@vibgrate/cli 2026.728.3 → 2026.728.5

package/dist/cli.js

@@ -1,46 +1,48 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-6GRLZ4Z2.js';
-export { runBuild } from './chunk-6GRLZ4Z2.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-A2IYFNCQ.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-VYGEOOLY.js';
-import { runCodeSession } from './chunk-WH2N22S3.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-YF43FOPP.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-643KXZ54.js';
+export { runBuild } from './chunk-643KXZ54.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-2ZHWF7C6.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-SGI5ZP2Y.js';
+import { runCodeSession } from './chunk-PRGCCW7D.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-RZEXHDCF.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-JRAGO6OB.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EVWW3BPM.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
-import { gatherSystemMemory } from './chunk-6UQMXIAG.js';
+import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-HK3AWUXH.js';
+import './chunk-TCJTQGAO.js';
 import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-SIPGDJT4.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-6HX47EBL.js';
 import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
 import './chunk-7AVYKZEM.js';
-import { buildModelInstallPlan } from './chunk-SZSNPXSW.js';
-import { ensurePackage, ensureUnavailableMessage } from './chunk-OSD546W7.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-VI4ITXHQ.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-57QU36P6.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6AXHLQBV.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-3BIRGSRS.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
+import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
+import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-NH5NJ3UO.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-RCP2KQGG.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-VBVY733D.js';
+import './chunk-IPICO2RV.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-G4HTI4ZM.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-4JD63RUR.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6UK6QPTR.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-EETK7S43.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
-import { resolveCliInvocation, NPX_INVOCATION } from './chunk-UZJS7GMK.js';
+import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
-import { resolvedGrammarFiles, grammarSetVersion } from './chunk-ON25BX6T.js';
+import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-B3YUO3NW.js';
+import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-RYNAK4LK.js';
 import { cacheDir, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import './chunk-DGUM43GV.js';
+import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs8 from 'fs';
 import fs8__default, { realpathSync } from 'fs';
 import * as path37 from 'path';
@@ -56,6 +58,7 @@ import chalk7 from 'chalk';
 import * as fs21 from 'fs/promises';
 import semver2 from 'semver';
 
+init_cli_invocation();
 function registerStatus(program) {
   const cmd = program.command("status").description("cache/freshness, counts, staleness, resolver rungs used").action(async function() {
     await runStatus(readGlobal(this));
@@ -1674,7 +1677,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve20) => httpServer.listen(port, host, resolve20));
+  await new Promise((resolve21) => httpServer.listen(port, host, resolve21));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1920,6 +1923,14 @@ function manifestHash(root2) {
   files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   return hashString(canonicalize(files));
 }
+function isDependencyFile(root2, filePath) {
+  const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
+  const parts = rel.split(path37.sep);
+  if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
+  const base = parts[parts.length - 1].toLowerCase();
+  return isManifest(filePath) || SKIP_FILES.has(base);
+}
 function loadScanCache(root2, key2) {
   try {
     const raw = JSON.parse(fs8.readFileSync(cachePath(root2), "utf8"));
@@ -2270,15 +2281,41 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
       kevSource: "skipped"
     };
   }
-  const seen = /* @__PURE__ */ new Set();
-  const unique = [];
+  const byKey = /* @__PURE__ */ new Map();
   for (const t of targets) {
     if (!t.ecosystem || !t.package || !t.version) continue;
     const k = key(t.ecosystem, t.package, t.version);
-    if (seen.has(k)) continue;
-    seen.add(k);
-    unique.push(t);
+    const locs = [];
+    if (t.locations?.length) {
+      for (const loc of t.locations) {
+        if (loc?.file) locs.push({ file: loc.file, line: loc.line ?? null });
+      }
+    } else if (t.file) {
+      locs.push({ file: t.file, line: t.line ?? null });
+    }
+    const existing = byKey.get(k);
+    if (!existing) {
+      byKey.set(k, {
+        ...t,
+        file: t.file ?? locs[0]?.file ?? null,
+        line: t.line ?? locs[0]?.line ?? null,
+        locations: locs
+      });
+      continue;
+    }
+    for (const loc of locs) {
+      if (!existing.locations.some((x) => x.file === loc.file && x.line === loc.line)) {
+        existing.locations.push(loc);
+      }
+    }
+    if (t.reachability === "reached") existing.reachability = "reached";
+    else if (t.reachability === "not-observed" && existing.reachability === "unknown") {
+      existing.reachability = "not-observed";
+    }
+    if (!existing.latestStable && t.latestStable) existing.latestStable = t.latestStable;
+    if (!existing.section && t.section) existing.section = t.section;
   }
+  const unique = [...byKey.values()];
   const [kev] = await Promise.all([loadKevCves({ offline: false })]);
   const concurrency = Math.max(1, Math.min(opts.concurrency ?? 8, 16));
   const findings = [];
@@ -2293,7 +2330,11 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
       const r = await enrichVulns(t.ecosystem, t.package, t.version, { offline: false });
       if (r.source === "osv" || r.source === "cache") anyOk = true;
       else if (r.source === "error") anyError = true;
+      const locations = t.locations.length ? t.locations : t.file ? [{ file: t.file, line: t.line ?? null }] : [];
+      const seenIds = /* @__PURE__ */ new Set();
       for (const v of r.vulns) {
+        if (seenIds.has(v.id)) continue;
+        seenIds.add(v.id);
         const kevHit = v.cves.some((c2) => kev.cves.has(c2.toUpperCase()));
         findings.push({
           package: t.package,
@@ -2307,8 +2348,9 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
           published: v.published,
           kev: kevHit,
           reachability: t.reachability ?? "unknown",
-          file: t.file ?? null,
-          line: t.line ?? null,
+          file: locations[0]?.file ?? t.file ?? null,
+          line: locations[0]?.line ?? t.line ?? null,
+          locations,
           section: t.section ?? null,
           latestStable: t.latestStable ?? null
         });
@@ -2408,6 +2450,13 @@ var VibgrateLanguageServer = class {
       if (!uri || !this.docs.has(uri)) return;
       this.scheduleScan(400);
     });
+    this.conn.onNotification("workspace/didChangeWatchedFiles", (_m, params) => {
+      const p = params;
+      const relevant = (p.changes ?? []).some(
+        (c2) => c2.uri && isDependencyFile(this.opts.root, uriToPath(c2.uri))
+      );
+      if (relevant) this.scheduleScan(400);
+    });
     this.conn.onNotification("textDocument/didClose", (_m, params) => {
       const p = params;
       if (p.textDocument?.uri) this.docs.delete(p.textDocument.uri);
@@ -3089,7 +3138,7 @@ function registerInstall(program) {
       }
       return;
     }
-    const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve4);
+    const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve5);
     if (targets.length === 0) {
       if (opts.detect) {
         if (global.json) json({ root: root2, detected: [], results: [] });
@@ -3120,7 +3169,7 @@ function registerInstall(program) {
   const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const results = tools.map(resolve4).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root2, !!opts.purge) }));
+    const results = tools.map(resolve5).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root2, !!opts.purge) }));
     if (global.json) {
       json({ root: root2, results });
       return;
@@ -3131,7 +3180,7 @@ function registerInstall(program) {
   });
   applyGlobalOptions(uninstall);
 }
-function resolve4(id) {
+function resolve5(id) {
   const a = assistantById(id);
   if (!a) {
     const near = ASSISTANTS.filter(
@@ -3345,11 +3394,11 @@ function registerWatch(program) {
       }
     }
     info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path37.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
-    await new Promise((resolve20) => {
+    await new Promise((resolve21) => {
       const stop = () => {
         for (const w of watchers) w.close();
         if (timer) clearTimeout(timer);
-        resolve20();
+        resolve21();
       };
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
@@ -3909,10 +3958,15 @@ async function executeModelInstallPlan(plan, options = {}) {
   return { ok: true, plan, installedDeps, pulledWeights };
 }
 function defaultOllamaPull(name, quiet) {
-  const res = spawnSync("ollama", ["pull", name], { stdio: quiet ? "ignore" : "inherit" });
+  const { resolveOllamaBinary: resolveOllamaBinary2 } = (init_resolve_ollama(), __toCommonJS(resolve_ollama_exports));
+  const ollama = resolveOllamaBinary2();
+  if (!ollama) return 127;
+  const res = spawnSync(ollama, ["pull", name], { stdio: quiet ? "ignore" : "inherit" });
   return res.status ?? 1;
 }
+init_resolve_ollama();
 function defaultHasBinary(name) {
+  if (name === "ollama" || name === "ollama.exe") return hasOllamaBinary();
   const res = spawnSync(process.platform === "win32" ? "where" : "which", [name], { stdio: "ignore" });
   return res.status === 0;
 }
@@ -5237,6 +5291,7 @@ function applyRecommendedDefaultMode(opts) {
     reason: `pinned default to ${recommended} from RAM/VRAM + repo fit`
   };
 }
+init_resolve_ollama();
 function registerModels(program) {
   const cmd = program.command("models").description("Code Modes (Spark/Flow/Forge) + local model fleet").option("--raw", "list discovered local models only (skip Code Modes status)").action(function(opts) {
     const global = readGlobal(this);
@@ -5336,7 +5391,7 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve20 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
+  const resolve21 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const sys = gatherSystemMemory();
@@ -5368,7 +5423,7 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve20);
+  applyGlobalOptions(resolve21);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
@@ -5585,17 +5640,22 @@ function registerModels(program) {
       }
     }
     if (target.runtime === "ollama") {
-      if (!hasBinary("ollama")) {
+      const ollama = resolveOllamaBinary();
+      if (!ollama) {
         throw new CliError(
-          "ollama is not installed or not on PATH \u2014 install it from https://ollama.com, then re-run.",
+          "ollama is not installed or not on PATH \u2014 install it from https://ollama.com, then re-run. (Dock-launched editors often miss Homebrew; open a terminal and try `which ollama`, or add /opt/homebrew/bin to PATH.)",
           ExitCode.NOT_FOUND
         );
       }
       if (!global.json) info(c.dim(`  $ ${plan.command}`));
-      const res = spawnSync("ollama", ["rm", target.name], { stdio: global.json ? "ignore" : "inherit" });
+      const res = spawnSync(ollama, ["rm", target.name], {
+        encoding: "utf8",
+        stdio: global.json ? ["ignore", "pipe", "pipe"] : "inherit"
+      });
       if (res.status !== 0) {
+        const tail = [res.stderr, res.stdout].filter(Boolean).join("\n").split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(-3).join(" \xB7 ");
         throw new CliError(
-          `\`ollama rm ${target.name}\` failed (exit ${res.status ?? "signal"}) \u2014 check the model name with \`vg models --raw\`.`,
+          `\`ollama rm ${target.name}\` failed (exit ${res.status ?? "signal"})${tail ? `: ${tail}` : ""} \u2014 check the model name with \`vg models --raw\`.`,
           ExitCode.ERROR
         );
       }
@@ -5794,6 +5854,7 @@ function registerModels(program) {
   applyGlobalOptions(catalog);
 }
 function hasBinary(bin) {
+  if (bin === "ollama" || bin === "ollama.exe") return hasOllamaBinary();
   const probe = spawnSync(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
   return probe.status === 0;
 }
@@ -5867,11 +5928,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve20(/^y(es)?$/i.test(answer.trim()));
+      resolve21(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -6056,9 +6117,9 @@ function registerCode(program) {
     const customSelection = !!(opts.provider || opts.model || opts.modelPath || config.provider || config.model);
     if (!customSelection && (modeFlag || !provider && !model)) {
       try {
-        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-4M5FG6MN.js');
-        const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-5O2NN3GA.js');
-        const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
+        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
+        const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
+        const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6087,7 +6148,7 @@ function registerCode(program) {
             ExitCode.ERROR
           );
         }
-        const { resolveGgufPath } = await import('./resolve-gguf-4AFRN4CP.js');
+        const { resolveGgufPath } = await import('./resolve-gguf-SDIYGGI6.js');
         const primaryRef = resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : resolved.underlying.weightsRef;
         const gguf = resolveGgufPath({
           modelRef: primaryRef,
@@ -6142,7 +6203,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-OCWQ326U.js');
+      const { runInteractive } = await import('./interactive-KVDKRKNK.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6194,7 +6255,7 @@ function registerCode(program) {
       {}
     );
     if (!opts.mock && route.providers[0]) {
-      const { ensureManagerRuntime } = await import('./model-manager-LB54VSV7.js');
+      const { ensureManagerRuntime } = await import('./model-manager-GJ2YSTSK.js');
       const ensure = await ensureManagerRuntime({
         providerId: route.providers[0].id,
         model: route.providers[0].model,
@@ -6224,18 +6285,18 @@ function registerCode(program) {
       };
       try {
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson } = await import('./stream-json-Z5KC2DM3.js');
-        const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
+        const { runCodeStreamJson } = await import('./stream-json-Y45JBNYP.js');
+        const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
         const readline5 = await import('readline');
         const child = await import('child_process');
-        const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
-        const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
-        const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
-        const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
-        const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
-        const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
+        const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
+        const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
+        const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
+        const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
+        const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6281,6 +6342,26 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-B35WCSAS.js');
+        const vgBuiltin = createVgBuiltinMcpTools({
+          getGraph: () => graph,
+          root: root2,
+          local: global.local === true
+        });
+        let disposeMcpStream;
+        let projectMcp;
+        let streamApprove = async () => !!auto;
+        if (Object.keys(mcp.servers).length) {
+          const { McpToolset, defaultMcpConnect } = await import('./mcp-tools-KAJS34TN.js');
+          const { toolset } = await McpToolset.connect(mcp.servers, defaultMcpConnect);
+          disposeMcpStream = () => toolset.dispose();
+          projectMcp = {
+            specs: toolset.specs(),
+            owns: (n) => toolset.owns(n),
+            execute: (call) => toolset.execute(call, (action) => streamApprove(action))
+          };
+        }
+        const externalTools = mergeExternalToolsets(vgBuiltin, projectMcp);
         try {
           await runCodeStreamJson({
             graph,
@@ -6304,6 +6385,7 @@ ${res.stderr}` : ""),
             files: opts.file.length ? opts.file : void 0,
             worktreeOverlay: true,
             advancedMode: !capsule,
+            externalTools,
             attribution: {
               client: "vg-code",
               provider: primarySlug,
@@ -6312,17 +6394,20 @@ ${res.stderr}` : ""),
             now: () => Date.now(),
             emit: emitStream,
             bindDecisions: (session) => {
+              streamApprove = (action) => session.approve(action);
               const rl = readline5.createInterface({ input: process.stdin });
               rl.on("line", (raw) => {
                 try {
                   const msg = JSON.parse(raw);
                   if (typeof msg.approveId === "number") session.submitDecision(msg.approveId, !!msg.approve);
+                  if (typeof msg.answerId === "number") session.submitAnswer(msg.answerId, String(msg.answer ?? ""));
                 } catch {
                 }
               });
             }
           });
         } finally {
+          await disposeMcpStream?.();
           await runtime.dispose();
         }
       } catch (e) {
@@ -6339,34 +6424,45 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-OCWQ326U.js');
-      const { nodeCodeFs } = await import('./session-ZJGENHKX.js');
-      const { TtyPrompter } = await import('./ui-Q6DJ3GCU.js');
+      const { agentTask } = await import('./interactive-KVDKRKNK.js');
+      const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
+      const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       if (opts.continue) {
-        const { loadLatestSession, summarizeSession } = await import('./session-store-WFBX7HXL.js');
+        const { loadLatestSession, summarizeSession } = await import('./session-store-O4XPXKOV.js');
         const prev = loadLatestSession(root2);
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      let mcpTools;
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-B35WCSAS.js');
+      const vgBuiltin = createVgBuiltinMcpTools({
+        getGraph: () => graph,
+        root: root2,
+        local: global.local === true
+      });
+      let projectMcp;
       let disposeMcp;
       if (Object.keys(mcp.servers).length) {
-        const { McpToolset, defaultMcpConnect } = await import('./mcp-tools-I7JK3S2M.js');
+        const { McpToolset, defaultMcpConnect } = await import('./mcp-tools-KAJS34TN.js');
         const { toolset } = await McpToolset.connect(mcp.servers, defaultMcpConnect);
         disposeMcp = () => toolset.dispose();
         const approve = async (a) => autonomous || !!(prompter && a.kind === "tool" && await prompter.confirm("Call an external tool?", false));
-        mcpTools = { specs: toolset.specs(), owns: (n) => toolset.owns(n), execute: (call) => toolset.execute(call, approve) };
+        projectMcp = {
+          specs: toolset.specs(),
+          owns: (n) => toolset.owns(n),
+          execute: (call) => toolset.execute(call, approve)
+        };
       }
+      const mcpTools = mergeExternalToolsets(vgBuiltin, projectMcp);
       try {
-        const { loadFederation } = await import('./federation-SZWZIFZ7.js');
-        const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
-        const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-EJQZXANB.js');
-        const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
-        const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
-        const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-3MHSB4KA.js');
+        const { loadFederation } = await import('./federation-MDQPO3PW.js');
+        const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
+        const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
+        const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
+        const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6510,11 +6606,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm(question) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve20(/^y(es)?$/i.test(answer.trim()));
+      resolve21(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -7172,7 +7268,7 @@ function registerDaemon(program) {
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadFederation } = await import('./federation-SZWZIFZ7.js');
+    const { loadFederation } = await import('./federation-MDQPO3PW.js');
     const fed = loadFederation(primary);
     if (!fed) throw new CliError(`could not load federation for ${primary}`, ExitCode.ERROR);
     const res = await vgdRequest(
@@ -7200,9 +7296,9 @@ function registerDaemon(program) {
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
-    const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
-    const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
+    const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
+    const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
+    const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
     const opts = this.opts();
     const graph = loadGraph2(root2, global.graph);
     if (!graph) {
@@ -7340,7 +7436,7 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 async function repositoryIdForCwd(socketPath, root2) {
-  const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
+  const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
   const reg = await vgdRequest({ op: "register", root: root2 }, { socketPath });
   if (reg.ok && "workspace" in reg) return reg.workspace.id;
   return repositoryIdFromRoot(root2);
@@ -7549,7 +7645,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-PPZJBYAJ.js');
+    const { runBaseline } = await import('./baseline-Y5FBYWNJ.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7834,6 +7930,7 @@ function emitDriftScoreLine(score) {
   if (process.env.VIBGRATE_EMIT_MARKERS !== "1") return;
   console.log(`VIBGRATE_DRIFT_SCORE=${score}`);
 }
+init_cli_invocation();
 var AI_ASSISTANT_DETECTORS = [
   { files: ["CLAUDE.md", ".claude"], name: "claude" },
   { files: [".cursor", ".cursorrules"], name: "cursor" },
@@ -7874,6 +7971,7 @@ function printAiContextPrompt(detectedAssistant) {
 }
 
 // src/reporting/commands/scan.ts
+init_cli_invocation();
 function shouldBuildCodeMap(opts) {
   return opts.graph !== false && !opts.maxPrivacy && !opts.noLocalArtifacts;
 }
@@ -8346,6 +8444,9 @@ function scanStaleness(rootDir, artifactPath) {
   walk2(rootDir, 0);
   return newest > ref ? { stale: true, newestChanged } : { stale: false };
 }
+
+// src/reporting/commands/fix.ts
+init_cli_invocation();
 var MAX_CONTRACTS = 40;
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -8967,11 +9068,11 @@ async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
 async function confirmWorkspaceRoot(pm) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve20(t === "y" || t === "yes");
+      resolve21(t === "y" || t === "yes");
     });
   });
 }
@@ -9338,14 +9439,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve20(null);
+      if (t === "q" || t === "quit") return resolve21(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve20(null);
-      resolve20(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve21(null);
+      resolve21(plans[n - 1].tier);
     });
   });
 }
@@ -10152,6 +10253,7 @@ var reportCommand = new Command("report").description("Generate a drift report f
       break;
   }
 });
+init_cli_invocation();
 function openUrl(url) {
   const platform = process.platform;
   let command;
@@ -10178,7 +10280,7 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve20) => setTimeout(resolve20, ms));
+var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
 function isInside(dir, file) {
   const rel = path37.relative(dir, file);
   return !!rel && !rel.startsWith("..") && !path37.isAbsolute(rel);
@@ -11675,7 +11777,7 @@ async function hasRecentDrill(root2, asOf) {
   const dir = path37.join(evidenceDir(root2), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
-  const { readJsonFile: readJsonFile2 } = await import('./fs-O5IQYXHO.js');
+  const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();