@vibgrate/cli 2026.727.4 → 2026.728.2

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-FPEOIS7K.js';
-export { runBuild } from './chunk-FPEOIS7K.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-MAUJTPQW.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-HYRAILGM.js';
-import { runCodeSession } from './chunk-R6ZRVVZT.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-KXSKFQMI.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-IWP7MYIA.js';
+export { runBuild } from './chunk-IWP7MYIA.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-A2IYFNCQ.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-NTW5UEKT.js';
+import { runCodeSession } from './chunk-WH2N22S3.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-YF43FOPP.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-77LYGXBI.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-JRAGO6OB.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { gatherSystemMemory } from './chunk-6UQMXIAG.js';
@@ -15,21 +15,22 @@ import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
 import './chunk-HK3AWUXH.js';
 import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
-import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-PXHNTC6D.js';
-import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-K7REHDQS.js';
+import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-SIPGDJT4.js';
+import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-6HX47EBL.js';
 import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
 import './chunk-KKRSQQ3A.js';
-import { buildModelInstallPlan } from './chunk-YCJIIGLP.js';
-import { ensurePackage, ensureUnavailableMessage } from './chunk-KUIBP3LU.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-LJP2EPKM.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, NPX_INVOCATION, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-YKVH2PGF.js';
+import { buildModelInstallPlan } from './chunk-UIOBFLE6.js';
+import { ensurePackage, ensureUnavailableMessage } from './chunk-OSD546W7.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WY6DGTBP.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-GQTWDKMJ.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6AXHLQBV.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-T3AYRS7J.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-ZFTFCM7B.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6UK6QPTR.js';
 import { discoverModels } from './chunk-3SDV6ADQ.js';
+import { resolveCliInvocation, NPX_INVOCATION } from './chunk-UZJS7GMK.js';
 import { listCachedWeights, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-GYSOQH5C.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-ON25BX6T.js';
 import './chunk-RXP66R2E.js';
@@ -2136,9 +2137,19 @@ function runTree(graph, params) {
 // src/lsp/enrich.ts
 var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
 var cache = /* @__PURE__ */ new Map();
+var SEVERITY_RANK = {
+  critical: 4,
+  high: 3,
+  moderate: 2,
+  low: 1,
+  unknown: 0
+};
 function key(ecosystem, name, version) {
   return `${ecosystem}:${name}@${version}`;
 }
+function emptyCounts() {
+  return { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 };
+}
 function severityOf(v) {
   const dbSpecific = v.database_specific;
   const label = typeof dbSpecific?.severity === "string" ? dbSpecific.severity.toLowerCase() : "";
@@ -2197,6 +2208,62 @@ async function enrichVulns(ecosystem, name, version, opts = { offline: false })
     return { vulns: [], cveCount: 0, source: "error" };
   }
 }
+async function scanWorkspaceVulns(targets, opts = { offline: false }) {
+  if (opts.offline) {
+    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "offline" };
+  }
+  if (targets.length === 0) {
+    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "osv" };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const t of targets) {
+    if (!t.ecosystem || !t.package || !t.version) continue;
+    const k = key(t.ecosystem, t.package, t.version);
+    if (seen.has(k)) continue;
+    seen.add(k);
+    unique.push(t);
+  }
+  const concurrency = Math.max(1, Math.min(opts.concurrency ?? 8, 16));
+  const findings = [];
+  let anyOk = false;
+  let anyError = false;
+  let i = 0;
+  async function worker() {
+    for (; ; ) {
+      const idx = i++;
+      if (idx >= unique.length) return;
+      const t = unique[idx];
+      const r = await enrichVulns(t.ecosystem, t.package, t.version, { offline: false });
+      if (r.source === "osv" || r.source === "cache") anyOk = true;
+      else if (r.source === "error") anyError = true;
+      for (const v of r.vulns) {
+        findings.push({
+          package: t.package,
+          version: t.version,
+          ecosystem: t.ecosystem,
+          id: v.id,
+          cves: v.cves,
+          summary: v.summary,
+          severity: v.severity
+        });
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, unique.length) }, () => worker()));
+  findings.sort(
+    (a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.package.localeCompare(b.package) || a.id.localeCompare(b.id)
+  );
+  const counts = emptyCounts();
+  for (const f of findings) counts[f.severity]++;
+  const source = anyOk ? "osv" : anyError ? "error" : "osv";
+  return {
+    findings,
+    counts,
+    packagesChecked: unique.length,
+    source
+  };
+}
 
 // src/lsp/server.ts
 function bandForDependency(dep) {
@@ -2284,6 +2351,7 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
     this.conn.onRequest("vibgrate/enrich", (_m, params) => this.onEnrich(params));
+    this.conn.onRequest("vibgrate/vulns", (_m, _params) => this.onVulns());
     this.conn.onRequest("workspace/executeCommand", (_m, params) => {
       const p = params;
       if (p.command === "vibgrate.rescan") {
@@ -2539,6 +2607,31 @@ var VibgrateLanguageServer = class {
     const p = params ?? {};
     return enrichVulns(p.ecosystem ?? null, p.package ?? "", p.version ?? null, { offline: this.opts.offline });
   }
+  /**
+   * `vibgrate/vulns` — live OSV.dev pass over every resolved dependency in the
+   * current workspace artifact. Powers the Vulnerabilities panel. Empty
+   * findings with `source: 'osv'` means checked clean; `offline`/`error` mean
+   * we could not check (absent ≠ zero).
+   */
+  async onVulns() {
+    if (this.opts.offline) {
+      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "offline" };
+    }
+    const a = this.artifact;
+    if (!a) {
+      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "pending" };
+    }
+    const targets = [];
+    for (const proj of a.projects ?? []) {
+      const ecosystem = osvEcosystem(proj.type);
+      if (!ecosystem) continue;
+      for (const dep of proj.dependencies ?? []) {
+        if (!dep.resolvedVersion) continue;
+        targets.push({ ecosystem, package: dep.package, version: dep.resolvedVersion });
+      }
+    }
+    return scanWorkspaceVulns(targets, { offline: this.opts.offline });
+  }
   onScoreForFile(params) {
     const p = params;
     const a = this.artifact;
@@ -3585,7 +3678,7 @@ async function executeModelInstallPlan(plan, options = {}) {
         plan,
         installedDeps,
         pulledWeights,
-        error: ensureUnavailableMessage(res.reason ?? "install-failed", spec)
+        error: ensureUnavailableMessage(res.reason ?? "install-failed", spec, res.detail)
       };
     }
     installedDeps.push(spec);
@@ -5786,7 +5879,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-SMHVURYK.js');
+      const { runInteractive } = await import('./interactive-36ZZ64WL.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -5838,7 +5931,7 @@ function registerCode(program) {
       {}
     );
     if (!opts.mock && route.providers[0]) {
-      const { ensureManagerRuntime } = await import('./model-manager-PN7HEDXD.js');
+      const { ensureManagerRuntime } = await import('./model-manager-OEPY4I7W.js');
       const ensure = await ensureManagerRuntime({
         providerId: route.providers[0].id,
         model: route.providers[0].model,
@@ -5864,18 +5957,18 @@ function registerCode(program) {
     }
     if (opts.streamJson && !opts.mock) {
       const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-      const { runCodeStreamJson } = await import('./stream-json-X7UQFB4T.js');
-      const { nodeCodeFs } = await import('./session-W3646AOV.js');
+      const { runCodeStreamJson } = await import('./stream-json-Z5KC2DM3.js');
+      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
       const readline5 = await import('readline');
       const child = await import('child_process');
       const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
       const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
       const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-      const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+      const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
       const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
       const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
       const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-      const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
+      const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
       const federation = loadOrDiscoverFederation(root2);
       const modelProfile = mergeModelExecutionProfile(
         resolveModelExecutionProfile({
@@ -5964,8 +6057,8 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-SMHVURYK.js');
-      const { nodeCodeFs } = await import('./session-W3646AOV.js');
+      const { agentTask } = await import('./interactive-36ZZ64WL.js');
+      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
       const { TtyPrompter } = await import('./ui-Q6DJ3GCU.js');
       let priorSummary;
       if (opts.continue) {
@@ -5987,11 +6080,11 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
         const { loadFederation } = await import('./federation-SZWZIFZ7.js');
         const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
         const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
         const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
         const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7099,7 +7192,11 @@ function registerLlmHost(program) {
       binding = ensured.module;
     } else if (opts.yes || !global.local) {
       if (!global.json) {
-        info(c.dim(`  binding unavailable: ${ensureUnavailableMessage(ensured.reason ?? "install-failed", "node-llama-cpp@^3")}`));
+        info(
+          c.dim(
+            `  binding unavailable: ${ensureUnavailableMessage(ensured.reason ?? "install-failed", "node-llama-cpp@^3", ensured.detail)}`
+          )
+        );
       }
     }
     if (global.json) {
@@ -7170,7 +7267,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-ENCOSJYQ.js');
+    const { runBaseline } = await import('./baseline-MRUM2P6H.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8689,7 +8786,7 @@ function reapAndReport(cwd, keepVersion) {
 }
 
 // src/reporting/commands/fix.ts
-var SEVERITY_RANK = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
+var SEVERITY_RANK2 = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
 function ecosystemId(type) {
   return projectTypeToVulnEcosystem(type) ?? type;
 }
@@ -8763,7 +8860,7 @@ var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade
     process.exit(1);
   }
   const failOn = opts.failOnVulns;
-  if (failOn && !(failOn in SEVERITY_RANK)) {
+  if (failOn && !(failOn in SEVERITY_RANK2)) {
     console.error(chalk7.red(`Invalid --fail-on-vulns value '${opts.failOnVulns}'. Use one of: low, moderate, high, critical.`));
     process.exit(1);
   }
@@ -8865,10 +8962,10 @@ var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade
   }
   if (failOn) {
     const recommended = response.plans.find((p) => p.tier === response.recommended);
-    const threshold = SEVERITY_RANK[failOn];
+    const threshold = SEVERITY_RANK2[failOn];
     let stillOpen = 0;
-    for (const sev of Object.keys(SEVERITY_RANK)) {
-      if (SEVERITY_RANK[sev] < threshold) continue;
+    for (const sev of Object.keys(SEVERITY_RANK2)) {
+      if (SEVERITY_RANK2[sev] < threshold) continue;
       const open = response.unresolved.bySeverity[sev] ?? 0;
       const maxFixable = Math.max(0, ...response.plans.map((p) => p.fixes.bySeverity[sev] ?? 0));
       const notFixedByRecommended = maxFixable - (recommended?.fixes.bySeverity[sev] ?? 0);