@vibgrate/cli 2026.729.1 → 2026.729.2

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-EEVZVXT2.js';
-export { runBuild } from './chunk-EEVZVXT2.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-QDZ47G45.js';
+export { runBuild } from './chunk-QDZ47G45.js';
 import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-2ZHWF7C6.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-CF2MLSOV.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-F6ZPUKED.js';
 import { runCodeSession } from './chunk-PRGCCW7D.js';
 import { summarizeDiffs, ScriptedProvider } from './chunk-RZEXHDCF.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-2JV3J5NF.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-74ZMAOVF.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -21,12 +21,12 @@ import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-TQFY6OSV.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-YMHQZ24Q.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-QS5BTBRX.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-PXXVLX7K.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-CYC3ZI32.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-67YG3R5F.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-G4HTI4ZM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-OIWHR57Q.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-HDQG3QYV.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
@@ -36,8 +36,8 @@ import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chu
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-YKVNMNEM.js';
-import { VERSION } from './chunk-NQ4FSRXL.js';
+import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-P3QIO4ZU.js';
+import { VERSION } from './chunk-WQE4OIZS.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
@@ -53,11 +53,12 @@ import { Command, CommanderError, Option } from 'commander';
 import * as os from 'os';
 import * as crypto3 from 'crypto';
 import { randomUUID } from 'crypto';
+import * as semver3 from 'semver';
+import semver3__default from 'semver';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
 import * as readline from 'readline';
 import chalk7 from 'chalk';
 import * as fs20 from 'fs/promises';
-import semver2 from 'semver';
 
 init_cli_invocation();
 function registerStatus(program) {
@@ -2978,9 +2979,19 @@ function osvEcosystem(type) {
       return null;
   }
 }
+function inRangeStep(dep) {
+  const target = dep.latestSatisfying;
+  if (!target || !dep.resolvedVersion) return null;
+  if (!semver3.valid(target) || !semver3.valid(dep.resolvedVersion)) return null;
+  if (!semver3.gt(target, dep.resolvedVersion)) return null;
+  const diff2 = semver3.diff(dep.resolvedVersion, target);
+  return { version: target, size: diff2 === "patch" || diff2 === "prepatch" ? "patch" : "minor" };
+}
 function inlineLabel(dep) {
   const bits = [];
   if (dep.drift === "major-behind") {
+    const step2 = inRangeStep(dep);
+    if (step2) bits.push(`${step2.size} behind`, step2.version);
     const n = dep.majorsBehind ?? 1;
     bits.push(`${n} major behind`);
   } else if (dep.drift === "minor-behind") {
@@ -3025,6 +3036,10 @@ function hoverMarkdown(dep, contribution) {
     lines.push(`| | |`);
     lines.push(`|---|---|`);
     lines.push(`| yours | \`${yours}\` |`);
+    const step2 = inRangeStep(dep);
+    if (step2 && step2.version !== dep.latestStable) {
+      lines.push(`| latest in range | \`${step2.version}\` |`);
+    }
     lines.push(`| latest | \`${dep.latestStable}\` |`);
     const journey = versionJourney(yours, dep.latestStable);
     if (journey) lines.push(`| journey | ${journey} |`);
@@ -6120,7 +6135,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
+        const { loadGraph: loadGraph2 } = await import('./load-4MLIHGXF.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6204,7 +6219,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-R5VQGDWP.js');
+      const { runInteractive } = await import('./interactive-HLGJJFLI.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6293,11 +6308,11 @@ function registerCode(program) {
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5M6QZZOS.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-TGGEAGQZ.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6343,7 +6358,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZCKBYQ2D.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6425,7 +6440,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-R5VQGDWP.js');
+      const { agentTask } = await import('./interactive-HLGJJFLI.js');
       const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6435,7 +6450,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZCKBYQ2D.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6459,11 +6474,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5M6QZZOS.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-TGGEAGQZ.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7303,7 +7318,7 @@ function registerDaemon(program) {
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
+    const { loadGraph: loadGraph2 } = await import('./load-4MLIHGXF.js');
     const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
     const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
     const opts = this.opts();
@@ -7652,7 +7667,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-MROWBNK7.js');
+    const { runBaseline } = await import('./baseline-UOTGTJYT.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8953,7 +8968,7 @@ async function fetchLatestVersion() {
     if (!response.ok) return null;
     const data = await response.json();
     const latest = data.version;
-    if (!latest || !semver2.valid(latest)) return null;
+    if (!latest || !semver3__default.valid(latest)) return null;
     await writeCache({ latest, checkedAt: Date.now() });
     return latest;
   } catch {
@@ -9092,8 +9107,8 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
       process.exit(1);
     }
-    const semver3 = await import('semver');
-    if (!semver3.gt(latest, VERSION)) {
+    const semver4 = await import('semver');
+    if (!semver4.gt(latest, VERSION)) {
       console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
       if (opts.reap !== false) reapAndReport(process.cwd(), VERSION);
       return;
@@ -10971,9 +10986,9 @@ async function loadReleases(root2, productId) {
   return releases;
 }
 function coerce(version) {
-  const parsed = semver2.parse(version, { loose: true });
+  const parsed = semver3__default.parse(version, { loose: true });
   if (parsed) return parsed.version;
-  const c2 = semver2.coerce(version);
+  const c2 = semver3__default.coerce(version);
   return c2 ? c2.version : null;
 }
 function versionAffected(version, range) {
@@ -10983,11 +10998,11 @@ function versionAffected(version, range) {
   if (!range.introduced && !range.fixed && !range.versions) return false;
   const introduced = range.introduced ? coerce(range.introduced) : "0.0.0";
   if (!introduced) return false;
-  if (semver2.lt(v, introduced)) return false;
+  if (semver3__default.lt(v, introduced)) return false;
   if (range.fixed) {
     const fixed = coerce(range.fixed);
     if (!fixed) return false;
-    if (semver2.gte(v, fixed)) return false;
+    if (semver3__default.gte(v, fixed)) return false;
   }
   return true;
 }
@@ -11068,8 +11083,8 @@ function computeExposure(input) {
       productName: product.name,
       classification: product.classification,
       status,
-      affectedVersions: [...affectedVersions].sort(semver2.compareLoose),
-      releases: affectedReleases.sort((a, b) => semver2.compareLoose(a.version, b.version)),
+      affectedVersions: [...affectedVersions].sort(semver3__default.compareLoose),
+      releases: affectedReleases.sort((a, b) => semver3__default.compareLoose(a.version, b.version)),
       memberStates: product.memberStates,
       supportStatus: support.status,
       supportDetail: support.detail