@vibgrate/cli 2026.717.1 → 2026.718.2

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, detectAssistants, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady, SKIP_DIRS, SKIP_FILES } from './chunk-L42NVMD6.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, detectAssistants, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, hostedBase, verifyDeterminism, renderHtml, isModelReady, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-H5M7CXE6.js';
 import { resolvedGrammarFiles, grammarSetVersion, hashString, canonicalize, hashBytes } from './chunk-VFO5UDAT.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-WZNIDXZP.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-M62BGJMK.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-BFXDF6ZE.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-RME7BFMU.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import * as fs8 from 'fs';
@@ -16,7 +16,7 @@ import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
 import chalk8 from 'chalk';
 import * as os from 'os';
-import * as fs14 from 'fs/promises';
+import * as fs15 from 'fs/promises';
 import * as readline from 'readline';
 import semver from 'semver';
 
@@ -1287,7 +1287,31 @@ var OFFSET_FILE = "stats-share.json";
 var INSTALL_ID_DIR = path.join(os.homedir(), ".vibgrate");
 var INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, "install-id");
 var SEND_TIMEOUT_MS = 4e3;
-function installId() {
+function telemetryOptOut(env = process.env) {
+  const dnt = (env.DO_NOT_TRACK ?? "").trim().toLowerCase();
+  if (dnt !== "" && dnt !== "0" && dnt !== "false") return "DO_NOT_TRACK";
+  const vt = (env.VIBGRATE_TELEMETRY ?? "").trim().toLowerCase();
+  if (vt === "0" || vt === "false" || vt === "off") return "VIBGRATE_TELEMETRY";
+  return null;
+}
+var CI_ENV_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "CIRCLECI",
+  "TRAVIS",
+  "BUILDKITE",
+  "JENKINS_URL",
+  "TF_BUILD"
+];
+function isCI(env = process.env) {
+  return CI_ENV_VARS.some((v) => {
+    const val = (env[v] ?? "").trim().toLowerCase();
+    return val !== "" && val !== "0" && val !== "false";
+  });
+}
+function installId(env = process.env) {
+  if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();
   try {
     const existing = fs8.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
@@ -1463,6 +1487,27 @@ var StatsSharer = class {
   }
 };
 
+// src/util/origin.ts
+function originAllowed(origin, allowlist) {
+  if (origin === void 0 || origin === "") return true;
+  const allowed = (allowlist ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (allowed.includes("*")) return true;
+  if (allowed.includes(origin)) return true;
+  return isLoopbackOrigin(origin);
+}
+function isLoopbackOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  const host = url.hostname;
+  if (host === "localhost" || host === "[::1]" || host === "::1") return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+
 // src/commands/serve.ts
 var SHARE_FLUSH_INTERVAL_MS = 5 * 60 * 1e3;
 function registerServe(program) {
@@ -1472,9 +1517,14 @@ function registerServe(program) {
     const graphPath = global.graph ?? defaultGraphPath(root);
     const refresh = opts.refresh !== false && !global.graph;
     const local = global.local === true;
-    const shareStats = opts.shareStats === true && !local;
+    const optOut = telemetryOptOut();
+    const shareStats = opts.shareStats === true && !local && optOut === null;
     const serveOpts = {
-      savings: opts.savings === true || shareStats,
+      // A *requested* --share-stats always implies local recording, even when
+      // the upload itself is suppressed (--local / env opt-out) — the local
+      // ledger never leaves the machine, and the disclosure messages below
+      // promise "recording locally".
+      savings: opts.savings === true || opts.shareStats === true,
       shareStats,
       local,
       dedup: opts.dedup === true,
@@ -1483,6 +1533,8 @@ function registerServe(program) {
     await ensureServableGraph(root, graphPath, global, refresh);
     if (opts.shareStats === true && local) {
       info(c.dim("vg \xB7 --share-stats ignored under --local (air-gapped): recording locally, not uploading."));
+    } else if (opts.shareStats === true && optOut !== null) {
+      info(c.dim(`vg \xB7 --share-stats disabled by ${optOut}: recording locally, not uploading.`));
     }
     if (shareStats) startSharing(root);
     const freshness = refresh ? "auto-refresh" : "as built";
@@ -1555,6 +1607,13 @@ async function serveHttp(graphPath, host, port, opts, freshness) {
       res.writeHead(404).end("not found");
       return;
     }
+    const origin = req.headers.origin;
+    if (!originAllowed(origin, process.env.VIBGRATE_ALLOWED_ORIGINS)) {
+      res.writeHead(403, { "Content-Type": "text/plain" }).end(
+        "forbidden origin \u2014 vg serve only accepts browser requests from loopback origins. Set VIBGRATE_ALLOWED_ORIGINS to allow others."
+      );
+      return;
+    }
     try {
       const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
       const server = createServer(source, opts);
@@ -3803,6 +3862,125 @@ function registerBundle(program) {
   });
   applyGlobalOptions(cmd);
 }
+function registerDoctor(program) {
+  const cmd = program.command("doctor").description("diagnose your setup: config, credentials, map freshness, hosted reachability, MCP launch").action(async function() {
+    await runDoctor(readGlobal(this));
+  });
+  applyGlobalOptions(cmd);
+}
+var REACH_TIMEOUT_MS = 3e3;
+var CONFIG_BASENAMES = ["vibgrate.config.ts", "vibgrate.config.js", "vibgrate.config.json"];
+async function runDoctor(global) {
+  const root = rootOf(global);
+  const local = global.local === true;
+  const graphPath = global.graph ?? defaultGraphPath(root);
+  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path.join(root, f))) ?? null;
+  const graph = loadGraph(root, graphPath);
+  let staleFiles = null;
+  if (graph) {
+    const probe = probeFreshness(root);
+    if (probe) staleFiles = driftCount(probe.drift);
+  }
+  const catalog = loadCatalog(root);
+  const libCount = Object.keys(catalog.libraries).length;
+  const creds = diagnoseCredentials(root);
+  const base = hostedBase();
+  const reachable = local ? null : await probeReachable(base);
+  const launch = detectServeLaunch();
+  const optOut = telemetryOptOut();
+  const d = {
+    version: VERSION,
+    node: process.version,
+    platform: `${process.platform}/${process.arch}`,
+    root,
+    configFile,
+    map: {
+      path: path.relative(root, graphPath),
+      built: graph !== null,
+      generatedAt: graph?.generatedAt ?? null,
+      staleFiles
+    },
+    libCatalog: {
+      path: path.relative(root, catalogPath(root)),
+      present: fs8.existsSync(catalogPath(root)),
+      libraries: libCount
+    },
+    credentials: creds,
+    hosted: { base, checked: !local, reachable },
+    mcpLaunch: { command: launch.command, args: launch.args, note: launch.note ?? null },
+    telemetry: { optOut, ci: isCI(), endpoint: statsEndpoint() }
+  };
+  if (global.json) {
+    json(d);
+    return;
+  }
+  info(`${c.cyan("vg")} doctor \xB7 v${d.version} \xB7 node ${d.node} \xB7 ${d.platform}`);
+  info(`  root       ${d.root}`);
+  info(`  config     ${d.configFile ? c.green(d.configFile) : c.dim("none (defaults) \u2014 `vg init` writes one")}`);
+  if (!d.map.built) {
+    info(`  map        ${c.yellow("none")} \u2014 run ${c.bold("vg")} to build ${c.dim(d.map.path)}`);
+  } else {
+    const fresh = d.map.staleFiles == null ? c.dim("freshness unknown (no snapshot)") : d.map.staleFiles === 0 ? c.green("up to date") : c.yellow(`${d.map.staleFiles} file(s) stale \u2014 auto-refreshes on next query`);
+    info(`  map        ${c.green("built")} ${c.dim(d.map.generatedAt ?? "")} \xB7 ${fresh}`);
+  }
+  info(
+    `  lib        ${d.libCatalog.present ? `${c.green(String(d.libCatalog.libraries))} librar${d.libCatalog.libraries === 1 ? "y" : "ies"} in ${d.libCatalog.path}` : c.dim("no catalog \u2014 `vg lib add <source>` starts one; `vg lib <name>` works without it")}`
+  );
+  if (d.credentials.source === "none") {
+    info(`  auth       ${c.dim("anonymous \u2014 fine for everything local; `vg login` enables push/publish")}`);
+  } else {
+    info(
+      `  auth       ${c.green(d.credentials.source)} ${c.dim(d.credentials.path ?? "")} \xB7 workspace ${d.credentials.workspaceId ?? "?"} \xB7 ${d.credentials.host ?? "?"}`
+    );
+  }
+  if (!d.hosted.checked) {
+    info(`  hosted     ${c.dim(`skipped under --local (${d.hosted.base})`)}`);
+  } else {
+    info(
+      `  hosted     ${d.hosted.base} \xB7 ${d.hosted.reachable ? c.green("reachable") : c.yellow("unreachable \u2014 local answers still work")}`
+    );
+  }
+  info(
+    `  mcp        ${c.bold(`${d.mcpLaunch.command} ${d.mcpLaunch.args.join(" ")}`)}${d.mcpLaunch.note ? c.dim(` (${d.mcpLaunch.note})`) : ""}`
+  );
+  const tel = d.telemetry.optOut ? c.green(`opted out via ${d.telemetry.optOut}`) : "off by default \u2014 only `vg serve --share-stats` ever uploads";
+  info(`  telemetry  ${tel}${d.telemetry.ci ? c.dim(" \xB7 CI detected") : ""}`);
+}
+function diagnoseCredentials(root) {
+  const none = { source: "none", path: null, host: null, workspaceId: null };
+  if (process.env.VIBGRATE_DSN) {
+    const parsed2 = parseDsn$1(process.env.VIBGRATE_DSN);
+    return { source: "env", path: null, host: parsed2?.host ?? null, workspaceId: parsed2?.workspaceId ?? null };
+  }
+  const stored = readStoredCredentials({ cwd: root });
+  if (!stored) return none;
+  const file = credentialsPath({ cwd: root });
+  const source = process.env.VIBGRATE_CREDENTIALS ? "env" : file === projectCredentialsPath(root) ? "project" : "home";
+  const parsed = parseDsn$1(stored.dsn);
+  return {
+    source,
+    path: shortenHome(file),
+    host: stored.ingestHost ?? parsed?.host ?? null,
+    workspaceId: stored.workspaceId ?? parsed?.workspaceId ?? null
+  };
+}
+function shortenHome(p) {
+  const home = homeCredentialsPath().slice(0, -"/.vibgrate/credentials.json".length);
+  return p.startsWith(home) ? `~${p.slice(home.length)}` : p;
+}
+async function probeReachable(base) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REACH_TIMEOUT_MS);
+  timer.unref?.();
+  try {
+    await fetch(base, { method: "HEAD", signal: controller.signal });
+    return true;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   const vibgrateDir2 = path.join(rootDir, ".vibgrate");
@@ -3816,7 +3994,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-YWGSHCKW.js');
+    const { runBaseline } = await import('./baseline-DKPQWOQ6.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -3926,9 +4104,9 @@ async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3)
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs14.stat(absPath);
+    const stat2 = await fs15.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs14.readFile(absPath, "utf8");
+    return await fs15.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -5121,8 +5299,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs14.mkdir(CACHE_DIR, { recursive: true });
-    await fs14.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs15.mkdir(CACHE_DIR, { recursive: true });
+    await fs15.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -6949,6 +7127,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "oddities",
   "serve",
   "lsp",
+  "doctor",
   "install",
   "uninstall",
   "share",
@@ -7004,6 +7183,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerLib(program);
   registerExport(program);
   registerBundle(program);
+  registerDoctor(program);
   program.addCommand(initCommand);
   program.addCommand(scanCommand);
   program.addCommand(fixCommand);