@vibgrate/cli 2026.729.1 → 2026.729.3

package/dist/cli.js

@@ -1,63 +1,65 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-EEVZVXT2.js';
-export { runBuild } from './chunk-EEVZVXT2.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-2ZHWF7C6.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-CF2MLSOV.js';
-import { runCodeSession } from './chunk-PRGCCW7D.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-RZEXHDCF.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-5MNX3OLS.js';
+export { runBuild } from './chunk-5MNX3OLS.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-YMSXP6AO.js';
+import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
+import { runCodeSession } from './chunk-WBMMRERH.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-2JV3J5NF.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EQ3IOFIG.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-TCJTQGAO.js';
-import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
-import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-SIPGDJT4.js';
-import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-6HX47EBL.js';
-import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
-import './chunk-7AVYKZEM.js';
-import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
+import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-EVLS2M5G.js';
+import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-X634FZVG.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-42RDYQFF.js';
+import './chunk-543E6WDJ.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-MYM5VIJ4.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-TQFY6OSV.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-YMHQZ24Q.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-QS5BTBRX.js';
+import './chunk-RGEVBSLK.js';
+import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
+import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
+import './chunk-7AVYKZEM.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-HWFVBYX4.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-3FQSBVQD.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RIEUPFXO.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-4BOWWYSE.js';
+import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-G4HTI4ZM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-OIWHR57Q.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
-import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
+import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-EETK7S43.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
-import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-YKVNMNEM.js';
-import { VERSION } from './chunk-NQ4FSRXL.js';
+import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-JXMZCTVZ.js';
+import { VERSION } from './chunk-N3HCPBFY.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
-import * as fs7 from 'fs';
-import fs7__default, { realpathSync } from 'fs';
-import * as path37 from 'path';
-import path37__default from 'path';
+import * as fs8 from 'fs';
+import fs8__default, { realpathSync } from 'fs';
+import * as path38 from 'path';
+import path38__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import * as os from 'os';
 import * as crypto3 from 'crypto';
 import { randomUUID } from 'crypto';
+import * as semver3 from 'semver';
+import semver3__default from 'semver';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
 import * as readline from 'readline';
 import chalk7 from 'chalk';
-import * as fs20 from 'fs/promises';
-import semver2 from 'semver';
+import * as fs22 from 'fs/promises';
 
 init_cli_invocation();
 function registerStatus(program) {
@@ -67,10 +69,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root2 = path37.resolve(global.cwd ?? ".");
+  const root2 = path38.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs7.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs8.existsSync(path38.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -90,8 +92,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path37.relative(process.cwd(), root2) || ".",
-      graphPath: path37.relative(root2, graphPath),
+      root: path38.relative(process.cwd(), root2) || ".",
+      graphPath: path38.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -106,11 +108,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path37.relative(root2, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path38.relative(root2, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path37.relative(root2, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path38.relative(root2, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -127,7 +129,7 @@ async function runStatus(global) {
   if (vibgrateDir(root2)) ;
 }
 function rootOf(global) {
-  return path37.resolve(global.cwd ?? ".");
+  return path38.resolve(global.cwd ?? ".");
 }
 function requireGraph(global) {
   const root2 = rootOf(global);
@@ -838,8 +840,8 @@ function pad2(s, n) {
 }
 var SCHEMA_VERSION2 = "1";
 var OFFSET_FILE = "stats-share.json";
-var INSTALL_ID_DIR = path37.join(os.homedir(), ".vibgrate");
-var INSTALL_ID_FILE = path37.join(INSTALL_ID_DIR, "install-id");
+var INSTALL_ID_DIR = path38.join(os.homedir(), ".vibgrate");
+var INSTALL_ID_FILE = path38.join(INSTALL_ID_DIR, "install-id");
 var SEND_TIMEOUT_MS = 4e3;
 function telemetryOptOut(env = process.env) {
   const dnt = (env.DO_NOT_TRACK ?? "").trim().toLowerCase();
@@ -867,14 +869,14 @@ function isCI(env = process.env) {
 function installId(env = process.env) {
   if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();
   try {
-    const existing = fs7.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    const existing = fs8.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
   } catch {
   }
   const id = randomUuid();
   try {
-    fs7.mkdirSync(INSTALL_ID_DIR, { recursive: true });
-    fs7.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+    fs8.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs8.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
   } catch {
   }
   return id;
@@ -891,14 +893,14 @@ function statsEndpoint() {
   return `https://${resolveIngestHost()}/v1/ingest/cli-mcp-usage`;
 }
 function offsetPath(root2) {
-  return path37.join(cacheDir(root2), OFFSET_FILE);
+  return path38.join(cacheDir(root2), OFFSET_FILE);
 }
 function ledgerFilePath(root2) {
-  return path37.join(cacheDir(root2), "savings.jsonl");
+  return path38.join(cacheDir(root2), "savings.jsonl");
 }
 function readOffset(root2) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(offsetPath(root2), "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(offsetPath(root2), "utf8"));
     return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
   } catch {
     return 0;
@@ -906,8 +908,8 @@ function readOffset(root2) {
 }
 function writeOffset(root2, offset) {
   try {
-    fs7.mkdirSync(cacheDir(root2), { recursive: true });
-    fs7.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
+    fs8.mkdirSync(cacheDir(root2), { recursive: true });
+    fs8.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
   } catch {
   }
 }
@@ -915,7 +917,7 @@ function buildBatch(root2, fromOffset, id = installId()) {
   const file = ledgerFilePath(root2);
   let size = 0;
   try {
-    size = fs7.statSync(file).size;
+    size = fs8.statSync(file).size;
   } catch {
     return { batch: null, newOffset: 0 };
   }
@@ -923,13 +925,13 @@ function buildBatch(root2, fromOffset, id = installId()) {
   if (start >= size) return { batch: null, newOffset: size };
   let text = "";
   try {
-    const fd = fs7.openSync(file, "r");
+    const fd = fs8.openSync(file, "r");
     try {
       const buf = Buffer.alloc(size - start);
-      fs7.readSync(fd, buf, 0, buf.length, start);
+      fs8.readSync(fd, buf, 0, buf.length, start);
       text = buf.toString("utf8");
     } finally {
-      fs7.closeSync(fd);
+      fs8.closeSync(fd);
     }
   } catch {
     return { batch: null, newOffset: fromOffset };
@@ -1065,12 +1067,12 @@ var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
 function liveStatsDir(root2) {
-  return path37.join(cacheDir(root2), "serve-live");
+  return path38.join(cacheDir(root2), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
   try {
-    entries = fs7.readdirSync(dir);
+    entries = fs8.readdirSync(dir);
   } catch {
     return [];
   }
@@ -1079,7 +1081,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs7.readFileSync(path37.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs8.readFileSync(path38.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1101,7 +1103,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path37.join(dir, `serve-${this.pid}.json`);
+    this.file = path38.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1133,10 +1135,10 @@ var LiveStatsBus = class {
     this.lastWriteAt = now;
     const body = { pid: this.pid, updatedAt: now, version: VERSION, snapshot: snap };
     try {
-      fs7.mkdirSync(this.dir, { recursive: true });
+      fs8.mkdirSync(this.dir, { recursive: true });
       const tmp = `${this.file}.tmp`;
-      fs7.writeFileSync(tmp, JSON.stringify(body));
-      fs7.renameSync(tmp, this.file);
+      fs8.writeFileSync(tmp, JSON.stringify(body));
+      fs8.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -1147,24 +1149,24 @@ var LiveStatsBus = class {
   siblings(now = Date.now()) {
     let entries;
     try {
-      entries = fs7.readdirSync(this.dir);
+      entries = fs8.readdirSync(this.dir);
     } catch {
       return [];
     }
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path37.join(this.dir, name);
+      const file = path38.join(this.dir, name);
       let parsed;
       try {
-        parsed = JSON.parse(fs7.readFileSync(file, "utf8"));
+        parsed = JSON.parse(fs8.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
       if (typeof parsed?.pid !== "number" || typeof parsed.updatedAt !== "number" || !parsed.snapshot?.totals) continue;
       if (now - parsed.updatedAt > STALE_MS) {
         try {
-          fs7.unlinkSync(file);
+          fs8.unlinkSync(file);
         } catch {
         }
         continue;
@@ -1176,7 +1178,7 @@ var LiveStatsBus = class {
   }
   unlinkOwn = () => {
     try {
-      fs7.unlinkSync(this.file);
+      fs8.unlinkSync(this.file);
     } catch {
     }
   };
@@ -1489,12 +1491,12 @@ var LedgerTail = class {
     if (size === this.offset) return;
     let chunk;
     try {
-      const fd = fs7.openSync(this.file, "r");
+      const fd = fs8.openSync(this.file, "r");
       try {
         chunk = Buffer.alloc(size - this.offset);
-        fs7.readSync(fd, chunk, 0, chunk.length, this.offset);
+        fs8.readSync(fd, chunk, 0, chunk.length, this.offset);
       } finally {
-        fs7.closeSync(fd);
+        fs8.closeSync(fd);
       }
     } catch {
       return;
@@ -1507,7 +1509,7 @@ var LedgerTail = class {
   }
   sizeOf() {
     try {
-      return fs7.statSync(this.file).size;
+      return fs8.statSync(this.file).size;
     } catch {
       return 0;
     }
@@ -1892,19 +1894,19 @@ function endOfLine(text, line) {
 }
 var CACHE_VERSION = "vg-lsp-scan-cache/2";
 function cachePath(root2) {
-  return path37.join(cacheDir(root2), "lsp-scan.json");
+  return path38.join(cacheDir(root2), "lsp-scan.json");
 }
 function manifestHash(root2) {
   const files = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = fs7.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const abs = path37.join(dir, entry.name);
+      const abs = path38.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         walk2(abs);
@@ -1914,8 +1916,8 @@ function manifestHash(root2) {
       const base = entry.name.toLowerCase();
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
-        const rel = path37.relative(root2, abs).split(path37.sep).join("/");
-        files.push({ rel, hash: hashBytes(fs7.readFileSync(abs)) });
+        const rel = path38.relative(root2, abs).split(path38.sep).join("/");
+        files.push({ rel, hash: hashBytes(fs8.readFileSync(abs)) });
       } catch {
       }
     }
@@ -1925,16 +1927,16 @@ function manifestHash(root2) {
   return hashString(canonicalize(files));
 }
 function isDependencyFile(root2, filePath) {
-  const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
-  if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
-  const parts = rel.split(path37.sep);
+  const rel = path38.relative(path38.resolve(root2), path38.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path38.isAbsolute(rel)) return false;
+  const parts = rel.split(path38.sep);
   if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
 }
 function loadScanCache(root2, key2) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(cachePath(root2), "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(cachePath(root2), "utf8"));
     if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
       return { manifestHash: raw.manifestHash, artifact: raw.artifact };
     }
@@ -1944,8 +1946,8 @@ function loadScanCache(root2, key2) {
 }
 function writeScanCache(root2, key2, artifact) {
   try {
-    fs7.mkdirSync(cacheDir(root2), { recursive: true });
-    fs7.writeFileSync(
+    fs8.mkdirSync(cacheDir(root2), { recursive: true });
+    fs8.writeFileSync(
       cachePath(root2),
       stableStringify(
         { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
@@ -1955,6 +1957,66 @@ function writeScanCache(root2, key2, artifact) {
   } catch {
   }
 }
+var MAX_ENTRIES = 1e3;
+var KEEP_ENTRIES = 500;
+function historyPath(root2) {
+  return path38.join(root2, ".vibgrate", "score-history.jsonl");
+}
+function parseLine(line) {
+  try {
+    const e = JSON.parse(line);
+    if (typeof e.ts === "string" && typeof e.score === "number" && typeof e.band === "string" && (e.mode === "verified" || e.mode === "estimated") && typeof e.methodology === "string") {
+      return e;
+    }
+  } catch {
+  }
+  return null;
+}
+function readHistory(root2) {
+  try {
+    return fs8.readFileSync(historyPath(root2), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
+  } catch {
+    return [];
+  }
+}
+function lastEntry(root2) {
+  const all = readHistory(root2);
+  return all.length ? all[all.length - 1] : null;
+}
+function recentHistory(root2, days, now = Date.now()) {
+  const cutoff = now - days * 24 * 60 * 60 * 1e3;
+  return readHistory(root2).filter((e) => {
+    const t = Date.parse(e.ts);
+    return Number.isFinite(t) && t >= cutoff;
+  });
+}
+function recordScore(root2, entry) {
+  try {
+    const prev = lastEntry(root2);
+    if (prev && prev.score === entry.score && prev.band === entry.band && prev.mode === entry.mode && prev.methodology === entry.methodology) {
+      const prevT = Date.parse(prev.ts);
+      const nextT = Date.parse(entry.ts);
+      if (Number.isFinite(prevT) && Number.isFinite(nextT) && nextT - prevT < 24 * 60 * 60 * 1e3) {
+        return;
+      }
+    }
+    const file = historyPath(root2);
+    fs8.mkdirSync(path38.dirname(file), { recursive: true });
+    fs8.appendFileSync(file, `${JSON.stringify(entry)}
+`);
+    const all = readHistory(root2);
+    if (all.length > MAX_ENTRIES) {
+      const kept = all.slice(-KEEP_ENTRIES);
+      fs8.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
+    }
+  } catch {
+  }
+}
+function deltaFrom(prev, current) {
+  if (!prev) return void 0;
+  if (prev.methodology !== current.methodology) return void 0;
+  return current.score - prev.score;
+}
 
 // src/lsp/graph-query.ts
 async function runGraphQuery(graph, params, ctx) {
@@ -2466,6 +2528,11 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("textDocument/codeLens", (_m, params) => this.onCodeLens(params));
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
+    this.conn.onRequest("vibgrate/score/history", (_m, params) => {
+      const p = params;
+      const days = typeof p?.days === "number" && p.days > 0 && p.days <= 365 ? p.days : 90;
+      return { days, entries: recentHistory(this.opts.root, days) };
+    });
     this.conn.onRequest("vibgrate/enrich", (_m, params) => this.onEnrich(params));
     this.conn.onRequest("vibgrate/vulns", (_m, _params) => this.onVulns());
     this.conn.onRequest("workspace/executeCommand", (_m, params) => {
@@ -2554,6 +2621,15 @@ var VibgrateLanguageServer = class {
       (f) => f.ruleId === "vibgrate/unmaintained" || f.ruleId === "vibgrate/abandoned"
     ).length;
     const band = a.drift.riskLevel ?? "low";
+    const historyEntry = {
+      ts: a.timestamp,
+      score: a.drift.score,
+      band,
+      mode: a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated"),
+      methodology: a.drift.methodologyVersion ?? "unknown"
+    };
+    const delta = deltaFrom(lastEntry(this.opts.root), historyEntry);
+    recordScore(this.opts.root, historyEntry);
     const payload = {
       score: a.drift.score,
       band,
@@ -2561,12 +2637,13 @@ var VibgrateLanguageServer = class {
       // offline marker. An air-gapped scan against a dated snapshot is Verified.
       // The score now carries the authoritative provenance (driftscore-3.0
       // envelope); fall back to the artifact heuristic for pre-v3 engines.
-      mode: a.drift.mode ?? (hasReleaseDates(a) ? "verified" : "estimated"),
-      methodology: a.drift.methodologyVersion ?? "unknown",
+      mode: historyEntry.mode,
+      methodology: historyEntry.methodology,
       scale: "0 best, 100 worst",
       counts: { behind, eol, unmaintained, total },
       rootPath: a.rootPath,
       scannedAt: a.timestamp,
+      ...delta !== void 0 ? { delta } : {},
       ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {}
     };
     this.conn.notify("vibgrate/score", payload);
@@ -2756,10 +2833,10 @@ var VibgrateLanguageServer = class {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
       const relManifest = manifestRelativePath(proj);
-      const absManifest = path37.resolve(this.opts.root, relManifest);
+      const absManifest = path38.resolve(this.opts.root, relManifest);
       let text = null;
       try {
-        if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
+        if (fs8.existsSync(absManifest)) text = fs8.readFileSync(absManifest, "utf8");
       } catch {
         text = null;
       }
@@ -2805,12 +2882,12 @@ function uriToPath(uri) {
   }
 }
 function projectForFile(root2, a, filePath) {
-  const dir = path37.dirname(path37.resolve(filePath));
+  const dir = path38.dirname(path38.resolve(filePath));
   let best;
   let bestLen = -1;
   for (const proj of a.projects ?? []) {
-    const projDir = path37.resolve(root2, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path37.sep)) && projDir.length > bestLen) {
+    const projDir = path38.resolve(root2, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path38.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -2818,7 +2895,7 @@ function projectForFile(root2, a, filePath) {
   return best;
 }
 function sameProject(location, projectPath) {
-  return path37.normalize(location) === path37.normalize(projectPath);
+  return path38.normalize(location) === path38.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -2891,34 +2968,34 @@ function buildBreakdown(drift, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join27 = (name) => base ? path37.join(base, name) : name;
+  const join28 = (name) => base ? path38.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join27("package.json");
+      return join28("package.json");
     case "python":
-      return join27("pyproject.toml");
+      return join28("pyproject.toml");
     case "go":
-      return join27("go.mod");
+      return join28("go.mod");
     case "rust":
-      return join27("Cargo.toml");
+      return join28("Cargo.toml");
     case "ruby":
-      return join27("Gemfile");
+      return join28("Gemfile");
     case "php":
-      return join27("composer.json");
+      return join28("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join27("pom.xml");
+      return join28("pom.xml");
     case "dotnet":
-      return join27(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join28(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join27("pubspec.yaml");
+      return join28("pubspec.yaml");
     case "elixir":
-      return join27("mix.exs");
+      return join28("mix.exs");
     default:
-      return join27("package.json");
+      return join28("package.json");
   }
 }
 function packageReachSet(graph) {
@@ -2978,9 +3055,19 @@ function osvEcosystem(type) {
       return null;
   }
 }
+function inRangeStep(dep) {
+  const target = dep.latestSatisfying;
+  if (!target || !dep.resolvedVersion) return null;
+  if (!semver3.valid(target) || !semver3.valid(dep.resolvedVersion)) return null;
+  if (!semver3.gt(target, dep.resolvedVersion)) return null;
+  const diff2 = semver3.diff(dep.resolvedVersion, target);
+  return { version: target, size: diff2 === "patch" || diff2 === "prepatch" ? "patch" : "minor" };
+}
 function inlineLabel(dep) {
   const bits = [];
   if (dep.drift === "major-behind") {
+    const step2 = inRangeStep(dep);
+    if (step2) bits.push(`${step2.size} behind`, step2.version);
     const n = dep.majorsBehind ?? 1;
     bits.push(`${n} major behind`);
   } else if (dep.drift === "minor-behind") {
@@ -3025,6 +3112,10 @@ function hoverMarkdown(dep, contribution) {
     lines.push(`| | |`);
     lines.push(`|---|---|`);
     lines.push(`| yours | \`${yours}\` |`);
+    const step2 = inRangeStep(dep);
+    if (step2 && step2.version !== dep.latestStable) {
+      lines.push(`| latest in range | \`${step2.version}\` |`);
+    }
     lines.push(`| latest | \`${dep.latestStable}\` |`);
     const journey = versionJourney(yours, dep.latestStable);
     if (journey) lines.push(`| journey | ${journey} |`);
@@ -3064,7 +3155,7 @@ function hoverMarkdown(dep, contribution) {
   return lines.join("\n");
 }
 function startLanguageServer(opts) {
-  if (!fs7.existsSync(opts.root)) {
+  if (!fs8.existsSync(opts.root)) {
     process.stderr.write(`vg lsp: root does not exist: ${opts.root}
 `);
     process.exit(1);
@@ -3201,8 +3292,8 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const gitDir = path37.join(root2, ".git");
-    if (!fs7.existsSync(gitDir)) {
+    const gitDir = path38.join(root2, ".git");
+    if (!fs8.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -3223,23 +3314,23 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root2, reports) {
-  const dir = path37.join(root2, ".vibgrate");
-  fs7.mkdirSync(dir, { recursive: true });
+  const dir = path38.join(root2, ".vibgrate");
+  fs8.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs7.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs8.writeFileSync(path38.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
-  const file = path37.join(root2, ".gitattributes");
+  const file = path38.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "";
+  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs7.writeFileSync(file, content);
+    fs8.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root2) {
@@ -3248,8 +3339,8 @@ function configureMergeDriver(root2) {
 }
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
-  fs7.mkdirSync(hooksDir, { recursive: true });
-  const file = path37.join(hooksDir, "pre-commit");
+  fs8.mkdirSync(hooksDir, { recursive: true });
+  const file = path38.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -3258,7 +3349,7 @@ function installPreCommitHook(root2) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -3267,21 +3358,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs7.writeFileSync(file, content);
-  fs7.chmodSync(file, 493);
+  fs8.writeFileSync(file, content);
+  fs8.chmodSync(file, 493);
 }
 function undo(root2) {
-  const hookFile = path37.join(hookDir(root2), "pre-commit");
-  if (fs7.existsSync(hookFile)) {
+  const hookFile = path38.join(hookDir(root2), "pre-commit");
+  if (fs8.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs7.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs7.rmSync(hookFile);
-    else fs7.writeFileSync(hookFile, next2);
+    const next2 = fs8.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs8.rmSync(hookFile);
+    else fs8.writeFileSync(hookFile, next2);
   }
-  const attr = path37.join(root2, ".gitattributes");
-  if (fs7.existsSync(attr)) {
-    const next2 = fs7.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs7.writeFileSync(attr, next2);
+  const attr = path38.join(root2, ".gitattributes");
+  if (fs8.existsSync(attr)) {
+    const next2 = fs8.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs8.writeFileSync(attr, next2);
   }
   try {
     git(root2, ["config", "--remove-section", "merge.vg"]);
@@ -3291,10 +3382,10 @@ function undo(root2) {
 function hookDir(root2) {
   try {
     const configured = git(root2, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path37.resolve(root2, configured);
+    if (configured) return path38.resolve(root2, configured);
   } catch {
   }
-  return path37.join(root2, ".git", "hooks");
+  return path38.join(root2, ".git", "hooks");
 }
 function git(root2, args) {
   return execFileSync("git", args, { cwd: root2, encoding: "utf8" });
@@ -3322,9 +3413,9 @@ function registerWatch(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
-    const watchRoots = (paths.length ? paths : ["."]).map((p) => path37.resolve(root2, p));
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path38.resolve(root2, p));
     for (const w of watchRoots) {
-      if (!fs7.existsSync(w)) {
+      if (!fs8.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
       }
     }
@@ -3377,14 +3468,14 @@ function registerWatch(program) {
     const watchers = [];
     for (const w of watchRoots) {
       try {
-        const watcher = fs7.watch(w, { recursive: true }, (_event, filename) => {
+        const watcher = fs8.watch(w, { recursive: true }, (_event, filename) => {
           if (!filename) {
             schedule("change");
             return;
           }
-          const parts = filename.split(path37.sep);
+          const parts = filename.split(path38.sep);
           if (parts.some((p) => SKIP_NAME.has(p))) return;
-          if (filename.includes(`${path37.sep}.vibgrate${path37.sep}`) || filename.startsWith(".vibgrate")) {
+          if (filename.includes(`${path38.sep}.vibgrate${path38.sep}`) || filename.startsWith(".vibgrate")) {
             return;
           }
           schedule(filename);
@@ -3394,7 +3485,7 @@ function registerWatch(program) {
         throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
       }
     }
-    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path37.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path38.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
     await new Promise((resolve21) => {
       const stop = () => {
         for (const w of watchers) w.close();
@@ -3727,10 +3818,10 @@ function normalizeStandards(raw) {
 }
 function loadStandards(root2) {
   for (const rel of STANDARDS_FILES) {
-    const p = path37__default.join(root2, rel);
+    const p = path38__default.join(root2, rel);
     let text;
     try {
-      text = fs7__default.readFileSync(p, "utf8");
+      text = fs8__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -4448,8 +4539,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path39 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path39);
+  const path40 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path40);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -5661,7 +5752,7 @@ function registerModels(program) {
         );
       }
     } else {
-      if (!target.path || !fs7.existsSync(target.path)) {
+      if (!target.path || !fs8.existsSync(target.path)) {
         throw new CliError(
           `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
           ExitCode.NOT_FOUND
@@ -5675,7 +5766,7 @@ function registerModels(program) {
       }
       if (!global.json) info(c.dim(`  $ rm ${target.path}`));
       try {
-        fs7.unlinkSync(target.path);
+        fs8.unlinkSync(target.path);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
@@ -5813,9 +5904,9 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path37.resolve(opts.out);
-      fs7.mkdirSync(path37.dirname(outPath), { recursive: true });
-      fs7.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
+      const outPath = path38.resolve(opts.out);
+      fs8.mkdirSync(path38.dirname(outPath), { recursive: true });
+      fs8.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
     }
@@ -5964,14 +6055,14 @@ function resolveUninstallTarget(name, runtimeOpt) {
     }
     return exact[0];
   }
-  const base = path37.basename(wantLc);
+  const base = path38.basename(wantLc);
   const soft = fleet.filter((m) => {
     const n = m.name.toLowerCase();
-    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path37.basename(n) === base;
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path38.basename(n) === base;
   });
   if (soft.length === 1) return soft[0];
   if (soft.length > 1) {
-    const baseHits = soft.filter((m) => path37.basename(m.name).toLowerCase() === base);
+    const baseHits = soft.filter((m) => path38.basename(m.name).toLowerCase() === base);
     const pool = baseHits.length ? baseHits : soft;
     const order = ["ollama", "gguf", "lm-studio"];
     for (const rt of order) {
@@ -6009,11 +6100,11 @@ function printBackends(backends) {
   }
 }
 function codeConfigPath(root2) {
-  return path37.join(root2, ".vibgrate", "code.json");
+  return path38.join(root2, ".vibgrate", "code.json");
 }
 function loadCodeConfig(root2) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(codeConfigPath(root2), "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(codeConfigPath(root2), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -6080,7 +6171,7 @@ function contextBudgetFor(config, modelContextWindow) {
 var MCP_CONFIG_FILES = [".cursor/mcp.json", ".vscode/mcp.json", ".mcp.json"];
 function readMcpServersFile(file) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs8.readFileSync(file, "utf8"));
     const map = raw.mcpServers ?? raw.servers;
     return map && typeof map === "object" ? parseMcpServers(map) : {};
   } catch {
@@ -6091,7 +6182,7 @@ function discoverMcpServers(root2, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path37.join(root2, rel));
+    const found = readMcpServersFile(path38.join(root2, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -6107,7 +6198,7 @@ function discoverMcpServers(root2, ownServers) {
 
 // src/commands/code.ts
 function registerCode(program) {
-  const cmd = program.command("code").description("propose a graph-grounded code edit (guided mode with no instruction; dry-run by default)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps", "24").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue", "resume the most recent session (recap + restore /undo)").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
+  const cmd = program.command("code").description("propose a graph-grounded code edit (guided mode with no instruction; dry-run by default)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: vibgrate-relay (Vibgrate Relay), ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps", "24").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--session", "with --stream-json: stay open for further turns (warm graph and tools) instead of exiting after one").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue", "resume the most recent session (recap + restore /undo)").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
     const global = readGlobal(this);
     const instruction = (instructionParts ?? []).join(" ").trim();
     const config = loadCodeConfig(rootOf(global));
@@ -6120,7 +6211,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
+        const { loadGraph: loadGraph2 } = await import('./load-4PARCNMD.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6204,7 +6295,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-R5VQGDWP.js');
+      const { runInteractive } = await import('./interactive-MJVMY5JP.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6237,7 +6328,7 @@ function registerCode(program) {
     let mockReply;
     if (opts.mock) {
       try {
-        mockReply = fs7.readFileSync(opts.mock, "utf8");
+        mockReply = fs8.readFileSync(opts.mock, "utf8");
       } catch {
         throw new CliError(`couldn't read the --mock file: ${opts.mock}`, ExitCode.USAGE_ERROR);
       }
@@ -6286,18 +6377,18 @@ function registerCode(program) {
       };
       try {
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson } = await import('./stream-json-Y45JBNYP.js');
-        const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-MTPWWVRR.js');
+        const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
         const readline5 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
-        const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-AILFASQV.js');
+        const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-S7D2SITC.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6343,7 +6434,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-BLHEIWMT.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6363,50 +6454,187 @@ ${res.stderr}` : ""),
           };
         }
         const externalTools = mergeExternalToolsets(vgBuiltin, projectMcp);
+        const { createCheckpoint } = await import('./checkpoint-4WFZMKEO.js');
+        const os5 = await import('os');
+        const pathMod = await import('path');
+        const checkpointIndex = pathMod.join(
+          fs8.mkdtempSync(pathMod.join(os5.tmpdir(), "vg-code-cp-")),
+          "index"
+        );
+        const gitRunner = (gitArgs, gitEnv) => {
+          const res = child.spawnSync("git", gitArgs, {
+            cwd: root2,
+            encoding: "utf8",
+            env: { ...process.env, ...gitEnv ?? {} },
+            timeout: 3e4,
+            maxBuffer: 32 * 1024 * 1024
+          });
+          return { stdout: res.stdout ?? "", exitCode: res.status ?? 1 };
+        };
+        const checkpointSessionId = `r${Date.now().toString(36)}`;
+        let checkpointSeq = 0;
+        const takeCheckpoint = (files) => createCheckpoint(gitRunner, {
+          sessionId: checkpointSessionId,
+          seq: ++checkpointSeq,
+          files,
+          indexFile: checkpointIndex
+        });
+        const { loadProjectRules, nodeRulesReader } = await import('./rules-ASYEUNB5.js');
+        const projectRules = loadProjectRules(nodeRulesReader(root2));
+        if (projectRules.sources.length && !global.quiet) {
+          emitStream({
+            event: "event",
+            type: "notice",
+            text: `project instructions: ${projectRules.sources.join(", ")}`
+          });
+        }
+        const baseAgentOptions = {
+          graph,
+          root: root2,
+          providers: route.providers,
+          fsImpl: nodeCodeFs(root2),
+          run,
+          executionEnv,
+          graphBackend,
+          modelProfile,
+          auto: !!auto,
+          maxSteps,
+          budget: modelProfile.capsuleBudgetTokens,
+          contextBudget,
+          denyCommands: config.denyCommands,
+          testCommand: config.testCommand,
+          stream: true,
+          verify: verify3 ? { command: verify3.command, maxRounds: modelProfile.maxRepairRounds } : void 0,
+          capsule,
+          files: opts.file.length ? opts.file : void 0,
+          worktreeOverlay: true,
+          advancedMode: !capsule,
+          externalTools,
+          attribution: {
+            client: "vg-code",
+            provider: primarySlug,
+            model: route.providers[0]?.model
+          },
+          now: () => Date.now(),
+          projectRules: projectRules.rendered || void 0,
+          checkpoint: takeCheckpoint
+        };
         try {
-          await runCodeStreamJson({
-            graph,
-            root: root2,
-            instruction,
-            providers: route.providers,
-            fsImpl: nodeCodeFs(root2),
-            run,
-            executionEnv,
-            graphBackend,
-            modelProfile,
-            auto: !!auto,
-            maxSteps,
-            budget: modelProfile.capsuleBudgetTokens,
-            contextBudget,
-            denyCommands: config.denyCommands,
-            testCommand: config.testCommand,
-            stream: true,
-            verify: verify3 ? { command: verify3.command, maxRounds: modelProfile.maxRepairRounds } : void 0,
-            capsule,
-            files: opts.file.length ? opts.file : void 0,
-            worktreeOverlay: true,
-            advancedMode: !capsule,
-            externalTools,
-            attribution: {
-              client: "vg-code",
-              provider: primarySlug,
-              model: route.providers[0]?.model
-            },
-            now: () => Date.now(),
-            emit: emitStream,
-            bindDecisions: (session) => {
-              streamApprove = (action) => session.approve(action);
-              const rl = readline5.createInterface({ input: process.stdin });
-              rl.on("line", (raw) => {
-                try {
-                  const msg = JSON.parse(raw);
-                  if (typeof msg.approveId === "number") session.submitDecision(msg.approveId, !!msg.approve);
-                  if (typeof msg.answerId === "number") session.submitAnswer(msg.answerId, String(msg.answer ?? ""));
-                } catch {
-                }
+          if (opts.session) {
+            const { runCodeStreamJsonSession } = await import('./stream-json-MTPWWVRR.js');
+            const { runAgent: runAgent2 } = await import('./agent-Z4Z66IGM.js');
+            const {
+              loadLatestSession,
+              newSession,
+              recordTask,
+              saveSession,
+              summarizeSession
+            } = await import('./session-store-O4XPXKOV.js');
+            const resumedRecord = opts.continue ? loadLatestSession(root2) : void 0;
+            let record = resumedRecord ?? newSession(
+              `s${Date.now().toString(36)}`,
+              primarySlug ?? route.providers[0]?.id ?? "unknown",
+              route.providers[0]?.model ?? "unknown",
+              Date.now()
+            );
+            const pendingTurns = [];
+            let wakeTurn;
+            let ended = false;
+            const pushTurn = (instruction2) => {
+              if (wakeTurn) {
+                const wake = wakeTurn;
+                wakeTurn = void 0;
+                wake(instruction2);
+              } else if (instruction2 !== null) {
+                pendingTurns.push(instruction2);
+              }
+            };
+            const nextTurn = () => {
+              if (ended) return Promise.resolve(null);
+              const queued = pendingTurns.shift();
+              if (queued !== void 0) return Promise.resolve(queued);
+              return new Promise((resolve21) => {
+                wakeTurn = resolve21;
               });
-            }
-          });
+            };
+            await runCodeStreamJsonSession({
+              emit: emitStream,
+              auto: !!auto,
+              sessionId: record.id,
+              resumed: !!resumedRecord,
+              instruction,
+              nextTurn,
+              bindDecisions: (session) => {
+                streamApprove = (action) => session.approve(action);
+                const rl = readline5.createInterface({ input: process.stdin });
+                rl.on("line", (raw) => {
+                  const msg = parseHostMessage(raw);
+                  if (!msg) return;
+                  if (msg.kind === "approve") session.submitDecision(msg.id, msg.approve);
+                  else if (msg.kind === "answer") session.submitAnswer(msg.id, msg.answer);
+                  else if (msg.kind === "submit") pushTurn(msg.instruction);
+                  else if (msg.kind === "restore") {
+                    void import('./checkpoint-4WFZMKEO.js').then(({ restoreCheckpoint }) => {
+                      const outcome = restoreCheckpoint(gitRunner, {
+                        commit: msg.commit,
+                        files: msg.files
+                      });
+                      emitStream({ event: "checkpoint-restored", commit: msg.commit, ...outcome });
+                    });
+                  } else if (msg.kind === "cancel") session.cancelTurn();
+                  else if (msg.kind === "end") {
+                    ended = true;
+                    pushTurn(null);
+                  }
+                });
+                rl.on("close", () => {
+                  ended = true;
+                  session.cancelTurn();
+                  pushTurn(null);
+                });
+              },
+              runTurn: ({ instruction: turnInstruction, priorSummary, signal, session }) => runAgent2({
+                ...baseAgentOptions,
+                instruction: turnInstruction,
+                priorSummary,
+                signal,
+                approve: session.approve,
+                askUser: session.askUser,
+                onEvent: session.onEvent
+              }),
+              onTurnEnd: (turn) => {
+                record = recordTask(
+                  record,
+                  {
+                    instruction: turn.instruction,
+                    summary: turn.result?.finalText ?? "turn failed",
+                    changes: turn.result?.changes ?? [],
+                    stopped: turn.result?.stopped ?? "error"
+                  },
+                  Date.now()
+                );
+                saveSession(root2, record);
+                return summarizeSession(record);
+              }
+            });
+          } else {
+            await runCodeStreamJson({
+              ...baseAgentOptions,
+              instruction,
+              emit: emitStream,
+              bindDecisions: (session) => {
+                streamApprove = (action) => session.approve(action);
+                const rl = readline5.createInterface({ input: process.stdin });
+                rl.on("line", (raw) => {
+                  const msg = parseHostMessage(raw);
+                  if (!msg) return;
+                  if (msg.kind === "approve") session.submitDecision(msg.id, msg.approve);
+                  else if (msg.kind === "answer") session.submitAnswer(msg.id, msg.answer);
+                  else if (msg.kind === "cancel") session.cancelTurn();
+                });
+              }
+            });
+          }
         } finally {
           await disposeMcpStream?.();
           await runtime.dispose();
@@ -6425,8 +6653,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-R5VQGDWP.js');
-      const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
+      const { agentTask } = await import('./interactive-MJVMY5JP.js');
+      const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       if (opts.continue) {
@@ -6435,7 +6663,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-BLHEIWMT.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6459,11 +6687,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
-        const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-AILFASQV.js');
+        const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-S7D2SITC.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6555,7 +6783,7 @@ ${res.stderr}` : ""),
       attribution: { client: "vg-code", provider: providerSlug, model: primary?.model }
     });
     if (opts.out) {
-      fs7.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
+      fs8.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
     }
     if (global.json) {
       json(result);
@@ -6768,7 +6996,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs7__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs8__default.readFileSync(path38__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -6776,7 +7004,7 @@ function readPackageVersion(root2) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs7__default.readFileSync(p, "utf8");
+    const t = fs8__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -6791,8 +7019,8 @@ async function publishCmd(root2, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root2) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path37__default.resolve(opts.readme) : path37__default.join(root2, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path37__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path38__default.resolve(opts.readme) : path38__default.join(root2, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path38__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -6924,8 +7152,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs7.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
-    fs7.writeFileSync(file, content);
+    fs8.mkdirSync(path38.dirname(path38.resolve(file)), { recursive: true });
+    fs8.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -6935,43 +7163,43 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path37.extname(file));
+  return formatForExt(path38.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const outDir = path37.resolve(root2, opts.out ?? "vg-bundle");
+    const outDir = path38.resolve(root2, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs7.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
+    fs8.mkdirSync(path38.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs7.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
+      fs8.copyFileSync(absPath, path38.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
-    if (fs7.existsSync(graphSrc)) {
-      fs7.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
+    if (fs8.existsSync(graphSrc)) {
+      fs8.copyFileSync(graphSrc, path38.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs7.writeFileSync(path37.join(outDir, "graph.json"), serializeGraph(graph));
+        fs8.writeFileSync(path38.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
     const cat = catalogPath(root2);
-    if (fs7.existsSync(cat)) {
-      fs7.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
+    if (fs8.existsSync(cat)) {
+      fs8.copyFileSync(cat, path38.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs7.existsSync(libDir(root2))) {
-        fs7.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
+      if (fs8.existsSync(libDir(root2))) {
+        fs8.cpSync(libDir(root2), path38.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -6983,15 +7211,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs7.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs8.writeFileSync(path38.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path37.relative(root2, outDir), ...manifest });
+      json({ out: path38.relative(root2, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path37.relative(root2, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path38.relative(root2, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path37.relative(root2, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path38.relative(root2, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -7009,7 +7237,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs7.existsSync(path37.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path38.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -7035,14 +7263,14 @@ async function runDoctor(global) {
     root: root2,
     configFile,
     map: {
-      path: path37.relative(root2, graphPath),
+      path: path38.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path37.relative(root2, catalogPath(root2)),
-      present: fs7.existsSync(catalogPath(root2)),
+      path: path38.relative(root2, catalogPath(root2)),
+      present: fs8.existsSync(catalogPath(root2)),
       libraries: libCount
     },
     credentials: creds,
@@ -7099,7 +7327,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path37.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path38.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -7179,7 +7407,9 @@ function registerDaemon(program) {
     if (await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is already running at ${socketPath}`, ExitCode.ERROR);
     }
-    const server = await startVgdServer({ socketPath });
+    let requestShutdown = () => {
+    };
+    const server = await startVgdServer({ socketPath, onShutdownRequest: () => requestShutdown() });
     if (!global.quiet) {
       info(`vgd \xB7 listening on ${c.dim(server.socketPath)} (${VGD_PROTOCOL_VERSION})`);
       info(c.dim("  register a workspace: vg daemon register"));
@@ -7190,6 +7420,7 @@ function registerDaemon(program) {
       if (!global.quiet) info(c.dim("vgd \xB7 stopped"));
       process.exit(0);
     };
+    requestShutdown = () => void shutdown();
     process.on("SIGINT", () => void shutdown());
     process.on("SIGTERM", () => void shutdown());
     await new Promise(() => {
@@ -7209,33 +7440,70 @@ function registerDaemon(program) {
       }
       return;
     }
-    const child = spawnDetachedDaemonStart(socketPath);
-    child.unref();
-    const deadline = Date.now() + 8e3;
-    let ready = false;
-    while (Date.now() < deadline) {
-      await sleep(100);
-      if (await vgdIsRunning({ socketPath })) {
-        ready = true;
-        break;
-      }
-    }
-    if (!ready) {
-      throw new CliError(`vgd failed to become ready at ${socketPath}`, ExitCode.ERROR);
-    }
+    const child = await startDetachedVgd(socketPath);
     const res = await vgdRequest({ op: "status" }, { socketPath });
     if (global.json) {
       json({ running: true, ensured: true, ...res.ok ? res : { socketPath } });
     } else if (!global.quiet) {
-      const pid = res.ok && "pid" in res ? res.pid : child.pid;
+      const pid = res.ok && "pid" in res ? res.pid : child;
       info(`vgd \xB7 started in background pid ${pid} \xB7 ${c.dim(socketPath)}`);
     }
   });
   applyGlobalOptions(ensure);
+  const stop = cmd.command("stop").description("stop the running vgd (idempotent \u2014 succeeds if none is running)").action(async function() {
+    const global = readGlobal(this);
+    const socketPath = socketOf(this);
+    const result = await stopVgd(socketPath);
+    if (global.json) {
+      json({ stopped: result === "stopped", result, socketPath });
+    } else if (!global.quiet) {
+      if (result === "stopped") info(`vgd \xB7 stopped ${c.dim(socketPath)}`);
+      else if (result === "not-running") info(c.dim(`vgd \xB7 not running (${socketPath})`));
+    }
+    if (result === "refused") {
+      throw new CliError(
+        "this vgd is embedded in another process (e.g. vg code) \u2014 stop that process instead",
+        ExitCode.ERROR
+      );
+    }
+    if (result === "failed") {
+      throw new CliError(
+        `vgd did not stop within 5s (${socketPath}) \u2014 check \`vg daemon status\` and stop the process manually`,
+        ExitCode.ERROR
+      );
+    }
+  });
+  applyGlobalOptions(stop);
+  const restart = cmd.command("restart").description("restart vgd (stop if running, then start in the background)").action(async function() {
+    const global = readGlobal(this);
+    const socketPath = socketOf(this);
+    const stopResult = await stopVgd(socketPath);
+    if (stopResult === "refused") {
+      throw new CliError(
+        "this vgd is embedded in another process (e.g. vg code) \u2014 stop that process instead",
+        ExitCode.ERROR
+      );
+    }
+    if (stopResult === "failed") {
+      throw new CliError(
+        `vgd did not stop within 5s (${socketPath}) \u2014 check \`vg daemon status\` and stop the process manually`,
+        ExitCode.ERROR
+      );
+    }
+    await startDetachedVgd(socketPath);
+    const res = await vgdRequest({ op: "status" }, { socketPath });
+    if (global.json) {
+      json({ running: true, restarted: true, ...res.ok ? res : { socketPath } });
+    } else if (!global.quiet) {
+      const pid = res.ok && "pid" in res ? res.pid : "?";
+      info(`vgd \xB7 restarted pid ${pid} \xB7 ${c.dim(socketPath)}`);
+    }
+  });
+  applyGlobalOptions(restart);
   const register = cmd.command("register").description("register the current repository with a running vgd").argument("[root]", "repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path37.resolve(rootArg ?? rootOf(global));
+    const root2 = path38.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -7271,7 +7539,7 @@ function registerDaemon(program) {
   const federation = cmd.command("federation").description("register a multi-root federation from .vibgrate/federation.json (or primary cwd)").argument("[root]", "primary repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const primary = path37.resolve(rootArg ?? rootOf(global));
+    const primary = path38.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -7299,32 +7567,42 @@ function registerDaemon(program) {
   const publish = cmd.command("publish").description("load the workspace code map into vgd ActiveGraph (from global/legacy store)").argument("[root]", "repository root (default: cwd)").option("--git-ref <ref>", "branch or SHA (default: detect HEAD)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path37.resolve(rootArg ?? rootOf(global));
+    const root2 = path38.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
-    const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
-    const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
     const opts = this.opts();
-    const graph = loadGraph2(root2, global.graph);
-    if (!graph) {
-      throw new CliError(
-        `no code map found for ${root2} \u2014 run \`vg build\` (or bare \`vg\`) first`,
-        ExitCode.NOT_FOUND
-      );
-    }
-    const reg = await vgdRequest({ op: "register", root: root2 }, { socketPath });
-    if (!reg.ok) throw new CliError(reg.error, ExitCode.ERROR);
-    const git2 = opts.gitRef?.trim() || detectGitRef(root2).ref || "HEAD";
-    const repositoryId = reg.ok && "workspace" in reg ? reg.workspace.id : repositoryIdFromRoot(root2);
-    const put = await vgdRequest(
-      { op: "put-graph", repositoryId, gitRef: git2, graph },
+    const loaded = await vgdRequest(
+      { op: "load-graph", root: root2, gitRef: opts.gitRef?.trim() || void 0, graphPath: global.graph },
       { socketPath }
     );
-    if (!put.ok) throw new CliError(put.error, ExitCode.ERROR);
+    let put = loaded;
+    if (!loaded.ok && loaded.code === "no_map") {
+      throw new CliError(loaded.error, ExitCode.NOT_FOUND);
+    }
+    if (!loaded.ok) {
+      const { loadGraph: loadGraph2 } = await import('./load-4PARCNMD.js');
+      const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
+      const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
+      const graph = loadGraph2(root2, global.graph);
+      if (!graph) {
+        throw new CliError(
+          `no code map found for ${root2} \u2014 run \`vg build\` (or bare \`vg\`) first`,
+          ExitCode.NOT_FOUND
+        );
+      }
+      const reg = await vgdRequest({ op: "register", root: root2 }, { socketPath });
+      if (!reg.ok) throw new CliError(reg.error, ExitCode.ERROR);
+      const git2 = opts.gitRef?.trim() || detectGitRef(root2).ref || "HEAD";
+      const repositoryId = reg.ok && "workspace" in reg ? reg.workspace.id : repositoryIdFromRoot(root2);
+      put = await vgdRequest(
+        { op: "put-graph", repositoryId, gitRef: git2, graph },
+        { socketPath }
+      );
+      if (!put.ok) throw new CliError(put.error, ExitCode.ERROR);
+    }
     if (global.json) json(put);
-    else if ("stored" in put) {
+    else if (put.ok && "stored" in put) {
       info(`vgd \xB7 published graph \xB7 ${put.nodeCount} node(s) \xB7 ref ${put.gitRef}`);
       info(c.dim(`  repositoryId ${put.repositoryId}`));
     }
@@ -7419,7 +7697,7 @@ function socketOf(cmd) {
   let c2 = cmd;
   while (c2) {
     const opts = c2.opts();
-    if (opts.socket) return path37.resolve(opts.socket);
+    if (opts.socket) return path38.resolve(opts.socket);
     c2 = c2.parent;
   }
   return vgdSocketPath();
@@ -7442,6 +7720,62 @@ function spawnDetachedDaemonStart(socketPath) {
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
+async function startDetachedVgd(socketPath) {
+  const child = spawnDetachedDaemonStart(socketPath);
+  child.unref();
+  const deadline = Date.now() + 8e3;
+  while (Date.now() < deadline) {
+    await sleep(100);
+    if (await vgdIsRunning({ socketPath })) return child.pid;
+  }
+  throw new CliError(`vgd failed to become ready at ${socketPath}`, ExitCode.ERROR);
+}
+async function stopVgd(socketPath) {
+  if (!await vgdIsRunning({ socketPath })) return "not-running";
+  let acknowledged = false;
+  try {
+    const res = await vgdRequest({ op: "shutdown" }, { socketPath });
+    if (res.ok) acknowledged = true;
+    else if (res.code === "shutdown_unsupported") return "refused";
+  } catch {
+  }
+  if (!acknowledged) {
+    const pid = readVgdPid();
+    if (pid == null) return "failed";
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+      return "failed";
+    }
+  }
+  const deadline = Date.now() + 5e3;
+  while (Date.now() < deadline) {
+    await sleep(100);
+    if (!await vgdIsRunning({ socketPath })) return "stopped";
+  }
+  return "failed";
+}
+async function restartVgdIfRunning(socketPath = vgdSocketPath()) {
+  try {
+    const stopResult = await stopVgd(socketPath);
+    if (stopResult === "not-running") return "not-running";
+    if (stopResult === "refused") return "refused";
+    if (stopResult === "failed") return "failed";
+    await startDetachedVgd(socketPath);
+    return "restarted";
+  } catch {
+    return "failed";
+  }
+}
+function readVgdPid() {
+  try {
+    const raw = fs8.readFileSync(vgdPidPath(), "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
 async function repositoryIdForCwd(socketPath, root2) {
   const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
   const reg = await vgdRequest({ op: "register", root: root2 }, { socketPath });
@@ -7520,7 +7854,7 @@ function registerPolicy(program) {
     const global = readGlobal(this);
     let raw;
     try {
-      raw = fs7.readFileSync(file, "utf8");
+      raw = fs8.readFileSync(file, "utf8");
     } catch {
       throw new CliError(`cannot read ${file}`, ExitCode.NOT_FOUND);
     }
@@ -7640,11 +7974,11 @@ function registerLlmHost(program) {
   applyGlobalOptions(cmd);
 }
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path37.resolve(targetPath);
-  const vibgrateDir2 = path37.join(rootDir, ".vibgrate");
+  const rootDir = path38.resolve(targetPath);
+  const vibgrateDir2 = path38.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path37.join(rootDir, "vibgrate.config.ts");
+  const configPath = path38.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -7652,7 +7986,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-MROWBNK7.js');
+    const { runBaseline } = await import('./baseline-Q3QQF5QF.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7755,16 +8089,16 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path37.join(rootDir, relFile));
+  const content = await readFile3(path38.join(rootDir, relFile));
   if (!content) return false;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`\\b${escaped}\\b`).test(content);
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs20.stat(absPath);
+    const stat2 = await fs22.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs20.readFile(absPath, "utf8");
+    return await fs22.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -7950,7 +8284,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path37.join(rootDir, file))) {
+      if (await pathExists$1(path38.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -8144,7 +8478,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path37.resolve(targetPath);
+  const rootDir = path38.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -8152,7 +8486,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path37.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path38.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
@@ -8411,40 +8745,40 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs7.statSync(artifactPath).mtimeMs;
+    ref = fs8.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
   let newest = -Infinity;
   let newestChanged;
-  const MAX_ENTRIES = 2e4;
+  const MAX_ENTRIES2 = 2e4;
   let scanned = 0;
   const walk2 = (dir, depth) => {
-    if (depth > 8 || scanned > MAX_ENTRIES) return;
+    if (depth > 8 || scanned > MAX_ENTRIES2) return;
     let entries;
     try {
-      entries = fs7.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       scanned++;
-      if (scanned > MAX_ENTRIES) break;
+      if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path37.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path38.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path37.join(dir, e.name);
+      const abs = path38.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs7.statSync(abs).mtimeMs;
+        mtimeMs = fs8.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path37.relative(rootDir, abs) || e.name;
+        newestChanged = path38.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -8575,7 +8909,7 @@ function analyzeTree(root2, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs7.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8584,17 +8918,17 @@ function analyzeTree(root2, packages) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path37.join(dir, entry.name), depth + 1);
+        walk2(path38.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path37.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path38.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path37.join(dir, entry.name);
+      const full = path38.join(dir, entry.name);
       let content;
       try {
-        if (fs7.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs7.readFileSync(full, "utf8");
+        if (fs8.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs8.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -8905,7 +9239,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path37.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path38.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -8934,8 +9268,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path37.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path37.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path38.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path38.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -8953,7 +9287,7 @@ async function fetchLatestVersion() {
     if (!response.ok) return null;
     const data = await response.json();
     const latest = data.version;
-    if (!latest || !semver2.valid(latest)) return null;
+    if (!latest || !semver3__default.valid(latest)) return null;
     await writeCache({ latest, checkedAt: Date.now() });
     return latest;
   } catch {
@@ -8962,8 +9296,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs20.mkdir(CACHE_DIR, { recursive: true });
-    await fs20.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs22.mkdir(CACHE_DIR, { recursive: true });
+    await fs22.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -8974,7 +9308,7 @@ function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd
   if (!execPath) return null;
   let resolved = execPath;
   try {
-    resolved = fs7.realpathSync(execPath);
+    resolved = fs8.realpathSync(execPath);
   } catch {
   }
   const p = resolved.replace(/\\/g, "/");
@@ -9004,14 +9338,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path37.join(dir, "node_modules") : null;
+        return dir ? path38.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path37.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path38.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
     const root2 = probe.root();
-    if (root2 && await pathExists(path37.join(root2, pkg))) return probe.pm;
+    if (root2 && await pathExists(path38.join(root2, pkg))) return probe.pm;
   }
   return null;
 }
@@ -9030,15 +9364,15 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path37.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path37.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path38.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path38.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path38.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path37.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path38.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path37.join(cwd, "package.json");
+    const pkgPath = path38.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -9063,7 +9397,7 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path37.join(cwd, "package.json");
+    const pkgPath = path38.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -9092,8 +9426,8 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
       process.exit(1);
     }
-    const semver3 = await import('semver');
-    if (!semver3.gt(latest, VERSION)) {
+    const semver4 = await import('semver');
+    if (!semver4.gt(latest, VERSION)) {
       console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
       if (opts.reap !== false) reapAndReport(process.cwd(), VERSION);
       return;
@@ -9152,8 +9486,29 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       process.exit(1);
     }
     if (opts.reap !== false) reapAndReport(cwd, latest);
+    if (opts.reap !== false) await restartVgdAndReport();
   }
 );
+async function restartVgdAndReport() {
+  let result;
+  try {
+    result = await restartVgdIfRunning();
+  } catch {
+    return;
+  }
+  if (result === "not-running") return;
+  if (result === "restarted") {
+    console.log(chalk7.dim("Restarted the vgd daemon on the new version."));
+  } else if (result === "refused") {
+    console.log(
+      chalk7.dim("A vgd embedded in another process (e.g. vg code) is running \u2014 restart that session to pick up the update.")
+    );
+  } else {
+    console.log(
+      chalk7.dim('Could not restart the vgd daemon automatically \u2014 run "vg daemon restart" to pick up the update.')
+    );
+  }
+}
 function reapAndReport(cwd, keepVersion) {
   let reaped = [];
   try {
@@ -9211,13 +9566,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path37.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path38.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path37.isAbsolute(inFile) ? inFile : path37.join(rootDir, inFile);
+  const artifactPath = path38.isAbsolute(inFile) ? inFile : path38.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -9244,7 +9599,7 @@ async function repositoryIdentity(rootDir, override) {
   }
 }
 var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path37.resolve(targetPath);
+  const rootDir = path38.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -9405,7 +9760,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path37.isAbsolute(projectPath) ? path37.relative(rootDir, projectPath) : projectPath;
+  const rel = path38.isAbsolute(projectPath) ? path38.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -10240,7 +10595,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path37.resolve(opts.in);
+  const artifactPath = path38.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -10289,8 +10644,8 @@ function openUrl(url) {
 // src/reporting/commands/login.ts
 var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
 function isInside(dir, file) {
-  const rel = path37.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path37.isAbsolute(rel);
+  const rel = path38.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path38.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -10545,7 +10900,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path37.resolve(opts.from);
+      const fromPath = path38.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -10563,9 +10918,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path37.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path38.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path37.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path38.resolve(opts.out)}
 `
       );
     } else {
@@ -10748,7 +11103,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path37.resolve(filePath);
+  const absolutePath = path38.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -10765,7 +11120,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path37.resolve(opts.out), body);
+    await writeTextFile(path38.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -10776,7 +11131,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path37.resolve(opts.out), report);
+    await writeTextFile(path38.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -10907,20 +11262,20 @@ function resolveRegime(id) {
   return regime;
 }
 function evidenceDir(root2) {
-  return path37.join(root2, ".vibgrate", "evidence");
+  return path38.join(root2, ".vibgrate", "evidence");
 }
 function orgPath(root2) {
-  return path37.join(evidenceDir(root2), "org.json");
+  return path38.join(evidenceDir(root2), "org.json");
 }
 function productsPath(root2) {
-  return path37.join(evidenceDir(root2), "products.json");
+  return path38.join(evidenceDir(root2), "products.json");
 }
 function releasesDir(root2) {
-  return path37.join(evidenceDir(root2), "releases");
+  return path38.join(evidenceDir(root2), "releases");
 }
 function releasePath(root2, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path37.join(releasesDir(root2), `${safe}.json`);
+  return path38.join(releasesDir(root2), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
@@ -10951,7 +11306,7 @@ async function freezeRelease(root2, release) {
   const p = releasePath(root2, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path37.relative(root2, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path38.relative(root2, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
@@ -10965,15 +11320,15 @@ async function loadReleases(root2, productId) {
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path37.join(dir, f));
+    const rel = await readJsonFile(path38.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
 }
 function coerce(version) {
-  const parsed = semver2.parse(version, { loose: true });
+  const parsed = semver3__default.parse(version, { loose: true });
   if (parsed) return parsed.version;
-  const c2 = semver2.coerce(version);
+  const c2 = semver3__default.coerce(version);
   return c2 ? c2.version : null;
 }
 function versionAffected(version, range) {
@@ -10983,11 +11338,11 @@ function versionAffected(version, range) {
   if (!range.introduced && !range.fixed && !range.versions) return false;
   const introduced = range.introduced ? coerce(range.introduced) : "0.0.0";
   if (!introduced) return false;
-  if (semver2.lt(v, introduced)) return false;
+  if (semver3__default.lt(v, introduced)) return false;
   if (range.fixed) {
     const fixed = coerce(range.fixed);
     if (!fixed) return false;
-    if (semver2.gte(v, fixed)) return false;
+    if (semver3__default.gte(v, fixed)) return false;
   }
   return true;
 }
@@ -11068,8 +11423,8 @@ function computeExposure(input) {
       productName: product.name,
       classification: product.classification,
       status,
-      affectedVersions: [...affectedVersions].sort(semver2.compareLoose),
-      releases: affectedReleases.sort((a, b) => semver2.compareLoose(a.version, b.version)),
+      affectedVersions: [...affectedVersions].sort(semver3__default.compareLoose),
+      releases: affectedReleases.sort((a, b) => semver3__default.compareLoose(a.version, b.version)),
       memberStates: product.memberStates,
       supportStatus: support.status,
       supportDetail: support.detail
@@ -11660,19 +12015,19 @@ function verifyEvidenceEnvelope(env, opts = {}) {
 var DEFAULT_KEY = "attest-key.pem";
 function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path37.resolve(chosen) : path37.join(root2, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path38.resolve(chosen) : path38.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
-  if (!fs7.existsSync(keyPath)) {
+  if (!fs8.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs7.mkdirSync(path37.dirname(keyPath), { recursive: true });
-    fs7.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs7.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs8.mkdirSync(path38.dirname(keyPath), { recursive: true });
+    fs8.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs8.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
   }
   let key2;
   try {
-    key2 = crypto3.createPrivateKey(fs7.readFileSync(keyPath, "utf8"));
+    key2 = crypto3.createPrivateKey(fs8.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${keyPath}`, ExitCode.USAGE_ERROR);
   }
@@ -11683,16 +12038,16 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs7.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs7.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs8.mkdirSync(path38.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs8.writeFileSync(path38.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path37.join("inputs", "advisory.json"), input.advisory);
+  write(path38.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path37.join("inputs", "releases", `${safe}.json`), rel);
+    write(path38.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path37.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path38.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -11708,13 +12063,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs7.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs8.writeFileSync(path38.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs7.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs8.writeFileSync(path38.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs7.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs8.writeFileSync(path38.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -11775,13 +12130,13 @@ function undeterminedFields(result, regime) {
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
 async function recordDrill(root2, record) {
-  const dir = path37.join(evidenceDir(root2), "drills");
-  const p = path37.join(dir, `${record.drillId}.json`);
+  const dir = path38.join(evidenceDir(root2), "drills");
+  const p = path38.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
 async function hasRecentDrill(root2, asOf) {
-  const dir = path37.join(evidenceDir(root2), "drills");
+  const dir = path38.join(evidenceDir(root2), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
@@ -11789,7 +12144,7 @@ async function hasRecentDrill(root2, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path37.join(dir, f));
+    const rec = await readJsonFile2(path38.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -11869,7 +12224,7 @@ function formatRegimeList() {
 
 // src/reporting/commands/evidence/index.ts
 function root(opts) {
-  return path37.resolve(opts.cwd ?? process.cwd());
+  return path38.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -11957,7 +12312,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path37.resolve(rootDir, opts.from),
+    from: path38.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -11965,7 +12320,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path37.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path38.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -12017,7 +12372,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path37.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path38.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -12025,7 +12380,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path37.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path38.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
@@ -12057,7 +12412,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs7.writeFileSync(path37.resolve(rootDir, opts.out), md);
+    fs8.writeFileSync(path38.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -12099,20 +12454,20 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path37.resolve(bundlePath);
-  const envPath = fs7.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
-  if (!fs7.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
-  const envelope = JSON.parse(fs7.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path37.join(path37.dirname(envPath), "result.json");
-  const result = fs7.existsSync(resultPath) ? JSON.parse(fs7.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs7.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
+  const abs = path38.resolve(bundlePath);
+  const envPath = fs8.statSync(abs).isDirectory() ? path38.join(abs, "evidence.intoto.jsonl") : abs;
+  if (!fs8.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
+  const envelope = JSON.parse(fs8.readFileSync(envPath, "utf8").trim().split("\n")[0]);
+  const resultPath = path38.join(path38.dirname(envPath), "result.json");
+  const result = fs8.existsSync(resultPath) ? JSON.parse(fs8.readFileSync(resultPath, "utf8")) : void 0;
+  const publicKeyPem = opts.pub ? fs8.readFileSync(path38.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path37.join(path37.dirname(envPath), "timestamp.tsr");
-  if (fs7.existsSync(tsrPath) && result) {
-    const t = verifyTimestamp(fs7.readFileSync(tsrPath), exposureSubjectDigest(result));
+  const tsrPath = path38.join(path38.dirname(envPath), "timestamp.tsr");
+  if (fs8.existsSync(tsrPath) && result) {
+    const t = verifyTimestamp(fs8.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
     console.log("  " + tcolor("TIMESTAMP") + `  ${t.reason}`);
   }
@@ -12179,12 +12534,12 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path37.resolve(rootDir, opts.out);
-  await writeJsonFile(path37.join(dir, "org.json"), org);
-  await writeJsonFile(path37.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path37.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path37.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path37.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path38.resolve(rootDir, opts.out);
+  await writeJsonFile(path38.join(dir, "org.json"), org);
+  await writeJsonFile(path38.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path38.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path38.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path38.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
 var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
   const rootDir = root(opts);
@@ -12210,10 +12565,10 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path37.resolve(rootDir, opts.result);
-    const resultPath = fs7.existsSync(raw) && fs7.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
-    if (!fs7.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
-    exposure = JSON.parse(fs7.readFileSync(resultPath, "utf8"));
+    const raw = path38.resolve(rootDir, opts.result);
+    const resultPath = fs8.existsSync(raw) && fs8.statSync(raw).isDirectory() ? path38.join(raw, "result.json") : raw;
+    if (!fs8.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
+    exposure = JSON.parse(fs8.readFileSync(resultPath, "utf8"));
   }
   const payload = { schemaVersion: "evidence-push-1", regime: regime.id, generatedAt: nowIso(), signed: Boolean(opts.signed), products: productPayload, exposure };
   const body = JSON.stringify(payload);
@@ -12403,7 +12758,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs7.existsSync(path37.resolve(cwd, first))) {
+  if (fs8.existsSync(path38.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -12448,9 +12803,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path37.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path38.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path37.resolve(eq.slice("--cwd=".length));
+  if (eq) return path38.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {