@vibgrate/cli 2026.731.1 → 2026.731.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. package/dist/{agent-33BMKWJC.js → agent-6PPW5GIV.js} +4 -4
  2. package/dist/{agent-33BMKWJC.js.map → agent-6PPW5GIV.js.map} +1 -1
  3. package/dist/baseline-ZMHL6DXF.js +9 -0
  4. package/dist/{baseline-4FBHW2X2.js.map → baseline-ZMHL6DXF.js.map} +1 -1
  5. package/dist/{chunk-SE4JMB4W.js → chunk-4CGLQXSI.js} +3 -3
  6. package/dist/{chunk-SE4JMB4W.js.map → chunk-4CGLQXSI.js.map} +1 -1
  7. package/dist/chunk-4DZC3ADC.js +42 -0
  8. package/dist/chunk-4DZC3ADC.js.map +1 -0
  9. package/dist/chunk-4TC6RJ7U.js +326 -0
  10. package/dist/chunk-4TC6RJ7U.js.map +1 -0
  11. package/dist/{chunk-T7OFJS3X.js → chunk-5J45MN3K.js} +13 -328
  12. package/dist/chunk-5J45MN3K.js.map +1 -0
  13. package/dist/{chunk-NJT4CA6K.js → chunk-DT4KIVRI.js} +17 -8
  14. package/dist/chunk-DT4KIVRI.js.map +1 -0
  15. package/dist/{chunk-3NP2DO4G.js → chunk-EX2SH5CT.js} +3 -3
  16. package/dist/{chunk-3NP2DO4G.js.map → chunk-EX2SH5CT.js.map} +1 -1
  17. package/dist/{chunk-GPDJOCUI.js → chunk-FF5ZQ6KI.js} +4 -4
  18. package/dist/{chunk-GPDJOCUI.js.map → chunk-FF5ZQ6KI.js.map} +1 -1
  19. package/dist/{chunk-476KWSFM.js → chunk-IZNOMGR6.js} +3 -3
  20. package/dist/{chunk-476KWSFM.js.map → chunk-IZNOMGR6.js.map} +1 -1
  21. package/dist/chunk-L6BRBFBP.js +65 -0
  22. package/dist/chunk-L6BRBFBP.js.map +1 -0
  23. package/dist/{chunk-J3BQ7FIT.js → chunk-LZX5NH4V.js} +7 -7
  24. package/dist/{chunk-J3BQ7FIT.js.map → chunk-LZX5NH4V.js.map} +1 -1
  25. package/dist/chunk-NNB2H4BA.js +6 -0
  26. package/dist/{chunk-2XTPGYR2.js.map → chunk-NNB2H4BA.js.map} +1 -1
  27. package/dist/{chunk-KGWEBM2J.js → chunk-Q7HUXIUF.js} +3 -3
  28. package/dist/{chunk-KGWEBM2J.js.map → chunk-Q7HUXIUF.js.map} +1 -1
  29. package/dist/{chunk-DXSEG6SZ.js → chunk-QWOJO32H.js} +3 -3
  30. package/dist/{chunk-DXSEG6SZ.js.map → chunk-QWOJO32H.js.map} +1 -1
  31. package/dist/{chunk-C22ZY3FV.js → chunk-RIWLXMMT.js} +3 -3
  32. package/dist/{chunk-C22ZY3FV.js.map → chunk-RIWLXMMT.js.map} +1 -1
  33. package/dist/{chunk-CWB6H553.js → chunk-TNCD5VFX.js} +3 -3
  34. package/dist/{chunk-CWB6H553.js.map → chunk-TNCD5VFX.js.map} +1 -1
  35. package/dist/{chunk-UVMP7DFF.js → chunk-XRN7DQGR.js} +11 -11
  36. package/dist/{chunk-UVMP7DFF.js.map → chunk-XRN7DQGR.js.map} +1 -1
  37. package/dist/{chunk-SKIMUFCI.js → chunk-Y44GPOBL.js} +41 -65
  38. package/dist/chunk-Y44GPOBL.js.map +1 -0
  39. package/dist/cli.d.ts +5 -1
  40. package/dist/cli.js +205 -46
  41. package/dist/cli.js.map +1 -1
  42. package/dist/ensure-map-C3NEC2GI.js +28 -0
  43. package/dist/ensure-map-C3NEC2GI.js.map +1 -0
  44. package/dist/fs-NTQUFCXV.js +4 -0
  45. package/dist/fs-NTQUFCXV.js.map +1 -0
  46. package/dist/index.d.ts +1 -1
  47. package/dist/index.js +10 -9
  48. package/dist/index.js.map +1 -1
  49. package/dist/{interactive-V6IRYZTA.js → interactive-2TAYVEHE.js} +19 -16
  50. package/dist/interactive-2TAYVEHE.js.map +1 -0
  51. package/dist/load-A5BGEQWP.js +10 -0
  52. package/dist/{load-KPHH26ND.js.map → load-A5BGEQWP.js.map} +1 -1
  53. package/dist/{run-outcome-TZ53G67B.js → run-outcome-OSIVMVT7.js} +5 -5
  54. package/dist/{run-outcome-TZ53G67B.js.map → run-outcome-OSIVMVT7.js.map} +1 -1
  55. package/dist/{runtime-session-PZKXBDJT.js → runtime-session-UPTC3E6N.js} +7 -7
  56. package/dist/{runtime-session-PZKXBDJT.js.map → runtime-session-UPTC3E6N.js.map} +1 -1
  57. package/dist/{stream-json-3YOPU3LF.js → stream-json-CFKBL3MR.js} +4 -4
  58. package/dist/{stream-json-3YOPU3LF.js.map → stream-json-CFKBL3MR.js.map} +1 -1
  59. package/dist/{vg-mcp-bridge-7NNVIVO7.js → vg-mcp-bridge-JHRKJBVT.js} +6 -6
  60. package/dist/{vg-mcp-bridge-7NNVIVO7.js.map → vg-mcp-bridge-JHRKJBVT.js.map} +1 -1
  61. package/dist/{vgd-Y2YCN75V.js → vgd-HNPOSXKZ.js} +6 -6
  62. package/dist/vgd-HNPOSXKZ.js.map +1 -0
  63. package/package.json +1 -1
  64. package/dist/baseline-4FBHW2X2.js +0 -9
  65. package/dist/chunk-2XTPGYR2.js +0 -6
  66. package/dist/chunk-NJT4CA6K.js.map +0 -1
  67. package/dist/chunk-SKIMUFCI.js.map +0 -1
  68. package/dist/chunk-T7OFJS3X.js.map +0 -1
  69. package/dist/fs-HF5DOHYR.js +0 -4
  70. package/dist/fs-HF5DOHYR.js.map +0 -1
  71. package/dist/interactive-V6IRYZTA.js.map +0 -1
  72. package/dist/load-KPHH26ND.js +0 -10
  73. package/dist/vgd-Y2YCN75V.js.map +0 -1
package/dist/cli.d.ts CHANGED
@@ -50,7 +50,11 @@ interface BuildCmdOpts {
50
50
  attestation?: string;
51
51
  pub?: string;
52
52
  }
53
- declare function runBuild(paths: string[], opts: BuildCmdOpts, global: GlobalOpts): Promise<void>;
53
+ interface RunBuildHooks {
54
+ /** Invoked during the parse phase (even under --quiet / non-TTY hosts). */
55
+ onParseProgress?: (done: number, total: number) => void;
56
+ }
57
+ declare function runBuild(paths: string[], opts: BuildCmdOpts, global: GlobalOpts, hooks?: RunBuildHooks): Promise<void>;
54
58
 
55
59
  /** The set of registered subcommand names (kept in sync with registration). */
56
60
  declare const KNOWN_COMMANDS: Set<string>;
package/dist/cli.js CHANGED
@@ -1,12 +1,13 @@
1
1
  #!/usr/bin/env node
2
- import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-T7OFJS3X.js';
3
- export { runBuild } from './chunk-T7OFJS3X.js';
4
- import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-CWB6H553.js';
5
- import { loadAdvancedScanHook, baselineCommand } from './chunk-GPDJOCUI.js';
2
+ import { loadAdvancedScanHook, baselineCommand } from './chunk-FF5ZQ6KI.js';
3
+ import { fetchCatalog, resolveProviders } from './chunk-4TC6RJ7U.js';
4
+ import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EX2SH5CT.js';
5
+ import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-TNCD5VFX.js';
6
6
  import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
7
7
  import { runCodeSession } from './chunk-WBMMRERH.js';
8
+ import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-5J45MN3K.js';
9
+ export { runBuild } from './chunk-5J45MN3K.js';
8
10
  import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
9
- import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-3NP2DO4G.js';
10
11
  import './chunk-5I4VSBWQ.js';
11
12
  import './chunk-IS7VTH2Q.js';
12
13
  import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -15,7 +16,7 @@ import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
15
16
  import './chunk-IZDH67DX.js';
16
17
  import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-EVLS2M5G.js';
17
18
  import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-X634FZVG.js';
18
- import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-KGWEBM2J.js';
19
+ import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-Q7HUXIUF.js';
19
20
  import './chunk-543E6WDJ.js';
20
21
  import { summarizeDiffs, ScriptedProvider } from './chunk-MYM5VIJ4.js';
21
22
  import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
@@ -23,15 +24,16 @@ import './chunk-RGEVBSLK.js';
23
24
  import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
24
25
  import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
25
26
  import './chunk-7AVYKZEM.js';
26
- import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-J3BQ7FIT.js';
27
- import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-SKIMUFCI.js';
28
- import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-C22ZY3FV.js';
27
+ import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-LZX5NH4V.js';
28
+ import { refreshIfStale } from './chunk-L6BRBFBP.js';
29
+ import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-Y44GPOBL.js';
30
+ import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RIWLXMMT.js';
31
+ import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-XRN7DQGR.js';
29
32
  import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
30
- import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-UVMP7DFF.js';
31
33
  import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
34
+ import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
32
35
  import './chunk-IPICO2RV.js';
33
36
  import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-FHJBGPJZ.js';
34
- import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
35
37
  import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
36
38
  import { resolveOne } from './chunk-J7LKEB2R.js';
37
39
  import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-EETK7S43.js';
@@ -39,14 +41,14 @@ import { discoverModels } from './chunk-CQDUBAQY.js';
39
41
  import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
40
42
  import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
41
43
  import './chunk-RXP66R2E.js';
42
- import { loadGraph, SCHEMA_VERSION } from './chunk-476KWSFM.js';
43
- import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-DXSEG6SZ.js';
44
- import { VERSION } from './chunk-2XTPGYR2.js';
44
+ import { loadGraph, SCHEMA_VERSION } from './chunk-IZNOMGR6.js';
45
+ import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-QWOJO32H.js';
46
+ import { VERSION } from './chunk-NNB2H4BA.js';
45
47
  import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
46
48
  import './chunk-BWPBB45M.js';
47
49
  import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
48
50
  import './chunk-BPF3YX2U.js';
49
- import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-NJT4CA6K.js';
51
+ import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIVRI.js';
50
52
  import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
51
53
  import * as fs7 from 'fs';
52
54
  import fs7__default, { realpathSync } from 'fs';
@@ -1707,7 +1709,7 @@ function manifestHash(root2) {
1707
1709
  for (const entry of entries) {
1708
1710
  const abs = path37.join(dir, entry.name);
1709
1711
  if (entry.isDirectory()) {
1710
- if (SKIP_DIRS.has(entry.name)) continue;
1712
+ if (isSkippedDirName(entry.name)) continue;
1711
1713
  walk2(abs);
1712
1714
  continue;
1713
1715
  }
@@ -1729,7 +1731,7 @@ function isDependencyFile(root2, filePath) {
1729
1731
  const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
1730
1732
  if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
1731
1733
  const parts = rel.split(path37.sep);
1732
- if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
1734
+ if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
1733
1735
  const base = parts[parts.length - 1].toLowerCase();
1734
1736
  return isManifest(filePath) || SKIP_FILES.has(base);
1735
1737
  }
@@ -2220,10 +2222,14 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
2220
2222
  else if (r.source === "error") anyError = true;
2221
2223
  const locations = t.locations.length ? t.locations : t.file ? [{ file: t.file, line: t.line ?? null }] : [];
2222
2224
  const seenIds = /* @__PURE__ */ new Set();
2225
+ const seenCves = /* @__PURE__ */ new Set();
2223
2226
  for (const v of r.vulns) {
2224
2227
  if (seenIds.has(v.id)) continue;
2228
+ const cveKeys = (v.cves ?? []).map((c2) => c2.toUpperCase()).filter(Boolean);
2229
+ if (cveKeys.length && cveKeys.every((c2) => seenCves.has(c2))) continue;
2225
2230
  seenIds.add(v.id);
2226
- const kevHit = v.cves.some((c2) => kev.cves.has(c2.toUpperCase()));
2231
+ for (const c2 of cveKeys) seenCves.add(c2);
2232
+ const kevHit = cveKeys.some((c2) => kev.cves.has(c2));
2227
2233
  findings.push({
2228
2234
  package: t.package,
2229
2235
  version: t.version,
@@ -2482,7 +2488,7 @@ var VibgrateLanguageServer = class {
2482
2488
  rootPath: a.rootPath,
2483
2489
  scannedAt: a.timestamp,
2484
2490
  ...delta !== void 0 ? { delta } : {},
2485
- ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {},
2491
+ ...buildBreakdown(this.opts.root, a.projects ?? []) ? { breakdown: buildBreakdown(this.opts.root, a.projects ?? []) } : {},
2486
2492
  ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {},
2487
2493
  ...buildProjectRefs(this.opts.root, a.projects ?? []) ? { projects: buildProjectRefs(this.opts.root, a.projects ?? []) } : {}
2488
2494
  };
@@ -2790,7 +2796,11 @@ function isPrunedWorkspacePath(relPath) {
2790
2796
  if (!relPath || relPath === "." || relPath === "") return false;
2791
2797
  const parts = relPath.split(/[/\\]/).filter(Boolean);
2792
2798
  if (parts.includes(".claude")) return true;
2793
- return parts.some((p) => SKIP_DIRS.has(p));
2799
+ return parts.some((p) => {
2800
+ if (SKIP_DIRS.has(p)) return true;
2801
+ if (p.startsWith(".venv") || p.startsWith("venv-") || p === "site-packages") return true;
2802
+ return false;
2803
+ });
2794
2804
  }
2795
2805
  function pruneArtifactProjects(a) {
2796
2806
  const projects = (a.projects ?? []).filter(
@@ -2812,15 +2822,81 @@ function projectByPath(a, projectPath) {
2812
2822
  }
2813
2823
  return void 0;
2814
2824
  }
2825
+ function projectHasLocalLockOrCsproj(rootDir, proj) {
2826
+ const base = proj.path === "." || proj.path === "" ? "" : proj.path;
2827
+ const dirAbs = base ? path37.join(rootDir, base) : rootDir;
2828
+ const lockNames = (() => {
2829
+ switch (proj.type) {
2830
+ case "node":
2831
+ case "typescript":
2832
+ return ["pnpm-lock.yaml", "yarn.lock", "package-lock.json", "bun.lockb", "bun.lock"];
2833
+ case "python":
2834
+ return ["poetry.lock", "uv.lock", "Pipfile.lock"];
2835
+ case "go":
2836
+ return ["go.sum"];
2837
+ case "rust":
2838
+ return ["Cargo.lock"];
2839
+ case "ruby":
2840
+ return ["Gemfile.lock"];
2841
+ case "php":
2842
+ return ["composer.lock"];
2843
+ case "dotnet":
2844
+ return ["packages.lock.json"];
2845
+ case "dart":
2846
+ return ["pubspec.lock"];
2847
+ case "java":
2848
+ case "kotlin":
2849
+ case "scala":
2850
+ case "groovy":
2851
+ return ["gradle.lockfile"];
2852
+ default:
2853
+ return [
2854
+ "pnpm-lock.yaml",
2855
+ "yarn.lock",
2856
+ "package-lock.json",
2857
+ "bun.lockb",
2858
+ "poetry.lock",
2859
+ "uv.lock",
2860
+ "Cargo.lock",
2861
+ "go.sum",
2862
+ "Gemfile.lock",
2863
+ "composer.lock",
2864
+ "packages.lock.json",
2865
+ "pubspec.lock"
2866
+ ];
2867
+ }
2868
+ })();
2869
+ for (const name of lockNames) {
2870
+ try {
2871
+ if (fs7.existsSync(path37.join(dirAbs, name))) return true;
2872
+ } catch {
2873
+ }
2874
+ }
2875
+ try {
2876
+ if (fs7.existsSync(dirAbs)) {
2877
+ const entries = fs7.readdirSync(dirAbs);
2878
+ if (entries.some((e) => /\.(csproj|fsproj|vbproj)$/i.test(e))) return true;
2879
+ }
2880
+ } catch {
2881
+ }
2882
+ const manifest = manifestRelativePath(proj);
2883
+ if (/\.(csproj|fsproj|vbproj)$/i.test(manifest)) {
2884
+ try {
2885
+ if (fs7.existsSync(path37.join(rootDir, manifest))) return true;
2886
+ } catch {
2887
+ }
2888
+ }
2889
+ return false;
2890
+ }
2815
2891
  function buildProjectRefs(rootDir, projects) {
2816
2892
  if (projects.length === 0) return void 0;
2817
- return projects.map((p) => {
2893
+ const refs = projects.filter((p) => projectHasLocalLockOrCsproj(rootDir, p)).map((p) => {
2818
2894
  const rel = p.path === "" ? "." : p.path;
2819
- const base = rel === "." ? "." : path37.basename(rel);
2895
+ const base = rel === "." || rel === "" ? "root" : path37.basename(rel);
2820
2896
  const lockfilePath = lockfileRelativePath(rootDir, p);
2821
2897
  return {
2822
2898
  path: rel,
2823
- name: p.name || base,
2899
+ name: base,
2824
2900
  manifestPath: manifestRelativePath(p),
2825
2901
  ...lockfilePath ? { lockfilePath } : {},
2826
2902
  ...p.drift ? {
@@ -2830,6 +2906,7 @@ function buildProjectRefs(rootDir, projects) {
2830
2906
  } : {}
2831
2907
  };
2832
2908
  }).sort((a, b) => a.path.localeCompare(b.path));
2909
+ return refs.length > 0 ? refs : void 0;
2833
2910
  }
2834
2911
  function projectForFile(root2, a, filePath) {
2835
2912
  const dir = path37.dirname(path37.resolve(filePath));
@@ -2878,7 +2955,7 @@ function scoreForProject(rootDir, a, proj) {
2878
2955
  counts: { behind, eol, unmaintained, total },
2879
2956
  rootPath: proj.path === "" ? "." : proj.path,
2880
2957
  scannedAt: a.timestamp,
2881
- ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {},
2958
+ ...buildBreakdown(rootDir, [proj]) ? { breakdown: buildBreakdown(rootDir, [proj]) } : {},
2882
2959
  ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {},
2883
2960
  ...buildProjectRefs(rootDir, a.projects ?? []) ? { projects: buildProjectRefs(rootDir, a.projects ?? []) } : {}
2884
2961
  };
@@ -2909,17 +2986,52 @@ function bandForScore(n) {
2909
2986
  if (n <= 60) return "moderate";
2910
2987
  return "high";
2911
2988
  }
2912
- function buildBreakdown(_drift, projects) {
2989
+ function buildBreakdown(rootDir, projects) {
2913
2990
  const byPkg = /* @__PURE__ */ new Map();
2914
2991
  for (const p of projects) {
2992
+ const relManifest = manifestRelativePath(p);
2993
+ if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
2915
2994
  const ecosystem = osvEcosystem(p.type);
2995
+ const absManifest = path37.resolve(rootDir, relManifest);
2996
+ let text = null;
2997
+ try {
2998
+ if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
2999
+ } catch {
3000
+ text = null;
3001
+ }
3002
+ const kind = manifestKind(absManifest);
2916
3003
  for (const d of p.dependencies ?? []) {
2917
- if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
3004
+ let line = null;
3005
+ if (text && kind !== "unknown") {
3006
+ const l = findPackageLine(text, d.package, kind);
3007
+ if (l >= 0) line = l + 1;
3008
+ }
3009
+ const loc = { file: relManifest, line };
3010
+ const existing = byPkg.get(d.package);
3011
+ if (!existing) {
3012
+ byPkg.set(d.package, { row: d, ecosystem, locations: [loc] });
3013
+ continue;
3014
+ }
3015
+ if (!existing.locations.some((x) => x.file === loc.file && x.line === loc.line)) {
3016
+ existing.locations.push(loc);
3017
+ }
3018
+ const prev = perDependencyDrift(existing.row, {
3019
+ unsupported: existing.row.unsupported === true,
3020
+ abandoned: existing.row.abandoned === true
3021
+ });
3022
+ const next2 = perDependencyDrift(d, {
3023
+ unsupported: d.unsupported === true,
3024
+ abandoned: d.abandoned === true
3025
+ });
3026
+ if (!next2.excluded && (prev.excluded || next2.drift > prev.drift)) {
3027
+ existing.row = d;
3028
+ if (ecosystem) existing.ecosystem = ecosystem;
3029
+ }
2918
3030
  }
2919
3031
  }
2920
3032
  if (byPkg.size === 0) return void 0;
2921
3033
  const items = [];
2922
- for (const [, { row, ecosystem }] of byPkg) {
3034
+ for (const [, { row, ecosystem, locations }] of byPkg) {
2923
3035
  const scored = perDependencyDrift(row, {
2924
3036
  unsupported: row.unsupported === true,
2925
3037
  abandoned: row.abandoned === true
@@ -2939,7 +3051,8 @@ function buildBreakdown(_drift, projects) {
2939
3051
  mode: scored.mode,
2940
3052
  unsupported: scored.unsupported || row.unsupported === true,
2941
3053
  abandoned: scored.flags.includes("abandoned-floor") || row.abandoned === true,
2942
- flags: scored.flags
3054
+ flags: scored.flags,
3055
+ locations
2943
3056
  });
2944
3057
  }
2945
3058
  items.sort((a, b) => b.drift - a.drift || a.package.localeCompare(b.package));
@@ -3225,7 +3338,7 @@ function hoverMarkdown(dep, contribution) {
3225
3338
  majorsBehind: dep.majorsBehind ?? 0
3226
3339
  });
3227
3340
  const explainUri = commandUri("vibgrate.explain", { package: dep.package });
3228
- lines.push(`[Route this fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
3341
+ lines.push(`[Fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
3229
3342
  }
3230
3343
  lines.push("");
3231
3344
  lines.push("---");
@@ -3298,12 +3411,24 @@ function registerInstall(program) {
3298
3411
  return;
3299
3412
  }
3300
3413
  if (global.json) {
3301
- json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
3414
+ json(
3415
+ ASSISTANTS.map((a) => ({
3416
+ id: a.id,
3417
+ label: a.label,
3418
+ mcp: !!a.mcp,
3419
+ skill: !!a.skill,
3420
+ nudge: !!a.nudge,
3421
+ installed: isAssistantInstalled(a, root2)
3422
+ }))
3423
+ );
3302
3424
  } else {
3303
3425
  info(`${c.cyan("vg install")} \xB7 supported assistants`);
3304
3426
  const pad4 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
3305
3427
  for (const a of ASSISTANTS) {
3306
- info(` ${c.bold(a.id.padEnd(pad4))} ${a.label} ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
3428
+ const on = isAssistantInstalled(a, root2) ? c.green("on") : c.dim("off");
3429
+ info(
3430
+ ` ${c.bold(a.id.padEnd(pad4))} ${a.label} ${on} ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`
3431
+ );
3307
3432
  }
3308
3433
  }
3309
3434
  return;
@@ -6289,7 +6414,7 @@ function registerCode(program) {
6289
6414
  try {
6290
6415
  const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
6291
6416
  const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
6292
- const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
6417
+ const { loadGraph: loadGraph2 } = await import('./load-A5BGEQWP.js');
6293
6418
  const state = readOrchestratorState2();
6294
6419
  const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
6295
6420
  const pin = mode ? activePin2(mode, state) : null;
@@ -6373,7 +6498,7 @@ function registerCode(program) {
6373
6498
  if (!(process.stdin.isTTY && process.stdout.isTTY)) {
6374
6499
  throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
6375
6500
  }
6376
- const { runInteractive } = await import('./interactive-V6IRYZTA.js');
6501
+ const { runInteractive } = await import('./interactive-2TAYVEHE.js');
6377
6502
  await runInteractive(
6378
6503
  rootOf(global),
6379
6504
  global,
@@ -6402,6 +6527,40 @@ function registerCode(program) {
6402
6527
  return;
6403
6528
  }
6404
6529
  if (!instruction) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
6530
+ {
6531
+ const { ensureCodeMap } = await import('./ensure-map-C3NEC2GI.js');
6532
+ const mapRoot = rootOf(global);
6533
+ try {
6534
+ await ensureCodeMap(mapRoot, global, {
6535
+ onProgress: (p) => {
6536
+ if (opts.streamJson) {
6537
+ process.stdout.write(
6538
+ JSON.stringify({
6539
+ event: "event",
6540
+ type: "map_build",
6541
+ phase: p.phase,
6542
+ message: p.message,
6543
+ ...p.pct != null ? { pct: p.pct } : {}
6544
+ }) + "\n"
6545
+ );
6546
+ return;
6547
+ }
6548
+ if (!global.json && !global.quiet && (p.phase === "start" || p.phase === "done")) {
6549
+ info(c.dim(`vg code \xB7 ${p.message}`));
6550
+ }
6551
+ }
6552
+ });
6553
+ } catch (e) {
6554
+ const msg = e instanceof Error ? e.message : String(e);
6555
+ if (opts.streamJson) {
6556
+ process.stdout.write(
6557
+ JSON.stringify({ event: "error", message: `Could not build the code map: ${msg}` }) + "\n"
6558
+ );
6559
+ return;
6560
+ }
6561
+ throw e;
6562
+ }
6563
+ }
6405
6564
  const { root: root2, graph } = requireGraph(global);
6406
6565
  let mockReply;
6407
6566
  if (opts.mock) {
@@ -6454,20 +6613,20 @@ function registerCode(program) {
6454
6613
  process.stdout.write(JSON.stringify(line) + "\n");
6455
6614
  };
6456
6615
  try {
6457
- const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-TZ53G67B.js');
6616
+ const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-OSIVMVT7.js');
6458
6617
  const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
6459
- const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3YOPU3LF.js');
6618
+ const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-CFKBL3MR.js');
6460
6619
  const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
6461
6620
  const readline5 = await import('readline');
6462
6621
  const child = await import('child_process');
6463
6622
  const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
6464
6623
  const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
6465
6624
  const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
6466
- const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
6625
+ const { startCodeRuntimeSession } = await import('./runtime-session-UPTC3E6N.js');
6467
6626
  const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
6468
6627
  const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
6469
6628
  const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
6470
- const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
6629
+ const { vgdRequest: vgdRequest2 } = await import('./vgd-HNPOSXKZ.js');
6471
6630
  const federation = loadOrDiscoverFederation(root2);
6472
6631
  const modelProfile = mergeModelExecutionProfile(
6473
6632
  resolveModelExecutionProfile({
@@ -6525,7 +6684,7 @@ ${res.stderr}` : ""),
6525
6684
  exitCode: res.status ?? 1
6526
6685
  };
6527
6686
  };
6528
- const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
6687
+ const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-JHRKJBVT.js');
6529
6688
  const vgBuiltin = createVgBuiltinMcpTools({
6530
6689
  getGraph: () => graph,
6531
6690
  root: root2,
@@ -6612,8 +6771,8 @@ ${res.stderr}` : ""),
6612
6771
  };
6613
6772
  try {
6614
6773
  if (opts.session) {
6615
- const { runCodeStreamJsonSession } = await import('./stream-json-3YOPU3LF.js');
6616
- const { runAgent: runAgent2 } = await import('./agent-33BMKWJC.js');
6774
+ const { runCodeStreamJsonSession } = await import('./stream-json-CFKBL3MR.js');
6775
+ const { runAgent: runAgent2 } = await import('./agent-6PPW5GIV.js');
6617
6776
  const {
6618
6777
  loadLatestSession,
6619
6778
  newSession,
@@ -6761,7 +6920,7 @@ ${res.stderr}` : ""),
6761
6920
  if (!autonomous && !tty) {
6762
6921
  throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
6763
6922
  }
6764
- const { agentTask } = await import('./interactive-V6IRYZTA.js');
6923
+ const { agentTask } = await import('./interactive-2TAYVEHE.js');
6765
6924
  const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
6766
6925
  const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
6767
6926
  let priorSummary;
@@ -6771,7 +6930,7 @@ ${res.stderr}` : ""),
6771
6930
  if (prev) priorSummary = summarizeSession(prev);
6772
6931
  }
6773
6932
  const prompter = tty ? new TtyPrompter() : void 0;
6774
- const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
6933
+ const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-JHRKJBVT.js');
6775
6934
  const vgBuiltin = createVgBuiltinMcpTools({
6776
6935
  getGraph: () => graph,
6777
6936
  root: root2,
@@ -6795,11 +6954,11 @@ ${res.stderr}` : ""),
6795
6954
  const { loadFederation } = await import('./federation-MDQPO3PW.js');
6796
6955
  const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
6797
6956
  const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
6798
- const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
6957
+ const { startCodeRuntimeSession } = await import('./runtime-session-UPTC3E6N.js');
6799
6958
  const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
6800
6959
  const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
6801
6960
  const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
6802
- const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
6961
+ const { vgdRequest: vgdRequest2 } = await import('./vgd-HNPOSXKZ.js');
6803
6962
  const federation = loadFederation(root2);
6804
6963
  const modelProfile = mergeModelExecutionProfile(
6805
6964
  resolveModelExecutionProfile({
@@ -7689,7 +7848,7 @@ function registerDaemon(program) {
7689
7848
  throw new CliError(loaded.error, ExitCode.NOT_FOUND);
7690
7849
  }
7691
7850
  if (!loaded.ok) {
7692
- const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
7851
+ const { loadGraph: loadGraph2 } = await import('./load-A5BGEQWP.js');
7693
7852
  const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
7694
7853
  const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
7695
7854
  const graph = loadGraph2(root2, global.graph);
@@ -8094,7 +8253,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
8094
8253
  console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
8095
8254
  }
8096
8255
  if (opts.baseline) {
8097
- const { runBaseline } = await import('./baseline-4FBHW2X2.js');
8256
+ const { runBaseline } = await import('./baseline-ZMHL6DXF.js');
8098
8257
  await runBaseline(rootDir);
8099
8258
  }
8100
8259
  console.log("");