n.qualifiedName,
+    kind: n.kind,
+    file: n.file,
+    line: n.span.start,
+    importance: n.importance,
+    isHub: n.isHub,
+    area: n.area
+  };
+}
+function resolveOrError(graph, name, mode) {
+  const { node, candidates } = resolveOne(graph, name);
+  if (node) return { node };
+  if (candidates.length === 0) {
+    return { ok: false, mode, error: "not-found", message: `no node matches "${name}"` };
+  }
+  return {
+    ok: false,
+    mode,
+    error: "ambiguous",
+    message: `"${name}" is ambiguous`,
+    candidates: candidates.slice(0, 10).map((n) => ({ name: n.qualifiedName, kind: n.kind, file: n.file, line: n.span.start }))
+  };
+}
+function runImpact(graph, params) {
+  const name = (params.name ?? "").trim();
+  if (!name) return { ok: false, mode: "impact", error: "bad-request", message: "name is required" };
+  const resolved = resolveOrError(graph, name, "impact");
+  if (!("node" in resolved)) return resolved;
+  const result = impactOf(graph, resolved.node.id, { depth: params.depth ?? 4 });
+  return { ok: true, mode: "impact", data: result };
+}
+function runPath(graph, params) {
+  const a = (params.a ?? "").trim();
+  const b = (params.b ?? "").trim();
+  if (!a || !b) return { ok: false, mode: "path", error: "bad-request", message: "a and b are required" };
+  const ra = resolveOrError(graph, a, "path");
+  if (!("node" in ra)) return ra;
+  const rb = resolveOrError(graph, b, "path");
+  if (!("node" in rb)) return rb;
+  const result = shortestPath(graph, ra.node.id, rb.node.id);
+  if (!result) {
+    return {
+      ok: false,
+      mode: "path",
+      error: "not-found",
+      message: `no path between ${ra.node.qualifiedName} and ${rb.node.qualifiedName}`
+    };
+  }
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const names = result.ids.map((id) => byId.get(id)?.qualifiedName ?? id);
+  return {
+    ok: true,
+    mode: "path",
+    data: { from: ra.node.qualifiedName, to: rb.node.qualifiedName, hops: names.length - 1, direction: result.direction, path: names }
+  };
+}
+function runShow(graph, params) {
+  const name = (params.name ?? "").trim();
+  if (!name) return { ok: false, mode: "show", error: "bad-request", message: "name is required" };
+  const resolved = resolveOrError(graph, name, "show");
+  if (!("node" in resolved)) return resolved;
+  const node = resolved.node;
+  const index = indexFor(graph);
+  const callees = dedupeNodes(index.callees(node.id).map((x) => x.node));
+  const callers = dedupeNodes(index.callers(node.id).map((x) => x.node));
+  const extendsEdges = index.out(node.id, "extends").concat(index.out(node.id, "implements"));
+  const supertypes = extendsEdges.map((e) => index.node(e.dst)?.qualifiedName).filter(Boolean);
+  const area = graph.areas.find((a) => a.id === node.area);
+  return {
+    ok: true,
+    mode: "show",
+    data: {
+      id: node.id,
+      name: node.qualifiedName,
+      kind: node.kind,
+      file: node.file,
+      line: node.span.start,
+      signature: node.signature ?? null,
+      importance: node.importance,
+      centrality: node.centrality,
+      isHub: node.isHub,
+      area: node.area,
+      areaLabel: area?.label ?? null,
+      tested: node.tested,
+      calls: callees.map((n) => n.qualifiedName),
+      calledBy: callers.map((n) => n.qualifiedName),
+      extends: supertypes
+    }
+  };
+}
+function dedupeNodes(nodes) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const n of nodes) {
+    if (seen.has(n.id)) continue;
+    seen.add(n.id);
+    out2.push(n);
+  }
+  return out2;
+}
+function runTree(graph, params) {
+  const name = (params.name ?? "").trim();
+  if (!name) return { ok: false, mode: "tree", error: "bad-request", message: "name is required" };
+  const resolved = resolveOrError(graph, name, "tree");
+  if (!("node" in resolved)) return resolved;
+  const index = indexFor(graph);
+  const direction = params.callers ? "callers" : "callees";
+  const maxDepth = Math.max(1, params.depth ?? 3);
+  const data = toJsonTree(index, resolved.node, direction, maxDepth, /* @__PURE__ */ new Set());
+  return { ok: true, mode: "tree", data };
+}
+
+// src/lsp/enrich.ts
+var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
+var cache = /* @__PURE__ */ new Map();
+function key(ecosystem, name, version) {
+  return `${ecosystem}:${name}@${version}`;
+}
+function severityOf(v) {
+  const dbSpecific = v.database_specific;
+  const label = typeof dbSpecific?.severity === "string" ? dbSpecific.severity.toLowerCase() : "";
+  if (label.includes("critical")) return "critical";
+  if (label.includes("high")) return "high";
+  if (label.includes("moderate") || label.includes("medium")) return "moderate";
+  if (label.includes("low")) return "low";
+  const sev = Array.isArray(v.severity) ? v.severity : [];
+  const cvss = sev.find((s) => typeof s.score === "string" && String(s.type).startsWith("CVSS"));
+  if (cvss) {
+    const m = /\/AV:.*$/.test(String(cvss.score)) ? null : Number(cvss.score);
+    if (m != null && !Number.isNaN(m)) {
+      if (m >= 9) return "critical";
+      if (m >= 7) return "high";
+      if (m >= 4) return "moderate";
+      if (m > 0) return "low";
+    }
+  }
+  return "unknown";
+}
+function toSummary(raw) {
+  const v = raw ?? {};
+  const aliases = Array.isArray(v.aliases) ? v.aliases.map(String) : [];
+  const details = typeof v.details === "string" ? v.details : "";
+  const summary = typeof v.summary === "string" && v.summary || (details ? details.split("\n")[0].slice(0, 140) : "") || "Advisory";
+  return {
+    id: String(v.id ?? "unknown"),
+    cves: aliases.filter((a) => a.startsWith("CVE-")),
+    summary,
+    severity: severityOf(v)
+  };
+}
+async function enrichVulns(ecosystem, name, version, opts = { offline: false }) {
+  if (!ecosystem || !version) return { vulns: [], cveCount: 0, source: "error" };
+  if (opts.offline) return { vulns: [], cveCount: 0, source: "offline" };
+  const k = key(ecosystem, name, version);
+  const cached = cache.get(k);
+  if (cached) return { ...cached, source: "cache" };
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 8e3);
+    const res = await fetch(OSV_QUERY_URL, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ version, package: { name, ecosystem } }),
+      signal: controller.signal
+    }).finally(() => clearTimeout(timer));
+    if (!res.ok) return { vulns: [], cveCount: 0, source: "error" };
+    const data = await res.json();
+    const vulns = (data.vulns ?? []).map(toSummary);
+    const cveCount = new Set(vulns.flatMap((v) => v.cves)).size;
+    const result = { vulns, cveCount, source: "osv" };
+    cache.set(k, result);
+    return result;
+  } catch {
+    return { vulns: [], cveCount: 0, source: "error" };
+  }
+}
+
+// src/lsp/server.ts
+function bandForDependency(dep) {
+  if (dep.drift === "major-behind") {
+    return (dep.majorsBehind ?? 1) >= 2 ? "high" : "moderate";
+  }
+  if (dep.drift === "minor-behind") return "moderate";
+  return "low";
+}
+function severityFor(level) {
+  if (level === "note") return 3;
+  return 2;
+}
+var DIAGNOSTIC_RULES = /* @__PURE__ */ new Set([
+  "vibgrate/runtime-eol",
+  "vibgrate/runtime-lag",
+  "vibgrate/unmaintained",
+  "vibgrate/abandoned",
+  "vibgrate/license-change",
+  "vibgrate/eol"
+]);
+var VibgrateLanguageServer = class {
+  constructor(opts, output = process.stdout) {
+    this.opts = opts;
+    this.conn = new Connection(process.stdin, output);
+    this.register();
+  }
+  opts;
+  conn;
+  docs = /* @__PURE__ */ new Map();
+  // uri → text
+  artifact = null;
+  scanning = false;
+  queued = false;
+  debounce = null;
+  shuttingDown = false;
+  graph = null;
+  graphBuilding = false;
+  register() {
+    this.conn.onRequest("initialize", () => ({
+      capabilities: {
+        // 1 = Full sync. We only actually act on save, but full sync keeps our
+        // buffer honest so hovers land on the text the user is looking at.
+        textDocumentSync: 1,
+        hoverProvider: true,
+        codeLensProvider: { resolveProvider: false },
+        executeCommandProvider: {
+          commands: ["vibgrate.rescan", "vibgrate.explain", "vibgrate.routeFix"]
+        }
+      },
+      serverInfo: { name: "Vibgrate", version: VERSION }
+    }));
+    this.conn.onNotification("initialized", () => {
+      this.scheduleScan(0);
+      void this.ensureGraph();
+    });
+    this.conn.onNotification("textDocument/didOpen", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !isManifest(uriToPath(uri))) return;
+      this.docs.set(uri, p.textDocument?.text ?? "");
+      if (this.artifact) this.publishForDoc(uri);
+      else this.scheduleScan(0);
+    });
+    this.conn.onNotification("textDocument/didChange", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !this.docs.has(uri)) return;
+      const full = p.contentChanges?.[p.contentChanges.length - 1]?.text;
+      if (typeof full === "string") this.docs.set(uri, full);
+      if (this.artifact) this.publishForDoc(uri);
+    });
+    this.conn.onNotification("textDocument/didSave", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !this.docs.has(uri)) return;
+      this.scheduleScan(400);
+    });
+    this.conn.onNotification("textDocument/didClose", (_m, params) => {
+      const p = params;
+      if (p.textDocument?.uri) this.docs.delete(p.textDocument.uri);
+    });
+    this.conn.onRequest("textDocument/hover", (_m, params) => this.onHover(params));
+    this.conn.onRequest("textDocument/codeLens", (_m, params) => this.onCodeLens(params));
+    this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
+    this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
+    this.conn.onRequest("vibgrate/enrich", (_m, params) => this.onEnrich(params));
+    this.conn.onRequest("workspace/executeCommand", (_m, params) => {
+      const p = params;
+      if (p.command === "vibgrate.rescan") {
+        this.scheduleScan(0);
+        return { ok: true };
+      }
+      return null;
+    });
+    this.conn.onRequest("shutdown", () => {
+      this.shuttingDown = true;
+      if (this.debounce) clearTimeout(this.debounce);
+      return null;
+    });
+    this.conn.onNotification("exit", () => {
+      process.exit(this.shuttingDown ? 0 : 1);
+    });
+  }
+  // ── Scanning ─────────────────────────────────────────────────────────────
+  scheduleScan(delayMs) {
+    if (this.debounce) clearTimeout(this.debounce);
+    this.debounce = setTimeout(() => void this.scan(), delayMs);
+  }
+  async scan() {
+    if (this.scanning) {
+      this.queued = true;
+      return;
+    }
+    this.scanning = true;
+    try {
+      const cacheKey = { manifestHash: manifestHash(this.opts.root), toolVersion: VERSION, offline: this.opts.offline };
+      const cached = loadScanCache(this.opts.root, cacheKey);
+      if (cached) {
+        this.artifact = cached.artifact;
+      } else {
+        const scanOpts = {
+          format: "json",
+          concurrency: 8,
+          offline: this.opts.offline,
+          noLocalArtifacts: true,
+          // an editor scan must not litter the repo
+          noGraph: true,
+          // the code map is not needed to score drift; skip the cost
+          quiet: true,
+          // no spinners, no artifact dump — an editor is not a terminal
+          vibgrateVersion: VERSION
+        };
+        const advanced = await loadAdvancedScanHook();
+        this.artifact = await runCoreScan(this.opts.root, scanOpts, advanced);
+        writeScanCache(this.opts.root, cacheKey, this.artifact);
+      }
+      this.publishScore();
+      for (const uri of this.docs.keys()) this.publishForDoc(uri);
+    } catch (err) {
+      this.conn.notify("window/logMessage", {
+        type: 3,
+        message: `Vibgrate scan failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+      this.conn.notify("vibgrate/status", { state: "error" });
+    } finally {
+      this.scanning = false;
+      if (this.queued) {
+        this.queued = false;
+        this.scheduleScan(0);
+      }
+    }
+  }
+  // ── Publishing ───────────────────────────────────────────────────────────
+  publishScore() {
+    const a = this.artifact;
+    if (!a) return;
+    let behind = 0;
+    let unmaintained = 0;
+    let total = 0;
+    for (const proj of a.projects ?? []) {
+      for (const dep of proj.dependencies ?? []) {
+        total++;
+        if (dep.drift === "major-behind" || dep.drift === "minor-behind") behind++;
+      }
+    }
+    const eol = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol"
+    ).length;
+    unmaintained = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/unmaintained" || f.ruleId === "vibgrate/abandoned"
+    ).length;
+    const band = a.drift.riskLevel ?? "low";
+    const payload = {
+      score: a.drift.score,
+      band,
+      // v3 §2.4: `estimated` means "no timestamps at all" — it is NOT an
+      // offline marker. An air-gapped scan against a dated snapshot is Verified.
+      // The score now carries the authoritative provenance (driftscore-3.0
+      // envelope); fall back to the artifact heuristic for pre-v3 engines.
+      mode: a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated"),
+      methodology: a.drift.methodologyVersion ?? "unknown",
+      scale: "0 best, 100 worst",
+      counts: { behind, eol, unmaintained, total },
+      rootPath: a.rootPath,
+      scannedAt: a.timestamp,
+      ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {}
+    };
+    this.conn.notify("vibgrate/score", payload);
+  }
+  /** Decorations + (optionally) diagnostics for one open manifest. */
+  publishForDoc(uri) {
+    const a = this.artifact;
+    const text = this.docs.get(uri);
+    if (!a || text === void 0) return;
+    const filePath = uriToPath(uri);
+    const kind = manifestKind(filePath);
+    const project = projectForFile(this.opts.root, a, filePath);
+    const items = [];
+    for (const dep of project?.dependencies ?? []) {
+      if (dep.drift === "current" || dep.drift === "unknown") continue;
+      const line = findPackageLine(text, dep.package, kind);
+      if (line === -1) continue;
+      items.push({
+        line,
+        endCol: endOfLine(text, line),
+        text: inlineLabel(dep),
+        band: bandForDependency(dep),
+        package: dep.package
+      });
+    }
+    this.conn.notify("vibgrate/inline", { uri, items });
+    if (!this.opts.diagnostics) {
+      this.conn.notify("textDocument/publishDiagnostics", { uri, diagnostics: [] });
+      return;
+    }
+    const diagnostics = (a.findings ?? []).filter((f) => DIAGNOSTIC_RULES.has(f.ruleId)).filter((f) => project && sameProject(f.location, project.path)).map((f) => {
+      const line = Math.max(0, findRuntimeLine(text, kind));
+      return {
+        range: {
+          start: { line, character: 0 },
+          end: { line, character: endOfLine(text, line) }
+        },
+        severity: severityFor(f.level),
+        // never 1 — see file header
+        source: "vibgrate",
+        code: f.ruleId,
+        message: f.message
+      };
+    });
+    this.conn.notify("textDocument/publishDiagnostics", { uri, diagnostics });
+  }
+  // ── Requests ─────────────────────────────────────────────────────────────
+  onHover(params) {
+    const p = params;
+    const uri = p.textDocument?.uri;
+    const line = p.position?.line;
+    const a = this.artifact;
+    const text = uri ? this.docs.get(uri) : void 0;
+    if (!uri || line === void 0 || !a || text === void 0) return null;
+    const filePath = uriToPath(uri);
+    const kind = manifestKind(filePath);
+    const project = projectForFile(this.opts.root, a, filePath);
+    const dep = (project?.dependencies ?? []).find(
+      (d) => findPackageLine(text, d.package, kind) === line
+    );
+    if (!dep) return null;
+    const contribution = a.drift.dependencyDrift?.top.find((t) => t.package === dep.package)?.drift ?? null;
+    return {
+      contents: { kind: "markdown", value: hoverMarkdown(dep, contribution) }
+    };
+  }
+  onCodeLens(params) {
+    const p = params;
+    const uri = p.textDocument?.uri;
+    const a = this.artifact;
+    if (!uri || !a || !this.docs.has(uri)) return [];
+    const behind = (a.projects ?? []).reduce(
+      (n, proj) => n + (proj.dependencies ?? []).filter(
+        (d) => d.drift === "major-behind" || d.drift === "minor-behind"
+      ).length,
+      0
+    );
+    const eol = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol"
+    ).length;
+    const estimated = (a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated")) === "estimated";
+    const mode = estimated ? "~" : "";
+    const title = `Vibgrate \xB7 drift ${mode}${a.drift.score} (${a.drift.riskLevel}) \xB7 ${behind} behind \xB7 ${eol} EOL`;
+    return [
+      {
+        range: { start: { line: 0, character: 0 }, end: { line: 0, character: 0 } },
+        command: { title, command: "vibgrate.openPanel", arguments: [] }
+      }
+    ];
+  }
+  // ── Graph ────────────────────────────────────────────────────────────────
+  /**
+   * Load the committed map if one exists, else build it once (this is the
+   * "first activation sets up the graph" step). Fire-and-forget from
+   * `initialized` so it never blocks the drift score; a query that arrives
+   * mid-build awaits the same in-flight promise via the `graphBuilding` guard.
+   */
+  async ensureGraph() {
+    if (!this.opts.graph) {
+      this.conn.notify("vibgrate/graph/status", { state: "disabled" });
+      return;
+    }
+    if (this.graph || this.graphBuilding) return;
+    this.graphBuilding = true;
+    try {
+      const existing = loadGraph(this.opts.root);
+      if (existing) {
+        this.graph = existing;
+        this.conn.notify("vibgrate/graph/status", { state: "ready" });
+        return;
+      }
+      this.conn.notify("vibgrate/graph/status", { state: "building" });
+      const result = await buildGraph({ root: this.opts.root });
+      writeArtifacts(result.graph, { root: this.opts.root, html: false, report: false });
+      writeSnapshot(this.opts.root, result.graph.provenance.corpusHash, result.fileStats, {});
+      this.graph = result.graph;
+      this.conn.notify("vibgrate/graph/status", { state: "ready" });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.conn.notify("window/logMessage", { type: 3, message: `Vibgrate graph build failed: ${message}` });
+      this.conn.notify("vibgrate/graph/status", { state: "error", message });
+    } finally {
+      this.graphBuilding = false;
+    }
+  }
+  /** The graph, refreshed if the working tree drifted since the last build (same probe `vg ask` uses). */
+  async graphForQuery() {
+    await this.ensureGraph();
+    if (!this.graph) return null;
+    const refreshed = await refreshIfStale(this.opts.root);
+    if (refreshed.status === "refreshed" && refreshed.wrote) {
+      const reloaded = loadGraph(this.opts.root);
+      if (reloaded) this.graph = reloaded;
+    }
+    return this.graph;
+  }
+  async onGraphQuery(params) {
+    const p = params;
+    if (!this.opts.graph) {
+      return { ok: false, mode: p.mode, error: "disabled", message: "the local Vibgrate Graph is turned off" };
+    }
+    const graph = await this.graphForQuery();
+    if (!graph) {
+      return { ok: false, mode: p.mode, error: "not-found", message: "no code map yet \u2014 it is still building" };
+    }
+    return runGraphQuery(graph, p, { root: this.opts.root, offline: this.opts.offline, semantic: this.opts.semantic });
+  }
+  /**
+   * `vibgrate/enrich` — lazy vulnerability enrichment for one expanded package,
+   * straight from OSV.dev (never our API). Honours the server's offline flag.
+   */
+  onEnrich(params) {
+    const p = params ?? {};
+    return enrichVulns(p.ecosystem ?? null, p.package ?? "", p.version ?? null, { offline: this.opts.offline });
+  }
+  onScoreForFile(params) {
+    const p = params;
+    const a = this.artifact;
+    if (!a || !p.uri) return null;
+    const project = projectForFile(this.opts.root, a, uriToPath(p.uri));
+    return project ? scoreForProject(a, project) : null;
+  }
+};
+function uriToPath(uri) {
+  try {
+    return fileURLToPath(uri);
+  } catch {
+    return uri;
+  }
+}
+function projectForFile(root, a, filePath) {
+  const dir = path.dirname(path.resolve(filePath));
+  let best;
+  let bestLen = -1;
+  for (const proj of a.projects ?? []) {
+    const projDir = path.resolve(root, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path.sep)) && projDir.length > bestLen) {
+      best = proj;
+      bestLen = projDir.length;
+    }
+  }
+  return best;
+}
+function sameProject(location, projectPath) {
+  return path.normalize(location) === path.normalize(projectPath);
+}
+function hasReleaseDates(a) {
+  for (const proj of a.projects ?? []) {
+    for (const dep of proj.dependencies ?? []) {
+      if (dep.ageDays !== null && dep.ageDays !== void 0) return true;
+    }
+  }
+  return false;
+}
+function scoreForProject(a, proj) {
+  if (!proj.drift) return null;
+  let behind = 0;
+  let total = 0;
+  for (const dep of proj.dependencies ?? []) {
+    total++;
+    if (dep.drift === "major-behind" || dep.drift === "minor-behind") behind++;
+  }
+  const projFindings = (a.findings ?? []).filter((f) => sameProject(f.location, proj.path));
+  const eol = projFindings.filter((f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol").length;
+  const unmaintained = projFindings.filter(
+    (f) => f.ruleId === "vibgrate/unmaintained" || f.ruleId === "vibgrate/abandoned"
+  ).length;
+  const hasDates = (proj.dependencies ?? []).some((d) => d.ageDays !== null && d.ageDays !== void 0);
+  return {
+    score: proj.drift.score,
+    band: proj.drift.riskLevel ?? "low",
+    mode: proj.drift.mode ?? (hasDates ? "verified" : "estimated"),
+    methodology: proj.drift.methodologyVersion ?? a.drift.methodologyVersion ?? "unknown",
+    scale: "0 best, 100 worst",
+    counts: { behind, eol, unmaintained, total },
+    rootPath: proj.path,
+    scannedAt: a.timestamp,
+    ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {}
+  };
+}
+function bandForScore(n) {
+  if (n <= 30) return "low";
+  if (n <= 60) return "moderate";
+  return "high";
+}
+function buildBreakdown(drift, projects) {
+  const top = drift.dependencyDrift?.top;
+  if (!top || top.length === 0) return void 0;
+  const byPkg = /* @__PURE__ */ new Map();
+  for (const p of projects) {
+    const ecosystem = osvEcosystem(p.type);
+    for (const d of p.dependencies ?? []) if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+  }
+  const items = top.filter((t) => t.drift > 0).map((t) => {
+    const found = byPkg.get(t.package);
+    const row = found?.row;
+    return {
+      package: t.package,
+      section: row?.section ?? "dependencies",
+      ecosystem: found?.ecosystem ?? null,
+      drift: t.drift,
+      band: bandForScore(t.drift),
+      currentSpec: row?.currentSpec ?? "",
+      resolvedVersion: row?.resolvedVersion ?? null,
+      latestStable: row?.latestStable ?? null,
+      majorsBehind: row?.majorsBehind ?? null,
+      ageDays: row?.ageDays ?? null,
+      mode: t.mode,
+      unsupported: t.unsupported,
+      abandoned: t.flags.includes("abandoned-floor"),
+      flags: t.flags
+    };
+  });
+  return items.length > 0 ? items : void 0;
+}
+function osvEcosystem(type) {
+  switch (type) {
+    case "node":
+    case "typescript":
+      return "npm";
+    case "python":
+      return "PyPI";
+    case "java":
+    case "kotlin":
+    case "scala":
+    case "groovy":
+      return "Maven";
+    case "go":
+      return "Go";
+    case "rust":
+      return "crates.io";
+    case "ruby":
+      return "RubyGems";
+    case "php":
+      return "Packagist";
+    case "dotnet":
+      return "NuGet";
+    case "dart":
+      return "Pub";
+    case "swift":
+      return "SwiftURL";
+    case "elixir":
+      return "Hex";
+    default:
+      return null;
+  }
+}
+function inlineLabel(dep) {
+  const bits = [];
+  if (dep.drift === "major-behind") {
+    const n = dep.majorsBehind ?? 1;
+    bits.push(`${n} major behind`);
+  } else if (dep.drift === "minor-behind") {
+    bits.push("minor behind");
+  }
+  if (dep.latestStable) bits.push(dep.latestStable);
+  if (dep.ageDays != null && dep.ageDays >= 1) {
+    bits.push(`${Math.round(dep.ageDays).toLocaleString("en-US")}d stale`);
+  }
+  return bits.join(" \xB7 ");
+}
+function commandUri(command, args) {
+  return `command:${command}?${encodeURIComponent(JSON.stringify([args]))}`;
+}
+function driftBadge(dep) {
+  if (dep.drift === "major-behind") {
+    const n = dep.majorsBehind ?? 1;
+    return `${n} major${n === 1 ? "" : "s"} behind`;
+  }
+  if (dep.drift === "minor-behind") return "minor behind";
+  return null;
+}
+function versionJourney(yours, latest) {
+  const from = Number(/^(\d+)/.exec(yours)?.[1]);
+  const to = Number(/^(\d+)/.exec(latest)?.[1]);
+  if (!Number.isFinite(from) || !Number.isFinite(to) || to <= from) return null;
+  const majors = [];
+  for (let m = from; m <= to; m++) majors.push(m);
+  const shown = majors.length > 5 ? [majors[0], majors[1], -1, majors[majors.length - 2], majors[majors.length - 1]] : majors;
+  return shown.map((m) => m === -1 ? "\u2026" : `${m}.x`).join(" \u2192 ");
+}
+function hoverMarkdown(dep, contribution) {
+  const lines = [];
+  const badge = driftBadge(dep);
+  const contributionText = contribution != null ? ` \xB7 contributes +${Math.round(contribution)} to drift` : "";
+  lines.push(badge ? `**${dep.package}**  \`${badge}\`${contributionText}` : `**${dep.package}**`);
+  lines.push("");
+  const yours = dep.resolvedVersion ?? dep.currentSpec;
+  const drifted = dep.drift === "major-behind" || dep.drift === "minor-behind";
+  if (dep.latestStable && dep.latestStable !== yours) {
+    lines.push("**Currency**");
+    lines.push(`| | |`);
+    lines.push(`|---|---|`);
+    lines.push(`| yours | \`${yours}\` |`);
+    lines.push(`| latest | \`${dep.latestStable}\` |`);
+    const journey = versionJourney(yours, dep.latestStable);
+    if (journey) lines.push(`| journey | ${journey} |`);
+    if (dep.majorsBehind) lines.push(`| majors behind | ${dep.majorsBehind} |`);
+    if (dep.ageDays != null && dep.ageDays >= 1) {
+      lines.push(`| age | ${Math.round(dep.ageDays).toLocaleString("en-US")} days |`);
+    }
+    if (dep.libyears != null && dep.libyears >= 0.01) {
+      lines.push(`| libyears | ${dep.libyears.toFixed(2)} |`);
+    }
+    const license = dep.license?.spdxId ?? dep.license?.raw;
+    if (license) lines.push(`| license | ${license} |`);
+  } else {
+    lines.push(`\`${yours}\` \u2014 current.`);
+  }
+  if (dep.unsupported || dep.abandoned) {
+    lines.push("");
+    lines.push("**Maintenance**");
+    if (dep.unsupported) lines.push("$(warning) Unsupported / deprecated \u2014 floored at 70.");
+    if (dep.abandoned) lines.push("$(warning) Abandoned \u2014 no recent releases \u2014 floored at 50.");
+  }
+  if (drifted) {
+    lines.push("");
+    lines.push("---");
+    const routeFixUri = commandUri("vibgrate.routeFix", {
+      package: dep.package,
+      from: yours,
+      to: dep.latestStable ?? yours,
+      majorsBehind: dep.majorsBehind ?? 0
+    });
+    const explainUri = commandUri("vibgrate.explain", { package: dep.package });
+    lines.push(`[Route this fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
+  }
+  lines.push("");
+  lines.push("---");
+  lines.push("$(shield) Resolved locally from your lockfile. No source uploaded.");
+  return lines.join("\n");
+}
+function startLanguageServer(opts) {
+  if (!fs8.existsSync(opts.root)) {
+    process.stderr.write(`vg lsp: root does not exist: ${opts.root}
+`);
+    process.exit(1);
+  }
+  const realWrite = process.stdout.write.bind(process.stdout);
+  const protocolOut = {
+    write(chunk) {
+      return realWrite(chunk);
+    }
+  };
+  process.stdout.write = ((chunk, ...rest) => process.stderr.write(chunk, ...rest));
+  process.stderr.write(
+    `vg lsp ${VERSION} \u2014 serving ${pathToFileURL(opts.root).href}${opts.offline ? " (offline)" : ""}
+`
+  );
+  new VibgrateLanguageServer(opts, protocolOut);
+}
+
+// src/commands/lsp.ts
+function registerLsp(program) {
+  const cmd = program.command("lsp").description("start the Vibgrate language server (stdio) \u2014 the engine behind the IDE extensions").option(
+    "--diagnostics",
+    "also publish Problems-panel diagnostics (EOL runtime, unmaintained, license change). Off by default: drift is not a defect, and the Problems panel is not ours to fill",
+    false
+  ).option("--no-graph", "skip the local Vibgrate Graph entirely: no background build, and graph queries report it as turned off").option("--no-semantic", "never use semantic search for graph queries (lexical only; the embedding model is not downloaded)").action(async function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    startLanguageServer({
+      root,
+      // `--local` is the established air-gap flag across the CLI; honour it
+      // here too, so an offline editor session stays offline.
+      offline: global.local === true,
+      diagnostics: opts.diagnostics === true,
+      graph: opts.graph !== false,
+      semantic: opts.semantic !== false
+    });
+    await new Promise(() => {
+    });
+  });
+  applyGlobalOptions(cmd);
+}
+
 // src/commands/install.ts
 var SMALL_REPO_FILES = 150;
 function registerInstall(program) {
-  const install = program.command("install").description("add vg to your AI assistant(s): skill + MCP + advisory nudge").argument("[tools...]", `assistant ids: ${ASSISTANTS.map((a) => a.id).join(", ")}`).option("--all", "install for every supported assistant").option("--list", "show the support matrix and exit").option("--no-hook", "skip the advisory nudge").action(function(tools, opts) {
+  const install = program.command("install").description("add vg to your AI assistant(s): skill + MCP + advisory nudge").argument("[tools...]", `assistant ids: ${ASSISTANTS.map((a) => a.id).join(", ")}`).option("--all", "install for every supported assistant").option("--detect", "detect assistants in use (repo footprint, home config, PATH) and install for those; with --list, only report what was detected").option("--list", "show the support matrix and exit").option("--no-hook", "skip the advisory nudge").action(function(tools, opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
+    const detected = opts.detect ? detectAssistants(root) : [];
     if (opts.list) {
+      if (opts.detect) {
+        if (global.json) {
+          json(detected.map((d) => ({ id: d.assistant.id, label: d.assistant.label, via: d.via, marker: d.marker })));
+        } else if (detected.length === 0) {
+          info(`${c.cyan("vg install")} \xB7 no AI assistants detected here`);
+        } else {
+          info(`${c.cyan("vg install")} \xB7 detected assistants`);
+          const pad4 = Math.max(...detected.map((d) => d.assistant.id.length)) + 2;
+          for (const d of detected) {
+            info(`  ${c.bold(d.assistant.id.padEnd(pad4))} ${d.assistant.label}  ${c.dim(`via ${d.via}: ${d.marker}`)}`);
+          }
+        }
+        return;
+      }
       if (global.json) {
         json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
       } else {
@@ -1593,8 +2727,15 @@ function registerInstall(program) {
       }
       return;
     }
-    const targets = opts.all ? ASSISTANTS : tools.map(resolve5);
-    if (targets.length === 0) throw usageError("name an assistant (e.g. `vg install claude`) or use --all / --list");
+    const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve6);
+    if (targets.length === 0) {
+      if (opts.detect) {
+        if (global.json) json({ root, detected: [], results: [] });
+        else info(`${c.cyan("vg install")} \xB7 no AI assistants detected here \u2014 name one (e.g. \`vg install claude\`) or use --all`);
+        return;
+      }
+      throw usageError("name an assistant (e.g. `vg install claude`) or use --all / --detect / --list");
+    }
     const graph = loadGraph(root, global.graph);
     const fileCount = graph ? graph.nodes.filter((n) => n.kind === "file").length : 0;
     const smallRepo = graph !== null && fileCount > 0 && fileCount < SMALL_REPO_FILES;
@@ -1617,7 +2758,7 @@ function registerInstall(program) {
   const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
-    const results = tools.map(resolve5).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root, !!opts.purge) }));
+    const results = tools.map(resolve6).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root, !!opts.purge) }));
     if (global.json) {
       json({ root, results });
       return;
@@ -1628,7 +2769,7 @@ function registerInstall(program) {
   });
   applyGlobalOptions(uninstall);
 }
-function resolve5(id) {
+function resolve6(id) {
   const a = assistantById(id);
   if (!a) {
     const near = ASSISTANTS.filter(
@@ -1649,7 +2790,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root = rootOf(global);
     const gitDir = path.join(root, ".git");
-    if (!fs6.existsSync(gitDir)) {
+    if (!fs8.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -1671,22 +2812,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root, reports) {
   const dir = path.join(root, ".vibgrate");
-  fs6.mkdirSync(dir, { recursive: true });
+  fs8.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs6.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs8.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root) {
   const file = path.join(root, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "";
+  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs6.writeFileSync(file, content);
+    fs8.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root) {
@@ -1695,7 +2836,7 @@ function configureMergeDriver(root) {
 }
 function installPreCommitHook(root) {
   const hooksDir = hookDir(root);
-  fs6.mkdirSync(hooksDir, { recursive: true });
+  fs8.mkdirSync(hooksDir, { recursive: true });
   const file = path.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -1705,7 +2846,7 @@ function installPreCommitHook(root) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -1714,21 +2855,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs6.writeFileSync(file, content);
-  fs6.chmodSync(file, 493);
+  fs8.writeFileSync(file, content);
+  fs8.chmodSync(file, 493);
 }
 function undo(root) {
   const hookFile = path.join(hookDir(root), "pre-commit");
-  if (fs6.existsSync(hookFile)) {
+  if (fs8.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs6.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs6.rmSync(hookFile);
-    else fs6.writeFileSync(hookFile, next2);
+    const next2 = fs8.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs8.rmSync(hookFile);
+    else fs8.writeFileSync(hookFile, next2);
   }
   const attr = path.join(root, ".gitattributes");
-  if (fs6.existsSync(attr)) {
-    const next2 = fs6.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs6.writeFileSync(attr, next2);
+  if (fs8.existsSync(attr)) {
+    const next2 = fs8.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs8.writeFileSync(attr, next2);
   }
   try {
     git(root, ["config", "--remove-section", "merge.vg"]);
@@ -1861,7 +3002,7 @@ function grepBaselineTokens(term, files) {
     if (f.size > 512 * 1024) continue;
     let content = "";
     try {
-      content = fs6.readFileSync(f.abs, "utf8");
+      content = fs8.readFileSync(f.abs, "utf8");
     } catch {
       continue;
     }
@@ -1871,7 +3012,7 @@ function grepBaselineTokens(term, files) {
 }
 function safeSize(abs) {
   try {
-    return fs6.statSync(abs).size;
+    return fs8.statSync(abs).size;
   } catch {
     return 0;
   }
@@ -2193,9 +3334,9 @@ function normalizeStandards(raw) {
     const name = asString(r.name);
     if (!name) continue;
     const ecosystem = asString(r.ecosystem)?.toLowerCase();
-    const key = `${ecosystem ?? "*"}\0${name.toLowerCase()}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
+    const key2 = `${ecosystem ?? "*"}\0${name.toLowerCase()}`;
+    if (seen.has(key2)) continue;
+    seen.add(key2);
     banned.push({ name, ...ecosystem ? { ecosystem } : {}, ...asString(r.use) ? { use: asString(r.use) } : {}, ...asString(r.reason) ? { reason: asString(r.reason) } : {} });
   }
   return { banned };
@@ -2205,7 +3346,7 @@ function loadStandards(root) {
     const p = path__default.join(root, rel3);
     let text;
     try {
-      text = fs6__default.readFileSync(p, "utf8");
+      text = fs8__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -2373,7 +3514,7 @@ function printBreakdown(usage) {
   info(c.dim(`    avg success across commands: ${usage.avgSuccessPct}%`));
 }
 function printSplit(usage) {
-  const label = (key) => key === "mcp" ? "MCP tools" : key === "cli" ? "vg CLI" : key;
+  const label = (key2) => key2 === "mcp" ? "MCP tools" : key2 === "cli" ? "vg CLI" : key2;
   if (usage.sources.length) {
     info("");
     info(c.bold("  by source") + c.dim("  (how the call arrived)"));
@@ -2443,7 +3584,7 @@ async function addCmd(root, rest, opts, asJson) {
 }
 function readPackageVersion(root) {
   try {
-    const pkg = JSON.parse(fs6__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs8__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -2451,7 +3592,7 @@ function readPackageVersion(root) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs6__default.readFileSync(p, "utf8");
+    const t = fs8__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -2597,8 +3738,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs6.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
-    fs6.writeFileSync(file, content);
+    fs8.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+    fs8.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -2621,24 +3762,24 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs6.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
+    fs8.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs6.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
+      fs8.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = global.graph ?? defaultGraphPath(root);
-    if (fs6.existsSync(graphSrc)) {
-      fs6.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
+    if (fs8.existsSync(graphSrc)) {
+      fs8.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
       included.push("graph.json");
     }
     const cat = catalogPath(root);
-    if (fs6.existsSync(cat)) {
-      fs6.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
+    if (fs8.existsSync(cat)) {
+      fs8.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs6.existsSync(libDir(root))) {
-        fs6.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
+      if (fs8.existsSync(libDir(root))) {
+        fs8.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -2650,7 +3791,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs6.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs8.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path.relative(root, outDir), ...manifest });
@@ -2675,7 +3816,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-SRVG4ZAD.js');
+    const { runBaseline } = await import('./baseline-YWGSHCKW.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -2785,9 +3926,9 @@ async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3)
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs12.stat(absPath);
+    const stat2 = await fs14.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs12.readFile(absPath, "utf8");
+    return await fs14.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -2816,11 +3957,11 @@ async function analyzeReachability(input) {
   const importedModules = [];
   const seenPackages = /* @__PURE__ */ new Set();
   for (const dep of input.dependencies) {
-    const key = `${dep.ecosystem}|${dep.package}`;
-    if (seenPackages.has(key)) continue;
-    seenPackages.add(key);
+    const key2 = `${dep.ecosystem}|${dep.package}`;
+    if (seenPackages.has(key2)) continue;
+    seenPackages.add(key2);
     const evidence = collectPackageImports(input.graph, dep.ecosystem, dep.package);
-    evidenceByPackage.set(key, evidence);
+    evidenceByPackage.set(key2, evidence);
     if (evidence.supported && importedModules.length < MAX_IMPORTED_MODULE_PACKAGES) {
       importedModules.push({
         ecosystem: dep.ecosystem,
@@ -2835,8 +3976,8 @@ async function analyzeReachability(input) {
   );
   const findings = [];
   for (const entry of input.manifest) {
-    const key = `${entry.ecosystem}|${entry.package}`;
-    const evidence = evidenceByPackage.get(key) ?? collectPackageImports(input.graph, entry.ecosystem, entry.package);
+    const key2 = `${entry.ecosystem}|${entry.package}`;
+    const evidence = evidenceByPackage.get(key2) ?? collectPackageImports(input.graph, entry.ecosystem, entry.package);
     const baseConfidence = ECOSYSTEM_MATCH_CONFIDENCE[entry.ecosystem] ?? 0;
     if (!evidence.supported) {
       findings.push({
@@ -2934,9 +4075,9 @@ function collectPreflightDependencies(projects, projectTypeToEcosystem) {
     for (const dep of project.dependencies) {
       const version = dep.resolvedVersion || normalizeVersionSpec(dep.currentSpec);
       if (!version) continue;
-      const key = `${ecosystem}:${dep.package}:${version}`;
-      if (!deduped.has(key)) {
-        deduped.set(key, { ecosystem, package: dep.package, version });
+      const key2 = `${ecosystem}:${dep.package}:${version}`;
+      if (!deduped.has(key2)) {
+        deduped.set(key2, { ecosystem, package: dep.package, version });
       }
     }
   }
@@ -3058,7 +4199,9 @@ async function autoPush(artifact, rootDir, opts) {
     if (opts.strict) process.exit(1);
     return;
   }
-  const { body, contentEncoding } = await prepareCompressedUpload(artifact);
+  const config = await loadConfig(rootDir);
+  const databaseSchemaCaps = config.scanners !== false ? config.scanners?.databaseSchema : void 0;
+  const { body, contentEncoding } = await prepareCompressedUpload(artifact, { databaseSchemaCaps });
   const timestamp = String(Date.now());
   let host = parsed.host;
   if (opts.region) {
@@ -3083,7 +4226,11 @@ async function autoPush(artifact, rootDir, opts) {
       body,
       contentEncoding,
       timestamp,
-      force: opts.force
+      force: opts.force,
+      // Set only by an automated caller running the scan on the workspace's
+      // behalf (e.g. a Vibgrate-hosted remediation run) — never a customer flag.
+      runId: process.env.VIBGRATE_SCAN_RUN_ID,
+      runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN
     });
     host = uploadedHost;
     if (!response.ok) {
@@ -3158,7 +4305,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',
   collectExcludes,
   []
-).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
+).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk8.red(`Path does not exist: ${rootDir}`));
@@ -3332,7 +4479,7 @@ Failing: findings detected at warn level or above.`));
   }
   if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
     console.error(chalk8.red(`
-Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
+Failing fitness function: DriftScore ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
     process.exit(2);
   }
   if (scanOpts.driftWorseningPercent !== void 0) {
@@ -3405,7 +4552,7 @@ var WATCHED_FILES = /* @__PURE__ */ new Set([
   "packages.lock.json"
 ]);
 var WATCHED_EXT = /\.(cs|fs)proj$/i;
-var SKIP_DIRS = /* @__PURE__ */ new Set([
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   "dist",
@@ -3426,7 +4573,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs6.statSync(artifactPath).mtimeMs;
+    ref = fs8.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -3438,7 +4585,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3446,14 +4593,14 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk2(path.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
       const abs = path.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs6.statSync(abs).mtimeMs;
+        mtimeMs = fs8.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -3520,7 +4667,7 @@ function extractContracts(content, pkg, ecosystem) {
 }
 
 // src/reporting/planning/usage.ts
-var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+var SKIP_DIRS3 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   "dist",
@@ -3587,7 +4734,7 @@ function analyzeTree(root, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3595,7 +4742,7 @@ function analyzeTree(root, packages) {
     for (const entry of entries) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
-        if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
+        if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
         walk2(path.join(dir, entry.name), depth + 1);
         continue;
       }
@@ -3605,8 +4752,8 @@ function analyzeTree(root, packages) {
       const full = path.join(dir, entry.name);
       let content;
       try {
-        if (fs6.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs6.readFileSync(full, "utf8");
+        if (fs8.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs8.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -3702,9 +4849,6 @@ function planBlock(plan, recommended) {
   if (plan.upgrades.length > shown.length) {
     lines.push(chalk8.dim(`      \u2026 and ${plan.upgrades.length - shown.length} more`));
   }
-  if (plan.upgrades.length === 0) {
-    lines.push(chalk8.dim("      (no upgrades in this plan)"));
-  }
   return lines.join("\n");
 }
 function dataNote(report) {
@@ -3731,9 +4875,15 @@ function renderText(report) {
     out2.push(chalk8.red(`\u26A0 ${report.exploitability.kevPackages} package(s) carry a KNOWN-EXPLOITED (KEV) advisory${epss} \u2014 prioritise these.`));
   }
   out2.push("");
-  for (const plan of report.plans) {
-    out2.push(planBlock(plan, plan.tier === report.recommended));
+  const visiblePlans = report.plans.filter((plan) => plan.upgrades.length > 0);
+  if (visiblePlans.length === 0) {
+    out2.push(chalk8.green("\u2714 Nothing to upgrade \u2014 every tracked dependency is current."));
     out2.push("");
+  } else {
+    for (const plan of visiblePlans) {
+      out2.push(planBlock(plan, plan.tier === report.recommended));
+      out2.push("");
+    }
   }
   out2.push(chalk8.bold("Recommendation"));
   out2.push(`  ${chalk8.green(report.plans.find((p) => p.tier === report.recommended)?.label ?? report.recommended)} \u2014 ${report.rationale}`);
@@ -3756,7 +4906,12 @@ function renderMarkdown(report) {
     out2.push(`_${report.vulnerabilityData === "unavailable" ? "Advisory data was unavailable \u2014 vulnerability impact is not shown." : "Advisory data was partial \u2014 some ecosystems were not checked."}_`);
   }
   out2.push("");
-  for (const plan of report.plans) {
+  const visiblePlans = report.plans.filter((plan) => plan.upgrades.length > 0);
+  if (visiblePlans.length === 0) {
+    out2.push("\u2714 Nothing to upgrade \u2014 every tracked dependency is current.");
+    out2.push("");
+  }
+  for (const plan of visiblePlans) {
     const rec = plan.tier === report.recommended ? " \u2705 **recommended**" : "";
     out2.push(`## ${plan.label}${rec}`);
     out2.push("");
@@ -3769,14 +4924,12 @@ function renderMarkdown(report) {
       out2.push(`- \u26A0 Introduces advisories in target versions: ${deltaSummary(plan.introduces)}`);
     }
     out2.push("");
-    if (plan.upgrades.length) {
-      out2.push("| Package | From | To | Kind | Reason |");
-      out2.push("|---|---|---|---|---|");
-      for (const u of plan.upgrades) {
-        out2.push(`| \`${u.package}\` | ${u.from ?? "?"} | ${u.to ?? "?"} | ${u.kind} | ${u.reason} |`);
-      }
-      out2.push("");
+    out2.push("| Package | From | To | Kind | Reason |");
+    out2.push("|---|---|---|---|---|");
+    for (const u of plan.upgrades) {
+      out2.push(`| \`${u.package}\` | ${u.from ?? "?"} | ${u.to ?? "?"} | ${u.kind} | ${u.reason} |`);
     }
+    out2.push("");
   }
   out2.push("## Recommendation");
   out2.push("");
@@ -3789,6 +4942,29 @@ function renderMarkdown(report) {
   return out2.join("\n");
 }
 
+// src/reporting/planning/dedupe.ts
+var TIER_ORDER = ["safe", "balanced", "aggressive"];
+function upgradeSetKey(plan) {
+  return plan.upgrades.map((u) => `${u.ecosystem}\0${u.package}\0${u.from ?? ""}\0${u.to ?? ""}`).sort().join("\n");
+}
+function dedupePlans(plans) {
+  const byTier = (plan) => {
+    const i = TIER_ORDER.indexOf(plan.tier);
+    return i === -1 ? TIER_ORDER.length : i;
+  };
+  const ordered = [...plans].sort((a, b) => byTier(a) - byTier(b));
+  const survivorByKey = /* @__PURE__ */ new Map();
+  const canonicalTier = /* @__PURE__ */ new Map();
+  for (const plan of ordered) {
+    const key2 = upgradeSetKey(plan);
+    const survivor = survivorByKey.get(key2) ?? plan;
+    if (!survivorByKey.has(key2)) survivorByKey.set(key2, plan);
+    canonicalTier.set(plan.tier, survivor.tier);
+  }
+  const survivors = new Set(survivorByKey.values());
+  return { plans: plans.filter((p) => survivors.has(p)), canonicalTier };
+}
+
 // src/reporting/planning/expected-drift.ts
 function estimateDriftScore(artifact, upgraded) {
   const projects = JSON.parse(JSON.stringify(artifact.projects ?? []));
@@ -3797,6 +4973,11 @@ function estimateDriftScore(artifact, upgraded) {
     for (const dep of p.dependencies ?? []) {
       if (!upgraded.has(dep.package)) continue;
       const mb3 = dep.majorsBehind ?? 0;
+      dep.majorsBehind = 0;
+      dep.drift = "current";
+      if (dep.libyears != null) dep.libyears = 0;
+      if (dep.ageDays != null) dep.ageDays = 0;
+      if (dep.latestStable) dep.resolvedVersion = dep.latestStable;
       if (mb3 >= 2 && buckets.twoPlusBehind > 0) {
         buckets.twoPlusBehind--;
         buckets.current++;
@@ -3940,22 +5121,56 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs12.mkdir(CACHE_DIR, { recursive: true });
-    await fs12.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs14.mkdir(CACHE_DIR, { recursive: true });
+    await fs14.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
 
 // src/reporting/commands/update.ts
-function detectGlobalInstall() {
-  const execPath = process.argv[1] || "";
-  if (execPath.includes("/lib/node_modules/") || execPath.includes("\\node_modules\\")) {
-    if (!execPath.includes(process.cwd())) {
-      if (execPath.includes("pnpm")) return "pnpm";
-      if (execPath.includes("yarn")) return "yarn";
-      if (execPath.includes("bun")) return "bun";
-      return "npm";
+var PACKAGE_NAME = "@vibgrate/cli";
+function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd()) {
+  if (!execPath) return null;
+  let resolved = execPath;
+  try {
+    resolved = fs8.realpathSync(execPath);
+  } catch {
+  }
+  const p = resolved.replace(/\\/g, "/");
+  if (!p.includes("/node_modules/")) return null;
+  if (p.includes("/_npx/") || p.includes("/dlx-") || p.includes("/.bunx/")) return null;
+  const workdir = cwd.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (workdir && (p === workdir || p.startsWith(workdir + "/"))) return null;
+  if (p.includes("/pnpm/")) return "pnpm";
+  if (p.includes("/yarn/") || p.includes("/.yarn/")) return "yarn";
+  if (p.includes("/.bun/")) return "bun";
+  return "npm";
+}
+var defaultRunner = (cmd) => execSync(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
+  const tryRun = (cmd) => {
+    try {
+      const out2 = run(cmd).trim().split("\n")[0]?.trim();
+      return out2 || null;
+    } catch {
+      return null;
     }
+  };
+  const probes = [
+    { pm: "npm", root: () => tryRun("npm root -g") },
+    { pm: "pnpm", root: () => tryRun("pnpm root -g") },
+    {
+      pm: "yarn",
+      root: () => {
+        const dir = tryRun("yarn global dir");
+        return dir ? path.join(dir, "node_modules") : null;
+      }
+    },
+    { pm: "bun", root: () => path.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+  ];
+  for (const probe of probes) {
+    const root = probe.root();
+    if (root && await pathExists(path.join(root, pkg))) return probe.pm;
   }
   return null;
 }
@@ -4005,24 +5220,25 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
       return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
   }
 }
-async function isDevDependency(cwd) {
+async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
     const pkgPath = path.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
-    const pkg = JSON.parse(raw);
-    return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
+    const parsed = JSON.parse(raw);
+    if (parsed.devDependencies?.[pkg]) return "dev";
+    if (parsed.dependencies?.[pkg]) return "prod";
   } catch {
-    return true;
   }
+  return null;
 }
 async function confirmWorkspaceRoot(pm) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     rl.question(chalk8.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve16(t === "y" || t === "yes");
+      resolve17(t === "y" || t === "yes");
     });
   });
 }
@@ -4046,15 +5262,29 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       return;
     }
     const cwd = process.cwd();
-    const globalPm = detectGlobalInstall();
-    const isGlobal = opts.global || globalPm !== null;
-    const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
+    const runtimeGlobalPm = detectGlobalInstall();
+    let globalPm = runtimeGlobalPm;
+    let isGlobal = Boolean(opts.global) || runtimeGlobalPm !== null;
+    let localState = null;
+    if (!isGlobal) {
+      localState = await getLocalDependencyState(cwd);
+      if (localState === null) {
+        globalPm = await findGlobalInstall();
+        if (globalPm) {
+          isGlobal = true;
+          console.log(
+            chalk8.dim(`Found a global ${globalPm} installation of ${PACKAGE_NAME} \u2014 updating it instead of this project.`)
+          );
+        }
+      }
+    }
+    const pm = opts.pm || globalPm || await detectPackageManager(cwd);
     let cmd;
     if (isGlobal) {
-      cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
+      cmd = getGlobalUpdateCommand(pm, PACKAGE_NAME, latest);
       console.log(chalk8.dim(`Updating global installation with ${pm}: ${cmd}`));
     } else {
-      const isDev = await isDevDependency(cwd);
+      const isDev = localState !== "prod";
       let workspaceRoot = false;
       if (pm === "pnpm" && await detectWorkspaceRoot(cwd)) {
         console.log(
@@ -4062,19 +5292,19 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
         );
         const proceed = opts.yes || opts.workspaceRoot || await confirmWorkspaceRoot(pm);
         if (!proceed) {
-          const rootCmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot: true });
+          const rootCmd = getInstallCommand(pm, PACKAGE_NAME, latest, isDev, { workspaceRoot: true });
           console.log(chalk8.dim(`Skipped. To update the workspace root, run: ${rootCmd}`));
           console.log(chalk8.dim('or re-run "vg update --yes" (or --workspace-root) to let vg do it.'));
           return;
         }
         workspaceRoot = true;
       }
-      cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev, { workspaceRoot });
+      cmd = getInstallCommand(pm, PACKAGE_NAME, latest, isDev, { workspaceRoot });
       console.log(chalk8.dim(`Using ${pm}: ${cmd}`));
     }
     try {
       execSync(cmd, { cwd, stdio: "inherit" });
-      console.log(chalk8.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+      console.log(chalk8.green("\u2714") + ` Updated to ${PACKAGE_NAME}@${latest}`);
     } catch {
       console.error(chalk8.red(`Update failed. Run manually: ${cmd}`));
       process.exit(1);
@@ -4098,11 +5328,11 @@ function collectCandidates(artifact) {
   for (const project of artifact.projects ?? []) {
     const ecosystem = ecosystemId(project.type);
     for (const dep of project.dependencies ?? []) {
-      const key = `${ecosystem}\0${dep.package}`;
-      if (seen.has(key)) continue;
+      const key2 = `${ecosystem}\0${dep.package}`;
+      if (seen.has(key2)) continue;
       if (!dep.latestStable || dep.latestStable === dep.resolvedVersion) continue;
       if (dep.drift === "current" || dep.drift === "unknown") continue;
-      seen.add(key);
+      seen.add(key2);
       out2.push({
         package: dep.package,
         ecosystem,
@@ -4150,7 +5380,7 @@ async function repositoryIdentity(rootDir, override) {
     return { name: override?.trim() || void 0 };
   }
 }
-var fixCommand = new Command("fix").description("Analyse drift and get ranked, risk-tiered upgrade plans from the hosted planner (requires login/DSN; read-only \u2014 never edits your project)").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
+var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk8.red(`Path does not exist: ${rootDir}`));
@@ -4240,6 +5470,9 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
     if (response.requestId) console.error(chalk8.dim(`  (ref ${response.requestId})`));
     process.exit(1);
   }
+  const { plans: dedupedPlans, canonicalTier } = dedupePlans(response.plans);
+  response.plans = dedupedPlans;
+  response.recommended = canonicalTier.get(response.recommended) ?? response.recommended;
   const currentDrift = artifact.drift?.score;
   if (typeof currentDrift === "number") {
     response.currentDriftScore = currentDrift;
@@ -4252,7 +5485,7 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
   }
   emit(response, opts.format);
   if (opts.format === "text" && opts.apply !== false) {
-    await runApplyFlow(rootDir, artifact, response, opts);
+    await runApplyFlow(rootDir, artifact, response, opts, canonicalTier);
   }
   if (failOn) {
     const recommended = response.plans.find((p) => p.tier === response.recommended);
@@ -4261,7 +5494,8 @@ var fixCommand = new Command("fix").description("Analyse drift and get ranked, r
     for (const sev of Object.keys(SEVERITY_RANK)) {
       if (SEVERITY_RANK[sev] < threshold) continue;
       const open = response.unresolved.bySeverity[sev] ?? 0;
-      const notFixedByRecommended = (response.plans.find((p) => p.tier === "aggressive")?.fixes.bySeverity[sev] ?? 0) - (recommended?.fixes.bySeverity[sev] ?? 0);
+      const maxFixable = Math.max(0, ...response.plans.map((p) => p.fixes.bySeverity[sev] ?? 0));
+      const notFixedByRecommended = maxFixable - (recommended?.fixes.bySeverity[sev] ?? 0);
       stillOpen += open + Math.max(0, notFixedByRecommended);
     }
     if (stillOpen > 0) {
@@ -4318,8 +5552,8 @@ async function buildTargetResolver(rootDir, artifact) {
     const ecosystem = ecosystemId(project.type);
     const dir = relProjectDir(rootDir, project.path);
     for (const dep of project.dependencies ?? []) {
-      const key = `${ecosystem}\0${dep.package}`;
-      (owners.get(key) ?? owners.set(key, /* @__PURE__ */ new Set()).get(key)).add(dir);
+      const key2 = `${ecosystem}\0${dep.package}`;
+      (owners.get(key2) ?? owners.set(key2, /* @__PURE__ */ new Set()).get(key2)).add(dir);
     }
   }
   const rootFallback = [{ dir: ".", isWorkspaceRoot: rootIsWorkspace }];
@@ -4349,18 +5583,18 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve16(null);
+      if (t === "q" || t === "quit") return resolve17(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve16(null);
-      resolve16(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve17(null);
+      resolve17(plans[n - 1].tier);
     });
   });
 }
-async function runApplyFlow(rootDir, artifact, response, opts) {
+async function runApplyFlow(rootDir, artifact, response, opts, canonicalTier) {
   const nonEmpty = response.plans.filter((p) => p.upgrades.length > 0);
   if (nonEmpty.length === 0) {
     console.log(chalk8.green("\n\u2714 Nothing to upgrade \u2014 every tracked dependency is current."));
@@ -4368,7 +5602,8 @@ async function runApplyFlow(rootDir, artifact, response, opts) {
   }
   let chosen;
   if (opts.plan) {
-    chosen = response.plans.find((p) => p.tier === opts.plan);
+    const tier = canonicalTier?.get(opts.plan) ?? opts.plan;
+    chosen = response.plans.find((p) => p.tier === tier);
     if (!chosen) {
       console.error(chalk8.red(`Unknown plan '${opts.plan}'. Use safe, balanced, or aggressive.`));
       process.exit(1);
@@ -4727,6 +5962,26 @@ function formatExtended(ext) {
     }
     lines.push("");
   }
+  if (ext.databaseSchema) {
+    const ds = ext.databaseSchema;
+    lines.push(chalk8.bold.underline("  Database Schema"));
+    const dsHead = [];
+    if (ds.providers.length > 0) dsHead.push(ds.providers.join(", "));
+    dsHead.push(`${ds.models.length} model${ds.models.length !== 1 ? "s" : ""}`);
+    dsHead.push(`${ds.enums.length} enum${ds.enums.length !== 1 ? "s" : ""}`);
+    lines.push(`    ${dsHead.join(" \xB7 ")}`);
+    const bySource = /* @__PURE__ */ new Map();
+    for (const m of ds.models) bySource.set(m.source, (bySource.get(m.source) ?? 0) + 1);
+    if (bySource.size > 1) {
+      const sourceSummary = [...bySource.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([s, n]) => `${s}: ${n}`).join(", ");
+      lines.push(`    Sources: ${sourceSummary}`);
+    }
+    if (ds.models.length > 0) {
+      const preview = ds.models.slice(0, 5).map((m) => m.name).join(", ");
+      lines.push(`    Models: ${chalk8.white(preview)}${ds.models.length > 5 ? chalk8.dim(` (+${ds.models.length - 5} more)`) : ""}`);
+    }
+    lines.push("");
+  }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
@@ -5168,7 +6423,7 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
+var delay = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
 function isInside(dir, file) {
   const rel3 = path.relative(dir, file);
   return !!rel3 && !rel3.startsWith("..") && !path.isAbsolute(rel3);
@@ -5593,21 +6848,21 @@ function formatDeltaText(base, current) {
   const added = [];
   const removed = [];
   const changed = [];
-  for (const [key, dep] of currentMap.entries()) {
-    if (!baseMap.has(key)) {
-      added.push(`${key} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
+  for (const [key2, dep] of currentMap.entries()) {
+    if (!baseMap.has(key2)) {
+      added.push(`${key2} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
       continue;
     }
-    const prev = baseMap.get(key);
+    const prev = baseMap.get(key2);
     const prevVersion = prev.resolvedVersion ?? prev.currentSpec;
     const nowVersion = dep.resolvedVersion ?? dep.currentSpec;
     if (prevVersion !== nowVersion || prev.majorsBehind !== dep.majorsBehind) {
-      changed.push(`${key} ${prevVersion} -> ${nowVersion} (majorsBehind ${prev.majorsBehind ?? "unknown"} -> ${dep.majorsBehind ?? "unknown"})`);
+      changed.push(`${key2} ${prevVersion} -> ${nowVersion} (majorsBehind ${prev.majorsBehind ?? "unknown"} -> ${dep.majorsBehind ?? "unknown"})`);
     }
   }
-  for (const [key, dep] of baseMap.entries()) {
-    if (!currentMap.has(key)) {
-      removed.push(`${key} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
+  for (const [key2, dep] of baseMap.entries()) {
+    if (!currentMap.has(key2)) {
+      removed.push(`${key2} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
     }
   }
   const lines = [
@@ -5615,7 +6870,7 @@ function formatDeltaText(base, current) {
     "===================",
     `Baseline: ${base.timestamp}`,
     `Current:  ${current.timestamp}`,
-    `Drift score delta: ${(current.drift.score - base.drift.score).toFixed(2)} points`,
+    `DriftScore delta: ${(current.drift.score - base.drift.score).toFixed(2)} points`,
     "",
     `Added dependencies (${added.length})`,
     ...added.map((d) => `  + ${d}`),
@@ -5693,6 +6948,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "areas",
   "oddities",
   "serve",
+  "lsp",
   "install",
   "uninstall",
   "share",
@@ -5733,6 +6989,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerImpact(program);
   registerUnknowns(program);
   registerServe(program);
+  registerLsp(program);
   registerInstall(program);
   registerShare(program);
   registerBenchmark(program);
@@ -5814,7 +7071,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs6.existsSync(path.resolve(cwd, first))) {
+  if (fs8.existsSync(path.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];