@vibgrate/cli 2026.728.3 → 2026.728.5

package/dist/{chunk-UZJS7GMK.js → chunk-3LSG7Z4I.js}

@@ -1,8 +1,7 @@
+import { __esm } from './chunk-Z6ZWNWWR.js';
 import * as fs from 'fs';
 import { execFileSync } from 'child_process';
 
-// src/util/cli-invocation.ts
-var NPX_INVOCATION = "npx @vibgrate/cli";
 function whichOnPath(cmd) {
   try {
     const out = execFileSync(process.platform === "win32" ? "where" : "which", [cmd], {
@@ -36,7 +35,6 @@ function isEphemeralNpxBinary(binPath) {
 function isInstalledOwnBinary(binPath) {
   return isOwnBinary(binPath) && !isEphemeralNpxBinary(binPath);
 }
-var cached;
 function resolveCliInvocation(which) {
   if (!which && cached !== void 0) return cached;
   const lookup = which ?? whichOnPath;
@@ -51,7 +49,13 @@ function resolveCliInvocation(which) {
   if (!which) cached = result;
   return result;
 }
+var NPX_INVOCATION, cached;
+var init_cli_invocation = __esm({
+  "src/util/cli-invocation.ts"() {
+    NPX_INVOCATION = "npx @vibgrate/cli";
+  }
+});
 
-export { NPX_INVOCATION, isInstalledOwnBinary, resolveCliInvocation, whichOnPath };
-//# sourceMappingURL=chunk-UZJS7GMK.js.map
-//# sourceMappingURL=chunk-UZJS7GMK.js.map
+export { NPX_INVOCATION, init_cli_invocation, isInstalledOwnBinary, resolveCliInvocation, whichOnPath };
+//# sourceMappingURL=chunk-3LSG7Z4I.js.map
+//# sourceMappingURL=chunk-3LSG7Z4I.js.map

package/dist/chunk-3LSG7Z4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/cli-invocation.ts"],"names":[],"mappings":";;;;AAkCO,SAAS,YAAY,GAAA,EAA4B;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,aAAa,OAAA,CAAQ,QAAA,KAAa,UAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG;AAAA,MAChF,QAAA,EAAU,MAAA;AAAA,MACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ;AAAA,KACnC,CAAA,CACE,IAAA,GACA,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AACnB,IAAA,OAAO,GAAA,IAAO,IAAA;AAAA,EAChB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,YAAY,OAAA,EAA0B;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAU,gBAAa,OAAO,CAAA;AACpC,IAAA,IAAI,6BAAA,CAA8B,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACrD,IAAA,MAAM,IAAA,GAAU,EAAA,CAAA,YAAA,CAAa,IAAA,EAAM,EAAE,QAAA,EAAU,QAAQ,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AACtE,IAAA,OAAO,KAAK,QAAA,CAAS,eAAe,CAAA,IAAK,IAAA,CAAK,SAAS,UAAU,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAYO,SAAS,qBAAqB,OAAA,EAA0B;AAC7D,EAAA,MAAM,WAAA,GAAc,gBAAA;AACpB,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,WAAA,CAAY,IAAA,CAAQ,EAAA,CAAA,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASO,SAAS,qBAAqB,OAAA,EAA0B;AAC7D,EAAA,OAAO,WAAA,CAAY,OAAO,CAAA,IAAK,CAAC,qBAAqB,OAAO,CAAA;AAC9D;AAUO,SAAS,qBAAqB,KAAA,EAAgD;AACnF,EAAA,IAAI,CAAC,KAAA,IAAS,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AAC3C,EAAA,MAAM,SAAS,KAAA,IAAS,WAAA;AAExB,EAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,EAAA,IAAM,oBAAA,CAAqB,EAAE,CAAA,EAAG;AAClC,IAAA,MAAA,GAAS,IAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,IAAA,MAAA,GAAS,QAAA,IAAY,oBAAA,CAAqB,QAAQ,CAAA,GAAI,UAAA,GAAa,cAAA;AAAA,EACrE;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,GAAS,MAAA;AACrB,EAAA,OAAO,MAAA;AACT;AAxHA,IA4Ba,cAAA,CAAA,CAqET;AAjGJ,IAAA,mBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,4BAAA,GAAA;AA4BO,IAAM,cAAA,GAAiB,mBAAA;AAAA,EAAA;AAAA,CAAA","file":"chunk-3LSG7Z4I.js","sourcesContent":["import * as fs from 'node:fs';\nimport { execFileSync } from 'node:child_process';\n\n/**\n * How the user should re-invoke this CLI in a \"next step\" hint.\n *\n * A user who ran `npx @vibgrate/cli scan` has no *persistent* `vg` (or\n * `vibgrate`) on PATH, so a hint like `vg install` or `vg login` would fail for\n * them once the run ends. We answer the practical question \"what will actually\n * run this CLI for this user again?\" by checking whether an *installed* copy of\n * our binary is reachable on PATH:\n *\n *   installed `vg`       → `vg`                 (the normal installed case)\n *   installed `vibgrate` → `vibgrate`           (alias present, `vg` shadowed)\n *   neither              → `npx @vibgrate/cli`  (npx / not installed globally)\n *\n * \"Installed\" is the key qualifier: `npx` prepends its own throwaway\n * `_npx/<hash>/node_modules/.bin` to PATH for the run, so `which vg` finds a `vg`\n * that is genuinely ours yet gone the moment the process exits. That ephemeral\n * binary is excluded (see {@link isEphemeralNpxBinary}) so npx users get the npx\n * form, not a `vg` they can't call again.\n *\n * This is deliberately the same ladder `detectServeLaunch` uses for the MCP\n * launch command — the underlying question (\"is an installed `vg` ours?\") is\n * identical.\n */\n\n/** The npx form that always works without a global install. */\nexport const NPX_INVOCATION = 'npx @vibgrate/cli';\n\n/**\n * Locate `cmd` on PATH, returning its resolved path or null. Best-effort: a\n * missing command or an unavailable `which`/`where` both yield null.\n */\nexport function whichOnPath(cmd: string): string | null {\n  try {\n    const out = execFileSync(process.platform === 'win32' ? 'where' : 'which', [cmd], {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    })\n      .trim()\n      .split(/\\r?\\n/)[0];\n    return out || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Does this PATH entry launch *this* package? Symlink installs resolve into a\n * `…/@vibgrate/cli/…` directory; script shims (pnpm/bun/yarn, Windows .cmd)\n * reference the package path in their first bytes. Best-effort: unreadable or\n * unrecognisable entries count as foreign, which only makes callers pick a safer\n * fallback.\n */\nexport function isOwnBinary(binPath: string): boolean {\n  try {\n    const real = fs.realpathSync(binPath);\n    if (/[\\\\/]@vibgrate[\\\\/]cli[\\\\/]/.test(real)) return true;\n    const head = fs.readFileSync(real, { encoding: 'utf8' }).slice(0, 2048);\n    return head.includes('@vibgrate/cli') || head.includes('vibgrate');\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Is this resolved binary an *ephemeral* npx-cache entry rather than a persistent\n * install? `npx @vibgrate/cli …` unpacks the package into an npm `_npx/<hash>/`\n * cache directory and prepends its `node_modules/.bin` to PATH for the duration\n * of the run — so `which vg` finds a `vg` that is *ours* yet vanishes the instant\n * the process exits. Treating that as an installed `vg` is exactly what made the\n * post-scan hints tell npx users to run `vg login`/`vg push`, commands they have\n * no `vg` on PATH for. npm's cache segment is `_npx` on every platform; we test\n * the raw PATH entry and its realpath (symlink shims resolve into the same tree).\n */\nexport function isEphemeralNpxBinary(binPath: string): boolean {\n  const NPX_SEGMENT = /[\\\\/]_npx[\\\\/]/;\n  if (NPX_SEGMENT.test(binPath)) return true;\n  try {\n    return NPX_SEGMENT.test(fs.realpathSync(binPath));\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Does this PATH entry launch *this* CLI in a way that will still work after the\n * current process exits? True only for a persistent install of our package — an\n * ephemeral npx-cache binary does not count, because the user cannot re-invoke it\n * by name. This is the predicate \"next step\" hints and the MCP launch command\n * must use, not {@link isOwnBinary} alone.\n */\nexport function isInstalledOwnBinary(binPath: string): boolean {\n  return isOwnBinary(binPath) && !isEphemeralNpxBinary(binPath);\n}\n\nlet cached: string | undefined;\n\n/**\n * The command prefix a user should type to re-run this CLI (see module doc).\n * Memoized per-process: PATH does not change mid-run, and each call would\n * otherwise spawn `which`. Pass `which` to override lookup in tests, which also\n * bypasses the cache.\n */\nexport function resolveCliInvocation(which?: (cmd: string) => string | null): string {\n  if (!which && cached !== undefined) return cached;\n  const lookup = which ?? whichOnPath;\n\n  const vg = lookup('vg');\n  let result: string;\n  if (vg && isInstalledOwnBinary(vg)) {\n    result = 'vg';\n  } else {\n    const vibgrate = lookup('vibgrate');\n    result = vibgrate && isInstalledOwnBinary(vibgrate) ? 'vibgrate' : NPX_INVOCATION;\n  }\n\n  if (!which) cached = result;\n  return result;\n}\n\n/** Reset the memoized invocation. Test-only. */\nexport function resetCliInvocationCache(): void {\n  cached = undefined;\n}\n"]}

package/dist/{chunk-3BIRGSRS.js → chunk-4JD63RUR.js}

@@ -19,7 +19,7 @@ import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.728.3";
+var VERSION = "2026.728.5";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -2334,7 +2334,7 @@ async function scanPythonProjects(rootDir, pypiCache, cache, projectScanTimeout,
   return results;
 }
 async function findPythonManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => PYTHON_MANIFEST_FILES.has(name) || /^requirements.*\.txt$/.test(name));
 }
 async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cache, catalog) {
@@ -2774,7 +2774,7 @@ async function scanJavaProjects(rootDir, mavenCache, cache, projectScanTimeout,
   return results;
 }
 async function findJavaManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => JAVA_MANIFEST_FILES.has(name));
 }
 async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache, catalog) {
@@ -3179,7 +3179,7 @@ async function scanRubyProjects(rootDir, rubygemsCache, cache, projectScanTimeou
   return results;
 }
 async function findRubyManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => RUBY_MANIFEST_FILES.has(name) || isGemspec(name));
 }
 async function scanOneRubyProject(dir, manifestFiles, rootDir, rubygemsCache, cache, catalog) {
@@ -3420,7 +3420,7 @@ async function scanSwiftProjects(rootDir, swiftCache, cache, projectScanTimeout)
   return results;
 }
 async function findSwiftManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => SWIFT_MANIFEST_FILES.has(name));
 }
 async function scanOneSwiftProject(dir, manifestFile, rootDir, swiftCache, cache) {
@@ -3656,7 +3656,7 @@ async function scanGoProjects(rootDir, goCache, cache, projectScanTimeout, catal
   return results;
 }
 async function findGoManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => GO_MANIFEST_FILES.has(name));
 }
 async function scanOneGoProject(dir, manifestFile, rootDir, goCache, cache, catalog) {
@@ -3942,7 +3942,7 @@ async function scanRustProjects(rootDir, cargoCache, cache, projectScanTimeout)
   return results;
 }
 async function findRustManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => RUST_MANIFEST_FILES.has(name));
 }
 async function scanOneRustProject(dir, manifestFile, rootDir, cargoCache, cache) {
@@ -4174,7 +4174,7 @@ async function scanPhpProjects(rootDir, composerCache, cache, projectScanTimeout
   return results;
 }
 async function findPhpManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => PHP_MANIFEST_FILES.has(name));
 }
 async function scanOnePhpProject(dir, manifestFile, rootDir, composerCache, cache) {
@@ -4439,7 +4439,7 @@ async function scanDartProjects(rootDir, pubCache, cache, projectScanTimeout) {
   return results;
 }
 async function findDartManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import('./fs-B5HZ2MIU.js');
+  const { findFiles: findFiles2 } = await import('./fs-6JKZNQ3U.js');
   return findFiles2(rootDir, (name) => DART_MANIFEST_FILES.has(name));
 }
 async function scanOneDartProject(dir, manifestFile, rootDir, pubCache, cache) {
@@ -11671,5 +11671,5 @@ async function computeTreeMetadataHash(rootDir, options) {
 }
 
 export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, prepareCompressedUpload, projectTypeToVulnEcosystem, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig };
-//# sourceMappingURL=chunk-3BIRGSRS.js.map
-//# sourceMappingURL=chunk-3BIRGSRS.js.map
+//# sourceMappingURL=chunk-4JD63RUR.js.map
+//# sourceMappingURL=chunk-4JD63RUR.js.map