@vibgrate/cli 2026.803.4 → 2026.804.1

package/dist/cli.js

@@ -1,37 +1,37 @@
 #!/usr/bin/env node
 import { loadAdvancedScanHook, baselineCommand } from './chunk-Y4JO6LYP.js';
-import { fetchCatalog, resolveProviders } from './chunk-5TS7N7J2.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-4ZMJKR74.js';
+import { fetchCatalog, resolveProviders } from './chunk-4TPTVRVI.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-L4CYXVW2.js';
 import './chunk-IS7VTH2Q.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-UWVFLVZX.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-7BU7CWXC.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-UHLFD7EO.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-TASMCKLD.js';
 import './chunk-543E6WDJ.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
-import { runCodeSession } from './chunk-BUCNKYTW.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-QUI3E3TQ.js';
+import { runCodeSession } from './chunk-XVZMDDU4.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-2U4SXS5U.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-HVHCXM2E.js';
-export { runBuild } from './chunk-HVHCXM2E.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-P63H3DXY.js';
+export { runBuild } from './chunk-P63H3DXY.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-KFK7KCAH.js';
+import './chunk-NAZLPO63.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
-import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt } from './chunk-FAA7RBIG.js';
-import { refreshIfStale } from './chunk-HBQC4XQJ.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-JZGVUH57.js';
-import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-23UPIFRU.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-66B4ZQA3.js';
+import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt } from './chunk-WGIX4S5A.js';
+import { refreshIfStale } from './chunk-A4CGGQJ7.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-CM6OYYBW.js';
+import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-D56WBMAM.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-FJ2ARY3S.js';
 import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-INIULQEP.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
 import './chunk-VIWZ4QT7.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-5WMFX7TY.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-KSFYHT5G.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import './chunk-5I4VSBWQ.js';
@@ -39,15 +39,13 @@ import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIV
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-TVRM57CE.js';
+import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-NGMVIAKI.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, clearModelCache, withTimeout } from './chunk-2A7XCANX.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-537JBQVB.js';
-import { resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, resetRelevanceProviderCache, loadRelevanceProvider, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, relevanceModuleDir, ensureVibgrateGitignore } from './chunk-7TOIESUT.js';
-import { VERSION } from './chunk-FZ5Y4KEI.js';
-import './chunk-4LGDQBYK.js';
-import { cacheDir, serializeGraph, stableStringify, parseGraph } from './chunk-RBMKBYGV.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-B6IBSQHG.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-ZZNNXZYB.js';
+import { cacheDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, resetRelevanceProviderCache, loadRelevanceProvider, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, relevanceModuleDir, parseGraph, ensureVibgrateGitignore } from './chunk-K5GPEWPI.js';
+import { VERSION } from './chunk-B2Y45PCA.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
@@ -392,8 +390,16 @@ function registerEmbed(program) {
 function showWhere(root2, modelId, asJson) {
   const m = modelCacheInfo(modelId);
   const repoCached = embeddingsCached(root2, modelId);
+  const repoPath = embeddingsPath(root2);
   if (asJson) {
-    json({ model: modelId, cacheDir: m.dir, present: m.present, bytes: m.bytes, repoEmbeddings: repoCached });
+    json({
+      model: modelId,
+      cacheDir: m.dir,
+      present: m.present,
+      bytes: m.bytes,
+      repoEmbeddings: repoCached,
+      embeddingsPath: repoPath
+    });
     return;
   }
   info(`${c.cyan("vg embed")} \xB7 model cache`);
@@ -401,7 +407,9 @@ function showWhere(root2, modelId, asJson) {
   info(`  shared at ${m.dir}`);
   info(`            ${m.present ? c.green(`present \xB7 ~${mb(m.bytes)}`) : c.dim("not downloaded yet (fetched on first semantic ask)")}`);
   info(`  this repo ${repoCached ? c.green("embeddings cached") : c.dim("not embedded yet \u2014 run `vg embed`")}`);
-  info(c.dim("  no admin/sudo needed \u2014 the cache is in your home folder, shared across all repos."));
+  info(`            ${c.dim(repoPath)}`);
+  info(c.dim("  no admin/sudo needed \u2014 the model cache is in your home folder, shared across all repos."));
+  info(c.dim("  vectors sit next to the code map (binary `embeddings`), not under .vibgrate/cache/."));
   info(c.dim("  turn off: run with --local \xB7 relocate: XDG_CACHE_HOME=<dir> \xB7 remove: vg embed --clear"));
 }
 function doClear(asJson) {
@@ -2567,8 +2575,10 @@ var VibgrateLanguageServer = class {
     try {
       const cacheKey = { manifestHash: manifestHash(this.opts.root), toolVersion: VERSION, offline: this.opts.offline };
       const cached = force ? null : loadScanCache(this.opts.root, cacheKey);
+      let fromCache = false;
       if (cached) {
         this.artifact = pruneArtifactProjects(cached.artifact);
+        fromCache = true;
       } else {
         const scanOpts = {
           format: "json",
@@ -2583,10 +2593,13 @@ var VibgrateLanguageServer = class {
           vibgrateVersion: VERSION
         };
         const advanced = await loadAdvancedScanHook();
-        this.artifact = pruneArtifactProjects(await runCoreScan(this.opts.root, scanOpts, advanced));
+        this.artifact = pruneArtifactProjects(
+          await runCoreScanSilently(this.opts.root, scanOpts, advanced)
+        );
         writeScanCache(this.opts.root, cacheKey, this.artifact);
       }
       this.publishScore();
+      this.publishScanArtifact(fromCache);
       for (const uri of this.docs.keys()) this.publishForDoc(uri);
     } catch (err) {
       this.conn.notify("window/logMessage", {
@@ -2603,6 +2616,20 @@ var VibgrateLanguageServer = class {
     }
   }
   // ── Publishing ───────────────────────────────────────────────────────────
+  /**
+   * Full scan artifact for Output ▸ Vibgrate Scan. Operational messages stay
+   * on window/logMessage → Output ▸ Vibgrate.
+   */
+  publishScanArtifact(fromCache) {
+    const a = this.artifact;
+    if (!a) return;
+    this.conn.notify("vibgrate/scanArtifact", {
+      json: JSON.stringify(a, null, 2),
+      rootPath: a.rootPath,
+      scannedAt: a.timestamp,
+      ...fromCache ? { fromCache: true } : {}
+    });
+  }
   publishScore() {
     const a = this.artifact;
     if (!a) return;
@@ -2961,6 +2988,25 @@ function uriToPath(uri) {
     return uri;
   }
 }
+async function runCoreScanSilently(root2, opts, advanced) {
+  const realLog = console.log.bind(console);
+  console.log = (...args) => {
+    if (args.length === 1 && typeof args[0] === "string" && looksLikeScanArtifactJson(args[0])) {
+      return;
+    }
+    realLog(...args);
+  };
+  try {
+    return await runCoreScan(root2, opts, advanced);
+  } finally {
+    console.log = realLog;
+  }
+}
+function looksLikeScanArtifactJson(text) {
+  const t = text.trimStart();
+  if (!t.startsWith("{")) return false;
+  return t.includes('"projects"') && (t.includes('"drift"') || t.includes('"timestamp"') || t.includes('"dependencies"'));
+}
 function isPrunedWorkspacePath(relPath) {
   if (!relPath || relPath === "." || relPath === "") return false;
   const parts = relPath.split(/[/\\]/).filter(Boolean);
@@ -6878,7 +6924,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-6KVGUQMU.js');
+        const { loadGraph: loadGraph2 } = await import('./load-VOSNNCOZ.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6963,7 +7009,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-DB7IC3BL.js');
+      const { runInteractive } = await import('./interactive-GQ3O7FKE.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6993,7 +7039,7 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-DZ53QXRT.js');
+      const { ensureCodeMap } = await import('./ensure-map-DNLGAQRQ.js');
       const mapRoot = rootOf(global);
       try {
         await ensureCodeMap(mapRoot, global, {
@@ -7078,20 +7124,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-YOYRC32U.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-I4T5GDQZ.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-3OJCPBWY.js');
-        const { nodeCodeFs } = await import('./session-5WKEACIF.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-WEWVI3DW.js');
+        const { nodeCodeFs } = await import('./session-QUONHFJN.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-XEP7IPGP.js');
-        const { resolveGraphBackend } = await import('./graph-backend-3A2M22QN.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-45HT7NZA.js');
+        const { resolveGraphBackend } = await import('./graph-backend-L7PIG7CS.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-UTLMMPIZ.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-URRPZ7OD.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7149,7 +7195,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PM3C4FQL.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-NOG3D6TL.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -7239,8 +7285,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession } = await import('./stream-json-3OJCPBWY.js');
-            const { runAgent: runAgent2 } = await import('./agent-WYBWUBCC.js');
+            const { runCodeStreamJsonSession } = await import('./stream-json-WEWVI3DW.js');
+            const { runAgent: runAgent2 } = await import('./agent-YDRDDKPE.js');
             const {
               condenseSession,
               loadLatestSession,
@@ -7408,8 +7454,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-DB7IC3BL.js');
-      const { nodeCodeFs } = await import('./session-5WKEACIF.js');
+      const { agentTask } = await import('./interactive-GQ3O7FKE.js');
+      const { nodeCodeFs } = await import('./session-QUONHFJN.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
@@ -7422,7 +7468,7 @@ ${res.stderr}` : ""),
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-PM3C4FQL.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-NOG3D6TL.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -7446,11 +7492,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-XEP7IPGP.js');
-        const { resolveGraphBackend } = await import('./graph-backend-3A2M22QN.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-45HT7NZA.js');
+        const { resolveGraphBackend } = await import('./graph-backend-L7PIG7CS.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-UTLMMPIZ.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-URRPZ7OD.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -8360,7 +8406,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-6KVGUQMU.js');
+      const { loadGraph: loadGraph2 } = await import('./load-VOSNNCOZ.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -8765,7 +8811,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-3HECX4Q6.js');
+    const { runBaseline } = await import('./baseline-IALIGR4A.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -10124,6 +10170,10 @@ async function writeCache(data) {
 
 // src/reporting/commands/update.ts
 var PACKAGE_NAME = "@vibgrate/cli";
+var SCRIPT_PACKAGES = [PACKAGE_NAME, "onnxruntime-node", "msgpackr-extract"];
+function allowScriptsFlag(pm) {
+  return pm === "npm" ? ` --allow-scripts=${SCRIPT_PACKAGES.join(",")}` : "";
+}
 function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd()) {
   if (!execPath) return null;
   let resolved = execPath;
@@ -10180,7 +10230,7 @@ function getGlobalUpdateCommand(pm, pkg, version) {
       return `bun add -g ${spec}`;
     case "npm":
     default:
-      return `npm install -g ${spec}`;
+      return `npm install -g${allowScriptsFlag("npm")} ${spec}`;
   }
 }
 async function detectPackageManager(cwd) {
@@ -10211,8 +10261,10 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
     case "bun":
       return isDev ? `bun add -d ${spec}` : `bun add ${spec}`;
     case "npm":
-    default:
-      return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
+    default: {
+      const allow = allowScriptsFlag("npm");
+      return isDev ? `npm install${allow} --save-dev ${spec}` : `npm install${allow} ${spec}`;
+    }
   }
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
@@ -10316,7 +10368,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-UTLMMPIZ.js');
+    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-URRPZ7OD.js');
     if (!await vgdIsRunning2()) return;
     const loaded = await vgdRequest2({ op: "load-graph", root: cwd });
     if (!loaded.ok || !("repositoryId" in loaded)) return;