kirograph 0.28.0 → 1.0.0

package/dist/bin/commands/vulns.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bin/commands/vulns.ts"],
-  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { formatFixSuggestion } from '../../security/export/fix-suggestions';\nimport { SuppressionManager } from '../../security/suppressions';\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Parse an `epss=N` fail-on value and return the threshold, or null if not an epss condition. */\nfunction parseEpssFailOn(failOn: string): number | null {\n  const m = failOn.match(/^epss=(.+)$/);\n  if (!m) return null;\n  const n = parseFloat(m[1]);\n  return isNaN(n) ? null : n;\n}\n\n/** Extract workspace label from a source_manifests JSON string. */\nfunction workspaceFromManifests(sourceManifests: string | null): string {\n  if (!sourceManifests) return 'root';\n  try {\n    const manifests: string[] = JSON.parse(sourceManifests);\n    if (!manifests.length) return 'root';\n    const dir = path.dirname(manifests[0]);\n    return dir === '.' ? 'root' : dir;\n  } catch {\n    return 'root';\n  }\n}\n\nexport function register(program: Command): void {\n  program\n    .command('vulns [projectPath]')\n    .description('List vulnerabilities with reachability verdicts and severity')\n    .option('--severity <level>', 'Filter by severity: critical, high, medium, low')\n    .option('--verdict <verdict>', 'Filter by verdict: affected, not_affected, under_investigation')\n    .option('--refresh', 'Trigger fresh vulnerability enrichment before listing')\n    .option('--epss <threshold>', 'Filter by EPSS score (e.g. 0.5 shows only vulns with EPSS >= 0.5)')\n    .option('--stale', 'Show staleness score of the affected dependency alongside each CVE')\n    .option('--sort <key>', 'Sort results by: risk (default), cvss, epss, name')\n    .option('--add <cveId>', 'Manually register a CVE')\n    .option('--package <name>', 'Package name for --add')\n    .option('--version <ver>', 'Package version for --add')\n    .option('--fail-on <condition>', 'Exit 1 if condition is met: affected, any, critical, high, epss=N')\n    .option('--group-by <key>', 'Group output by: workspace')\n    .action(async (projectPath: string | undefined, opts: {\n      severity?: string;\n      verdict?: string;\n      refresh?: boolean;\n      epss?: string;\n      stale?: boolean;\n      sort?: string;\n      add?: string;\n      package?: string;\n      version?: string;\n      failOn?: string;\n      groupBy?: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      // Validate --fail-on early\n      if (opts.failOn !== undefined) {\n        const validFailOns = ['affected', 'any', 'critical', 'high'];\n        const isEpss = parseEpssFailOn(opts.failOn) !== null;\n        if (!validFailOns.includes(opts.failOn) && !isEpss) {\n          console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: affected, any, critical, high, epss=N`);\n          process.exit(1);\n        }\n      }\n\n      // Validate --group-by early\n      if (opts.groupBy !== undefined && opts.groupBy !== 'workspace') {\n        console.error(`  \u2716 Invalid --group-by value: ${opts.groupBy}. Supported: workspace`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // Handle --add: manually register a CVE\n      if (opts.add) {\n        if (!opts.package || !opts.version) {\n          console.error(`  \u2716 --add requires --package <name> and --version <ver>`);\n          cg.close(); process.exit(1);\n        }\n\n        const cveId = opts.add;\n        const pkgName = opts.package;\n        const pkgVersion = opts.version;\n\n        // Find the matching dependency node\n        const depRow: { node_id: string; ecosystem: string } | undefined = rawDb.get(\n          `SELECT node_id, ecosystem FROM sec_dependencies\n           WHERE package_name = ? AND (resolved_version = ? OR declared_constraint = ?)`,\n          [pkgName, pkgVersion, pkgVersion],\n        );\n\n        if (!depRow) {\n          console.error(`  \u2716 No dependency found matching ${violet}${pkgName}@${pkgVersion}${reset}`);\n          console.error(`  ${dim}Run${reset} ${violet}${bold}kirograph index${reset} ${dim}first to discover dependencies.${reset}`);\n          cg.close(); process.exit(1);\n        }\n\n        // Create the vulnerability node\n        const vulnNodeId = `vuln:${cveId}`;\n        const now = Date.now();\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO nodes\n            (id, kind, name, qualified_name, file_path, language,\n             start_line, end_line, start_column, end_column,\n             is_exported, is_async, is_static, is_abstract, updated_at)\n           VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,\n          [vulnNodeId, cveId, cveId, now],\n        );\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO sec_vulnerabilities\n            (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n           VALUES (?, ?, NULL, '[]', NULL, 'Manually registered', 'manual')`,\n          [vulnNodeId, cveId],\n        );\n\n        // Create has_vulnerability edge\n        rawDb.run(\n          `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)\n           VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,\n          [depRow.node_id, vulnNodeId],\n        );\n\n        console.log(`  ${green}\u2713${reset} Registered ${violet}${bold}${cveId}${reset} against ${violet}${pkgName}@${pkgVersion}${reset}`);\n        cg.close();\n        return;\n      }\n\n      // Handle --refresh: trigger fresh vulnerability enrichment\n      if (opts.refresh) {\n        console.error(`  ${dim}Refreshing vulnerability data from configured databases...${reset}`);\n        const { OsvAdapter } = await Promise.resolve().then(() => require('../../security/vuln/osv-adapter.js'));\n        const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require('../../security/vuln/client.js'));\n\n        const adapters = config.securityDatabases.map((dbName: string) => {\n          if (dbName.toUpperCase() === 'OSV') return new OsvAdapter();\n          return null;\n        }).filter(Boolean) as any[];\n\n        const client = new VulnerabilityDatabaseClient(adapters, db);\n        const result = await client.enrichAll();\n\n        console.error(`  ${green}\u2713${reset} Checked ${bold}${result.dependenciesChecked}${reset} dependencies, found ${bold}${result.vulnerabilitiesFound}${reset} vulnerabilities`);\n        if (result.errors.length > 0) {\n          console.error(`  ${'\\x1b[33m'}\u26A0${reset} ${result.errors.length} error(s) during enrichment`);\n        }\n        console.error();\n      }\n\n      // Build query for listing vulnerabilities\n      // Include source_manifests when group-by workspace is requested\n      const selectSourceManifests = opts.groupBy === 'workspace' ? `,\\n          d.source_manifests` : '';\n      let query = `\n        SELECT\n          v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary, v.source_database,\n          v.epss_score, v.epss_percentile, v.risk_score,\n          d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,\n          d.staleness_score,\n          r.verdict${selectSourceManifests}\n        FROM sec_vulnerabilities v\n        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n        LEFT JOIN sec_dependencies d ON d.node_id = e.source\n        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n        WHERE 1=1\n      `;\n      const params: any[] = [];\n\n      // Apply severity filter\n      if (opts.severity) {\n        const severityRanges: Record<string, [number, number]> = {\n          critical: [9.0, 10.0],\n          high: [7.0, 8.9],\n          medium: [4.0, 6.9],\n          low: [0.1, 3.9],\n        };\n        const range = severityRanges[opts.severity.toLowerCase()];\n        if (!range) {\n          console.error(`  \u2716 Invalid severity: ${opts.severity}. Use: critical, high, medium, low`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND v.severity_score >= ? AND v.severity_score <= ?`;\n        params.push(range[0], range[1]);\n      }\n\n      // Apply verdict filter\n      if (opts.verdict) {\n        const validVerdicts = ['affected', 'not_affected', 'under_investigation'];\n        if (!validVerdicts.includes(opts.verdict)) {\n          console.error(`  \u2716 Invalid verdict: ${opts.verdict}. Use: affected, not_affected, under_investigation`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND r.verdict = ?`;\n        params.push(opts.verdict);\n      }\n\n      // Apply EPSS threshold filter\n      if (opts.epss !== undefined) {\n        const epssThreshold = parseFloat(opts.epss);\n        if (isNaN(epssThreshold) || epssThreshold < 0 || epssThreshold > 1) {\n          console.error(`  \u2716 Invalid EPSS threshold: ${opts.epss}. Use a number between 0 and 1 (e.g. 0.5)`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND v.epss_score >= ?`;\n        params.push(epssThreshold);\n      }\n\n      // Resolve sort order\n      const sortKey = opts.sort?.toLowerCase() ?? 'risk';\n      const validSortKeys = ['risk', 'cvss', 'epss', 'name'];\n      if (!validSortKeys.includes(sortKey)) {\n        console.error(`  \u2716 Invalid sort key: ${opts.sort}. Use: risk, cvss, epss, name`);\n        cg.close(); process.exit(1);\n      }\n      const sortClause =\n        sortKey === 'risk' ? `v.risk_score DESC NULLS LAST` :\n        sortKey === 'cvss' ? `v.severity_score DESC NULLS LAST` :\n        sortKey === 'epss' ? `v.epss_score DESC NULLS LAST` :\n        `v.cve_id ASC`;\n      query += ` ORDER BY ${sortClause}`;\n\n      const rows: Array<{\n        node_id: string;\n        cve_id: string;\n        severity_score: number | null;\n        fixed_version: string | null;\n        summary: string | null;\n        source_database: string;\n        epss_score: number | null;\n        epss_percentile: number | null;\n        risk_score: number | null;\n        package_name: string | null;\n        ecosystem: string | null;\n        resolved_version: string | null;\n        declared_constraint: string | null;\n        staleness_score: number | null;\n        verdict: string | null;\n        source_manifests?: string | null;\n      }> = rawDb.all(query, params);\n\n      // Deduplicate by (cve_id, package_name, ecosystem) \u2014 same CVE can appear multiple\n      // times if a package is declared in multiple manifests (monorepo) or has multiple\n      // dep nodes. Keep the row with the worst verdict (affected > under_investigation > not_affected > null).\n      const verdictRank = (v: string | null) =>\n        v === 'affected' ? 3 : v === 'under_investigation' ? 2 : v === 'not_affected' ? 1 : 0;\n      const deduped = new Map<string, typeof rows[0]>();\n      for (const row of rows) {\n        const key = `${row.cve_id}::${row.package_name ?? ''}::${row.ecosystem ?? ''}`;\n        const existing = deduped.get(key);\n        if (!existing || verdictRank(row.verdict) > verdictRank(existing.verdict)) {\n          deduped.set(key, row);\n        }\n      }\n      const dedupedRows = [...deduped.values()];\n\n      // Filter out suppressed CVEs\n      const suppressions = new SuppressionManager(target);\n      const suppressedRows = dedupedRows.filter(row => suppressions.isSuppressed(row.cve_id));\n      const filteredRows = dedupedRows.filter(row => !suppressions.isSuppressed(row.cve_id));\n\n      if (filteredRows.length === 0) {\n        const filterNote = (opts.severity || opts.verdict)\n          ? ` matching filters`\n          : '';\n        console.log(`\\n  ${dim}No vulnerabilities found${filterNote}.${reset}\\n`);\n        if (suppressedRows.length > 0) {\n          console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n        }\n        cg.close();\n        return;\n      }\n\n      // \u2500\u2500 Render a single vulnerability row \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      function printVulnRow(row: (typeof filteredRows)[0], indent = '  '): void {\n        // Severity badge\n        const score = row.severity_score;\n        let severityLabel: string;\n        let severityColor: string;\n        if (score == null) {\n          severityLabel = 'unknown';\n          severityColor = dim;\n        } else if (score >= 9.0) {\n          severityLabel = 'CRITICAL';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 7.0) {\n          severityLabel = 'HIGH';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 4.0) {\n          severityLabel = 'MEDIUM';\n          severityColor = '\\x1b[33m';\n        } else {\n          severityLabel = 'LOW';\n          severityColor = dim;\n        }\n\n        // Verdict badge\n        let verdictLabel: string;\n        let verdictColor: string;\n        if (!row.verdict) {\n          verdictLabel = 'pending';\n          verdictColor = dim;\n        } else if (row.verdict === 'affected') {\n          verdictLabel = 'affected';\n          verdictColor = '\\x1b[31m';\n        } else if (row.verdict === 'not_affected') {\n          verdictLabel = 'not affected';\n          verdictColor = green;\n        } else {\n          verdictLabel = 'investigating';\n          verdictColor = '\\x1b[33m';\n        }\n\n        const pkg = row.package_name\n          ? `${row.package_name}@${row.resolved_version || row.declared_constraint || '?'}`\n          : 'unknown package';\n\n        // EPSS badge\n        let epssBadge = '';\n        if (row.epss_score != null && row.epss_percentile != null) {\n          const epssColor = row.epss_score >= 0.3 ? '\\x1b[33m' : dim;\n          const scoreStr = row.epss_score.toFixed(2);\n          const pctStr = `${Math.round(row.epss_percentile * 100)}th%`;\n          epssBadge = `  ${epssColor}${dim}[EPSS: ${scoreStr} / ${pctStr}]${reset}`;\n        }\n\n        // Risk score badge\n        let riskBadge = '';\n        if (row.risk_score != null) {\n          const riskColor = row.risk_score >= 7 ? '\\x1b[31m' : row.risk_score >= 4 ? '\\x1b[33m' : dim;\n          riskBadge = `  ${riskColor}[Risk: ${row.risk_score.toFixed(1)}]${reset}`;\n        }\n\n        console.log(`${indent}${severityColor}${severityLabel}${reset}  ${violet}${bold}${row.cve_id}${reset}  ${dim}${pkg}${reset}  [${verdictColor}${verdictLabel}${reset}]${epssBadge}${riskBadge}`);\n\n        if (row.summary && row.summary !== 'Manually registered') {\n          const truncated = row.summary.length > 100 ? row.summary.slice(0, 100) + '\u2026' : row.summary;\n          console.log(`${indent}  ${dim}${truncated}${reset}`);\n        }\n\n        // Staleness badge (when --stale flag is set)\n        if (opts.stale && row.staleness_score != null) {\n          const s = row.staleness_score;\n          const staleColor = s >= 0.7 ? '\\x1b[31m' : s >= 0.4 ? '\\x1b[33m' : dim;\n          console.log(`${indent}  ${staleColor}${dim}[staleness: ${s.toFixed(2)}]${reset}`);\n        }\n\n        // Fix suggestion\n        if (row.fixed_version && row.ecosystem && row.package_name) {\n          const fix = formatFixSuggestion(row.ecosystem, row.package_name, row.fixed_version);\n          if (fix) {\n            console.log(`${indent}  ${fix}`);\n          }\n        }\n\n        console.log();\n      }\n\n      // \u2500\u2500 Output: grouped or flat \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.groupBy === 'workspace') {\n        // Group by workspace (directory of first source manifest)\n        const groups = new Map<string, Array<(typeof filteredRows)[0]>>();\n        for (const row of filteredRows) {\n          const ws = workspaceFromManifests(row.source_manifests ?? null);\n          if (!groups.has(ws)) groups.set(ws, []);\n          groups.get(ws)!.push(row);\n        }\n\n        // Only apply workspace grouping when there are multiple distinct workspaces\n        const workspaces = Array.from(groups.keys());\n        if (workspaces.length <= 1) {\n          // Single workspace \u2014 fall through to flat output\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const row of filteredRows) {\n            printVulnRow(row);\n          }\n        } else {\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const ws of workspaces) {\n            const wsRows = groups.get(ws)!;\n            const count = wsRows.length;\n            const header = `Workspace: ${ws} (${count} vulnerabilit${count === 1 ? 'y' : 'ies'})`;\n            const line = '\u2500'.repeat(header.length);\n            console.log(`  ${bold}${header}${reset}`);\n            console.log(`  ${dim}${line}${reset}`);\n            for (const row of wsRows) {\n              printVulnRow(row);\n            }\n          }\n        }\n      } else {\n        console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n        for (const row of filteredRows) {\n          printVulnRow(row);\n        }\n      }\n\n      if (suppressedRows.length > 0) {\n        console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n      }\n\n      // \u2500\u2500 CI exit codes: --fail-on \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.failOn !== undefined) {\n        const failOn = opts.failOn;\n\n        let failCount = 0;\n        let failReason = '';\n\n        if (failOn === 'affected') {\n          failCount = filteredRows.filter(r => r.verdict === 'affected').length;\n          failReason = `affected`;\n        } else if (failOn === 'any') {\n          failCount = filteredRows.length;\n          failReason = `any`;\n        } else if (failOn === 'critical') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 9.0).length;\n          failReason = `critical`;\n        } else if (failOn === 'high') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 7.0).length;\n          failReason = `high`;\n        } else {\n          const epssThreshold = parseEpssFailOn(failOn);\n          if (epssThreshold !== null) {\n            failCount = filteredRows.filter(r => r.epss_score != null && r.epss_score >= epssThreshold).length;\n            failReason = `epss=${epssThreshold}`;\n          }\n        }\n\n        if (failCount > 0) {\n          console.log(`  \\x1b[31m\u2716\\x1b[0m --fail-on ${failReason}: ${failCount} ${failReason === 'any' ? '' : `${failReason} `}vulnerabilit${failCount === 1 ? 'y' : 'ies'} found. Exiting with code 1.`);\n          cg.close();\n          process.exit(1);\n        }\n      }\n\n      cg.close();\n    });\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAChD,6BAAoC;AACpC,0BAAmC;AAKnC,SAAS,gBAAgB,QAA+B;AACtD,QAAM,IAAI,OAAO,MAAM,aAAa;AACpC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,WAAW,EAAE,CAAC,CAAC;AACzB,SAAO,MAAM,CAAC,IAAI,OAAO;AAC3B;AAGA,SAAS,uBAAuB,iBAAwC;AACtE,MAAI,CAAC,gBAAiB,QAAO;AAC7B,MAAI;AACF,UAAM,YAAsB,KAAK,MAAM,eAAe;AACtD,QAAI,CAAC,UAAU,OAAQ,QAAO;AAC9B,UAAM,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC;AACrC,WAAO,QAAQ,MAAM,SAAS;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,qBAAqB,EAC7B,YAAY,8DAA8D,EAC1E,OAAO,sBAAsB,iDAAiD,EAC9E,OAAO,uBAAuB,gEAAgE,EAC9F,OAAO,aAAa,uDAAuD,EAC3E,OAAO,sBAAsB,mEAAmE,EAChG,OAAO,WAAW,oEAAoE,EACtF,OAAO,gBAAgB,mDAAmD,EAC1E,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,oBAAoB,wBAAwB,EACnD,OAAO,mBAAmB,2BAA2B,EACrD,OAAO,yBAAyB,mEAAmE,EACnG,OAAO,oBAAoB,4BAA4B,EACvD,OAAO,OAAO,aAAiC,SAY1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,eAAe,CAAC,YAAY,OAAO,YAAY,MAAM;AAC3D,YAAM,SAAS,gBAAgB,KAAK,MAAM,MAAM;AAChD,UAAI,CAAC,aAAa,SAAS,KAAK,MAAM,KAAK,CAAC,QAAQ;AAClD,gBAAQ,MAAM,qCAAgC,KAAK,MAAM,8CAA8C;AACvG,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,KAAK,YAAY,UAAa,KAAK,YAAY,aAAa;AAC9D,cAAQ,MAAM,sCAAiC,KAAK,OAAO,wBAAwB;AACnF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAG1B,QAAI,KAAK,KAAK;AACZ,UAAI,CAAC,KAAK,WAAW,CAAC,KAAK,SAAS;AAClC,gBAAQ,MAAM,8DAAyD;AACvE,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAEA,YAAM,QAAQ,KAAK;AACnB,YAAM,UAAU,KAAK;AACrB,YAAM,aAAa,KAAK;AAGxB,YAAM,SAA6D,MAAM;AAAA,QACvE;AAAA;AAAA,QAEA,CAAC,SAAS,YAAY,UAAU;AAAA,MAClC;AAEA,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,yCAAoC,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC1F,gBAAQ,MAAM,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK,IAAI,aAAG,kCAAkC,eAAK,EAAE;AACzH,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAGA,YAAM,aAAa,QAAQ,KAAK;AAChC,YAAM,MAAM,KAAK,IAAI;AAErB,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,CAAC,YAAY,OAAO,OAAO,GAAG;AAAA,MAChC;AAEA,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,YAAY,KAAK;AAAA,MACpB;AAGA,YAAM;AAAA,QACJ;AAAA;AAAA,QAEA,CAAC,OAAO,SAAS,UAAU;AAAA,MAC7B;AAEA,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,eAAe,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,YAAY,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC/H,SAAG,MAAM;AACT;AAAA,IACF;AAGA,QAAI,KAAK,SAAS;AAChB,cAAQ,MAAM,KAAK,aAAG,6DAA6D,eAAK,EAAE;AAC1F,YAAM,EAAE,WAAW,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,oCAAoC,CAAC;AACvG,YAAM,EAAE,4BAA4B,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AAEnH,YAAM,WAAW,OAAO,kBAAkB,IAAI,CAAC,WAAmB;AAChE,YAAI,OAAO,YAAY,MAAM,MAAO,QAAO,IAAI,WAAW;AAC1D,eAAO;AAAA,MACT,CAAC,EAAE,OAAO,OAAO;AAEjB,YAAM,SAAS,IAAI,4BAA4B,UAAU,EAAE;AAC3D,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,YAAY,cAAI,GAAG,OAAO,mBAAmB,GAAG,eAAK,wBAAwB,cAAI,GAAG,OAAO,oBAAoB,GAAG,eAAK,kBAAkB;AAC1K,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,MAAM,KAAK,UAAU,SAAI,eAAK,IAAI,OAAO,OAAO,MAAM,6BAA6B;AAAA,MAC7F;AACA,cAAQ,MAAM;AAAA,IAChB;AAIA,UAAM,wBAAwB,KAAK,YAAY,cAAc;AAAA,gCAAoC;AACjG,QAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAMG,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOpC,UAAM,SAAgB,CAAC;AAGvB,QAAI,KAAK,UAAU;AACjB,YAAM,iBAAmD;AAAA,QACvD,UAAU,CAAC,GAAK,EAAI;AAAA,QACpB,MAAM,CAAC,GAAK,GAAG;AAAA,QACf,QAAQ,CAAC,GAAK,GAAG;AAAA,QACjB,KAAK,CAAC,KAAK,GAAG;AAAA,MAChB;AACA,YAAM,QAAQ,eAAe,KAAK,SAAS,YAAY,CAAC;AACxD,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,8BAAyB,KAAK,QAAQ,oCAAoC;AACxF,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAChC;AAGA,QAAI,KAAK,SAAS;AAChB,YAAM,gBAAgB,CAAC,YAAY,gBAAgB,qBAAqB;AACxE,UAAI,CAAC,cAAc,SAAS,KAAK,OAAO,GAAG;AACzC,gBAAQ,MAAM,6BAAwB,KAAK,OAAO,oDAAoD;AACtG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,KAAK,OAAO;AAAA,IAC1B;AAGA,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,gBAAgB,WAAW,KAAK,IAAI;AAC1C,UAAI,MAAM,aAAa,KAAK,gBAAgB,KAAK,gBAAgB,GAAG;AAClE,gBAAQ,MAAM,oCAA+B,KAAK,IAAI,2CAA2C;AACjG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,aAAa;AAAA,IAC3B;AAGA,UAAM,UAAU,KAAK,MAAM,YAAY,KAAK;AAC5C,UAAM,gBAAgB,CAAC,QAAQ,QAAQ,QAAQ,MAAM;AACrD,QAAI,CAAC,cAAc,SAAS,OAAO,GAAG;AACpC,cAAQ,MAAM,8BAAyB,KAAK,IAAI,+BAA+B;AAC/E,SAAG,MAAM;AAAG,cAAQ,KAAK,CAAC;AAAA,IAC5B;AACA,UAAM,aACJ,YAAY,SAAS,iCACrB,YAAY,SAAS,qCACrB,YAAY,SAAS,iCACrB;AACF,aAAS,aAAa,UAAU;AAEhC,UAAM,OAiBD,MAAM,IAAI,OAAO,MAAM;AAK5B,UAAM,cAAc,CAAC,MACnB,MAAM,aAAa,IAAI,MAAM,wBAAwB,IAAI,MAAM,iBAAiB,IAAI;AACtF,UAAM,UAAU,oBAAI,IAA4B;AAChD,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,GAAG,IAAI,MAAM,KAAK,IAAI,gBAAgB,EAAE,KAAK,IAAI,aAAa,EAAE;AAC5E,YAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAI,CAAC,YAAY,YAAY,IAAI,OAAO,IAAI,YAAY,SAAS,OAAO,GAAG;AACzE,gBAAQ,IAAI,KAAK,GAAG;AAAA,MACtB;AAAA,IACF;AACA,UAAM,cAAc,CAAC,GAAG,QAAQ,OAAO,CAAC;AAGxC,UAAM,eAAe,IAAI,uCAAmB,MAAM;AAClD,UAAM,iBAAiB,YAAY,OAAO,SAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AACtF,UAAM,eAAe,YAAY,OAAO,SAAO,CAAC,aAAa,aAAa,IAAI,MAAM,CAAC;AAErF,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,aAAc,KAAK,YAAY,KAAK,UACtC,sBACA;AACJ,cAAQ,IAAI;AAAA,IAAO,aAAG,2BAA2B,UAAU,IAAI,eAAK;AAAA,CAAI;AACxE,UAAI,eAAe,SAAS,GAAG;AAC7B,gBAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,MACpH;AACA,SAAG,MAAM;AACT;AAAA,IACF;AAIA,aAAS,aAAa,KAA+B,SAAS,MAAY;AAExE,YAAM,QAAQ,IAAI;AAClB,UAAI;AACJ,UAAI;AACJ,UAAI,SAAS,MAAM;AACjB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAChB,wBAAgB;AAAA,MAClB;AAGA,UAAI;AACJ,UAAI;AACJ,UAAI,CAAC,IAAI,SAAS;AAChB,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,YAAY;AACrC,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,gBAAgB;AACzC,uBAAe;AACf,uBAAe;AAAA,MACjB,OAAO;AACL,uBAAe;AACf,uBAAe;AAAA,MACjB;AAEA,YAAM,MAAM,IAAI,eACZ,GAAG,IAAI,YAAY,IAAI,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,KAC7E;AAGJ,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,QAAQ,IAAI,mBAAmB,MAAM;AACzD,cAAM,YAAY,IAAI,cAAc,MAAM,aAAa;AACvD,cAAM,WAAW,IAAI,WAAW,QAAQ,CAAC;AACzC,cAAM,SAAS,GAAG,KAAK,MAAM,IAAI,kBAAkB,GAAG,CAAC;AACvD,oBAAY,KAAK,SAAS,GAAG,aAAG,UAAU,QAAQ,MAAM,MAAM,IAAI,eAAK;AAAA,MACzE;AAGA,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,MAAM;AAC1B,cAAM,YAAY,IAAI,cAAc,IAAI,aAAa,IAAI,cAAc,IAAI,aAAa;AACxF,oBAAY,KAAK,SAAS,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,IAAI,eAAK;AAAA,MACxE;AAEA,cAAQ,IAAI,GAAG,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,eAAK,KAAK,gBAAM,GAAG,cAAI,GAAG,IAAI,MAAM,GAAG,eAAK,KAAK,aAAG,GAAG,GAAG,GAAG,eAAK,MAAM,YAAY,GAAG,YAAY,GAAG,eAAK,IAAI,SAAS,GAAG,SAAS,EAAE;AAE9L,UAAI,IAAI,WAAW,IAAI,YAAY,uBAAuB;AACxD,cAAM,YAAY,IAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,GAAG,GAAG,IAAI,WAAM,IAAI;AACnF,gBAAQ,IAAI,GAAG,MAAM,KAAK,aAAG,GAAG,SAAS,GAAG,eAAK,EAAE;AAAA,MACrD;AAGA,UAAI,KAAK,SAAS,IAAI,mBAAmB,MAAM;AAC7C,cAAM,IAAI,IAAI;AACd,cAAM,aAAa,KAAK,MAAM,aAAa,KAAK,MAAM,aAAa;AACnE,gBAAQ,IAAI,GAAG,MAAM,KAAK,UAAU,GAAG,aAAG,eAAe,EAAE,QAAQ,CAAC,CAAC,IAAI,eAAK,EAAE;AAAA,MAClF;AAGA,UAAI,IAAI,iBAAiB,IAAI,aAAa,IAAI,cAAc;AAC1D,cAAM,UAAM,4CAAoB,IAAI,WAAW,IAAI,cAAc,IAAI,aAAa;AAClF,YAAI,KAAK;AACP,kBAAQ,IAAI,GAAG,MAAM,KAAK,GAAG,EAAE;AAAA,QACjC;AAAA,MACF;AAEA,cAAQ,IAAI;AAAA,IACd;AAIA,QAAI,KAAK,YAAY,aAAa;AAEhC,YAAM,SAAS,oBAAI,IAA6C;AAChE,iBAAW,OAAO,cAAc;AAC9B,cAAM,KAAK,uBAAuB,IAAI,oBAAoB,IAAI;AAC9D,YAAI,CAAC,OAAO,IAAI,EAAE,EAAG,QAAO,IAAI,IAAI,CAAC,CAAC;AACtC,eAAO,IAAI,EAAE,EAAG,KAAK,GAAG;AAAA,MAC1B;AAGA,YAAM,aAAa,MAAM,KAAK,OAAO,KAAK,CAAC;AAC3C,UAAI,WAAW,UAAU,GAAG;AAE1B,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,OAAO,cAAc;AAC9B,uBAAa,GAAG;AAAA,QAClB;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,MAAM,YAAY;AAC3B,gBAAM,SAAS,OAAO,IAAI,EAAE;AAC5B,gBAAM,QAAQ,OAAO;AACrB,gBAAM,SAAS,cAAc,EAAE,KAAK,KAAK,gBAAgB,UAAU,IAAI,MAAM,KAAK;AAClF,gBAAM,OAAO,SAAI,OAAO,OAAO,MAAM;AACrC,kBAAQ,IAAI,KAAK,cAAI,GAAG,MAAM,GAAG,eAAK,EAAE;AACxC,kBAAQ,IAAI,KAAK,aAAG,GAAG,IAAI,GAAG,eAAK,EAAE;AACrC,qBAAW,OAAO,QAAQ;AACxB,yBAAa,GAAG;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,iBAAW,OAAO,cAAc;AAC9B,qBAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS,GAAG;AAC7B,cAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,IACpH;AAIA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,SAAS,KAAK;AAEpB,UAAI,YAAY;AAChB,UAAI,aAAa;AAEjB,UAAI,WAAW,YAAY;AACzB,oBAAY,aAAa,OAAO,OAAK,EAAE,YAAY,UAAU,EAAE;AAC/D,qBAAa;AAAA,MACf,WAAW,WAAW,OAAO;AAC3B,oBAAY,aAAa;AACzB,qBAAa;AAAA,MACf,WAAW,WAAW,YAAY;AAChC,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,WAAW,WAAW,QAAQ;AAC5B,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,OAAO;AACL,cAAM,gBAAgB,gBAAgB,MAAM;AAC5C,YAAI,kBAAkB,MAAM;AAC1B,sBAAY,aAAa,OAAO,OAAK,EAAE,cAAc,QAAQ,EAAE,cAAc,aAAa,EAAE;AAC5F,uBAAa,QAAQ,aAAa;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,YAAY,GAAG;AACjB,gBAAQ,IAAI,qCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,QAAQ,KAAK,GAAG,UAAU,GAAG,eAAe,cAAc,IAAI,MAAM,KAAK,8BAA8B;AAC9L,WAAG,MAAM;AACT,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { formatFixSuggestion } from '../../security/export/fix-suggestions';\nimport { SuppressionManager } from '../../security/suppressions';\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Parse an `epss=N` fail-on value and return the threshold, or null if not an epss condition. */\nfunction parseEpssFailOn(failOn: string): number | null {\n  const m = failOn.match(/^epss=(.+)$/);\n  if (!m) return null;\n  const n = parseFloat(m[1]);\n  return isNaN(n) ? null : n;\n}\n\n/** Extract workspace label from a source_manifests JSON string. */\nfunction workspaceFromManifests(sourceManifests: string | null): string {\n  if (!sourceManifests) return 'root';\n  try {\n    const manifests: string[] = JSON.parse(sourceManifests);\n    if (!manifests.length) return 'root';\n    const dir = path.dirname(manifests[0]);\n    return dir === '.' ? 'root' : dir;\n  } catch {\n    return 'root';\n  }\n}\n\nexport function register(program: Command): void {\n  program\n    .command('vulns [projectPath]')\n    .description('List vulnerabilities with reachability verdicts and severity')\n    .option('--severity <level>', 'Filter by severity: critical, high, medium, low')\n    .option('--verdict <verdict>', 'Filter by verdict: affected, not_affected, under_investigation')\n    .option('--refresh', 'Trigger fresh vulnerability enrichment before listing')\n    .option('--epss <threshold>', 'Filter by EPSS score (e.g. 0.5 shows only vulns with EPSS >= 0.5)')\n    .option('--stale', 'Show staleness score of the affected dependency alongside each CVE')\n    .option('--sort <key>', 'Sort results by: risk (default), cvss, epss, name')\n    .option('--add <cveId>', 'Manually register a CVE')\n    .option('--package <name>', 'Package name for --add')\n    .option('--version <ver>', 'Package version for --add')\n    .option('--fail-on <condition>', 'Exit 1 if condition is met: affected, any, critical, high, epss=N')\n    .option('--group-by <key>', 'Group output by: workspace')\n    .action(async (projectPath: string | undefined, opts: {\n      severity?: string;\n      verdict?: string;\n      refresh?: boolean;\n      epss?: string;\n      stale?: boolean;\n      sort?: string;\n      add?: string;\n      package?: string;\n      version?: string;\n      failOn?: string;\n      groupBy?: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      // Validate --fail-on early\n      if (opts.failOn !== undefined) {\n        const validFailOns = ['affected', 'any', 'critical', 'high'];\n        const isEpss = parseEpssFailOn(opts.failOn) !== null;\n        if (!validFailOns.includes(opts.failOn) && !isEpss) {\n          console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: affected, any, critical, high, epss=N`);\n          process.exit(1);\n        }\n      }\n\n      // Validate --group-by early\n      if (opts.groupBy !== undefined && opts.groupBy !== 'workspace') {\n        console.error(`  \u2716 Invalid --group-by value: ${opts.groupBy}. Supported: workspace`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // Handle --add: manually register a CVE\n      if (opts.add) {\n        if (!opts.package || !opts.version) {\n          console.error(`  \u2716 --add requires --package <name> and --version <ver>`);\n          cg.close(); process.exit(1);\n        }\n\n        const cveId = opts.add;\n        const pkgName = opts.package;\n        const pkgVersion = opts.version;\n\n        // Find the matching dependency node\n        const depRow: { node_id: string; ecosystem: string } | undefined = rawDb.get(\n          `SELECT node_id, ecosystem FROM sec_dependencies\n           WHERE package_name = ? AND (resolved_version = ? OR declared_constraint = ?)`,\n          [pkgName, pkgVersion, pkgVersion],\n        );\n\n        if (!depRow) {\n          console.error(`  \u2716 No dependency found matching ${violet}${pkgName}@${pkgVersion}${reset}`);\n          console.error(`  ${dim}Run${reset} ${violet}${bold}kirograph index${reset} ${dim}first to discover dependencies.${reset}`);\n          cg.close(); process.exit(1);\n        }\n\n        // Create the vulnerability node\n        const vulnNodeId = `vuln:${cveId}`;\n        const now = Date.now();\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO nodes\n            (id, kind, name, qualified_name, file_path, language,\n             start_line, end_line, start_column, end_column,\n             is_exported, is_async, is_static, is_abstract, updated_at)\n           VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,\n          [vulnNodeId, cveId, cveId, now],\n        );\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO sec_vulnerabilities\n            (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n           VALUES (?, ?, NULL, '[]', NULL, 'Manually registered', 'manual')`,\n          [vulnNodeId, cveId],\n        );\n\n        // Create has_vulnerability edge\n        rawDb.run(\n          `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)\n           VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,\n          [depRow.node_id, vulnNodeId],\n        );\n\n        console.log(`  ${green}\u2713${reset} Registered ${violet}${bold}${cveId}${reset} against ${violet}${pkgName}@${pkgVersion}${reset}`);\n        cg.close();\n        return;\n      }\n\n      // Handle --refresh: trigger fresh vulnerability enrichment\n      if (opts.refresh) {\n        console.error(`  ${dim}Refreshing vulnerability data from configured databases...${reset}`);\n        const { OsvAdapter } = await Promise.resolve().then(() => require('../../security/vuln/osv-adapter.js'));\n        const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require('../../security/vuln/client.js'));\n\n        const adapters = config.securityDatabases.map((dbName: string) => {\n          if (dbName.toUpperCase() === 'OSV') return new OsvAdapter();\n          return null;\n        }).filter(Boolean) as any[];\n\n        const client = new VulnerabilityDatabaseClient(adapters, db);\n        const result = await client.enrichAll();\n\n        console.error(`  ${green}\u2713${reset} Checked ${bold}${result.dependenciesChecked}${reset} dependencies, found ${bold}${result.vulnerabilitiesFound}${reset} vulnerabilities`);\n        if (result.errors.length > 0) {\n          console.error(`  ${'\\x1b[33m'}\u26A0${reset} ${result.errors.length} error(s) during enrichment`);\n        }\n        console.error();\n      }\n\n      // Build query for listing vulnerabilities\n      // Include source_manifests when group-by workspace is requested\n      const selectSourceManifests = opts.groupBy === 'workspace' ? `,\\n          d.source_manifests` : '';\n      let query = `\n        SELECT\n          v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary, v.source_database,\n          v.epss_score, v.epss_percentile, v.risk_score,\n          d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,\n          d.staleness_score,\n          r.verdict${selectSourceManifests}\n        FROM sec_vulnerabilities v\n        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n        LEFT JOIN sec_dependencies d ON d.node_id = e.source\n        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n        WHERE 1=1\n      `;\n      const params: any[] = [];\n\n      // Apply severity filter.\n      // Bounds are half-open [min, max) and MUST mirror the display buckets in\n      // printVulnRow() so the filter and the rendered label never disagree:\n      //   CRITICAL >= 9.0, HIGH >= 7.0, MEDIUM >= 4.0, LOW < 4.0 (incl. 0.0).\n      if (opts.severity) {\n        const severityRanges: Record<string, [number, number]> = {\n          critical: [9.0, 10.01],\n          high: [7.0, 9.0],\n          medium: [4.0, 7.0],\n          low: [0.0, 4.0],\n        };\n        const range = severityRanges[opts.severity.toLowerCase()];\n        if (!range) {\n          console.error(`  \u2716 Invalid severity: ${opts.severity}. Use: critical, high, medium, low`);\n          cg.close(); process.exit(1);\n        }\n        // severity_score IS NULL means \"unknown\" \u2014 excluded from every band.\n        query += ` AND v.severity_score IS NOT NULL AND v.severity_score >= ? AND v.severity_score < ?`;\n        params.push(range[0], range[1]);\n      }\n\n      // Apply verdict filter\n      if (opts.verdict) {\n        const validVerdicts = ['affected', 'not_affected', 'under_investigation'];\n        if (!validVerdicts.includes(opts.verdict)) {\n          console.error(`  \u2716 Invalid verdict: ${opts.verdict}. Use: affected, not_affected, under_investigation`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND r.verdict = ?`;\n        params.push(opts.verdict);\n      }\n\n      // Apply EPSS threshold filter\n      if (opts.epss !== undefined) {\n        const epssThreshold = parseFloat(opts.epss);\n        if (isNaN(epssThreshold) || epssThreshold < 0 || epssThreshold > 1) {\n          console.error(`  \u2716 Invalid EPSS threshold: ${opts.epss}. Use a number between 0 and 1 (e.g. 0.5)`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND v.epss_score >= ?`;\n        params.push(epssThreshold);\n      }\n\n      // Resolve sort order\n      const sortKey = opts.sort?.toLowerCase() ?? 'risk';\n      const validSortKeys = ['risk', 'cvss', 'epss', 'name'];\n      if (!validSortKeys.includes(sortKey)) {\n        console.error(`  \u2716 Invalid sort key: ${opts.sort}. Use: risk, cvss, epss, name`);\n        cg.close(); process.exit(1);\n      }\n      const sortClause =\n        sortKey === 'risk' ? `v.risk_score DESC NULLS LAST` :\n        sortKey === 'cvss' ? `v.severity_score DESC NULLS LAST` :\n        sortKey === 'epss' ? `v.epss_score DESC NULLS LAST` :\n        `v.cve_id ASC`;\n      query += ` ORDER BY ${sortClause}`;\n\n      const rows: Array<{\n        node_id: string;\n        cve_id: string;\n        severity_score: number | null;\n        fixed_version: string | null;\n        summary: string | null;\n        source_database: string;\n        epss_score: number | null;\n        epss_percentile: number | null;\n        risk_score: number | null;\n        package_name: string | null;\n        ecosystem: string | null;\n        resolved_version: string | null;\n        declared_constraint: string | null;\n        staleness_score: number | null;\n        verdict: string | null;\n        source_manifests?: string | null;\n      }> = rawDb.all(query, params);\n\n      // Deduplicate by (cve_id, package_name, ecosystem) \u2014 same CVE can appear multiple\n      // times if a package is declared in multiple manifests (monorepo) or has multiple\n      // dep nodes. Keep the row with the worst verdict (affected > under_investigation > not_affected > null).\n      const verdictRank = (v: string | null) =>\n        v === 'affected' ? 3 : v === 'under_investigation' ? 2 : v === 'not_affected' ? 1 : 0;\n      const deduped = new Map<string, typeof rows[0]>();\n      for (const row of rows) {\n        const key = `${row.cve_id}::${row.package_name ?? ''}::${row.ecosystem ?? ''}`;\n        const existing = deduped.get(key);\n        if (!existing || verdictRank(row.verdict) > verdictRank(existing.verdict)) {\n          deduped.set(key, row);\n        }\n      }\n      const dedupedRows = [...deduped.values()];\n\n      // Filter out suppressed CVEs\n      const suppressions = new SuppressionManager(target);\n      const suppressedRows = dedupedRows.filter(row => suppressions.isSuppressed(row.cve_id));\n      const filteredRows = dedupedRows.filter(row => !suppressions.isSuppressed(row.cve_id));\n\n      if (filteredRows.length === 0) {\n        const filterNote = (opts.severity || opts.verdict)\n          ? ` matching filters`\n          : '';\n        console.log(`\\n  ${dim}No vulnerabilities found${filterNote}.${reset}\\n`);\n        if (suppressedRows.length > 0) {\n          console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n        }\n        cg.close();\n        return;\n      }\n\n      // \u2500\u2500 Render a single vulnerability row \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      function printVulnRow(row: (typeof filteredRows)[0], indent = '  '): void {\n        // Severity badge\n        const score = row.severity_score;\n        let severityLabel: string;\n        let severityColor: string;\n        if (score == null) {\n          severityLabel = 'unknown';\n          severityColor = dim;\n        } else if (score >= 9.0) {\n          severityLabel = 'CRITICAL';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 7.0) {\n          severityLabel = 'HIGH';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 4.0) {\n          severityLabel = 'MEDIUM';\n          severityColor = '\\x1b[33m';\n        } else {\n          severityLabel = 'LOW';\n          severityColor = dim;\n        }\n\n        // Verdict badge\n        let verdictLabel: string;\n        let verdictColor: string;\n        if (!row.verdict) {\n          verdictLabel = 'pending';\n          verdictColor = dim;\n        } else if (row.verdict === 'affected') {\n          verdictLabel = 'affected';\n          verdictColor = '\\x1b[31m';\n        } else if (row.verdict === 'not_affected') {\n          verdictLabel = 'not affected';\n          verdictColor = green;\n        } else {\n          verdictLabel = 'investigating';\n          verdictColor = '\\x1b[33m';\n        }\n\n        const pkg = row.package_name\n          ? `${row.package_name}@${row.resolved_version || row.declared_constraint || '?'}`\n          : 'unknown package';\n\n        // EPSS badge\n        let epssBadge = '';\n        if (row.epss_score != null && row.epss_percentile != null) {\n          const epssColor = row.epss_score >= 0.3 ? '\\x1b[33m' : dim;\n          const scoreStr = row.epss_score.toFixed(2);\n          const pctStr = `${Math.round(row.epss_percentile * 100)}th%`;\n          epssBadge = `  ${epssColor}${dim}[EPSS: ${scoreStr} / ${pctStr}]${reset}`;\n        }\n\n        // Risk score badge\n        let riskBadge = '';\n        if (row.risk_score != null) {\n          const riskColor = row.risk_score >= 7 ? '\\x1b[31m' : row.risk_score >= 4 ? '\\x1b[33m' : dim;\n          riskBadge = `  ${riskColor}[Risk: ${row.risk_score.toFixed(1)}]${reset}`;\n        }\n\n        console.log(`${indent}${severityColor}${severityLabel}${reset}  ${violet}${bold}${row.cve_id}${reset}  ${dim}${pkg}${reset}  [${verdictColor}${verdictLabel}${reset}]${epssBadge}${riskBadge}`);\n\n        if (row.summary && row.summary !== 'Manually registered') {\n          const truncated = row.summary.length > 100 ? row.summary.slice(0, 100) + '\u2026' : row.summary;\n          console.log(`${indent}  ${dim}${truncated}${reset}`);\n        }\n\n        // Staleness badge (when --stale flag is set)\n        if (opts.stale && row.staleness_score != null) {\n          const s = row.staleness_score;\n          const staleColor = s >= 0.7 ? '\\x1b[31m' : s >= 0.4 ? '\\x1b[33m' : dim;\n          console.log(`${indent}  ${staleColor}${dim}[staleness: ${s.toFixed(2)}]${reset}`);\n        }\n\n        // Fix suggestion\n        if (row.fixed_version && row.ecosystem && row.package_name) {\n          const fix = formatFixSuggestion(row.ecosystem, row.package_name, row.fixed_version);\n          if (fix) {\n            console.log(`${indent}  ${fix}`);\n          }\n        }\n\n        console.log();\n      }\n\n      // \u2500\u2500 Output: grouped or flat \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.groupBy === 'workspace') {\n        // Group by workspace (directory of first source manifest)\n        const groups = new Map<string, Array<(typeof filteredRows)[0]>>();\n        for (const row of filteredRows) {\n          const ws = workspaceFromManifests(row.source_manifests ?? null);\n          if (!groups.has(ws)) groups.set(ws, []);\n          groups.get(ws)!.push(row);\n        }\n\n        // Only apply workspace grouping when there are multiple distinct workspaces\n        const workspaces = Array.from(groups.keys());\n        if (workspaces.length <= 1) {\n          // Single workspace \u2014 fall through to flat output\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const row of filteredRows) {\n            printVulnRow(row);\n          }\n        } else {\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const ws of workspaces) {\n            const wsRows = groups.get(ws)!;\n            const count = wsRows.length;\n            const header = `Workspace: ${ws} (${count} vulnerabilit${count === 1 ? 'y' : 'ies'})`;\n            const line = '\u2500'.repeat(header.length);\n            console.log(`  ${bold}${header}${reset}`);\n            console.log(`  ${dim}${line}${reset}`);\n            for (const row of wsRows) {\n              printVulnRow(row);\n            }\n          }\n        }\n      } else {\n        console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n        for (const row of filteredRows) {\n          printVulnRow(row);\n        }\n      }\n\n      if (suppressedRows.length > 0) {\n        console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n      }\n\n      // Hint when reachability hasn't been computed yet (verdict is pending).\n      // vulns --refresh only re-queries vulnerability data; the call-graph\n      // reachability analysis that resolves [pending] \u2192 [affected]/[not affected]\n      // runs during `kirograph index`.\n      const pendingCount = filteredRows.filter(r => !r.verdict).length;\n      if (pendingCount > 0) {\n        console.log(`  ${dim}${pendingCount} vulnerabilit${pendingCount === 1 ? 'y is' : 'ies are'} [pending] reachability analysis \u2014 run ${reset}kirograph index${dim} to compute call-graph verdicts.${reset}\\n`);\n      }\n\n      // \u2500\u2500 CI exit codes: --fail-on \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.failOn !== undefined) {\n        const failOn = opts.failOn;\n\n        let failCount = 0;\n        let failReason = '';\n\n        if (failOn === 'affected') {\n          failCount = filteredRows.filter(r => r.verdict === 'affected').length;\n          failReason = `affected`;\n        } else if (failOn === 'any') {\n          failCount = filteredRows.length;\n          failReason = `any`;\n        } else if (failOn === 'critical') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 9.0).length;\n          failReason = `critical`;\n        } else if (failOn === 'high') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 7.0).length;\n          failReason = `high`;\n        } else {\n          const epssThreshold = parseEpssFailOn(failOn);\n          if (epssThreshold !== null) {\n            failCount = filteredRows.filter(r => r.epss_score != null && r.epss_score >= epssThreshold).length;\n            failReason = `epss=${epssThreshold}`;\n          }\n        }\n\n        if (failCount > 0) {\n          console.log(`  \\x1b[31m\u2716\\x1b[0m --fail-on ${failReason}: ${failCount} ${failReason === 'any' ? '' : `${failReason} `}vulnerabilit${failCount === 1 ? 'y' : 'ies'} found. Exiting with code 1.`);\n          cg.close();\n          process.exit(1);\n        }\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAChD,6BAAoC;AACpC,0BAAmC;AAKnC,SAAS,gBAAgB,QAA+B;AACtD,QAAM,IAAI,OAAO,MAAM,aAAa;AACpC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,WAAW,EAAE,CAAC,CAAC;AACzB,SAAO,MAAM,CAAC,IAAI,OAAO;AAC3B;AAGA,SAAS,uBAAuB,iBAAwC;AACtE,MAAI,CAAC,gBAAiB,QAAO;AAC7B,MAAI;AACF,UAAM,YAAsB,KAAK,MAAM,eAAe;AACtD,QAAI,CAAC,UAAU,OAAQ,QAAO;AAC9B,UAAM,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC;AACrC,WAAO,QAAQ,MAAM,SAAS;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,qBAAqB,EAC7B,YAAY,8DAA8D,EAC1E,OAAO,sBAAsB,iDAAiD,EAC9E,OAAO,uBAAuB,gEAAgE,EAC9F,OAAO,aAAa,uDAAuD,EAC3E,OAAO,sBAAsB,mEAAmE,EAChG,OAAO,WAAW,oEAAoE,EACtF,OAAO,gBAAgB,mDAAmD,EAC1E,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,oBAAoB,wBAAwB,EACnD,OAAO,mBAAmB,2BAA2B,EACrD,OAAO,yBAAyB,mEAAmE,EACnG,OAAO,oBAAoB,4BAA4B,EACvD,OAAO,OAAO,aAAiC,SAY1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,eAAe,CAAC,YAAY,OAAO,YAAY,MAAM;AAC3D,YAAM,SAAS,gBAAgB,KAAK,MAAM,MAAM;AAChD,UAAI,CAAC,aAAa,SAAS,KAAK,MAAM,KAAK,CAAC,QAAQ;AAClD,gBAAQ,MAAM,qCAAgC,KAAK,MAAM,8CAA8C;AACvG,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,KAAK,YAAY,UAAa,KAAK,YAAY,aAAa;AAC9D,cAAQ,MAAM,sCAAiC,KAAK,OAAO,wBAAwB;AACnF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAG1B,QAAI,KAAK,KAAK;AACZ,UAAI,CAAC,KAAK,WAAW,CAAC,KAAK,SAAS;AAClC,gBAAQ,MAAM,8DAAyD;AACvE,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAEA,YAAM,QAAQ,KAAK;AACnB,YAAM,UAAU,KAAK;AACrB,YAAM,aAAa,KAAK;AAGxB,YAAM,SAA6D,MAAM;AAAA,QACvE;AAAA;AAAA,QAEA,CAAC,SAAS,YAAY,UAAU;AAAA,MAClC;AAEA,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,yCAAoC,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC1F,gBAAQ,MAAM,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK,IAAI,aAAG,kCAAkC,eAAK,EAAE;AACzH,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAGA,YAAM,aAAa,QAAQ,KAAK;AAChC,YAAM,MAAM,KAAK,IAAI;AAErB,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,CAAC,YAAY,OAAO,OAAO,GAAG;AAAA,MAChC;AAEA,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,YAAY,KAAK;AAAA,MACpB;AAGA,YAAM;AAAA,QACJ;AAAA;AAAA,QAEA,CAAC,OAAO,SAAS,UAAU;AAAA,MAC7B;AAEA,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,eAAe,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,YAAY,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC/H,SAAG,MAAM;AACT;AAAA,IACF;AAGA,QAAI,KAAK,SAAS;AAChB,cAAQ,MAAM,KAAK,aAAG,6DAA6D,eAAK,EAAE;AAC1F,YAAM,EAAE,WAAW,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,oCAAoC,CAAC;AACvG,YAAM,EAAE,4BAA4B,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AAEnH,YAAM,WAAW,OAAO,kBAAkB,IAAI,CAAC,WAAmB;AAChE,YAAI,OAAO,YAAY,MAAM,MAAO,QAAO,IAAI,WAAW;AAC1D,eAAO;AAAA,MACT,CAAC,EAAE,OAAO,OAAO;AAEjB,YAAM,SAAS,IAAI,4BAA4B,UAAU,EAAE;AAC3D,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,YAAY,cAAI,GAAG,OAAO,mBAAmB,GAAG,eAAK,wBAAwB,cAAI,GAAG,OAAO,oBAAoB,GAAG,eAAK,kBAAkB;AAC1K,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,MAAM,KAAK,UAAU,SAAI,eAAK,IAAI,OAAO,OAAO,MAAM,6BAA6B;AAAA,MAC7F;AACA,cAAQ,MAAM;AAAA,IAChB;AAIA,UAAM,wBAAwB,KAAK,YAAY,cAAc;AAAA,gCAAoC;AACjG,QAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAMG,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOpC,UAAM,SAAgB,CAAC;AAMvB,QAAI,KAAK,UAAU;AACjB,YAAM,iBAAmD;AAAA,QACvD,UAAU,CAAC,GAAK,KAAK;AAAA,QACrB,MAAM,CAAC,GAAK,CAAG;AAAA,QACf,QAAQ,CAAC,GAAK,CAAG;AAAA,QACjB,KAAK,CAAC,GAAK,CAAG;AAAA,MAChB;AACA,YAAM,QAAQ,eAAe,KAAK,SAAS,YAAY,CAAC;AACxD,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,8BAAyB,KAAK,QAAQ,oCAAoC;AACxF,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAEA,eAAS;AACT,aAAO,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAChC;AAGA,QAAI,KAAK,SAAS;AAChB,YAAM,gBAAgB,CAAC,YAAY,gBAAgB,qBAAqB;AACxE,UAAI,CAAC,cAAc,SAAS,KAAK,OAAO,GAAG;AACzC,gBAAQ,MAAM,6BAAwB,KAAK,OAAO,oDAAoD;AACtG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,KAAK,OAAO;AAAA,IAC1B;AAGA,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,gBAAgB,WAAW,KAAK,IAAI;AAC1C,UAAI,MAAM,aAAa,KAAK,gBAAgB,KAAK,gBAAgB,GAAG;AAClE,gBAAQ,MAAM,oCAA+B,KAAK,IAAI,2CAA2C;AACjG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,aAAa;AAAA,IAC3B;AAGA,UAAM,UAAU,KAAK,MAAM,YAAY,KAAK;AAC5C,UAAM,gBAAgB,CAAC,QAAQ,QAAQ,QAAQ,MAAM;AACrD,QAAI,CAAC,cAAc,SAAS,OAAO,GAAG;AACpC,cAAQ,MAAM,8BAAyB,KAAK,IAAI,+BAA+B;AAC/E,SAAG,MAAM;AAAG,cAAQ,KAAK,CAAC;AAAA,IAC5B;AACA,UAAM,aACJ,YAAY,SAAS,iCACrB,YAAY,SAAS,qCACrB,YAAY,SAAS,iCACrB;AACF,aAAS,aAAa,UAAU;AAEhC,UAAM,OAiBD,MAAM,IAAI,OAAO,MAAM;AAK5B,UAAM,cAAc,CAAC,MACnB,MAAM,aAAa,IAAI,MAAM,wBAAwB,IAAI,MAAM,iBAAiB,IAAI;AACtF,UAAM,UAAU,oBAAI,IAA4B;AAChD,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,GAAG,IAAI,MAAM,KAAK,IAAI,gBAAgB,EAAE,KAAK,IAAI,aAAa,EAAE;AAC5E,YAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAI,CAAC,YAAY,YAAY,IAAI,OAAO,IAAI,YAAY,SAAS,OAAO,GAAG;AACzE,gBAAQ,IAAI,KAAK,GAAG;AAAA,MACtB;AAAA,IACF;AACA,UAAM,cAAc,CAAC,GAAG,QAAQ,OAAO,CAAC;AAGxC,UAAM,eAAe,IAAI,uCAAmB,MAAM;AAClD,UAAM,iBAAiB,YAAY,OAAO,SAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AACtF,UAAM,eAAe,YAAY,OAAO,SAAO,CAAC,aAAa,aAAa,IAAI,MAAM,CAAC;AAErF,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,aAAc,KAAK,YAAY,KAAK,UACtC,sBACA;AACJ,cAAQ,IAAI;AAAA,IAAO,aAAG,2BAA2B,UAAU,IAAI,eAAK;AAAA,CAAI;AACxE,UAAI,eAAe,SAAS,GAAG;AAC7B,gBAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,MACpH;AACA,SAAG,MAAM;AACT;AAAA,IACF;AAIA,aAAS,aAAa,KAA+B,SAAS,MAAY;AAExE,YAAM,QAAQ,IAAI;AAClB,UAAI;AACJ,UAAI;AACJ,UAAI,SAAS,MAAM;AACjB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAChB,wBAAgB;AAAA,MAClB;AAGA,UAAI;AACJ,UAAI;AACJ,UAAI,CAAC,IAAI,SAAS;AAChB,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,YAAY;AACrC,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,gBAAgB;AACzC,uBAAe;AACf,uBAAe;AAAA,MACjB,OAAO;AACL,uBAAe;AACf,uBAAe;AAAA,MACjB;AAEA,YAAM,MAAM,IAAI,eACZ,GAAG,IAAI,YAAY,IAAI,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,KAC7E;AAGJ,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,QAAQ,IAAI,mBAAmB,MAAM;AACzD,cAAM,YAAY,IAAI,cAAc,MAAM,aAAa;AACvD,cAAM,WAAW,IAAI,WAAW,QAAQ,CAAC;AACzC,cAAM,SAAS,GAAG,KAAK,MAAM,IAAI,kBAAkB,GAAG,CAAC;AACvD,oBAAY,KAAK,SAAS,GAAG,aAAG,UAAU,QAAQ,MAAM,MAAM,IAAI,eAAK;AAAA,MACzE;AAGA,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,MAAM;AAC1B,cAAM,YAAY,IAAI,cAAc,IAAI,aAAa,IAAI,cAAc,IAAI,aAAa;AACxF,oBAAY,KAAK,SAAS,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,IAAI,eAAK;AAAA,MACxE;AAEA,cAAQ,IAAI,GAAG,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,eAAK,KAAK,gBAAM,GAAG,cAAI,GAAG,IAAI,MAAM,GAAG,eAAK,KAAK,aAAG,GAAG,GAAG,GAAG,eAAK,MAAM,YAAY,GAAG,YAAY,GAAG,eAAK,IAAI,SAAS,GAAG,SAAS,EAAE;AAE9L,UAAI,IAAI,WAAW,IAAI,YAAY,uBAAuB;AACxD,cAAM,YAAY,IAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,GAAG,GAAG,IAAI,WAAM,IAAI;AACnF,gBAAQ,IAAI,GAAG,MAAM,KAAK,aAAG,GAAG,SAAS,GAAG,eAAK,EAAE;AAAA,MACrD;AAGA,UAAI,KAAK,SAAS,IAAI,mBAAmB,MAAM;AAC7C,cAAM,IAAI,IAAI;AACd,cAAM,aAAa,KAAK,MAAM,aAAa,KAAK,MAAM,aAAa;AACnE,gBAAQ,IAAI,GAAG,MAAM,KAAK,UAAU,GAAG,aAAG,eAAe,EAAE,QAAQ,CAAC,CAAC,IAAI,eAAK,EAAE;AAAA,MAClF;AAGA,UAAI,IAAI,iBAAiB,IAAI,aAAa,IAAI,cAAc;AAC1D,cAAM,UAAM,4CAAoB,IAAI,WAAW,IAAI,cAAc,IAAI,aAAa;AAClF,YAAI,KAAK;AACP,kBAAQ,IAAI,GAAG,MAAM,KAAK,GAAG,EAAE;AAAA,QACjC;AAAA,MACF;AAEA,cAAQ,IAAI;AAAA,IACd;AAIA,QAAI,KAAK,YAAY,aAAa;AAEhC,YAAM,SAAS,oBAAI,IAA6C;AAChE,iBAAW,OAAO,cAAc;AAC9B,cAAM,KAAK,uBAAuB,IAAI,oBAAoB,IAAI;AAC9D,YAAI,CAAC,OAAO,IAAI,EAAE,EAAG,QAAO,IAAI,IAAI,CAAC,CAAC;AACtC,eAAO,IAAI,EAAE,EAAG,KAAK,GAAG;AAAA,MAC1B;AAGA,YAAM,aAAa,MAAM,KAAK,OAAO,KAAK,CAAC;AAC3C,UAAI,WAAW,UAAU,GAAG;AAE1B,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,OAAO,cAAc;AAC9B,uBAAa,GAAG;AAAA,QAClB;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,MAAM,YAAY;AAC3B,gBAAM,SAAS,OAAO,IAAI,EAAE;AAC5B,gBAAM,QAAQ,OAAO;AACrB,gBAAM,SAAS,cAAc,EAAE,KAAK,KAAK,gBAAgB,UAAU,IAAI,MAAM,KAAK;AAClF,gBAAM,OAAO,SAAI,OAAO,OAAO,MAAM;AACrC,kBAAQ,IAAI,KAAK,cAAI,GAAG,MAAM,GAAG,eAAK,EAAE;AACxC,kBAAQ,IAAI,KAAK,aAAG,GAAG,IAAI,GAAG,eAAK,EAAE;AACrC,qBAAW,OAAO,QAAQ;AACxB,yBAAa,GAAG;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,iBAAW,OAAO,cAAc;AAC9B,qBAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS,GAAG;AAC7B,cAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,IACpH;AAMA,UAAM,eAAe,aAAa,OAAO,OAAK,CAAC,EAAE,OAAO,EAAE;AAC1D,QAAI,eAAe,GAAG;AACpB,cAAQ,IAAI,KAAK,aAAG,GAAG,YAAY,gBAAgB,iBAAiB,IAAI,SAAS,SAAS,+CAA0C,eAAK,kBAAkB,aAAG,mCAAmC,eAAK;AAAA,CAAI;AAAA,IAC5M;AAIA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,SAAS,KAAK;AAEpB,UAAI,YAAY;AAChB,UAAI,aAAa;AAEjB,UAAI,WAAW,YAAY;AACzB,oBAAY,aAAa,OAAO,OAAK,EAAE,YAAY,UAAU,EAAE;AAC/D,qBAAa;AAAA,MACf,WAAW,WAAW,OAAO;AAC3B,oBAAY,aAAa;AACzB,qBAAa;AAAA,MACf,WAAW,WAAW,YAAY;AAChC,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,WAAW,WAAW,QAAQ;AAC5B,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,OAAO;AACL,cAAM,gBAAgB,gBAAgB,MAAM;AAC5C,YAAI,kBAAkB,MAAM;AAC1B,sBAAY,aAAa,OAAO,OAAK,EAAE,cAAc,QAAQ,EAAE,cAAc,aAAa,EAAE;AAC5F,uBAAa,QAAQ,aAAa;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,YAAY,GAAG;AACjB,gBAAQ,IAAI,qCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,QAAQ,KAAK,GAAG,UAAU,GAAG,eAAe,cAAc,IAAI,MAAM,KAAK,8BAA8B;AAC9L,WAAG,MAAM;AACT,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
   "names": []
 }

package/dist/bin/installer/common.js

@@ -44,6 +44,7 @@ __export(common_exports, {
   removeGeneratedBlock: () => removeGeneratedBlock,
   removeImportLine: () => removeImportLine,
   removeMcpServersConfig: () => removeMcpServersConfig,
+  silentCommand: () => silentCommand,
   upsertGeneratedBlock: () => upsertGeneratedBlock,
   writeJson: () => writeJson,
   writeMcpServersConfig: () => writeMcpServersConfig
@@ -55,7 +56,11 @@ var import_tool_names = require("../../mcp/tool-names");
 const KIROGRAPH_SERVER_NAME = "kirograph";
 const KIROGRAPH_COMMAND = "kirograph";
 const KIROGRAPH_MCP_ARGS = ["serve", "--mcp"];
-const KIROGRAPH_SYNC_CMD = "kirograph sync-if-dirty --quiet 2>/dev/null || true";
+function silentCommand(baseCommand) {
+  const isWindows = process.platform === "win32";
+  return isWindows ? `${baseCommand} >nul 2>&1 || exit /b 0` : `${baseCommand} >/dev/null 2>&1 || true`;
+}
+const KIROGRAPH_SYNC_CMD = silentCommand("kirograph sync-if-dirty --quiet");
 const KIROGRAPH_TOOLS = import_tool_names.KIROGRAPH_TOOL_NAMES;
 const KIROGRAPH_SCOPED_TOOLS = import_tool_names.KIROGRAPH_TOOL_NAMES.map((name) => `@kirograph/${name}`);
 function ensureDir(p) {
@@ -214,6 +219,7 @@ function printMcpCommand(command) {
   removeGeneratedBlock,
   removeImportLine,
   removeMcpServersConfig,
+  silentCommand,
   upsertGeneratedBlock,
   writeJson,
   writeMcpServersConfig

package/dist/bin/installer/common.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bin/installer/common.ts"],
-  "sourcesContent": ["import * as fs from 'fs';\nimport * as path from 'path';\nimport { KIROGRAPH_TOOL_NAMES } from '../../mcp/tool-names';\nimport type { InstructionOptions } from './instructions';\nimport type { CavemanMode } from './caveman';\n\n/** Single options object passed to every target's installLate(). */\nexport interface LateInstallOptions {\n  cavemanMode?: CavemanMode | 'off';\n  shellCompressionLevel?: string;\n  enableMemory?: boolean;\n  enableDocs?: boolean;\n  enableData?: boolean;\n  enableSecurity?: boolean;\n  enableArchitecture?: boolean;\n  enablePatterns?: boolean;\n  enableWatchmen?: boolean;\n  watchmenSynthesisMode?: 'local' | 'agent';\n  enableWiki?: boolean;\n  wikiSynthesisMode?: 'local' | 'agent';\n  wikiLocalModel?: string;\n  enableCodeHealth?: boolean;\n  enableNavigation?: boolean;\n  enableComplexity?: boolean;\n  enableGitContext?: boolean;\n  enableEditPrimitives?: boolean;\n  enableBranch?: boolean;\n  enableAgentUtils?: boolean;\n  enableGeneralCompression?: boolean;\n  trackCallSites?: boolean;\n  kiroHookFormat?: 'v1-legacy' | 'v2';\n}\n\nexport type InstallTarget = 'kiro' | 'claude' | 'codex' | 'cursor' | 'antigravity' | 'opencode' | 'windsurf' | 'cline' | 'copilot' | 'copilot-cli' | 'junie' | 'gemini-cli' | 'continue' | 'roo' | 'warp' | 'aider' | 'trae' | 'augment' | 'kilo' | 'amp' | 'devin' | 'replit' | 'goose' | 'openhands' | 'tabnine' | 'mistral-vibe' | 'ibm-bob' | 'crush' | 'droid-factory' | 'forgecode' | 'iflow' | 'qwen' | 'rovo' | 'qoder';\n\nexport const KIROGRAPH_SERVER_NAME = 'kirograph';\nexport const KIROGRAPH_COMMAND = 'kirograph';\nexport const KIROGRAPH_MCP_ARGS = ['serve', '--mcp'];\nexport const KIROGRAPH_SYNC_CMD = 'kirograph sync-if-dirty --quiet 2>/dev/null || true';\nexport const KIROGRAPH_TOOLS = KIROGRAPH_TOOL_NAMES;\nexport const KIROGRAPH_SCOPED_TOOLS = KIROGRAPH_TOOL_NAMES.map(name => `@kirograph/${name}`);\n\nexport function ensureDir(p: string): void {\n  fs.mkdirSync(p, { recursive: true });\n}\n\nexport function readJson(p: string): any {\n  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return {}; }\n}\n\nexport function writeJson(p: string, data: unknown): void {\n  fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\\n');\n}\n\n/**\n * Write MCP server config to a JSON file under the mcpServers key.\n * Returns true if the config was written, false if already configured (idempotent).\n */\nexport function writeMcpServersConfig(configPath: string, serverConfig: object): boolean {\n  ensureDir(path.dirname(configPath));\n  const existing = readJson(configPath);\n  existing.mcpServers = existing.mcpServers ?? {};\n  if (existing.mcpServers[KIROGRAPH_SERVER_NAME]) {\n    return false; // Already configured\n  }\n  existing.mcpServers[KIROGRAPH_SERVER_NAME] = serverConfig;\n  writeJson(configPath, existing);\n  return true;\n}\n\n/**\n * Always write (overwrite) the MCP server config entry, regardless of whether it already exists.\n * Used when the final state is known upfront and idempotency would cause stale data.\n */\nexport function overwriteMcpServersConfig(configPath: string, serverConfig: object): void {\n  ensureDir(path.dirname(configPath));\n  const existing = readJson(configPath);\n  existing.mcpServers = existing.mcpServers ?? {};\n  existing.mcpServers[KIROGRAPH_SERVER_NAME] = serverConfig;\n  writeJson(configPath, existing);\n}\n\nexport function removeMcpServersConfig(configPath: string): boolean {\n  if (!fs.existsSync(configPath)) return false;\n  const existing = readJson(configPath);\n  if (!existing.mcpServers?.[KIROGRAPH_SERVER_NAME]) return false;\n  delete existing.mcpServers[KIROGRAPH_SERVER_NAME];\n  writeJson(configPath, existing);\n  return true;\n}\n\nexport function appendImportLine(filePath: string, line: string, heading: string): boolean {\n  const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';\n  if (existing.includes(line)) return false;\n\n  const prefix = existing.length > 0 && !existing.endsWith('\\n') ? '\\n' : '';\n  const separator = existing.trim().length > 0 ? '\\n' : '';\n  fs.writeFileSync(filePath, existing + prefix + separator + heading + '\\n' + line + '\\n');\n  return true;\n}\n\nexport function removeImportLine(filePath: string, line: string): boolean {\n  if (!fs.existsSync(filePath)) return false;\n  const original = fs.readFileSync(filePath, 'utf8');\n  const next = original\n    .split('\\n')\n    .filter(l => l.trim() !== line)\n    .join('\\n')\n    .replace(/\\n{3,}/g, '\\n\\n');\n  if (next === original) return false;\n  fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n  return true;\n}\n\nexport function upsertGeneratedBlock(filePath: string, blockId: string, heading: string, content: string): boolean {\n  const start = `<!-- kirograph:${blockId}:start -->`;\n  const end = `<!-- kirograph:${blockId}:end -->`;\n  const block = `${start}\\n${heading}\\n\\n${content.trim()}\\n${end}`;\n  const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';\n  const pattern = new RegExp(`${escapeRegExp(start)}[\\\\s\\\\S]*?${escapeRegExp(end)}`);\n\n  if (pattern.test(existing)) {\n    const next = existing.replace(pattern, block);\n    if (next === existing) return false;\n    fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n    return true;\n  }\n\n  const prefix = existing.length > 0 && !existing.endsWith('\\n') ? '\\n' : '';\n  const separator = existing.trim().length > 0 ? '\\n' : '';\n  fs.writeFileSync(filePath, existing + prefix + separator + block + '\\n');\n  return true;\n}\n\nexport function removeGeneratedBlock(filePath: string, blockId: string): boolean {\n  if (!fs.existsSync(filePath)) return false;\n  const start = `<!-- kirograph:${blockId}:start -->`;\n  const end = `<!-- kirograph:${blockId}:end -->`;\n  const original = fs.readFileSync(filePath, 'utf8');\n  const pattern = new RegExp(`\\\\n?${escapeRegExp(start)}[\\\\s\\\\S]*?${escapeRegExp(end)}\\\\n?`);\n  const next = original.replace(pattern, '\\n').replace(/\\n{3,}/g, '\\n\\n');\n  if (next === original) return false;\n  fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n  return true;\n}\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Build InstructionOptions from the installLate parameters.\n * Used by all targets to pass full feature config to buildAgentInstructions.\n */\nexport function buildInstructionOpts(opts: LateInstallOptions, hasHooks?: boolean): InstructionOptions {\n  return {\n    cavemanMode: opts.cavemanMode,\n    shellCompressionLevel: (opts.shellCompressionLevel as InstructionOptions['shellCompressionLevel']) ?? undefined,\n    enableArchitecture: opts.enableArchitecture ?? false,\n    enableMemory: opts.enableMemory ?? false,\n    enableDocs: opts.enableDocs ?? false,\n    enableData: opts.enableData ?? false,\n    enableSecurity: opts.enableSecurity ?? false,\n    enablePatterns: opts.enablePatterns ?? false,\n    enableWiki: opts.enableWiki ?? false,\n    enableCodeHealth: opts.enableCodeHealth ?? false,\n    enableNavigation: opts.enableNavigation ?? false,\n    enableComplexity: opts.enableComplexity ?? false,\n    enableGitContext: opts.enableGitContext ?? false,\n    enableEditPrimitives: opts.enableEditPrimitives ?? false,\n    enableBranch: opts.enableBranch ?? false,\n    enableAgentUtils: opts.enableAgentUtils ?? false,\n    enableGeneralCompression: opts.enableGeneralCompression ?? false,\n    trackCallSites: opts.trackCallSites ?? false,\n    hasHooks: hasHooks ?? false,\n  };\n}\n\nconst violet = '\\x1b[38;5;99m';\nconst resetAnsi = '\\x1b[0m';\nconst dimAnsi = '\\x1b[2m';\nconst boldAnsi = '\\x1b[1m';\n\n/**\n * Print a highlighted MCP config JSON block for targets that need user-scoped setup.\n */\nexport function printMcpSetup(configPath: string, projectRoot: string): void {\n  const escapedPath = projectRoot.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n  console.log(`\\n  ${dimAnsi}Add the MCP server manually:${resetAnsi}`);\n  console.log(`  ${dimAnsi}Edit${resetAnsi} ${violet}${boldAnsi}${configPath}${resetAnsi} ${dimAnsi}and add:${resetAnsi}`);\n  console.log(`  ${violet}{${resetAnsi}`);\n  console.log(`  ${violet}  \"mcpServers\": {${resetAnsi}`);\n  console.log(`  ${violet}    \"kirograph\": {${resetAnsi}`);\n  console.log(`  ${violet}      \"command\": \"kirograph\",${resetAnsi}`);\n  console.log(`  ${violet}      \"args\": [\"serve\", \"--mcp\", \"--path\", \"${escapedPath}\"]${resetAnsi}`);\n  console.log(`  ${violet}    }${resetAnsi}`);\n  console.log(`  ${violet}  }${resetAnsi}`);\n  console.log(`  ${violet}}${resetAnsi}\\n`);\n}\n\n/**\n * Print a highlighted CLI command for MCP registration.\n */\nexport function printMcpCommand(command: string): void {\n  console.log(`\\n  ${dimAnsi}Add the MCP server with:${resetAnsi}`);\n  console.log(`  ${violet}${boldAnsi}${command}${resetAnsi}\\n`);\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAoB;AACpB,WAAsB;AACtB,wBAAqC;AAiC9B,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB,CAAC,SAAS,OAAO;AAC5C,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,yBAAyB,uCAAqB,IAAI,UAAQ,cAAc,IAAI,EAAE;AAEpF,SAAS,UAAU,GAAiB;AACzC,KAAG,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACrC;AAEO,SAAS,SAAS,GAAgB;AACvC,MAAI;AAAE,WAAO,KAAK,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO,CAAC;AAAA,EAAG;AAC5E;AAEO,SAAS,UAAU,GAAW,MAAqB;AACxD,KAAG,cAAc,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,IAAI;AAC1D;AAMO,SAAS,sBAAsB,YAAoB,cAA+B;AACvF,YAAU,KAAK,QAAQ,UAAU,CAAC;AAClC,QAAM,WAAW,SAAS,UAAU;AACpC,WAAS,aAAa,SAAS,cAAc,CAAC;AAC9C,MAAI,SAAS,WAAW,qBAAqB,GAAG;AAC9C,WAAO;AAAA,EACT;AACA,WAAS,WAAW,qBAAqB,IAAI;AAC7C,YAAU,YAAY,QAAQ;AAC9B,SAAO;AACT;AAMO,SAAS,0BAA0B,YAAoB,cAA4B;AACxF,YAAU,KAAK,QAAQ,UAAU,CAAC;AAClC,QAAM,WAAW,SAAS,UAAU;AACpC,WAAS,aAAa,SAAS,cAAc,CAAC;AAC9C,WAAS,WAAW,qBAAqB,IAAI;AAC7C,YAAU,YAAY,QAAQ;AAChC;AAEO,SAAS,uBAAuB,YAA6B;AAClE,MAAI,CAAC,GAAG,WAAW,UAAU,EAAG,QAAO;AACvC,QAAM,WAAW,SAAS,UAAU;AACpC,MAAI,CAAC,SAAS,aAAa,qBAAqB,EAAG,QAAO;AAC1D,SAAO,SAAS,WAAW,qBAAqB;AAChD,YAAU,YAAY,QAAQ;AAC9B,SAAO;AACT;AAEO,SAAS,iBAAiB,UAAkB,MAAc,SAA0B;AACzF,QAAM,WAAW,GAAG,WAAW,QAAQ,IAAI,GAAG,aAAa,UAAU,MAAM,IAAI;AAC/E,MAAI,SAAS,SAAS,IAAI,EAAG,QAAO;AAEpC,QAAM,SAAS,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AACxE,QAAM,YAAY,SAAS,KAAK,EAAE,SAAS,IAAI,OAAO;AACtD,KAAG,cAAc,UAAU,WAAW,SAAS,YAAY,UAAU,OAAO,OAAO,IAAI;AACvF,SAAO;AACT;AAEO,SAAS,iBAAiB,UAAkB,MAAuB;AACxE,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,QAAM,WAAW,GAAG,aAAa,UAAU,MAAM;AACjD,QAAM,OAAO,SACV,MAAM,IAAI,EACV,OAAO,OAAK,EAAE,KAAK,MAAM,IAAI,EAC7B,KAAK,IAAI,EACT,QAAQ,WAAW,MAAM;AAC5B,MAAI,SAAS,SAAU,QAAO;AAC9B,KAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,SAAO;AACT;AAEO,SAAS,qBAAqB,UAAkB,SAAiB,SAAiB,SAA0B;AACjH,QAAM,QAAQ,kBAAkB,OAAO;AACvC,QAAM,MAAM,kBAAkB,OAAO;AACrC,QAAM,QAAQ,GAAG,KAAK;AAAA,EAAK,OAAO;AAAA;AAAA,EAAO,QAAQ,KAAK,CAAC;AAAA,EAAK,GAAG;AAC/D,QAAM,WAAW,GAAG,WAAW,QAAQ,IAAI,GAAG,aAAa,UAAU,MAAM,IAAI;AAC/E,QAAM,UAAU,IAAI,OAAO,GAAG,aAAa,KAAK,CAAC,aAAa,aAAa,GAAG,CAAC,EAAE;AAEjF,MAAI,QAAQ,KAAK,QAAQ,GAAG;AAC1B,UAAM,OAAO,SAAS,QAAQ,SAAS,KAAK;AAC5C,QAAI,SAAS,SAAU,QAAO;AAC9B,OAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AACxE,QAAM,YAAY,SAAS,KAAK,EAAE,SAAS,IAAI,OAAO;AACtD,KAAG,cAAc,UAAU,WAAW,SAAS,YAAY,QAAQ,IAAI;AACvE,SAAO;AACT;AAEO,SAAS,qBAAqB,UAAkB,SAA0B;AAC/E,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,QAAM,QAAQ,kBAAkB,OAAO;AACvC,QAAM,MAAM,kBAAkB,OAAO;AACrC,QAAM,WAAW,GAAG,aAAa,UAAU,MAAM;AACjD,QAAM,UAAU,IAAI,OAAO,OAAO,aAAa,KAAK,CAAC,aAAa,aAAa,GAAG,CAAC,MAAM;AACzF,QAAM,OAAO,SAAS,QAAQ,SAAS,IAAI,EAAE,QAAQ,WAAW,MAAM;AACtE,MAAI,SAAS,SAAU,QAAO;AAC9B,KAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,SAAO;AACT;AAEA,SAAS,aAAa,GAAmB;AACvC,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAMO,SAAS,qBAAqB,MAA0B,UAAwC;AACrG,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,uBAAwB,KAAK,yBAAyE;AAAA,IACtG,oBAAoB,KAAK,sBAAsB;AAAA,IAC/C,cAAc,KAAK,gBAAgB;AAAA,IACnC,YAAY,KAAK,cAAc;AAAA,IAC/B,YAAY,KAAK,cAAc;AAAA,IAC/B,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,YAAY,KAAK,cAAc;AAAA,IAC/B,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,sBAAsB,KAAK,wBAAwB;AAAA,IACnD,cAAc,KAAK,gBAAgB;AAAA,IACnC,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,0BAA0B,KAAK,4BAA4B;AAAA,IAC3D,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,UAAU,YAAY;AAAA,EACxB;AACF;AAEA,MAAM,SAAS;AACf,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,WAAW;AAKV,SAAS,cAAc,YAAoB,aAA2B;AAC3E,QAAM,cAAc,YAAY,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AAC1E,UAAQ,IAAI;AAAA,IAAO,OAAO,+BAA+B,SAAS,EAAE;AACpE,UAAQ,IAAI,KAAK,OAAO,OAAO,SAAS,IAAI,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,IAAI,OAAO,WAAW,SAAS,EAAE;AACvH,UAAQ,IAAI,KAAK,MAAM,IAAI,SAAS,EAAE;AACtC,UAAQ,IAAI,KAAK,MAAM,oBAAoB,SAAS,EAAE;AACtD,UAAQ,IAAI,KAAK,MAAM,qBAAqB,SAAS,EAAE;AACvD,UAAQ,IAAI,KAAK,MAAM,gCAAgC,SAAS,EAAE;AAClE,UAAQ,IAAI,KAAK,MAAM,+CAA+C,WAAW,KAAK,SAAS,EAAE;AACjG,UAAQ,IAAI,KAAK,MAAM,QAAQ,SAAS,EAAE;AAC1C,UAAQ,IAAI,KAAK,MAAM,MAAM,SAAS,EAAE;AACxC,UAAQ,IAAI,KAAK,MAAM,IAAI,SAAS;AAAA,CAAI;AAC1C;AAKO,SAAS,gBAAgB,SAAuB;AACrD,UAAQ,IAAI;AAAA,IAAO,OAAO,2BAA2B,SAAS,EAAE;AAChE,UAAQ,IAAI,KAAK,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS;AAAA,CAAI;AAC9D;",
+  "sourcesContent": ["import * as fs from 'fs';\nimport * as path from 'path';\nimport { KIROGRAPH_TOOL_NAMES } from '../../mcp/tool-names';\nimport type { InstructionOptions } from './instructions';\nimport type { CavemanMode } from './caveman';\n\n/** Single options object passed to every target's installLate(). */\nexport interface LateInstallOptions {\n  cavemanMode?: CavemanMode | 'off';\n  shellCompressionLevel?: string;\n  enableMemory?: boolean;\n  enableDocs?: boolean;\n  enableData?: boolean;\n  enableSecurity?: boolean;\n  enableArchitecture?: boolean;\n  enablePatterns?: boolean;\n  enableWatchmen?: boolean;\n  watchmenSynthesisMode?: 'local' | 'agent';\n  enableWiki?: boolean;\n  wikiSynthesisMode?: 'local' | 'agent';\n  wikiLocalModel?: string;\n  enableCodeHealth?: boolean;\n  enableNavigation?: boolean;\n  enableComplexity?: boolean;\n  enableGitContext?: boolean;\n  enableEditPrimitives?: boolean;\n  enableBranch?: boolean;\n  enableAgentUtils?: boolean;\n  enableGeneralCompression?: boolean;\n  trackCallSites?: boolean;\n  kiroHookFormat?: 'v1-legacy' | 'v2';\n}\n\nexport type InstallTarget = 'kiro' | 'claude' | 'codex' | 'cursor' | 'antigravity' | 'opencode' | 'windsurf' | 'cline' | 'copilot' | 'copilot-cli' | 'junie' | 'gemini-cli' | 'continue' | 'roo' | 'warp' | 'aider' | 'trae' | 'augment' | 'kilo' | 'amp' | 'devin' | 'replit' | 'goose' | 'openhands' | 'tabnine' | 'mistral-vibe' | 'ibm-bob' | 'crush' | 'droid-factory' | 'forgecode' | 'iflow' | 'qwen' | 'rovo' | 'qoder' | 'commandcode';\n\nexport const KIROGRAPH_SERVER_NAME = 'kirograph';\nexport const KIROGRAPH_COMMAND = 'kirograph';\nexport const KIROGRAPH_MCP_ARGS = ['serve', '--mcp'];\n\n/**\n * Wrap a kirograph command so it runs quietly and never fails the host process,\n * emitting shell syntax appropriate for the OS the install is running on.\n *\n * Hook commands are executed by the host agent's shell: POSIX sh/bash on\n * macOS/Linux, cmd.exe on Windows. The two use incompatible syntax for\n * discarding output and swallowing a non-zero exit code:\n *   - POSIX:  `<cmd> >/dev/null 2>&1 || true`\n *   - cmd.exe: `<cmd> >nul 2>&1 || exit /b 0`\n *\n * On Windows `/dev/null` is treated as a literal path and `true` is not a valid\n * command, so the bash form silently breaks hooks (see issue #40).\n *\n * @param baseCommand the kirograph invocation without redirection, e.g. `kirograph sync --quiet`\n */\nexport function silentCommand(baseCommand: string): string {\n  const isWindows = process.platform === 'win32';\n  return isWindows\n    ? `${baseCommand} >nul 2>&1 || exit /b 0`\n    : `${baseCommand} >/dev/null 2>&1 || true`;\n}\n\nexport const KIROGRAPH_SYNC_CMD = silentCommand('kirograph sync-if-dirty --quiet');\nexport const KIROGRAPH_TOOLS = KIROGRAPH_TOOL_NAMES;\nexport const KIROGRAPH_SCOPED_TOOLS = KIROGRAPH_TOOL_NAMES.map(name => `@kirograph/${name}`);\n\nexport function ensureDir(p: string): void {\n  fs.mkdirSync(p, { recursive: true });\n}\n\nexport function readJson(p: string): any {\n  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return {}; }\n}\n\nexport function writeJson(p: string, data: unknown): void {\n  fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\\n');\n}\n\n/**\n * Write MCP server config to a JSON file under the mcpServers key.\n * Returns true if the config was written, false if already configured (idempotent).\n */\nexport function writeMcpServersConfig(configPath: string, serverConfig: object): boolean {\n  ensureDir(path.dirname(configPath));\n  const existing = readJson(configPath);\n  existing.mcpServers = existing.mcpServers ?? {};\n  if (existing.mcpServers[KIROGRAPH_SERVER_NAME]) {\n    return false; // Already configured\n  }\n  existing.mcpServers[KIROGRAPH_SERVER_NAME] = serverConfig;\n  writeJson(configPath, existing);\n  return true;\n}\n\n/**\n * Always write (overwrite) the MCP server config entry, regardless of whether it already exists.\n * Used when the final state is known upfront and idempotency would cause stale data.\n */\nexport function overwriteMcpServersConfig(configPath: string, serverConfig: object): void {\n  ensureDir(path.dirname(configPath));\n  const existing = readJson(configPath);\n  existing.mcpServers = existing.mcpServers ?? {};\n  existing.mcpServers[KIROGRAPH_SERVER_NAME] = serverConfig;\n  writeJson(configPath, existing);\n}\n\nexport function removeMcpServersConfig(configPath: string): boolean {\n  if (!fs.existsSync(configPath)) return false;\n  const existing = readJson(configPath);\n  if (!existing.mcpServers?.[KIROGRAPH_SERVER_NAME]) return false;\n  delete existing.mcpServers[KIROGRAPH_SERVER_NAME];\n  writeJson(configPath, existing);\n  return true;\n}\n\nexport function appendImportLine(filePath: string, line: string, heading: string): boolean {\n  const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';\n  if (existing.includes(line)) return false;\n\n  const prefix = existing.length > 0 && !existing.endsWith('\\n') ? '\\n' : '';\n  const separator = existing.trim().length > 0 ? '\\n' : '';\n  fs.writeFileSync(filePath, existing + prefix + separator + heading + '\\n' + line + '\\n');\n  return true;\n}\n\nexport function removeImportLine(filePath: string, line: string): boolean {\n  if (!fs.existsSync(filePath)) return false;\n  const original = fs.readFileSync(filePath, 'utf8');\n  const next = original\n    .split('\\n')\n    .filter(l => l.trim() !== line)\n    .join('\\n')\n    .replace(/\\n{3,}/g, '\\n\\n');\n  if (next === original) return false;\n  fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n  return true;\n}\n\nexport function upsertGeneratedBlock(filePath: string, blockId: string, heading: string, content: string): boolean {\n  const start = `<!-- kirograph:${blockId}:start -->`;\n  const end = `<!-- kirograph:${blockId}:end -->`;\n  const block = `${start}\\n${heading}\\n\\n${content.trim()}\\n${end}`;\n  const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';\n  const pattern = new RegExp(`${escapeRegExp(start)}[\\\\s\\\\S]*?${escapeRegExp(end)}`);\n\n  if (pattern.test(existing)) {\n    const next = existing.replace(pattern, block);\n    if (next === existing) return false;\n    fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n    return true;\n  }\n\n  const prefix = existing.length > 0 && !existing.endsWith('\\n') ? '\\n' : '';\n  const separator = existing.trim().length > 0 ? '\\n' : '';\n  fs.writeFileSync(filePath, existing + prefix + separator + block + '\\n');\n  return true;\n}\n\nexport function removeGeneratedBlock(filePath: string, blockId: string): boolean {\n  if (!fs.existsSync(filePath)) return false;\n  const start = `<!-- kirograph:${blockId}:start -->`;\n  const end = `<!-- kirograph:${blockId}:end -->`;\n  const original = fs.readFileSync(filePath, 'utf8');\n  const pattern = new RegExp(`\\\\n?${escapeRegExp(start)}[\\\\s\\\\S]*?${escapeRegExp(end)}\\\\n?`);\n  const next = original.replace(pattern, '\\n').replace(/\\n{3,}/g, '\\n\\n');\n  if (next === original) return false;\n  fs.writeFileSync(filePath, next.endsWith('\\n') ? next : next + '\\n');\n  return true;\n}\n\nfunction escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Build InstructionOptions from the installLate parameters.\n * Used by all targets to pass full feature config to buildAgentInstructions.\n */\nexport function buildInstructionOpts(opts: LateInstallOptions, hasHooks?: boolean): InstructionOptions {\n  return {\n    cavemanMode: opts.cavemanMode,\n    shellCompressionLevel: (opts.shellCompressionLevel as InstructionOptions['shellCompressionLevel']) ?? undefined,\n    enableArchitecture: opts.enableArchitecture ?? false,\n    enableMemory: opts.enableMemory ?? false,\n    enableDocs: opts.enableDocs ?? false,\n    enableData: opts.enableData ?? false,\n    enableSecurity: opts.enableSecurity ?? false,\n    enablePatterns: opts.enablePatterns ?? false,\n    enableWiki: opts.enableWiki ?? false,\n    enableCodeHealth: opts.enableCodeHealth ?? false,\n    enableNavigation: opts.enableNavigation ?? false,\n    enableComplexity: opts.enableComplexity ?? false,\n    enableGitContext: opts.enableGitContext ?? false,\n    enableEditPrimitives: opts.enableEditPrimitives ?? false,\n    enableBranch: opts.enableBranch ?? false,\n    enableAgentUtils: opts.enableAgentUtils ?? false,\n    enableGeneralCompression: opts.enableGeneralCompression ?? false,\n    trackCallSites: opts.trackCallSites ?? false,\n    hasHooks: hasHooks ?? false,\n  };\n}\n\nconst violet = '\\x1b[38;5;99m';\nconst resetAnsi = '\\x1b[0m';\nconst dimAnsi = '\\x1b[2m';\nconst boldAnsi = '\\x1b[1m';\n\n/**\n * Print a highlighted MCP config JSON block for targets that need user-scoped setup.\n */\nexport function printMcpSetup(configPath: string, projectRoot: string): void {\n  const escapedPath = projectRoot.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n  console.log(`\\n  ${dimAnsi}Add the MCP server manually:${resetAnsi}`);\n  console.log(`  ${dimAnsi}Edit${resetAnsi} ${violet}${boldAnsi}${configPath}${resetAnsi} ${dimAnsi}and add:${resetAnsi}`);\n  console.log(`  ${violet}{${resetAnsi}`);\n  console.log(`  ${violet}  \"mcpServers\": {${resetAnsi}`);\n  console.log(`  ${violet}    \"kirograph\": {${resetAnsi}`);\n  console.log(`  ${violet}      \"command\": \"kirograph\",${resetAnsi}`);\n  console.log(`  ${violet}      \"args\": [\"serve\", \"--mcp\", \"--path\", \"${escapedPath}\"]${resetAnsi}`);\n  console.log(`  ${violet}    }${resetAnsi}`);\n  console.log(`  ${violet}  }${resetAnsi}`);\n  console.log(`  ${violet}}${resetAnsi}\\n`);\n}\n\n/**\n * Print a highlighted CLI command for MCP registration.\n */\nexport function printMcpCommand(command: string): void {\n  console.log(`\\n  ${dimAnsi}Add the MCP server with:${resetAnsi}`);\n  console.log(`  ${violet}${boldAnsi}${command}${resetAnsi}\\n`);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAoB;AACpB,WAAsB;AACtB,wBAAqC;AAiC9B,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB,CAAC,SAAS,OAAO;AAiB5C,SAAS,cAAc,aAA6B;AACzD,QAAM,YAAY,QAAQ,aAAa;AACvC,SAAO,YACH,GAAG,WAAW,4BACd,GAAG,WAAW;AACpB;AAEO,MAAM,qBAAqB,cAAc,iCAAiC;AAC1E,MAAM,kBAAkB;AACxB,MAAM,yBAAyB,uCAAqB,IAAI,UAAQ,cAAc,IAAI,EAAE;AAEpF,SAAS,UAAU,GAAiB;AACzC,KAAG,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACrC;AAEO,SAAS,SAAS,GAAgB;AACvC,MAAI;AAAE,WAAO,KAAK,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO,CAAC;AAAA,EAAG;AAC5E;AAEO,SAAS,UAAU,GAAW,MAAqB;AACxD,KAAG,cAAc,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,IAAI;AAC1D;AAMO,SAAS,sBAAsB,YAAoB,cAA+B;AACvF,YAAU,KAAK,QAAQ,UAAU,CAAC;AAClC,QAAM,WAAW,SAAS,UAAU;AACpC,WAAS,aAAa,SAAS,cAAc,CAAC;AAC9C,MAAI,SAAS,WAAW,qBAAqB,GAAG;AAC9C,WAAO;AAAA,EACT;AACA,WAAS,WAAW,qBAAqB,IAAI;AAC7C,YAAU,YAAY,QAAQ;AAC9B,SAAO;AACT;AAMO,SAAS,0BAA0B,YAAoB,cAA4B;AACxF,YAAU,KAAK,QAAQ,UAAU,CAAC;AAClC,QAAM,WAAW,SAAS,UAAU;AACpC,WAAS,aAAa,SAAS,cAAc,CAAC;AAC9C,WAAS,WAAW,qBAAqB,IAAI;AAC7C,YAAU,YAAY,QAAQ;AAChC;AAEO,SAAS,uBAAuB,YAA6B;AAClE,MAAI,CAAC,GAAG,WAAW,UAAU,EAAG,QAAO;AACvC,QAAM,WAAW,SAAS,UAAU;AACpC,MAAI,CAAC,SAAS,aAAa,qBAAqB,EAAG,QAAO;AAC1D,SAAO,SAAS,WAAW,qBAAqB;AAChD,YAAU,YAAY,QAAQ;AAC9B,SAAO;AACT;AAEO,SAAS,iBAAiB,UAAkB,MAAc,SAA0B;AACzF,QAAM,WAAW,GAAG,WAAW,QAAQ,IAAI,GAAG,aAAa,UAAU,MAAM,IAAI;AAC/E,MAAI,SAAS,SAAS,IAAI,EAAG,QAAO;AAEpC,QAAM,SAAS,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AACxE,QAAM,YAAY,SAAS,KAAK,EAAE,SAAS,IAAI,OAAO;AACtD,KAAG,cAAc,UAAU,WAAW,SAAS,YAAY,UAAU,OAAO,OAAO,IAAI;AACvF,SAAO;AACT;AAEO,SAAS,iBAAiB,UAAkB,MAAuB;AACxE,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,QAAM,WAAW,GAAG,aAAa,UAAU,MAAM;AACjD,QAAM,OAAO,SACV,MAAM,IAAI,EACV,OAAO,OAAK,EAAE,KAAK,MAAM,IAAI,EAC7B,KAAK,IAAI,EACT,QAAQ,WAAW,MAAM;AAC5B,MAAI,SAAS,SAAU,QAAO;AAC9B,KAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,SAAO;AACT;AAEO,SAAS,qBAAqB,UAAkB,SAAiB,SAAiB,SAA0B;AACjH,QAAM,QAAQ,kBAAkB,OAAO;AACvC,QAAM,MAAM,kBAAkB,OAAO;AACrC,QAAM,QAAQ,GAAG,KAAK;AAAA,EAAK,OAAO;AAAA;AAAA,EAAO,QAAQ,KAAK,CAAC;AAAA,EAAK,GAAG;AAC/D,QAAM,WAAW,GAAG,WAAW,QAAQ,IAAI,GAAG,aAAa,UAAU,MAAM,IAAI;AAC/E,QAAM,UAAU,IAAI,OAAO,GAAG,aAAa,KAAK,CAAC,aAAa,aAAa,GAAG,CAAC,EAAE;AAEjF,MAAI,QAAQ,KAAK,QAAQ,GAAG;AAC1B,UAAM,OAAO,SAAS,QAAQ,SAAS,KAAK;AAC5C,QAAI,SAAS,SAAU,QAAO;AAC9B,OAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AACxE,QAAM,YAAY,SAAS,KAAK,EAAE,SAAS,IAAI,OAAO;AACtD,KAAG,cAAc,UAAU,WAAW,SAAS,YAAY,QAAQ,IAAI;AACvE,SAAO;AACT;AAEO,SAAS,qBAAqB,UAAkB,SAA0B;AAC/E,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,QAAM,QAAQ,kBAAkB,OAAO;AACvC,QAAM,MAAM,kBAAkB,OAAO;AACrC,QAAM,WAAW,GAAG,aAAa,UAAU,MAAM;AACjD,QAAM,UAAU,IAAI,OAAO,OAAO,aAAa,KAAK,CAAC,aAAa,aAAa,GAAG,CAAC,MAAM;AACzF,QAAM,OAAO,SAAS,QAAQ,SAAS,IAAI,EAAE,QAAQ,WAAW,MAAM;AACtE,MAAI,SAAS,SAAU,QAAO;AAC9B,KAAG,cAAc,UAAU,KAAK,SAAS,IAAI,IAAI,OAAO,OAAO,IAAI;AACnE,SAAO;AACT;AAEA,SAAS,aAAa,GAAmB;AACvC,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAMO,SAAS,qBAAqB,MAA0B,UAAwC;AACrG,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,uBAAwB,KAAK,yBAAyE;AAAA,IACtG,oBAAoB,KAAK,sBAAsB;AAAA,IAC/C,cAAc,KAAK,gBAAgB;AAAA,IACnC,YAAY,KAAK,cAAc;AAAA,IAC/B,YAAY,KAAK,cAAc;AAAA,IAC/B,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,YAAY,KAAK,cAAc;AAAA,IAC/B,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,sBAAsB,KAAK,wBAAwB;AAAA,IACnD,cAAc,KAAK,gBAAgB;AAAA,IACnC,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,0BAA0B,KAAK,4BAA4B;AAAA,IAC3D,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,UAAU,YAAY;AAAA,EACxB;AACF;AAEA,MAAM,SAAS;AACf,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,WAAW;AAKV,SAAS,cAAc,YAAoB,aAA2B;AAC3E,QAAM,cAAc,YAAY,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AAC1E,UAAQ,IAAI;AAAA,IAAO,OAAO,+BAA+B,SAAS,EAAE;AACpE,UAAQ,IAAI,KAAK,OAAO,OAAO,SAAS,IAAI,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,IAAI,OAAO,WAAW,SAAS,EAAE;AACvH,UAAQ,IAAI,KAAK,MAAM,IAAI,SAAS,EAAE;AACtC,UAAQ,IAAI,KAAK,MAAM,oBAAoB,SAAS,EAAE;AACtD,UAAQ,IAAI,KAAK,MAAM,qBAAqB,SAAS,EAAE;AACvD,UAAQ,IAAI,KAAK,MAAM,gCAAgC,SAAS,EAAE;AAClE,UAAQ,IAAI,KAAK,MAAM,+CAA+C,WAAW,KAAK,SAAS,EAAE;AACjG,UAAQ,IAAI,KAAK,MAAM,QAAQ,SAAS,EAAE;AAC1C,UAAQ,IAAI,KAAK,MAAM,MAAM,SAAS,EAAE;AACxC,UAAQ,IAAI,KAAK,MAAM,IAAI,SAAS;AAAA,CAAI;AAC1C;AAKO,SAAS,gBAAgB,SAAuB;AACrD,UAAQ,IAAI;AAAA,IAAO,OAAO,2BAA2B,SAAS,EAAE;AAChE,UAAQ,IAAI,KAAK,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS;AAAA,CAAI;AAC9D;",
   "names": []
 }

package/dist/bin/installer/config-prompt.js

@@ -84,6 +84,115 @@ const PRESET_MODELS = [
     description: "Enter a custom HuggingFace model ID and embedding dimension"
   }
 ];
+async function promptEmbeddings(rl) {
+  (0, import_prompts.printSection)("\u{1F50D}", "Semantic Search");
+  const enableEmbeddings = await (0, import_prompts.askToggle)(
+    rl,
+    "Semantic embeddings (similarity search):",
+    "Enables natural-language code search via vector embeddings. A local model (~130MB) is downloaded on first use."
+  );
+  const patch = {
+    enableEmbeddings,
+    semanticEngine: "cosine",
+    useVecIndex: false,
+    turboquantMemDocs: false,
+    turboquantBits: 3,
+    turbovecMemDocs: false,
+    turbovecBits: 4,
+    typesenseDashboard: false,
+    qdrantDashboard: false
+  };
+  if (!enableEmbeddings) {
+    return patch;
+  }
+  const modelChoice = await (0, import_prompts.arrowSelect)(
+    rl,
+    "Embedding model:",
+    PRESET_MODELS.map((m) => ({ value: m.value, label: m.label, description: m.description }))
+  );
+  let embeddingModel;
+  let embeddingDim;
+  if (modelChoice === "__other__") {
+    console.log(`
+  ${import_prompts.dim}Enter a HuggingFace model ID in the format org/model-name.${import_prompts.reset}`);
+    while (true) {
+      const raw = (await (0, import_prompts.ask)(rl, `  ${import_prompts.violet}Model identifier:${import_prompts.reset} `)).trim();
+      if (raw.includes("/")) {
+        embeddingModel = raw;
+        break;
+      }
+      console.log(`  Expected a HuggingFace model ID in the format org/model-name (e.g. nomic-ai/nomic-embed-text-v1.5).`);
+    }
+    console.log(`
+  ${import_prompts.dim}Enter the embedding output dimension for this model (check the model card on HuggingFace).${import_prompts.reset}`);
+    while (true) {
+      const raw = (await (0, import_prompts.ask)(rl, `  ${import_prompts.violet}Embedding dimension (e.g. 768, 384):${import_prompts.reset} `)).trim();
+      const n = parseInt(raw, 10);
+      if (!isNaN(n) && n > 0) {
+        embeddingDim = n;
+        break;
+      }
+      console.log(`  Expected a positive integer (e.g. 768, 384, 1536).`);
+    }
+  } else {
+    const preset = PRESET_MODELS.find((m) => m.value === modelChoice);
+    embeddingModel = preset.value;
+    embeddingDim = preset.dim;
+  }
+  patch.embeddingModel = embeddingModel;
+  patch.embeddingDim = embeddingDim;
+  const semanticEngine = await (0, import_prompts.arrowSelect)(rl, "Vector search engine:", [
+    { value: "cosine", label: "cosine", description: "In-process cosine similarity. No extra deps. Best for small/medium projects." },
+    { value: "turboquant", label: "turboquant", description: "ANN index, zero native deps. Compresses embeddings 20\u201330\xD7 (Google TurboQuant). ANN without native binaries \u2014 ideal for CI, ARM, restricted envs. Optional: npm install turboquant-js." },
+    { value: "turbovec", label: "turbovec", description: "ANN search via Rust/SIMD (napi-rs). Same TurboQuant algorithm but NEON on ARM and AVX-512BW on x86 \u2014 faster than turboquant-js at the cost of a one-time Rust build. Requires Rust toolchain. Build: cd native/turbovec-node && npm install && npm run build." },
+    { value: "sqlite-vec", label: "sqlite-vec", description: "ANN index. Sub-linear search. Best for large codebases. Needs: better-sqlite3, sqlite-vec (native)." },
+    { value: "orama", label: "orama", description: "Hybrid search (full-text + vector). Pure JS. Needs: @orama/orama, @orama/plugin-data-persistence." },
+    { value: "pglite", label: "pglite", description: "Hybrid search via PostgreSQL + pgvector. Exact results. Pure WASM. Needs: @electric-sql/pglite." },
+    { value: "lancedb", label: "lancedb", description: "ANN search via LanceDB (Apache Lance columnar format). Pure JS. Needs: @lancedb/lancedb." },
+    { value: "qdrant", label: "qdrant", description: "ANN search via Qdrant embedded binary (HNSW index, Cosine). Needs: qdrant-local." },
+    { value: "typesense", label: "typesense", description: "ANN search via Typesense (auto-downloaded binary, HNSW, Cosine). Needs: typesense." }
+  ]);
+  patch.semanticEngine = semanticEngine;
+  patch.useVecIndex = semanticEngine === "sqlite-vec";
+  if (semanticEngine === "turboquant") {
+    patch.turboquantMemDocs = await (0, import_prompts.askToggle)(
+      rl,
+      "TurboQuant for memory & docs search (optional):",
+      "Replaces the default linear cosine scan in memory observations and doc sections with a compressed ANN index \u2014 no native deps required. Most useful when you accumulate many observations or large doc sets (1 000+ entries).",
+      false
+    );
+  }
+  if (semanticEngine === "turbovec") {
+    patch.turbovecBits = await (0, import_prompts.arrowSelect)(rl, "TurboVec bits per coordinate:", [
+      { value: 4, label: "4 bits (recommended)", description: "Best quality, ~19\xD7 compression vs raw Float32. Default." },
+      { value: 3, label: "3 bits", description: "Balanced \u2014 ~25\xD7 compression, slight quality drop." },
+      { value: 2, label: "2 bits", description: "Highest compression (~38\xD7), lowest accuracy." }
+    ]);
+    patch.turbovecMemDocs = await (0, import_prompts.askToggle)(
+      rl,
+      "TurboVec for memory & docs search (optional):",
+      "Replaces the default linear cosine scan in memory observations and doc sections with the TurboVec ANN index. Requires the addon to be built.",
+      false
+    );
+  }
+  if (semanticEngine === "typesense") {
+    patch.typesenseDashboard = await (0, import_prompts.askToggle)(
+      rl,
+      "Typesense dashboard:",
+      "Serves the Typesense Dashboard locally and opens it in your browser after indexing completes.",
+      false
+    );
+  }
+  if (semanticEngine === "qdrant") {
+    patch.qdrantDashboard = await (0, import_prompts.askToggle)(
+      rl,
+      "Qdrant dashboard:",
+      "Downloads the Qdrant Web UI (first time only) and opens it in your browser after indexing completes.",
+      false
+    );
+  }
+  return patch;
+}
 async function promptConfigOptions(rl, opts = {}) {
   const installMode = await (0, import_prompts.arrowSelect)(rl, "Installation mode:", [
     { value: "core", label: "Core only", description: "3 always-on tools (search, context, node) \u2014 ~170 tok. Zero config." },
@@ -130,14 +239,14 @@ async function promptConfigOptions(rl, opts = {}) {
     enableGeneralCompression: false
   };
   if (installMode === "core") {
-    return { patch: basePatch, hooksToImport: null };
+    const embeddingPatch2 = await promptEmbeddings(rl);
+    return { patch: { ...basePatch, ...embeddingPatch2 }, hooksToImport: null };
   }
   if (installMode === "full") {
+    const embeddingPatch2 = await promptEmbeddings(rl);
     const fullPatch = {
       ...basePatch,
-      enableEmbeddings: true,
-      embeddingModel: DEFAULT_EMBEDDING_MODEL,
-      embeddingDim: 768,
+      ...embeddingPatch2,
       extractDocstrings: true,
       trackCallSites: true,
       enableArchitecture: true,
@@ -168,104 +277,12 @@ async function promptConfigOptions(rl, opts = {}) {
       description: p.description
     })));
     const profile = PROFILES[profileKey];
-    const patch2 = { ...basePatch, ...profile.patch };
+    const embeddingPatch2 = await promptEmbeddings(rl);
+    const patch2 = { ...basePatch, ...profile.patch, ...embeddingPatch2 };
     return { patch: patch2, hooksToImport: null };
   }
-  (0, import_prompts.printSection)("\u{1F50D}", "Semantic Search");
-  const enableEmbeddings = await (0, import_prompts.askToggle)(
-    rl,
-    "Semantic embeddings (similarity search):",
-    "Enables natural-language code search via vector embeddings. A local model (~130MB) is downloaded on first use."
-  );
-  const patch = { ...basePatch, enableEmbeddings };
-  if (enableEmbeddings) {
-    const modelChoice = await (0, import_prompts.arrowSelect)(
-      rl,
-      "Embedding model:",
-      PRESET_MODELS.map((m) => ({ value: m.value, label: m.label, description: m.description }))
-    );
-    let embeddingModel;
-    let embeddingDim;
-    if (modelChoice === "__other__") {
-      console.log(`
-  ${import_prompts.dim}Enter a HuggingFace model ID in the format org/model-name.${import_prompts.reset}`);
-      while (true) {
-        const raw = (await (0, import_prompts.ask)(rl, `  ${import_prompts.violet}Model identifier:${import_prompts.reset} `)).trim();
-        if (raw.includes("/")) {
-          embeddingModel = raw;
-          break;
-        }
-        console.log(`  Expected a HuggingFace model ID in the format org/model-name (e.g. nomic-ai/nomic-embed-text-v1.5).`);
-      }
-      console.log(`
-  ${import_prompts.dim}Enter the embedding output dimension for this model (check the model card on HuggingFace).${import_prompts.reset}`);
-      while (true) {
-        const raw = (await (0, import_prompts.ask)(rl, `  ${import_prompts.violet}Embedding dimension (e.g. 768, 384):${import_prompts.reset} `)).trim();
-        const n = parseInt(raw, 10);
-        if (!isNaN(n) && n > 0) {
-          embeddingDim = n;
-          break;
-        }
-        console.log(`  Expected a positive integer (e.g. 768, 384, 1536).`);
-      }
-    } else {
-      const preset = PRESET_MODELS.find((m) => m.value === modelChoice);
-      embeddingModel = preset.value;
-      embeddingDim = preset.dim;
-    }
-    patch.embeddingModel = embeddingModel;
-    patch.embeddingDim = embeddingDim;
-    const semanticEngine = await (0, import_prompts.arrowSelect)(rl, "Vector search engine:", [
-      { value: "cosine", label: "cosine", description: "In-process cosine similarity. No extra deps. Best for small/medium projects." },
-      { value: "turboquant", label: "turboquant", description: "ANN index, zero native deps. Compresses embeddings 20\u201330\xD7 (Google TurboQuant). ANN without native binaries \u2014 ideal for CI, ARM, restricted envs. Optional: npm install turboquant-js." },
-      { value: "turbovec", label: "turbovec", description: "ANN search via Rust/SIMD (napi-rs). Same TurboQuant algorithm but NEON on ARM and AVX-512BW on x86 \u2014 faster than turboquant-js at the cost of a one-time Rust build. Requires Rust toolchain. Build: cd native/turbovec-node && npm install && npm run build." },
-      { value: "sqlite-vec", label: "sqlite-vec", description: "ANN index. Sub-linear search. Best for large codebases. Needs: better-sqlite3, sqlite-vec (native)." },
-      { value: "orama", label: "orama", description: "Hybrid search (full-text + vector). Pure JS. Needs: @orama/orama, @orama/plugin-data-persistence." },
-      { value: "pglite", label: "pglite", description: "Hybrid search via PostgreSQL + pgvector. Exact results. Pure WASM. Needs: @electric-sql/pglite." },
-      { value: "lancedb", label: "lancedb", description: "ANN search via LanceDB (Apache Lance columnar format). Pure JS. Needs: @lancedb/lancedb." },
-      { value: "qdrant", label: "qdrant", description: "ANN search via Qdrant embedded binary (HNSW index, Cosine). Needs: qdrant-local." },
-      { value: "typesense", label: "typesense", description: "ANN search via Typesense (auto-downloaded binary, HNSW, Cosine). Needs: typesense." }
-    ]);
-    patch.semanticEngine = semanticEngine;
-    patch.useVecIndex = semanticEngine === "sqlite-vec";
-    if (semanticEngine === "turboquant") {
-      patch.turboquantMemDocs = await (0, import_prompts.askToggle)(
-        rl,
-        "TurboQuant for memory & docs search (optional):",
-        "Replaces the default linear cosine scan in memory observations and doc sections with a compressed ANN index \u2014 no native deps required. Most useful when you accumulate many observations or large doc sets (1 000+ entries).",
-        false
-      );
-    }
-    if (semanticEngine === "turbovec") {
-      patch.turbovecBits = await (0, import_prompts.arrowSelect)(rl, "TurboVec bits per coordinate:", [
-        { value: 4, label: "4 bits (recommended)", description: "Best quality, ~19\xD7 compression vs raw Float32. Default." },
-        { value: 3, label: "3 bits", description: "Balanced \u2014 ~25\xD7 compression, slight quality drop." },
-        { value: 2, label: "2 bits", description: "Highest compression (~38\xD7), lowest accuracy." }
-      ]);
-      patch.turbovecMemDocs = await (0, import_prompts.askToggle)(
-        rl,
-        "TurboVec for memory & docs search (optional):",
-        "Replaces the default linear cosine scan in memory observations and doc sections with the TurboVec ANN index. Requires the addon to be built.",
-        false
-      );
-    }
-    if (semanticEngine === "typesense") {
-      patch.typesenseDashboard = await (0, import_prompts.askToggle)(
-        rl,
-        "Typesense dashboard:",
-        "Serves the Typesense Dashboard locally and opens it in your browser after indexing completes.",
-        false
-      );
-    }
-    if (semanticEngine === "qdrant") {
-      patch.qdrantDashboard = await (0, import_prompts.askToggle)(
-        rl,
-        "Qdrant dashboard:",
-        "Downloads the Qdrant Web UI (first time only) and opens it in your browser after indexing completes.",
-        false
-      );
-    }
-  }
+  const embeddingPatch = await promptEmbeddings(rl);
+  const patch = { ...basePatch, ...embeddingPatch };
   (0, import_prompts.printSection)("\u{1F4CA}", "Graph Features");
   patch.extractDocstrings = await (0, import_prompts.askToggle)(
     rl,