@vibgrate/cli 2026.807.1 → 2026.814.1

package/dist/cli.js

@@ -1,59 +1,61 @@
 #!/usr/bin/env node
-import { loadAdvancedScanHook, baselineCommand } from './chunk-Y4JO6LYP.js';
-import { fetchCatalog, resolveProviders } from './chunk-N5EP5ZR2.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-2HAJCW7Z.js';
+import { fetchCatalog, resolveProviders } from './chunk-2HNPL4OB.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-5KY5UCDJ.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-TFAXW7VM.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-6OP5U55G.js';
+export { runBuild } from './chunk-6OP5U55G.js';
+import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-2W3GBKSV.js';
 import './chunk-IS7VTH2Q.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-XSHGXGVJ.js';
-import { runCodeSession } from './chunk-PT2XQTSK.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-VQVLY63G.js';
+import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
+import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
+import { runCodeSession } from './chunk-VD6TVFGA.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-WN2AAB5O.js';
 import './chunk-543E6WDJ.js';
-import { summarizeDiffs, ScriptedProvider } from './chunk-ADP6ITGF.js';
+import './chunk-A4F7ESUR.js';
+import './chunk-HYC3A2AT.js';
+import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
+import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
+import { parseReasoningEffort, summarizeDiffs, ScriptedProvider } from './chunk-N3XFY3PX.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, runBuild } from './chunk-NWX4VUFS.js';
-export { runBuild } from './chunk-NWX4VUFS.js';
-import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-EXOYSXH6.js';
-import { vgdSocketPath, vgdIsRunning, vgdRequest, vgdPidPath } from './chunk-RBIRXQR6.js';
-import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
-import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
-import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
-import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-VNAOFA6X.js';
-import { refreshIfStale } from './chunk-GQ2EQXBG.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-FOKURZL3.js';
-import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-G4KO5W6H.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-5ESL76CM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-INIULQEP.js';
+import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-RNZP2XAL.js';
+import { refreshIfStale } from './chunk-QFCJY6FQ.js';
+import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, engineUnavailable, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-J3IDTLF4.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-BTYFZ3NM.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-N6ZMZ5AI.js';
 import './chunk-VIWZ4QT7.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-QXIWQ2WG.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-NXDYWBZB.js';
+import { resolveOne } from './chunk-J7LKEB2R.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-RBBP4SP7.js';
+import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-EBUTRJHX.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-BXPWVTGS.js';
 import './chunk-5I4VSBWQ.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIVRI.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-3LSG7Z4I.js';
-import { resolveOne } from './chunk-J7LKEB2R.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-7CYFCSY2.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-LS7GZBKP.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-JFCCJWXD.js';
-import { cacheDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, resetRelevanceProviderCache, loadRelevanceProvider, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, relevanceModuleDir, parseGraph, ensureVibgrateGitignore } from './chunk-2M6B5V2U.js';
-import { VERSION } from './chunk-ITY2NPIQ.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-UJAOCFQQ.js';
+import { cacheDir } from './chunk-JYY6G46J.js';
+import { resetRelevanceProviderCache, loadRelevanceProvider, relevanceModuleDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, parseGraph, ensureVibgrateGitignore } from './chunk-K7MONYIM.js';
+import { VERSION } from './chunk-QIUQH2ND.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
-import * as fs11 from 'fs';
-import fs11__default, { realpathSync } from 'fs';
-import * as path41 from 'path';
-import path41__default from 'path';
+import * as fs12 from 'fs';
+import fs12__default, { realpathSync } from 'fs';
+import * as path43 from 'path';
+import path43__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
@@ -65,7 +67,7 @@ import * as zlib from 'zlib';
 import * as crypto3 from 'crypto';
 import { randomUUID, createHash } from 'crypto';
 import chalk7 from 'chalk';
-import * as fs25 from 'fs/promises';
+import * as fs27 from 'fs/promises';
 
 init_cli_invocation();
 function registerStatus(program) {
@@ -75,10 +77,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root2 = path41.resolve(global.cwd ?? ".");
+  const root2 = path43.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs11.existsSync(path41.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs12.existsSync(path43.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -98,8 +100,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path41.relative(process.cwd(), root2) || ".",
-      graphPath: path41.relative(root2, graphPath),
+      root: path43.relative(process.cwd(), root2) || ".",
+      graphPath: path43.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -114,11 +116,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path41.relative(root2, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path43.relative(root2, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path41.relative(root2, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path43.relative(root2, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -135,7 +137,7 @@ async function runStatus(global) {
   if (vibgrateDir(root2)) ;
 }
 function rootOf(global) {
-  return path41.resolve(global.cwd ?? ".");
+  return path43.resolve(global.cwd ?? ".");
 }
 function requireGraph(global) {
   const root2 = rootOf(global);
@@ -242,18 +244,19 @@ function registerAsk(program) {
   applyGlobalOptions(cmd);
 }
 function crashedMessage(signal) {
-  return `semantic search is disabled: its native backend (onnxruntime-node, via fastembed) crashed with ${signal} \u2014 using fast lexical search instead. This is almost always an install-script block: npm skips onnxruntime-node's postinstall under allow-scripts/ignore-scripts, so the platform binaries were never downloaded. Reinstall allowing them \u2014 npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
+  const envPrefix = process.platform === "linux" ? "ONNXRUNTIME_NODE_INSTALL=skip " : "";
+  return `semantic search is disabled: its native backend (onnxruntime-node, via the vendored fastembed path) crashed with ${signal} \u2014 using fast lexical search instead. This usually means the installed native binaries are broken (an interrupted install, or a platform without prebuilt CPU binaries). Reinstall to repair \u2014 ${envPrefix}npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
 }
 function defaultCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || path41.join(os.homedir(), ".cache");
-  return path41.join(base, "vibgrate", "models");
+  const base = process.env.XDG_CACHE_HOME || path43.join(os.homedir(), ".cache");
+  return path43.join(base, "vibgrate", "models");
 }
 function verdictPath(dir) {
-  return path41.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
+  return path43.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
 }
 function readVerdict(dir) {
   try {
-    const raw = JSON.parse(fs11.readFileSync(verdictPath(dir), "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(verdictPath(dir), "utf8"));
     if (raw?.status !== "ok" && raw?.status !== "crashed") return null;
     if (raw.version !== VERSION) return null;
     return raw;
@@ -263,18 +266,18 @@ function readVerdict(dir) {
 }
 function writeVerdict(dir, verdict) {
   try {
-    fs11.mkdirSync(dir, { recursive: true });
-    fs11.writeFileSync(verdictPath(dir), JSON.stringify(verdict, null, 2) + "\n", "utf8");
+    fs12.mkdirSync(dir, { recursive: true });
+    fs12.writeFileSync(verdictPath(dir), JSON.stringify(verdict, null, 2) + "\n", "utf8");
   } catch {
   }
 }
 function probeModuleUrl(from = import.meta.url) {
-  const dir = path41.dirname(fileURLToPath(from));
+  const dir = path43.dirname(fileURLToPath(from));
   for (const name of ["embeddings.js", "index.js"]) {
-    const candidate = path41.join(dir, name);
-    if (fs11.existsSync(candidate)) return pathToFileURL(candidate).href;
+    const candidate = path43.join(dir, name);
+    if (fs12.existsSync(candidate)) return pathToFileURL(candidate).href;
   }
-  return pathToFileURL(path41.join(dir, "index.js")).href;
+  return pathToFileURL(path43.join(dir, "index.js")).href;
 }
 function defaultRunProbe(timeoutMs) {
   const moduleUrl = probeModuleUrl();
@@ -293,7 +296,7 @@ function defaultRunProbe(timeoutMs) {
       })
       .catch(() => process.stdout.write('{"ok":false}'));
   `;
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const child = spawn(process.execPath, ["--input-type=module", "-e", script], {
       stdio: ["ignore", "pipe", "ignore"],
       // The probe must never inherit a debugger port or loader flags that would
@@ -306,7 +309,7 @@ function defaultRunProbe(timeoutMs) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve21({ signal, status, stdout });
+      resolve23({ signal, status, stdout });
     };
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
@@ -349,7 +352,7 @@ async function embedderHealth(options = {}) {
 }
 function clearEmbedderHealth(cacheDir2) {
   try {
-    fs11.unlinkSync(verdictPath(cacheDir2 ?? defaultCacheDir()));
+    fs12.unlinkSync(verdictPath(cacheDir2 ?? defaultCacheDir()));
   } catch {
   }
 }
@@ -1019,12 +1022,12 @@ var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
 function liveStatsDir(root2) {
-  return path41.join(cacheDir(root2), "serve-live");
+  return path43.join(cacheDir(root2), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
   try {
-    entries = fs11.readdirSync(dir);
+    entries = fs12.readdirSync(dir);
   } catch {
     return [];
   }
@@ -1033,7 +1036,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs11.readFileSync(path41.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(path43.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1055,7 +1058,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path41.join(dir, `serve-${this.pid}.json`);
+    this.file = path43.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1087,10 +1090,10 @@ var LiveStatsBus = class {
     this.lastWriteAt = now;
     const body = { pid: this.pid, updatedAt: now, version: VERSION, snapshot: snap };
     try {
-      fs11.mkdirSync(this.dir, { recursive: true });
+      fs12.mkdirSync(this.dir, { recursive: true });
       const tmp = `${this.file}.tmp`;
-      fs11.writeFileSync(tmp, JSON.stringify(body));
-      fs11.renameSync(tmp, this.file);
+      fs12.writeFileSync(tmp, JSON.stringify(body));
+      fs12.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -1101,24 +1104,24 @@ var LiveStatsBus = class {
   siblings(now = Date.now()) {
     let entries;
     try {
-      entries = fs11.readdirSync(this.dir);
+      entries = fs12.readdirSync(this.dir);
     } catch {
       return [];
     }
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path41.join(this.dir, name);
+      const file = path43.join(this.dir, name);
       let parsed;
       try {
-        parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
+        parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
       if (typeof parsed?.pid !== "number" || typeof parsed.updatedAt !== "number" || !parsed.snapshot?.totals) continue;
       if (now - parsed.updatedAt > STALE_MS) {
         try {
-          fs11.unlinkSync(file);
+          fs12.unlinkSync(file);
         } catch {
         }
         continue;
@@ -1130,7 +1133,7 @@ var LiveStatsBus = class {
   }
   unlinkOwn = () => {
     try {
-      fs11.unlinkSync(this.file);
+      fs12.unlinkSync(this.file);
     } catch {
     }
   };
@@ -1443,12 +1446,12 @@ var LedgerTail = class {
     if (size === this.offset) return;
     let chunk;
     try {
-      const fd = fs11.openSync(this.file, "r");
+      const fd = fs12.openSync(this.file, "r");
       try {
         chunk = Buffer.alloc(size - this.offset);
-        fs11.readSync(fd, chunk, 0, chunk.length, this.offset);
+        fs12.readSync(fd, chunk, 0, chunk.length, this.offset);
       } finally {
-        fs11.closeSync(fd);
+        fs12.closeSync(fd);
       }
     } catch {
       return;
@@ -1461,7 +1464,7 @@ var LedgerTail = class {
   }
   sizeOf() {
     try {
-      return fs11.statSync(this.file).size;
+      return fs12.statSync(this.file).size;
     } catch {
       return 0;
     }
@@ -1640,7 +1643,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve21) => httpServer.listen(port, host, resolve21));
+  await new Promise((resolve23) => httpServer.listen(port, host, resolve23));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1854,19 +1857,19 @@ function endOfLine(text, line) {
 }
 var CACHE_VERSION = "vg-lsp-scan-cache/2";
 function cachePath(root2) {
-  return path41.join(cacheDir(root2), "lsp-scan.json");
+  return path43.join(cacheDir(root2), "lsp-scan.json");
 }
 function manifestHash(root2) {
   const files = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = fs11.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const abs = path41.join(dir, entry.name);
+      const abs = path43.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (isSkippedDirName(entry.name)) continue;
         walk2(abs);
@@ -1876,8 +1879,8 @@ function manifestHash(root2) {
       const base = entry.name.toLowerCase();
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
-        const rel = path41.relative(root2, abs).split(path41.sep).join("/");
-        files.push({ rel, hash: hashBytes(fs11.readFileSync(abs)) });
+        const rel = path43.relative(root2, abs).split(path43.sep).join("/");
+        files.push({ rel, hash: hashBytes(fs12.readFileSync(abs)) });
       } catch {
       }
     }
@@ -1887,16 +1890,16 @@ function manifestHash(root2) {
   return hashString(canonicalize(files));
 }
 function isDependencyFile(root2, filePath) {
-  const rel = path41.relative(path41.resolve(root2), path41.resolve(filePath));
-  if (rel === "" || rel.startsWith("..") || path41.isAbsolute(rel)) return false;
-  const parts = rel.split(path41.sep);
+  const rel = path43.relative(path43.resolve(root2), path43.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path43.isAbsolute(rel)) return false;
+  const parts = rel.split(path43.sep);
   if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
 }
 function loadScanCache(root2, key2) {
   try {
-    const raw = JSON.parse(fs11.readFileSync(cachePath(root2), "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(cachePath(root2), "utf8"));
     if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
       return { manifestHash: raw.manifestHash, artifact: raw.artifact };
     }
@@ -1906,8 +1909,8 @@ function loadScanCache(root2, key2) {
 }
 function writeScanCache(root2, key2, artifact) {
   try {
-    fs11.mkdirSync(cacheDir(root2), { recursive: true });
-    fs11.writeFileSync(
+    fs12.mkdirSync(cacheDir(root2), { recursive: true });
+    fs12.writeFileSync(
       cachePath(root2),
       stableStringify(
         { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
@@ -1920,7 +1923,7 @@ function writeScanCache(root2, key2, artifact) {
 var MAX_ENTRIES = 1e3;
 var KEEP_ENTRIES = 500;
 function historyPath(root2) {
-  return path41.join(root2, ".vibgrate", "score-history.jsonl");
+  return path43.join(root2, ".vibgrate", "score-history.jsonl");
 }
 function parseLine(line) {
   try {
@@ -1934,7 +1937,7 @@ function parseLine(line) {
 }
 function readHistory(root2) {
   try {
-    return fs11.readFileSync(historyPath(root2), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
+    return fs12.readFileSync(historyPath(root2), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
   } catch {
     return [];
   }
@@ -1961,14 +1964,14 @@ function recordScore(root2, entry) {
       }
     }
     const file = historyPath(root2);
-    fs11.mkdirSync(path41.dirname(file), { recursive: true });
+    fs12.mkdirSync(path43.dirname(file), { recursive: true });
     ensureVibgrateGitignore(root2);
-    fs11.appendFileSync(file, `${JSON.stringify(entry)}
+    fs12.appendFileSync(file, `${JSON.stringify(entry)}
 `);
     const all = readHistory(root2);
     if (all.length > MAX_ENTRIES) {
       const kept = all.slice(-KEEP_ENTRIES);
-      fs11.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
+      fs12.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
     }
   } catch {
   }
@@ -2311,8 +2314,8 @@ async function enrichVulns(ecosystem, name, version, opts = { offline: false })
   if (!ecosystem || !version) return { vulns: [], cveCount: 0, source: "error" };
   if (opts.offline) return { vulns: [], cveCount: 0, source: "offline" };
   const k = key(ecosystem, name, version);
-  const cached = cache.get(k);
-  if (cached) return { ...cached, source: "cache" };
+  const cached2 = cache.get(k);
+  if (cached2) return { ...cached2, source: "cache" };
   try {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 8e3);
@@ -2624,10 +2627,10 @@ var VibgrateLanguageServer = class {
     this.forceNextScan = false;
     try {
       const cacheKey = { manifestHash: manifestHash(this.opts.root), toolVersion: VERSION, offline: this.opts.offline };
-      const cached = force ? null : loadScanCache(this.opts.root, cacheKey);
+      const cached2 = force ? null : loadScanCache(this.opts.root, cacheKey);
       let fromCache = false;
-      if (cached) {
-        this.artifact = pruneArtifactProjects(cached.artifact);
+      if (cached2) {
+        this.artifact = pruneArtifactProjects(cached2.artifact);
         fromCache = true;
       } else {
         const scanOpts = {
@@ -2940,10 +2943,10 @@ var VibgrateLanguageServer = class {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
       const relManifest = manifestRelativePath(proj);
-      const absManifest = path41.resolve(this.opts.root, relManifest);
+      const absManifest = path43.resolve(this.opts.root, relManifest);
       let text = null;
       try {
-        if (fs11.existsSync(absManifest)) text = fs11.readFileSync(absManifest, "utf8");
+        if (fs12.existsSync(absManifest)) text = fs12.readFileSync(absManifest, "utf8");
       } catch {
         text = null;
       }
@@ -3092,10 +3095,10 @@ function pruneArtifactProjects(a) {
   return { ...a, projects, findings };
 }
 function projectByPath(a, projectPath) {
-  const want = path41.normalize(projectPath === "" ? "." : projectPath);
+  const norm = (p) => path43.normalize((p === "" ? "." : p).replace(/\\/g, "/"));
+  const want = norm(projectPath);
   for (const proj of a.projects ?? []) {
-    const got = path41.normalize(proj.path === "" ? "." : proj.path);
-    if (got === want) return proj;
+    if (norm(proj.path) === want) return proj;
   }
   return void 0;
 }
@@ -3103,7 +3106,7 @@ function buildProjectRefs(rootDir, projects) {
   if (projects.length === 0) return void 0;
   const byPath = /* @__PURE__ */ new Map();
   for (const p of projects) {
-    const rel = p.path === "" ? "." : p.path;
+    const rel = (p.path === "" ? "." : p.path).replace(/\\/g, "/");
     const prev = byPath.get(rel);
     if (!prev) {
       byPath.set(rel, p);
@@ -3131,12 +3134,12 @@ function buildProjectRefs(rootDir, projects) {
   return refs.length > 0 ? refs : void 0;
 }
 function projectForFile(root2, a, filePath) {
-  const dir = path41.dirname(path41.resolve(filePath));
+  const dir = path43.dirname(path43.resolve(filePath));
   let best;
   let bestLen = -1;
   for (const proj of a.projects ?? []) {
-    const projDir = path41.resolve(root2, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path41.sep)) && projDir.length > bestLen) {
+    const projDir = path43.resolve(root2, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path43.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -3144,7 +3147,7 @@ function projectForFile(root2, a, filePath) {
   return best;
 }
 function sameProject(location, projectPath) {
-  return path41.normalize(location) === path41.normalize(projectPath);
+  return path43.normalize(location) === path43.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -3214,10 +3217,10 @@ function buildBreakdown(rootDir, projects) {
     const relManifest = manifestRelativePath(p);
     if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
-    const absManifest = path41.resolve(rootDir, relManifest);
+    const absManifest = path43.resolve(rootDir, relManifest);
     let text = null;
     try {
-      if (fs11.existsSync(absManifest)) text = fs11.readFileSync(absManifest, "utf8");
+      if (fs12.existsSync(absManifest)) text = fs12.readFileSync(absManifest, "utf8");
     } catch {
       text = null;
     }
@@ -3282,34 +3285,34 @@ function buildBreakdown(rootDir, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join31 = (name) => base ? path41.join(base, name) : name;
+  const join33 = (name) => base ? path43.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join31("package.json");
+      return join33("package.json");
     case "python":
-      return join31("pyproject.toml");
+      return join33("pyproject.toml");
     case "go":
-      return join31("go.mod");
+      return join33("go.mod");
     case "rust":
-      return join31("Cargo.toml");
+      return join33("Cargo.toml");
     case "ruby":
-      return join31("Gemfile");
+      return join33("Gemfile");
     case "php":
-      return join31("composer.json");
+      return join33("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join31("pom.xml");
+      return join33("pom.xml");
     case "dotnet":
-      return join31(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join33(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join31("pubspec.yaml");
+      return join33("pubspec.yaml");
     case "elixir":
-      return join31("mix.exs");
+      return join33("mix.exs");
     default:
-      return join31("package.json");
+      return join33("package.json");
   }
 }
 function lockfileRelativePath(rootDir, proj) {
@@ -3340,9 +3343,9 @@ function lockfileRelativePath(rootDir, proj) {
   const dirsToTry = base ? [base, ""] : [""];
   for (const dir of dirsToTry) {
     for (const name of candidateNames) {
-      const rel = dir ? path41.join(dir, name) : name;
+      const rel = dir ? path43.join(dir, name) : name;
       try {
-        if (fs11.existsSync(path41.join(rootDir, rel))) return rel;
+        if (fs12.existsSync(path43.join(rootDir, rel))) return rel;
       } catch {
       }
     }
@@ -3413,10 +3416,10 @@ function lookupImportFiles(map, pkg) {
 }
 function firstPackageMentionLine(root2, relFile, pkg) {
   try {
-    const abs = path41.resolve(root2, relFile);
-    const stat2 = fs11.statSync(abs);
+    const abs = path43.resolve(root2, relFile);
+    const stat2 = fs12.statSync(abs);
     if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
-    const text = fs11.readFileSync(abs, "utf8");
+    const text = fs12.readFileSync(abs, "utf8");
     const tokens = [pkg];
     if (pkg.startsWith("@")) {
       const parts = pkg.split("/");
@@ -3568,7 +3571,7 @@ function hoverMarkdown(dep, contribution) {
   return lines.join("\n");
 }
 function startLanguageServer(opts) {
-  if (!fs11.existsSync(opts.root)) {
+  if (!fs12.existsSync(opts.root)) {
     process.stderr.write(`vg lsp: root does not exist: ${opts.root}
 `);
     process.exit(1);
@@ -3617,12 +3620,12 @@ function hookCommand(vgBin) {
   return `${vgBin} hook pre-tool-use`;
 }
 function installClaudeHooks(root2, vgBin = "vg") {
-  const file = path41.join(root2, ".claude", "settings.json");
-  const rel = path41.join(".claude", "settings.json");
+  const file = path43.join(root2, ".claude", "settings.json");
+  const rel = path43.join(".claude", "settings.json");
   let settings = {};
-  if (fs11.existsSync(file)) {
+  if (fs12.existsSync(file)) {
     try {
-      const parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
+      const parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         return { file: rel, status: "skipped", note: "settings.json is not a JSON object \u2014 left untouched" };
       }
@@ -3659,12 +3662,12 @@ function installClaudeHooks(root2, vgBin = "vg") {
   return { file: rel, status: "written" };
 }
 function uninstallClaudeHooks(root2) {
-  const file = path41.join(root2, ".claude", "settings.json");
-  const rel = path41.join(".claude", "settings.json");
-  if (!fs11.existsSync(file)) return { file: rel, status: "unchanged" };
+  const file = path43.join(root2, ".claude", "settings.json");
+  const rel = path43.join(".claude", "settings.json");
+  if (!fs12.existsSync(file)) return { file: rel, status: "unchanged" };
   let settings;
   try {
-    settings = JSON.parse(fs11.readFileSync(file, "utf8"));
+    settings = JSON.parse(fs12.readFileSync(file, "utf8"));
   } catch {
     return { file: rel, status: "skipped", note: "settings.json is not parseable JSON \u2014 left untouched" };
   }
@@ -3686,8 +3689,8 @@ function uninstallClaudeHooks(root2) {
   return { file: rel, status: "written" };
 }
 function writeSettings(file, settings) {
-  fs11.mkdirSync(path41.dirname(file), { recursive: true });
-  fs11.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
+  fs12.mkdirSync(path43.dirname(file), { recursive: true });
+  fs12.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
 `);
 }
 
@@ -3801,25 +3804,28 @@ function resolve5(id) {
   }
   return a;
 }
-var RELEVANCE_MODULE_NAME = "@vibgrate/relevance";
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 function registryBase(opts) {
   return (process.env.VIBGRATE_MODULE_REGISTRY || opts.registry || DEFAULT_REGISTRY).replace(/\/+$/, "");
 }
+function modulesBaseDir() {
+  const base = process.env.XDG_CACHE_HOME || path43.join(os.homedir(), ".cache");
+  return path43.join(base, "vibgrate", "modules");
+}
 function stateFile() {
-  return path41.join(path41.dirname(relevanceModuleDir()), "consent.json");
+  return path43.join(modulesBaseDir(), "consent.json");
 }
 function readConsent() {
   try {
-    return JSON.parse(fs11.readFileSync(stateFile(), "utf8"));
+    return JSON.parse(fs12.readFileSync(stateFile(), "utf8"));
   } catch {
     return {};
   }
 }
 function writeConsent(state) {
   try {
-    fs11.mkdirSync(path41.dirname(stateFile()), { recursive: true });
-    fs11.writeFileSync(stateFile(), JSON.stringify(state));
+    fs12.mkdirSync(path43.dirname(stateFile()), { recursive: true });
+    fs12.writeFileSync(stateFile(), JSON.stringify(state));
   } catch {
   }
 }
@@ -3827,17 +3833,16 @@ function kernelDisabled() {
   const v = process.env.VIBGRATE_NO_KERNEL;
   return v === "1" || v === "true";
 }
-function moduleInstalled() {
+function moduleInstalledAt(dir) {
   try {
-    const meta = JSON.parse(fs11.readFileSync(path41.join(relevanceModuleDir(), ".module.json"), "utf8"));
-    if (fs11.existsSync(path41.join(relevanceModuleDir(), "index.js"))) {
+    const meta = JSON.parse(fs12.readFileSync(path43.join(dir, ".module.json"), "utf8"));
+    if (fs12.existsSync(path43.join(dir, "index.js"))) {
       return { installed: true, version: meta.version };
     }
   } catch {
   }
   return { installed: false };
 }
-var DISCLOSURE = "vg can install the optional Vibgrate relevance module (proprietary license, runs fully locally, improves how questions find the code they mean). Disable any time with VIBGRATE_NO_KERNEL=1.";
 function verifyIntegrity(buf, integrity, shasum) {
   if (integrity) {
     const [algo, expected] = integrity.split("-", 2);
@@ -3879,21 +3884,21 @@ function untar(data) {
     if (type !== "0" && type !== "\0") continue;
     const name = pendingName ?? (prefix ? `${prefix}/${rawName}` : rawName);
     pendingName = null;
-    if (name.split("/").includes("..") || path41.isAbsolute(name)) {
+    if (name.split("/").includes("..") || path43.isAbsolute(name)) {
       throw new Error(`unsafe path in tarball: ${name}`);
     }
     out2.push({ name, body: Buffer.from(body) });
   }
   return out2;
 }
-async function installRelevanceModule(opts = {}) {
+async function installModule(mod, opts = {}) {
   if (kernelDisabled()) return { status: "disabled", detail: "VIBGRATE_NO_KERNEL is set" };
-  const existing = moduleInstalled();
+  const existing = moduleInstalledAt(mod.dir());
   if (existing.installed && !opts.force) return { status: "already-installed", version: existing.version };
   const doFetch = opts.fetchImpl ?? fetch;
   const base = registryBase(opts);
   try {
-    const metaRes = await doFetch(`${base}/${RELEVANCE_MODULE_NAME.replace("/", "%2f")}`);
+    const metaRes = await doFetch(`${base}/${mod.npmName.replace("/", "%2f")}`);
     if (!metaRes.ok) return { status: "unavailable", detail: `registry ${metaRes.status}` };
     const meta = await metaRes.json();
     const version = meta["dist-tags"]?.latest;
@@ -3904,35 +3909,54 @@ async function installRelevanceModule(opts = {}) {
     const gz = Buffer.from(await tarRes.arrayBuffer());
     verifyIntegrity(gz, dist.integrity, dist.shasum);
     const entries = untar(zlib.gunzipSync(gz));
-    const dir = relevanceModuleDir();
-    fs11.rmSync(dir, { recursive: true, force: true });
-    fs11.mkdirSync(dir, { recursive: true });
+    const dir = mod.dir();
+    fs12.rmSync(dir, { recursive: true, force: true });
+    fs12.mkdirSync(dir, { recursive: true });
     let wrote = 0;
     for (const e of entries) {
       let rel = null;
       if (e.name.startsWith("package/dist/")) rel = e.name.slice("package/dist/".length);
       else if (e.name === "package/LICENSE" || e.name === "package/README.md") rel = e.name.slice("package/".length);
       if (!rel) continue;
-      const target = path41.join(dir, rel);
-      if (!target.startsWith(dir + path41.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
-      fs11.mkdirSync(path41.dirname(target), { recursive: true });
-      fs11.writeFileSync(target, e.body);
+      const target = path43.join(dir, rel);
+      if (!target.startsWith(dir + path43.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
+      fs12.mkdirSync(path43.dirname(target), { recursive: true });
+      fs12.writeFileSync(target, e.body);
       wrote += 1;
     }
-    if (!wrote || !fs11.existsSync(path41.join(dir, "index.js"))) {
-      fs11.rmSync(dir, { recursive: true, force: true });
+    if (!wrote || !fs12.existsSync(path43.join(dir, "index.js"))) {
+      fs12.rmSync(dir, { recursive: true, force: true });
       return { status: "unavailable", detail: "package layout not recognized (no dist/index.js)" };
     }
-    fs11.writeFileSync(path41.join(dir, ".module.json"), JSON.stringify({ name: RELEVANCE_MODULE_NAME, version }));
-    resetRelevanceProviderCache();
+    fs12.writeFileSync(path43.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
+    mod.onChanged?.();
     return { status: "installed", version };
   } catch (e) {
     return { status: "unavailable", detail: String(e.message ?? e).slice(0, 200) };
   }
 }
+function removeModule(mod) {
+  fs12.rmSync(mod.dir(), { recursive: true, force: true });
+  mod.onChanged?.();
+}
+
+// src/install/relevance-module.ts
+var RELEVANCE_MODULE_NAME = "@vibgrate/relevance";
+var RELEVANCE_MODULE = {
+  id: "relevance",
+  npmName: RELEVANCE_MODULE_NAME,
+  dir: relevanceModuleDir,
+  onChanged: resetRelevanceProviderCache
+};
+function moduleInstalled() {
+  return moduleInstalledAt(relevanceModuleDir());
+}
+var DISCLOSURE = "vg can install the optional Vibgrate relevance module (proprietary license, runs fully locally, improves how questions find the code they mean). Disable any time with VIBGRATE_NO_KERNEL=1.";
+async function installRelevanceModule(opts = {}) {
+  return installModule(RELEVANCE_MODULE, opts);
+}
 function removeRelevanceModule() {
-  fs11.rmSync(relevanceModuleDir(), { recursive: true, force: true });
-  resetRelevanceProviderCache();
+  removeModule(RELEVANCE_MODULE);
 }
 async function ensureRelevanceModule(io = {}) {
   try {
@@ -3945,78 +3969,178 @@ async function ensureRelevanceModule(io = {}) {
     return { status: "unavailable", detail: "auto-install failed" };
   }
 }
+function disabled() {
+  const v = process.env.VIBGRATE_NO_KERNEL;
+  return v === "1" || v === "true";
+}
+function hcsModuleDir() {
+  return path43.join(modulesBaseDir(), "hcs");
+}
+function candidatePaths() {
+  const custom = process.env.VIBGRATE_HCS_PATH;
+  if (custom) {
+    const p = path43.resolve(custom);
+    try {
+      if (fs12.statSync(p).isDirectory()) return [path43.join(p, "index.js")];
+    } catch {
+    }
+    return [p];
+  }
+  return [path43.join(hcsModuleDir(), "index.js")];
+}
+var cached;
+function resetHcsEngineCache() {
+  cached = void 0;
+}
+async function loadHcsEngine() {
+  if (cached !== void 0) return cached;
+  cached = null;
+  if (disabled()) return cached;
+  for (const p of candidatePaths()) {
+    if (!fs12.existsSync(p)) continue;
+    try {
+      const mod = await import(pathToFileURL(p).href);
+      const engine = await mod.createHcsEngine?.();
+      if (engine && typeof engine.version === "function" && typeof engine.renderDigest === "function" && typeof engine.buildMap === "function" && typeof engine.evaluateGate === "function") {
+        cached = engine;
+        return cached;
+      }
+    } catch {
+    }
+  }
+  return cached;
+}
+
+// src/install/hcs-module.ts
+var HCS_MODULE_NAME = "@vibgrate/hcs-engine";
+var HCS_MODULE = {
+  id: "hcs",
+  npmName: HCS_MODULE_NAME,
+  dir: hcsModuleDir,
+  onChanged: resetHcsEngineCache
+};
+var HCS_DISCLOSURE = "vg can install the optional Vibgrate HCS engine module (proprietary license, runs fully locally in a WASM sandbox \u2014 no network, no process spawns). Disable any time with VIBGRATE_NO_KERNEL=1.";
+function hcsModuleInstalled() {
+  return moduleInstalledAt(hcsModuleDir());
+}
+async function installHcsModule(opts = {}) {
+  return installModule(HCS_MODULE, opts);
+}
+function removeHcsModule() {
+  removeModule(HCS_MODULE);
+}
+async function ensureHcsModule(io = {}) {
+  try {
+    if (kernelDisabled()) return { status: "disabled" };
+    const existing = hcsModuleInstalled();
+    if (existing.installed) return { status: "already-installed", version: existing.version };
+    if (readConsent().hcs === "denied") return { status: "declined" };
+    return await installHcsModule({ fetchImpl: io.fetchImpl });
+  } catch {
+    return { status: "unavailable", detail: "auto-install failed" };
+  }
+}
 
 // src/commands/module.ts
+var MODULES = {
+  relevance: {
+    npmName: RELEVANCE_MODULE_NAME,
+    disclosure: DISCLOSURE,
+    install: installRelevanceModule,
+    remove: removeRelevanceModule,
+    installed: moduleInstalled,
+    resetLoader: resetRelevanceProviderCache,
+    loadedVersion: async () => {
+      const provider = await loadRelevanceProvider();
+      return provider ? provider.version() : null;
+    }
+  },
+  hcs: {
+    npmName: HCS_MODULE_NAME,
+    disclosure: HCS_DISCLOSURE,
+    install: installHcsModule,
+    remove: removeHcsModule,
+    installed: hcsModuleInstalled,
+    resetLoader: resetHcsEngineCache,
+    loadedVersion: async () => {
+      const engine = await loadHcsEngine();
+      return engine ? engine.version() : null;
+    }
+  }
+};
+var SUPPORTED = Object.keys(MODULES).join(", ");
 function registerModule(program) {
-  const cmd = program.command("module").description("manage optional local modules (relevance)");
-  cmd.command("install").description("install an optional module (fetches from the registry, integrity-checked)").argument("<name>", "module name (supported: relevance)").option("--yes", "skip the confirmation prompt").option("--force", "reinstall even when already present").action(async function(name, opts) {
+  const cmd = program.command("module").description(`manage optional local modules (${SUPPORTED})`);
+  cmd.command("install").description("install an optional module (fetches from the registry, integrity-checked)").argument("<name>", `module name (supported: ${SUPPORTED})`).option("--yes", "skip the confirmation prompt").option("--force", "reinstall even when already present").action(async function(name, opts) {
     const global = readGlobal(this);
-    requireRelevance(name);
+    const mod = requireModule(name);
     if (kernelDisabled()) {
-      throw new CliError("VIBGRATE_NO_KERNEL is set \u2014 unset it to install the relevance module", ExitCode.USAGE_ERROR);
+      throw new CliError(`VIBGRATE_NO_KERNEL is set \u2014 unset it to install the ${name} module`, ExitCode.USAGE_ERROR);
     }
     if (!opts.yes && process.stdin.isTTY && process.stdout.isTTY) {
-      const ok = await confirm(`${DISCLOSURE}
+      const ok = await confirm(`${mod.disclosure}
 Install now? [Y/n] `);
       if (!ok) {
-        writeConsent({ ...readConsent(), relevance: "denied" });
+        writeConsent({ ...readConsent(), [name]: "denied" });
         info("not installed");
         return;
       }
     }
-    writeConsent({ ...readConsent(), relevance: "granted" });
-    const result = await installRelevanceModule({ force: opts.force });
+    writeConsent({ ...readConsent(), [name]: "granted" });
+    const result = await mod.install({ force: opts.force });
     if (global.json) {
       json(result);
       if (result.status === "unavailable") process.exitCode = ExitCode.ERROR;
       return;
     }
-    if (result.status === "installed") out(`installed ${RELEVANCE_MODULE_NAME}@${result.version}`);
+    if (result.status === "installed") out(`installed ${mod.npmName}@${result.version}`);
     else if (result.status === "already-installed") out(`already installed (${result.version ?? "unknown"}) \u2014 use --force to reinstall`);
     else throw new CliError(`install failed: ${result.detail ?? result.status} \u2014 check network access to the registry, or retry later`, ExitCode.ERROR);
   });
-  cmd.command("remove").description("remove an installed module").argument("<name>", "module name (supported: relevance)").action(async function(name) {
-    requireRelevance(name);
-    removeRelevanceModule();
+  cmd.command("remove").description("remove an installed module").argument("<name>", `module name (supported: ${SUPPORTED})`).action(async function(name) {
+    requireModule(name).remove();
     out("removed");
   });
   cmd.command("status").description("show installed modules and whether they load").action(async function() {
     const global = readGlobal(this);
-    const installed = moduleInstalled();
-    resetRelevanceProviderCache();
-    const provider = installed.installed ? await loadRelevanceProvider() : null;
-    const status = {
-      relevance: {
+    const consent = readConsent();
+    const status = {};
+    for (const [name, mod] of Object.entries(MODULES)) {
+      const installed = mod.installed();
+      mod.resetLoader();
+      const loadedVersion = installed.installed ? await mod.loadedVersion() : null;
+      status[name] = {
         installed: installed.installed,
         version: installed.version ?? null,
-        loadable: !!provider,
-        providerVersion: provider ? provider.version() : null,
+        loadable: loadedVersion !== null,
+        providerVersion: loadedVersion,
         disabled: kernelDisabled(),
-        consent: readConsent().relevance ?? "unset"
-      }
-    };
+        consent: consent[name] ?? "unset"
+      };
+    }
     if (global.json) {
       json(status);
       return;
     }
-    const r = status.relevance;
-    out(`relevance: ${r.installed ? `installed ${r.version}` : "not installed"}${r.disabled ? " (disabled via VIBGRATE_NO_KERNEL)" : ""}`);
-    if (r.installed) out(`  loads: ${r.loadable ? `yes (${r.providerVersion})` : "no"}`);
-    info(c.dim(`  consent: ${r.consent}`));
+    for (const [name, s] of Object.entries(status)) {
+      out(`${name}: ${s.installed ? `installed ${s.version}` : "not installed"}${s.disabled ? " (disabled via VIBGRATE_NO_KERNEL)" : ""}`);
+      if (s.installed) out(`  loads: ${s.loadable ? `yes (${s.providerVersion})` : "no"}`);
+      info(c.dim(`  consent: ${s.consent}`));
+    }
   });
   applyGlobalOptions(cmd);
 }
-function requireRelevance(name) {
-  if (name !== "relevance") {
-    throw usageError(`unknown module '${name}' \u2014 supported modules: relevance`);
-  }
+function requireModule(name) {
+  const mod = MODULES[name];
+  if (!mod) throw usageError(`unknown module '${name}' \u2014 supported modules: ${SUPPORTED}`);
+  return mod;
 }
 function confirm(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(question, (answer) => {
       rl.close();
-      resolve21(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
+      resolve23(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -4040,7 +4164,7 @@ function hookContext(payloadText, root2, graphOverride) {
   let graph;
   try {
     const preferred = loadGraphPreferIndex(root2, graphPath);
-    graph = preferred ? preferred.graph : parseGraph(fs11.readFileSync(graphPath, "utf8"));
+    graph = preferred ? preferred.graph : parseGraph(fs12.readFileSync(graphPath, "utf8"));
   } catch {
     return null;
   }
@@ -4062,7 +4186,7 @@ function registerHook(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     try {
-      const stdin = fs11.readFileSync(0, "utf8");
+      const stdin = fs12.readFileSync(0, "utf8");
       const context = hookContext(stdin, root2, global.graph);
       if (context) {
         process.stdout.write(
@@ -4082,8 +4206,8 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const gitDir = path41.join(root2, ".git");
-    if (!fs11.existsSync(gitDir)) {
+    const gitDir = path43.join(root2, ".git");
+    if (!fs12.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -4104,23 +4228,23 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root2, reports) {
-  const dir = path41.join(root2, ".vibgrate");
-  fs11.mkdirSync(dir, { recursive: true });
+  const dir = path43.join(root2, ".vibgrate");
+  fs12.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs11.writeFileSync(path41.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs12.writeFileSync(path43.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
-  const file = path41.join(root2, ".gitattributes");
+  const file = path43.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : "";
+  let content = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs11.writeFileSync(file, content);
+    fs12.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root2) {
@@ -4129,8 +4253,8 @@ function configureMergeDriver(root2) {
 }
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
-  fs11.mkdirSync(hooksDir, { recursive: true });
-  const file = path41.join(hooksDir, "pre-commit");
+  fs12.mkdirSync(hooksDir, { recursive: true });
+  const file = path43.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -4139,7 +4263,7 @@ function installPreCommitHook(root2) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -4148,21 +4272,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs11.writeFileSync(file, content);
-  fs11.chmodSync(file, 493);
+  fs12.writeFileSync(file, content);
+  fs12.chmodSync(file, 493);
 }
 function undo(root2) {
-  const hookFile = path41.join(hookDir(root2), "pre-commit");
-  if (fs11.existsSync(hookFile)) {
+  const hookFile = path43.join(hookDir(root2), "pre-commit");
+  if (fs12.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs11.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs11.rmSync(hookFile);
-    else fs11.writeFileSync(hookFile, next2);
+    const next2 = fs12.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs12.rmSync(hookFile);
+    else fs12.writeFileSync(hookFile, next2);
   }
-  const attr = path41.join(root2, ".gitattributes");
-  if (fs11.existsSync(attr)) {
-    const next2 = fs11.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs11.writeFileSync(attr, next2);
+  const attr = path43.join(root2, ".gitattributes");
+  if (fs12.existsSync(attr)) {
+    const next2 = fs12.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs12.writeFileSync(attr, next2);
   }
   try {
     git(root2, ["config", "--remove-section", "merge.vg"]);
@@ -4172,10 +4296,10 @@ function undo(root2) {
 function hookDir(root2) {
   try {
     const configured = git(root2, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path41.resolve(root2, configured);
+    if (configured) return path43.resolve(root2, configured);
   } catch {
   }
-  return path41.join(root2, ".git", "hooks");
+  return path43.join(root2, ".git", "hooks");
 }
 function git(root2, args) {
   return execFileSync("git", args, { cwd: root2, encoding: "utf8" });
@@ -4189,9 +4313,9 @@ function registerWatch(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
-    const watchRoots = (paths.length ? paths : ["."]).map((p) => path41.resolve(root2, p));
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path43.resolve(root2, p));
     for (const w of watchRoots) {
-      if (!fs11.existsSync(w)) {
+      if (!fs12.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
       }
     }
@@ -4244,7 +4368,7 @@ function registerWatch(program) {
     const watchers = [];
     for (const w of watchRoots) {
       try {
-        const watcher = fs11.watch(w, { recursive: true }, (_event, filename) => {
+        const watcher = fs12.watch(w, { recursive: true }, (_event, filename) => {
           if (!filename) {
             schedule("change");
             return;
@@ -4257,12 +4381,12 @@ function registerWatch(program) {
         throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
       }
     }
-    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path41.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
-    await new Promise((resolve21) => {
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path43.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    await new Promise((resolve23) => {
       const stop = () => {
         for (const w of watchers) w.close();
         if (timer) clearTimeout(timer);
-        resolve21();
+        resolve23();
       };
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
@@ -4590,10 +4714,10 @@ function normalizeStandards(raw) {
 }
 function loadStandards(root2) {
   for (const rel of STANDARDS_FILES) {
-    const p = path41__default.join(root2, rel);
+    const p = path43__default.join(root2, rel);
     let text;
     try {
-      text = fs11__default.readFileSync(p, "utf8");
+      text = fs12__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -5311,8 +5435,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path43 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path43);
+  const path45 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path45);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -6089,14 +6213,14 @@ function buildLocalInferenceStatus(opts) {
   const dynamicCustomSampler = /^(1|true|yes)$/i.test(String(env.VG_LLM_CUSTOM_SAMPLER ?? ""));
   const preferOllama = /^(1|true|yes)$/i.test(String(env.VG_PREFER_OLLAMA ?? ""));
   const weightCatalog = catalogIntegrityReport();
-  const cached = listCachedWeights(env);
+  const cached2 = listCachedWeights(env);
   const sessions = listHostSessions();
   const recommendedMode = recommendMode(opts.system, opts.repo);
   const hints = [];
   if (!weightCatalog.complete) {
     hints.push(`weight catalog unpinned: ${weightCatalog.unpinned.join(", ")}`);
   }
-  if (cached.length === 0) {
+  if (cached2.length === 0) {
     hints.push("no first-party GGUF in weight store \u2014 `vg models install` for embedded path");
   }
   if (preferOllama) {
@@ -6121,8 +6245,8 @@ function buildLocalInferenceStatus(opts) {
     weightCatalog,
     weightStore: {
       dir: weightStoreDir(env),
-      cachedGgufs: cached.length,
-      names: cached.map((w) => w.name).slice(0, 12)
+      cachedGgufs: cached2.length,
+      names: cached2.map((w) => w.name).slice(0, 12)
     },
     hostPool: {
       size: hostSessionPoolSize(),
@@ -6255,7 +6379,7 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve21 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
+  const resolve23 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const sys = gatherSystemMemory();
@@ -6287,7 +6411,7 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve21);
+  applyGlobalOptions(resolve23);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
@@ -6524,7 +6648,7 @@ function registerModels(program) {
         );
       }
     } else {
-      if (!target.path || !fs11.existsSync(target.path)) {
+      if (!target.path || !fs12.existsSync(target.path)) {
         throw new CliError(
           `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
           ExitCode.NOT_FOUND
@@ -6538,7 +6662,7 @@ function registerModels(program) {
       }
       if (!global.json) info(c.dim(`  $ rm ${target.path}`));
       try {
-        fs11.unlinkSync(target.path);
+        fs12.unlinkSync(target.path);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
@@ -6676,9 +6800,9 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path41.resolve(opts.out);
-      fs11.mkdirSync(path41.dirname(outPath), { recursive: true });
-      fs11.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
+      const outPath = path43.resolve(opts.out);
+      fs12.mkdirSync(path43.dirname(outPath), { recursive: true });
+      fs12.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
     }
@@ -6792,11 +6916,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve21(/^y(es)?$/i.test(answer.trim()));
+      resolve23(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -6827,14 +6951,14 @@ function resolveUninstallTarget(name, runtimeOpt) {
     }
     return exact[0];
   }
-  const base = path41.basename(wantLc);
+  const base = path43.basename(wantLc);
   const soft = fleet.filter((m) => {
     const n = m.name.toLowerCase();
-    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path41.basename(n) === base;
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path43.basename(n) === base;
   });
   if (soft.length === 1) return soft[0];
   if (soft.length > 1) {
-    const baseHits = soft.filter((m) => path41.basename(m.name).toLowerCase() === base);
+    const baseHits = soft.filter((m) => path43.basename(m.name).toLowerCase() === base);
     const pool = baseHits.length ? baseHits : soft;
     const order = ["ollama", "gguf", "lm-studio"];
     for (const rt of order) {
@@ -6872,11 +6996,11 @@ function printBackends(backends) {
   }
 }
 function codeConfigPath(root2) {
-  return path41.join(root2, ".vibgrate", "code.json");
+  return path43.join(root2, ".vibgrate", "code.json");
 }
 function loadCodeConfig(root2) {
   try {
-    const raw = JSON.parse(fs11.readFileSync(codeConfigPath(root2), "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(codeConfigPath(root2), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -6943,7 +7067,7 @@ function contextBudgetFor(config, modelContextWindow) {
 var MCP_CONFIG_FILES = [".cursor/mcp.json", ".vscode/mcp.json", ".mcp.json"];
 function readMcpServersFile(file) {
   try {
-    const raw = JSON.parse(fs11.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(file, "utf8"));
     const map = raw.mcpServers ?? raw.servers;
     return map && typeof map === "object" ? parseMcpServers(map) : {};
   } catch {
@@ -6954,7 +7078,7 @@ function discoverMcpServers(root2, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path41.join(root2, rel));
+    const found = readMcpServersFile(path43.join(root2, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -6970,9 +7094,160 @@ function discoverMcpServers(root2, ownServers) {
 
 // src/commands/code.ts
 function registerCode(program) {
-  const cmd = program.command("code").description("propose a graph-grounded code edit (guided mode with no instruction; dry-run by default)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: vibgrate-relay (Vibgrate Relay), ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps", "24").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--session", "with --stream-json: stay open for further turns (warm graph and tools) instead of exiting after one").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue", "resume the most recent session (recap + restore /undo)").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
+  const cmd = program.command("code").description("propose a graph-grounded code edit (guided mode with no instruction; dry-run by default)").argument("[instruction...]", "what to change, in plain language (omit for guided interactive mode)").option("--provider <id>", "backend: vibgrate-relay (Vibgrate Relay), ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp").option("--model <id>", "model id (or set VG_CODE_MODEL). No model is hard-coded \u2014 pick the current best.").option("--mode <mode>", "Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)").option("--model-path <gguf>", "gguf path for --provider llama-cpp (weights are never auto-downloaded)").option("-f, --file <path>", "restrict the edit surface to this file (repeatable)", collect, []).option("-b, --budget <n>", "approx context token budget", "3000").option("--apply", "write the change (still requires --yes or an interactive confirm)").option("--yes", "consent to write / to a first-use package install, non-interactively").option("--auto", "autonomous agent: auto-approve every edit and command (use with care)").option("--max-steps <n>", "cap the number of agent steps", "24").option("--single", "one-shot planner (single edit) instead of the multi-step agent").option("--stream", "stream the model output live").option("--stream-json", "machine protocol: NDJSON agent events on stdout, approval decisions on stdin (for host UIs like the VS Code panel)").option("--session", "with --stream-json: stay open for further turns (warm graph and tools) instead of exiting after one").option("--verify [command]", "after the agent finishes, run tests and make it fix failures (uses the config testCommand if no command is given)").option("--continue [id]", "resume a session: the most recent one, or the given session id (recap + restore /undo)").option("--restore-checkpoint <commit>", "one-shot: restore the given --file paths from a checkpoint commit, then exit (for host UIs after the original session ended)").option("--reasoning-effort <level>", "how hard a reasoning-capable model should think: low | medium | high (ignored by models without the knob)").option("--worktree [id]", "run the session in an isolated git worktree under .vibgrate/worktrees (bare: create a new one; with id: reuse it)").option("--worktree-diff <id>", "one-shot: print the worktree's delta against its base as a patch, then exit").option("--worktree-apply <id>", "one-shot: apply the worktree's delta onto the main tree (git apply --3way), then exit").option("--worktree-remove <id>", "one-shot: remove the worktree checkout, then exit").option("--capsule", "use a source-bearing Task Capsule for first context (Fusion A/B; exact source ranges from the graph)").option("--no-capsule", "disable Task Capsule context even if enabled in .vibgrate/code.json").option("--security-tier <tier>", "shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available), L2/L3 reserved").option("--mock <file>", "use a scripted reply from <file> instead of a model (offline; for tests/CI)").option("-o, --out <file>", "write the JSON result to <file> (implies --json shape; for CI/benchmarks)").action(async function(instructionParts, opts) {
     const global = readGlobal(this);
-    const instruction = (instructionParts ?? []).join(" ").trim();
+    let instruction = (instructionParts ?? []).join(" ").trim();
+    if (typeof opts.continue === "string") {
+      const { looksLikeSessionId } = await import('./session-store-AQUORKWB.js');
+      if (!looksLikeSessionId(opts.continue)) {
+        instruction = [opts.continue, instruction].filter(Boolean).join(" ");
+        opts.continue = true;
+      }
+    }
+    if (opts.restoreCheckpoint) {
+      const { restoreCheckpoint, isValidCheckpointCommit } = await import('./checkpoint-UYMYMMQO.js');
+      if (!isValidCheckpointCommit(opts.restoreCheckpoint)) {
+        throw usageError("--restore-checkpoint expects a checkpoint commit id (hex SHA)");
+      }
+      const files = (opts.file ?? []).filter(Boolean);
+      if (!files.length) {
+        throw usageError("--restore-checkpoint needs the files to restore, e.g. -f src/a.ts -f src/b.ts");
+      }
+      const root3 = rootOf(global);
+      const child = await import('child_process');
+      const gitRunner = (gitArgs, gitEnv) => {
+        const res = child.spawnSync("git", gitArgs, {
+          cwd: root3,
+          encoding: "utf8",
+          env: { ...process.env, ...gitEnv ?? {} },
+          timeout: 3e4,
+          maxBuffer: 32 * 1024 * 1024
+        });
+        return { stdout: res.stdout ?? "", exitCode: res.status ?? 1 };
+      };
+      const outcome = restoreCheckpoint(gitRunner, { commit: opts.restoreCheckpoint, files });
+      if (opts.streamJson) {
+        process.stdout.write(
+          JSON.stringify({ event: "checkpoint-restored", commit: opts.restoreCheckpoint, ...outcome }) + "\n"
+        );
+      } else if (global.json) {
+        json({ commit: opts.restoreCheckpoint, ...outcome });
+      } else {
+        out(
+          `restored ${outcome.restored.length}, removed ${outcome.removed.length}, failed ${outcome.failed.length}`
+        );
+      }
+      if (outcome.failed.length) process.exitCode = 1;
+      return;
+    }
+    if (opts.worktreeDiff || opts.worktreeApply || opts.worktreeRemove) {
+      const wt = await import('./worktree-session-D575IQWM.js');
+      const child = await import('child_process');
+      const os7 = await import('os');
+      const pathMod = await import('path');
+      const root3 = rootOf(global);
+      const gitRunner = (gitArgs, gitEnv) => {
+        const res = child.spawnSync("git", gitArgs, {
+          cwd: root3,
+          encoding: "utf8",
+          env: { ...process.env, ...gitEnv ?? {} },
+          timeout: 6e4,
+          maxBuffer: 64 * 1024 * 1024
+        });
+        return { stdout: (res.stdout ?? "") + (res.stderr ?? ""), exitCode: res.status ?? 1 };
+      };
+      const emitLine = (line) => {
+        if (opts.streamJson) process.stdout.write(JSON.stringify(line) + "\n");
+        else if (global.json) json(line);
+      };
+      const findWt = (id) => wt.listSessionWorktrees(gitRunner, root3).find((w) => w.id === id);
+      if (opts.worktreeDiff) {
+        const target = findWt(opts.worktreeDiff);
+        if (!target) throw new CliError(`no worktree ${opts.worktreeDiff} under .vibgrate/worktrees`, ExitCode.NOT_FOUND);
+        const diff2 = wt.worktreeDiffToBase(gitRunner, target.path, target.base);
+        if ("error" in diff2) throw new CliError(diff2.error, ExitCode.ERROR);
+        const MAX_PATCH = 2 * 1024 * 1024;
+        const truncated = diff2.patch.length > MAX_PATCH;
+        emitLine({
+          event: "worktree-diff",
+          id: target.id,
+          base: target.base,
+          files: diff2.files,
+          patch: truncated ? diff2.patch.slice(0, MAX_PATCH) : diff2.patch,
+          truncated
+        });
+        if (!opts.streamJson && !global.json) {
+          out(diff2.patch || `worktree ${target.id}: no changes vs base`);
+        }
+        return;
+      }
+      if (opts.worktreeApply) {
+        const target = findWt(opts.worktreeApply);
+        if (!target) throw new CliError(`no worktree ${opts.worktreeApply} under .vibgrate/worktrees`, ExitCode.NOT_FOUND);
+        const diff2 = wt.worktreeDiffToBase(gitRunner, target.path, target.base);
+        if ("error" in diff2) throw new CliError(diff2.error, ExitCode.ERROR);
+        if (!diff2.files.length) {
+          emitLine({ event: "worktree-applied", id: target.id, applied: true, files: [] });
+          if (!opts.streamJson && !global.json) out(`worktree ${target.id}: nothing to apply`);
+          return;
+        }
+        const patchFile = pathMod.join(
+          fs12.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-wt-")),
+          "delta.patch"
+        );
+        fs12.writeFileSync(patchFile, diff2.patch);
+        const outcome = wt.applyWorktreePatch(gitRunner, root3, patchFile, diff2.files);
+        emitLine({ event: "worktree-applied", id: target.id, ...outcome });
+        if (!opts.streamJson && !global.json) {
+          out(
+            outcome.applied ? `applied ${outcome.files.length} file(s) from worktree ${target.id}` : `apply failed: ${outcome.error}`
+          );
+        }
+        if (!outcome.applied) process.exitCode = 1;
+        return;
+      }
+      if (opts.worktreeRemove) {
+        const outcome = wt.removeSessionWorktree(gitRunner, root3, opts.worktreeRemove);
+        emitLine({ event: "worktree-removed", id: opts.worktreeRemove, ...outcome });
+        if (!opts.streamJson && !global.json) {
+          out(outcome.removed ? `removed worktree ${opts.worktreeRemove}` : `remove failed: ${outcome.error}`);
+        }
+        if (!outcome.removed) process.exitCode = 1;
+        return;
+      }
+    }
+    const mainRoot = rootOf(global);
+    let activeWorktree;
+    if (opts.worktree) {
+      const wt = await import('./worktree-session-D575IQWM.js');
+      const child = await import('child_process');
+      const gitRunner = (gitArgs, gitEnv) => {
+        const res = child.spawnSync("git", gitArgs, {
+          cwd: mainRoot,
+          encoding: "utf8",
+          env: { ...process.env, ...gitEnv ?? {} },
+          timeout: 6e4,
+          maxBuffer: 64 * 1024 * 1024
+        });
+        return { stdout: (res.stdout ?? "") + (res.stderr ?? ""), exitCode: res.status ?? 1 };
+      };
+      if (typeof opts.worktree === "string") {
+        const existing = wt.listSessionWorktrees(gitRunner, mainRoot).find((w) => w.id === opts.worktree);
+        if (!existing) {
+          throw new CliError(`no worktree ${opts.worktree} under .vibgrate/worktrees \u2014 start one with --worktree`, ExitCode.NOT_FOUND);
+        }
+        activeWorktree = existing;
+      } else {
+        const created = wt.createSessionWorktree(
+          gitRunner,
+          mainRoot,
+          `wt${Date.now().toString(36)}`
+        );
+        if ("error" in created) throw new CliError(created.error, ExitCode.ERROR);
+        activeWorktree = created;
+      }
+      global.cwd = activeWorktree.path;
+    }
     if (!global.local) {
       await ensureRelevanceModule();
     }
@@ -6986,7 +7261,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-IIWVYUN7.js');
+        const { loadGraph: loadGraph2 } = await import('./load-XZV5LEGA.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -7071,7 +7346,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-YEMXHGBO.js');
+      const { runInteractive } = await import('./interactive-WRA477OW.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -7101,7 +7376,7 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-TYMYYIJE.js');
+      const { ensureCodeMap } = await import('./ensure-map-EURJPSAK.js');
       const mapRoot = rootOf(global);
       try {
         await ensureCodeMap(mapRoot, global, {
@@ -7138,7 +7413,7 @@ function registerCode(program) {
     let mockReply;
     if (opts.mock) {
       try {
-        mockReply = fs11.readFileSync(opts.mock, "utf8");
+        mockReply = fs12.readFileSync(opts.mock, "utf8");
       } catch {
         throw new CliError(`couldn't read the --mock file: ${opts.mock}`, ExitCode.USAGE_ERROR);
       }
@@ -7186,20 +7461,20 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-2JO55QCC.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-X5KS6AUE.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-DUCFTBUF.js');
-        const { nodeCodeFs } = await import('./session-5LFX4U2E.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-LKVPDKXP.js');
+        const { nodeCodeFs } = await import('./session-3R34WA5S.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-HFKGKQV7.js');
-        const { resolveGraphBackend } = await import('./graph-backend-5YOWNHHG.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-J7GDVRFU.js');
+        const { resolveGraphBackend } = await import('./graph-backend-VUW2QWPI.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-LFHQ4GWC.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-UIFH5TTW.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7257,7 +7532,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-4KPDQUFN.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZPJAHP7T.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -7277,11 +7552,11 @@ ${res.stderr}` : ""),
           };
         }
         const externalTools = mergeExternalToolsets(vgBuiltin, projectMcp);
-        const { createCheckpoint } = await import('./checkpoint-4WFZMKEO.js');
-        const os6 = await import('os');
+        const { createCheckpoint } = await import('./checkpoint-UYMYMMQO.js');
+        const os7 = await import('os');
         const pathMod = await import('path');
         const checkpointIndex = pathMod.join(
-          fs11.mkdtempSync(pathMod.join(os6.tmpdir(), "vg-code-cp-")),
+          fs12.mkdtempSync(pathMod.join(os7.tmpdir(), "vg-code-cp-")),
           "index"
         );
         const gitRunner = (gitArgs, gitEnv) => {
@@ -7302,6 +7577,7 @@ ${res.stderr}` : ""),
           files,
           indexFile: checkpointIndex
         });
+        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-DOZ5RWJP.js');
         const { loadProjectRules, nodeRulesReader } = await import('./rules-ASYEUNB5.js');
         const projectRules = loadProjectRules(nodeRulesReader(root2));
         if (projectRules.sources.length && !global.quiet) {
@@ -7325,6 +7601,9 @@ ${res.stderr}` : ""),
           graphBackend,
           modelProfile,
           auto: !!auto,
+          // v5: spawn-time reasoning budget. Session mode lets a per-turn
+          // value override it; one-shot runs use this.
+          reasoningEffort: parseReasoningEffort(opts.reasoningEffort),
           maxSteps,
           budget: modelProfile.capsuleBudgetTokens,
           contextBudget,
@@ -7347,27 +7626,43 @@ ${res.stderr}` : ""),
           },
           now: () => Date.now(),
           projectRules: projectRules.rendered || void 0,
-          checkpoint: takeCheckpoint
+          checkpoint: takeCheckpoint,
+          // Standing allow-always rules, re-read per approval so an
+          // "Always allow" or a revocation applies to the very next action.
+          // Always the MAIN root: consent is per-developer, and a worktree
+          // checkout has no code-approvals.json (it is gitignored).
+          approvalRules: () => loadApprovalRules(mainRoot)
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession } = await import('./stream-json-DUCFTBUF.js');
-            const { runAgent: runAgent2 } = await import('./agent-K3J6EHLI.js');
+            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-LKVPDKXP.js');
+            const { runAgent: runAgent2 } = await import('./agent-2ZISYEQF.js');
             const {
               condenseSession,
               loadLatestSession,
+              loadSession,
               newSession,
               recordTask,
               saveSession,
+              sessionsDir,
               summarizeSession
-            } = await import('./session-store-KGONLWHN.js');
-            const resumedRecord = opts.continue ? loadLatestSession(root2) : void 0;
+            } = await import('./session-store-AQUORKWB.js');
+            const { VERSION: VERSION2 } = await import('./version-55TOTJTF.js');
+            const resumedRecord = typeof opts.continue === "string" ? loadSession(mainRoot, opts.continue) : opts.continue ? loadLatestSession(mainRoot) : void 0;
+            if (typeof opts.continue === "string" && !resumedRecord) {
+              emitStream({
+                event: "event",
+                type: "notice",
+                text: `Could not load session ${opts.continue} \u2014 starting a fresh conversation.`
+              });
+            }
             let record = resumedRecord ?? newSession(
               `s${Date.now().toString(36)}`,
               primarySlug ?? route.providers[0]?.id ?? "unknown",
               route.providers[0]?.model ?? "unknown",
               Date.now()
             );
+            if (activeWorktree) record = { ...record, worktree: activeWorktree };
             const pendingTurns = [];
             let wakeTurn;
             let ended = false;
@@ -7384,32 +7679,54 @@ ${res.stderr}` : ""),
               if (ended) return Promise.resolve(null);
               const queued = pendingTurns.shift();
               if (queued !== void 0) return Promise.resolve(queued);
-              return new Promise((resolve21) => {
-                wakeTurn = resolve21;
+              return new Promise((resolve23) => {
+                wakeTurn = resolve23;
               });
             };
             let turnIndex = 0;
+            let lastTurnAttachments;
             await runCodeStreamJsonSession({
               emit: emitAndRecord,
               auto: !!auto,
               sessionId: record.id,
               resumed: !!resumedRecord,
+              // Environment facts for the host: where sessions live (the
+              // single source of truth for history UIs, fixing multi-root
+              // ambiguity) and the versions in play for its first-use report.
+              sessionInfo: {
+                sessionDir: sessionsDir(mainRoot),
+                engineVersion: VERSION2,
+                protocolVersion: STREAM_JSON_PROTOCOL_VERSION,
+                provider: primarySlug,
+                model: route.providers[0]?.model,
+                ...activeWorktree ? { worktree: { path: activeWorktree.path, base: activeWorktree.base } } : {}
+              },
               instruction,
               nextTurn,
               bindDecisions: (session) => {
                 streamApprove = (action) => session.approve(action);
+                session.onAlwaysRule = (action) => {
+                  const rule = ruleForAction(action);
+                  if (!rule) return;
+                  const saved = addApprovalRule(mainRoot, rule);
+                  emitStream({
+                    event: "event",
+                    type: "notice",
+                    text: saved ? `Always-allow rule saved: ${ruleLabel(rule)} (manage in .vibgrate/code-approvals.json)` : "Could not save the always-allow rule (is .vibgrate writable?) \u2014 approved this once."
+                  });
+                };
                 const rl = readline6.createInterface({ input: process.stdin });
                 rl.on("line", (raw) => {
                   const msg = parseHostMessage(raw);
                   if (!msg) return;
                   if (msg.kind === "approve") {
-                    session.submitDecision(msg.id, msg.approve);
+                    session.submitDecision(msg.id, msg.approve, msg.always);
                     runOutcome.noteDecision(msg.id, msg.approve);
                   } else if (msg.kind === "answer") session.submitAnswer(msg.id, msg.answer);
                   else if (msg.kind === "submit")
                     pushTurn({ instruction: msg.instruction, agentMode: msg.agentMode, images: msg.images });
                   else if (msg.kind === "restore") {
-                    void import('./checkpoint-4WFZMKEO.js').then(({ restoreCheckpoint }) => {
+                    void import('./checkpoint-UYMYMMQO.js').then(({ restoreCheckpoint }) => {
                       const outcome = restoreCheckpoint(gitRunner, {
                         commit: msg.commit,
                         files: msg.files
@@ -7418,12 +7735,22 @@ ${res.stderr}` : ""),
                     });
                   } else if (msg.kind === "compact") {
                     record = condenseSession(record, Date.now());
-                    saveSession(root2, record);
+                    saveSession(mainRoot, record);
                     emitStream({
                       event: "event",
                       type: "notice",
                       text: "Conversation compacted \u2014 earlier turns condensed into a checkpoint."
                     });
+                  } else if (msg.kind === "inject") {
+                    session.inject(msg.text);
+                  } else if (msg.kind === "rename") {
+                    const t = msg.title.slice(0, 120);
+                    if (t) record = { ...record, title: t };
+                    else {
+                      record = { ...record };
+                      delete record.title;
+                    }
+                    saveSession(mainRoot, record);
                   } else if (msg.kind === "cancel") {
                     session.cancelTurn();
                     runOutcome.cancelPending();
@@ -7439,7 +7766,8 @@ ${res.stderr}` : ""),
                   pushTurn(null);
                 });
               },
-              runTurn: ({ instruction: turnInstruction, signal, session, agentMode, auto: turnAuto, images }) => {
+              runTurn: ({ instruction: turnInstruction, signal, session, agentMode, auto: turnAuto, images, reasoningEffort: turnEffort, attachments: turnAttachments }) => {
+                lastTurnAttachments = turnAttachments;
                 const priorSummary = summarizeSession(record) || void 0;
                 turnIndex++;
                 runOutcome.beginRun(turnRunId(record.id, turnIndex), turnInstruction);
@@ -7448,6 +7776,8 @@ ${res.stderr}` : ""),
                 return runAgent2({
                   ...baseAgentOptions,
                   instruction: turnInstruction,
+                  // v4 steer: the loop drains injected content at each step.
+                  takeInjected: () => session.drainInjected(),
                   priorSummary,
                   // Carry-over for capsule seed ranking: the previous
                   // turn's instruction (the current turn is recorded only
@@ -7457,6 +7787,9 @@ ${res.stderr}` : ""),
                   auto: turnAuto,
                   plan,
                   images,
+                  // v5: per-turn reasoning budget beats the spawn-time flag,
+                  // so a host's effort picker takes effect without a respawn.
+                  reasoningEffort: turnEffort ?? baseAgentOptions.reasoningEffort,
                   approve: session.approve,
                   askUser: session.askUser,
                   onEvent: session.onEvent
@@ -7469,11 +7802,13 @@ ${res.stderr}` : ""),
                     instruction: turn.instruction,
                     summary: turn.result?.finalText ?? "turn failed",
                     changes: turn.result?.changes ?? [],
-                    stopped: turn.result?.stopped ?? "error"
+                    stopped: turn.result?.stopped ?? "error",
+                    // Metadata only — recordTask never stores the bytes.
+                    attachments: lastTurnAttachments
                   },
                   Date.now()
                 );
-                saveSession(root2, record);
+                saveSession(mainRoot, record);
                 return summarizeSession(record);
               }
             });
@@ -7485,12 +7820,16 @@ ${res.stderr}` : ""),
               emit: emitAndRecord,
               bindDecisions: (session) => {
                 streamApprove = (action) => session.approve(action);
+                session.onAlwaysRule = (action) => {
+                  const rule = ruleForAction(action);
+                  if (rule) addApprovalRule(mainRoot, rule);
+                };
                 const rl = readline6.createInterface({ input: process.stdin });
                 rl.on("line", (raw) => {
                   const msg = parseHostMessage(raw);
                   if (!msg) return;
                   if (msg.kind === "approve") {
-                    session.submitDecision(msg.id, msg.approve);
+                    session.submitDecision(msg.id, msg.approve, msg.always);
                     runOutcome.noteDecision(msg.id, msg.approve);
                   } else if (msg.kind === "answer") session.submitAnswer(msg.id, msg.answer);
                   else if (msg.kind === "cancel") {
@@ -7520,21 +7859,23 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-YEMXHGBO.js');
-      const { nodeCodeFs } = await import('./session-5LFX4U2E.js');
+      const { agentTask } = await import('./interactive-WRA477OW.js');
+      const { nodeCodeFs } = await import('./session-3R34WA5S.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
       if (opts.continue) {
-        const { loadLatestSession, summarizeSession } = await import('./session-store-KGONLWHN.js');
-        const prev = loadLatestSession(root2);
+        const { loadLatestSession, loadSession, summarizeSession } = await import('./session-store-AQUORKWB.js');
+        const prev = typeof opts.continue === "string" ? loadSession(mainRoot, opts.continue) : loadLatestSession(mainRoot);
         if (prev) {
           priorSummary = summarizeSession(prev);
           priorInstruction = prev.tasks.at(-1)?.instruction;
+        } else if (typeof opts.continue === "string") {
+          info(`could not load session ${opts.continue} \u2014 continuing without its recap`);
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-4KPDQUFN.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZPJAHP7T.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -7558,11 +7899,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-HFKGKQV7.js');
-        const { resolveGraphBackend } = await import('./graph-backend-5YOWNHHG.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-J7GDVRFU.js');
+        const { resolveGraphBackend } = await import('./graph-backend-VUW2QWPI.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-LFHQ4GWC.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-UIFH5TTW.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -7656,7 +7997,7 @@ ${res.stderr}` : ""),
       attribution: { client: "vg-code", provider: providerSlug, model: primary?.model }
     });
     if (opts.out) {
-      fs11.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
+      fs12.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
     }
     if (global.json) {
       json(result);
@@ -7708,11 +8049,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm2(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve21(/^y(es)?$/i.test(answer.trim()));
+      resolve23(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -7869,7 +8210,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs11__default.readFileSync(path41__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs12__default.readFileSync(path43__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -7877,7 +8218,7 @@ function readPackageVersion(root2) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs11__default.readFileSync(p, "utf8");
+    const t = fs12__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -7892,8 +8233,8 @@ async function publishCmd(root2, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root2) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path41__default.resolve(opts.readme) : path41__default.join(root2, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path41__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path43__default.resolve(opts.readme) : path43__default.join(root2, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path43__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -8025,8 +8366,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs11.mkdirSync(path41.dirname(path41.resolve(file)), { recursive: true });
-    fs11.writeFileSync(file, content);
+    fs12.mkdirSync(path43.dirname(path43.resolve(file)), { recursive: true });
+    fs12.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -8036,43 +8377,43 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path41.extname(file));
+  return formatForExt(path43.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const outDir = path41.resolve(root2, opts.out ?? "vg-bundle");
+    const outDir = path43.resolve(root2, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs11.mkdirSync(path41.join(outDir, "grammars"), { recursive: true });
+    fs12.mkdirSync(path43.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs11.copyFileSync(absPath, path41.join(outDir, "grammars", fileName));
+      fs12.copyFileSync(absPath, path43.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
-    if (fs11.existsSync(graphSrc)) {
-      fs11.copyFileSync(graphSrc, path41.join(outDir, "graph.json"));
+    if (fs12.existsSync(graphSrc)) {
+      fs12.copyFileSync(graphSrc, path43.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs11.writeFileSync(path41.join(outDir, "graph.json"), serializeGraph(graph));
+        fs12.writeFileSync(path43.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
     const cat = catalogPath(root2);
-    if (fs11.existsSync(cat)) {
-      fs11.copyFileSync(cat, path41.join(outDir, "vibgrate.lib.json"));
+    if (fs12.existsSync(cat)) {
+      fs12.copyFileSync(cat, path43.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs11.existsSync(libDir(root2))) {
-        fs11.cpSync(libDir(root2), path41.join(outDir, "lib"), { recursive: true });
+      if (fs12.existsSync(libDir(root2))) {
+        fs12.cpSync(libDir(root2), path43.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -8084,15 +8425,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs11.writeFileSync(path41.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs12.writeFileSync(path43.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path41.relative(root2, outDir), ...manifest });
+      json({ out: path43.relative(root2, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path41.relative(root2, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path43.relative(root2, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path41.relative(root2, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path43.relative(root2, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -8110,7 +8451,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs11.existsSync(path41.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs12.existsSync(path43.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -8136,14 +8477,14 @@ async function runDoctor(global) {
     root: root2,
     configFile,
     map: {
-      path: path41.relative(root2, graphPath),
+      path: path43.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path41.relative(root2, catalogPath(root2)),
-      present: fs11.existsSync(catalogPath(root2)),
+      path: path43.relative(root2, catalogPath(root2)),
+      present: fs12.existsSync(catalogPath(root2)),
       libraries: libCount
     },
     credentials: creds,
@@ -8200,7 +8541,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path41.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path43.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -8333,10 +8674,16 @@ function registerDaemon(program) {
     }
     const child = await startDetachedVgd(socketPath);
     const res = await vgdRequest({ op: "status" }, { socketPath });
+    if (!res.ok) {
+      throw new CliError(
+        `vgd started (pid ${child ?? "?"}) but status failed: ${res.error} (${socketPath})`,
+        ExitCode.ERROR
+      );
+    }
     if (global.json) {
-      json({ running: true, ensured: true, ...res.ok ? res : { socketPath } });
+      json({ running: true, ensured: true, ...res });
     } else if (!global.quiet) {
-      const pid = res.ok && "pid" in res ? res.pid : child;
+      const pid = "pid" in res ? res.pid : child;
       info(`vgd \xB7 started in background pid ${pid} \xB7 ${c.dim(socketPath)}`);
     }
   });
@@ -8394,7 +8741,7 @@ function registerDaemon(program) {
   const register = cmd.command("register").description("register the current repository with a running vgd").argument("[root]", "repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path41.resolve(rootArg ?? rootOf(global));
+    const root2 = path43.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8430,7 +8777,7 @@ function registerDaemon(program) {
   const federation = cmd.command("federation").description("register a multi-root federation from .vibgrate/federation.json (or primary cwd)").argument("[root]", "primary repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const primary = path41.resolve(rootArg ?? rootOf(global));
+    const primary = path43.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8458,7 +8805,7 @@ function registerDaemon(program) {
   const publish = cmd.command("publish").description("load the workspace code map into vgd ActiveGraph (from global/legacy store)").argument("[root]", "repository root (default: cwd)").option("--git-ref <ref>", "branch or SHA (default: detect HEAD)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path41.resolve(rootArg ?? rootOf(global));
+    const root2 = path43.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -8472,7 +8819,7 @@ function registerDaemon(program) {
       throw new CliError(loaded.error, ExitCode.NOT_FOUND);
     }
     if (!loaded.ok) {
-      const { loadGraph: loadGraph2 } = await import('./load-IIWVYUN7.js');
+      const { loadGraph: loadGraph2 } = await import('./load-XZV5LEGA.js');
       const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
       const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
       const graph = loadGraph2(root2, global.graph);
@@ -8588,25 +8935,23 @@ function socketOf(cmd) {
   let c2 = cmd;
   while (c2) {
     const opts = c2.opts();
-    if (opts.socket) return path41.resolve(opts.socket);
+    if (opts.socket) return path43.resolve(opts.socket);
     c2 = c2.parent;
   }
   return vgdSocketPath();
 }
 function spawnDetachedDaemonStart(socketPath) {
+  const opts = {
+    detached: true,
+    stdio: "ignore",
+    env: process.env,
+    windowsHide: true
+  };
   const entry = process.argv[1];
   if (entry && (entry.endsWith(".js") || entry.endsWith(".mjs") || entry.endsWith(".cjs"))) {
-    return spawn(process.execPath, [entry, "daemon", "start", "--socket", socketPath], {
-      detached: true,
-      stdio: "ignore",
-      env: process.env
-    });
+    return spawn(process.execPath, [entry, "daemon", "start", "--socket", socketPath], opts);
   }
-  return spawn(process.argv[0] || "vg", ["daemon", "start", "--socket", socketPath], {
-    detached: true,
-    stdio: "ignore",
-    env: process.env
-  });
+  return spawn(process.argv[0] || "vg", ["daemon", "start", "--socket", socketPath], opts);
 }
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
@@ -8614,12 +8959,22 @@ function sleep(ms) {
 async function startDetachedVgd(socketPath) {
   const child = spawnDetachedDaemonStart(socketPath);
   child.unref();
-  const deadline = Date.now() + 8e3;
+  const readyMs = 3e4;
+  const deadline = Date.now() + readyMs;
   while (Date.now() < deadline) {
-    await sleep(100);
+    await sleep(150);
     if (await vgdIsRunning({ socketPath })) return child.pid;
+    if (child.exitCode != null && child.exitCode !== 0) {
+      throw new CliError(
+        `vgd child exited ${child.exitCode} before becoming ready at ${socketPath}`,
+        ExitCode.ERROR
+      );
+    }
   }
-  throw new CliError(`vgd failed to become ready at ${socketPath}`, ExitCode.ERROR);
+  throw new CliError(
+    `vgd failed to become ready within ${Math.round(readyMs / 1e3)}s at ${socketPath}`,
+    ExitCode.ERROR
+  );
 }
 async function stopVgd(socketPath) {
   if (!await vgdIsRunning({ socketPath })) return "not-running";
@@ -8660,7 +9015,7 @@ async function restartVgdIfRunning(socketPath = vgdSocketPath()) {
 }
 function readVgdPid() {
   try {
-    const raw = fs11.readFileSync(vgdPidPath(), "utf8").trim();
+    const raw = fs12.readFileSync(vgdPidPath(), "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -8745,7 +9100,7 @@ function registerPolicy(program) {
     const global = readGlobal(this);
     let raw;
     try {
-      raw = fs11.readFileSync(file, "utf8");
+      raw = fs12.readFileSync(file, "utf8");
     } catch {
       throw new CliError(`cannot read ${file}`, ExitCode.NOT_FOUND);
     }
@@ -8864,12 +9219,299 @@ function registerLlmHost(program) {
   });
   applyGlobalOptions(cmd);
 }
+var DIGEST_FORMATS = ["md", "json", "html"];
+var DIGEST_LEVELS = ["concise", "full"];
+var MAP_FORMATS = ["json", "md", "mermaid"];
+var MAP_PROFILES = ["integration", "migration", "governance"];
+var GATE_FORMATS = ["text", "json", "sarif"];
+var LANGUAGE_EXTENSIONS = {
+  rust: [".rs"],
+  ruby: [".rb", ".rake", ".gemspec"],
+  php: [".php"],
+  dart: [".dart"],
+  swift: [".swift"],
+  scala: [".scala", ".sc"],
+  cplusplus: [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx", ".h", ".ixx"],
+  cobol: [".cbl", ".cob", ".cpy", ".cob85", ".cobol"],
+  vb6: [".vbp", ".bas", ".cls", ".frm", ".ctl", ".dsr"]
+};
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".vibgrate",
+  ".hg",
+  ".svn",
+  "dist",
+  "build",
+  "out",
+  "bin",
+  "obj",
+  "target",
+  "vendor",
+  "coverage",
+  "__pycache__",
+  "DerivedData",
+  "Pods"
+]);
+var TEST_PATTERNS = [/[/\\]tests?[/\\]/i, /[/\\]__tests__[/\\]/i, /[/\\]spec[/\\]/i, /\.spec\./i, /\.test\./i];
+var MAX_EXTRACT_FILE_BYTES = 2 * 1024 * 1024;
+async function requireEngine() {
+  if (kernelDisabled()) {
+    throw engineUnavailable(
+      "vg hcs needs the HCS engine module, but VIBGRATE_NO_KERNEL is set \u2014 unset it and retry"
+    );
+  }
+  let engine = await loadHcsEngine();
+  if (engine) return engine;
+  const result = await ensureHcsModule();
+  if (result.status === "installed") {
+    info(c.dim(`installed ${HCS_MODULE_NAME}@${result.version} (proprietary license, runs fully locally)`));
+    resetHcsEngineCache();
+    engine = await loadHcsEngine();
+    if (engine) return engine;
+  }
+  if (result.status === "declined") {
+    throw engineUnavailable(
+      "the HCS engine module was previously declined \u2014 run `vg module install hcs` to install it"
+    );
+  }
+  throw engineUnavailable(
+    `the HCS engine module is not installed and could not be fetched${result.detail ? ` (${result.detail})` : ""} \u2014 run \`vg module install hcs\` on a machine with registry access, or point VIBGRATE_HCS_PATH at an installed engine. This exit (6, ENGINE_UNAVAILABLE) is distinct from a gate failure (2) by design.`
+  );
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function readFileOrThrow(file, label) {
+  const p = path43.resolve(file);
+  if (!fs12.existsSync(p)) throw usageError(`${label} file not found: ${p}`);
+  return fs12.readFileSync(p, "utf-8");
+}
+async function readInput(file, label) {
+  return file ? readFileOrThrow(file, label) : readStdin();
+}
+function writeOutput(outFile, content) {
+  if (!outFile) {
+    process.stdout.write(content.endsWith("\n") ? content : content + "\n");
+    return;
+  }
+  const outPath = path43.resolve(outFile);
+  const dir = path43.dirname(outPath);
+  if (!fs12.existsSync(dir)) throw usageError(`output directory does not exist: ${dir}`);
+  fs12.writeFileSync(outPath, content.endsWith("\n") ? content : content + "\n", "utf-8");
+  info(c.dim(`wrote ${outPath}`));
+}
+function requireChoice(value, valid2, flag) {
+  if (!valid2.includes(value)) throw usageError(`${flag} must be one of: ${valid2.join(", ")}`);
+}
+function engineCall(what, fn) {
+  try {
+    return fn();
+  } catch (err) {
+    throw new CliError(`${what} failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function registerHcs(program) {
+  const cmd = program.command("hcs").description("Holistic Code Specification \u2014 extract and analyze deterministic code facts");
+  cmd.command("extract").description("extract HCS facts from source into an NDJSON stream").argument("[dir]", "directory to extract from", ".").option("--language <lang>", "only extract this language (default: all the engine supports)").option("--include-tests", "include test files (excluded by default)").option("-o, --out <file>", "write NDJSON to file (default: stdout)").option(
+    "--previous <file>",
+    "previous extract output to update incrementally (default: the --out file, so repeated `-o` runs are incremental; a missing file means a full extraction)"
+  ).option("--full", "ignore the previous stream and re-extract every file from scratch").action(async function(dir, opts) {
+    const engine = await requireEngine();
+    if (!engine.extractFacts || !engine.supportedLanguages) {
+      throw engineUnavailable(
+        "the installed HCS engine does not include extraction \u2014 update it with `vg module install hcs --force`"
+      );
+    }
+    const canIncremental = Boolean(engine.planExtract && engine.mergeExtract);
+    if (opts.previous && !canIncremental) {
+      throw engineUnavailable(
+        "the installed HCS engine does not include incremental extraction \u2014 update it with `vg module install hcs --force`"
+      );
+    }
+    const statePath = opts.previous ?? opts.out;
+    const useIncremental = canIncremental && statePath !== void 0;
+    const root2 = path43.resolve(dir);
+    if (!fs12.existsSync(root2) || !fs12.statSync(root2).isDirectory()) {
+      throw usageError(`not a directory: ${root2}`);
+    }
+    const supported = new Set(
+      engine.supportedLanguages().split(",").map((l) => l.trim()).filter(Boolean)
+    );
+    if (opts.language && !supported.has(opts.language)) {
+      throw usageError(`--language must be one of: ${[...supported].sort().join(", ")}`);
+    }
+    const wanted = opts.language ? /* @__PURE__ */ new Set([opts.language]) : supported;
+    const extToLang = /* @__PURE__ */ new Map();
+    for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) {
+      if (wanted.has(lang)) for (const ext of exts) extToLang.set(ext, lang);
+    }
+    const byLanguage = /* @__PURE__ */ new Map();
+    const walk2 = (abs, rel) => {
+      let entries;
+      try {
+        entries = fs12.readdirSync(abs, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const entry of entries.sort((a, b) => a.name < b.name ? -1 : 1)) {
+        if (entry.name.startsWith(".")) continue;
+        const absChild = path43.join(abs, entry.name);
+        const relChild = rel ? `${rel}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+          if (!SKIP_DIRS2.has(entry.name)) walk2(absChild, relChild);
+          continue;
+        }
+        if (!entry.isFile()) continue;
+        if (!opts.includeTests && TEST_PATTERNS.some((p) => p.test(relChild))) continue;
+        const lang = extToLang.get(path43.extname(entry.name).toLowerCase());
+        if (!lang) continue;
+        try {
+          if (fs12.statSync(absChild).size > MAX_EXTRACT_FILE_BYTES) continue;
+          const content = fs12.readFileSync(absChild, "utf-8");
+          let bucket = byLanguage.get(lang);
+          if (!bucket) byLanguage.set(lang, bucket = []);
+          bucket.push({ path: relChild, content });
+        } catch {
+        }
+      }
+    };
+    walk2(root2, "");
+    if (byLanguage.size === 0 && !useIncremental) {
+      info(`no extractable sources found under ${root2} (languages: ${[...wanted].sort().join(", ")})`);
+      writeOutput(opts.out, "");
+      return;
+    }
+    const extractLanguage = (language, only) => {
+      let files = byLanguage.get(language);
+      if (only) files = files.filter((f) => only.has(f.path));
+      if (files.length === 0) return "";
+      info(c.dim(`extracting ${language} (${files.length} files)`));
+      return engineCall(
+        `${language} extraction`,
+        () => engine.extractFacts(JSON.stringify({ language, files, emittedAt: "" }))
+      ).trim();
+    };
+    const languages = [...byLanguage.keys()].sort();
+    if (!useIncremental) {
+      const parts2 = languages.map((l) => extractLanguage(l)).filter(Boolean);
+      writeOutput(opts.out, parts2.join("\n"));
+      return;
+    }
+    const previousPath = path43.resolve(statePath);
+    const previousNdjson = !opts.full && fs12.existsSync(previousPath) ? fs12.readFileSync(previousPath, "utf-8") : "";
+    if (opts.full) info(c.dim("running a full re-extraction (--full)"));
+    else if (!previousNdjson) info(c.dim(`previous stream not found at ${previousPath} \u2014 running a full extraction`));
+    const currentFilesJson = JSON.stringify(
+      languages.flatMap((l) => byLanguage.get(l).map((f) => ({ path: f.path, content: f.content })))
+    );
+    const plan = JSON.parse(
+      engineCall("incremental planning", () => engine.planExtract(previousNdjson, currentFilesJson))
+    );
+    const toExtract = /* @__PURE__ */ new Set([...plan.added, ...plan.changed]);
+    info(
+      c.dim(
+        `incremental plan (${plan.mode}): ${plan.added.length} added, ${plan.changed.length} changed, ${plan.removed.length} removed, ${plan.unchanged} unchanged`
+      )
+    );
+    const parts = languages.map((l) => extractLanguage(l, toExtract)).filter(Boolean);
+    const merged = JSON.parse(
+      engineCall(
+        "incremental merge",
+        () => engine.mergeExtract(previousNdjson, parts.join("\n"), currentFilesJson)
+      )
+    );
+    info(
+      c.dim(
+        `merged: ${merged.stats.reusedFacts} facts reused, ${merged.stats.freshFacts} fresh, ${merged.stats.droppedFacts} dropped`
+      )
+    );
+    writeOutput(opts.out, merged.ndjson);
+  });
+  cmd.command("digest").description("render an HCS NDJSON fact stream (from `vg hcs extract`) as Markdown, JSON, or HTML").option("--in <file>", "NDJSON file to read (default: stdin)").option("-o, --out <file>", "write output to file (default: stdout)").option("--format <format>", `output format: ${DIGEST_FORMATS.join(" | ")}`, "md").option("--level <level>", `detail level: ${DIGEST_LEVELS.join(" | ")}`, "concise").option("--title <title>", "override the document title").action(async function(opts) {
+    requireChoice(opts.format, DIGEST_FORMATS, "--format");
+    requireChoice(opts.level, DIGEST_LEVELS, "--level");
+    const engine = await requireEngine();
+    const ndjson = await readInput(opts.in, "input");
+    const options = { format: opts.format, level: opts.level };
+    if (opts.title) options.title = opts.title;
+    writeOutput(opts.out, engineCall("digest rendering", () => engine.renderDigest(ndjson, JSON.stringify(options))));
+  });
+  cmd.command("map").description("build the System Map from an HCS NDJSON fact stream").option("--facts <file>", "NDJSON facts file to read (default: stdin)").option("-o, --out <file>", "write output to file (default: stdout)").option("--format <format>", `output format: ${MAP_FORMATS.join(" | ")}`, "json").option("--profile <profile>", `consumer projection: ${MAP_PROFILES.join(" | ")}`).action(async function(opts) {
+    requireChoice(opts.format, MAP_FORMATS, "--format");
+    if (opts.profile) requireChoice(opts.profile, MAP_PROFILES, "--profile");
+    const generatedAt = readGlobal(this).generatedAt;
+    const engine = await requireEngine();
+    const ndjson = await readInput(opts.facts, "facts");
+    const options = { format: opts.format };
+    if (opts.profile) options.profile = opts.profile;
+    if (generatedAt) options.generatedAt = generatedAt;
+    writeOutput(opts.out, engineCall("map build", () => engine.buildMap(ndjson, JSON.stringify(options))));
+  });
+  cmd.command("gate").description("governance gate \u2014 diff two HCS fact streams and fail (exit 2) on material structural regressions").requiredOption("--baseline <file>", 'baseline NDJSON facts (the "before" stream)').option("--facts <file>", 'current NDJSON facts (the "after" stream; default: stdin)').option("--policy <file>", "gate policy JSON \u2014 thresholds and disabled rules").option("-o, --out <file>", "write the result to file (default: stdout)").option("--format <format>", `output format: ${GATE_FORMATS.join(" | ")}`, "text").action(async function(opts) {
+    requireChoice(opts.format, GATE_FORMATS, "--format");
+    const engine = await requireEngine();
+    const before = readFileOrThrow(opts.baseline, "baseline");
+    const after = await readInput(opts.facts, "facts");
+    let policy;
+    if (opts.policy) {
+      try {
+        policy = JSON.parse(readFileOrThrow(opts.policy, "policy"));
+      } catch (err) {
+        if (err instanceof CliError) throw err;
+        throw usageError(`invalid policy JSON: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const jsonOut = engineCall(
+      "gate evaluation",
+      () => engine.evaluateGate(before, after, JSON.stringify({ format: "json", policy }))
+    );
+    const pass = JSON.parse(jsonOut).pass;
+    const output = opts.format === "json" ? jsonOut : engineCall("gate evaluation", () => engine.evaluateGate(before, after, JSON.stringify({ format: opts.format, policy })));
+    writeOutput(opts.out, output);
+    if (!pass) {
+      info(c.red("gate FAILED \u2014 material structural regression against the baseline"));
+      process.exitCode = ExitCode.GATE_FAILED;
+    } else {
+      info(c.green("gate passed"));
+    }
+  });
+  cmd.command("validate").description("validate an HCS NDJSON model against the spec (exits with the Appendix-I conformance code)").argument("<file>", "NDJSON model file (e.g. `vg hcs extract` output)").action(async function(file) {
+    const opts = { json: readGlobal(this).json };
+    const engine = await requireEngine();
+    if (!engine.validateLines) {
+      throw engineUnavailable(
+        "the installed HCS engine does not include the validator \u2014 update it with `vg module install hcs --force`"
+      );
+    }
+    const content = readFileOrThrow(file, "model");
+    const lines = content.split("\n").filter((l) => l.trim());
+    const report = JSON.parse(engineCall("validation", () => engine.validateLines(JSON.stringify(lines))));
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    } else if (report.ok) {
+      info(c.green("\u2714 conformant \u2014 model satisfies the HCS spec"));
+    } else {
+      info(c.red(`\u2718 ${report.errors.length} validation error(s) (exit ${report.exitCode}):`));
+      for (const e of report.errors.slice(0, 50)) {
+        info(c.dim(`  [${e.code}] ${e.factId || "(model)"}: ${e.message}`));
+      }
+      if (report.errors.length > 50) info(c.dim(`  \u2026 and ${report.errors.length - 50} more`));
+    }
+    process.exitCode = report.exitCode;
+  });
+  applyGlobalOptions(cmd);
+}
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path41.resolve(targetPath);
-  const vibgrateDir2 = path41.join(rootDir, ".vibgrate");
+  const rootDir = path43.resolve(targetPath);
+  const vibgrateDir2 = path43.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path41.join(rootDir, "vibgrate.config.ts");
+  const configPath = path43.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -8877,7 +9519,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-IAFWF2ET.js');
+    const { runBaseline } = await import('./baseline-AGX42TZM.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -8980,7 +9622,7 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path41.join(rootDir, relFile));
+  const content = await readFile3(path43.join(rootDir, relFile));
   if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\b${escaped}\\b`);
@@ -9018,9 +9660,9 @@ function sitesFromImportFiles(files, limit = 10) {
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs25.stat(absPath);
+    const stat2 = await fs27.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs25.readFile(absPath, "utf8");
+    return await fs27.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -9216,7 +9858,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path41.join(rootDir, file))) {
+      if (await pathExists$1(path43.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -9410,18 +10052,31 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path41.resolve(targetPath);
+  const rootDir = path43.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
   const hasDsn = !!resolveDsn(opts.dsn);
-  const willPush = !opts.offline && (opts.push || hasDsn);
+  let willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path41.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path43.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
+  let pushBlockedReason;
+  const blockPush = (reason, detailLines) => {
+    if (opts.strict) {
+      console.error(chalk7.red(reason));
+      for (const line of detailLines) console.error(chalk7.dim(line));
+      process.exit(1);
+    }
+    console.error(chalk7.yellow(`\u26A0 ${reason}`));
+    for (const line of detailLines) console.error(chalk7.dim(`  ${line}`));
+    console.error(chalk7.dim("  Scanning locally \u2014 results will not be uploaded to Vibgrate Cloud."));
+    pushBlockedReason = reason;
+    willPush = false;
+  };
   if (willPush && hasDsn) {
     const dsn = resolveDsn(opts.dsn);
     const parsed = parseDsn(dsn);
@@ -9433,65 +10088,56 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
       try {
         const preflight = await fetchScanPreflight(parsed, ingestHost, {
           repositoryName,
-          vcsSha: fingerprint.vcsSha
+          vcsSha: fingerprint.vcsSha,
+          // Canonical repo identity (credential-redacted by detectVcs) — the
+          // server matches on this first, so re-scanning an already-mapped
+          // repository under a different display name (e.g. a fresh clone in
+          // a temp dir) is not miscounted as a NEW repo against the plan cap.
+          remoteUrl: vcs.remoteUrl
         });
         pinnedRegion = preflight.region;
         planTier = preflight.plan?.tier;
         upgradeUrl = preflight.upgradeUrl ?? `https://${dashHostForIngestHost(preflight.ingestHost ?? ingestHost)}/${parsed.workspaceId}`;
         if (preflight.vm && !preflight.vm.allowed) {
-          console.error(chalk7.red(preflight.error ?? "VM meter usage exhausted"));
-          console.error(
-            chalk7.dim(
-              `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
-            )
-          );
-          process.exit(1);
-        }
-        if (preflight.repositories && !preflight.repositories.allowed) {
-          console.error(
-            chalk7.red(
-              preflight.error ?? `Repository limit reached for the ${preflight.plan.label} plan \u2014 cannot scan a new repository.`
-            )
-          );
+          blockPush(preflight.error ?? "VM meter usage exhausted", [
+            `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
+          ]);
+        } else if (preflight.repositories && !preflight.repositories.allowed) {
           const max = preflight.repositories.max < 0 ? "unlimited" : String(preflight.repositories.max);
-          console.error(
-            chalk7.dim(
-              `Repositories: ${preflight.repositories.total}/${max} (${preflight.plan.label} plan) \u2014 archive a repository or upgrade your plan.`
-            )
-          );
+          const detail = [
+            `Repositories: ${preflight.repositories.total}/${max} (${preflight.plan.label} plan) \u2014 archive a repository or upgrade your plan.`
+          ];
           if (preflight.upgradeUrl) {
-            console.error(chalk7.dim(`  Upgrade: ${preflight.upgradeUrl}`));
+            detail.push(`Upgrade: ${preflight.upgradeUrl}`);
           }
-          process.exit(1);
-        }
-        if (preflight.status === "error" || !preflight.scans.allowed) {
-          console.error(chalk7.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
-          console.error(
-            chalk7.dim(
-              `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
-            )
+          blockPush(
+            preflight.error ?? `Repository limit reached for the ${preflight.plan.label} plan \u2014 cannot upload a new repository.`,
+            detail
           );
-          if (opts.strict) process.exit(1);
-          process.exit(1);
-        }
-        console.log(
-          chalk7.dim(
-            `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
-          )
-        );
-        if (preflight.repository?.unchanged && !opts.force) {
+        } else if (preflight.status === "error" || !preflight.scans.allowed) {
+          blockPush(preflight.error ?? "Scan ingestion not allowed for this workspace.", [
+            `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
+          ]);
+        } else {
           console.log(
-            chalk7.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+            chalk7.dim(
+              `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
+            )
           );
-          if (preflight.repository.lastIngestId) {
-            emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
-            const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
-            console.log(chalk7.dim(`  Latest report: ${dashUrl}`));
-          } else if (opts.strict) {
-            console.error(chalk7.red("Repository unchanged but no previous ingest id available."));
-            process.exit(1);
+          if (preflight.repository?.unchanged && !opts.force) {
+            console.log(
+              chalk7.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+            );
+            if (preflight.repository.lastIngestId) {
+              emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
+              const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
+              console.log(chalk7.dim(`  Latest report: ${dashUrl}`));
+            } else if (opts.strict) {
+              console.error(chalk7.red("Repository unchanged but no previous ingest id available."));
+              process.exit(1);
+            }
+            return;
           }
-          return;
         }
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -9607,6 +10253,12 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
   }
   if (willPush) {
     await autoPush(artifact, rootDir, scanOpts);
+  } else if (pushBlockedReason) {
+    console.error("");
+    console.error(chalk7.yellow(`\u26A0 Results were not uploaded: ${pushBlockedReason}`));
+    if (upgradeUrl) {
+      console.error(chalk7.dim(`  Upgrade: ${upgradeUrl}`));
+    }
   }
   const showAiPrompt = scanOpts.format === "text" && !opts.quiet && !hasDsn && !opts.offline && !noLocalArtifacts && !opts.maxPrivacy && isFirstRun;
   if (showAiPrompt) {
@@ -9656,7 +10308,7 @@ var WATCHED_FILES = /* @__PURE__ */ new Set([
   "packages.lock.json"
 ]);
 var WATCHED_EXT = /\.(cs|fs)proj$/i;
-var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+var SKIP_DIRS3 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   "dist",
@@ -9677,7 +10329,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs11.statSync(artifactPath).mtimeMs;
+    ref = fs12.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -9689,7 +10341,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES2) return;
     let entries;
     try {
-      entries = fs11.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -9697,20 +10349,20 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path41.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS3.has(e.name) && !e.name.startsWith(".")) walk2(path43.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path41.join(dir, e.name);
+      const abs = path43.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs11.statSync(abs).mtimeMs;
+        mtimeMs = fs12.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path41.relative(rootDir, abs) || e.name;
+        newestChanged = path43.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -9774,7 +10426,7 @@ function extractContracts(content, pkg, ecosystem) {
 }
 
 // src/reporting/planning/usage.ts
-var SKIP_DIRS3 = /* @__PURE__ */ new Set([
+var SKIP_DIRS4 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
   "dist",
@@ -9841,7 +10493,7 @@ function analyzeTree(root2, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs11.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -9849,18 +10501,18 @@ function analyzeTree(root2, packages) {
     for (const entry of entries) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
-        if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path41.join(dir, entry.name), depth + 1);
+        if (SKIP_DIRS4.has(entry.name) || entry.name.startsWith(".")) continue;
+        walk2(path43.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path41.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path43.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path41.join(dir, entry.name);
+      const full = path43.join(dir, entry.name);
       let content;
       try {
-        if (fs11.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs11.readFileSync(full, "utf8");
+        if (fs12.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs12.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -10171,7 +10823,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path41.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path43.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -10200,8 +10852,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path41.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path41.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path43.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path43.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -10228,8 +10880,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs25.mkdir(CACHE_DIR, { recursive: true });
-    await fs25.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs27.mkdir(CACHE_DIR, { recursive: true });
+    await fs27.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -10264,10 +10916,10 @@ function buildDeferredUpdateScript(opts) {
 }
 function scheduleDeferredUpdate(command, pid = process.pid, dir = os.tmpdir()) {
   const stamp = `${pid}-${process.hrtime.bigint().toString(36)}`;
-  const scriptPath = path41.join(dir, `vg-update-${stamp}.cmd`);
-  const logPath = path41.join(dir, `vg-update-${stamp}.log`);
+  const scriptPath = path43.join(dir, `vg-update-${stamp}.cmd`);
+  const logPath = path43.join(dir, `vg-update-${stamp}.log`);
   try {
-    fs11.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
+    fs12.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
     const child = spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", scriptPath], {
       detached: true,
       stdio: "ignore",
@@ -10286,11 +10938,12 @@ var SCRIPT_PACKAGES = [PACKAGE_NAME, "onnxruntime-node", "msgpackr-extract"];
 function allowScriptsFlag(pm) {
   return pm === "npm" ? ` --allow-scripts=${SCRIPT_PACKAGES.join(",")}` : "";
 }
+var ORT_INSTALL_SKIP_ENV = { ONNXRUNTIME_NODE_INSTALL: "skip" };
 function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd()) {
   if (!execPath) return null;
   let resolved = execPath;
   try {
-    resolved = fs11.realpathSync(execPath);
+    resolved = fs12.realpathSync(execPath);
   } catch {
   }
   const p = resolved.replace(/\\/g, "/");
@@ -10320,14 +10973,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path41.join(dir, "node_modules") : null;
+        return dir ? path43.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path41.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path43.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
     const root2 = probe.root();
-    if (root2 && await pathExists(path41.join(root2, pkg))) return probe.pm;
+    if (root2 && await pathExists(path43.join(root2, pkg))) return probe.pm;
   }
   return null;
 }
@@ -10342,19 +10995,19 @@ function getGlobalUpdateCommand(pm, pkg, version) {
       return `bun add -g ${spec}`;
     case "npm":
     default:
-      return `npm install -g${allowScriptsFlag("npm")} ${spec}`;
+      return `npm install -g --no-fund${allowScriptsFlag("npm")} ${spec}`;
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path41.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path41.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path41.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path43.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path43.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path43.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path41.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path43.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path41.join(cwd, "package.json");
+    const pkgPath = path43.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -10375,13 +11028,13 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
     case "npm":
     default: {
       const allow = allowScriptsFlag("npm");
-      return isDev ? `npm install${allow} --save-dev ${spec}` : `npm install${allow} ${spec}`;
+      return isDev ? `npm install --no-fund${allow} --save-dev ${spec}` : `npm install --no-fund${allow} ${spec}`;
     }
   }
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path41.join(cwd, "package.json");
+    const pkgPath = path43.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -10396,19 +11049,24 @@ async function confirmWorkspaceRoot(pm) {
 async function confirm3(question) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     rl.question(chalk7.yellow(question), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve21(t === "y" || t === "yes");
+      resolve23(t === "y" || t === "yes");
     });
   });
 }
 var CAPTURED_OUTPUT_LIMIT = 64e3;
 async function runInstall(cmd, cwd) {
   const { spawn: spawn5 } = await import('child_process');
-  return new Promise((resolve21) => {
-    const child = spawn5(cmd, { cwd, shell: true, stdio: ["inherit", "pipe", "pipe"] });
+  return new Promise((resolve23) => {
+    const child = spawn5(cmd, {
+      cwd,
+      shell: true,
+      stdio: ["inherit", "pipe", "pipe"],
+      env: { ...process.env, ...ORT_INSTALL_SKIP_ENV }
+    });
     let output = "";
     const tee = (src, dest) => {
       if (!src) return;
@@ -10421,15 +11079,15 @@ async function runInstall(cmd, cwd) {
     };
     tee(child.stdout, process.stdout);
     tee(child.stderr, process.stderr);
-    child.on("error", (err) => resolve21({ ok: false, output: `${output}
+    child.on("error", (err) => resolve23({ ok: false, output: `${output}
 ${String(err)}` }));
-    child.on("close", (code) => resolve21({ ok: code === 0, output }));
+    child.on("close", (code) => resolve23({ ok: code === 0, output }));
   });
 }
 async function releaseWindowsFileLocks(cwd, keepVersion) {
   reapAndReport(cwd, keepVersion);
   try {
-    const { vgdSocketPath: vgdSocketPath2 } = await import('./vgd-LFHQ4GWC.js');
+    const { vgdSocketPath: vgdSocketPath2 } = await import('./vgd-UIFH5TTW.js');
     const result = await stopVgd(vgdSocketPath2());
     if (result === "stopped") {
       console.log(chalk7.dim("Stopped the vgd daemon so its files can be replaced \u2014 it restarts on the next command."));
@@ -10554,7 +11212,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-LFHQ4GWC.js');
+    const { vgdIsRunning: vgdIsRunning2, vgdRequest: vgdRequest2 } = await import('./vgd-UIFH5TTW.js');
     if (!await vgdIsRunning2()) return;
     const loaded = await vgdRequest2({ op: "load-graph", root: cwd });
     if (!loaded.ok || !("repositoryId" in loaded)) return;
@@ -10643,13 +11301,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path41.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path43.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path41.isAbsolute(inFile) ? inFile : path41.join(rootDir, inFile);
+  const artifactPath = path43.isAbsolute(inFile) ? inFile : path43.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -10675,8 +11333,8 @@ async function repositoryIdentity(rootDir, override) {
     return { name: override?.trim() || void 0 };
   }
 }
-var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path41.resolve(targetPath);
+var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Preview the recommended plan (or --plan <tier>) without applying; never prompts").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
+  const rootDir = path43.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -10837,7 +11495,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path41.isAbsolute(projectPath) ? path41.relative(rootDir, projectPath) : projectPath;
+  const rel = path43.isAbsolute(projectPath) ? path43.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -10878,14 +11536,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve21(null);
+      if (t === "q" || t === "quit") return resolve23(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve21(null);
-      resolve21(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve23(null);
+      resolve23(plans[n - 1].tier);
     });
   });
 }
@@ -10905,8 +11563,16 @@ async function runApplyFlow(rootDir, artifact, response, opts, canonicalTier) {
     }
   } else if (nonEmpty.length === 1) {
     chosen = nonEmpty[0];
-  } else if (opts.yes) {
+  } else if (opts.yes || opts.dryRun) {
     chosen = response.plans.find((p) => p.tier === response.recommended) ?? nonEmpty[0];
+    if (opts.dryRun && !opts.yes && nonEmpty.length > 1) {
+      console.log(
+        chalk7.dim(
+          `
+Dry-run previews the recommended (${chosen.tier}) plan \u2014 nothing will be written. Pass --plan <safe|balanced|aggressive> to preview another tier.`
+        )
+      );
+    }
   } else if (process.stdin.isTTY && process.stdout.isTTY) {
     const tier = await promptPlanSelection(response);
     if (!tier) {
@@ -10915,7 +11581,7 @@ async function runApplyFlow(rootDir, artifact, response, opts, canonicalTier) {
     }
     chosen = response.plans.find((p) => p.tier === tier);
   } else {
-    console.log(chalk7.dim("\nMultiple plans available \u2014 re-run with --plan <tier> or --yes to apply, or --dry-run to preview."));
+    console.log(chalk7.dim("\nMultiple plans available \u2014 re-run with --plan <tier> or --yes to apply, or --dry-run to preview the recommended plan."));
     return;
   }
   if (!chosen || chosen.upgrades.length === 0) {
@@ -11672,7 +12338,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path41.resolve(opts.in);
+  const artifactPath = path43.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -11719,10 +12385,10 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
+var delay = (ms) => new Promise((resolve23) => setTimeout(resolve23, ms));
 function isInside(dir, file) {
-  const rel = path41.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path41.isAbsolute(rel);
+  const rel = path43.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path43.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -11977,7 +12643,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path41.resolve(opts.from);
+      const fromPath = path43.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -11995,9 +12661,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path41.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path43.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path41.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path43.resolve(opts.out)}
 `
       );
     } else {
@@ -12180,7 +12846,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path41.resolve(filePath);
+  const absolutePath = path43.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -12197,7 +12863,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path41.resolve(opts.out), body);
+    await writeTextFile(path43.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -12208,7 +12874,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path41.resolve(opts.out), report);
+    await writeTextFile(path43.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -12339,20 +13005,20 @@ function resolveRegime(id) {
   return regime;
 }
 function evidenceDir(root2) {
-  return path41.join(root2, ".vibgrate", "evidence");
+  return path43.join(root2, ".vibgrate", "evidence");
 }
 function orgPath(root2) {
-  return path41.join(evidenceDir(root2), "org.json");
+  return path43.join(evidenceDir(root2), "org.json");
 }
 function productsPath(root2) {
-  return path41.join(evidenceDir(root2), "products.json");
+  return path43.join(evidenceDir(root2), "products.json");
 }
 function releasesDir(root2) {
-  return path41.join(evidenceDir(root2), "releases");
+  return path43.join(evidenceDir(root2), "releases");
 }
 function releasePath(root2, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path41.join(releasesDir(root2), `${safe}.json`);
+  return path43.join(releasesDir(root2), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
@@ -12383,7 +13049,7 @@ async function freezeRelease(root2, release) {
   const p = releasePath(root2, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path41.relative(root2, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path43.relative(root2, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
@@ -12397,7 +13063,7 @@ async function loadReleases(root2, productId) {
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path41.join(dir, f));
+    const rel = await readJsonFile(path43.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
@@ -13092,19 +13758,19 @@ function verifyEvidenceEnvelope(env, opts = {}) {
 var DEFAULT_KEY = "attest-key.pem";
 function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path41.resolve(chosen) : path41.join(root2, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path43.resolve(chosen) : path43.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
-  if (!fs11.existsSync(keyPath)) {
+  if (!fs12.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs11.mkdirSync(path41.dirname(keyPath), { recursive: true });
-    fs11.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs11.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs12.mkdirSync(path43.dirname(keyPath), { recursive: true });
+    fs12.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs12.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
   }
   let key2;
   try {
-    key2 = crypto3.createPrivateKey(fs11.readFileSync(keyPath, "utf8"));
+    key2 = crypto3.createPrivateKey(fs12.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${keyPath}`, ExitCode.USAGE_ERROR);
   }
@@ -13115,16 +13781,16 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs11.mkdirSync(path41.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs11.writeFileSync(path41.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs12.mkdirSync(path43.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs12.writeFileSync(path43.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path41.join("inputs", "advisory.json"), input.advisory);
+  write(path43.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path41.join("inputs", "releases", `${safe}.json`), rel);
+    write(path43.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path41.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path43.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -13140,13 +13806,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs11.writeFileSync(path41.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs12.writeFileSync(path43.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs11.writeFileSync(path41.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs12.writeFileSync(path43.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs11.writeFileSync(path41.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs12.writeFileSync(path43.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -13207,13 +13873,13 @@ function undeterminedFields(result, regime) {
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
 async function recordDrill(root2, record) {
-  const dir = path41.join(evidenceDir(root2), "drills");
-  const p = path41.join(dir, `${record.drillId}.json`);
+  const dir = path43.join(evidenceDir(root2), "drills");
+  const p = path43.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
 async function hasRecentDrill(root2, asOf) {
-  const dir = path41.join(evidenceDir(root2), "drills");
+  const dir = path43.join(evidenceDir(root2), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
@@ -13221,7 +13887,7 @@ async function hasRecentDrill(root2, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path41.join(dir, f));
+    const rec = await readJsonFile2(path43.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -13301,7 +13967,7 @@ function formatRegimeList() {
 
 // src/reporting/commands/evidence/index.ts
 function root(opts) {
-  return path41.resolve(opts.cwd ?? process.cwd());
+  return path43.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -13389,7 +14055,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path41.resolve(rootDir, opts.from),
+    from: path43.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -13397,7 +14063,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path41.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path43.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -13449,7 +14115,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path41.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path43.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -13457,7 +14123,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path41.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path43.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
@@ -13489,7 +14155,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs11.writeFileSync(path41.resolve(rootDir, opts.out), md);
+    fs12.writeFileSync(path43.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -13531,20 +14197,20 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path41.resolve(bundlePath);
-  const envPath = fs11.statSync(abs).isDirectory() ? path41.join(abs, "evidence.intoto.jsonl") : abs;
-  if (!fs11.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
-  const envelope = JSON.parse(fs11.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path41.join(path41.dirname(envPath), "result.json");
-  const result = fs11.existsSync(resultPath) ? JSON.parse(fs11.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs11.readFileSync(path41.resolve(opts.pub), "utf8") : void 0;
+  const abs = path43.resolve(bundlePath);
+  const envPath = fs12.statSync(abs).isDirectory() ? path43.join(abs, "evidence.intoto.jsonl") : abs;
+  if (!fs12.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
+  const envelope = JSON.parse(fs12.readFileSync(envPath, "utf8").trim().split("\n")[0]);
+  const resultPath = path43.join(path43.dirname(envPath), "result.json");
+  const result = fs12.existsSync(resultPath) ? JSON.parse(fs12.readFileSync(resultPath, "utf8")) : void 0;
+  const publicKeyPem = opts.pub ? fs12.readFileSync(path43.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path41.join(path41.dirname(envPath), "timestamp.tsr");
-  if (fs11.existsSync(tsrPath) && result) {
-    const t = verifyTimestamp(fs11.readFileSync(tsrPath), exposureSubjectDigest(result));
+  const tsrPath = path43.join(path43.dirname(envPath), "timestamp.tsr");
+  if (fs12.existsSync(tsrPath) && result) {
+    const t = verifyTimestamp(fs12.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
     console.log("  " + tcolor("TIMESTAMP") + `  ${t.reason}`);
   }
@@ -13611,12 +14277,12 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path41.resolve(rootDir, opts.out);
-  await writeJsonFile(path41.join(dir, "org.json"), org);
-  await writeJsonFile(path41.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path41.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path41.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path41.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path43.resolve(rootDir, opts.out);
+  await writeJsonFile(path43.join(dir, "org.json"), org);
+  await writeJsonFile(path43.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path43.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path43.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path43.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
 var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
   const rootDir = root(opts);
@@ -13642,10 +14308,10 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path41.resolve(rootDir, opts.result);
-    const resultPath = fs11.existsSync(raw) && fs11.statSync(raw).isDirectory() ? path41.join(raw, "result.json") : raw;
-    if (!fs11.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
-    exposure = JSON.parse(fs11.readFileSync(resultPath, "utf8"));
+    const raw = path43.resolve(rootDir, opts.result);
+    const resultPath = fs12.existsSync(raw) && fs12.statSync(raw).isDirectory() ? path43.join(raw, "result.json") : raw;
+    if (!fs12.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
+    exposure = JSON.parse(fs12.readFileSync(resultPath, "utf8"));
   }
   const payload = { schemaVersion: "evidence-push-1", regime: regime.id, generatedAt: nowIso(), signed: Boolean(opts.signed), products: productPayload, exposure };
   const body = JSON.stringify(payload);
@@ -13707,6 +14373,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "daemon",
   "policy",
   "llm-host",
+  "hcs",
   "install",
   "uninstall",
   "share",
@@ -13771,6 +14438,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerDaemon(program);
   registerPolicy(program);
   registerLlmHost(program);
+  registerHcs(program);
   program.addCommand(initCommand);
   program.addCommand(scanCommand);
   program.addCommand(fixCommand);
@@ -13839,7 +14507,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs11.existsSync(path41.resolve(cwd, first))) {
+  if (fs12.existsSync(path43.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -13884,9 +14552,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path41.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path43.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path41.resolve(eq.slice("--cwd=".length));
+  if (eq) return path43.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {