@vibgrate/cli 2026.730.1 → 2026.730.2

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-EKCNSRNJ.js';
-export { runBuild } from './chunk-EKCNSRNJ.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-TJ3WIJ7H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-6WNJJXFY.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-ZW5W627G.js';
+export { runBuild } from './chunk-ZW5W627G.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-LCQILWQL.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-UPH2RJ7L.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { runCodeSession } from './chunk-WBMMRERH.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-CQDCZQFV.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-NSK25UT2.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -23,11 +23,11 @@ import './chunk-RGEVBSLK.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import './chunk-7AVYKZEM.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-CFL3QQQZ.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-GLT3N7T2.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-6D4BCGRQ.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WHXVU23K.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-A5LF4VS4.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RV5DTGYT.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-ON7PZNYV.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-CPX7XP3O.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-FHJBGPJZ.js';
@@ -39,9 +39,9 @@ import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { loadGraph, SCHEMA_VERSION } from './chunk-VOEYUAER.js';
-import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-5G7C6H2G.js';
-import { VERSION } from './chunk-Q4UQ73NA.js';
+import { loadGraph, SCHEMA_VERSION } from './chunk-HWN4P64B.js';
+import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-PHVVVOW7.js';
+import { VERSION } from './chunk-BZPZ3OM6.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
@@ -2334,6 +2334,7 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("textDocument/codeLens", (_m, params) => this.onCodeLens(params));
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
+    this.conn.onRequest("vibgrate/score/forProject", (_m, params) => this.onScoreForProject(params));
     this.conn.onRequest("vibgrate/score/history", (_m, params) => {
       const p = params;
       const days = typeof p?.days === "number" && p.days > 0 && p.days <= 365 ? p.days : 90;
@@ -2454,7 +2455,8 @@ var VibgrateLanguageServer = class {
       scannedAt: a.timestamp,
       ...delta !== void 0 ? { delta } : {},
       ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {},
-      ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {}
+      ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {},
+      ...buildProjectRefs(a.projects ?? []) ? { projects: buildProjectRefs(a.projects ?? []) } : {}
     };
     this.conn.notify("vibgrate/score", payload);
   }
@@ -2686,6 +2688,17 @@ var VibgrateLanguageServer = class {
     const project = projectForFile(this.opts.root, a, uriToPath(p.uri));
     return project ? scoreForProject(a, project) : null;
   }
+  /**
+   * `vibgrate/score/forProject` — monorepo scope picker. Returns the same
+   * shape as the whole-repo score, scoped to one scanned project path.
+   */
+  onScoreForProject(params) {
+    const p = params;
+    const a = this.artifact;
+    if (!a || typeof p.path !== "string") return null;
+    const project = projectByPath(a, p.path);
+    return project ? scoreForProject(a, project) : null;
+  }
 };
 function uriToPath(uri) {
   try {
@@ -2712,6 +2725,30 @@ function pruneArtifactProjects(a) {
   const findings = (a.findings ?? []).filter((f) => !isPrunedWorkspacePath(f.location));
   return { ...a, projects, findings };
 }
+function projectByPath(a, projectPath) {
+  const want = path37.normalize(projectPath === "" ? "." : projectPath);
+  for (const proj of a.projects ?? []) {
+    const got = path37.normalize(proj.path === "" ? "." : proj.path);
+    if (got === want) return proj;
+  }
+  return void 0;
+}
+function buildProjectRefs(projects) {
+  if (projects.length === 0) return void 0;
+  return projects.map((p) => {
+    const rel = p.path === "" ? "." : p.path;
+    const base = rel === "." ? "." : path37.basename(rel);
+    return {
+      path: rel,
+      name: p.name || base,
+      ...p.drift ? {
+        score: p.drift.score,
+        band: p.drift.riskLevel ?? "low",
+        mode: p.drift.mode ?? "verified"
+      } : {}
+    };
+  }).sort((a, b) => a.path.localeCompare(b.path));
+}
 function projectForFile(root2, a, filePath) {
   const dir = path37.dirname(path37.resolve(filePath));
   let best;
@@ -2757,10 +2794,11 @@ function scoreForProject(a, proj) {
     methodology: proj.drift.methodologyVersion ?? a.drift.methodologyVersion ?? "unknown",
     scale: "0 best, 100 worst",
     counts: { behind, eol, unmaintained, total },
-    rootPath: proj.path,
+    rootPath: proj.path === "" ? "." : proj.path,
     scannedAt: a.timestamp,
     ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {},
-    ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {}
+    ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {},
+    ...buildProjectRefs(a.projects ?? []) ? { projects: buildProjectRefs(a.projects ?? []) } : {}
   };
 }
 function runtimeHorizonLabel(project) {
@@ -2789,34 +2827,40 @@ function bandForScore(n) {
   if (n <= 60) return "moderate";
   return "high";
 }
-function buildBreakdown(drift, projects) {
-  const top = drift.dependencyDrift?.top;
-  if (!top || top.length === 0) return void 0;
+function buildBreakdown(_drift, projects) {
   const byPkg = /* @__PURE__ */ new Map();
   for (const p of projects) {
     const ecosystem = osvEcosystem(p.type);
-    for (const d of p.dependencies ?? []) if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+    for (const d of p.dependencies ?? []) {
+      if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+    }
   }
-  const items = top.filter((t) => t.drift > 0).map((t) => {
-    const found = byPkg.get(t.package);
-    const row = found?.row;
-    return {
-      package: t.package,
-      section: row?.section ?? "dependencies",
-      ecosystem: found?.ecosystem ?? null,
-      drift: t.drift,
-      band: bandForScore(t.drift),
-      currentSpec: row?.currentSpec ?? "",
-      resolvedVersion: row?.resolvedVersion ?? null,
-      latestStable: row?.latestStable ?? null,
-      majorsBehind: row?.majorsBehind ?? null,
-      ageDays: row?.ageDays ?? null,
-      mode: t.mode,
-      unsupported: t.unsupported,
-      abandoned: t.flags.includes("abandoned-floor"),
-      flags: t.flags
-    };
-  });
+  if (byPkg.size === 0) return void 0;
+  const items = [];
+  for (const [, { row, ecosystem }] of byPkg) {
+    const scored = perDependencyDrift(row, {
+      unsupported: row.unsupported === true,
+      abandoned: row.abandoned === true
+    });
+    if (scored.excluded) continue;
+    items.push({
+      package: row.package,
+      section: row.section ?? "dependencies",
+      ecosystem,
+      drift: scored.drift,
+      band: bandForScore(scored.drift),
+      currentSpec: row.currentSpec ?? "",
+      resolvedVersion: row.resolvedVersion ?? null,
+      latestStable: row.latestStable ?? null,
+      majorsBehind: row.majorsBehind ?? null,
+      ageDays: row.ageDays ?? null,
+      mode: scored.mode,
+      unsupported: scored.unsupported || row.unsupported === true,
+      abandoned: scored.flags.includes("abandoned-floor") || row.abandoned === true,
+      flags: scored.flags
+    });
+  }
+  items.sort((a, b) => b.drift - a.drift || a.package.localeCompare(b.package));
   return items.length > 0 ? items : void 0;
 }
 function manifestRelativePath(proj) {
@@ -6064,7 +6108,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-YPSEDYIW.js');
+        const { loadGraph: loadGraph2 } = await import('./load-RFQFTTIT.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6148,7 +6192,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-NJG6467J.js');
+      const { runInteractive } = await import('./interactive-MR7DTVYS.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6229,7 +6273,7 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-5FQWHWYK.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-EKB6YQIK.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
         const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3YOPU3LF.js');
         const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
@@ -6238,11 +6282,11 @@ function registerCode(program) {
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y4ZD3QDO.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-23RZLEA4.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-DH7AHQ23.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-VIPBL7W4.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6300,7 +6344,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PZFGTZSA.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-UZFHPP2Q.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6536,7 +6580,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-NJG6467J.js');
+      const { agentTask } = await import('./interactive-MR7DTVYS.js');
       const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6546,7 +6590,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PZFGTZSA.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-UZFHPP2Q.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6570,11 +6614,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y4ZD3QDO.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-23RZLEA4.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-DH7AHQ23.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-VIPBL7W4.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7464,7 +7508,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-YPSEDYIW.js');
+      const { loadGraph: loadGraph2 } = await import('./load-RFQFTTIT.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -7869,7 +7913,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-V6MYDEMS.js');
+    const { runBaseline } = await import('./baseline-536TQZIB.js');
     await runBaseline(rootDir);
   }
   console.log("");