@vibgrate/cli 2026.727.3 → 2026.728.2

package/dist/cli.js

@@ -1,33 +1,37 @@
 #!/usr/bin/env node
-import { loadAdvancedScanHook, baselineCommand } from './chunk-FFWGT55D.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-C66GOHYB.js';
-export { runBuild } from './chunk-C66GOHYB.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-Z7GP7XTJ.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-IWP7MYIA.js';
+export { runBuild } from './chunk-IWP7MYIA.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-A2IYFNCQ.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-NTW5UEKT.js';
+import { runCodeSession } from './chunk-WH2N22S3.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-YF43FOPP.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-77LYGXBI.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-JRAGO6OB.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { gatherSystemMemory } from './chunk-6UQMXIAG.js';
-import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-3V24O47U.js';
+import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-PVZBYZZR.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
 import './chunk-HK3AWUXH.js';
 import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
-import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-PXHNTC6D.js';
-import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-K7REHDQS.js';
+import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-SIPGDJT4.js';
+import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-6HX47EBL.js';
 import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
-import './chunk-NDMDSPFX.js';
-import { runCodeSession } from './chunk-2VFWXNS5.js';
-import { ensurePackage, ensureUnavailableMessage, isPackageInstalled, summarizeDiffs, ScriptedProvider } from './chunk-OFUC6RYN.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-AVQSHIJ5.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, NPX_INVOCATION, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-MAY5HLDH.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6JIKUDWM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-Y23HMSWU.js';
+import './chunk-KKRSQQ3A.js';
+import { buildModelInstallPlan } from './chunk-UIOBFLE6.js';
+import { ensurePackage, ensureUnavailableMessage } from './chunk-OSD546W7.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WY6DGTBP.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-GQTWDKMJ.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6AXHLQBV.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-ZFTFCM7B.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { discoverModels, listCachedWeights, isWeightCached, lookupCatalog, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-OOIG3RUM.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6UK6QPTR.js';
+import { discoverModels } from './chunk-3SDV6ADQ.js';
+import { resolveCliInvocation, NPX_INVOCATION } from './chunk-UZJS7GMK.js';
+import { listCachedWeights, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-GYSOQH5C.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-ON25BX6T.js';
 import './chunk-RXP66R2E.js';
 import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-B3YUO3NW.js';
@@ -2133,9 +2137,19 @@ function runTree(graph, params) {
 // src/lsp/enrich.ts
 var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
 var cache = /* @__PURE__ */ new Map();
+var SEVERITY_RANK = {
+  critical: 4,
+  high: 3,
+  moderate: 2,
+  low: 1,
+  unknown: 0
+};
 function key(ecosystem, name, version) {
   return `${ecosystem}:${name}@${version}`;
 }
+function emptyCounts() {
+  return { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 };
+}
 function severityOf(v) {
   const dbSpecific = v.database_specific;
   const label = typeof dbSpecific?.severity === "string" ? dbSpecific.severity.toLowerCase() : "";
@@ -2194,6 +2208,62 @@ async function enrichVulns(ecosystem, name, version, opts = { offline: false })
     return { vulns: [], cveCount: 0, source: "error" };
   }
 }
+async function scanWorkspaceVulns(targets, opts = { offline: false }) {
+  if (opts.offline) {
+    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "offline" };
+  }
+  if (targets.length === 0) {
+    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "osv" };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const t of targets) {
+    if (!t.ecosystem || !t.package || !t.version) continue;
+    const k = key(t.ecosystem, t.package, t.version);
+    if (seen.has(k)) continue;
+    seen.add(k);
+    unique.push(t);
+  }
+  const concurrency = Math.max(1, Math.min(opts.concurrency ?? 8, 16));
+  const findings = [];
+  let anyOk = false;
+  let anyError = false;
+  let i = 0;
+  async function worker() {
+    for (; ; ) {
+      const idx = i++;
+      if (idx >= unique.length) return;
+      const t = unique[idx];
+      const r = await enrichVulns(t.ecosystem, t.package, t.version, { offline: false });
+      if (r.source === "osv" || r.source === "cache") anyOk = true;
+      else if (r.source === "error") anyError = true;
+      for (const v of r.vulns) {
+        findings.push({
+          package: t.package,
+          version: t.version,
+          ecosystem: t.ecosystem,
+          id: v.id,
+          cves: v.cves,
+          summary: v.summary,
+          severity: v.severity
+        });
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, unique.length) }, () => worker()));
+  findings.sort(
+    (a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.package.localeCompare(b.package) || a.id.localeCompare(b.id)
+  );
+  const counts = emptyCounts();
+  for (const f of findings) counts[f.severity]++;
+  const source = anyOk ? "osv" : anyError ? "error" : "osv";
+  return {
+    findings,
+    counts,
+    packagesChecked: unique.length,
+    source
+  };
+}
 
 // src/lsp/server.ts
 function bandForDependency(dep) {
@@ -2281,6 +2351,7 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
     this.conn.onRequest("vibgrate/enrich", (_m, params) => this.onEnrich(params));
+    this.conn.onRequest("vibgrate/vulns", (_m, _params) => this.onVulns());
     this.conn.onRequest("workspace/executeCommand", (_m, params) => {
       const p = params;
       if (p.command === "vibgrate.rescan") {
@@ -2536,6 +2607,31 @@ var VibgrateLanguageServer = class {
     const p = params ?? {};
     return enrichVulns(p.ecosystem ?? null, p.package ?? "", p.version ?? null, { offline: this.opts.offline });
   }
+  /**
+   * `vibgrate/vulns` — live OSV.dev pass over every resolved dependency in the
+   * current workspace artifact. Powers the Vulnerabilities panel. Empty
+   * findings with `source: 'osv'` means checked clean; `offline`/`error` mean
+   * we could not check (absent ≠ zero).
+   */
+  async onVulns() {
+    if (this.opts.offline) {
+      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "offline" };
+    }
+    const a = this.artifact;
+    if (!a) {
+      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "pending" };
+    }
+    const targets = [];
+    for (const proj of a.projects ?? []) {
+      const ecosystem = osvEcosystem(proj.type);
+      if (!ecosystem) continue;
+      for (const dep of proj.dependencies ?? []) {
+        if (!dep.resolvedVersion) continue;
+        targets.push({ ecosystem, package: dep.package, version: dep.resolvedVersion });
+      }
+    }
+    return scanWorkspaceVulns(targets, { offline: this.opts.offline });
+  }
   onScoreForFile(params) {
     const p = params;
     const a = this.artifact;
@@ -3540,166 +3636,6 @@ function toEstimateJson(e) {
     guessed: e.guessed
   };
 }
-
-// src/runtime/model-install-plan.ts
-var MODEL_INSTALL_PLAN_SCHEMA_VERSION = "model-install-plan/0";
-function runtimeDepsForBackend(backend) {
-  const b = backend.toLowerCase();
-  if (b === "llama.cpp" || b === "llama-cpp" || b === "vibgrate") {
-    return [
-      {
-        id: "node-llama-cpp",
-        kind: "npm-runtime",
-        spec: "node-llama-cpp@^3",
-        reason: "in-process llama.cpp binding for the first-party / llama-cpp provider"
-      }
-    ];
-  }
-  if (b === "ollama") {
-    return [
-      {
-        id: "ollama",
-        kind: "native-binary",
-        binary: "ollama",
-        reason: "Ollama on PATH (install from https://ollama.com \u2014 third-party apps are not auto-installed)"
-      }
-    ];
-  }
-  return [];
-}
-function weightsChannelForBackend(backend, opts) {
-  const b = backend.toLowerCase();
-  if (b === "ollama") return "ollama";
-  if (b === "llama.cpp" || b === "llama-cpp" || b === "vibgrate") {
-    if (opts?.downloadUrl || opts?.weightsRef && lookupCatalog(opts.weightsRef)) return "vibgrate";
-    return "local-path";
-  }
-  if (b === "lm-studio" || b === "lmstudio" || b === "foundry-local") return "manual";
-  return "manual";
-}
-function weightsInstalled(ref, installedNames) {
-  const want = ref.toLowerCase();
-  return installedNames.some((n) => {
-    const have = n.toLowerCase();
-    return have === want || have.includes(want) || want.includes(have);
-  });
-}
-function buildModelInstallPlan(input) {
-  const hasBinary2 = input.hasBinary ?? (() => false);
-  const pkgInstalled = input.isPackageInstalled ?? isPackageInstalled;
-  const installedNames = input.installedNames ?? [];
-  const offline = !!input.offline;
-  const backend = input.backend;
-  const provider = providerLabel(backend);
-  const runtimeDeps = runtimeDepsForBackend(backend).map((dep) => {
-    if (dep.kind === "npm-runtime" && dep.spec) {
-      return { ...dep, status: pkgInstalled(dep.spec) ? "satisfied" : "missing" };
-    }
-    if (dep.kind === "native-binary" && dep.binary) {
-      return { ...dep, status: hasBinary2(dep.binary) ? "satisfied" : "unmanaged" };
-    }
-    return { ...dep, status: "unmanaged" };
-  });
-  const channel = weightsChannelForBackend(backend, {
-    downloadUrl: input.downloadUrl,
-    weightsRef: input.weightsRef
-  });
-  const weightCached = (input.isWeightCached ?? isWeightCached)(input.weightsRef);
-  const catalog = lookupCatalog(input.weightsRef);
-  const downloadUrl = input.downloadUrl ?? catalog?.url;
-  let weightsStatus = "missing";
-  if (channel === "ollama") {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) ? "satisfied" : "missing";
-  } else if (channel === "vibgrate") {
-    weightsStatus = weightCached || weightsInstalled(input.weightsRef, installedNames) || !!input.modelPath ? "satisfied" : "missing";
-  } else if (channel === "local-path") {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) || !!input.modelPath || weightCached ? "satisfied" : "manual";
-  } else {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) ? "satisfied" : "manual";
-  }
-  const alreadySatisfied = [];
-  const willInstall = [];
-  const willDownload = [];
-  const blocked = [];
-  for (const dep of runtimeDeps) {
-    if (dep.status === "satisfied") {
-      alreadySatisfied.push(dep.id);
-      continue;
-    }
-    if (dep.kind === "npm-runtime" && dep.spec && dep.status === "missing") {
-      if (offline) {
-        blocked.push({ id: dep.id, reason: `${dep.spec} needed but --local/offline forbids install` });
-      } else {
-        willInstall.push(dep.spec);
-      }
-      continue;
-    }
-    if (dep.kind === "native-binary" && dep.status === "unmanaged") {
-      blocked.push({
-        id: dep.id,
-        reason: dep.reason
-      });
-    }
-  }
-  if (weightsStatus === "satisfied") {
-    alreadySatisfied.push(`weights:${input.weightsRef}`);
-  } else if (weightsStatus === "missing" && (channel === "ollama" || channel === "vibgrate")) {
-    if (offline) {
-      blocked.push({ id: `weights:${input.weightsRef}`, reason: "weights missing and --local/offline forbids download" });
-    } else if (channel === "ollama" && runtimeDeps.some((d) => d.id === "ollama" && d.status === "unmanaged")) {
-      willDownload.push(input.weightsRef);
-    } else if (channel === "vibgrate" && !downloadUrl) {
-      blocked.push({
-        id: `weights:${input.weightsRef}`,
-        reason: `no first-party download URL for ${input.weightsRef} \u2014 place a gguf in the weight store or pass --model-path`
-      });
-    } else {
-      willDownload.push(input.weightsRef);
-    }
-  } else if (weightsStatus === "manual" || weightsStatus === "missing") {
-    blocked.push({
-      id: `weights:${input.weightsRef}`,
-      reason: channel === "local-path" ? `point --model-path at a local gguf for ${input.weightsRef}, or run install when a first-party URL is catalogued` : `install or link weights for ${input.weightsRef} via the backend app`
-    });
-  }
-  const effectiveWillInstall = offline ? [] : willInstall;
-  const effectiveWillDownload = offline ? [] : willDownload;
-  const offlineBlocked = offline && blocked.some((b) => /offline|forbids/i.test(b.reason));
-  const allRuntimeOk = runtimeDeps.every((d) => d.status === "satisfied");
-  const fullyReady = allRuntimeOk && weightsStatus === "satisfied" && blocked.length === 0;
-  return {
-    schemaVersion: MODEL_INSTALL_PLAN_SCHEMA_VERSION,
-    provider,
-    backend,
-    model: input.weightsRef,
-    mode: input.mode,
-    packId: input.packId,
-    license: input.license,
-    promise: input.promise,
-    fit: input.fit,
-    runtimeDeps,
-    weights: {
-      channel,
-      ref: input.weightsRef,
-      status: weightsStatus,
-      downloadUrl: channel === "vibgrate" ? downloadUrl : void 0
-    },
-    alreadySatisfied,
-    willInstall: effectiveWillInstall,
-    willDownload: effectiveWillDownload,
-    blocked,
-    offlineBlocked,
-    ready: fullyReady
-  };
-}
-function providerLabel(backend) {
-  const b = backend.toLowerCase();
-  if (b === "llama.cpp" || b === "llama-cpp") return "llama-cpp";
-  if (b === "vibgrate") return "vibgrate";
-  if (b === "lm-studio" || b === "lmstudio") return "lmstudio";
-  if (b === "foundry-local") return "foundry-local";
-  return b === "ollama" ? "ollama" : backend;
-}
 async function executeModelInstallPlan(plan, options = {}) {
   const installedDeps = [];
   const pulledWeights = [];
@@ -3742,7 +3678,7 @@ async function executeModelInstallPlan(plan, options = {}) {
         plan,
         installedDeps,
         pulledWeights,
-        error: ensureUnavailableMessage(res.reason ?? "install-failed", spec)
+        error: ensureUnavailableMessage(res.reason ?? "install-failed", spec, res.detail)
       };
     }
     installedDeps.push(spec);
@@ -5853,9 +5789,11 @@ function registerCode(program) {
     let provider = opts.provider ?? config.provider;
     let model = opts.model ?? config.model;
     const modeFlag = opts.mode ?? config.modelProfile?.mode;
-    if (!opts.model && !opts.modelPath && (modeFlag || !provider && !model)) {
+    let codeModeActive = false;
+    const customSelection = !!(opts.provider || opts.model || opts.modelPath || config.provider || config.model);
+    if (!customSelection && (modeFlag || !provider && !model)) {
       try {
-        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2, providerForBackend: providerForBackend2 } = await import('./model-orchestrator-TVONAUPS.js');
+        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-4VSYP4J4.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-5O2NN3GA.js');
         const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
         const state = readOrchestratorState2();
@@ -5886,26 +5824,31 @@ function registerCode(program) {
             ExitCode.ERROR
           );
         }
-        const { resolveGgufPath } = await import('./resolve-gguf-VPL4YQ6J.js');
+        const { resolveGgufPath } = await import('./resolve-gguf-Y6FH3CNB.js');
+        const primaryRef = resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : resolved.underlying.weightsRef;
         const gguf = resolveGgufPath({
-          modelRef: resolved.underlying.weightsRef,
+          modelRef: primaryRef,
           modelPath: opts.modelPath
         }) ?? resolveGgufPath({
-          modelRef: resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : void 0
+          modelRef: resolved.underlying.weightsRef,
+          modelPath: opts.modelPath
         });
-        if (gguf && !opts.provider) {
+        if (!gguf && !opts.mock) {
+          throw new CliError(
+            `Code Mode ${resolved.mode} uses the Vibgrate model manager \u2014 weights not installed. Run \`vg models install ${resolved.mode}\` then retry. (Custom Ollama/LM Studio: pass --provider explicitly.)`,
+            ExitCode.NOT_FOUND
+          );
+        }
+        if (gguf) {
+          codeModeActive = true;
           provider = "llama-cpp";
-          model = model ?? gguf.ref ?? resolved.underlying.weightsRef;
+          model = model ?? gguf.ref ?? primaryRef;
           opts.modelPath = gguf.path;
           if (!global.json && !global.quiet && !opts.streamJson) {
             info(
-              `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 embedded llama.cpp ${c.dim(gguf.path)} ${c.dim(`(${resolved.fit.label})`)}`
+              `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 Vibgrate manager ${c.dim(gguf.path)} ${c.dim(`(${resolved.fit.label})`)}`
             );
           }
-        } else {
-          const ollamaFb = resolved.underlying.backend === "ollama" ? resolved.underlying : resolved.pack.fallback?.find((f) => f.backend === "ollama") ?? resolved.underlying;
-          provider = provider ?? providerForBackend2(ollamaFb.backend);
-          model = model ?? ollamaFb.weightsRef;
         }
         if (!config.modelProfile?.capsuleBudgetTokens) {
           config.modelProfile = {
@@ -5919,11 +5862,6 @@ function registerCode(program) {
         } else if (!config.modelProfile?.mode) {
           config.modelProfile = { ...config.modelProfile, mode: resolved.mode };
         }
-        if (!global.json && !global.quiet && !opts.streamJson && provider !== "llama-cpp") {
-          info(
-            `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 ${resolved.underlying.weightsRef} ${c.dim(`(${resolved.fit.label})`)}`
-          );
-        }
       } catch (e) {
         if (e instanceof CliError) throw e;
         if (!provider && !model && !opts.mock) throw e;
@@ -5941,7 +5879,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-INGJNSON.js');
+      const { runInteractive } = await import('./interactive-36ZZ64WL.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -5985,28 +5923,52 @@ function registerCode(program) {
         model,
         modelPath: opts.modelPath,
         local: global.local,
-        consent: opts.yes,
-        mockReply
+        consent: opts.yes || codeModeActive || customSelection,
+        mockReply,
+        codeMode: codeModeActive,
+        preferEmbedded: codeModeActive || void 0
       },
       {}
     );
+    if (!opts.mock && route.providers[0]) {
+      const { ensureManagerRuntime } = await import('./model-manager-OEPY4I7W.js');
+      const ensure = await ensureManagerRuntime({
+        providerId: route.providers[0].id,
+        model: route.providers[0].model,
+        offline: !!global.local,
+        // Code Mode / explicit custom selection / --yes count as consent for
+        // npm runtime deps (and ollama pull when the binary is already present).
+        consent: !!(opts.yes || codeModeActive || customSelection || process.stdin.isTTY),
+        onProgress: (line) => {
+          if (!global.json && !global.quiet && !opts.streamJson) info(c.dim(`  ${line}`));
+        }
+      });
+      if (!ensure.ok) {
+        throw new CliError(ensure.error ?? "model manager runtime not ready", ExitCode.ERROR);
+      }
+      if (!global.json && !global.quiet && !opts.streamJson && (ensure.installed.length || ensure.pulled.length)) {
+        for (const s of ensure.installed) info(c.dim(`  installed ${s}`));
+        for (const s of ensure.pulled) info(c.dim(`  pulled ${s}`));
+      }
+    }
     if (!global.json && !global.quiet) {
       info(`${c.cyan("vg code")} \xB7 ${c.dim(route.reason)}`);
+      info(`${c.cyan("vg code")} \xB7 manager ${c.bold(route.managerLine)}`);
     }
     if (opts.streamJson && !opts.mock) {
       const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-      const { runCodeStreamJson } = await import('./stream-json-6ZBUA2L3.js');
-      const { nodeCodeFs } = await import('./session-M72522AP.js');
+      const { runCodeStreamJson } = await import('./stream-json-Z5KC2DM3.js');
+      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
       const readline5 = await import('readline');
       const child = await import('child_process');
       const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
       const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
       const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-      const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+      const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
       const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
       const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
       const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-      const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
+      const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
       const federation = loadOrDiscoverFederation(root2);
       const modelProfile = mergeModelExecutionProfile(
         resolveModelExecutionProfile({
@@ -6095,8 +6057,8 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-INGJNSON.js');
-      const { nodeCodeFs } = await import('./session-M72522AP.js');
+      const { agentTask } = await import('./interactive-36ZZ64WL.js');
+      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
       const { TtyPrompter } = await import('./ui-Q6DJ3GCU.js');
       let priorSummary;
       if (opts.continue) {
@@ -6118,11 +6080,11 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
         const { loadFederation } = await import('./federation-SZWZIFZ7.js');
         const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
         const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
         const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
         const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7230,7 +7192,11 @@ function registerLlmHost(program) {
       binding = ensured.module;
     } else if (opts.yes || !global.local) {
       if (!global.json) {
-        info(c.dim(`  binding unavailable: ${ensureUnavailableMessage(ensured.reason ?? "install-failed", "node-llama-cpp@^3")}`));
+        info(
+          c.dim(
+            `  binding unavailable: ${ensureUnavailableMessage(ensured.reason ?? "install-failed", "node-llama-cpp@^3", ensured.detail)}`
+          )
+        );
       }
     }
     if (global.json) {
@@ -7301,7 +7267,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-ATM5MXBZ.js');
+    const { runBaseline } = await import('./baseline-MRUM2P6H.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8820,7 +8786,7 @@ function reapAndReport(cwd, keepVersion) {
 }
 
 // src/reporting/commands/fix.ts
-var SEVERITY_RANK = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
+var SEVERITY_RANK2 = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
 function ecosystemId(type) {
   return projectTypeToVulnEcosystem(type) ?? type;
 }
@@ -8894,7 +8860,7 @@ var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade
     process.exit(1);
   }
   const failOn = opts.failOnVulns;
-  if (failOn && !(failOn in SEVERITY_RANK)) {
+  if (failOn && !(failOn in SEVERITY_RANK2)) {
     console.error(chalk7.red(`Invalid --fail-on-vulns value '${opts.failOnVulns}'. Use one of: low, moderate, high, critical.`));
     process.exit(1);
   }
@@ -8996,10 +8962,10 @@ var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade
   }
   if (failOn) {
     const recommended = response.plans.find((p) => p.tier === response.recommended);
-    const threshold = SEVERITY_RANK[failOn];
+    const threshold = SEVERITY_RANK2[failOn];
     let stillOpen = 0;
-    for (const sev of Object.keys(SEVERITY_RANK)) {
-      if (SEVERITY_RANK[sev] < threshold) continue;
+    for (const sev of Object.keys(SEVERITY_RANK2)) {
+      if (SEVERITY_RANK2[sev] < threshold) continue;
       const open = response.unresolved.bySeverity[sev] ?? 0;
       const maxFixable = Math.max(0, ...response.plans.map((p) => p.fixes.bySeverity[sev] ?? 0));
       const notFixedByRecommended = maxFixable - (recommended?.fixes.bySeverity[sev] ?? 0);