kirograph 0.17.0 → 0.19.0

package/dist/bin/commands/supply-chain.js

@@ -0,0 +1,138 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var supply_chain_exports = {};
+__export(supply_chain_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(supply_chain_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const red = "\x1B[31m";
+const yellow = "\x1B[33m";
+const RISK_ORDER = {
+  critical: 4,
+  high: 3,
+  medium: 2,
+  low: 1,
+  unknown: 0
+};
+function riskColor(level) {
+  switch (level) {
+    case "critical":
+      return red;
+    case "high":
+      return yellow;
+    case "medium":
+      return "\x1B[33m";
+    case "low":
+      return import_ui.green;
+    default:
+      return import_ui.dim;
+  }
+}
+function register(program) {
+  program.command("supply-chain [projectPath]").description("Assess supply-chain health: OpenSSF Scorecard, maintainer count, package age, and risk level").option("--threshold <level>", "Show only at or above risk level: critical|high|medium|low (default: low)", "low").option("--refresh", "Re-fetch data from registries and Scorecard API").option("--format <fmt>", "Output format: table | json (default: table)", "table").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${yellow}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const thresholdLevel = opts.threshold;
+    if (!["critical", "high", "medium", "low"].includes(thresholdLevel)) {
+      console.error(`  \u2716 --threshold must be one of: critical | high | medium | low`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { SupplyChainChecker } = await Promise.resolve().then(() => require("../../security/supply-chain.js"));
+    const checker = new SupplyChainChecker(db);
+    if (opts.refresh || opts.format !== "json") {
+      console.error(`  ${import_ui.dim}Fetching supply-chain data from registries...${import_ui.reset}`);
+    }
+    const { results, errors } = await checker.checkAll();
+    if (errors.length > 0) {
+      console.error(`  ${yellow}\u26A0${import_ui.reset} ${errors.length} error(s) during fetch`);
+    }
+    const thresholdOrder = RISK_ORDER[thresholdLevel] ?? 0;
+    const filtered = results.filter((r) => (RISK_ORDER[r.riskLevel] ?? 0) >= thresholdOrder);
+    filtered.sort((a, b) => (RISK_ORDER[b.riskLevel] ?? 0) - (RISK_ORDER[a.riskLevel] ?? 0));
+    if (opts.format === "json") {
+      console.log(JSON.stringify(filtered, null, 2));
+      cg.close();
+      return;
+    }
+    if (filtered.length === 0) {
+      console.log(`
+  ${import_ui.dim}No supply-chain risks found at or above threshold: ${thresholdLevel}.${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Run with${import_ui.reset} ${import_ui.violet}${import_ui.bold}--refresh${import_ui.reset} ${import_ui.dim}to re-fetch from registries.${import_ui.reset}
+`);
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.violet}${import_ui.bold}Supply-Chain Health${import_ui.reset}
+`);
+    for (const r of filtered) {
+      const scoreStr = r.scorecardScore !== null ? r.scorecardScore.toFixed(1) : "n/a";
+      const maintStr = r.maintainerCount !== null ? String(r.maintainerCount) : "n/a";
+      const daysStr = r.daysSinceLastCommit !== null ? `${r.daysSinceLastCommit}d` : "n/a";
+      const color = riskColor(r.riskLevel);
+      console.log(`  ${import_ui.violet}${import_ui.bold}${r.packageName}${import_ui.reset} ${import_ui.dim}(${r.ecosystem})${import_ui.reset}`);
+      console.log(`    Scorecard: ${import_ui.dim}${scoreStr}/10${import_ui.reset}   Maintainers: ${import_ui.dim}${maintStr}${import_ui.reset}   Last activity: ${import_ui.dim}${daysStr}${import_ui.reset}`);
+      console.log(`    Risk: ${color}${import_ui.bold}${r.riskLevel.toUpperCase()}${import_ui.reset}`);
+      if (r.riskReasons.length > 0) {
+        for (const reason of r.riskReasons) {
+          console.log(`      ${import_ui.dim}\u2022${import_ui.reset} ${reason}`);
+        }
+      }
+      console.log();
+    }
+    const total = results.length;
+    console.log(`  ${import_ui.bold}${filtered.length}${import_ui.reset} of ${import_ui.bold}${total}${import_ui.reset} ${import_ui.dim}packages flagged (threshold: ${thresholdLevel})${import_ui.reset}
+`);
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=supply-chain.js.map

package/dist/bin/commands/supply-chain.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/supply-chain.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\ntype Threshold = 'critical' | 'high' | 'medium' | 'low';\n\nconst RISK_ORDER: Record<string, number> = {\n  critical: 4,\n  high: 3,\n  medium: 2,\n  low: 1,\n  unknown: 0,\n};\n\nfunction riskColor(level: string): string {\n  switch (level) {\n    case 'critical': return red;\n    case 'high':     return yellow;\n    case 'medium':   return '\\x1b[33m';\n    case 'low':      return green;\n    default:         return dim;\n  }\n}\n\nexport function register(program: Command): void {\n  program\n    .command('supply-chain [projectPath]')\n    .description('Assess supply-chain health: OpenSSF Scorecard, maintainer count, package age, and risk level')\n    .option('--threshold <level>', 'Show only at or above risk level: critical|high|medium|low (default: low)', 'low')\n    .option('--refresh', 'Re-fetch data from registries and Scorecard API')\n    .option('--format <fmt>', 'Output format: table | json (default: table)', 'table')\n    .action(async (projectPath: string | undefined, opts: {\n      threshold: string;\n      refresh?: boolean;\n      format: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const thresholdLevel = opts.threshold as Threshold;\n      if (!['critical', 'high', 'medium', 'low'].includes(thresholdLevel)) {\n        console.error(`  \u2716 --threshold must be one of: critical | high | medium | low`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { SupplyChainChecker } = await Promise.resolve().then(() => require('../../security/supply-chain.js'));\n      const checker = new SupplyChainChecker(db);\n\n      if (opts.refresh || opts.format !== 'json') {\n        console.error(`  ${dim}Fetching supply-chain data from registries...${reset}`);\n      }\n\n      const { results, errors } = await checker.checkAll();\n\n      if (errors.length > 0) {\n        console.error(`  ${yellow}\u26A0${reset} ${errors.length} error(s) during fetch`);\n      }\n\n      // Filter by threshold\n      const thresholdOrder = RISK_ORDER[thresholdLevel] ?? 0;\n      const filtered = results.filter(r => (RISK_ORDER[r.riskLevel] ?? 0) >= thresholdOrder);\n\n      // Sort by risk descending\n      filtered.sort((a, b) => (RISK_ORDER[b.riskLevel] ?? 0) - (RISK_ORDER[a.riskLevel] ?? 0));\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(filtered, null, 2));\n        cg.close();\n        return;\n      }\n\n      if (filtered.length === 0) {\n        console.log(`\\n  ${dim}No supply-chain risks found at or above threshold: ${thresholdLevel}.${reset}`);\n        console.log(`  ${dim}Run with${reset} ${violet}${bold}--refresh${reset} ${dim}to re-fetch from registries.${reset}\\n`);\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${violet}${bold}Supply-Chain Health${reset}\\n`);\n\n      for (const r of filtered) {\n        const scoreStr = r.scorecardScore !== null ? r.scorecardScore.toFixed(1) : 'n/a';\n        const maintStr = r.maintainerCount !== null ? String(r.maintainerCount) : 'n/a';\n        const daysStr  = r.daysSinceLastCommit !== null ? `${r.daysSinceLastCommit}d` : 'n/a';\n        const color    = riskColor(r.riskLevel);\n\n        console.log(`  ${violet}${bold}${r.packageName}${reset} ${dim}(${r.ecosystem})${reset}`);\n        console.log(`    Scorecard: ${dim}${scoreStr}/10${reset}   Maintainers: ${dim}${maintStr}${reset}   Last activity: ${dim}${daysStr}${reset}`);\n        console.log(`    Risk: ${color}${bold}${r.riskLevel.toUpperCase()}${reset}`);\n\n        if (r.riskReasons.length > 0) {\n          for (const reason of r.riskReasons) {\n            console.log(`      ${dim}\u2022${reset} ${reason}`);\n          }\n        }\n        console.log();\n      }\n\n      const total = results.length;\n      console.log(`  ${bold}${filtered.length}${reset} of ${bold}${total}${reset} ${dim}packages flagged (threshold: ${thresholdLevel})${reset}\\n`);\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEhD,MAAM,MAAS;AACf,MAAM,SAAS;AAIf,MAAM,aAAqC;AAAA,EACzC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,SAAS;AACX;AAEA,SAAS,UAAU,OAAuB;AACxC,UAAQ,OAAO;AAAA,IACb,KAAK;AAAY,aAAO;AAAA,IACxB,KAAK;AAAY,aAAO;AAAA,IACxB,KAAK;AAAY,aAAO;AAAA,IACxB,KAAK;AAAY,aAAO;AAAA,IACxB;AAAiB,aAAO;AAAA,EAC1B;AACF;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,4BAA4B,EACpC,YAAY,8FAA8F,EAC1G,OAAO,uBAAuB,6EAA6E,KAAK,EAChH,OAAO,aAAa,iDAAiD,EACrE,OAAO,kBAAkB,gDAAgD,OAAO,EAChF,OAAO,OAAO,aAAiC,SAI1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,iBAAiB,KAAK;AAC5B,QAAI,CAAC,CAAC,YAAY,QAAQ,UAAU,KAAK,EAAE,SAAS,cAAc,GAAG;AACnE,cAAQ,MAAM,qEAAgE;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,mBAAmB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gCAAgC,CAAC;AAC3G,UAAM,UAAU,IAAI,mBAAmB,EAAE;AAEzC,QAAI,KAAK,WAAW,KAAK,WAAW,QAAQ;AAC1C,cAAQ,MAAM,KAAK,aAAG,gDAAgD,eAAK,EAAE;AAAA,IAC/E;AAEA,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM,QAAQ,SAAS;AAEnD,QAAI,OAAO,SAAS,GAAG;AACrB,cAAQ,MAAM,KAAK,MAAM,SAAI,eAAK,IAAI,OAAO,MAAM,wBAAwB;AAAA,IAC7E;AAGA,UAAM,iBAAiB,WAAW,cAAc,KAAK;AACrD,UAAM,WAAW,QAAQ,OAAO,QAAM,WAAW,EAAE,SAAS,KAAK,MAAM,cAAc;AAGrF,aAAS,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE,SAAS,KAAK,MAAM,WAAW,EAAE,SAAS,KAAK,EAAE;AAEvF,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC7C,SAAG,MAAM;AACT;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ,IAAI;AAAA,IAAO,aAAG,sDAAsD,cAAc,IAAI,eAAK,EAAE;AACrG,cAAQ,IAAI,KAAK,aAAG,WAAW,eAAK,IAAI,gBAAM,GAAG,cAAI,YAAY,eAAK,IAAI,aAAG,+BAA+B,eAAK;AAAA,CAAI;AACrH,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,sBAAsB,eAAK;AAAA,CAAI;AAE/D,eAAW,KAAK,UAAU;AACxB,YAAM,WAAW,EAAE,mBAAmB,OAAO,EAAE,eAAe,QAAQ,CAAC,IAAI;AAC3E,YAAM,WAAW,EAAE,oBAAoB,OAAO,OAAO,EAAE,eAAe,IAAI;AAC1E,YAAM,UAAW,EAAE,wBAAwB,OAAO,GAAG,EAAE,mBAAmB,MAAM;AAChF,YAAM,QAAW,UAAU,EAAE,SAAS;AAEtC,cAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,EAAE,WAAW,GAAG,eAAK,IAAI,aAAG,IAAI,EAAE,SAAS,IAAI,eAAK,EAAE;AACvF,cAAQ,IAAI,kBAAkB,aAAG,GAAG,QAAQ,MAAM,eAAK,mBAAmB,aAAG,GAAG,QAAQ,GAAG,eAAK,qBAAqB,aAAG,GAAG,OAAO,GAAG,eAAK,EAAE;AAC5I,cAAQ,IAAI,aAAa,KAAK,GAAG,cAAI,GAAG,EAAE,UAAU,YAAY,CAAC,GAAG,eAAK,EAAE;AAE3E,UAAI,EAAE,YAAY,SAAS,GAAG;AAC5B,mBAAW,UAAU,EAAE,aAAa;AAClC,kBAAQ,IAAI,SAAS,aAAG,SAAI,eAAK,IAAI,MAAM,EAAE;AAAA,QAC/C;AAAA,MACF;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,QAAQ,QAAQ;AACtB,YAAQ,IAAI,KAAK,cAAI,GAAG,SAAS,MAAM,GAAG,eAAK,OAAO,cAAI,GAAG,KAAK,GAAG,eAAK,IAAI,aAAG,gCAAgC,cAAc,IAAI,eAAK;AAAA,CAAI;AAE5I,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/uninit.js

@@ -38,6 +38,7 @@ var readline = __toESM(require("readline"));
 var import_banner = require("../banner");
 var import_ui = require("../ui");
 var import_prompts = require("../installer/prompts");
+var import_targets = require("../installer/targets");
 const UNINIT_FAREWELLS = [
   "Oh. So it's come to this.",
   "We're sorry to see you go. (Are we? Yes. We are.)",
@@ -50,15 +51,104 @@ const UNINIT_FAREWELLS = [
   "574 embeddings. Gone. Just like that.",
   "See you on the other side of `kirograph install`."
 ];
-const UNINIT_TARGETS = ["kiro", "claude", "codex", "all"];
+const ALL_TARGETS = [
+  "kiro",
+  "claude",
+  "codex",
+  "cursor",
+  "antigravity",
+  "opencode",
+  "windsurf",
+  "cline",
+  "copilot",
+  "junie",
+  "gemini-cli",
+  "continue",
+  "roo",
+  "warp",
+  "aider",
+  "trae",
+  "augment",
+  "kilo",
+  "amp",
+  "devin",
+  "replit",
+  "goose",
+  "openhands",
+  "tabnine",
+  "mistral-vibe",
+  "ibm-bob",
+  "crush",
+  "droid-factory",
+  "forgecode",
+  "iflow",
+  "qwen",
+  "rovo",
+  "qoder"
+];
+function isValidTarget(t) {
+  return t === "all" || ALL_TARGETS.includes(t);
+}
+function uninitKiro(projectRoot) {
+  const kiroHooks = [
+    "kirograph-mark-dirty-on-save.kiro.hook",
+    "kirograph-mark-dirty-on-create.kiro.hook",
+    "kirograph-sync-on-delete.kiro.hook",
+    "kirograph-sync-if-dirty.kiro.hook",
+    "kirograph-compress-hint.kiro.hook",
+    "kirograph-mem-capture.kiro.hook",
+    // Legacy .json filenames
+    "kirograph-mark-dirty-on-save.json",
+    "kirograph-mark-dirty-on-create.json",
+    "kirograph-sync-on-delete.json",
+    "kirograph-sync-if-dirty.json",
+    "kirograph-sync-on-save.json",
+    "kirograph-sync-on-create.json",
+    "kirograph-compress-hint.json",
+    "kirograph-mem-capture.json"
+  ];
+  const hooksDir = path.join(projectRoot, ".kiro", "hooks");
+  let removedHooks = 0;
+  for (const hook of kiroHooks) {
+    const p = path.join(hooksDir, hook);
+    if (fs.existsSync(p)) {
+      fs.unlinkSync(p);
+      removedHooks++;
+    }
+  }
+  if (removedHooks > 0) console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);
+  const steeringDir = path.join(projectRoot, ".kiro", "steering");
+  let removedSteering = 0;
+  if (fs.existsSync(steeringDir)) {
+    for (const entry of fs.readdirSync(steeringDir)) {
+      if (entry.startsWith("kirograph") && entry.endsWith(".md")) {
+        fs.unlinkSync(path.join(steeringDir, entry));
+        removedSteering++;
+      }
+    }
+  }
+  if (removedSteering > 0) {
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed ${removedSteering} steering file(s) from .kiro/steering/`);
+  }
+  const agentPath = path.join(projectRoot, ".kiro", "agents", "kirograph.json");
+  if (fs.existsSync(agentPath)) {
+    fs.unlinkSync(agentPath);
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed .kiro/agents/kirograph.json`);
+  }
+  const { removeMcpServersConfig } = require("../installer/common");
+  const mcpPath = path.join(projectRoot, ".kiro", "settings", "mcp.json");
+  if (removeMcpServersConfig(mcpPath)) {
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed kirograph from .kiro/settings/mcp.json`);
+  }
+}
 async function runUninit(projectPath, opts) {
-  const target = path.resolve(projectPath ?? process.cwd());
-  const integration = (opts.target ?? "kiro").toLowerCase();
-  if (!UNINIT_TARGETS.includes(integration)) {
-    console.error(`Unknown uninit target: ${opts.target}. Choose from: kiro, claude, codex, all`);
+  const projectRoot = path.resolve(projectPath ?? process.cwd());
+  const targetName = (opts.target ?? "kiro").toLowerCase();
+  if (!isValidTarget(targetName)) {
+    console.error(`Unknown uninit target: ${opts.target}. Choose from: ${ALL_TARGETS.join(", ")}, all`);
     process.exit(1);
   }
-  const dir = path.join(target, ".kirograph");
+  const dir = path.join(projectRoot, ".kirograph");
   if (!fs.existsSync(dir)) {
     console.log("Not initialized.");
     return;
@@ -70,10 +160,10 @@ async function runUninit(projectPath, opts) {
     const farewell = UNINIT_FAREWELLS[Math.floor(Math.random() * UNINIT_FAREWELLS.length)];
     console.log(`  ${import_ui.violet}${import_ui.bold}${farewell}${import_ui.reset}`);
     console.log(`
-  ${import_ui.dim}This can remove ${integration} integration files and, separately, the shared .kirograph/ data.${import_ui.reset}`);
+  ${import_ui.dim}This can remove ${targetName} integration files and, separately, the shared .kirograph/ data.${import_ui.reset}`);
     console.log(`  ${import_ui.dim}Your source code is untouched.${import_ui.reset}`);
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    removeIntegration = await (0, import_prompts.askToggle)(rl, `Remove ${integration} integration files?`, "Removes hooks, steering, MCP config, and agent instructions for this target.", false);
+    removeIntegration = await (0, import_prompts.askToggle)(rl, `Remove ${targetName} integration files?`, "Removes hooks, MCP config, rules, and agent instructions for this target.", false);
     removeGraph = await (0, import_prompts.askToggle)(rl, "Remove shared .kirograph/ data too?", "Deletes the graph database, snapshots, and all indexed data. Cannot be undone.", false);
     rl.close();
     if (!removeIntegration && !removeGraph) {
@@ -88,65 +178,24 @@ async function runUninit(projectPath, opts) {
     fs.rmSync(dir, { recursive: true, force: true });
     console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed .kirograph/`);
   }
-  if (removeIntegration && (integration === "kiro" || integration === "all")) {
-    const kiroHooks = [
-      "kirograph-mark-dirty-on-save.kiro.hook",
-      "kirograph-mark-dirty-on-create.kiro.hook",
-      "kirograph-sync-on-delete.kiro.hook",
-      "kirograph-sync-if-dirty.kiro.hook",
-      "kirograph-compress-hint.kiro.hook",
-      "kirograph-mem-capture.kiro.hook",
-      // Legacy .json filenames
-      "kirograph-mark-dirty-on-save.json",
-      "kirograph-mark-dirty-on-create.json",
-      "kirograph-sync-on-delete.json",
-      "kirograph-sync-if-dirty.json",
-      "kirograph-sync-on-save.json",
-      "kirograph-sync-on-create.json",
-      "kirograph-compress-hint.json",
-      "kirograph-mem-capture.json"
-    ];
-    const hooksDir = path.join(target, ".kiro", "hooks");
-    let removedHooks = 0;
-    for (const hook of kiroHooks) {
-      const p = path.join(hooksDir, hook);
-      if (fs.existsSync(p)) {
-        fs.unlinkSync(p);
-        removedHooks++;
+  if (removeIntegration) {
+    const targets = targetName === "all" ? [...ALL_TARGETS] : [targetName];
+    for (const t of targets) {
+      if (t === "kiro") {
+        uninitKiro(projectRoot);
+      } else {
+        const installer = (0, import_targets.getTargetInstaller)(t);
+        installer.uninit?.(projectRoot);
       }
     }
-    if (removedHooks > 0) console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);
-    const steeringPath = path.join(target, ".kiro", "steering", "kirograph.md");
-    if (fs.existsSync(steeringPath)) {
-      fs.unlinkSync(steeringPath);
-      console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed .kiro/steering/kirograph.md`);
-    }
-    const agentPath = path.join(target, ".kiro", "agents", "kirograph.json");
-    if (fs.existsSync(agentPath)) {
-      fs.unlinkSync(agentPath);
-      console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed .kiro/agents/kirograph.json`);
-    }
-    const { removeMcpServersConfig } = await Promise.resolve().then(() => require("../installer/common.js"));
-    const mcpPath = path.join(target, ".kiro", "settings", "mcp.json");
-    if (removeMcpServersConfig(mcpPath)) {
-      console.log(`  ${import_ui.green}\u2713${import_ui.reset} Removed kirograph from .kiro/settings/mcp.json`);
-    }
-  }
-  if (removeIntegration && (integration === "claude" || integration === "all")) {
-    const { uninitClaude } = await Promise.resolve().then(() => require("../installer/targets/claude.js"));
-    uninitClaude(target);
-  }
-  if (removeIntegration && (integration === "codex" || integration === "all")) {
-    const { uninitCodex } = await Promise.resolve().then(() => require("../installer/targets/codex.js"));
-    uninitCodex(target);
   }
   console.log(`
-  ${import_ui.dim}Done. Run ${import_ui.violet}kirograph install --target ${integration === "all" ? "kiro" : integration}${import_ui.reset}${import_ui.dim} to come back anytime.${import_ui.reset}
+  ${import_ui.dim}Done. Run ${import_ui.violet}kirograph install --target ${targetName === "all" ? "kiro" : targetName}${import_ui.reset}${import_ui.dim} to come back anytime.${import_ui.reset}
 `);
 }
 function register(program) {
-  program.command("uninit [projectPath]").description("Remove KiroGraph from a project").option("--force", "Skip confirmation").option("--target <target>", "Integration target to clean up: kiro, claude, codex, or all", "kiro").action(runUninit);
-  program.command("uninstall [projectPath]").description("Alias for uninit. Remove KiroGraph from a project").option("--force", "Skip confirmation").option("--target <target>", "Integration target to clean up: kiro, claude, codex, or all", "kiro").action(runUninit);
+  program.command("uninit [projectPath]").description("Remove KiroGraph from a project").option("--force", "Skip confirmation").option("--target <target>", `Integration target to clean up (or "all"): ${ALL_TARGETS.slice(0, 6).join(", ")}, ...`, "kiro").action(runUninit);
+  program.command("uninstall [projectPath]").description("Alias for uninit. Remove KiroGraph from a project").option("--force", "Skip confirmation").option("--target <target>", `Integration target to clean up (or "all"): ${ALL_TARGETS.slice(0, 6).join(", ")}, ...`, "kiro").action(runUninit);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/bin/commands/uninit.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bin/commands/uninit.ts"],
-  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport * as readline from 'readline';\nimport { printBanner } from '../banner';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { askToggle } from '../installer/prompts';\n\nexport const UNINIT_FAREWELLS = [\n  \"Oh. So it's come to this.\",\n  \"We're sorry to see you go. (Are we? Yes. We are.)\",\n  \"Deleting months of carefully indexed knowledge. Bold move.\",\n  \"Fine. We'll just sit here in the dark.\",\n  \"You can always come back. We won't mention this.\",\n  \"The graph remembers everything. Except, soon, anything.\",\n  \"Somewhere a tree-sitter is crying.\",\n  \"Uninstalling... and pretending it doesn't hurt.\",\n  \"574 embeddings. Gone. Just like that.\",\n  \"See you on the other side of `kirograph install`.\",\n];\n\ntype UninitTarget = 'kiro' | 'claude' | 'codex' | 'all';\n\nconst UNINIT_TARGETS: UninitTarget[] = ['kiro', 'claude', 'codex', 'all'];\n\nasync function runUninit(projectPath: string | undefined, opts: { force?: boolean; target?: string }): Promise<void> {\n  const target = path.resolve(projectPath ?? process.cwd());\n  const integration = (opts.target ?? 'kiro').toLowerCase() as UninitTarget;\n  if (!UNINIT_TARGETS.includes(integration)) {\n    console.error(`Unknown uninit target: ${opts.target}. Choose from: kiro, claude, codex, all`);\n    process.exit(1);\n  }\n  const dir = path.join(target, '.kirograph');\n  if (!fs.existsSync(dir)) { console.log('Not initialized.'); return; }\n\n  let removeIntegration = true;\n  let removeGraph = opts.force === true;\n\n  if (!opts.force) {\n    printBanner();\n    const farewell = UNINIT_FAREWELLS[Math.floor(Math.random() * UNINIT_FAREWELLS.length)]!;\n    console.log(`  ${violet}${bold}${farewell}${reset}`);\n    console.log(`\\n  ${dim}This can remove ${integration} integration files and, separately, the shared .kirograph/ data.${reset}`);\n    console.log(`  ${dim}Your source code is untouched.${reset}`);\n\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n\n    removeIntegration = await askToggle(rl, `Remove ${integration} integration files?`, 'Removes hooks, steering, MCP config, and agent instructions for this target.', false);\n    removeGraph = await askToggle(rl, 'Remove shared .kirograph/ data too?', 'Deletes the graph database, snapshots, and all indexed data. Cannot be undone.', false);\n\n    rl.close();\n\n    if (!removeIntegration && !removeGraph) {\n      console.log(`\\n  ${dim}Cancelled. Nothing removed.${reset}\\n`);\n      return;\n    }\n    console.log();\n  }\n\n  if (removeGraph) {\n    fs.rmSync(dir, { recursive: true, force: true });\n    console.log(`  ${green}\u2713${reset} Removed .kirograph/`);\n  }\n\n  if (removeIntegration && (integration === 'kiro' || integration === 'all')) {\n    // Remove .kiro hooks created by kirograph\n    const kiroHooks = [\n      'kirograph-mark-dirty-on-save.kiro.hook',\n      'kirograph-mark-dirty-on-create.kiro.hook',\n      'kirograph-sync-on-delete.kiro.hook',\n      'kirograph-sync-if-dirty.kiro.hook',\n      'kirograph-compress-hint.kiro.hook',\n      'kirograph-mem-capture.kiro.hook',\n      // Legacy .json filenames\n      'kirograph-mark-dirty-on-save.json',\n      'kirograph-mark-dirty-on-create.json',\n      'kirograph-sync-on-delete.json',\n      'kirograph-sync-if-dirty.json',\n      'kirograph-sync-on-save.json',\n      'kirograph-sync-on-create.json',\n      'kirograph-compress-hint.json',\n      'kirograph-mem-capture.json',\n    ];\n    const hooksDir = path.join(target, '.kiro', 'hooks');\n    let removedHooks = 0;\n    for (const hook of kiroHooks) {\n      const p = path.join(hooksDir, hook);\n      if (fs.existsSync(p)) { fs.unlinkSync(p); removedHooks++; }\n    }\n    if (removedHooks > 0) console.log(`  ${green}\u2713${reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);\n\n    // Remove .kiro/steering/kirograph.md\n    const steeringPath = path.join(target, '.kiro', 'steering', 'kirograph.md');\n    if (fs.existsSync(steeringPath)) {\n      fs.unlinkSync(steeringPath);\n      console.log(`  ${green}\u2713${reset} Removed .kiro/steering/kirograph.md`);\n    }\n\n    // Remove .kiro/agents/kirograph.json\n    const agentPath = path.join(target, '.kiro', 'agents', 'kirograph.json');\n    if (fs.existsSync(agentPath)) {\n      fs.unlinkSync(agentPath);\n      console.log(`  ${green}\u2713${reset} Removed .kiro/agents/kirograph.json`);\n    }\n\n    // Remove kirograph server from .kiro/settings/mcp.json\n    const { removeMcpServersConfig } = await Promise.resolve().then(() => require('../installer/common.js'));\n    const mcpPath = path.join(target, '.kiro', 'settings', 'mcp.json');\n    if (removeMcpServersConfig(mcpPath)) {\n      console.log(`  ${green}\u2713${reset} Removed kirograph from .kiro/settings/mcp.json`);\n    }\n  }\n\n  if (removeIntegration && (integration === 'claude' || integration === 'all')) {\n    const { uninitClaude } = await Promise.resolve().then(() => require('../installer/targets/claude.js'));\n    uninitClaude(target);\n  }\n\n  if (removeIntegration && (integration === 'codex' || integration === 'all')) {\n    const { uninitCodex } = await Promise.resolve().then(() => require('../installer/targets/codex.js'));\n    uninitCodex(target);\n  }\n\n  console.log(`\\n  ${dim}Done. Run ${violet}kirograph install --target ${integration === 'all' ? 'kiro' : integration}${reset}${dim} to come back anytime.${reset}\\n`);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('uninit [projectPath]')\n    .description('Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', 'Integration target to clean up: kiro, claude, codex, or all', 'kiro')\n    .action(runUninit);\n\n  program\n    .command('uninstall [projectPath]')\n    .description('Alias for uninit. Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', 'Integration target to clean up: kiro, claude, codex, or all', 'kiro')\n    .action(runUninit);\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,SAAoB;AACpB,eAA0B;AAC1B,oBAA4B;AAC5B,gBAAgD;AAChD,qBAA0B;AAEnB,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,iBAAiC,CAAC,QAAQ,UAAU,SAAS,KAAK;AAExE,eAAe,UAAU,aAAiC,MAA2D;AACnH,QAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,QAAM,eAAe,KAAK,UAAU,QAAQ,YAAY;AACxD,MAAI,CAAC,eAAe,SAAS,WAAW,GAAG;AACzC,YAAQ,MAAM,0BAA0B,KAAK,MAAM,yCAAyC;AAC5F,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,MAAM,KAAK,KAAK,QAAQ,YAAY;AAC1C,MAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AAAE,YAAQ,IAAI,kBAAkB;AAAG;AAAA,EAAQ;AAEpE,MAAI,oBAAoB;AACxB,MAAI,cAAc,KAAK,UAAU;AAEjC,MAAI,CAAC,KAAK,OAAO;AACf,mCAAY;AACZ,UAAM,WAAW,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,iBAAiB,MAAM,CAAC;AACrF,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,QAAQ,GAAG,eAAK,EAAE;AACnD,YAAQ,IAAI;AAAA,IAAO,aAAG,mBAAmB,WAAW,mEAAmE,eAAK,EAAE;AAC9H,YAAQ,IAAI,KAAK,aAAG,iCAAiC,eAAK,EAAE;AAE5D,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAEpF,wBAAoB,UAAM,0BAAU,IAAI,UAAU,WAAW,uBAAuB,gFAAgF,KAAK;AACzK,kBAAc,UAAM,0BAAU,IAAI,uCAAuC,kFAAkF,KAAK;AAEhK,OAAG,MAAM;AAET,QAAI,CAAC,qBAAqB,CAAC,aAAa;AACtC,cAAQ,IAAI;AAAA,IAAO,aAAG,8BAA8B,eAAK;AAAA,CAAI;AAC7D;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,MAAI,aAAa;AACf,OAAG,OAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sBAAsB;AAAA,EACvD;AAEA,MAAI,sBAAsB,gBAAgB,UAAU,gBAAgB,QAAQ;AAE1E,UAAM,YAAY;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MAEA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,WAAW,KAAK,KAAK,QAAQ,SAAS,OAAO;AACnD,QAAI,eAAe;AACnB,eAAW,QAAQ,WAAW;AAC5B,YAAM,IAAI,KAAK,KAAK,UAAU,IAAI;AAClC,UAAI,GAAG,WAAW,CAAC,GAAG;AAAE,WAAG,WAAW,CAAC;AAAG;AAAA,MAAgB;AAAA,IAC5D;AACA,QAAI,eAAe,EAAG,SAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,YAAY,4BAA4B;AAGzG,UAAM,eAAe,KAAK,KAAK,QAAQ,SAAS,YAAY,cAAc;AAC1E,QAAI,GAAG,WAAW,YAAY,GAAG;AAC/B,SAAG,WAAW,YAAY;AAC1B,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,IACvE;AAGA,UAAM,YAAY,KAAK,KAAK,QAAQ,SAAS,UAAU,gBAAgB;AACvE,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,SAAG,WAAW,SAAS;AACvB,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,IACvE;AAGA,UAAM,EAAE,uBAAuB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,wBAAwB,CAAC;AACvG,UAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,YAAY,UAAU;AACjE,QAAI,uBAAuB,OAAO,GAAG;AACnC,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,iDAAiD;AAAA,IAClF;AAAA,EACF;AAEA,MAAI,sBAAsB,gBAAgB,YAAY,gBAAgB,QAAQ;AAC5E,UAAM,EAAE,aAAa,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gCAAgC,CAAC;AACrG,iBAAa,MAAM;AAAA,EACrB;AAEA,MAAI,sBAAsB,gBAAgB,WAAW,gBAAgB,QAAQ;AAC3E,UAAM,EAAE,YAAY,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AACnG,gBAAY,MAAM;AAAA,EACpB;AAEA,UAAQ,IAAI;AAAA,IAAO,aAAG,aAAa,gBAAM,8BAA8B,gBAAgB,QAAQ,SAAS,WAAW,GAAG,eAAK,GAAG,aAAG,yBAAyB,eAAK;AAAA,CAAI;AACrK;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,sBAAsB,EAC9B,YAAY,iCAAiC,EAC7C,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,+DAA+D,MAAM,EACjG,OAAO,SAAS;AAEnB,UACG,QAAQ,yBAAyB,EACjC,YAAY,mDAAmD,EAC/D,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,+DAA+D,MAAM,EACjG,OAAO,SAAS;AACrB;",
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport * as readline from 'readline';\nimport { printBanner } from '../banner';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { askToggle } from '../installer/prompts';\nimport type { InstallTarget } from '../installer/common';\nimport { getTargetInstaller } from '../installer/targets';\n\nexport const UNINIT_FAREWELLS = [\n  \"Oh. So it's come to this.\",\n  \"We're sorry to see you go. (Are we? Yes. We are.)\",\n  \"Deleting months of carefully indexed knowledge. Bold move.\",\n  \"Fine. We'll just sit here in the dark.\",\n  \"You can always come back. We won't mention this.\",\n  \"The graph remembers everything. Except, soon, anything.\",\n  \"Somewhere a tree-sitter is crying.\",\n  \"Uninstalling... and pretending it doesn't hurt.\",\n  \"574 embeddings. Gone. Just like that.\",\n  \"See you on the other side of `kirograph install`.\",\n];\n\nconst ALL_TARGETS: InstallTarget[] = [\n  'kiro', 'claude', 'codex', 'cursor', 'antigravity', 'opencode',\n  'windsurf', 'cline', 'copilot', 'junie', 'gemini-cli',\n  'continue', 'roo', 'warp', 'aider', 'trae',\n  'augment', 'kilo', 'amp', 'devin', 'replit', 'goose', 'openhands', 'tabnine',\n  'mistral-vibe', 'ibm-bob', 'crush', 'droid-factory', 'forgecode', 'iflow', 'qwen', 'rovo', 'qoder',\n];\n\nfunction isValidTarget(t: string): t is InstallTarget | 'all' {\n  return t === 'all' || ALL_TARGETS.includes(t as InstallTarget);\n}\n\nfunction uninitKiro(projectRoot: string): void {\n  // Remove .kiro hooks created by kirograph\n  const kiroHooks = [\n    'kirograph-mark-dirty-on-save.kiro.hook',\n    'kirograph-mark-dirty-on-create.kiro.hook',\n    'kirograph-sync-on-delete.kiro.hook',\n    'kirograph-sync-if-dirty.kiro.hook',\n    'kirograph-compress-hint.kiro.hook',\n    'kirograph-mem-capture.kiro.hook',\n    // Legacy .json filenames\n    'kirograph-mark-dirty-on-save.json',\n    'kirograph-mark-dirty-on-create.json',\n    'kirograph-sync-on-delete.json',\n    'kirograph-sync-if-dirty.json',\n    'kirograph-sync-on-save.json',\n    'kirograph-sync-on-create.json',\n    'kirograph-compress-hint.json',\n    'kirograph-mem-capture.json',\n  ];\n  const hooksDir = path.join(projectRoot, '.kiro', 'hooks');\n  let removedHooks = 0;\n  for (const hook of kiroHooks) {\n    const p = path.join(hooksDir, hook);\n    if (fs.existsSync(p)) { fs.unlinkSync(p); removedHooks++; }\n  }\n  if (removedHooks > 0) console.log(`  ${green}\u2713${reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);\n\n  // Remove .kiro/steering/kirograph*.md (main + all workflow files)\n  const steeringDir = path.join(projectRoot, '.kiro', 'steering');\n  let removedSteering = 0;\n  if (fs.existsSync(steeringDir)) {\n    for (const entry of fs.readdirSync(steeringDir)) {\n      if (entry.startsWith('kirograph') && entry.endsWith('.md')) {\n        fs.unlinkSync(path.join(steeringDir, entry));\n        removedSteering++;\n      }\n    }\n  }\n  if (removedSteering > 0) {\n    console.log(`  ${green}\u2713${reset} Removed ${removedSteering} steering file(s) from .kiro/steering/`);\n  }\n\n  // Remove .kiro/agents/kirograph.json\n  const agentPath = path.join(projectRoot, '.kiro', 'agents', 'kirograph.json');\n  if (fs.existsSync(agentPath)) {\n    fs.unlinkSync(agentPath);\n    console.log(`  ${green}\u2713${reset} Removed .kiro/agents/kirograph.json`);\n  }\n\n  // Remove kirograph server from .kiro/settings/mcp.json\n  const { removeMcpServersConfig } = require('../installer/common');\n  const mcpPath = path.join(projectRoot, '.kiro', 'settings', 'mcp.json');\n  if (removeMcpServersConfig(mcpPath)) {\n    console.log(`  ${green}\u2713${reset} Removed kirograph from .kiro/settings/mcp.json`);\n  }\n}\n\nasync function runUninit(projectPath: string | undefined, opts: { force?: boolean; target?: string }): Promise<void> {\n  const projectRoot = path.resolve(projectPath ?? process.cwd());\n  const targetName = (opts.target ?? 'kiro').toLowerCase();\n\n  if (!isValidTarget(targetName)) {\n    console.error(`Unknown uninit target: ${opts.target}. Choose from: ${ALL_TARGETS.join(', ')}, all`);\n    process.exit(1);\n  }\n\n  const dir = path.join(projectRoot, '.kirograph');\n  if (!fs.existsSync(dir)) { console.log('Not initialized.'); return; }\n\n  let removeIntegration = true;\n  let removeGraph = opts.force === true;\n\n  if (!opts.force) {\n    printBanner();\n    const farewell = UNINIT_FAREWELLS[Math.floor(Math.random() * UNINIT_FAREWELLS.length)]!;\n    console.log(`  ${violet}${bold}${farewell}${reset}`);\n    console.log(`\\n  ${dim}This can remove ${targetName} integration files and, separately, the shared .kirograph/ data.${reset}`);\n    console.log(`  ${dim}Your source code is untouched.${reset}`);\n\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n\n    removeIntegration = await askToggle(rl, `Remove ${targetName} integration files?`, 'Removes hooks, MCP config, rules, and agent instructions for this target.', false);\n    removeGraph = await askToggle(rl, 'Remove shared .kirograph/ data too?', 'Deletes the graph database, snapshots, and all indexed data. Cannot be undone.', false);\n\n    rl.close();\n\n    if (!removeIntegration && !removeGraph) {\n      console.log(`\\n  ${dim}Cancelled. Nothing removed.${reset}\\n`);\n      return;\n    }\n    console.log();\n  }\n\n  if (removeGraph) {\n    fs.rmSync(dir, { recursive: true, force: true });\n    console.log(`  ${green}\u2713${reset} Removed .kirograph/`);\n  }\n\n  if (removeIntegration) {\n    const targets: InstallTarget[] = targetName === 'all' ? [...ALL_TARGETS] : [targetName as InstallTarget];\n\n    for (const t of targets) {\n      if (t === 'kiro') {\n        uninitKiro(projectRoot);\n      } else {\n        const installer = getTargetInstaller(t);\n        installer.uninit?.(projectRoot);\n      }\n    }\n  }\n\n  console.log(`\\n  ${dim}Done. Run ${violet}kirograph install --target ${targetName === 'all' ? 'kiro' : targetName}${reset}${dim} to come back anytime.${reset}\\n`);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('uninit [projectPath]')\n    .description('Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', `Integration target to clean up (or \"all\"): ${ALL_TARGETS.slice(0, 6).join(', ')}, ...`, 'kiro')\n    .action(runUninit);\n\n  program\n    .command('uninstall [projectPath]')\n    .description('Alias for uninit. Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', `Integration target to clean up (or \"all\"): ${ALL_TARGETS.slice(0, 6).join(', ')}, ...`, 'kiro')\n    .action(runUninit);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,SAAoB;AACpB,eAA0B;AAC1B,oBAA4B;AAC5B,gBAAgD;AAChD,qBAA0B;AAE1B,qBAAmC;AAE5B,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,cAA+B;AAAA,EACnC;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAS;AAAA,EAAU;AAAA,EAAe;AAAA,EACpD;AAAA,EAAY;AAAA,EAAS;AAAA,EAAW;AAAA,EAAS;AAAA,EACzC;AAAA,EAAY;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EACpC;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAa;AAAA,EACnE;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAS;AAAA,EAAiB;AAAA,EAAa;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAC7F;AAEA,SAAS,cAAc,GAAuC;AAC5D,SAAO,MAAM,SAAS,YAAY,SAAS,CAAkB;AAC/D;AAEA,SAAS,WAAW,aAA2B;AAE7C,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,KAAK,KAAK,aAAa,SAAS,OAAO;AACxD,MAAI,eAAe;AACnB,aAAW,QAAQ,WAAW;AAC5B,UAAM,IAAI,KAAK,KAAK,UAAU,IAAI;AAClC,QAAI,GAAG,WAAW,CAAC,GAAG;AAAE,SAAG,WAAW,CAAC;AAAG;AAAA,IAAgB;AAAA,EAC5D;AACA,MAAI,eAAe,EAAG,SAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,YAAY,4BAA4B;AAGzG,QAAM,cAAc,KAAK,KAAK,aAAa,SAAS,UAAU;AAC9D,MAAI,kBAAkB;AACtB,MAAI,GAAG,WAAW,WAAW,GAAG;AAC9B,eAAW,SAAS,GAAG,YAAY,WAAW,GAAG;AAC/C,UAAI,MAAM,WAAW,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AAC1D,WAAG,WAAW,KAAK,KAAK,aAAa,KAAK,CAAC;AAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,eAAe,wCAAwC;AAAA,EACpG;AAGA,QAAM,YAAY,KAAK,KAAK,aAAa,SAAS,UAAU,gBAAgB;AAC5E,MAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,OAAG,WAAW,SAAS;AACvB,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,EACvE;AAGA,QAAM,EAAE,uBAAuB,IAAI,QAAQ,qBAAqB;AAChE,QAAM,UAAU,KAAK,KAAK,aAAa,SAAS,YAAY,UAAU;AACtE,MAAI,uBAAuB,OAAO,GAAG;AACnC,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,iDAAiD;AAAA,EAClF;AACF;AAEA,eAAe,UAAU,aAAiC,MAA2D;AACnH,QAAM,cAAc,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AAC7D,QAAM,cAAc,KAAK,UAAU,QAAQ,YAAY;AAEvD,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,YAAQ,MAAM,0BAA0B,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,CAAC,OAAO;AAClG,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,MAAM,KAAK,KAAK,aAAa,YAAY;AAC/C,MAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AAAE,YAAQ,IAAI,kBAAkB;AAAG;AAAA,EAAQ;AAEpE,MAAI,oBAAoB;AACxB,MAAI,cAAc,KAAK,UAAU;AAEjC,MAAI,CAAC,KAAK,OAAO;AACf,mCAAY;AACZ,UAAM,WAAW,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,iBAAiB,MAAM,CAAC;AACrF,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,QAAQ,GAAG,eAAK,EAAE;AACnD,YAAQ,IAAI;AAAA,IAAO,aAAG,mBAAmB,UAAU,mEAAmE,eAAK,EAAE;AAC7H,YAAQ,IAAI,KAAK,aAAG,iCAAiC,eAAK,EAAE;AAE5D,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAEpF,wBAAoB,UAAM,0BAAU,IAAI,UAAU,UAAU,uBAAuB,6EAA6E,KAAK;AACrK,kBAAc,UAAM,0BAAU,IAAI,uCAAuC,kFAAkF,KAAK;AAEhK,OAAG,MAAM;AAET,QAAI,CAAC,qBAAqB,CAAC,aAAa;AACtC,cAAQ,IAAI;AAAA,IAAO,aAAG,8BAA8B,eAAK;AAAA,CAAI;AAC7D;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,MAAI,aAAa;AACf,OAAG,OAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sBAAsB;AAAA,EACvD;AAEA,MAAI,mBAAmB;AACrB,UAAM,UAA2B,eAAe,QAAQ,CAAC,GAAG,WAAW,IAAI,CAAC,UAA2B;AAEvG,eAAW,KAAK,SAAS;AACvB,UAAI,MAAM,QAAQ;AAChB,mBAAW,WAAW;AAAA,MACxB,OAAO;AACL,cAAM,gBAAY,mCAAmB,CAAC;AACtC,kBAAU,SAAS,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,IAAO,aAAG,aAAa,gBAAM,8BAA8B,eAAe,QAAQ,SAAS,UAAU,GAAG,eAAK,GAAG,aAAG,yBAAyB,eAAK;AAAA,CAAI;AACnK;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,sBAAsB,EAC9B,YAAY,iCAAiC,EAC7C,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,8CAA8C,YAAY,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,MAAM,EAC3H,OAAO,SAAS;AAEnB,UACG,QAAQ,yBAAyB,EACjC,YAAY,mDAAmD,EAC/D,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,8CAA8C,YAAY,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,MAAM,EAC3H,OAAO,SAAS;AACrB;",
   "names": []
 }

package/dist/bin/commands/vex.js

@@ -0,0 +1,76 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vex_exports = {};
+__export(vex_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(vex_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+function register(program) {
+  program.command("vex [projectPath]").description("Export CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange)").option("--output <file>", "Write VEX to file instead of stdout").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { VEXExporter } = await Promise.resolve().then(() => require("../../security/export/vex.js"));
+    const exporter = new VEXExporter(db, target);
+    const json = exporter.exportJSON();
+    if (opts.output) {
+      const outPath = path.resolve(opts.output);
+      fs.mkdirSync(path.dirname(outPath), { recursive: true });
+      fs.writeFileSync(outPath, json, "utf-8");
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} VEX written to ${import_ui.violet}${import_ui.bold}${outPath}${import_ui.reset}`);
+    } else {
+      process.stdout.write(json + "\n");
+    }
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=vex.js.map

package/dist/bin/commands/vex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/vex.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nexport function register(program: Command): void {\n  program\n    .command('vex [projectPath]')\n    .description('Export CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange)')\n    .option('--output <file>', 'Write VEX to file instead of stdout')\n    .action(async (projectPath: string | undefined, opts: { output?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { VEXExporter } = await Promise.resolve().then(() => require('../../security/export/vex.js'));\n      const exporter = new VEXExporter(db, target);\n      const json = exporter.exportJSON();\n\n      if (opts.output) {\n        const outPath = path.resolve(opts.output);\n        fs.mkdirSync(path.dirname(outPath), { recursive: true });\n        fs.writeFileSync(outPath, json, 'utf-8');\n        console.error(`  ${green}\u2713${reset} VEX written to ${violet}${bold}${outPath}${reset}`);\n      } else {\n        process.stdout.write(json + '\\n');\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,SAAoB;AACpB,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEzC,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,mBAAmB,EAC3B,YAAY,kEAAkE,EAC9E,OAAO,mBAAmB,qCAAqC,EAC/D,OAAO,OAAO,aAAiC,SAA8B;AAC5E,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,YAAY,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,8BAA8B,CAAC;AAClG,UAAM,WAAW,IAAI,YAAY,IAAI,MAAM;AAC3C,UAAM,OAAO,SAAS,WAAW;AAEjC,QAAI,KAAK,QAAQ;AACf,YAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AACxC,SAAG,UAAU,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,SAAG,cAAc,SAAS,MAAM,OAAO;AACvC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,mBAAmB,gBAAM,GAAG,cAAI,GAAG,OAAO,GAAG,eAAK,EAAE;AAAA,IACvF,OAAO;AACL,cAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,IAClC;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/vuln-suppress.js

@@ -0,0 +1,95 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vuln_suppress_exports = {};
+__export(vuln_suppress_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(vuln_suppress_exports);
+var path = __toESM(require("path"));
+var import_ui = require("../ui");
+var import_suppressions = require("../../security/suppressions");
+function register(program) {
+  const vulnCmd = program.command("vuln").description("CVE suppression management");
+  vulnCmd.command("suppress <cveId> [projectPath]").description("Mark a CVE as suppressed (false positive or accepted risk)").option("--reason <text>", "Reason for suppression").option("--expires <date>", "Expiry date in ISO format (e.g. 2026-12-31)").action(async (cveId, projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    manager.add(cveId, opts.reason, opts.expires);
+    const reasonNote = opts.reason ? ` ${import_ui.dim}(${opts.reason})${import_ui.reset}` : "";
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset} suppressed${reasonNote}`);
+  });
+  vulnCmd.command("unsuppress <cveId> [projectPath]").description("Remove a CVE suppression").action(async (cveId, projectPath) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    const removed = manager.remove(cveId);
+    if (!removed) {
+      console.error(`  \u2716 No suppression found for ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset}`);
+      process.exit(1);
+    }
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset} unsuppressed`);
+  });
+  vulnCmd.command("suppressions [projectPath]").description("List all active CVE suppressions").option("--format <fmt>", "Output format: table | json", "table").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    const suppressions = manager.getActive();
+    if (opts.format === "json") {
+      console.log(JSON.stringify(suppressions, null, 2));
+      return;
+    }
+    if (suppressions.length === 0) {
+      console.log(`
+  ${import_ui.dim}No active suppressions.${import_ui.reset}
+`);
+      return;
+    }
+    const CVE_W = Math.max(6, ...suppressions.map((s) => s.cveId.length));
+    const DATE_W = 12;
+    const EXP_W = 12;
+    const header = `  ${import_ui.bold}${"CVE ID".padEnd(CVE_W)}${import_ui.reset}  ${import_ui.bold}${"Suppressed At".padEnd(DATE_W)}${import_ui.reset}  ${import_ui.bold}${"Expires".padEnd(EXP_W)}${import_ui.reset}  ${import_ui.bold}Reason${import_ui.reset}`;
+    const separator = `  ${"\u2500".repeat(CVE_W)}  ${"\u2500".repeat(DATE_W)}  ${"\u2500".repeat(EXP_W)}  ${"\u2500".repeat(20)}`;
+    console.log(`
+  ${import_ui.bold}Active Suppressions${import_ui.reset} (${suppressions.length})
+`);
+    console.log(header);
+    console.log(separator);
+    for (const s of suppressions) {
+      const suppressedDate = s.suppressedAt.slice(0, 10);
+      const expiresStr = s.expiresAt ? s.expiresAt.slice(0, 10) : import_ui.dim + "\u2014" + import_ui.reset;
+      const reasonStr = s.reason ? `${import_ui.dim}${s.reason}${import_ui.reset}` : `${import_ui.dim}\u2014${import_ui.reset}`;
+      console.log(
+        `  ${import_ui.violet}${s.cveId.padEnd(CVE_W)}${import_ui.reset}  ${suppressedDate.padEnd(DATE_W)}  ${expiresStr.padEnd(EXP_W + (s.expiresAt ? 0 : (import_ui.dim + import_ui.reset).length))}  ${reasonStr}`
+      );
+    }
+    console.log();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=vuln-suppress.js.map