@vibgrate/cli 2026.728.2 → 2026.728.3

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-IWP7MYIA.js';
-export { runBuild } from './chunk-IWP7MYIA.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-6GRLZ4Z2.js';
+export { runBuild } from './chunk-6GRLZ4Z2.js';
 import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-A2IYFNCQ.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-NTW5UEKT.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-VYGEOOLY.js';
 import { runCodeSession } from './chunk-WH2N22S3.js';
 import { summarizeDiffs, ScriptedProvider } from './chunk-YF43FOPP.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
@@ -10,7 +10,7 @@ import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-JRAGO6OB.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { gatherSystemMemory } from './chunk-6UQMXIAG.js';
-import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-PVZBYZZR.js';
+import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
 import './chunk-HK3AWUXH.js';
@@ -18,20 +18,20 @@ import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-SIPGDJT4.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-6HX47EBL.js';
 import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
-import './chunk-KKRSQQ3A.js';
-import { buildModelInstallPlan } from './chunk-UIOBFLE6.js';
+import './chunk-7AVYKZEM.js';
+import { buildModelInstallPlan } from './chunk-SZSNPXSW.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-OSD546W7.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WY6DGTBP.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-GQTWDKMJ.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-VI4ITXHQ.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-57QU36P6.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6AXHLQBV.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-ZFTFCM7B.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-3BIRGSRS.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6UK6QPTR.js';
-import { discoverModels } from './chunk-3SDV6ADQ.js';
+import { discoverModels } from './chunk-CQDUBAQY.js';
 import { resolveCliInvocation, NPX_INVOCATION } from './chunk-UZJS7GMK.js';
-import { listCachedWeights, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-GYSOQH5C.js';
+import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-ON25BX6T.js';
 import './chunk-RXP66R2E.js';
 import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-B3YUO3NW.js';
@@ -2136,7 +2136,10 @@ function runTree(graph, params) {
 
 // src/lsp/enrich.ts
 var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
+var KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
 var cache = /* @__PURE__ */ new Map();
+var kevCache = null;
+var KEV_TTL_MS = 6 * 60 * 60 * 1e3;
 var SEVERITY_RANK = {
   critical: 4,
   high: 3,
@@ -2170,7 +2173,24 @@ function severityOf(v) {
   }
   return "unknown";
 }
-function toSummary(raw) {
+function fixedVersionsOf(v, packageName) {
+  const affected = Array.isArray(v.affected) ? v.affected : [];
+  const lower = packageName.toLowerCase();
+  const out2 = [];
+  for (const a of affected) {
+    const pkg = a.package;
+    if (pkg?.name && pkg.name.toLowerCase() !== lower) continue;
+    const ranges = Array.isArray(a.ranges) ? a.ranges : [];
+    for (const range of ranges) {
+      const events = Array.isArray(range.events) ? range.events : [];
+      for (const ev of events) {
+        if (typeof ev.fixed === "string" && ev.fixed && !out2.includes(ev.fixed)) out2.push(ev.fixed);
+      }
+    }
+  }
+  return out2;
+}
+function toSummary(raw, packageName = "") {
   const v = raw ?? {};
   const aliases = Array.isArray(v.aliases) ? v.aliases.map(String) : [];
   const details = typeof v.details === "string" ? v.details : "";
@@ -2179,7 +2199,9 @@ function toSummary(raw) {
     id: String(v.id ?? "unknown"),
     cves: aliases.filter((a) => a.startsWith("CVE-")),
     summary,
-    severity: severityOf(v)
+    severity: severityOf(v),
+    fixedVersions: fixedVersionsOf(v, packageName),
+    published: typeof v.published === "string" ? v.published : null
   };
 }
 async function enrichVulns(ecosystem, name, version, opts = { offline: false }) {
@@ -2199,7 +2221,7 @@ async function enrichVulns(ecosystem, name, version, opts = { offline: false })
     }).finally(() => clearTimeout(timer));
     if (!res.ok) return { vulns: [], cveCount: 0, source: "error" };
     const data = await res.json();
-    const vulns = (data.vulns ?? []).map(toSummary);
+    const vulns = (data.vulns ?? []).map((raw) => toSummary(raw, name));
     const cveCount = new Set(vulns.flatMap((v) => v.cves)).size;
     const result = { vulns, cveCount, source: "osv" };
     cache.set(k, result);
@@ -2208,12 +2230,45 @@ async function enrichVulns(ecosystem, name, version, opts = { offline: false })
     return { vulns: [], cveCount: 0, source: "error" };
   }
 }
+async function loadKevCves(opts = { offline: false }) {
+  if (opts.offline) return { cves: /* @__PURE__ */ new Set(), source: "skipped" };
+  if (kevCache && Date.now() - kevCache.at < KEV_TTL_MS) {
+    return { cves: kevCache.cves, source: "cisa" };
+  }
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 12e3);
+    const res = await fetch(KEV_URL, { signal: controller.signal }).finally(() => clearTimeout(timer));
+    if (!res.ok) return { cves: /* @__PURE__ */ new Set(), source: "error" };
+    const data = await res.json();
+    const cves = /* @__PURE__ */ new Set();
+    for (const v of data.vulnerabilities ?? []) {
+      if (v.cveID) cves.add(v.cveID.toUpperCase());
+    }
+    kevCache = { at: Date.now(), cves };
+    return { cves, source: "cisa" };
+  } catch {
+    return { cves: /* @__PURE__ */ new Set(), source: "error" };
+  }
+}
 async function scanWorkspaceVulns(targets, opts = { offline: false }) {
   if (opts.offline) {
-    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "offline" };
+    return {
+      findings: [],
+      counts: emptyCounts(),
+      packagesChecked: 0,
+      source: "offline",
+      kevSource: "skipped"
+    };
   }
   if (targets.length === 0) {
-    return { findings: [], counts: emptyCounts(), packagesChecked: 0, source: "osv" };
+    return {
+      findings: [],
+      counts: emptyCounts(),
+      packagesChecked: 0,
+      source: "osv",
+      kevSource: "skipped"
+    };
   }
   const seen = /* @__PURE__ */ new Set();
   const unique = [];
@@ -2224,6 +2279,7 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
     seen.add(k);
     unique.push(t);
   }
+  const [kev] = await Promise.all([loadKevCves({ offline: false })]);
   const concurrency = Math.max(1, Math.min(opts.concurrency ?? 8, 16));
   const findings = [];
   let anyOk = false;
@@ -2238,6 +2294,7 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
       if (r.source === "osv" || r.source === "cache") anyOk = true;
       else if (r.source === "error") anyError = true;
       for (const v of r.vulns) {
+        const kevHit = v.cves.some((c2) => kev.cves.has(c2.toUpperCase()));
         findings.push({
           package: t.package,
           version: t.version,
@@ -2245,14 +2302,22 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
           id: v.id,
           cves: v.cves,
           summary: v.summary,
-          severity: v.severity
+          severity: v.severity,
+          fixedVersions: v.fixedVersions,
+          published: v.published,
+          kev: kevHit,
+          reachability: t.reachability ?? "unknown",
+          file: t.file ?? null,
+          line: t.line ?? null,
+          section: t.section ?? null,
+          latestStable: t.latestStable ?? null
         });
       }
     }
   }
   await Promise.all(Array.from({ length: Math.min(concurrency, unique.length) }, () => worker()));
   findings.sort(
-    (a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.package.localeCompare(b.package) || a.id.localeCompare(b.id)
+    (a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || Number(b.kev) - Number(a.kev) || a.package.localeCompare(b.package) || a.id.localeCompare(b.id)
   );
   const counts = emptyCounts();
   for (const f of findings) counts[f.severity]++;
@@ -2261,7 +2326,8 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
     findings,
     counts,
     packagesChecked: unique.length,
-    source
+    source,
+    kevSource: kev.source
   };
 }
 
@@ -2611,23 +2677,64 @@ var VibgrateLanguageServer = class {
    * `vibgrate/vulns` — live OSV.dev pass over every resolved dependency in the
    * current workspace artifact. Powers the Vulnerabilities panel. Empty
    * findings with `source: 'osv'` means checked clean; `offline`/`error` mean
-   * we could not check (absent ≠ zero).
+   * we could not check (absent ≠ zero). Attaches manifest locations, fixed-in
+   * versions, CISA KEV flags, and a best-effort code-map reachability signal.
    */
   async onVulns() {
     if (this.opts.offline) {
-      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "offline" };
+      return {
+        findings: [],
+        counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 },
+        packagesChecked: 0,
+        source: "offline",
+        kevSource: "skipped"
+      };
     }
     const a = this.artifact;
     if (!a) {
-      return { findings: [], counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 }, packagesChecked: 0, source: "pending" };
+      return {
+        findings: [],
+        counts: { critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 },
+        packagesChecked: 0,
+        source: "pending",
+        kevSource: "skipped"
+      };
     }
+    const reachedPkgs = packageReachSet(this.graph);
     const targets = [];
     for (const proj of a.projects ?? []) {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
+      const relManifest = manifestRelativePath(proj);
+      const absManifest = path37.resolve(this.opts.root, relManifest);
+      let text = null;
+      try {
+        if (fs8.existsSync(absManifest)) text = fs8.readFileSync(absManifest, "utf8");
+      } catch {
+        text = null;
+      }
+      const kind = manifestKind(absManifest);
       for (const dep of proj.dependencies ?? []) {
         if (!dep.resolvedVersion) continue;
-        targets.push({ ecosystem, package: dep.package, version: dep.resolvedVersion });
+        let line = null;
+        if (text && kind) {
+          const l = findPackageLine(text, dep.package, kind);
+          if (l >= 0) line = l + 1;
+        }
+        let reachability = "unknown";
+        if (reachedPkgs) {
+          reachability = packageReached(reachedPkgs, dep.package) ? "reached" : "not-observed";
+        }
+        targets.push({
+          ecosystem,
+          package: dep.package,
+          version: dep.resolvedVersion,
+          file: relManifest,
+          line,
+          section: dep.section ?? null,
+          latestStable: dep.latestStable ?? null,
+          reachability
+        });
       }
     }
     return scanWorkspaceVulns(targets, { offline: this.opts.offline });
@@ -2732,6 +2839,63 @@ function buildBreakdown(drift, projects) {
   });
   return items.length > 0 ? items : void 0;
 }
+function manifestRelativePath(proj) {
+  const base = proj.path === "." || proj.path === "" ? "" : proj.path;
+  const join27 = (name) => base ? path37.join(base, name) : name;
+  switch (proj.type) {
+    case "node":
+    case "typescript":
+      return join27("package.json");
+    case "python":
+      return join27("pyproject.toml");
+    case "go":
+      return join27("go.mod");
+    case "rust":
+      return join27("Cargo.toml");
+    case "ruby":
+      return join27("Gemfile");
+    case "php":
+      return join27("composer.json");
+    case "java":
+    case "kotlin":
+    case "scala":
+    case "groovy":
+      return join27("pom.xml");
+    case "dotnet":
+      return join27(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+    case "dart":
+      return join27("pubspec.yaml");
+    case "elixir":
+      return join27("mix.exs");
+    default:
+      return join27("package.json");
+  }
+}
+function packageReachSet(graph) {
+  if (!graph?.nodes?.length) return null;
+  const set = /* @__PURE__ */ new Set();
+  for (const n of graph.nodes) {
+    if (n.kind !== "external" && n.kind !== "package" && n.kind !== "module") continue;
+    const names = [n.name, n.qualifiedName].filter(Boolean);
+    for (const raw of names) {
+      const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/");
+      if (cleaned.startsWith("@")) {
+        const parts = cleaned.split("/");
+        if (parts.length >= 2) set.add(`${parts[0]}/${parts[1]}`.toLowerCase());
+      } else {
+        set.add(cleaned.split("/")[0].toLowerCase());
+      }
+      set.add(cleaned.toLowerCase());
+    }
+  }
+  return set;
+}
+function packageReached(set, pkg) {
+  const p = pkg.toLowerCase();
+  if (set.has(p)) return true;
+  if (!p.startsWith("@") && set.has(p.split("/")[0])) return true;
+  return false;
+}
 function osvEcosystem(type) {
   switch (type) {
     case "node":
@@ -5372,17 +5536,35 @@ function registerModels(program) {
     }
   });
   applyGlobalOptions(pull);
-  const uninstallCmd = cmd.command("uninstall").description("uninstall a locally-installed model via your runtime (Ollama)").argument("<name>", "installed model name, e.g. qwen2.5-coder:7b").option("--runtime <id>", "runtime to remove from (default: ollama)", "ollama").option("--dry-run", "print the uninstall plan only \u2014 do not delete").option("--yes", "uninstall without an interactive confirm (required non-interactively)").action(async function(name, opts) {
+  const uninstallCmd = cmd.command("uninstall").description("uninstall a locally-installed model (Ollama, LM Studio, or GGUF)").argument("<name>", "installed model name, e.g. qwen2.5-coder:7b or a .gguf basename").option("--runtime <id>", "runtime: ollama | lm-studio | gguf (default: auto-detect from installed fleet)").option("--dry-run", "print the uninstall plan only \u2014 do not delete").option("--yes", "uninstall without an interactive confirm (required non-interactively)").action(async function(name, opts) {
     const global = readGlobal(this);
-    if (opts.runtime !== "ollama") {
-      throw new CliError(`only the ollama runtime supports uninstall today (got --runtime ${opts.runtime}). LM Studio / gguf models are managed in their own apps.`, ExitCode.USAGE_ERROR);
-    }
     const dryRun = !!opts.dryRun;
-    const plan = { runtime: "ollama", command: `ollama rm ${name}`, willRemove: !dryRun };
+    const target = resolveUninstallTarget(name, opts.runtime);
+    if (!target) {
+      const hint = opts.runtime ? `no installed model named "${name}" for runtime ${opts.runtime}` : `no installed model named "${name}"`;
+      throw new CliError(
+        `${hint} \u2014 check the name with \`vg models --raw\`.`,
+        ExitCode.NOT_FOUND
+      );
+    }
+    const plan = target.runtime === "ollama" ? {
+      runtime: "ollama",
+      name: target.name,
+      path: target.path,
+      command: `ollama rm ${target.name}`,
+      willRemove: !dryRun
+    } : {
+      runtime: target.runtime,
+      name: target.name,
+      path: target.path,
+      command: `rm ${target.path}`,
+      willRemove: !dryRun
+    };
     if (dryRun) {
       if (global.json) json({ ...plan, willRemove: false, note: "dry-run \u2014 re-run without --dry-run to uninstall" });
       else {
         info(`${c.cyan("vg models uninstall")} \xB7 would run: ${c.bold(plan.command)}`);
+        info(c.dim(`  ${target.runtime} \xB7 ${target.name}`));
         info(c.dim("  dry-run \u2014 re-run without --dry-run to uninstall (non-interactive: add --yes)"));
       }
       return;
@@ -5391,27 +5573,55 @@ function registerModels(program) {
     if (!opts.yes) {
       if (!interactive) {
         throw new CliError(
-          `refusing to uninstall "${name}" non-interactively without --yes \u2014 re-run with --yes, or pass --dry-run to preview.`,
+          `refusing to uninstall "${target.name}" non-interactively without --yes \u2014 re-run with --yes, or pass --dry-run to preview.`,
           ExitCode.USAGE_ERROR
         );
       }
-      const ok = await confirmYesNo(`Uninstall local model ${name}?`);
+      const ok = await confirmYesNo(`Uninstall local model ${target.name} (${target.runtime})?`);
       if (!ok) {
         if (global.json) json({ ...plan, willRemove: false, cancelled: true });
         else info(c.dim("  cancelled"));
         return;
       }
     }
-    if (!hasBinary("ollama")) {
-      throw new CliError("ollama is not installed or not on PATH \u2014 install it from https://ollama.com, then re-run.", ExitCode.NOT_FOUND);
-    }
-    if (!global.json) info(c.dim(`  $ ${plan.command}`));
-    const res = spawnSync("ollama", ["rm", name], { stdio: global.json ? "ignore" : "inherit" });
-    if (res.status !== 0) {
-      throw new CliError(`\`ollama rm ${name}\` failed (exit ${res.status ?? "signal"}) \u2014 check the model name with \`vg models\`.`, ExitCode.ERROR);
+    if (target.runtime === "ollama") {
+      if (!hasBinary("ollama")) {
+        throw new CliError(
+          "ollama is not installed or not on PATH \u2014 install it from https://ollama.com, then re-run.",
+          ExitCode.NOT_FOUND
+        );
+      }
+      if (!global.json) info(c.dim(`  $ ${plan.command}`));
+      const res = spawnSync("ollama", ["rm", target.name], { stdio: global.json ? "ignore" : "inherit" });
+      if (res.status !== 0) {
+        throw new CliError(
+          `\`ollama rm ${target.name}\` failed (exit ${res.status ?? "signal"}) \u2014 check the model name with \`vg models --raw\`.`,
+          ExitCode.ERROR
+        );
+      }
+    } else {
+      if (!target.path || !fs8.existsSync(target.path)) {
+        throw new CliError(
+          `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
+          ExitCode.NOT_FOUND
+        );
+      }
+      if (!target.path.endsWith(".gguf")) {
+        throw new CliError(
+          `refusing to delete non-GGUF path for ${target.runtime} model "${target.name}"`,
+          ExitCode.USAGE_ERROR
+        );
+      }
+      if (!global.json) info(c.dim(`  $ rm ${target.path}`));
+      try {
+        fs8.unlinkSync(target.path);
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
+      }
     }
     if (global.json) json({ ...plan, removed: true });
-    else info(c.green(`  \u2714 uninstalled ${name}`));
+    else info(c.green(`  \u2714 uninstalled ${target.name}`));
   });
   applyGlobalOptions(uninstallCmd);
   const hostBench = cmd.command("host-bench").description("Approach B host measurement arms (TTFT / grammar / KV / sampler) + optional release gates").option("--mock", "registry metric shells only (no generate)").option("--simulate", "multi-turn warm-host simulation without a GPU (default)").option("--live", "run against a real binding + GGUF (requires --model-path)").option("--model-path <path>", "GGUF path for --live").option("--turns <n>", "turns per arm for simulate/live (default 2)", "2").option("--arms <ids>", "comma-separated arm ids (default: all)").option("--gate", "evaluate release gates; exit 2 on hard failure").option("--dry-run", "print planned arms only \u2014 do not run").action(async function(opts) {
@@ -5599,10 +5809,12 @@ function repoSignals(root2) {
 }
 function buildFullStatus(root2, models, sys) {
   const state = readOrchestratorState();
+  const freeDiskBytes = freeBytesOnVolume(weightStoreDir());
   return buildOrchestratorStatus({
     system: sys,
     repo: repoSignals(root2),
     installedNames: models.map((m) => m.name),
+    freeDiskBytes,
     pins: state.pins,
     defaultMode: state.defaultMode
   });
@@ -5621,7 +5833,8 @@ function printOrchestratorStatus(orch) {
   const sys = orch.system;
   const ram = `RAM ${fmt(sys.freeRamBytes)} free / ${fmt(sys.totalRamBytes)}`;
   const vram = typeof sys.vramTotalBytes === "number" ? ` \xB7 VRAM ${fmt(sys.vramFreeBytes ?? 0)} free / ${fmt(sys.vramTotalBytes)}` : "";
-  info(c.dim(`  ${ram}${vram}`));
+  const disk = typeof sys.freeDiskBytes === "number" ? ` \xB7 Disk ${fmt(sys.freeDiskBytes)} free (model cache)` : "";
+  info(c.dim(`  ${ram}${vram}${disk}`));
   if (orch.memoryBreakdown) {
     const b = orch.memoryBreakdown;
     info(
@@ -5662,6 +5875,56 @@ function confirmYesNo(question) {
     });
   });
 }
+function normalizeUninstallRuntime(raw) {
+  if (!raw?.trim()) return void 0;
+  const r = raw.trim().toLowerCase();
+  if (r === "ollama") return "ollama";
+  if (r === "lm-studio" || r === "lmstudio" || r === "lm_studio") return "lm-studio";
+  if (r === "gguf" || r === "llama-cpp" || r === "llamacpp" || r === "vibgrate") return "gguf";
+  throw new CliError(
+    `unknown --runtime ${raw} (use ollama, lm-studio, or gguf)`,
+    ExitCode.USAGE_ERROR
+  );
+}
+function resolveUninstallTarget(name, runtimeOpt) {
+  const want = name.trim();
+  if (!want) return null;
+  const wantLc = want.toLowerCase();
+  const runtime = normalizeUninstallRuntime(runtimeOpt);
+  const fleet = discoverModels().filter((m) => runtime ? m.runtime === runtime : true);
+  const exact = fleet.filter((m) => m.name.toLowerCase() === wantLc);
+  if (exact.length === 1) return exact[0];
+  if (exact.length > 1) {
+    const order = ["ollama", "gguf", "lm-studio"];
+    for (const rt of order) {
+      const hit = exact.find((m) => m.runtime === rt);
+      if (hit) return hit;
+    }
+    return exact[0];
+  }
+  const base = path37.basename(wantLc);
+  const soft = fleet.filter((m) => {
+    const n = m.name.toLowerCase();
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path37.basename(n) === base;
+  });
+  if (soft.length === 1) return soft[0];
+  if (soft.length > 1) {
+    const baseHits = soft.filter((m) => path37.basename(m.name).toLowerCase() === base);
+    const pool = baseHits.length ? baseHits : soft;
+    const order = ["ollama", "gguf", "lm-studio"];
+    for (const rt of order) {
+      const hit = pool.find((m) => m.runtime === rt);
+      if (hit) return hit;
+    }
+    return pool[0];
+  }
+  if (!runtime || runtime === "ollama") {
+    if (want.includes(":") || !want.includes("/") && !want.endsWith(".gguf")) {
+      return { runtime: "ollama", name: want, path: "" };
+    }
+  }
+  return null;
+}
 function printInstallPlanHuman(label, plan) {
   const title = plan.mode ? `${plan.mode} \u2192 ${plan.model}` : plan.model;
   info(`${c.cyan(label)} \xB7 ${c.bold(title)}`);
@@ -5793,7 +6056,7 @@ function registerCode(program) {
     const customSelection = !!(opts.provider || opts.model || opts.modelPath || config.provider || config.model);
     if (!customSelection && (modeFlag || !provider && !model)) {
       try {
-        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-4VSYP4J4.js');
+        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-4M5FG6MN.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-5O2NN3GA.js');
         const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
         const state = readOrchestratorState2();
@@ -5824,7 +6087,7 @@ function registerCode(program) {
             ExitCode.ERROR
           );
         }
-        const { resolveGgufPath } = await import('./resolve-gguf-Y6FH3CNB.js');
+        const { resolveGgufPath } = await import('./resolve-gguf-4AFRN4CP.js');
         const primaryRef = resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : resolved.underlying.weightsRef;
         const gguf = resolveGgufPath({
           modelRef: primaryRef,
@@ -5879,7 +6142,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-36ZZ64WL.js');
+      const { runInteractive } = await import('./interactive-OCWQ326U.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -5931,7 +6194,7 @@ function registerCode(program) {
       {}
     );
     if (!opts.mock && route.providers[0]) {
-      const { ensureManagerRuntime } = await import('./model-manager-OEPY4I7W.js');
+      const { ensureManagerRuntime } = await import('./model-manager-LB54VSV7.js');
       const ensure = await ensureManagerRuntime({
         providerId: route.providers[0].id,
         model: route.providers[0].model,
@@ -5951,102 +6214,121 @@ function registerCode(program) {
         for (const s of ensure.pulled) info(c.dim(`  pulled ${s}`));
       }
     }
-    if (!global.json && !global.quiet) {
+    if (!global.json && !global.quiet && !opts.streamJson) {
       info(`${c.cyan("vg code")} \xB7 ${c.dim(route.reason)}`);
       info(`${c.cyan("vg code")} \xB7 manager ${c.bold(route.managerLine)}`);
     }
     if (opts.streamJson && !opts.mock) {
-      const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-      const { runCodeStreamJson } = await import('./stream-json-Z5KC2DM3.js');
-      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
-      const readline5 = await import('readline');
-      const child = await import('child_process');
-      const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
-      const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
-      const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-      const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
-      const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
-      const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
-      const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-      const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
-      const federation = loadOrDiscoverFederation(root2);
-      const modelProfile = mergeModelExecutionProfile(
-        resolveModelExecutionProfile({
-          providerId: primarySlug,
-          model: route.providers[0]?.model,
-          budget: Number(opts.budget) || void 0,
-          securityTier
-        }),
-        config.modelProfile
-      );
-      const tier = securityTier ?? modelProfile.securityTier ?? (auto ? "L1" : "L0");
-      const writableRoots = federation?.members.map((m) => m.root) ?? [root2];
-      const executionEnv = resolveExecutionEnv(tier, { writableRoots });
-      const runtime = await startCodeRuntimeSession({ root: root2 });
-      const git2 = detectGitRef(root2);
-      const repositoryId = repositoryIdFromRoot(root2);
-      if (runtime.socketPath && git2.ref) {
-        try {
-          await vgdRequest2(
-            { op: "put-graph", repositoryId, gitRef: git2.ref, graph },
-            { socketPath: runtime.socketPath }
-          );
-        } catch {
-        }
-      }
-      const graphBackend = resolveGraphBackend({
-        graph,
-        repositoryId,
-        gitRef: git2.ref || null,
-        socketPath: runtime.socketPath
-      });
-      const run = (command) => {
-        const res = child.spawnSync(command, { cwd: root2, shell: true, encoding: "utf8", timeout: 12e4, maxBuffer: 10 * 1024 * 1024 });
-        return { stdout: (res.stdout ?? "") + (res.stderr ? `
-${res.stderr}` : ""), exitCode: res.status ?? 1 };
-      };
-      const emit2 = (line) => {
+      const emitStream = (line) => {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        await runCodeStreamJson({
-          graph,
-          root: root2,
-          instruction,
-          providers: route.providers,
-          fsImpl: nodeCodeFs(root2),
-          run,
-          executionEnv,
-          graphBackend,
-          modelProfile,
-          auto: !!auto,
-          maxSteps,
-          budget: modelProfile.capsuleBudgetTokens,
-          contextBudget,
-          denyCommands: config.denyCommands,
-          testCommand: config.testCommand,
-          stream: true,
-          verify: verify3 ? { command: verify3.command, maxRounds: modelProfile.maxRepairRounds } : void 0,
-          capsule,
-          files: opts.file.length ? opts.file : void 0,
-          worktreeOverlay: true,
-          advancedMode: !capsule,
-          attribution: { client: "vg-code", provider: primarySlug, model: route.providers[0]?.model },
-          now: () => Date.now(),
-          emit: emit2,
-          bindDecisions: (session) => {
-            const rl = readline5.createInterface({ input: process.stdin });
-            rl.on("line", (raw) => {
-              try {
-                const msg = JSON.parse(raw);
-                if (typeof msg.approveId === "number") session.submitDecision(msg.approveId, !!msg.approve);
-              } catch {
-              }
-            });
+        const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
+        const { runCodeStreamJson } = await import('./stream-json-Z5KC2DM3.js');
+        const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
+        const readline5 = await import('readline');
+        const child = await import('child_process');
+        const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
+        const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
+        const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
+        const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
+        const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
+        const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
+        const federation = loadOrDiscoverFederation(root2);
+        const modelProfile = mergeModelExecutionProfile(
+          resolveModelExecutionProfile({
+            providerId: primarySlug,
+            model: route.providers[0]?.model,
+            budget: Number(opts.budget) || void 0,
+            securityTier
+          }),
+          config.modelProfile
+        );
+        const tier = securityTier ?? modelProfile.securityTier ?? (auto ? "L1" : "L0");
+        const writableRoots = federation?.members.map((m) => m.root) ?? [root2];
+        const executionEnv = resolveExecutionEnv(tier, { writableRoots });
+        const runtime = await startCodeRuntimeSession({ root: root2 });
+        const git2 = detectGitRef(root2);
+        const repositoryId = repositoryIdFromRoot(root2);
+        if (runtime.socketPath && git2.ref) {
+          try {
+            await vgdRequest2(
+              { op: "put-graph", repositoryId, gitRef: git2.ref, graph },
+              { socketPath: runtime.socketPath }
+            );
+          } catch {
           }
+        }
+        const graphBackend = resolveGraphBackend({
+          graph,
+          repositoryId,
+          gitRef: git2.ref || null,
+          socketPath: runtime.socketPath
         });
-      } finally {
-        await runtime.dispose();
+        const run = (command) => {
+          const res = child.spawnSync(command, {
+            cwd: root2,
+            shell: true,
+            encoding: "utf8",
+            timeout: 12e4,
+            maxBuffer: 10 * 1024 * 1024
+          });
+          return {
+            stdout: (res.stdout ?? "") + (res.stderr ? `
+${res.stderr}` : ""),
+            exitCode: res.status ?? 1
+          };
+        };
+        try {
+          await runCodeStreamJson({
+            graph,
+            root: root2,
+            instruction,
+            providers: route.providers,
+            fsImpl: nodeCodeFs(root2),
+            run,
+            executionEnv,
+            graphBackend,
+            modelProfile,
+            auto: !!auto,
+            maxSteps,
+            budget: modelProfile.capsuleBudgetTokens,
+            contextBudget,
+            denyCommands: config.denyCommands,
+            testCommand: config.testCommand,
+            stream: true,
+            verify: verify3 ? { command: verify3.command, maxRounds: modelProfile.maxRepairRounds } : void 0,
+            capsule,
+            files: opts.file.length ? opts.file : void 0,
+            worktreeOverlay: true,
+            advancedMode: !capsule,
+            attribution: {
+              client: "vg-code",
+              provider: primarySlug,
+              model: route.providers[0]?.model
+            },
+            now: () => Date.now(),
+            emit: emitStream,
+            bindDecisions: (session) => {
+              const rl = readline5.createInterface({ input: process.stdin });
+              rl.on("line", (raw) => {
+                try {
+                  const msg = JSON.parse(raw);
+                  if (typeof msg.approveId === "number") session.submitDecision(msg.approveId, !!msg.approve);
+                } catch {
+                }
+              });
+            }
+          });
+        } finally {
+          await runtime.dispose();
+        }
+      } catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        emitStream({ event: "error", message });
+        process.exitCode = e instanceof CliError ? e.code : ExitCode.ERROR;
       }
       return;
     }
@@ -6057,7 +6339,7 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-36ZZ64WL.js');
+      const { agentTask } = await import('./interactive-OCWQ326U.js');
       const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
       const { TtyPrompter } = await import('./ui-Q6DJ3GCU.js');
       let priorSummary;
@@ -7267,7 +7549,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-MRUM2P6H.js');
+    const { runBaseline } = await import('./baseline-PPZJBYAJ.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -10907,7 +11189,7 @@ async function resolveAdvisory(id, opts) {
 }
 
 // src/reporting/commands/evidence/feeds.ts
-var KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+var KEV_URL2 = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
 var OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 var OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 async function getJson(url, init) {
@@ -10922,7 +11204,7 @@ async function getJson(url, init) {
   return res.json();
 }
 async function fetchKevCatalog() {
-  const data = await getJson(KEV_URL);
+  const data = await getJson(KEV_URL2);
   const map = /* @__PURE__ */ new Map();
   for (const v of data.vulnerabilities ?? []) {
     if (v.cveID) map.set(v.cveID.toUpperCase(), v);
@@ -12070,12 +12352,22 @@ function handleError(err) {
     if (err.code === "commander.version") process.exit(ExitCode.OK);
     process.exit(ExitCode.USAGE_ERROR);
   }
+  const streamJsonHost = process.argv.includes("--stream-json") || process.env.VG_CODE_STREAM_JSON === "1";
+  const emitHostError = (message2) => {
+    if (!streamJsonHost) return;
+    try {
+      process.stdout.write(JSON.stringify({ event: "error", message: message2 }) + "\n");
+    } catch {
+    }
+  };
   if (err instanceof CliError) {
+    emitHostError(err.message);
     info(c.red(`error: ${err.message}`));
     process.exit(err.code);
   }
   const message = err instanceof Error ? err.message : String(err);
   const correlation = Math.random().toString(36).slice(2, 10);
+  emitHostError(message);
   info(c.red(`error: ${message}`));
   info(c.dim(`  (ref ${correlation}) \u2014 re-run with --json for detail, or report at https://vibgrate.com/help`));
   process.exit(ExitCode.ERROR);