@vibgrate/cli 2026.730.1 → 2026.731.1

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-EKCNSRNJ.js';
-export { runBuild } from './chunk-EKCNSRNJ.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-TJ3WIJ7H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-6WNJJXFY.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-T7OFJS3X.js';
+export { runBuild } from './chunk-T7OFJS3X.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-CWB6H553.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-GPDJOCUI.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { runCodeSession } from './chunk-WBMMRERH.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-CQDCZQFV.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-3NP2DO4G.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -23,11 +23,11 @@ import './chunk-RGEVBSLK.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import './chunk-7AVYKZEM.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-CFL3QQQZ.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-GLT3N7T2.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-6D4BCGRQ.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-J3BQ7FIT.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-SKIMUFCI.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-C22ZY3FV.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-ON7PZNYV.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-UVMP7DFF.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-FHJBGPJZ.js';
@@ -39,14 +39,14 @@ import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { loadGraph, SCHEMA_VERSION } from './chunk-VOEYUAER.js';
-import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-5G7C6H2G.js';
-import { VERSION } from './chunk-Q4UQ73NA.js';
+import { loadGraph, SCHEMA_VERSION } from './chunk-476KWSFM.js';
+import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-DXSEG6SZ.js';
+import { VERSION } from './chunk-2XTPGYR2.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
-import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-IDAQV3NQ.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-NJT4CA6K.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs7 from 'fs';
 import fs7__default, { realpathSync } from 'fs';
@@ -2009,6 +2009,30 @@ function runTree(graph, params) {
 }
 
 // src/lsp/enrich.ts
+var REACH_RANK = {
+  reached: 3,
+  potentially_reachable: 2,
+  unknown: 1,
+  "not-observed": 0
+};
+function mergeReachability(a, b) {
+  const left = a ?? "unknown";
+  const right = b ?? "unknown";
+  return REACH_RANK[right] > REACH_RANK[left] ? right : left;
+}
+function mergeReachSites(a, b) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const site of [...a ?? [], ...b ?? []]) {
+    if (!site?.file) continue;
+    const k = `${site.file}::${site.line ?? ""}::${site.symbol ?? ""}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out2.push(site);
+    if (out2.length >= 10) break;
+  }
+  return out2;
+}
 var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
 var KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
 var cache = /* @__PURE__ */ new Map();
@@ -2171,10 +2195,11 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
         existing.locations.push(loc);
       }
     }
-    if (t.reachability === "reached") existing.reachability = "reached";
-    else if (t.reachability === "not-observed" && existing.reachability === "unknown") {
-      existing.reachability = "not-observed";
+    existing.reachability = mergeReachability(existing.reachability, t.reachability);
+    if (t.reachSites?.length) {
+      existing.reachSites = mergeReachSites(existing.reachSites, t.reachSites);
     }
+    if (!existing.reachEvidence && t.reachEvidence) existing.reachEvidence = t.reachEvidence;
     if (!existing.latestStable && t.latestStable) existing.latestStable = t.latestStable;
     if (!existing.section && t.section) existing.section = t.section;
   }
@@ -2211,6 +2236,8 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
           published: v.published,
           kev: kevHit,
           reachability: t.reachability ?? "unknown",
+          reachSites: t.reachSites ?? [],
+          reachEvidence: t.reachEvidence ?? null,
           file: locations[0]?.file ?? t.file ?? null,
           line: locations[0]?.line ?? t.line ?? null,
           locations,
@@ -2334,6 +2361,8 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("textDocument/codeLens", (_m, params) => this.onCodeLens(params));
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
+    this.conn.onRequest("vibgrate/score/forProject", (_m, params) => this.onScoreForProject(params));
+    this.conn.onRequest("vibgrate/architecture", (_m, params) => this.onArchitecture(params));
     this.conn.onRequest("vibgrate/score/history", (_m, params) => {
       const p = params;
       const days = typeof p?.days === "number" && p.days > 0 && p.days <= 365 ? p.days : 90;
@@ -2454,7 +2483,8 @@ var VibgrateLanguageServer = class {
       scannedAt: a.timestamp,
       ...delta !== void 0 ? { delta } : {},
       ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {},
-      ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {}
+      ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {},
+      ...buildProjectRefs(this.opts.root, a.projects ?? []) ? { projects: buildProjectRefs(this.opts.root, a.projects ?? []) } : {}
     };
     this.conn.notify("vibgrate/score", payload);
   }
@@ -2637,7 +2667,7 @@ var VibgrateLanguageServer = class {
         kevSource: "skipped"
       };
     }
-    const reachedPkgs = packageReachSet(this.graph);
+    const importMap = packageImportMap(this.graph);
     const targets = [];
     for (const proj of a.projects ?? []) {
       if (isPrunedWorkspacePath(proj.path) || isPrunedWorkspacePath(manifestRelativePath(proj))) {
@@ -2662,8 +2692,22 @@ var VibgrateLanguageServer = class {
           if (l >= 0) line = l + 1;
         }
         let reachability = "unknown";
-        if (reachedPkgs) {
-          reachability = packageReached(reachedPkgs, dep.package) ? "reached" : "not-observed";
+        let reachSites = [];
+        let reachEvidence = null;
+        if (importMap) {
+          const files = lookupImportFiles(importMap, dep.package);
+          if (files.length > 0) {
+            reachability = "reached";
+            reachSites = files.slice(0, 10).map((file) => ({
+              file,
+              // Best-effort first line that mentions the package name (import site).
+              line: firstPackageMentionLine(this.opts.root, file, dep.package)
+            }));
+            reachEvidence = `${dep.package} is imported by ${files.length} file${files.length === 1 ? "" : "s"} in the code map`;
+          } else {
+            reachability = "not-observed";
+            reachEvidence = `no import of ${dep.package} was found in the code map`;
+          }
         }
         targets.push({
           ecosystem,
@@ -2673,7 +2717,9 @@ var VibgrateLanguageServer = class {
           line,
           section: dep.section ?? null,
           latestStable: dep.latestStable ?? null,
-          reachability
+          reachability,
+          reachSites,
+          reachEvidence
         });
       }
     }
@@ -2684,7 +2730,53 @@ var VibgrateLanguageServer = class {
     const a = this.artifact;
     if (!a || !p.uri) return null;
     const project = projectForFile(this.opts.root, a, uriToPath(p.uri));
-    return project ? scoreForProject(a, project) : null;
+    return project ? scoreForProject(this.opts.root, a, project) : null;
+  }
+  /**
+   * `vibgrate/score/forProject` — monorepo scope picker. Returns the same
+   * shape as the whole-repo score, scoped to one scanned project path.
+   */
+  onScoreForProject(params) {
+    const p = params;
+    const a = this.artifact;
+    if (!a || typeof p.path !== "string") return null;
+    const project = projectByPath(a, p.path);
+    return project ? scoreForProject(this.opts.root, a, project) : null;
+  }
+  /**
+   * `vibgrate/architecture` — the Architecture panel. `path` absent or
+   * `'__repo__'` returns the whole-workspace aggregate (`extended.architecture`);
+   * a project path returns that project's own detection (`ProjectScan.architecture`).
+   * Returns `null` when the scanner hasn't produced architecture data yet (still
+   * scanning, or the archetype/layer scanner is disabled) rather than an empty
+   * shape a client might mistake for "no layers detected".
+   */
+  onArchitecture(params) {
+    const p = params;
+    const a = this.artifact;
+    if (!a) return null;
+    if (!p?.path || p.path === "__repo__") {
+      const arch = a.extended?.architecture;
+      if (!arch) return null;
+      return {
+        archetype: arch.archetype,
+        archetypeConfidence: arch.archetypeConfidence,
+        layers: arch.layers,
+        totalClassified: arch.totalClassified,
+        unclassified: arch.unclassified
+      };
+    }
+    const project = projectByPath(a, p.path);
+    if (!project?.architecture) return null;
+    return {
+      archetype: project.architecture.archetype,
+      archetypeConfidence: project.architecture.archetypeConfidence,
+      layers: project.architecture.layers,
+      totalClassified: project.architecture.totalClassified,
+      unclassified: project.architecture.unclassified,
+      manifestPath: manifestRelativePath(project),
+      lockfilePath: lockfileRelativePath(this.opts.root, project)
+    };
   }
 };
 function uriToPath(uri) {
@@ -2712,6 +2804,33 @@ function pruneArtifactProjects(a) {
   const findings = (a.findings ?? []).filter((f) => !isPrunedWorkspacePath(f.location));
   return { ...a, projects, findings };
 }
+function projectByPath(a, projectPath) {
+  const want = path37.normalize(projectPath === "" ? "." : projectPath);
+  for (const proj of a.projects ?? []) {
+    const got = path37.normalize(proj.path === "" ? "." : proj.path);
+    if (got === want) return proj;
+  }
+  return void 0;
+}
+function buildProjectRefs(rootDir, projects) {
+  if (projects.length === 0) return void 0;
+  return projects.map((p) => {
+    const rel = p.path === "" ? "." : p.path;
+    const base = rel === "." ? "." : path37.basename(rel);
+    const lockfilePath = lockfileRelativePath(rootDir, p);
+    return {
+      path: rel,
+      name: p.name || base,
+      manifestPath: manifestRelativePath(p),
+      ...lockfilePath ? { lockfilePath } : {},
+      ...p.drift ? {
+        score: p.drift.score,
+        band: p.drift.riskLevel ?? "low",
+        mode: p.drift.mode ?? "verified"
+      } : {}
+    };
+  }).sort((a, b) => a.path.localeCompare(b.path));
+}
 function projectForFile(root2, a, filePath) {
   const dir = path37.dirname(path37.resolve(filePath));
   let best;
@@ -2736,7 +2855,7 @@ function hasReleaseDates(a) {
   }
   return false;
 }
-function scoreForProject(a, proj) {
+function scoreForProject(rootDir, a, proj) {
   if (!proj.drift) return null;
   let behind = 0;
   let total = 0;
@@ -2757,10 +2876,11 @@ function scoreForProject(a, proj) {
     methodology: proj.drift.methodologyVersion ?? a.drift.methodologyVersion ?? "unknown",
     scale: "0 best, 100 worst",
     counts: { behind, eol, unmaintained, total },
-    rootPath: proj.path,
+    rootPath: proj.path === "" ? "." : proj.path,
     scannedAt: a.timestamp,
     ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {},
-    ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {}
+    ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {},
+    ...buildProjectRefs(rootDir, a.projects ?? []) ? { projects: buildProjectRefs(rootDir, a.projects ?? []) } : {}
   };
 }
 function runtimeHorizonLabel(project) {
@@ -2789,34 +2909,40 @@ function bandForScore(n) {
   if (n <= 60) return "moderate";
   return "high";
 }
-function buildBreakdown(drift, projects) {
-  const top = drift.dependencyDrift?.top;
-  if (!top || top.length === 0) return void 0;
+function buildBreakdown(_drift, projects) {
   const byPkg = /* @__PURE__ */ new Map();
   for (const p of projects) {
     const ecosystem = osvEcosystem(p.type);
-    for (const d of p.dependencies ?? []) if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+    for (const d of p.dependencies ?? []) {
+      if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+    }
   }
-  const items = top.filter((t) => t.drift > 0).map((t) => {
-    const found = byPkg.get(t.package);
-    const row = found?.row;
-    return {
-      package: t.package,
-      section: row?.section ?? "dependencies",
-      ecosystem: found?.ecosystem ?? null,
-      drift: t.drift,
-      band: bandForScore(t.drift),
-      currentSpec: row?.currentSpec ?? "",
-      resolvedVersion: row?.resolvedVersion ?? null,
-      latestStable: row?.latestStable ?? null,
-      majorsBehind: row?.majorsBehind ?? null,
-      ageDays: row?.ageDays ?? null,
-      mode: t.mode,
-      unsupported: t.unsupported,
-      abandoned: t.flags.includes("abandoned-floor"),
-      flags: t.flags
-    };
-  });
+  if (byPkg.size === 0) return void 0;
+  const items = [];
+  for (const [, { row, ecosystem }] of byPkg) {
+    const scored = perDependencyDrift(row, {
+      unsupported: row.unsupported === true,
+      abandoned: row.abandoned === true
+    });
+    if (scored.excluded) continue;
+    items.push({
+      package: row.package,
+      section: row.section ?? "dependencies",
+      ecosystem,
+      drift: scored.drift,
+      band: bandForScore(scored.drift),
+      currentSpec: row.currentSpec ?? "",
+      resolvedVersion: row.resolvedVersion ?? null,
+      latestStable: row.latestStable ?? null,
+      majorsBehind: row.majorsBehind ?? null,
+      ageDays: row.ageDays ?? null,
+      mode: scored.mode,
+      unsupported: scored.unsupported || row.unsupported === true,
+      abandoned: scored.flags.includes("abandoned-floor") || row.abandoned === true,
+      flags: scored.flags
+    });
+  }
+  items.sort((a, b) => b.drift - a.drift || a.package.localeCompare(b.package));
   return items.length > 0 ? items : void 0;
 }
 function manifestRelativePath(proj) {
@@ -2851,30 +2977,129 @@ function manifestRelativePath(proj) {
       return join27("package.json");
   }
 }
-function packageReachSet(graph) {
+function lockfileRelativePath(rootDir, proj) {
+  const base = proj.path === "." || proj.path === "" ? "" : proj.path;
+  const candidateNames = (() => {
+    switch (proj.type) {
+      case "node":
+      case "typescript":
+        return ["pnpm-lock.yaml", "yarn.lock", "package-lock.json", "bun.lockb"];
+      case "python":
+        return ["poetry.lock", "uv.lock", "Pipfile.lock"];
+      case "go":
+        return ["go.sum"];
+      case "rust":
+        return ["Cargo.lock"];
+      case "ruby":
+        return ["Gemfile.lock"];
+      case "php":
+        return ["composer.lock"];
+      case "dotnet":
+        return ["packages.lock.json"];
+      case "dart":
+        return ["pubspec.lock"];
+      default:
+        return [];
+    }
+  })();
+  const dirsToTry = base ? [base, ""] : [""];
+  for (const dir of dirsToTry) {
+    for (const name of candidateNames) {
+      const rel = dir ? path37.join(dir, name) : name;
+      try {
+        if (fs7.existsSync(path37.join(rootDir, rel))) return rel;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function packageImportMap(graph) {
   if (!graph?.nodes?.length) return null;
-  const set = /* @__PURE__ */ new Set();
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const map = /* @__PURE__ */ new Map();
+  const addPkg = (raw, file) => {
+    if (!file) return;
+    const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/");
+    const keys = /* @__PURE__ */ new Set();
+    keys.add(cleaned.toLowerCase());
+    if (cleaned.startsWith("@")) {
+      const parts = cleaned.split("/");
+      if (parts.length >= 2) keys.add(`${parts[0]}/${parts[1]}`.toLowerCase());
+    } else {
+      keys.add(cleaned.split("/")[0].toLowerCase());
+    }
+    for (const k of keys) {
+      let set = map.get(k);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        map.set(k, set);
+      }
+      set.add(file);
+    }
+  };
+  for (const e of graph.edges ?? []) {
+    if (e.kind !== "import") continue;
+    const src = byId.get(e.src);
+    const dst = byId.get(e.dst);
+    if (!src?.file || !dst) continue;
+    if (dst.kind !== "external" && dst.kind !== "package" && dst.kind !== "module") continue;
+    for (const raw of [dst.name, dst.qualifiedName].filter(Boolean)) {
+      addPkg(raw, src.file);
+    }
+  }
   for (const n of graph.nodes) {
     if (n.kind !== "external" && n.kind !== "package" && n.kind !== "module") continue;
-    const names = [n.name, n.qualifiedName].filter(Boolean);
-    for (const raw of names) {
-      const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/");
+    for (const raw of [n.name, n.qualifiedName].filter(Boolean)) {
+      const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/").toLowerCase();
+      if (!map.has(cleaned)) map.set(cleaned, /* @__PURE__ */ new Set());
       if (cleaned.startsWith("@")) {
         const parts = cleaned.split("/");
-        if (parts.length >= 2) set.add(`${parts[0]}/${parts[1]}`.toLowerCase());
-      } else {
-        set.add(cleaned.split("/")[0].toLowerCase());
+        if (parts.length >= 2 && !map.has(`${parts[0]}/${parts[1]}`)) {
+          map.set(`${parts[0]}/${parts[1]}`, /* @__PURE__ */ new Set());
+        }
       }
-      set.add(cleaned.toLowerCase());
     }
   }
-  return set;
+  const out2 = /* @__PURE__ */ new Map();
+  for (const [k, files] of map) {
+    out2.set(k, [...files].sort());
+  }
+  return out2;
 }
-function packageReached(set, pkg) {
+function lookupImportFiles(map, pkg) {
   const p = pkg.toLowerCase();
-  if (set.has(p)) return true;
-  if (!p.startsWith("@") && set.has(p.split("/")[0])) return true;
-  return false;
+  if (map.has(p)) return map.get(p);
+  if (!p.startsWith("@")) {
+    const root2 = p.split("/")[0];
+    if (map.has(root2)) return map.get(root2);
+  }
+  return [];
+}
+function firstPackageMentionLine(root2, relFile, pkg) {
+  try {
+    const abs = path37.resolve(root2, relFile);
+    const stat2 = fs7.statSync(abs);
+    if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
+    const text = fs7.readFileSync(abs, "utf8");
+    const tokens = [pkg];
+    if (pkg.startsWith("@")) {
+      const parts = pkg.split("/");
+      if (parts[1]) tokens.push(parts[1]);
+    } else if (pkg.includes("/")) {
+      tokens.push(pkg.split("/")[0]);
+    }
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!/import|require|from|use |include/.test(line) && !line.includes(pkg)) continue;
+      for (const t of tokens) {
+        if (t && line.includes(t)) return i + 1;
+      }
+    }
+  } catch {
+  }
+  return null;
 }
 function osvEcosystem(type) {
   switch (type) {
@@ -6064,7 +6289,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-YPSEDYIW.js');
+        const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6148,7 +6373,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-NJG6467J.js');
+      const { runInteractive } = await import('./interactive-V6IRYZTA.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6229,7 +6454,7 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-5FQWHWYK.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-TZ53G67B.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
         const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3YOPU3LF.js');
         const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
@@ -6238,11 +6463,11 @@ function registerCode(program) {
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y4ZD3QDO.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-DH7AHQ23.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6300,7 +6525,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PZFGTZSA.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6536,7 +6761,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-NJG6467J.js');
+      const { agentTask } = await import('./interactive-V6IRYZTA.js');
       const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6546,7 +6771,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PZFGTZSA.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6570,11 +6795,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-Y4ZD3QDO.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-DH7AHQ23.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7464,7 +7689,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-YPSEDYIW.js');
+      const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -7869,7 +8094,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-V6MYDEMS.js');
+    const { runBaseline } = await import('./baseline-4FBHW2X2.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7971,11 +8196,42 @@ function collectPackageImports(graph, ecosystem, pkg) {
     importingFiles: [...files].sort()
   };
 }
-async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
+async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
   const content = await readFile3(path37.join(rootDir, relFile));
-  if (!content) return false;
+  if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`\\b${escaped}\\b`).test(content);
+  const re = new RegExp(`\\b${escaped}\\b`);
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    if (re.test(lines[i])) return i + 1;
+  }
+  return null;
+}
+function formatSitePath(site) {
+  return site.line != null && site.line > 0 ? `${site.file}:${site.line}` : site.file;
+}
+function enclosingFunctionName(graph, relFile, line) {
+  if (line == null || line < 1) return null;
+  let best = null;
+  let bestSpan = Number.POSITIVE_INFINITY;
+  for (const node2 of graph.nodes) {
+    if (node2.file !== relFile) continue;
+    if (node2.kind !== "function" && node2.kind !== "method") continue;
+    const start = node2.span?.start;
+    const end = node2.span?.end;
+    if (start == null || end == null) continue;
+    if (line < start || line > end) continue;
+    const span = end - start;
+    if (span < bestSpan) {
+      bestSpan = span;
+      best = node2;
+    }
+  }
+  return best?.name ?? null;
+}
+function sitesFromImportFiles(files, limit = 10) {
+  const sites = files.slice(0, limit).map((file) => ({ file }));
+  return { callPath: sites.map(formatSitePath), sites };
 }
 async function defaultReadFile(absPath) {
   try {
@@ -8058,6 +8314,7 @@ async function analyzeReachability(input) {
     }
     const matchableSymbols = entry.symbols.map((s) => ({ symbol: s.symbol, identifier: symbolIdentifier(s.symbol) })).filter((s) => isMatchableIdentifier(s.identifier));
     if (entry.symbolCoverage !== "function" || matchableSymbols.length === 0) {
+      const { callPath, sites } = sitesFromImportFiles(evidence.importingFiles, 10);
       findings.push({
         advisoryId: entry.advisoryId,
         ecosystem: entry.ecosystem,
@@ -8065,7 +8322,8 @@ async function analyzeReachability(input) {
         version: entry.version,
         tier: "potentially_reachable",
         evidence: `${entry.package} is imported by ${evidence.importingFiles.length} file${evidence.importingFiles.length === 1 ? "" : "s"}; vulnerable symbols unresolved (coverage: ${entry.symbolCoverage})`,
-        callPath: evidence.importingFiles.slice(0, 10),
+        callPath,
+        sites,
         graphConfidence: Math.min(baseConfidence, 0.6)
       });
       continue;
@@ -8073,14 +8331,19 @@ async function analyzeReachability(input) {
     const filesToCheck = evidence.importingFiles.slice(0, MAX_FILES_PER_PACKAGE);
     let anySymbolFound = false;
     for (const { symbol, identifier } of matchableSymbols) {
-      const referencingFiles = [];
+      const sites = [];
       for (const relFile of filesToCheck) {
-        if (await fileReferencesIdentifier(input.rootDir, relFile, identifier, readFile3)) {
-          referencingFiles.push(relFile);
-          if (referencingFiles.length >= 5) break;
-        }
+        const line = await firstReferenceLine(input.rootDir, relFile, identifier, readFile3);
+        if (line == null) continue;
+        sites.push({
+          file: relFile,
+          line,
+          symbol,
+          function: enclosingFunctionName(input.graph, relFile, line)
+        });
+        if (sites.length >= 5) break;
       }
-      if (referencingFiles.length > 0) {
+      if (sites.length > 0) {
         anySymbolFound = true;
         findings.push({
           advisoryId: entry.advisoryId,
@@ -8089,13 +8352,15 @@ async function analyzeReachability(input) {
           version: entry.version,
           symbol,
           tier: "reachable",
-          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${referencingFiles.length} importing file${referencingFiles.length === 1 ? "" : "s"}`,
-          callPath: referencingFiles,
+          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${sites.length} importing file${sites.length === 1 ? "" : "s"}`,
+          callPath: sites.map(formatSitePath),
+          sites,
           graphConfidence: Math.min(baseConfidence, 0.75)
         });
       }
     }
     if (!anySymbolFound) {
+      const { callPath, sites } = sitesFromImportFiles(evidence.importingFiles, 10);
       findings.push({
         advisoryId: entry.advisoryId,
         ecosystem: entry.ecosystem,
@@ -8103,7 +8368,8 @@ async function analyzeReachability(input) {
         version: entry.version,
         tier: "not_reached",
         evidence: `${entry.package} is imported, but none of its ${matchableSymbols.length} vulnerable symbol${matchableSymbols.length === 1 ? "" : "s"} is referenced in the ${filesToCheck.length} importing file${filesToCheck.length === 1 ? "" : "s"} checked`,
-        callPath: evidence.importingFiles.slice(0, 10),
+        callPath,
+        sites,
         graphConfidence: Math.min(baseConfidence, 0.55)
       });
     }