@vibgrate/cli 2026.730.2 → 2026.731.2

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-ZW5W627G.js';
-export { runBuild } from './chunk-ZW5W627G.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-LCQILWQL.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-UPH2RJ7L.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-FF5ZQ6KI.js';
+import { fetchCatalog, resolveProviders } from './chunk-4TC6RJ7U.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EX2SH5CT.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-TNCD5VFX.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { runCodeSession } from './chunk-WBMMRERH.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-5J45MN3K.js';
+export { runBuild } from './chunk-5J45MN3K.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-NSK25UT2.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -15,7 +16,7 @@ import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-EVLS2M5G.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-X634FZVG.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-KGWEBM2J.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-Q7HUXIUF.js';
 import './chunk-543E6WDJ.js';
 import { summarizeDiffs, ScriptedProvider } from './chunk-MYM5VIJ4.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
@@ -23,15 +24,16 @@ import './chunk-RGEVBSLK.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import './chunk-7AVYKZEM.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WHXVU23K.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-A5LF4VS4.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RV5DTGYT.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-LZX5NH4V.js';
+import { refreshIfStale } from './chunk-L6BRBFBP.js';
+import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-Y44GPOBL.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RIWLXMMT.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-XRN7DQGR.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-CPX7XP3O.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-FHJBGPJZ.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-EETK7S43.js';
@@ -39,14 +41,14 @@ import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { loadGraph, SCHEMA_VERSION } from './chunk-HWN4P64B.js';
-import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-PHVVVOW7.js';
-import { VERSION } from './chunk-BZPZ3OM6.js';
+import { loadGraph, SCHEMA_VERSION } from './chunk-IZNOMGR6.js';
+import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-QWOJO32H.js';
+import { VERSION } from './chunk-NNB2H4BA.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
-import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-IDAQV3NQ.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIVRI.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs7 from 'fs';
 import fs7__default, { realpathSync } from 'fs';
@@ -1707,7 +1709,7 @@ function manifestHash(root2) {
     for (const entry of entries) {
       const abs = path37.join(dir, entry.name);
       if (entry.isDirectory()) {
-        if (SKIP_DIRS.has(entry.name)) continue;
+        if (isSkippedDirName(entry.name)) continue;
         walk2(abs);
         continue;
       }
@@ -1729,7 +1731,7 @@ function isDependencyFile(root2, filePath) {
   const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
   if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
   const parts = rel.split(path37.sep);
-  if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
+  if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
 }
@@ -2009,6 +2011,30 @@ function runTree(graph, params) {
 }
 
 // src/lsp/enrich.ts
+var REACH_RANK = {
+  reached: 3,
+  potentially_reachable: 2,
+  unknown: 1,
+  "not-observed": 0
+};
+function mergeReachability(a, b) {
+  const left = a ?? "unknown";
+  const right = b ?? "unknown";
+  return REACH_RANK[right] > REACH_RANK[left] ? right : left;
+}
+function mergeReachSites(a, b) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const site of [...a ?? [], ...b ?? []]) {
+    if (!site?.file) continue;
+    const k = `${site.file}::${site.line ?? ""}::${site.symbol ?? ""}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out2.push(site);
+    if (out2.length >= 10) break;
+  }
+  return out2;
+}
 var OSV_QUERY_URL = "https://api.osv.dev/v1/query";
 var KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
 var cache = /* @__PURE__ */ new Map();
@@ -2171,10 +2197,11 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
         existing.locations.push(loc);
       }
     }
-    if (t.reachability === "reached") existing.reachability = "reached";
-    else if (t.reachability === "not-observed" && existing.reachability === "unknown") {
-      existing.reachability = "not-observed";
+    existing.reachability = mergeReachability(existing.reachability, t.reachability);
+    if (t.reachSites?.length) {
+      existing.reachSites = mergeReachSites(existing.reachSites, t.reachSites);
     }
+    if (!existing.reachEvidence && t.reachEvidence) existing.reachEvidence = t.reachEvidence;
     if (!existing.latestStable && t.latestStable) existing.latestStable = t.latestStable;
     if (!existing.section && t.section) existing.section = t.section;
   }
@@ -2195,10 +2222,14 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
       else if (r.source === "error") anyError = true;
       const locations = t.locations.length ? t.locations : t.file ? [{ file: t.file, line: t.line ?? null }] : [];
       const seenIds = /* @__PURE__ */ new Set();
+      const seenCves = /* @__PURE__ */ new Set();
       for (const v of r.vulns) {
         if (seenIds.has(v.id)) continue;
+        const cveKeys = (v.cves ?? []).map((c2) => c2.toUpperCase()).filter(Boolean);
+        if (cveKeys.length && cveKeys.every((c2) => seenCves.has(c2))) continue;
         seenIds.add(v.id);
-        const kevHit = v.cves.some((c2) => kev.cves.has(c2.toUpperCase()));
+        for (const c2 of cveKeys) seenCves.add(c2);
+        const kevHit = cveKeys.some((c2) => kev.cves.has(c2));
         findings.push({
           package: t.package,
           version: t.version,
@@ -2211,6 +2242,8 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
           published: v.published,
           kev: kevHit,
           reachability: t.reachability ?? "unknown",
+          reachSites: t.reachSites ?? [],
+          reachEvidence: t.reachEvidence ?? null,
           file: locations[0]?.file ?? t.file ?? null,
           line: locations[0]?.line ?? t.line ?? null,
           locations,
@@ -2335,6 +2368,7 @@ var VibgrateLanguageServer = class {
     this.conn.onRequest("vibgrate/graph/query", (_m, params) => this.onGraphQuery(params));
     this.conn.onRequest("vibgrate/score/forFile", (_m, params) => this.onScoreForFile(params));
     this.conn.onRequest("vibgrate/score/forProject", (_m, params) => this.onScoreForProject(params));
+    this.conn.onRequest("vibgrate/architecture", (_m, params) => this.onArchitecture(params));
     this.conn.onRequest("vibgrate/score/history", (_m, params) => {
       const p = params;
       const days = typeof p?.days === "number" && p.days > 0 && p.days <= 365 ? p.days : 90;
@@ -2454,9 +2488,9 @@ var VibgrateLanguageServer = class {
       rootPath: a.rootPath,
       scannedAt: a.timestamp,
       ...delta !== void 0 ? { delta } : {},
-      ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {},
+      ...buildBreakdown(this.opts.root, a.projects ?? []) ? { breakdown: buildBreakdown(this.opts.root, a.projects ?? []) } : {},
       ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {},
-      ...buildProjectRefs(a.projects ?? []) ? { projects: buildProjectRefs(a.projects ?? []) } : {}
+      ...buildProjectRefs(this.opts.root, a.projects ?? []) ? { projects: buildProjectRefs(this.opts.root, a.projects ?? []) } : {}
     };
     this.conn.notify("vibgrate/score", payload);
   }
@@ -2639,7 +2673,7 @@ var VibgrateLanguageServer = class {
         kevSource: "skipped"
       };
     }
-    const reachedPkgs = packageReachSet(this.graph);
+    const importMap = packageImportMap(this.graph);
     const targets = [];
     for (const proj of a.projects ?? []) {
       if (isPrunedWorkspacePath(proj.path) || isPrunedWorkspacePath(manifestRelativePath(proj))) {
@@ -2664,8 +2698,22 @@ var VibgrateLanguageServer = class {
           if (l >= 0) line = l + 1;
         }
         let reachability = "unknown";
-        if (reachedPkgs) {
-          reachability = packageReached(reachedPkgs, dep.package) ? "reached" : "not-observed";
+        let reachSites = [];
+        let reachEvidence = null;
+        if (importMap) {
+          const files = lookupImportFiles(importMap, dep.package);
+          if (files.length > 0) {
+            reachability = "reached";
+            reachSites = files.slice(0, 10).map((file) => ({
+              file,
+              // Best-effort first line that mentions the package name (import site).
+              line: firstPackageMentionLine(this.opts.root, file, dep.package)
+            }));
+            reachEvidence = `${dep.package} is imported by ${files.length} file${files.length === 1 ? "" : "s"} in the code map`;
+          } else {
+            reachability = "not-observed";
+            reachEvidence = `no import of ${dep.package} was found in the code map`;
+          }
         }
         targets.push({
           ecosystem,
@@ -2675,7 +2723,9 @@ var VibgrateLanguageServer = class {
           line,
           section: dep.section ?? null,
           latestStable: dep.latestStable ?? null,
-          reachability
+          reachability,
+          reachSites,
+          reachEvidence
         });
       }
     }
@@ -2686,7 +2736,7 @@ var VibgrateLanguageServer = class {
     const a = this.artifact;
     if (!a || !p.uri) return null;
     const project = projectForFile(this.opts.root, a, uriToPath(p.uri));
-    return project ? scoreForProject(a, project) : null;
+    return project ? scoreForProject(this.opts.root, a, project) : null;
   }
   /**
    * `vibgrate/score/forProject` — monorepo scope picker. Returns the same
@@ -2697,7 +2747,42 @@ var VibgrateLanguageServer = class {
     const a = this.artifact;
     if (!a || typeof p.path !== "string") return null;
     const project = projectByPath(a, p.path);
-    return project ? scoreForProject(a, project) : null;
+    return project ? scoreForProject(this.opts.root, a, project) : null;
+  }
+  /**
+   * `vibgrate/architecture` — the Architecture panel. `path` absent or
+   * `'__repo__'` returns the whole-workspace aggregate (`extended.architecture`);
+   * a project path returns that project's own detection (`ProjectScan.architecture`).
+   * Returns `null` when the scanner hasn't produced architecture data yet (still
+   * scanning, or the archetype/layer scanner is disabled) rather than an empty
+   * shape a client might mistake for "no layers detected".
+   */
+  onArchitecture(params) {
+    const p = params;
+    const a = this.artifact;
+    if (!a) return null;
+    if (!p?.path || p.path === "__repo__") {
+      const arch = a.extended?.architecture;
+      if (!arch) return null;
+      return {
+        archetype: arch.archetype,
+        archetypeConfidence: arch.archetypeConfidence,
+        layers: arch.layers,
+        totalClassified: arch.totalClassified,
+        unclassified: arch.unclassified
+      };
+    }
+    const project = projectByPath(a, p.path);
+    if (!project?.architecture) return null;
+    return {
+      archetype: project.architecture.archetype,
+      archetypeConfidence: project.architecture.archetypeConfidence,
+      layers: project.architecture.layers,
+      totalClassified: project.architecture.totalClassified,
+      unclassified: project.architecture.unclassified,
+      manifestPath: manifestRelativePath(project),
+      lockfilePath: lockfileRelativePath(this.opts.root, project)
+    };
   }
 };
 function uriToPath(uri) {
@@ -2711,7 +2796,11 @@ function isPrunedWorkspacePath(relPath) {
   if (!relPath || relPath === "." || relPath === "") return false;
   const parts = relPath.split(/[/\\]/).filter(Boolean);
   if (parts.includes(".claude")) return true;
-  return parts.some((p) => SKIP_DIRS.has(p));
+  return parts.some((p) => {
+    if (SKIP_DIRS.has(p)) return true;
+    if (p.startsWith(".venv") || p.startsWith("venv-") || p === "site-packages") return true;
+    return false;
+  });
 }
 function pruneArtifactProjects(a) {
   const projects = (a.projects ?? []).filter(
@@ -2733,14 +2822,83 @@ function projectByPath(a, projectPath) {
   }
   return void 0;
 }
-function buildProjectRefs(projects) {
+function projectHasLocalLockOrCsproj(rootDir, proj) {
+  const base = proj.path === "." || proj.path === "" ? "" : proj.path;
+  const dirAbs = base ? path37.join(rootDir, base) : rootDir;
+  const lockNames = (() => {
+    switch (proj.type) {
+      case "node":
+      case "typescript":
+        return ["pnpm-lock.yaml", "yarn.lock", "package-lock.json", "bun.lockb", "bun.lock"];
+      case "python":
+        return ["poetry.lock", "uv.lock", "Pipfile.lock"];
+      case "go":
+        return ["go.sum"];
+      case "rust":
+        return ["Cargo.lock"];
+      case "ruby":
+        return ["Gemfile.lock"];
+      case "php":
+        return ["composer.lock"];
+      case "dotnet":
+        return ["packages.lock.json"];
+      case "dart":
+        return ["pubspec.lock"];
+      case "java":
+      case "kotlin":
+      case "scala":
+      case "groovy":
+        return ["gradle.lockfile"];
+      default:
+        return [
+          "pnpm-lock.yaml",
+          "yarn.lock",
+          "package-lock.json",
+          "bun.lockb",
+          "poetry.lock",
+          "uv.lock",
+          "Cargo.lock",
+          "go.sum",
+          "Gemfile.lock",
+          "composer.lock",
+          "packages.lock.json",
+          "pubspec.lock"
+        ];
+    }
+  })();
+  for (const name of lockNames) {
+    try {
+      if (fs7.existsSync(path37.join(dirAbs, name))) return true;
+    } catch {
+    }
+  }
+  try {
+    if (fs7.existsSync(dirAbs)) {
+      const entries = fs7.readdirSync(dirAbs);
+      if (entries.some((e) => /\.(csproj|fsproj|vbproj)$/i.test(e))) return true;
+    }
+  } catch {
+  }
+  const manifest = manifestRelativePath(proj);
+  if (/\.(csproj|fsproj|vbproj)$/i.test(manifest)) {
+    try {
+      if (fs7.existsSync(path37.join(rootDir, manifest))) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function buildProjectRefs(rootDir, projects) {
   if (projects.length === 0) return void 0;
-  return projects.map((p) => {
+  const refs = projects.filter((p) => projectHasLocalLockOrCsproj(rootDir, p)).map((p) => {
     const rel = p.path === "" ? "." : p.path;
-    const base = rel === "." ? "." : path37.basename(rel);
+    const base = rel === "." || rel === "" ? "root" : path37.basename(rel);
+    const lockfilePath = lockfileRelativePath(rootDir, p);
     return {
       path: rel,
-      name: p.name || base,
+      name: base,
+      manifestPath: manifestRelativePath(p),
+      ...lockfilePath ? { lockfilePath } : {},
       ...p.drift ? {
         score: p.drift.score,
         band: p.drift.riskLevel ?? "low",
@@ -2748,6 +2906,7 @@ function buildProjectRefs(projects) {
       } : {}
     };
   }).sort((a, b) => a.path.localeCompare(b.path));
+  return refs.length > 0 ? refs : void 0;
 }
 function projectForFile(root2, a, filePath) {
   const dir = path37.dirname(path37.resolve(filePath));
@@ -2773,7 +2932,7 @@ function hasReleaseDates(a) {
   }
   return false;
 }
-function scoreForProject(a, proj) {
+function scoreForProject(rootDir, a, proj) {
   if (!proj.drift) return null;
   let behind = 0;
   let total = 0;
@@ -2796,9 +2955,9 @@ function scoreForProject(a, proj) {
     counts: { behind, eol, unmaintained, total },
     rootPath: proj.path === "" ? "." : proj.path,
     scannedAt: a.timestamp,
-    ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {},
+    ...buildBreakdown(rootDir, [proj]) ? { breakdown: buildBreakdown(rootDir, [proj]) } : {},
     ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {},
-    ...buildProjectRefs(a.projects ?? []) ? { projects: buildProjectRefs(a.projects ?? []) } : {}
+    ...buildProjectRefs(rootDir, a.projects ?? []) ? { projects: buildProjectRefs(rootDir, a.projects ?? []) } : {}
   };
 }
 function runtimeHorizonLabel(project) {
@@ -2827,17 +2986,52 @@ function bandForScore(n) {
   if (n <= 60) return "moderate";
   return "high";
 }
-function buildBreakdown(_drift, projects) {
+function buildBreakdown(rootDir, projects) {
   const byPkg = /* @__PURE__ */ new Map();
   for (const p of projects) {
+    const relManifest = manifestRelativePath(p);
+    if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
+    const absManifest = path37.resolve(rootDir, relManifest);
+    let text = null;
+    try {
+      if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
+    } catch {
+      text = null;
+    }
+    const kind = manifestKind(absManifest);
     for (const d of p.dependencies ?? []) {
-      if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+      let line = null;
+      if (text && kind !== "unknown") {
+        const l = findPackageLine(text, d.package, kind);
+        if (l >= 0) line = l + 1;
+      }
+      const loc = { file: relManifest, line };
+      const existing = byPkg.get(d.package);
+      if (!existing) {
+        byPkg.set(d.package, { row: d, ecosystem, locations: [loc] });
+        continue;
+      }
+      if (!existing.locations.some((x) => x.file === loc.file && x.line === loc.line)) {
+        existing.locations.push(loc);
+      }
+      const prev = perDependencyDrift(existing.row, {
+        unsupported: existing.row.unsupported === true,
+        abandoned: existing.row.abandoned === true
+      });
+      const next2 = perDependencyDrift(d, {
+        unsupported: d.unsupported === true,
+        abandoned: d.abandoned === true
+      });
+      if (!next2.excluded && (prev.excluded || next2.drift > prev.drift)) {
+        existing.row = d;
+        if (ecosystem) existing.ecosystem = ecosystem;
+      }
     }
   }
   if (byPkg.size === 0) return void 0;
   const items = [];
-  for (const [, { row, ecosystem }] of byPkg) {
+  for (const [, { row, ecosystem, locations }] of byPkg) {
     const scored = perDependencyDrift(row, {
       unsupported: row.unsupported === true,
       abandoned: row.abandoned === true
@@ -2857,7 +3051,8 @@ function buildBreakdown(_drift, projects) {
       mode: scored.mode,
       unsupported: scored.unsupported || row.unsupported === true,
       abandoned: scored.flags.includes("abandoned-floor") || row.abandoned === true,
-      flags: scored.flags
+      flags: scored.flags,
+      locations
     });
   }
   items.sort((a, b) => b.drift - a.drift || a.package.localeCompare(b.package));
@@ -2895,30 +3090,129 @@ function manifestRelativePath(proj) {
       return join27("package.json");
   }
 }
-function packageReachSet(graph) {
+function lockfileRelativePath(rootDir, proj) {
+  const base = proj.path === "." || proj.path === "" ? "" : proj.path;
+  const candidateNames = (() => {
+    switch (proj.type) {
+      case "node":
+      case "typescript":
+        return ["pnpm-lock.yaml", "yarn.lock", "package-lock.json", "bun.lockb"];
+      case "python":
+        return ["poetry.lock", "uv.lock", "Pipfile.lock"];
+      case "go":
+        return ["go.sum"];
+      case "rust":
+        return ["Cargo.lock"];
+      case "ruby":
+        return ["Gemfile.lock"];
+      case "php":
+        return ["composer.lock"];
+      case "dotnet":
+        return ["packages.lock.json"];
+      case "dart":
+        return ["pubspec.lock"];
+      default:
+        return [];
+    }
+  })();
+  const dirsToTry = base ? [base, ""] : [""];
+  for (const dir of dirsToTry) {
+    for (const name of candidateNames) {
+      const rel = dir ? path37.join(dir, name) : name;
+      try {
+        if (fs7.existsSync(path37.join(rootDir, rel))) return rel;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function packageImportMap(graph) {
   if (!graph?.nodes?.length) return null;
-  const set = /* @__PURE__ */ new Set();
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const map = /* @__PURE__ */ new Map();
+  const addPkg = (raw, file) => {
+    if (!file) return;
+    const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/");
+    const keys = /* @__PURE__ */ new Set();
+    keys.add(cleaned.toLowerCase());
+    if (cleaned.startsWith("@")) {
+      const parts = cleaned.split("/");
+      if (parts.length >= 2) keys.add(`${parts[0]}/${parts[1]}`.toLowerCase());
+    } else {
+      keys.add(cleaned.split("/")[0].toLowerCase());
+    }
+    for (const k of keys) {
+      let set = map.get(k);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        map.set(k, set);
+      }
+      set.add(file);
+    }
+  };
+  for (const e of graph.edges ?? []) {
+    if (e.kind !== "import") continue;
+    const src = byId.get(e.src);
+    const dst = byId.get(e.dst);
+    if (!src?.file || !dst) continue;
+    if (dst.kind !== "external" && dst.kind !== "package" && dst.kind !== "module") continue;
+    for (const raw of [dst.name, dst.qualifiedName].filter(Boolean)) {
+      addPkg(raw, src.file);
+    }
+  }
   for (const n of graph.nodes) {
     if (n.kind !== "external" && n.kind !== "package" && n.kind !== "module") continue;
-    const names = [n.name, n.qualifiedName].filter(Boolean);
-    for (const raw of names) {
-      const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/");
+    for (const raw of [n.name, n.qualifiedName].filter(Boolean)) {
+      const cleaned = raw.replace(/^node_modules\//, "").replace(/\\/g, "/").toLowerCase();
+      if (!map.has(cleaned)) map.set(cleaned, /* @__PURE__ */ new Set());
       if (cleaned.startsWith("@")) {
         const parts = cleaned.split("/");
-        if (parts.length >= 2) set.add(`${parts[0]}/${parts[1]}`.toLowerCase());
-      } else {
-        set.add(cleaned.split("/")[0].toLowerCase());
+        if (parts.length >= 2 && !map.has(`${parts[0]}/${parts[1]}`)) {
+          map.set(`${parts[0]}/${parts[1]}`, /* @__PURE__ */ new Set());
+        }
       }
-      set.add(cleaned.toLowerCase());
     }
   }
-  return set;
+  const out2 = /* @__PURE__ */ new Map();
+  for (const [k, files] of map) {
+    out2.set(k, [...files].sort());
+  }
+  return out2;
 }
-function packageReached(set, pkg) {
+function lookupImportFiles(map, pkg) {
   const p = pkg.toLowerCase();
-  if (set.has(p)) return true;
-  if (!p.startsWith("@") && set.has(p.split("/")[0])) return true;
-  return false;
+  if (map.has(p)) return map.get(p);
+  if (!p.startsWith("@")) {
+    const root2 = p.split("/")[0];
+    if (map.has(root2)) return map.get(root2);
+  }
+  return [];
+}
+function firstPackageMentionLine(root2, relFile, pkg) {
+  try {
+    const abs = path37.resolve(root2, relFile);
+    const stat2 = fs7.statSync(abs);
+    if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
+    const text = fs7.readFileSync(abs, "utf8");
+    const tokens = [pkg];
+    if (pkg.startsWith("@")) {
+      const parts = pkg.split("/");
+      if (parts[1]) tokens.push(parts[1]);
+    } else if (pkg.includes("/")) {
+      tokens.push(pkg.split("/")[0]);
+    }
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!/import|require|from|use |include/.test(line) && !line.includes(pkg)) continue;
+      for (const t of tokens) {
+        if (t && line.includes(t)) return i + 1;
+      }
+    }
+  } catch {
+  }
+  return null;
 }
 function osvEcosystem(type) {
   switch (type) {
@@ -3044,7 +3338,7 @@ function hoverMarkdown(dep, contribution) {
       majorsBehind: dep.majorsBehind ?? 0
     });
     const explainUri = commandUri("vibgrate.explain", { package: dep.package });
-    lines.push(`[Route this fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
+    lines.push(`[Fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
   }
   lines.push("");
   lines.push("---");
@@ -3117,12 +3411,24 @@ function registerInstall(program) {
         return;
       }
       if (global.json) {
-        json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
+        json(
+          ASSISTANTS.map((a) => ({
+            id: a.id,
+            label: a.label,
+            mcp: !!a.mcp,
+            skill: !!a.skill,
+            nudge: !!a.nudge,
+            installed: isAssistantInstalled(a, root2)
+          }))
+        );
       } else {
         info(`${c.cyan("vg install")} \xB7 supported assistants`);
         const pad4 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
         for (const a of ASSISTANTS) {
-          info(`  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
+          const on = isAssistantInstalled(a, root2) ? c.green("on") : c.dim("off");
+          info(
+            `  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${on}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`
+          );
         }
       }
       return;
@@ -6108,7 +6414,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-RFQFTTIT.js');
+        const { loadGraph: loadGraph2 } = await import('./load-A5BGEQWP.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6192,7 +6498,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-MR7DTVYS.js');
+      const { runInteractive } = await import('./interactive-2TAYVEHE.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6221,6 +6527,40 @@ function registerCode(program) {
       return;
     }
     if (!instruction) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
+    {
+      const { ensureCodeMap } = await import('./ensure-map-C3NEC2GI.js');
+      const mapRoot = rootOf(global);
+      try {
+        await ensureCodeMap(mapRoot, global, {
+          onProgress: (p) => {
+            if (opts.streamJson) {
+              process.stdout.write(
+                JSON.stringify({
+                  event: "event",
+                  type: "map_build",
+                  phase: p.phase,
+                  message: p.message,
+                  ...p.pct != null ? { pct: p.pct } : {}
+                }) + "\n"
+              );
+              return;
+            }
+            if (!global.json && !global.quiet && (p.phase === "start" || p.phase === "done")) {
+              info(c.dim(`vg code \xB7 ${p.message}`));
+            }
+          }
+        });
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (opts.streamJson) {
+          process.stdout.write(
+            JSON.stringify({ event: "error", message: `Could not build the code map: ${msg}` }) + "\n"
+          );
+          return;
+        }
+        throw e;
+      }
+    }
     const { root: root2, graph } = requireGraph(global);
     let mockReply;
     if (opts.mock) {
@@ -6273,20 +6613,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-EKB6YQIK.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-OSIVMVT7.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3YOPU3LF.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-CFKBL3MR.js');
         const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
         const readline5 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-23RZLEA4.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-UPTC3E6N.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-VIPBL7W4.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-HNPOSXKZ.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6344,7 +6684,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-UZFHPP2Q.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-JHRKJBVT.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6431,8 +6771,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession } = await import('./stream-json-3YOPU3LF.js');
-            const { runAgent: runAgent2 } = await import('./agent-33BMKWJC.js');
+            const { runCodeStreamJsonSession } = await import('./stream-json-CFKBL3MR.js');
+            const { runAgent: runAgent2 } = await import('./agent-6PPW5GIV.js');
             const {
               loadLatestSession,
               newSession,
@@ -6580,7 +6920,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-MR7DTVYS.js');
+      const { agentTask } = await import('./interactive-2TAYVEHE.js');
       const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6590,7 +6930,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-UZFHPP2Q.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-JHRKJBVT.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6614,11 +6954,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-23RZLEA4.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-UPTC3E6N.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-VIPBL7W4.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-HNPOSXKZ.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7508,7 +7848,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-RFQFTTIT.js');
+      const { loadGraph: loadGraph2 } = await import('./load-A5BGEQWP.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -7913,7 +8253,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-536TQZIB.js');
+    const { runBaseline } = await import('./baseline-ZMHL6DXF.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8015,11 +8355,42 @@ function collectPackageImports(graph, ecosystem, pkg) {
     importingFiles: [...files].sort()
   };
 }
-async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
+async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
   const content = await readFile3(path37.join(rootDir, relFile));
-  if (!content) return false;
+  if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`\\b${escaped}\\b`).test(content);
+  const re = new RegExp(`\\b${escaped}\\b`);
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    if (re.test(lines[i])) return i + 1;
+  }
+  return null;
+}
+function formatSitePath(site) {
+  return site.line != null && site.line > 0 ? `${site.file}:${site.line}` : site.file;
+}
+function enclosingFunctionName(graph, relFile, line) {
+  if (line == null || line < 1) return null;
+  let best = null;
+  let bestSpan = Number.POSITIVE_INFINITY;
+  for (const node2 of graph.nodes) {
+    if (node2.file !== relFile) continue;
+    if (node2.kind !== "function" && node2.kind !== "method") continue;
+    const start = node2.span?.start;
+    const end = node2.span?.end;
+    if (start == null || end == null) continue;
+    if (line < start || line > end) continue;
+    const span = end - start;
+    if (span < bestSpan) {
+      bestSpan = span;
+      best = node2;
+    }
+  }
+  return best?.name ?? null;
+}
+function sitesFromImportFiles(files, limit = 10) {
+  const sites = files.slice(0, limit).map((file) => ({ file }));
+  return { callPath: sites.map(formatSitePath), sites };
 }
 async function defaultReadFile(absPath) {
   try {
@@ -8102,6 +8473,7 @@ async function analyzeReachability(input) {
     }
     const matchableSymbols = entry.symbols.map((s) => ({ symbol: s.symbol, identifier: symbolIdentifier(s.symbol) })).filter((s) => isMatchableIdentifier(s.identifier));
     if (entry.symbolCoverage !== "function" || matchableSymbols.length === 0) {
+      const { callPath, sites } = sitesFromImportFiles(evidence.importingFiles, 10);
       findings.push({
         advisoryId: entry.advisoryId,
         ecosystem: entry.ecosystem,
@@ -8109,7 +8481,8 @@ async function analyzeReachability(input) {
         version: entry.version,
         tier: "potentially_reachable",
         evidence: `${entry.package} is imported by ${evidence.importingFiles.length} file${evidence.importingFiles.length === 1 ? "" : "s"}; vulnerable symbols unresolved (coverage: ${entry.symbolCoverage})`,
-        callPath: evidence.importingFiles.slice(0, 10),
+        callPath,
+        sites,
         graphConfidence: Math.min(baseConfidence, 0.6)
       });
       continue;
@@ -8117,14 +8490,19 @@ async function analyzeReachability(input) {
     const filesToCheck = evidence.importingFiles.slice(0, MAX_FILES_PER_PACKAGE);
     let anySymbolFound = false;
     for (const { symbol, identifier } of matchableSymbols) {
-      const referencingFiles = [];
+      const sites = [];
       for (const relFile of filesToCheck) {
-        if (await fileReferencesIdentifier(input.rootDir, relFile, identifier, readFile3)) {
-          referencingFiles.push(relFile);
-          if (referencingFiles.length >= 5) break;
-        }
+        const line = await firstReferenceLine(input.rootDir, relFile, identifier, readFile3);
+        if (line == null) continue;
+        sites.push({
+          file: relFile,
+          line,
+          symbol,
+          function: enclosingFunctionName(input.graph, relFile, line)
+        });
+        if (sites.length >= 5) break;
       }
-      if (referencingFiles.length > 0) {
+      if (sites.length > 0) {
         anySymbolFound = true;
         findings.push({
           advisoryId: entry.advisoryId,
@@ -8133,13 +8511,15 @@ async function analyzeReachability(input) {
           version: entry.version,
           symbol,
           tier: "reachable",
-          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${referencingFiles.length} importing file${referencingFiles.length === 1 ? "" : "s"}`,
-          callPath: referencingFiles,
+          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${sites.length} importing file${sites.length === 1 ? "" : "s"}`,
+          callPath: sites.map(formatSitePath),
+          sites,
           graphConfidence: Math.min(baseConfidence, 0.75)
         });
       }
     }
     if (!anySymbolFound) {
+      const { callPath, sites } = sitesFromImportFiles(evidence.importingFiles, 10);
       findings.push({
         advisoryId: entry.advisoryId,
         ecosystem: entry.ecosystem,
@@ -8147,7 +8527,8 @@ async function analyzeReachability(input) {
         version: entry.version,
         tier: "not_reached",
         evidence: `${entry.package} is imported, but none of its ${matchableSymbols.length} vulnerable symbol${matchableSymbols.length === 1 ? "" : "s"} is referenced in the ${filesToCheck.length} importing file${filesToCheck.length === 1 ? "" : "s"} checked`,
-        callPath: evidence.importingFiles.slice(0, 10),
+        callPath,
+        sites,
         graphConfidence: Math.min(baseConfidence, 0.55)
       });
     }