@vibgrate/cli 2026.805.2 → 2026.806.2

package/dist/cli.js

@@ -1,37 +1,37 @@
 #!/usr/bin/env node
 import { loadAdvancedScanHook, baselineCommand } from './chunk-Y4JO6LYP.js';
-import { fetchCatalog, resolveProviders } from './chunk-ABJVJUKB.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-3LDQD53S.js';
+import { fetchCatalog, resolveProviders } from './chunk-IQJUFRZZ.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-VTJAPNJO.js';
 import './chunk-IS7VTH2Q.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-L5O6W5EB.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-P64OTAUL.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-6XKDAYYR.js';
+import { runCodeSession } from './chunk-KAOSPAFK.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-I2JNLAKW.js';
 import './chunk-543E6WDJ.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-SI4D7DYF.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
-import { runCodeSession } from './chunk-63QGVU4A.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-2U4SXS5U.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-OAMAINC6.js';
-export { runBuild } from './chunk-OAMAINC6.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-D2VEJHPC.js';
+export { runBuild } from './chunk-D2VEJHPC.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-TFGUYBNC.js';
+import './chunk-HV4CKBXT.js';
 import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
-import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-MDQO4ACI.js';
-import { refreshIfStale } from './chunk-PPXAN2X5.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-4IAKFZVG.js';
-import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-TAV6XEFK.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-TPWMFEIA.js';
+import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-6L6V77HW.js';
+import { refreshIfStale } from './chunk-455ZJQQ4.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-7C5UKIXD.js';
+import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-ZPPDKHGL.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-QDKFGLI3.js';
 import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-INIULQEP.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
 import './chunk-VIWZ4QT7.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-EEZ5HCL2.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-CBPDYYIH.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import './chunk-5I4VSBWQ.js';
@@ -39,21 +39,21 @@ import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIV
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-PZEJ4LHP.js';
+import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-EW2ZMFUC.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-LEESW7CF.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-VETQRKXJ.js';
-import { cacheDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, resetRelevanceProviderCache, loadRelevanceProvider, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, relevanceModuleDir, parseGraph, ensureVibgrateGitignore } from './chunk-ZXQP2GQE.js';
-import { VERSION } from './chunk-54USY7IT.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-KYRH3567.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-SBVZGEOB.js';
+import { cacheDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, resetRelevanceProviderCache, loadRelevanceProvider, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, relevanceModuleDir, parseGraph, ensureVibgrateGitignore } from './chunk-ZMSTSEGR.js';
+import { VERSION } from './chunk-K6MLOGU4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs11 from 'fs';
 import fs11__default, { realpathSync } from 'fs';
-import * as path40 from 'path';
-import path40__default from 'path';
+import * as path41 from 'path';
+import path41__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
@@ -75,10 +75,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root2 = path40.resolve(global.cwd ?? ".");
+  const root2 = path41.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs11.existsSync(path40.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs11.existsSync(path41.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -98,8 +98,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path40.relative(process.cwd(), root2) || ".",
-      graphPath: path40.relative(root2, graphPath),
+      root: path41.relative(process.cwd(), root2) || ".",
+      graphPath: path41.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -114,11 +114,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path40.relative(root2, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path41.relative(root2, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path40.relative(root2, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path41.relative(root2, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -135,7 +135,7 @@ async function runStatus(global) {
   if (vibgrateDir(root2)) ;
 }
 function rootOf(global) {
-  return path40.resolve(global.cwd ?? ".");
+  return path41.resolve(global.cwd ?? ".");
 }
 function requireGraph(global) {
   const root2 = rootOf(global);
@@ -179,7 +179,14 @@ function registerAsk(program) {
         info(c.dim("  preparing semantic search (first use embeds the map; cached, resumable & offline after)\u2026"));
       }
       let reason;
-      const embedder = await loadEmbedder({ local: global.local, onUnavailable: (r) => reason = r });
+      let detail;
+      const embedder = await loadEmbedder({
+        local: global.local,
+        onUnavailable: (r, d) => {
+          reason = r;
+          detail = d;
+        }
+      });
       if (embedder) {
         const bar = !global.json && firstRun ? new ProgressBar(c.dim("embedding")) : void 0;
         const vectors = await getNodeEmbeddings(graph, embedder, root2, bar ? (d, t) => bar.update(d, t) : void 0);
@@ -189,6 +196,7 @@ function registerAsk(program) {
       } else {
         result = queryGraph(graph, q, { budget, relevance, topicTags });
         note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
+        if (detail) note += ` (${detail})`;
       }
     } else {
       result = queryGraph(graph, q, { budget, relevance, topicTags });
@@ -237,11 +245,11 @@ function crashedMessage(signal) {
   return `semantic search is disabled: its native backend (onnxruntime-node, via fastembed) crashed with ${signal} \u2014 using fast lexical search instead. This is almost always an install-script block: npm skips onnxruntime-node's postinstall under allow-scripts/ignore-scripts, so the platform binaries were never downloaded. Reinstall allowing them \u2014 npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
 }
 function defaultCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || path40.join(os.homedir(), ".cache");
-  return path40.join(base, "vibgrate", "models");
+  const base = process.env.XDG_CACHE_HOME || path41.join(os.homedir(), ".cache");
+  return path41.join(base, "vibgrate", "models");
 }
 function verdictPath(dir) {
-  return path40.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
+  return path41.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
 }
 function readVerdict(dir) {
   try {
@@ -260,14 +268,27 @@ function writeVerdict(dir, verdict) {
   } catch {
   }
 }
+function probeModuleUrl(from = import.meta.url) {
+  const dir = path41.dirname(fileURLToPath(from));
+  for (const name of ["embeddings.js", "index.js"]) {
+    const candidate = path41.join(dir, name);
+    if (fs11.existsSync(candidate)) return pathToFileURL(candidate).href;
+  }
+  return pathToFileURL(path41.join(dir, "index.js")).href;
+}
 function defaultRunProbe(timeoutMs) {
-  const moduleUrl = new URL("./embeddings.js", import.meta.url).href;
+  const moduleUrl = probeModuleUrl();
   const script = `
     import(${JSON.stringify(moduleUrl)})
       .then(async (m) => {
+        if (typeof m.loadEmbedder !== 'function') {
+          process.stdout.write('{"ok":false}');
+          return;
+        }
         const e = await m.loadEmbedder({ noDownload: true });
         if (!e) { process.stdout.write('{"ok":false}'); return; }
         await e.embedQuery('probe');
+        await e.embed(['probe document']);
         process.stdout.write('{"ok":true}');
       })
       .catch(() => process.stdout.write('{"ok":false}'));
@@ -350,11 +371,12 @@ function registerEmbed(program) {
     const bg = opts.bg === true;
     const speak = !bg && !global.json;
     if (global.local) {
-      if (speak) info(c.dim("vg embed \xB7 semantic is off (--local) \u2014 lexical search only"));
+      if (global.json) json({ embedded: 0, model: modelId, semantic: false, reason: "local" });
+      else if (speak) info(c.dim("vg embed \xB7 semantic is off (--local) \u2014 lexical search only"));
       return;
     }
     if (countPending(graph, root2, modelId) === 0) {
-      if (global.json) json({ embedded: 0, pending: 0, upToDate: true, model: modelId });
+      if (global.json) json({ embedded: 0, pending: 0, upToDate: true, model: modelId, semantic: true });
       else if (speak) info(`${c.cyan("vg embed")} \xB7 semantic index already up to date`);
       return;
     }
@@ -365,6 +387,7 @@ function registerEmbed(program) {
       return;
     }
     let reason;
+    let detail;
     const embedder = await loadEmbedder({
       local: global.local,
       // Background warm-ups skip the download unless explicitly asked to fetch
@@ -372,17 +395,24 @@ function registerEmbed(program) {
       // time `vg serve`/`vg ask` needs it).
       noDownload: bg && opts.download !== true,
       showDownloadProgress: !bg,
-      onUnavailable: (r) => reason = r
+      onUnavailable: (r, d) => {
+        reason = r;
+        detail = d;
+      }
     });
     if (!embedder) {
-      if (speak && reason) info(c.dim(`vg embed \xB7 ${unavailableMessage(reason)}`));
+      if (global.json) {
+        json({ embedded: 0, model: modelId, semantic: false, reason: reason ?? "init-failed", detail: detail ?? null });
+      } else if (reason) {
+        info(c.dim(`vg embed \xB7 ${unavailableMessage(reason)}${detail ? ` (${detail})` : ""}`));
+      }
       return;
     }
     const pending = countPending(graph, root2, modelId);
     const bar = speak ? new ProgressBar(c.dim("embedding")) : void 0;
     await getNodeEmbeddings(graph, embedder, root2, bar ? (d, t) => bar.update(d, t) : void 0);
     bar?.done();
-    if (global.json) json({ embedded: pending, model: modelId });
+    if (global.json) json({ embedded: pending, model: modelId, semantic: true });
     else if (speak) info(`${c.green("\u2714")} vg embed \xB7 semantic index ready (~${pending} node(s) \xB7 model ${modelId})`);
   });
   applyGlobalOptions(cmd);
@@ -989,7 +1019,7 @@ var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
 function liveStatsDir(root2) {
-  return path40.join(cacheDir(root2), "serve-live");
+  return path41.join(cacheDir(root2), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
@@ -1003,7 +1033,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs11.readFileSync(path40.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs11.readFileSync(path41.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1025,7 +1055,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path40.join(dir, `serve-${this.pid}.json`);
+    this.file = path41.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1078,7 +1108,7 @@ var LiveStatsBus = class {
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path40.join(this.dir, name);
+      const file = path41.join(this.dir, name);
       let parsed;
       try {
         parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
@@ -1824,7 +1854,7 @@ function endOfLine(text, line) {
 }
 var CACHE_VERSION = "vg-lsp-scan-cache/2";
 function cachePath(root2) {
-  return path40.join(cacheDir(root2), "lsp-scan.json");
+  return path41.join(cacheDir(root2), "lsp-scan.json");
 }
 function manifestHash(root2) {
   const files = [];
@@ -1836,7 +1866,7 @@ function manifestHash(root2) {
       return;
     }
     for (const entry of entries) {
-      const abs = path40.join(dir, entry.name);
+      const abs = path41.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (isSkippedDirName(entry.name)) continue;
         walk2(abs);
@@ -1846,7 +1876,7 @@ function manifestHash(root2) {
       const base = entry.name.toLowerCase();
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
-        const rel = path40.relative(root2, abs).split(path40.sep).join("/");
+        const rel = path41.relative(root2, abs).split(path41.sep).join("/");
         files.push({ rel, hash: hashBytes(fs11.readFileSync(abs)) });
       } catch {
       }
@@ -1857,9 +1887,9 @@ function manifestHash(root2) {
   return hashString(canonicalize(files));
 }
 function isDependencyFile(root2, filePath) {
-  const rel = path40.relative(path40.resolve(root2), path40.resolve(filePath));
-  if (rel === "" || rel.startsWith("..") || path40.isAbsolute(rel)) return false;
-  const parts = rel.split(path40.sep);
+  const rel = path41.relative(path41.resolve(root2), path41.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path41.isAbsolute(rel)) return false;
+  const parts = rel.split(path41.sep);
   if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
@@ -1890,7 +1920,7 @@ function writeScanCache(root2, key2, artifact) {
 var MAX_ENTRIES = 1e3;
 var KEEP_ENTRIES = 500;
 function historyPath(root2) {
-  return path40.join(root2, ".vibgrate", "score-history.jsonl");
+  return path41.join(root2, ".vibgrate", "score-history.jsonl");
 }
 function parseLine(line) {
   try {
@@ -1931,7 +1961,7 @@ function recordScore(root2, entry) {
       }
     }
     const file = historyPath(root2);
-    fs11.mkdirSync(path40.dirname(file), { recursive: true });
+    fs11.mkdirSync(path41.dirname(file), { recursive: true });
     ensureVibgrateGitignore(root2);
     fs11.appendFileSync(file, `${JSON.stringify(entry)}
 `);
@@ -1990,11 +2020,17 @@ async function runAsk(graph, params, ctx) {
     const budgetMs = semanticBudgetMs();
     log(`ask: trying the semantic path (budget ${Math.round(budgetMs / 1e3)}s)`);
     let reason;
+    let detail;
     const started = Date.now();
     try {
       result = await withTimeout(
         (async () => {
-          const embedder = await loadEmbedder({ onUnavailable: (r2) => reason = r2 });
+          const embedder = await loadEmbedder({
+            onUnavailable: (r2, d) => {
+              reason = r2;
+              detail = d;
+            }
+          });
           if (!embedder) return null;
           log(`ask: embedder "${embedder.id}" loaded in ${Date.now() - started}ms; embedding nodes\u2026`);
           const vectors = await getNodeEmbeddings(graph, embedder, ctx.root);
@@ -2008,7 +2044,9 @@ async function runAsk(graph, params, ctx) {
       );
       if (!result) {
         note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
-        log(`ask: semantic unavailable (${reason ?? "no backend"}) \u2014 falling back to lexical`);
+        log(
+          `ask: semantic unavailable (${reason ?? "no backend"}) \u2014 falling back to lexical` + (detail ? ` \xB7 ${detail}` : "")
+        );
       }
     } catch (err) {
       mode = "lexical";
@@ -2902,7 +2940,7 @@ var VibgrateLanguageServer = class {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
       const relManifest = manifestRelativePath(proj);
-      const absManifest = path40.resolve(this.opts.root, relManifest);
+      const absManifest = path41.resolve(this.opts.root, relManifest);
       let text = null;
       try {
         if (fs11.existsSync(absManifest)) text = fs11.readFileSync(absManifest, "utf8");
@@ -3054,9 +3092,9 @@ function pruneArtifactProjects(a) {
   return { ...a, projects, findings };
 }
 function projectByPath(a, projectPath) {
-  const want = path40.normalize(projectPath === "" ? "." : projectPath);
+  const want = path41.normalize(projectPath === "" ? "." : projectPath);
   for (const proj of a.projects ?? []) {
-    const got = path40.normalize(proj.path === "" ? "." : proj.path);
+    const got = path41.normalize(proj.path === "" ? "." : proj.path);
     if (got === want) return proj;
   }
   return void 0;
@@ -3093,12 +3131,12 @@ function buildProjectRefs(rootDir, projects) {
   return refs.length > 0 ? refs : void 0;
 }
 function projectForFile(root2, a, filePath) {
-  const dir = path40.dirname(path40.resolve(filePath));
+  const dir = path41.dirname(path41.resolve(filePath));
   let best;
   let bestLen = -1;
   for (const proj of a.projects ?? []) {
-    const projDir = path40.resolve(root2, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path40.sep)) && projDir.length > bestLen) {
+    const projDir = path41.resolve(root2, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path41.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -3106,7 +3144,7 @@ function projectForFile(root2, a, filePath) {
   return best;
 }
 function sameProject(location, projectPath) {
-  return path40.normalize(location) === path40.normalize(projectPath);
+  return path41.normalize(location) === path41.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -3176,7 +3214,7 @@ function buildBreakdown(rootDir, projects) {
     const relManifest = manifestRelativePath(p);
     if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
-    const absManifest = path40.resolve(rootDir, relManifest);
+    const absManifest = path41.resolve(rootDir, relManifest);
     let text = null;
     try {
       if (fs11.existsSync(absManifest)) text = fs11.readFileSync(absManifest, "utf8");
@@ -3244,34 +3282,34 @@ function buildBreakdown(rootDir, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join30 = (name) => base ? path40.join(base, name) : name;
+  const join31 = (name) => base ? path41.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join30("package.json");
+      return join31("package.json");
     case "python":
-      return join30("pyproject.toml");
+      return join31("pyproject.toml");
     case "go":
-      return join30("go.mod");
+      return join31("go.mod");
     case "rust":
-      return join30("Cargo.toml");
+      return join31("Cargo.toml");
     case "ruby":
-      return join30("Gemfile");
+      return join31("Gemfile");
     case "php":
-      return join30("composer.json");
+      return join31("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join30("pom.xml");
+      return join31("pom.xml");
     case "dotnet":
-      return join30(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join31(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join30("pubspec.yaml");
+      return join31("pubspec.yaml");
     case "elixir":
-      return join30("mix.exs");
+      return join31("mix.exs");
     default:
-      return join30("package.json");
+      return join31("package.json");
   }
 }
 function lockfileRelativePath(rootDir, proj) {
@@ -3302,9 +3340,9 @@ function lockfileRelativePath(rootDir, proj) {
   const dirsToTry = base ? [base, ""] : [""];
   for (const dir of dirsToTry) {
     for (const name of candidateNames) {
-      const rel = dir ? path40.join(dir, name) : name;
+      const rel = dir ? path41.join(dir, name) : name;
       try {
-        if (fs11.existsSync(path40.join(rootDir, rel))) return rel;
+        if (fs11.existsSync(path41.join(rootDir, rel))) return rel;
       } catch {
       }
     }
@@ -3375,7 +3413,7 @@ function lookupImportFiles(map, pkg) {
 }
 function firstPackageMentionLine(root2, relFile, pkg) {
   try {
-    const abs = path40.resolve(root2, relFile);
+    const abs = path41.resolve(root2, relFile);
     const stat2 = fs11.statSync(abs);
     if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
     const text = fs11.readFileSync(abs, "utf8");
@@ -3579,8 +3617,8 @@ function hookCommand(vgBin) {
   return `${vgBin} hook pre-tool-use`;
 }
 function installClaudeHooks(root2, vgBin = "vg") {
-  const file = path40.join(root2, ".claude", "settings.json");
-  const rel = path40.join(".claude", "settings.json");
+  const file = path41.join(root2, ".claude", "settings.json");
+  const rel = path41.join(".claude", "settings.json");
   let settings = {};
   if (fs11.existsSync(file)) {
     try {
@@ -3621,8 +3659,8 @@ function installClaudeHooks(root2, vgBin = "vg") {
   return { file: rel, status: "written" };
 }
 function uninstallClaudeHooks(root2) {
-  const file = path40.join(root2, ".claude", "settings.json");
-  const rel = path40.join(".claude", "settings.json");
+  const file = path41.join(root2, ".claude", "settings.json");
+  const rel = path41.join(".claude", "settings.json");
   if (!fs11.existsSync(file)) return { file: rel, status: "unchanged" };
   let settings;
   try {
@@ -3648,7 +3686,7 @@ function uninstallClaudeHooks(root2) {
   return { file: rel, status: "written" };
 }
 function writeSettings(file, settings) {
-  fs11.mkdirSync(path40.dirname(file), { recursive: true });
+  fs11.mkdirSync(path41.dirname(file), { recursive: true });
   fs11.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
 `);
 }
@@ -3769,7 +3807,7 @@ function registryBase(opts) {
   return (process.env.VIBGRATE_MODULE_REGISTRY || opts.registry || DEFAULT_REGISTRY).replace(/\/+$/, "");
 }
 function stateFile() {
-  return path40.join(path40.dirname(relevanceModuleDir()), "consent.json");
+  return path41.join(path41.dirname(relevanceModuleDir()), "consent.json");
 }
 function readConsent() {
   try {
@@ -3780,7 +3818,7 @@ function readConsent() {
 }
 function writeConsent(state) {
   try {
-    fs11.mkdirSync(path40.dirname(stateFile()), { recursive: true });
+    fs11.mkdirSync(path41.dirname(stateFile()), { recursive: true });
     fs11.writeFileSync(stateFile(), JSON.stringify(state));
   } catch {
   }
@@ -3791,8 +3829,8 @@ function kernelDisabled() {
 }
 function moduleInstalled() {
   try {
-    const meta = JSON.parse(fs11.readFileSync(path40.join(relevanceModuleDir(), ".module.json"), "utf8"));
-    if (fs11.existsSync(path40.join(relevanceModuleDir(), "index.js"))) {
+    const meta = JSON.parse(fs11.readFileSync(path41.join(relevanceModuleDir(), ".module.json"), "utf8"));
+    if (fs11.existsSync(path41.join(relevanceModuleDir(), "index.js"))) {
       return { installed: true, version: meta.version };
     }
   } catch {
@@ -3841,7 +3879,7 @@ function untar(data) {
     if (type !== "0" && type !== "\0") continue;
     const name = pendingName ?? (prefix ? `${prefix}/${rawName}` : rawName);
     pendingName = null;
-    if (name.split("/").includes("..") || path40.isAbsolute(name)) {
+    if (name.split("/").includes("..") || path41.isAbsolute(name)) {
       throw new Error(`unsafe path in tarball: ${name}`);
     }
     out2.push({ name, body: Buffer.from(body) });
@@ -3875,17 +3913,17 @@ async function installRelevanceModule(opts = {}) {
       if (e.name.startsWith("package/dist/")) rel = e.name.slice("package/dist/".length);
       else if (e.name === "package/LICENSE" || e.name === "package/README.md") rel = e.name.slice("package/".length);
       if (!rel) continue;
-      const target = path40.join(dir, rel);
-      if (!target.startsWith(dir + path40.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
-      fs11.mkdirSync(path40.dirname(target), { recursive: true });
+      const target = path41.join(dir, rel);
+      if (!target.startsWith(dir + path41.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
+      fs11.mkdirSync(path41.dirname(target), { recursive: true });
       fs11.writeFileSync(target, e.body);
       wrote += 1;
     }
-    if (!wrote || !fs11.existsSync(path40.join(dir, "index.js"))) {
+    if (!wrote || !fs11.existsSync(path41.join(dir, "index.js"))) {
       fs11.rmSync(dir, { recursive: true, force: true });
       return { status: "unavailable", detail: "package layout not recognized (no dist/index.js)" };
     }
-    fs11.writeFileSync(path40.join(dir, ".module.json"), JSON.stringify({ name: RELEVANCE_MODULE_NAME, version }));
+    fs11.writeFileSync(path41.join(dir, ".module.json"), JSON.stringify({ name: RELEVANCE_MODULE_NAME, version }));
     resetRelevanceProviderCache();
     return { status: "installed", version };
   } catch (e) {
@@ -4044,7 +4082,7 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const gitDir = path40.join(root2, ".git");
+    const gitDir = path41.join(root2, ".git");
     if (!fs11.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
@@ -4066,15 +4104,15 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root2, reports) {
-  const dir = path40.join(root2, ".vibgrate");
+  const dir = path41.join(root2, ".vibgrate");
   fs11.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs11.writeFileSync(path40.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs11.writeFileSync(path41.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
-  const file = path40.join(root2, ".gitattributes");
+  const file = path41.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
   let content = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
@@ -4092,7 +4130,7 @@ function configureMergeDriver(root2) {
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
   fs11.mkdirSync(hooksDir, { recursive: true });
-  const file = path40.join(hooksDir, "pre-commit");
+  const file = path41.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -4114,14 +4152,14 @@ ${content}`;
   fs11.chmodSync(file, 493);
 }
 function undo(root2) {
-  const hookFile = path40.join(hookDir(root2), "pre-commit");
+  const hookFile = path41.join(hookDir(root2), "pre-commit");
   if (fs11.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
     const next2 = fs11.readFileSync(hookFile, "utf8").replace(re, "\n");
     if (next2.trim() === "#!/bin/sh") fs11.rmSync(hookFile);
     else fs11.writeFileSync(hookFile, next2);
   }
-  const attr = path40.join(root2, ".gitattributes");
+  const attr = path41.join(root2, ".gitattributes");
   if (fs11.existsSync(attr)) {
     const next2 = fs11.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
     fs11.writeFileSync(attr, next2);
@@ -4134,10 +4172,10 @@ function undo(root2) {
 function hookDir(root2) {
   try {
     const configured = git(root2, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path40.resolve(root2, configured);
+    if (configured) return path41.resolve(root2, configured);
   } catch {
   }
-  return path40.join(root2, ".git", "hooks");
+  return path41.join(root2, ".git", "hooks");
 }
 function git(root2, args) {
   return execFileSync("git", args, { cwd: root2, encoding: "utf8" });
@@ -4151,7 +4189,7 @@ function registerWatch(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
-    const watchRoots = (paths.length ? paths : ["."]).map((p) => path40.resolve(root2, p));
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path41.resolve(root2, p));
     for (const w of watchRoots) {
       if (!fs11.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
@@ -4219,7 +4257,7 @@ function registerWatch(program) {
         throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
       }
     }
-    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path40.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path41.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
     await new Promise((resolve21) => {
       const stop = () => {
         for (const w of watchers) w.close();
@@ -4552,7 +4590,7 @@ function normalizeStandards(raw) {
 }
 function loadStandards(root2) {
   for (const rel of STANDARDS_FILES) {
-    const p = path40__default.join(root2, rel);
+    const p = path41__default.join(root2, rel);
     let text;
     try {
       text = fs11__default.readFileSync(p, "utf8");
@@ -5273,8 +5311,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path42 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path42);
+  const path43 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path43);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -6638,8 +6676,8 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path40.resolve(opts.out);
-      fs11.mkdirSync(path40.dirname(outPath), { recursive: true });
+      const outPath = path41.resolve(opts.out);
+      fs11.mkdirSync(path41.dirname(outPath), { recursive: true });
       fs11.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
@@ -6789,14 +6827,14 @@ function resolveUninstallTarget(name, runtimeOpt) {
     }
     return exact[0];
   }
-  const base = path40.basename(wantLc);
+  const base = path41.basename(wantLc);
   const soft = fleet.filter((m) => {
     const n = m.name.toLowerCase();
-    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path40.basename(n) === base;
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path41.basename(n) === base;
   });
   if (soft.length === 1) return soft[0];
   if (soft.length > 1) {
-    const baseHits = soft.filter((m) => path40.basename(m.name).toLowerCase() === base);
+    const baseHits = soft.filter((m) => path41.basename(m.name).toLowerCase() === base);
     const pool = baseHits.length ? baseHits : soft;
     const order = ["ollama", "gguf", "lm-studio"];
     for (const rt of order) {
@@ -6834,7 +6872,7 @@ function printBackends(backends) {
   }
 }
 function codeConfigPath(root2) {
-  return path40.join(root2, ".vibgrate", "code.json");
+  return path41.join(root2, ".vibgrate", "code.json");
 }
 function loadCodeConfig(root2) {
   try {
@@ -6916,7 +6954,7 @@ function discoverMcpServers(root2, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path40.join(root2, rel));
+    const found = readMcpServersFile(path41.join(root2, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -6948,7 +6986,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-B6KY2WPG.js');
+        const { loadGraph: loadGraph2 } = await import('./load-QBVKCWZT.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -7033,7 +7071,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-5NXJTODL.js');
+      const { runInteractive } = await import('./interactive-7EZHEBHQ.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -7063,7 +7101,7 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-7L3TPCGA.js');
+      const { ensureCodeMap } = await import('./ensure-map-5E5TFPXJ.js');
       const mapRoot = rootOf(global);
       try {
         await ensureCodeMap(mapRoot, global, {
@@ -7148,20 +7186,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-JO4IIEJJ.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-NQAU6DOA.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-VP6TVWKF.js');
-        const { nodeCodeFs } = await import('./session-KRLJTAK6.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-5WFD6HRO.js');
+        const { nodeCodeFs } = await import('./session-QNSYTLLJ.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-LY3STY7C.js');
-        const { resolveGraphBackend } = await import('./graph-backend-5AMGXUDF.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-ZPGU4PGW.js');
+        const { resolveGraphBackend } = await import('./graph-backend-GQZXMNRI.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-BCBVZ2QA.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-54GEZWBI.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7219,7 +7257,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CT67CXT.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-VTGXA6CO.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -7240,10 +7278,10 @@ ${res.stderr}` : ""),
         }
         const externalTools = mergeExternalToolsets(vgBuiltin, projectMcp);
         const { createCheckpoint } = await import('./checkpoint-4WFZMKEO.js');
-        const os5 = await import('os');
+        const os6 = await import('os');
         const pathMod = await import('path');
         const checkpointIndex = pathMod.join(
-          fs11.mkdtempSync(pathMod.join(os5.tmpdir(), "vg-code-cp-")),
+          fs11.mkdtempSync(pathMod.join(os6.tmpdir(), "vg-code-cp-")),
           "index"
         );
         const gitRunner = (gitArgs, gitEnv) => {
@@ -7279,6 +7317,10 @@ ${res.stderr}` : ""),
           providers: route.providers,
           fsImpl: nodeCodeFs(root2),
           run,
+          // Live command-output events for the VG Code panel (async shell).
+          // Sandboxed executionEnv still uses its own runner when set.
+          streamShell: !executionEnv,
+          allowSubagents: true,
           executionEnv,
           graphBackend,
           modelProfile,
@@ -7309,8 +7351,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession } = await import('./stream-json-VP6TVWKF.js');
-            const { runAgent: runAgent2 } = await import('./agent-PFYXJWWP.js');
+            const { runCodeStreamJsonSession } = await import('./stream-json-5WFD6HRO.js');
+            const { runAgent: runAgent2 } = await import('./agent-DSC3EQLT.js');
             const {
               condenseSession,
               loadLatestSession,
@@ -7478,8 +7520,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-5NXJTODL.js');
-      const { nodeCodeFs } = await import('./session-KRLJTAK6.js');
+      const { agentTask } = await import('./interactive-7EZHEBHQ.js');
+      const { nodeCodeFs } = await import('./session-QNSYTLLJ.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
@@ -7492,7 +7534,7 @@ ${res.stderr}` : ""),
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CT67CXT.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-VTGXA6CO.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -7516,11 +7558,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-LY3STY7C.js');
-        const { resolveGraphBackend } = await import('./graph-backend-5AMGXUDF.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-ZPGU4PGW.js');
+        const { resolveGraphBackend } = await import('./graph-backend-GQZXMNRI.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-BCBVZ2QA.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-54GEZWBI.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7827,7 +7869,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs11__default.readFileSync(path40__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs11__default.readFileSync(path41__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -7850,8 +7892,8 @@ async function publishCmd(root2, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root2) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path40__default.resolve(opts.readme) : path40__default.join(root2, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path40__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path41__default.resolve(opts.readme) : path41__default.join(root2, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path41__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -7983,7 +8025,7 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs11.mkdirSync(path40.dirname(path40.resolve(file)), { recursive: true });
+    fs11.mkdirSync(path41.dirname(path41.resolve(file)), { recursive: true });
     fs11.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
@@ -7994,43 +8036,43 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path40.extname(file));
+  return formatForExt(path41.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const outDir = path40.resolve(root2, opts.out ?? "vg-bundle");
+    const outDir = path41.resolve(root2, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs11.mkdirSync(path40.join(outDir, "grammars"), { recursive: true });
+    fs11.mkdirSync(path41.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs11.copyFileSync(absPath, path40.join(outDir, "grammars", fileName));
+      fs11.copyFileSync(absPath, path41.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
     if (fs11.existsSync(graphSrc)) {
-      fs11.copyFileSync(graphSrc, path40.join(outDir, "graph.json"));
+      fs11.copyFileSync(graphSrc, path41.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs11.writeFileSync(path40.join(outDir, "graph.json"), serializeGraph(graph));
+        fs11.writeFileSync(path41.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
     const cat = catalogPath(root2);
     if (fs11.existsSync(cat)) {
-      fs11.copyFileSync(cat, path40.join(outDir, "vibgrate.lib.json"));
+      fs11.copyFileSync(cat, path41.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
       if (fs11.existsSync(libDir(root2))) {
-        fs11.cpSync(libDir(root2), path40.join(outDir, "lib"), { recursive: true });
+        fs11.cpSync(libDir(root2), path41.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -8042,15 +8084,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs11.writeFileSync(path40.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs11.writeFileSync(path41.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path40.relative(root2, outDir), ...manifest });
+      json({ out: path41.relative(root2, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path40.relative(root2, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path41.relative(root2, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path40.relative(root2, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path41.relative(root2, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -8068,7 +8110,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs11.existsSync(path40.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs11.existsSync(path41.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -8094,13 +8136,13 @@ async function runDoctor(global) {
     root: root2,
     configFile,
     map: {
-      path: path40.relative(root2, graphPath),
+      path: path41.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path40.relative(root2, catalogPath(root2)),
+      path: path41.relative(root2, catalogPath(root2)),
       present: fs11.existsSync(catalogPath(root2)),
       libraries: libCount
     },
@@ -8158,7 +8200,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path40.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path41.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -8352,7 +8394,7 @@ function registerDaemon(program) {
   const register = cmd.command("register").description("register the current repository with a running vgd").argument("[root]", "repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path40.resolve(rootArg ?? rootOf(global));
+    const root2 = path41.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8388,7 +8430,7 @@ function registerDaemon(program) {
   const federation = cmd.command("federation").description("register a multi-root federation from .vibgrate/federation.json (or primary cwd)").argument("[root]", "primary repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const primary = path40.resolve(rootArg ?? rootOf(global));
+    const primary = path41.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8416,7 +8458,7 @@ function registerDaemon(program) {
   const publish = cmd.command("publish").description("load the workspace code map into vgd ActiveGraph (from global/legacy store)").argument("[root]", "repository root (default: cwd)").option("--git-ref <ref>", "branch or SHA (default: detect HEAD)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path40.resolve(rootArg ?? rootOf(global));
+    const root2 = path41.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8430,7 +8472,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-B6KY2WPG.js');
+      const { loadGraph: loadGraph2 } = await import('./load-QBVKCWZT.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -8546,7 +8588,7 @@ function socketOf(cmd) {
   let c2 = cmd;
   while (c2) {
     const opts = c2.opts();
-    if (opts.socket) return path40.resolve(opts.socket);
+    if (opts.socket) return path41.resolve(opts.socket);
     c2 = c2.parent;
   }
   return vgdSocketPath();
@@ -8823,11 +8865,11 @@ function registerLlmHost(program) {
   applyGlobalOptions(cmd);
 }
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path40.resolve(targetPath);
-  const vibgrateDir2 = path40.join(rootDir, ".vibgrate");
+  const rootDir = path41.resolve(targetPath);
+  const vibgrateDir2 = path41.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path40.join(rootDir, "vibgrate.config.ts");
+  const configPath = path41.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -8835,7 +8877,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-7C4F7PBS.js');
+    const { runBaseline } = await import('./baseline-KVCXVZFQ.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8938,7 +8980,7 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path40.join(rootDir, relFile));
+  const content = await readFile3(path41.join(rootDir, relFile));
   if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\b${escaped}\\b`);
@@ -9174,7 +9216,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path40.join(rootDir, file))) {
+      if (await pathExists$1(path41.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -9368,7 +9410,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path40.resolve(targetPath);
+  const rootDir = path41.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -9376,7 +9418,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path40.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path41.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
@@ -9655,11 +9697,11 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path40.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path41.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path40.join(dir, e.name);
+      const abs = path41.join(dir, e.name);
       let mtimeMs;
       try {
         mtimeMs = fs11.statSync(abs).mtimeMs;
@@ -9668,7 +9710,7 @@ function scanStaleness(rootDir, artifactPath) {
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path40.relative(rootDir, abs) || e.name;
+        newestChanged = path41.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -9808,13 +9850,13 @@ function analyzeTree(root2, packages) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path40.join(dir, entry.name), depth + 1);
+        walk2(path41.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path40.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path41.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path40.join(dir, entry.name);
+      const full = path41.join(dir, entry.name);
       let content;
       try {
         if (fs11.statSync(full).size > MAX_FILE_BYTES2) continue;
@@ -10129,7 +10171,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path40.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path41.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -10158,8 +10200,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path40.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path40.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path41.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path41.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -10191,6 +10233,52 @@ async function writeCache(data) {
   } catch {
   }
 }
+var LOCK_ERROR_RE = /\b(EBUSY|EPERM|ETXTBSY|EACCES)\b|resource busy or locked|being used by another process|access is denied/i;
+function isFileLockError(output) {
+  return LOCK_ERROR_RE.test(output);
+}
+function buildDeferredUpdateScript(opts) {
+  const waitSeconds = opts.waitSeconds ?? 120;
+  return [
+    "@echo off",
+    "setlocal",
+    `set "VG_PID=${opts.pid}"`,
+    `set "VG_LOG=${opts.logPath}"`,
+    'echo Waiting for vg (pid %VG_PID%) to exit so its locked files can be replaced...> "%VG_LOG%"',
+    `for /l %%i in (1,1,${waitSeconds}) do (`,
+    '  tasklist /FI "PID eq %VG_PID%" /NH 2>nul | find "%VG_PID%" >nul || goto :run',
+    "  ping -n 2 127.0.0.1 >nul",
+    ")",
+    ":run",
+    `echo Running: ${opts.command}>> "%VG_LOG%"`,
+    `call ${opts.command} >> "%VG_LOG%" 2>&1`,
+    "if errorlevel 1 (",
+    '  echo.>> "%VG_LOG%"',
+    '  echo Update FAILED. See the npm output above.>> "%VG_LOG%"',
+    ") else (",
+    '  echo.>> "%VG_LOG%"',
+    '  echo Update complete.>> "%VG_LOG%"',
+    ")",
+    ""
+  ].join("\r\n");
+}
+function scheduleDeferredUpdate(command, pid = process.pid, dir = os.tmpdir()) {
+  const stamp = `${pid}-${process.hrtime.bigint().toString(36)}`;
+  const scriptPath = path41.join(dir, `vg-update-${stamp}.cmd`);
+  const logPath = path41.join(dir, `vg-update-${stamp}.log`);
+  try {
+    fs11.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
+    const child = spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", scriptPath], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.unref();
+    return { scriptPath, logPath };
+  } catch {
+    return null;
+  }
+}
 
 // src/reporting/commands/update.ts
 var PACKAGE_NAME = "@vibgrate/cli";
@@ -10232,14 +10320,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path40.join(dir, "node_modules") : null;
+        return dir ? path41.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path40.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path41.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
     const root2 = probe.root();
-    if (root2 && await pathExists(path40.join(root2, pkg))) return probe.pm;
+    if (root2 && await pathExists(path41.join(root2, pkg))) return probe.pm;
   }
   return null;
 }
@@ -10258,15 +10346,15 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path40.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path40.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path40.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path41.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path41.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path41.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path40.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path41.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path40.join(cwd, "package.json");
+    const pkgPath = path41.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -10293,7 +10381,7 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path40.join(cwd, "package.json");
+    const pkgPath = path41.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -10303,16 +10391,84 @@ async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   return null;
 }
 async function confirmWorkspaceRoot(pm) {
+  return confirm3(`Update the ${pm} workspace root with -w? [y/N]: `);
+}
+async function confirm3(question) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve21) => {
-    rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
+    rl.question(chalk7.yellow(question), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
       resolve21(t === "y" || t === "yes");
     });
   });
 }
+var CAPTURED_OUTPUT_LIMIT = 64e3;
+async function runInstall(cmd, cwd) {
+  const { spawn: spawn5 } = await import('child_process');
+  return new Promise((resolve21) => {
+    const child = spawn5(cmd, { cwd, shell: true, stdio: ["inherit", "pipe", "pipe"] });
+    let output = "";
+    const tee = (src, dest) => {
+      if (!src) return;
+      src.setEncoding("utf8");
+      src.on("data", (chunk) => {
+        dest.write(chunk);
+        output += chunk;
+        if (output.length > CAPTURED_OUTPUT_LIMIT) output = output.slice(-CAPTURED_OUTPUT_LIMIT);
+      });
+    };
+    tee(child.stdout, process.stdout);
+    tee(child.stderr, process.stderr);
+    child.on("error", (err) => resolve21({ ok: false, output: `${output}
+${String(err)}` }));
+    child.on("close", (code) => resolve21({ ok: code === 0, output }));
+  });
+}
+async function releaseWindowsFileLocks(cwd, keepVersion) {
+  reapAndReport(cwd, keepVersion);
+  try {
+    const { vgdSocketPath: vgdSocketPath2 } = await import('./vgd-54GEZWBI.js');
+    const result = await stopVgd(vgdSocketPath2());
+    if (result === "stopped") {
+      console.log(chalk7.dim("Stopped the vgd daemon so its files can be replaced \u2014 it restarts on the next command."));
+    } else if (result === "refused") {
+      console.log(
+        chalk7.dim(
+          "A vgd embedded in another process (e.g. vg code) is running \u2014 close that session if the update reports a locked file."
+        )
+      );
+    }
+  } catch {
+  }
+}
+async function offerDeferredWindowsUpdate(cmd, assumeYes) {
+  console.error(
+    chalk7.yellow("\nWindows could not replace a file that is still in use.") + chalk7.dim(
+      "\nThis is the self-update case: vg loads native modules (.node), and Windows locks them\nfor as long as a process has them open \u2014 including this one. Re-running the same\ncommand by hand hits the identical lock."
+    )
+  );
+  const proceed = assumeYes || await confirm3("Finish the update automatically after vg exits? [y/N]: ");
+  if (!proceed) {
+    console.error(
+      chalk7.dim(
+        "Skipped. To update manually, close every terminal and editor running vg (including\nMCP servers started by your AI client), then run:\n  " + cmd
+      )
+    );
+    return false;
+  }
+  const scheduled = scheduleDeferredUpdate(cmd);
+  if (!scheduled) {
+    console.error(chalk7.red(`Could not schedule the deferred update. Run manually once vg is closed: ${cmd}`));
+    return false;
+  }
+  console.log(
+    chalk7.green("\u2714") + " Update scheduled \u2014 it runs as soon as this process exits.\n" + chalk7.dim(`  Transcript: ${scheduled.logPath}
+`) + chalk7.dim('  Check the new version with "vg --version" in a few seconds.')
+  );
+  return true;
+}
 var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").option("-y, --yes", "Skip confirmation prompts (e.g. installing at a workspace root)").option("-w, --workspace-root", "Allow updating the pnpm workspace root (implies --yes for that prompt)").option("--no-reap", "Do not signal running vg serve processes on an older version to restart").action(
   async (opts) => {
     console.log(chalk7.dim(`Current version: ${VERSION}`));
@@ -10374,10 +10530,16 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       cmd = getInstallCommand(pm, PACKAGE_NAME, latest, isDev, { workspaceRoot });
       console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
     }
-    try {
-      execSync(cmd, { cwd, stdio: "inherit" });
+    if (process.platform === "win32" && isGlobal && opts.reap !== false) {
+      await releaseWindowsFileLocks(cwd, latest);
+    }
+    const install = await runInstall(cmd, cwd);
+    if (install.ok) {
       console.log(chalk7.green("\u2714") + ` Updated to ${PACKAGE_NAME}@${latest}`);
-    } catch {
+    } else if (process.platform === "win32" && isFileLockError(install.output)) {
+      const scheduled = await offerDeferredWindowsUpdate(cmd, Boolean(opts.yes));
+      process.exit(scheduled ? 0 : 1);
+    } else {
       console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
       process.exit(1);
     }
@@ -10392,7 +10554,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-BCBVZ2QA.js');
+    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-54GEZWBI.js');
     if (!await vgdIsRunning2()) return;
     const loaded = await vgdRequest2({ op: "load-graph", root: cwd });
     if (!loaded.ok || !("repositoryId" in loaded)) return;
@@ -10481,13 +10643,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path40.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path41.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path40.isAbsolute(inFile) ? inFile : path40.join(rootDir, inFile);
+  const artifactPath = path41.isAbsolute(inFile) ? inFile : path41.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -10514,7 +10676,7 @@ async function repositoryIdentity(rootDir, override) {
   }
 }
 var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path40.resolve(targetPath);
+  const rootDir = path41.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -10675,7 +10837,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path40.isAbsolute(projectPath) ? path40.relative(rootDir, projectPath) : projectPath;
+  const rel = path41.isAbsolute(projectPath) ? path41.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -11510,7 +11672,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path40.resolve(opts.in);
+  const artifactPath = path41.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -11559,8 +11721,8 @@ function openUrl(url) {
 // src/reporting/commands/login.ts
 var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
 function isInside(dir, file) {
-  const rel = path40.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path40.isAbsolute(rel);
+  const rel = path41.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path41.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -11815,7 +11977,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path40.resolve(opts.from);
+      const fromPath = path41.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -11833,9 +11995,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path40.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path41.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path40.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path41.resolve(opts.out)}
 `
       );
     } else {
@@ -12018,7 +12180,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path40.resolve(filePath);
+  const absolutePath = path41.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -12035,7 +12197,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path40.resolve(opts.out), body);
+    await writeTextFile(path41.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -12046,7 +12208,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path40.resolve(opts.out), report);
+    await writeTextFile(path41.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -12177,20 +12339,20 @@ function resolveRegime(id) {
   return regime;
 }
 function evidenceDir(root2) {
-  return path40.join(root2, ".vibgrate", "evidence");
+  return path41.join(root2, ".vibgrate", "evidence");
 }
 function orgPath(root2) {
-  return path40.join(evidenceDir(root2), "org.json");
+  return path41.join(evidenceDir(root2), "org.json");
 }
 function productsPath(root2) {
-  return path40.join(evidenceDir(root2), "products.json");
+  return path41.join(evidenceDir(root2), "products.json");
 }
 function releasesDir(root2) {
-  return path40.join(evidenceDir(root2), "releases");
+  return path41.join(evidenceDir(root2), "releases");
 }
 function releasePath(root2, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path40.join(releasesDir(root2), `${safe}.json`);
+  return path41.join(releasesDir(root2), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
@@ -12221,7 +12383,7 @@ async function freezeRelease(root2, release) {
   const p = releasePath(root2, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path40.relative(root2, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path41.relative(root2, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
@@ -12235,7 +12397,7 @@ async function loadReleases(root2, productId) {
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path40.join(dir, f));
+    const rel = await readJsonFile(path41.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
@@ -12930,12 +13092,12 @@ function verifyEvidenceEnvelope(env, opts = {}) {
 var DEFAULT_KEY = "attest-key.pem";
 function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path40.resolve(chosen) : path40.join(root2, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path41.resolve(chosen) : path41.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
   if (!fs11.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs11.mkdirSync(path40.dirname(keyPath), { recursive: true });
+    fs11.mkdirSync(path41.dirname(keyPath), { recursive: true });
     fs11.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
     fs11.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
@@ -12953,16 +13115,16 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs11.mkdirSync(path40.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs11.writeFileSync(path40.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs11.mkdirSync(path41.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs11.writeFileSync(path41.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path40.join("inputs", "advisory.json"), input.advisory);
+  write(path41.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path40.join("inputs", "releases", `${safe}.json`), rel);
+    write(path41.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path40.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path41.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -12978,13 +13140,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs11.writeFileSync(path40.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs11.writeFileSync(path41.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs11.writeFileSync(path40.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs11.writeFileSync(path41.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs11.writeFileSync(path40.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs11.writeFileSync(path41.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -13045,13 +13207,13 @@ function undeterminedFields(result, regime) {
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
 async function recordDrill(root2, record) {
-  const dir = path40.join(evidenceDir(root2), "drills");
-  const p = path40.join(dir, `${record.drillId}.json`);
+  const dir = path41.join(evidenceDir(root2), "drills");
+  const p = path41.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
 async function hasRecentDrill(root2, asOf) {
-  const dir = path40.join(evidenceDir(root2), "drills");
+  const dir = path41.join(evidenceDir(root2), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
@@ -13059,7 +13221,7 @@ async function hasRecentDrill(root2, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path40.join(dir, f));
+    const rec = await readJsonFile2(path41.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -13139,7 +13301,7 @@ function formatRegimeList() {
 
 // src/reporting/commands/evidence/index.ts
 function root(opts) {
-  return path40.resolve(opts.cwd ?? process.cwd());
+  return path41.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -13227,7 +13389,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path40.resolve(rootDir, opts.from),
+    from: path41.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -13235,7 +13397,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path40.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path41.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -13287,7 +13449,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path40.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path41.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -13295,7 +13457,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path40.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path41.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
@@ -13327,7 +13489,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs11.writeFileSync(path40.resolve(rootDir, opts.out), md);
+    fs11.writeFileSync(path41.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -13369,18 +13531,18 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path40.resolve(bundlePath);
-  const envPath = fs11.statSync(abs).isDirectory() ? path40.join(abs, "evidence.intoto.jsonl") : abs;
+  const abs = path41.resolve(bundlePath);
+  const envPath = fs11.statSync(abs).isDirectory() ? path41.join(abs, "evidence.intoto.jsonl") : abs;
   if (!fs11.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
   const envelope = JSON.parse(fs11.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path40.join(path40.dirname(envPath), "result.json");
+  const resultPath = path41.join(path41.dirname(envPath), "result.json");
   const result = fs11.existsSync(resultPath) ? JSON.parse(fs11.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs11.readFileSync(path40.resolve(opts.pub), "utf8") : void 0;
+  const publicKeyPem = opts.pub ? fs11.readFileSync(path41.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path40.join(path40.dirname(envPath), "timestamp.tsr");
+  const tsrPath = path41.join(path41.dirname(envPath), "timestamp.tsr");
   if (fs11.existsSync(tsrPath) && result) {
     const t = verifyTimestamp(fs11.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
@@ -13449,12 +13611,12 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path40.resolve(rootDir, opts.out);
-  await writeJsonFile(path40.join(dir, "org.json"), org);
-  await writeJsonFile(path40.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path40.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path40.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path40.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path41.resolve(rootDir, opts.out);
+  await writeJsonFile(path41.join(dir, "org.json"), org);
+  await writeJsonFile(path41.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path41.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path41.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path41.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
 var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
   const rootDir = root(opts);
@@ -13480,8 +13642,8 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path40.resolve(rootDir, opts.result);
-    const resultPath = fs11.existsSync(raw) && fs11.statSync(raw).isDirectory() ? path40.join(raw, "result.json") : raw;
+    const raw = path41.resolve(rootDir, opts.result);
+    const resultPath = fs11.existsSync(raw) && fs11.statSync(raw).isDirectory() ? path41.join(raw, "result.json") : raw;
     if (!fs11.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
     exposure = JSON.parse(fs11.readFileSync(resultPath, "utf8"));
   }
@@ -13677,7 +13839,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs11.existsSync(path40.resolve(cwd, first))) {
+  if (fs11.existsSync(path41.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -13722,9 +13884,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path40.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path41.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path40.resolve(eq.slice("--cwd=".length));
+  if (eq) return path41.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {