@vibgrate/cli 2026.731.1 → 2026.731.3

package/dist/{chunk-CWB6H553.js → chunk-Z7VH4RPO.js}

@@ -1,5 +1,5 @@
 import { resolveIngestHost } from './chunk-HTLDXEHW.js';
-import { VERSION } from './chunk-2XTPGYR2.js';
+import { VERSION } from './chunk-DEKGSQHL.js';
 import { cacheDir } from './chunk-ZKNB4YH4.js';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -212,5 +212,5 @@ var StatsSharer = class {
 };
 
 export { StatsSharer, installId, isCI, statsEndpoint, telemetryOptOut };
-//# sourceMappingURL=chunk-CWB6H553.js.map
-//# sourceMappingURL=chunk-CWB6H553.js.map
+//# sourceMappingURL=chunk-Z7VH4RPO.js.map
+//# sourceMappingURL=chunk-Z7VH4RPO.js.map

package/dist/{chunk-CWB6H553.js.map → chunk-Z7VH4RPO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/engine/stats-share.ts"],"names":[],"mappings":";;;;;;;;AAiCA,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAM,WAAA,GAAc,kBAAA;AAEpB,IAAM,cAAA,GAAsB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,CAAA;AAC1D,IAAM,eAAA,GAAuB,IAAA,CAAA,IAAA,CAAK,cAAA,EAAgB,YAAY,CAAA;AAE9D,IAAM,eAAA,GAAkB,GAAA;AAgCjB,SAAS,eAAA,CAAgB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACnF,EAAA,MAAM,OAAO,GAAA,CAAI,YAAA,IAAgB,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AACxD,EAAA,IAAI,QAAQ,EAAA,IAAM,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,SAAS,OAAO,cAAA;AACzD,EAAA,MAAM,MAAM,GAAA,CAAI,kBAAA,IAAsB,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAC7D,EAAA,IAAI,OAAO,GAAA,IAAO,EAAA,KAAO,OAAA,IAAW,EAAA,KAAO,OAAO,OAAO,oBAAA;AACzD,EAAA,OAAO,IAAA;AACT;AAGA,IAAM,WAAA,GAAc;AAAA,EAClB,IAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAGO,SAAS,IAAA,CAAK,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAc;AAClE,EAAA,OAAO,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM;AAC7B,IAAA,MAAM,OAAO,GAAA,CAAI,CAAC,KAAK,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAC9C,IAAA,OAAO,GAAA,KAAQ,EAAA,IAAM,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,OAAA;AAAA,EAC9C,CAAC,CAAA;AACH;AAcO,SAAS,SAAA,CAAU,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAa;AACtE,EAAA,IAAI,eAAA,CAAgB,GAAG,CAAA,KAAM,IAAA,IAAQ,KAAK,GAAG,CAAA,SAAU,UAAA,EAAW;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,eAAA,EAAiB,MAAM,EAAE,IAAA,EAAK;AAC/D,IAAA,IAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,OAAO,QAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,MAAM,KAAK,UAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAG,EAAA,CAAA,SAAA,CAAU,cAAA,EAAgB,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,IAAG,iBAAc,eAAA,EAAiB,EAAA,GAAK,MAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAA;AACT;AAEA,SAAS,OAAO,CAAA,EAAoB;AAClC,EAAA,OAAO,iEAAA,CAAkE,KAAK,CAAC,CAAA;AACjF;AAEA,SAAS,UAAA,GAAqB;AAC5B,EAAA,OAAO,UAAA,EAAW;AACpB;AAGO,SAAS,aAAA,GAAwB;AACtC,EAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,uBAAA;AAC7B,EAAA,IAAI,QAAA,IAAY,cAAA,CAAe,IAAA,CAAK,QAAQ,GAAG,OAAO,QAAA;AACtD,EAAA,OAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,wBAAA,CAAA;AACvC;AAEA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG,WAAW,CAAA;AAC9C;AAEA,SAAS,eAAe,IAAA,EAAsB;AAC5C,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG,eAAe,CAAA;AAClD;AAEA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,WAAW,IAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAChE,IAAA,OAAO,OAAO,IAAI,MAAA,KAAW,QAAA,IAAY,IAAI,MAAA,IAAU,CAAA,GAAI,IAAI,MAAA,GAAS,CAAA;AAAA,EAC1E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,CAAY,MAAc,MAAA,EAAsB;AACvD,EAAA,IAAI;AACF,IAAG,aAAU,QAAA,CAAS,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,IAAG,EAAA,CAAA,aAAA,CAAc,UAAA,CAAW,IAAI,CAAA,EAAG,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,CAAA,GAAI,IAAI,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAOO,SAAS,UAAA,CACd,IAAA,EACA,UAAA,EACA,EAAA,GAAK,WAAU,EACkC;AACjD,EAAA,MAAM,IAAA,GAAO,eAAe,IAAI,CAAA;AAChC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI;AACF,IAAA,IAAA,GAAU,EAAA,CAAA,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,MAAM,KAAA,GAAQ,UAAA,GAAa,IAAA,GAAO,CAAA,GAAI,UAAA;AACtC,EAAA,IAAI,SAAS,IAAA,EAAM,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,WAAW,IAAA,EAAK;AAEzD,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAQ,EAAA,CAAA,QAAA,CAAS,IAAA,EAAM,GAAG,CAAA;AAChC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,IAAA,GAAO,KAAK,CAAA;AACrC,MAAG,YAAS,EAAA,EAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,QAAQ,KAAK,CAAA;AACzC,MAAA,IAAA,GAAO,GAAA,CAAI,SAAS,MAAM,CAAA;AAAA,IAC5B,CAAA,SAAE;AACA,MAAG,aAAU,EAAE,CAAA;AAAA,IACjB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,UAAA,EAAW;AAAA,EAC9C;AAIA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AACpC,EAAA,IAAI,SAAS,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,WAAW,KAAA,EAAM;AACvD,EAAA,MAAM,QAAA,GAAW,QAAQ,MAAA,GAAS,CAAA;AAClC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAsB;AACvC,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,QAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,CAAA,QAAA;AACZ,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,EAAG;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,CAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAA,GAAI,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAiB,EAAE,MAAA,IAAU,KAAA;AACnC,IAAA,MAAM,MAAA,GAAS,EAAE,MAAA,IAAU,SAAA;AAC3B,IAAA,MAAM,OAAA,GAAmB,EAAE,OAAA,IAAW,UAAA;AACtC,IAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACpD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,IAAK;AAAA,MAC3B,MAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,OAAA;AAAA,MACA,KAAA,EAAO,CAAA;AAAA,MACP,QAAA,EAAU,CAAA;AAAA,MACV,cAAA,EAAgB;AAAA,KAClB;AACA,IAAA,GAAA,CAAI,KAAA,EAAA;AACJ,IAAA,GAAA,CAAI,QAAA,IAAY,EAAE,QAAA,IAAY,CAAA;AAC9B,IAAA,GAAA,CAAI,cAAA,IAAkB,EAAE,cAAA,IAAkB,CAAA;AAC1C,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,GAAG,CAAA;AACjB,IAAA,KAAA,EAAA;AACA,IAAA,IAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,EAAU;AAC5B,MAAA,IAAI,CAAA,CAAE,EAAA,GAAK,KAAA,EAAO,KAAA,GAAQ,CAAA,CAAE,EAAA;AAC5B,MAAA,IAAI,CAAA,CAAE,EAAA,GAAK,KAAA,EAAO,KAAA,GAAQ,CAAA,CAAE,EAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,IAAI,KAAA,KAAU,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAA,EAAS;AACtF,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,aAAA,EAAe,cAAA;AAAA,IACf,SAAA,EAAW,EAAA;AAAA,IACX,SAAA,EAAW,OAAA;AAAA,IACX,IAAI,OAAA,CAAQ,QAAA;AAAA,IACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,WAAA,EAAa,IAAI,IAAA,CAAK,KAAK,EAAE,WAAA,EAAY;AAAA,IACzC,SAAA,EAAW,IAAI,IAAA,CAAK,KAAK,EAAE,WAAA,EAAY;AAAA,IACvC,UAAA,EAAY,KAAA;AAAA,IACZ,IAAA,EAAM,CAAC,GAAG,IAAA,CAAK,QAAQ;AAAA,GACzB;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,QAAA,EAAS;AACtC;AAMA,eAAe,UAAU,KAAA,EAAqC;AAC5D,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,eAAe,CAAA;AAClE,EAAA,KAAA,CAAM,KAAA,IAAQ;AACd,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAc,EAAG;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,YAAY,OAAA,EAAQ;AAAA,MACnE,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC1B,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF;AAOO,IAAM,cAAN,MAAkB;AAAA,EAKvB,YAA6B,IAAA,EAAc;AAAd,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAC3B,IAAA,IAAA,CAAK,MAAA,GAAS,WAAW,IAAI,CAAA;AAAA,EAC/B;AAAA,EAF6B,IAAA;AAAA,EAJZ,KAAK,SAAA,EAAU;AAAA,EACxB,MAAA;AAAA,EACA,QAAA,GAAW,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnB,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,UAAA,CAAW,KAAK,IAAA,EAAM,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,EAAE,CAAA;AACvE,MAAA,IAAI,CAAC,KAAA,EAAO;AAEV,QAAA,IAAI,SAAA,GAAY,KAAK,MAAA,EAAQ;AAC3B,UAAA,IAAA,CAAK,MAAA,GAAS,SAAA;AACd,UAAA,WAAA,CAAY,IAAA,CAAK,MAAM,SAAS,CAAA;AAAA,QAClC;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,EAAA,GAAK,MAAM,SAAA,CAAU,KAAK,CAAA;AAChC,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,IAAA,CAAK,MAAA,GAAS,SAAA;AACd,QAAA,WAAA,CAAY,IAAA,CAAK,MAAM,SAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAAA,IAClB;AAAA,EACF;AACF","file":"chunk-CWB6H553.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { cacheDir } from './cache.js';\nimport { VERSION } from '../version.js';\nimport { resolveIngestHost } from '../reporting/regions.js';\nimport type { SavingEntry, Source, Outcome } from './savings.js';\n\n/**\n * Opt-in usage-stats sharing for `vg serve --share-stats`.\n *\n * This is the ONLY path in `vg serve` that sends anything off the machine, and\n * it is off unless the operator explicitly asks for it. What we send is the\n * same counts-only ledger `vg savings` reports locally — per (source, client,\n * tool, outcome): how many calls and the vg-vs-grep token figures — plus the vg\n * version, OS/arch, and a random per-install id. We never send code, file paths,\n * question text, repo identity, or any credential. See GUARDRAILS §3.4.\n *\n * Even when the flag is passed, the universal `DO_NOT_TRACK` opt-out (or\n * `VIBGRATE_TELEMETRY=0`) wins: nothing is uploaded and no install id is ever\n * minted or persisted (see `telemetryOptOut` / `installId`).\n *\n * Design:\n *  - The local ledger (savings.jsonl) is the single source of truth; the flusher\n *    reads only the tail past a persisted byte offset, so a batch is sent once.\n *  - Fire-and-forget with a short timeout. A network problem never blocks a tool\n *    call and never throws — the offset only advances on a confirmed 2xx, so a\n *    failed batch is retried on the next flush.\n *  - Fully offline-safe: under `--local` the sharer is never constructed.\n */\n\n/** Payload schema version — must match the server's `mcpUsageStatsSchema`. */\nconst SCHEMA_VERSION = '1';\n/** Where the offset (and cached install id) live, per repo, beside the ledger. */\nconst OFFSET_FILE = 'stats-share.json';\n/** The machine-global anonymous install id lives here (stable across repos). */\nconst INSTALL_ID_DIR = path.join(os.homedir(), '.vibgrate');\nconst INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, 'install-id');\n/** Give a flush POST a hard ceiling so a hung endpoint never stalls shutdown. */\nconst SEND_TIMEOUT_MS = 4000;\n\n/** One aggregated row of the shared batch — counts only. */\nexport interface StatsRow {\n  source: Source;\n  client: string;\n  tool: string;\n  outcome: Outcome;\n  calls: number;\n  vgTokens: number;\n  baselineTokens: number;\n}\n\n/** The counts-only batch POSTed to the ingest endpoint. */\nexport interface StatsBatch {\n  schemaVersion: string;\n  installId: string;\n  vgVersion: string;\n  os: string;\n  arch: string;\n  windowStart: string;\n  windowEnd: string;\n  totalCalls: number;\n  rows: StatsRow[];\n}\n\n/**\n * The universal opt-out (https://consoledonottrack.com) plus a tool-specific\n * alias, honoured even when `--share-stats` is passed explicitly. Pure function\n * of the environment for testability. Returns the name of the variable that\n * opted out (for the disclosure message), or null when sharing may proceed.\n */\nexport function telemetryOptOut(env: NodeJS.ProcessEnv = process.env): string | null {\n  const dnt = (env.DO_NOT_TRACK ?? '').trim().toLowerCase();\n  if (dnt !== '' && dnt !== '0' && dnt !== 'false') return 'DO_NOT_TRACK';\n  const vt = (env.VIBGRATE_TELEMETRY ?? '').trim().toLowerCase();\n  if (vt === '0' || vt === 'false' || vt === 'off') return 'VIBGRATE_TELEMETRY';\n  return null;\n}\n\n/** Common CI environment markers — a CI runner is never an interactive session. */\nconst CI_ENV_VARS = [\n  'CI',\n  'GITHUB_ACTIONS',\n  'GITLAB_CI',\n  'CIRCLECI',\n  'TRAVIS',\n  'BUILDKITE',\n  'JENKINS_URL',\n  'TF_BUILD',\n] as const;\n\n/** True when running under a recognised CI system. Pure function of the env. */\nexport function isCI(env: NodeJS.ProcessEnv = process.env): boolean {\n  return CI_ENV_VARS.some((v) => {\n    const val = (env[v] ?? '').trim().toLowerCase();\n    return val !== '' && val !== '0' && val !== 'false';\n  });\n}\n\n/**\n * Read (or lazily create) the anonymous per-install id — a random UUID stored in\n * `~/.vibgrate/install-id`. It is *not* tied to the user, the repo, or any\n * account; it only lets us de-duplicate batches from the same install when\n * aggregating. If the home dir isn't writable we fall back to an ephemeral id\n * so sharing still works (it just can't be de-duplicated across restarts).\n *\n * Under an env opt-out no id is ever read or persisted (the sharing path isn't\n * reached then either — this is defence in depth), and on CI runners the id is\n * ephemeral: a persisted id on a shared/throwaway runner would be meaningless\n * for de-duplication and would leave state behind on machines we don't own.\n */\nexport function installId(env: NodeJS.ProcessEnv = process.env): string {\n  if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();\n  try {\n    const existing = fs.readFileSync(INSTALL_ID_FILE, 'utf8').trim();\n    if (isUuid(existing)) return existing;\n  } catch {\n    /* not created yet */\n  }\n  const id = randomUuid();\n  try {\n    fs.mkdirSync(INSTALL_ID_DIR, { recursive: true });\n    fs.writeFileSync(INSTALL_ID_FILE, id + '\\n', { mode: 0o600 });\n  } catch {\n    /* home dir read-only — use the ephemeral id for this process */\n  }\n  return id;\n}\n\nfunction isUuid(s: string): boolean {\n  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);\n}\n\nfunction randomUuid(): string {\n  return randomUUID();\n}\n\n/** Resolve the ingest endpoint: env override wins, else the default region host. */\nexport function statsEndpoint(): string {\n  const override = process.env.VIBGRATE_STATS_ENDPOINT;\n  if (override && /^https?:\\/\\//.test(override)) return override;\n  return `https://${resolveIngestHost()}/v1/ingest/cli-mcp-usage`;\n}\n\nfunction offsetPath(root: string): string {\n  return path.join(cacheDir(root), OFFSET_FILE);\n}\n\nfunction ledgerFilePath(root: string): string {\n  return path.join(cacheDir(root), 'savings.jsonl');\n}\n\nfunction readOffset(root: string): number {\n  try {\n    const raw = JSON.parse(fs.readFileSync(offsetPath(root), 'utf8')) as { offset?: number };\n    return typeof raw.offset === 'number' && raw.offset >= 0 ? raw.offset : 0;\n  } catch {\n    return 0;\n  }\n}\n\nfunction writeOffset(root: string, offset: number): void {\n  try {\n    fs.mkdirSync(cacheDir(root), { recursive: true });\n    fs.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + '\\n');\n  } catch {\n    /* best-effort; a lost offset just means one batch may re-send */\n  }\n}\n\n/**\n * Aggregate the ledger entries after `fromOffset` into a counts-only batch.\n * Returns the batch (or null if there's nothing new) and the new byte offset to\n * persist once the batch is confirmed sent.\n */\nexport function buildBatch(\n  root: string,\n  fromOffset: number,\n  id = installId(),\n): { batch: StatsBatch | null; newOffset: number } {\n  const file = ledgerFilePath(root);\n  let size = 0;\n  try {\n    size = fs.statSync(file).size;\n  } catch {\n    return { batch: null, newOffset: 0 };\n  }\n  // The ledger was truncated/recreated under us — re-read from the top.\n  const start = fromOffset > size ? 0 : fromOffset;\n  if (start >= size) return { batch: null, newOffset: size };\n\n  let text = '';\n  try {\n    const fd = fs.openSync(file, 'r');\n    try {\n      const buf = Buffer.alloc(size - start);\n      fs.readSync(fd, buf, 0, buf.length, start);\n      text = buf.toString('utf8');\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return { batch: null, newOffset: fromOffset };\n  }\n\n  // Only whole lines are complete; a trailing partial line (mid-append) is left\n  // for the next flush by rewinding the offset to the last newline.\n  const lastNl = text.lastIndexOf('\\n');\n  if (lastNl < 0) return { batch: null, newOffset: start };\n  const consumed = start + lastNl + 1;\n  const rows = new Map<string, StatsRow>();\n  let total = 0;\n  let minTs = Infinity;\n  let maxTs = -Infinity;\n  for (const line of text.slice(0, lastNl).split('\\n')) {\n    if (!line.trim()) continue;\n    let e: SavingEntry;\n    try {\n      e = JSON.parse(line) as SavingEntry;\n    } catch {\n      continue;\n    }\n    const source: Source = e.source ?? 'mcp';\n    const client = e.client ?? 'unknown';\n    const outcome: Outcome = e.outcome ?? 'complete';\n    const key = `${source}|${client}|${e.tool}|${outcome}`;\n    const row = rows.get(key) ?? {\n      source,\n      client,\n      tool: e.tool,\n      outcome,\n      calls: 0,\n      vgTokens: 0,\n      baselineTokens: 0,\n    };\n    row.calls++;\n    row.vgTokens += e.vgTokens ?? 0;\n    row.baselineTokens += e.baselineTokens ?? 0;\n    rows.set(key, row);\n    total++;\n    if (typeof e.ts === 'number') {\n      if (e.ts < minTs) minTs = e.ts;\n      if (e.ts > maxTs) maxTs = e.ts;\n    }\n  }\n  if (total === 0 || !Number.isFinite(minTs)) return { batch: null, newOffset: consumed };\n  const batch: StatsBatch = {\n    schemaVersion: SCHEMA_VERSION,\n    installId: id,\n    vgVersion: VERSION,\n    os: process.platform,\n    arch: process.arch,\n    windowStart: new Date(minTs).toISOString(),\n    windowEnd: new Date(maxTs).toISOString(),\n    totalCalls: total,\n    rows: [...rows.values()],\n  };\n  return { batch, newOffset: consumed };\n}\n\n/**\n * POST a batch to the endpoint. Never throws; returns whether it was accepted.\n * A short timeout keeps a hung endpoint from stalling the caller (e.g. shutdown).\n */\nasync function postBatch(batch: StatsBatch): Promise<boolean> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);\n  timer.unref?.();\n  try {\n    const res = await fetch(statsEndpoint(), {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Connection: 'close' },\n      body: JSON.stringify(batch),\n      signal: controller.signal,\n    });\n    return res.ok;\n  } catch {\n    return false;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Periodic + on-shutdown flusher for one serve session. Holds the install id and\n * the persisted offset so each flush reads only new ledger lines and advances the\n * offset only when the batch is confirmed sent.\n */\nexport class StatsSharer {\n  private readonly id = installId();\n  private offset: number;\n  private flushing = false;\n\n  constructor(private readonly root: string) {\n    this.offset = readOffset(root);\n  }\n\n  /**\n   * Flush any new ledger entries. Single-flight (a slow POST won't overlap the\n   * next tick). Best-effort: any failure is swallowed and retried next time.\n   */\n  async flush(): Promise<void> {\n    if (this.flushing) return;\n    this.flushing = true;\n    try {\n      const { batch, newOffset } = buildBatch(this.root, this.offset, this.id);\n      if (!batch) {\n        // Nothing to send, but still advance past consumed blank/partial space.\n        if (newOffset > this.offset) {\n          this.offset = newOffset;\n          writeOffset(this.root, newOffset);\n        }\n        return;\n      }\n      const ok = await postBatch(batch);\n      if (ok) {\n        this.offset = newOffset;\n        writeOffset(this.root, newOffset);\n      }\n    } catch {\n      /* never let sharing break serving */\n    } finally {\n      this.flushing = false;\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/engine/stats-share.ts"],"names":[],"mappings":";;;;;;;;AAiCA,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAM,WAAA,GAAc,kBAAA;AAEpB,IAAM,cAAA,GAAsB,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,WAAW,CAAA;AAC1D,IAAM,eAAA,GAAuB,IAAA,CAAA,IAAA,CAAK,cAAA,EAAgB,YAAY,CAAA;AAE9D,IAAM,eAAA,GAAkB,GAAA;AAgCjB,SAAS,eAAA,CAAgB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAoB;AACnF,EAAA,MAAM,OAAO,GAAA,CAAI,YAAA,IAAgB,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AACxD,EAAA,IAAI,QAAQ,EAAA,IAAM,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,SAAS,OAAO,cAAA;AACzD,EAAA,MAAM,MAAM,GAAA,CAAI,kBAAA,IAAsB,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAC7D,EAAA,IAAI,OAAO,GAAA,IAAO,EAAA,KAAO,OAAA,IAAW,EAAA,KAAO,OAAO,OAAO,oBAAA;AACzD,EAAA,OAAO,IAAA;AACT;AAGA,IAAM,WAAA,GAAc;AAAA,EAClB,IAAA;AAAA,EACA,gBAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAGO,SAAS,IAAA,CAAK,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAc;AAClE,EAAA,OAAO,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM;AAC7B,IAAA,MAAM,OAAO,GAAA,CAAI,CAAC,KAAK,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAC9C,IAAA,OAAO,GAAA,KAAQ,EAAA,IAAM,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,OAAA;AAAA,EAC9C,CAAC,CAAA;AACH;AAcO,SAAS,SAAA,CAAU,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAa;AACtE,EAAA,IAAI,eAAA,CAAgB,GAAG,CAAA,KAAM,IAAA,IAAQ,KAAK,GAAG,CAAA,SAAU,UAAA,EAAW;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,eAAA,EAAiB,MAAM,EAAE,IAAA,EAAK;AAC/D,IAAA,IAAI,MAAA,CAAO,QAAQ,CAAA,EAAG,OAAO,QAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,MAAM,KAAK,UAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAG,EAAA,CAAA,SAAA,CAAU,cAAA,EAAgB,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,IAAG,iBAAc,eAAA,EAAiB,EAAA,GAAK,MAAM,EAAE,IAAA,EAAM,KAAO,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAA;AACT;AAEA,SAAS,OAAO,CAAA,EAAoB;AAClC,EAAA,OAAO,iEAAA,CAAkE,KAAK,CAAC,CAAA;AACjF;AAEA,SAAS,UAAA,GAAqB;AAC5B,EAAA,OAAO,UAAA,EAAW;AACpB;AAGO,SAAS,aAAA,GAAwB;AACtC,EAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,uBAAA;AAC7B,EAAA,IAAI,QAAA,IAAY,cAAA,CAAe,IAAA,CAAK,QAAQ,GAAG,OAAO,QAAA;AACtD,EAAA,OAAO,CAAA,QAAA,EAAW,mBAAmB,CAAA,wBAAA,CAAA;AACvC;AAEA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG,WAAW,CAAA;AAC9C;AAEA,SAAS,eAAe,IAAA,EAAsB;AAC5C,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG,eAAe,CAAA;AAClD;AAEA,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,WAAW,IAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAChE,IAAA,OAAO,OAAO,IAAI,MAAA,KAAW,QAAA,IAAY,IAAI,MAAA,IAAU,CAAA,GAAI,IAAI,MAAA,GAAS,CAAA;AAAA,EAC1E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAA,CAAY,MAAc,MAAA,EAAsB;AACvD,EAAA,IAAI;AACF,IAAG,aAAU,QAAA,CAAS,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,IAAG,EAAA,CAAA,aAAA,CAAc,UAAA,CAAW,IAAI,CAAA,EAAG,IAAA,CAAK,UAAU,EAAE,MAAA,EAAQ,CAAA,GAAI,IAAI,CAAA;AAAA,EACtE,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAOO,SAAS,UAAA,CACd,IAAA,EACA,UAAA,EACA,EAAA,GAAK,WAAU,EACkC;AACjD,EAAA,MAAM,IAAA,GAAO,eAAe,IAAI,CAAA;AAChC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI;AACF,IAAA,IAAA,GAAU,EAAA,CAAA,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,CAAA,EAAE;AAAA,EACrC;AAEA,EAAA,MAAM,KAAA,GAAQ,UAAA,GAAa,IAAA,GAAO,CAAA,GAAI,UAAA;AACtC,EAAA,IAAI,SAAS,IAAA,EAAM,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,WAAW,IAAA,EAAK;AAEzD,EAAA,IAAI,IAAA,GAAO,EAAA;AACX,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAQ,EAAA,CAAA,QAAA,CAAS,IAAA,EAAM,GAAG,CAAA;AAChC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,IAAA,GAAO,KAAK,CAAA;AACrC,MAAG,YAAS,EAAA,EAAI,GAAA,EAAK,CAAA,EAAG,GAAA,CAAI,QAAQ,KAAK,CAAA;AACzC,MAAA,IAAA,GAAO,GAAA,CAAI,SAAS,MAAM,CAAA;AAAA,IAC5B,CAAA,SAAE;AACA,MAAG,aAAU,EAAE,CAAA;AAAA,IACjB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,UAAA,EAAW;AAAA,EAC9C;AAIA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AACpC,EAAA,IAAI,SAAS,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,WAAW,KAAA,EAAM;AACvD,EAAA,MAAM,QAAA,GAAW,QAAQ,MAAA,GAAS,CAAA;AAClC,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAsB;AACvC,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,QAAA;AACZ,EAAA,IAAI,KAAA,GAAQ,CAAA,QAAA;AACZ,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,EAAG;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,CAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAA,GAAI,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAiB,EAAE,MAAA,IAAU,KAAA;AACnC,IAAA,MAAM,MAAA,GAAS,EAAE,MAAA,IAAU,SAAA;AAC3B,IAAA,MAAM,OAAA,GAAmB,EAAE,OAAA,IAAW,UAAA;AACtC,IAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACpD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,IAAK;AAAA,MAC3B,MAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,OAAA;AAAA,MACA,KAAA,EAAO,CAAA;AAAA,MACP,QAAA,EAAU,CAAA;AAAA,MACV,cAAA,EAAgB;AAAA,KAClB;AACA,IAAA,GAAA,CAAI,KAAA,EAAA;AACJ,IAAA,GAAA,CAAI,QAAA,IAAY,EAAE,QAAA,IAAY,CAAA;AAC9B,IAAA,GAAA,CAAI,cAAA,IAAkB,EAAE,cAAA,IAAkB,CAAA;AAC1C,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,GAAG,CAAA;AACjB,IAAA,KAAA,EAAA;AACA,IAAA,IAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,EAAU;AAC5B,MAAA,IAAI,CAAA,CAAE,EAAA,GAAK,KAAA,EAAO,KAAA,GAAQ,CAAA,CAAE,EAAA;AAC5B,MAAA,IAAI,CAAA,CAAE,EAAA,GAAK,KAAA,EAAO,KAAA,GAAQ,CAAA,CAAE,EAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,IAAI,KAAA,KAAU,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAA,EAAS;AACtF,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,aAAA,EAAe,cAAA;AAAA,IACf,SAAA,EAAW,EAAA;AAAA,IACX,SAAA,EAAW,OAAA;AAAA,IACX,IAAI,OAAA,CAAQ,QAAA;AAAA,IACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,WAAA,EAAa,IAAI,IAAA,CAAK,KAAK,EAAE,WAAA,EAAY;AAAA,IACzC,SAAA,EAAW,IAAI,IAAA,CAAK,KAAK,EAAE,WAAA,EAAY;AAAA,IACvC,UAAA,EAAY,KAAA;AAAA,IACZ,IAAA,EAAM,CAAC,GAAG,IAAA,CAAK,QAAQ;AAAA,GACzB;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,QAAA,EAAS;AACtC;AAMA,eAAe,UAAU,KAAA,EAAqC;AAC5D,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,eAAe,CAAA;AAClE,EAAA,KAAA,CAAM,KAAA,IAAQ;AACd,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAc,EAAG;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,YAAY,OAAA,EAAQ;AAAA,MACnE,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MAC1B,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AACF;AAOO,IAAM,cAAN,MAAkB;AAAA,EAKvB,YAA6B,IAAA,EAAc;AAAd,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAC3B,IAAA,IAAA,CAAK,MAAA,GAAS,WAAW,IAAI,CAAA;AAAA,EAC/B;AAAA,EAF6B,IAAA;AAAA,EAJZ,KAAK,SAAA,EAAU;AAAA,EACxB,MAAA;AAAA,EACA,QAAA,GAAW,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnB,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,KAAA,EAAO,SAAA,EAAU,GAAI,UAAA,CAAW,KAAK,IAAA,EAAM,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,EAAE,CAAA;AACvE,MAAA,IAAI,CAAC,KAAA,EAAO;AAEV,QAAA,IAAI,SAAA,GAAY,KAAK,MAAA,EAAQ;AAC3B,UAAA,IAAA,CAAK,MAAA,GAAS,SAAA;AACd,UAAA,WAAA,CAAY,IAAA,CAAK,MAAM,SAAS,CAAA;AAAA,QAClC;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,EAAA,GAAK,MAAM,SAAA,CAAU,KAAK,CAAA;AAChC,MAAA,IAAI,EAAA,EAAI;AACN,QAAA,IAAA,CAAK,MAAA,GAAS,SAAA;AACd,QAAA,WAAA,CAAY,IAAA,CAAK,MAAM,SAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAAA,IAClB;AAAA,EACF;AACF","file":"chunk-Z7VH4RPO.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { randomUUID } from 'node:crypto';\nimport { cacheDir } from './cache.js';\nimport { VERSION } from '../version.js';\nimport { resolveIngestHost } from '../reporting/regions.js';\nimport type { SavingEntry, Source, Outcome } from './savings.js';\n\n/**\n * Opt-in usage-stats sharing for `vg serve --share-stats`.\n *\n * This is the ONLY path in `vg serve` that sends anything off the machine, and\n * it is off unless the operator explicitly asks for it. What we send is the\n * same counts-only ledger `vg savings` reports locally — per (source, client,\n * tool, outcome): how many calls and the vg-vs-grep token figures — plus the vg\n * version, OS/arch, and a random per-install id. We never send code, file paths,\n * question text, repo identity, or any credential. See GUARDRAILS §3.4.\n *\n * Even when the flag is passed, the universal `DO_NOT_TRACK` opt-out (or\n * `VIBGRATE_TELEMETRY=0`) wins: nothing is uploaded and no install id is ever\n * minted or persisted (see `telemetryOptOut` / `installId`).\n *\n * Design:\n *  - The local ledger (savings.jsonl) is the single source of truth; the flusher\n *    reads only the tail past a persisted byte offset, so a batch is sent once.\n *  - Fire-and-forget with a short timeout. A network problem never blocks a tool\n *    call and never throws — the offset only advances on a confirmed 2xx, so a\n *    failed batch is retried on the next flush.\n *  - Fully offline-safe: under `--local` the sharer is never constructed.\n */\n\n/** Payload schema version — must match the server's `mcpUsageStatsSchema`. */\nconst SCHEMA_VERSION = '1';\n/** Where the offset (and cached install id) live, per repo, beside the ledger. */\nconst OFFSET_FILE = 'stats-share.json';\n/** The machine-global anonymous install id lives here (stable across repos). */\nconst INSTALL_ID_DIR = path.join(os.homedir(), '.vibgrate');\nconst INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, 'install-id');\n/** Give a flush POST a hard ceiling so a hung endpoint never stalls shutdown. */\nconst SEND_TIMEOUT_MS = 4000;\n\n/** One aggregated row of the shared batch — counts only. */\nexport interface StatsRow {\n  source: Source;\n  client: string;\n  tool: string;\n  outcome: Outcome;\n  calls: number;\n  vgTokens: number;\n  baselineTokens: number;\n}\n\n/** The counts-only batch POSTed to the ingest endpoint. */\nexport interface StatsBatch {\n  schemaVersion: string;\n  installId: string;\n  vgVersion: string;\n  os: string;\n  arch: string;\n  windowStart: string;\n  windowEnd: string;\n  totalCalls: number;\n  rows: StatsRow[];\n}\n\n/**\n * The universal opt-out (https://consoledonottrack.com) plus a tool-specific\n * alias, honoured even when `--share-stats` is passed explicitly. Pure function\n * of the environment for testability. Returns the name of the variable that\n * opted out (for the disclosure message), or null when sharing may proceed.\n */\nexport function telemetryOptOut(env: NodeJS.ProcessEnv = process.env): string | null {\n  const dnt = (env.DO_NOT_TRACK ?? '').trim().toLowerCase();\n  if (dnt !== '' && dnt !== '0' && dnt !== 'false') return 'DO_NOT_TRACK';\n  const vt = (env.VIBGRATE_TELEMETRY ?? '').trim().toLowerCase();\n  if (vt === '0' || vt === 'false' || vt === 'off') return 'VIBGRATE_TELEMETRY';\n  return null;\n}\n\n/** Common CI environment markers — a CI runner is never an interactive session. */\nconst CI_ENV_VARS = [\n  'CI',\n  'GITHUB_ACTIONS',\n  'GITLAB_CI',\n  'CIRCLECI',\n  'TRAVIS',\n  'BUILDKITE',\n  'JENKINS_URL',\n  'TF_BUILD',\n] as const;\n\n/** True when running under a recognised CI system. Pure function of the env. */\nexport function isCI(env: NodeJS.ProcessEnv = process.env): boolean {\n  return CI_ENV_VARS.some((v) => {\n    const val = (env[v] ?? '').trim().toLowerCase();\n    return val !== '' && val !== '0' && val !== 'false';\n  });\n}\n\n/**\n * Read (or lazily create) the anonymous per-install id — a random UUID stored in\n * `~/.vibgrate/install-id`. It is *not* tied to the user, the repo, or any\n * account; it only lets us de-duplicate batches from the same install when\n * aggregating. If the home dir isn't writable we fall back to an ephemeral id\n * so sharing still works (it just can't be de-duplicated across restarts).\n *\n * Under an env opt-out no id is ever read or persisted (the sharing path isn't\n * reached then either — this is defence in depth), and on CI runners the id is\n * ephemeral: a persisted id on a shared/throwaway runner would be meaningless\n * for de-duplication and would leave state behind on machines we don't own.\n */\nexport function installId(env: NodeJS.ProcessEnv = process.env): string {\n  if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();\n  try {\n    const existing = fs.readFileSync(INSTALL_ID_FILE, 'utf8').trim();\n    if (isUuid(existing)) return existing;\n  } catch {\n    /* not created yet */\n  }\n  const id = randomUuid();\n  try {\n    fs.mkdirSync(INSTALL_ID_DIR, { recursive: true });\n    fs.writeFileSync(INSTALL_ID_FILE, id + '\\n', { mode: 0o600 });\n  } catch {\n    /* home dir read-only — use the ephemeral id for this process */\n  }\n  return id;\n}\n\nfunction isUuid(s: string): boolean {\n  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);\n}\n\nfunction randomUuid(): string {\n  return randomUUID();\n}\n\n/** Resolve the ingest endpoint: env override wins, else the default region host. */\nexport function statsEndpoint(): string {\n  const override = process.env.VIBGRATE_STATS_ENDPOINT;\n  if (override && /^https?:\\/\\//.test(override)) return override;\n  return `https://${resolveIngestHost()}/v1/ingest/cli-mcp-usage`;\n}\n\nfunction offsetPath(root: string): string {\n  return path.join(cacheDir(root), OFFSET_FILE);\n}\n\nfunction ledgerFilePath(root: string): string {\n  return path.join(cacheDir(root), 'savings.jsonl');\n}\n\nfunction readOffset(root: string): number {\n  try {\n    const raw = JSON.parse(fs.readFileSync(offsetPath(root), 'utf8')) as { offset?: number };\n    return typeof raw.offset === 'number' && raw.offset >= 0 ? raw.offset : 0;\n  } catch {\n    return 0;\n  }\n}\n\nfunction writeOffset(root: string, offset: number): void {\n  try {\n    fs.mkdirSync(cacheDir(root), { recursive: true });\n    fs.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + '\\n');\n  } catch {\n    /* best-effort; a lost offset just means one batch may re-send */\n  }\n}\n\n/**\n * Aggregate the ledger entries after `fromOffset` into a counts-only batch.\n * Returns the batch (or null if there's nothing new) and the new byte offset to\n * persist once the batch is confirmed sent.\n */\nexport function buildBatch(\n  root: string,\n  fromOffset: number,\n  id = installId(),\n): { batch: StatsBatch | null; newOffset: number } {\n  const file = ledgerFilePath(root);\n  let size = 0;\n  try {\n    size = fs.statSync(file).size;\n  } catch {\n    return { batch: null, newOffset: 0 };\n  }\n  // The ledger was truncated/recreated under us — re-read from the top.\n  const start = fromOffset > size ? 0 : fromOffset;\n  if (start >= size) return { batch: null, newOffset: size };\n\n  let text = '';\n  try {\n    const fd = fs.openSync(file, 'r');\n    try {\n      const buf = Buffer.alloc(size - start);\n      fs.readSync(fd, buf, 0, buf.length, start);\n      text = buf.toString('utf8');\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return { batch: null, newOffset: fromOffset };\n  }\n\n  // Only whole lines are complete; a trailing partial line (mid-append) is left\n  // for the next flush by rewinding the offset to the last newline.\n  const lastNl = text.lastIndexOf('\\n');\n  if (lastNl < 0) return { batch: null, newOffset: start };\n  const consumed = start + lastNl + 1;\n  const rows = new Map<string, StatsRow>();\n  let total = 0;\n  let minTs = Infinity;\n  let maxTs = -Infinity;\n  for (const line of text.slice(0, lastNl).split('\\n')) {\n    if (!line.trim()) continue;\n    let e: SavingEntry;\n    try {\n      e = JSON.parse(line) as SavingEntry;\n    } catch {\n      continue;\n    }\n    const source: Source = e.source ?? 'mcp';\n    const client = e.client ?? 'unknown';\n    const outcome: Outcome = e.outcome ?? 'complete';\n    const key = `${source}|${client}|${e.tool}|${outcome}`;\n    const row = rows.get(key) ?? {\n      source,\n      client,\n      tool: e.tool,\n      outcome,\n      calls: 0,\n      vgTokens: 0,\n      baselineTokens: 0,\n    };\n    row.calls++;\n    row.vgTokens += e.vgTokens ?? 0;\n    row.baselineTokens += e.baselineTokens ?? 0;\n    rows.set(key, row);\n    total++;\n    if (typeof e.ts === 'number') {\n      if (e.ts < minTs) minTs = e.ts;\n      if (e.ts > maxTs) maxTs = e.ts;\n    }\n  }\n  if (total === 0 || !Number.isFinite(minTs)) return { batch: null, newOffset: consumed };\n  const batch: StatsBatch = {\n    schemaVersion: SCHEMA_VERSION,\n    installId: id,\n    vgVersion: VERSION,\n    os: process.platform,\n    arch: process.arch,\n    windowStart: new Date(minTs).toISOString(),\n    windowEnd: new Date(maxTs).toISOString(),\n    totalCalls: total,\n    rows: [...rows.values()],\n  };\n  return { batch, newOffset: consumed };\n}\n\n/**\n * POST a batch to the endpoint. Never throws; returns whether it was accepted.\n * A short timeout keeps a hung endpoint from stalling the caller (e.g. shutdown).\n */\nasync function postBatch(batch: StatsBatch): Promise<boolean> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), SEND_TIMEOUT_MS);\n  timer.unref?.();\n  try {\n    const res = await fetch(statsEndpoint(), {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Connection: 'close' },\n      body: JSON.stringify(batch),\n      signal: controller.signal,\n    });\n    return res.ok;\n  } catch {\n    return false;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Periodic + on-shutdown flusher for one serve session. Holds the install id and\n * the persisted offset so each flush reads only new ledger lines and advances the\n * offset only when the batch is confirmed sent.\n */\nexport class StatsSharer {\n  private readonly id = installId();\n  private offset: number;\n  private flushing = false;\n\n  constructor(private readonly root: string) {\n    this.offset = readOffset(root);\n  }\n\n  /**\n   * Flush any new ledger entries. Single-flight (a slow POST won't overlap the\n   * next tick). Best-effort: any failure is swallowed and retried next time.\n   */\n  async flush(): Promise<void> {\n    if (this.flushing) return;\n    this.flushing = true;\n    try {\n      const { batch, newOffset } = buildBatch(this.root, this.offset, this.id);\n      if (!batch) {\n        // Nothing to send, but still advance past consumed blank/partial space.\n        if (newOffset > this.offset) {\n          this.offset = newOffset;\n          writeOffset(this.root, newOffset);\n        }\n        return;\n      }\n      const ok = await postBatch(batch);\n      if (ok) {\n        this.offset = newOffset;\n        writeOffset(this.root, newOffset);\n      }\n    } catch {\n      /* never let sharing break serving */\n    } finally {\n      this.flushing = false;\n    }\n  }\n}\n"]}

package/dist/cli.d.ts

@@ -50,7 +50,11 @@ interface BuildCmdOpts {
     attestation?: string;
     pub?: string;
 }
-declare function runBuild(paths: string[], opts: BuildCmdOpts, global: GlobalOpts): Promise<void>;
+interface RunBuildHooks {
+    /** Invoked during the parse phase (even under --quiet / non-TTY hosts). */
+    onParseProgress?: (done: number, total: number) => void;
+}
+declare function runBuild(paths: string[], opts: BuildCmdOpts, global: GlobalOpts, hooks?: RunBuildHooks): Promise<void>;
 
 /** The set of registered subcommand names (kept in sync with registration). */
 declare const KNOWN_COMMANDS: Set<string>;

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-T7OFJS3X.js';
-export { runBuild } from './chunk-T7OFJS3X.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-CWB6H553.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-GPDJOCUI.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-FF5ZQ6KI.js';
+import { fetchCatalog, resolveProviders } from './chunk-BMUTNUB7.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-WK52LWRX.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-Z7VH4RPO.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
-import { runCodeSession } from './chunk-WBMMRERH.js';
+import { runCodeSession } from './chunk-KLO2XBUX.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-LTTVCI5C.js';
+export { runBuild } from './chunk-LTTVCI5C.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-3NP2DO4G.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -15,23 +16,24 @@ import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-EVLS2M5G.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-X634FZVG.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-KGWEBM2J.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-3VSU7G75.js';
 import './chunk-543E6WDJ.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-MYM5VIJ4.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-TRKRRX2S.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
 import './chunk-RGEVBSLK.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import './chunk-7AVYKZEM.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-J3BQ7FIT.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-SKIMUFCI.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-C22ZY3FV.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-B6S2DSBS.js';
+import { refreshIfStale } from './chunk-5XIEVZLW.js';
+import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-5IA2TA57.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-RIWLXMMT.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-XRN7DQGR.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-UVMP7DFF.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-FHJBGPJZ.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
 import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-EETK7S43.js';
@@ -39,14 +41,14 @@ import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { loadGraph, SCHEMA_VERSION } from './chunk-476KWSFM.js';
-import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-DXSEG6SZ.js';
-import { VERSION } from './chunk-2XTPGYR2.js';
+import { loadGraph, SCHEMA_VERSION } from './chunk-MOLBANFB.js';
+import { resolveGraphPath, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-AVCBKQKA.js';
+import { VERSION } from './chunk-DEKGSQHL.js';
 import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
-import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-NJT4CA6K.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIVRI.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs7 from 'fs';
 import fs7__default, { realpathSync } from 'fs';
@@ -1707,7 +1709,7 @@ function manifestHash(root2) {
     for (const entry of entries) {
       const abs = path37.join(dir, entry.name);
       if (entry.isDirectory()) {
-        if (SKIP_DIRS.has(entry.name)) continue;
+        if (isSkippedDirName(entry.name)) continue;
         walk2(abs);
         continue;
       }
@@ -1729,7 +1731,7 @@ function isDependencyFile(root2, filePath) {
   const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
   if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
   const parts = rel.split(path37.sep);
-  if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
+  if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
 }
@@ -2220,10 +2222,14 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
       else if (r.source === "error") anyError = true;
       const locations = t.locations.length ? t.locations : t.file ? [{ file: t.file, line: t.line ?? null }] : [];
       const seenIds = /* @__PURE__ */ new Set();
+      const seenCves = /* @__PURE__ */ new Set();
       for (const v of r.vulns) {
         if (seenIds.has(v.id)) continue;
+        const cveKeys = (v.cves ?? []).map((c2) => c2.toUpperCase()).filter(Boolean);
+        if (cveKeys.length && cveKeys.every((c2) => seenCves.has(c2))) continue;
         seenIds.add(v.id);
-        const kevHit = v.cves.some((c2) => kev.cves.has(c2.toUpperCase()));
+        for (const c2 of cveKeys) seenCves.add(c2);
+        const kevHit = cveKeys.some((c2) => kev.cves.has(c2));
         findings.push({
           package: t.package,
           version: t.version,
@@ -2482,7 +2488,7 @@ var VibgrateLanguageServer = class {
       rootPath: a.rootPath,
       scannedAt: a.timestamp,
       ...delta !== void 0 ? { delta } : {},
-      ...buildBreakdown(a.drift, a.projects ?? []) ? { breakdown: buildBreakdown(a.drift, a.projects ?? []) } : {},
+      ...buildBreakdown(this.opts.root, a.projects ?? []) ? { breakdown: buildBreakdown(this.opts.root, a.projects ?? []) } : {},
       ...buildEolHorizon(a.projects ?? []) ? { eolHorizon: buildEolHorizon(a.projects ?? []) } : {},
       ...buildProjectRefs(this.opts.root, a.projects ?? []) ? { projects: buildProjectRefs(this.opts.root, a.projects ?? []) } : {}
     };
@@ -2790,7 +2796,11 @@ function isPrunedWorkspacePath(relPath) {
   if (!relPath || relPath === "." || relPath === "") return false;
   const parts = relPath.split(/[/\\]/).filter(Boolean);
   if (parts.includes(".claude")) return true;
-  return parts.some((p) => SKIP_DIRS.has(p));
+  return parts.some((p) => {
+    if (SKIP_DIRS.has(p)) return true;
+    if (p.startsWith(".venv") || p.startsWith("venv-") || p === "site-packages") return true;
+    return false;
+  });
 }
 function pruneArtifactProjects(a) {
   const projects = (a.projects ?? []).filter(
@@ -2814,22 +2824,34 @@ function projectByPath(a, projectPath) {
 }
 function buildProjectRefs(rootDir, projects) {
   if (projects.length === 0) return void 0;
-  return projects.map((p) => {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const p of projects) {
     const rel = p.path === "" ? "." : p.path;
-    const base = rel === "." ? "." : path37.basename(rel);
+    const prev = byPath.get(rel);
+    if (!prev) {
+      byPath.set(rel, p);
+      continue;
+    }
+    if (!prev.drift && p.drift) byPath.set(rel, p);
+  }
+  const refs = [];
+  for (const [rel, p] of byPath) {
+    if (!p.drift) continue;
     const lockfilePath = lockfileRelativePath(rootDir, p);
-    return {
+    refs.push({
       path: rel,
-      name: p.name || base,
+      // Full relative path for display/identity; package name alone collides
+      // across nested fixtures (e.g. two "mcp" leaves).
+      name: rel,
       manifestPath: manifestRelativePath(p),
       ...lockfilePath ? { lockfilePath } : {},
-      ...p.drift ? {
-        score: p.drift.score,
-        band: p.drift.riskLevel ?? "low",
-        mode: p.drift.mode ?? "verified"
-      } : {}
-    };
-  }).sort((a, b) => a.path.localeCompare(b.path));
+      score: p.drift.score,
+      band: p.drift.riskLevel ?? "low",
+      mode: p.drift.mode ?? "verified"
+    });
+  }
+  refs.sort((a, b) => a.path.localeCompare(b.path));
+  return refs.length > 0 ? refs : void 0;
 }
 function projectForFile(root2, a, filePath) {
   const dir = path37.dirname(path37.resolve(filePath));
@@ -2878,7 +2900,7 @@ function scoreForProject(rootDir, a, proj) {
     counts: { behind, eol, unmaintained, total },
     rootPath: proj.path === "" ? "." : proj.path,
     scannedAt: a.timestamp,
-    ...buildBreakdown(proj.drift, [proj]) ? { breakdown: buildBreakdown(proj.drift, [proj]) } : {},
+    ...buildBreakdown(rootDir, [proj]) ? { breakdown: buildBreakdown(rootDir, [proj]) } : {},
     ...buildEolHorizon([proj]) ? { eolHorizon: buildEolHorizon([proj]) } : {},
     ...buildProjectRefs(rootDir, a.projects ?? []) ? { projects: buildProjectRefs(rootDir, a.projects ?? []) } : {}
   };
@@ -2909,17 +2931,52 @@ function bandForScore(n) {
   if (n <= 60) return "moderate";
   return "high";
 }
-function buildBreakdown(_drift, projects) {
+function buildBreakdown(rootDir, projects) {
   const byPkg = /* @__PURE__ */ new Map();
   for (const p of projects) {
+    const relManifest = manifestRelativePath(p);
+    if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
+    const absManifest = path37.resolve(rootDir, relManifest);
+    let text = null;
+    try {
+      if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
+    } catch {
+      text = null;
+    }
+    const kind = manifestKind(absManifest);
     for (const d of p.dependencies ?? []) {
-      if (!byPkg.has(d.package)) byPkg.set(d.package, { row: d, ecosystem });
+      let line = null;
+      if (text && kind !== "unknown") {
+        const l = findPackageLine(text, d.package, kind);
+        if (l >= 0) line = l + 1;
+      }
+      const loc = { file: relManifest, line };
+      const existing = byPkg.get(d.package);
+      if (!existing) {
+        byPkg.set(d.package, { row: d, ecosystem, locations: [loc] });
+        continue;
+      }
+      if (!existing.locations.some((x) => x.file === loc.file && x.line === loc.line)) {
+        existing.locations.push(loc);
+      }
+      const prev = perDependencyDrift(existing.row, {
+        unsupported: existing.row.unsupported === true,
+        abandoned: existing.row.abandoned === true
+      });
+      const next2 = perDependencyDrift(d, {
+        unsupported: d.unsupported === true,
+        abandoned: d.abandoned === true
+      });
+      if (!next2.excluded && (prev.excluded || next2.drift > prev.drift)) {
+        existing.row = d;
+        if (ecosystem) existing.ecosystem = ecosystem;
+      }
     }
   }
   if (byPkg.size === 0) return void 0;
   const items = [];
-  for (const [, { row, ecosystem }] of byPkg) {
+  for (const [, { row, ecosystem, locations }] of byPkg) {
     const scored = perDependencyDrift(row, {
       unsupported: row.unsupported === true,
       abandoned: row.abandoned === true
@@ -2939,7 +2996,8 @@ function buildBreakdown(_drift, projects) {
       mode: scored.mode,
       unsupported: scored.unsupported || row.unsupported === true,
       abandoned: scored.flags.includes("abandoned-floor") || row.abandoned === true,
-      flags: scored.flags
+      flags: scored.flags,
+      locations
     });
   }
   items.sort((a, b) => b.drift - a.drift || a.package.localeCompare(b.package));
@@ -3225,7 +3283,7 @@ function hoverMarkdown(dep, contribution) {
       majorsBehind: dep.majorsBehind ?? 0
     });
     const explainUri = commandUri("vibgrate.explain", { package: dep.package });
-    lines.push(`[Route this fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
+    lines.push(`[Fix \u2192](${routeFixUri}) \xB7 [Explain this drift](${explainUri})`);
   }
   lines.push("");
   lines.push("---");
@@ -3298,12 +3356,24 @@ function registerInstall(program) {
         return;
       }
       if (global.json) {
-        json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
+        json(
+          ASSISTANTS.map((a) => ({
+            id: a.id,
+            label: a.label,
+            mcp: !!a.mcp,
+            skill: !!a.skill,
+            nudge: !!a.nudge,
+            installed: isAssistantInstalled(a, root2)
+          }))
+        );
       } else {
         info(`${c.cyan("vg install")} \xB7 supported assistants`);
         const pad4 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
         for (const a of ASSISTANTS) {
-          info(`  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
+          const on = isAssistantInstalled(a, root2) ? c.green("on") : c.dim("off");
+          info(
+            `  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${on}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`
+          );
         }
       }
       return;
@@ -6289,7 +6359,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
+        const { loadGraph: loadGraph2 } = await import('./load-WA53B3GW.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6373,7 +6443,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-V6IRYZTA.js');
+      const { runInteractive } = await import('./interactive-QWT7ERXJ.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6402,6 +6472,40 @@ function registerCode(program) {
       return;
     }
     if (!instruction) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
+    {
+      const { ensureCodeMap } = await import('./ensure-map-UQL7SM34.js');
+      const mapRoot = rootOf(global);
+      try {
+        await ensureCodeMap(mapRoot, global, {
+          onProgress: (p) => {
+            if (opts.streamJson) {
+              process.stdout.write(
+                JSON.stringify({
+                  event: "event",
+                  type: "map_build",
+                  phase: p.phase,
+                  message: p.message,
+                  ...p.pct != null ? { pct: p.pct } : {}
+                }) + "\n"
+              );
+              return;
+            }
+            if (!global.json && !global.quiet && (p.phase === "start" || p.phase === "done")) {
+              info(c.dim(`vg code \xB7 ${p.message}`));
+            }
+          }
+        });
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (opts.streamJson) {
+          process.stdout.write(
+            JSON.stringify({ event: "error", message: `Could not build the code map: ${msg}` }) + "\n"
+          );
+          return;
+        }
+        throw e;
+      }
+    }
     const { root: root2, graph } = requireGraph(global);
     let mockReply;
     if (opts.mock) {
@@ -6454,20 +6558,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-TZ53G67B.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-J2IDIVYI.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3YOPU3LF.js');
-        const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-TSGYC2MQ.js');
+        const { nodeCodeFs } = await import('./session-L7SJNE55.js');
         const readline5 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-52P2Y5LX.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-PNR7UKLL.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6525,7 +6629,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-IFAXEQMZ.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6599,7 +6703,8 @@ ${res.stderr}` : ""),
           capsule,
           files: opts.file.length ? opts.file : void 0,
           worktreeOverlay: true,
-          advancedMode: !capsule,
+          // Full coding agent: free discovery by default. Capsule is context only.
+          advancedMode: true,
           externalTools,
           attribution: {
             client: "vg-code",
@@ -6612,15 +6717,15 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession } = await import('./stream-json-3YOPU3LF.js');
-            const { runAgent: runAgent2 } = await import('./agent-33BMKWJC.js');
+            const { runCodeStreamJsonSession } = await import('./stream-json-TSGYC2MQ.js');
+            const { runAgent: runAgent2 } = await import('./agent-6XOI7RVW.js');
             const {
               loadLatestSession,
               newSession,
               recordTask,
               saveSession,
               summarizeSession
-            } = await import('./session-store-O4XPXKOV.js');
+            } = await import('./session-store-SQECEXUU.js');
             const resumedRecord = opts.continue ? loadLatestSession(root2) : void 0;
             let record = resumedRecord ?? newSession(
               `s${Date.now().toString(36)}`,
@@ -6761,17 +6866,17 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-V6IRYZTA.js');
-      const { nodeCodeFs } = await import('./session-3OBIQLE4.js');
+      const { agentTask } = await import('./interactive-QWT7ERXJ.js');
+      const { nodeCodeFs } = await import('./session-L7SJNE55.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       if (opts.continue) {
-        const { loadLatestSession, summarizeSession } = await import('./session-store-O4XPXKOV.js');
+        const { loadLatestSession, summarizeSession } = await import('./session-store-SQECEXUU.js');
         const prev = loadLatestSession(root2);
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-7NNVIVO7.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-IFAXEQMZ.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6795,11 +6900,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-PZKXBDJT.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-52P2Y5LX.js');
         const { resolveGraphBackend } = await import('./graph-backend-G5Y6QQV4.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-Y2YCN75V.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-PNR7UKLL.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7689,7 +7794,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-KPHH26ND.js');
+      const { loadGraph: loadGraph2 } = await import('./load-WA53B3GW.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -8094,7 +8199,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-4FBHW2X2.js');
+    const { runBaseline } = await import('./baseline-PY6TETA5.js');
     await runBaseline(rootDir);
   }
   console.log("");