CLIv2026.725.1July 25, 2026
CLI 2026.725.1
This release of the CLI ships 21 new changes, 3 improved changes, 4 changed changes, 1 fixed change and 1 security change.
New
- -- Failure Capsules focus repair after a failed verify step.
- -- vg daemon ensure starts the local Fusion Runtime daemon in the background when needed.
- -- vgd answers query-graph, impact-of, and graph-summary against warm ActiveGraph slots (vg daemon query).
- -- vg daemon publish loads the workspace code map into the Fusion Runtime.
- -- VG Code can inspect the blast radius of a proposed change before applying it (inspect_change), abort cleanly, and refresh Task Capsule context with compact deltas after edits.
- `vg code` agents can apply multi-file PatchIR edits via the new `apply_patch` tool.
- `vg code` can use a source-bearing Task Capsule for the first model context (`--capsule`, or `"capsule": true` in `.vibgrate/code.json`).
- Code Modes (Spark / Flow / Forge): `vg models` now resolves a qualified pack that fits your machine, with `status`, `mode`, `resolve`, `ensure`, `pin` / `unpin`, and `packs`.
- Fusion Runtime continues: multi-root workspaces via `.vibgrate/federation.json` and `vg daemon federation`, plus a security-ladder execution environment (L0 host / L1 with real Seatbelt or bubblewrap isolation when available).
- Started Fusion Runtime Phase 0: source-bearing Task Capsule compiler, PatchIR schema and bridge from existing search/replace edits, and global XDG / Application Support path helpers so generated graph state can leave the repository.
- Federation discovery now also records conservative bridge edges from OpenAPI `$ref` paths, Docker Compose build contexts, and protobuf imports between workspace members so cross-service impact can follow API and service layout.
- The code map is branch-aware: global store paths key snapshots by git branch (or detached HEAD), multiple in-memory graphs stay warm per repository with LILO idle-timeout eviction, and interactive `vg code` re-resolves HEAD before each task so a mid-session checkout switches to t
- `apply_patch` now asks for one atomic multi-file approval (every path and diff together) instead of one prompt per file, and `vg models --json` includes system RAM/VRAM, loaded models, and per-model quant/size estimates for host UIs.
- Agent shell commands under `--auto` now follow a default-deny network policy (`network-policy@2026.07.0`), refuse credential-shaped content on the command line, and can resolve security tier L3 when Firecracker plus guest images are configured via `VIBGRATE_FIRECRACKER_*` (otherw
- Fusion Runtime v0 completion: signed context-policy patch proposals (never auto-applied from a single task), gVisor L2 when configured, GraphQL schema import bridges, and verification-step hashes on every agent run provenance record and audit line.
- Post–Fusion v0: a curated Model Execution Profile catalogue for common coding models, high-confidence federation bridges injected as Task Capsule pinned facts, and `vg policy` / `vg policy verify` to inspect the production pin and check signed context-policy patches before any re
- Project-context ingest for `vg ask`: package manifests, Docker/Compose, CI workflows, tsconfig/bundler configs, OpenAPI/GraphQL/protobuf contracts, Makefiles, and workspace files become secret-scrubbed `document` nodes and are embedded alongside code so agents can answer run/buil
- Every `vg code` run now records a `run-provenance/0` summary: pinned `context-policy@2026.07.0`, ranking version, model profile, security tier, graph corpus hash, and blake3 content hashes for each mutation so changes are auditable and reproducible offline.
- Fusion Runtime Phase 5: `vg code --capsule` sessions buffer edits in a session overlay, recompute a session code graph so search/impact see uncommitted edits, and run a graph-derived verification ladder (syntax + optional tests) on finish.
- Added a lightweight local daemon prototype (`vg daemon`) for the Fusion Runtime: a Unix-socket (named-pipe on Windows) control plane with a workspace registry.
- `vg code` now auto-discovers monorepo package workspaces (npm/pnpm workspaces, git submodules, VS Code multi-root workspace files) when no federation file is present, and records conservative package-dependency bridge edges between members so cross-package impact stays grounded.
Improved
- -- VG Code search and impact tools use the Fusion Runtime daemon graph when available, with automatic fall back to the local map.
- -- Interactive VG Code refreshes the code map for uncommitted git changes before each task, and capsule-first runs limit early navigation so the model prefers Task Capsule evidence.
- Graph ingest now extracts object-literal methods (e.g.
Changed
- Interactive `vg code` now attaches to the local Fusion Runtime daemon (`vgd`) instead of spawning a separate `vg serve` process.
- Public CLI docs and website help now cover every shipped `vg` command, including `doctor`, `lsp`, `daemon`, `policy`, Code Modes on `vg models`, and the full `vg install` assistant matrix.
- The code map is stored in the global application data directory by default (Application Support / XDG), not under `.vibgrate/` inside the repository.
- The "Keep tracking your DriftScore" panel now shows the lower per-project pricing (rounded down to whole dollars) and advertises the new-customer offer — 25% off your first year — alongside the regular monthly Team and Business estimate for the scanned repo.
Fixed
- `vg serve` now repaints its live status in place in narrow terminals instead of adding a stale status line on every refresh.
Security
- -- L1 shell isolation is enforced: macOS uses Seatbelt (sandbox-exec) and Linux uses bubblewrap when available, scoped to project roots.
Vibgrate CLI
See a real scan run
A replay of the actual CLI running against our test repositories — live progress, real findings, a genuine DriftScore. Nothing executes in your browser.
Replay
❯ npx @vibgrate/cli scan
╭──────────────────────────────────────────╮
│ Vibgrate Drift Report │
╰──────────────────────────────────────────╯
── node-turborepo (node) .
Runtime: >=18.0.0 (6 majors behind)
Frameworks:
Turbo: 1.13.4 → 2.10.8 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
1 current 1 1-behind 3 2+ behind 1 unknown
── @repo/admin (node) apps/admin
Frameworks:
TanStack Query: 5.101.4 → 5.101.4 (current)
React: 18.3.1 → 19.2.8 (1 behind)
React DOM: 18.3.1 → 19.2.8 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vite: 5.4.21 → 8.2.0 (3 behind)
Dependencies:
4 current 8 1-behind 3 2+ behind 4 unknown
── @repo/api (node) apps/api
Frameworks:
Express: 4.22.2 → 5.2.1 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vitest: 1.6.1 → 4.1.10 (3 behind)
Dependencies:
7 current 5 1-behind 3 2+ behind 4 unknown
── @repo/web (node) apps/web
Frameworks:
Next.js: 14.2.35 → 16.2.12 (2 behind)
React: 18.3.1 → 19.2.8 (1 behind)
React DOM: 18.3.1 → 19.2.8 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
2 current 6 1-behind 3 2+ behind 5 unknown
── @repo/config (node) packages/config
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
2 current 2 1-behind 5 2+ behind 0 unknown
── @repo/database (node) packages/database
Frameworks:
Prisma: 5.22.0 → 7.9.1 (2 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
1 current 0 1-behind 3 2+ behind 1 unknown
── @repo/types (node) packages/types
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
0 current 0 1-behind 1 2+ behind 1 unknown
── @repo/ui (node) packages/ui
Frameworks:
React: 18.3.1 → 19.2.8 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
React: 18.3.1 → 19.2.8 (1 behind)
Dependencies:
1 current 4 1-behind 1 2+ behind 1 unknown
── @repo/utils (node) packages/utils
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vitest: 1.6.1 → 4.1.10 (3 behind)
Dependencies:
0 current 1 1-behind 2 2+ behind 1 unknown
Tech Stack
Frontend: React, React DOM
Meta-frameworks: Next.js
Bundlers: tsx, Turbo, Vite
CSS / UI: Autoprefixer, PostCSS, Tailwind CSS
Backend: Express
ORM / Database: Prisma, Prisma Client
Testing: Vitest
Lint & Format: ESLint, ESLint Prettier, ESLint React, Prettier, typescript-eslint
Services & Integrations
Auth: JWT 9.0.3
Databases: Prisma 5.22.0
TypeScript
v5.3.3 · strict ✔ · MIXED · target: ES2022
Build & Deploy
Package Managers: pnpm
Monorepo: npm-workspaces, pnpm-workspaces, turbo
Product Purpose Signals
Frameworks: react, nextjs
Evidence: 177
Top Signals:
- [heading] Dashboard (apps/admin/src/pages/Dashboard.tsx)
- [title] Revenue Overview (apps/admin/src/pages/Dashboard.tsx)
- [copy] workspace:* (packages/ui/package.json)
- [copy] ./dist (packages/ui/tsconfig.json)
- [copy] ./src/index.ts (packages/ui/package.json)
- [copy] @repo/config/tsconfig-base.json (packages/ui/tsconfig.json)
- [copy] @repo/ui (packages/ui/package.json)
- [copy] #3b82f6 (apps/admin/src/pages/Dashboard.tsx)
Unknowns:
- No pricing or billing evidence found.
- No integrations/connectors evidence found.
- No route structure evidence found.
Security Posture
Lockfile ✖ · .env ✔ · node_modules ✔
Platform
Native modules: turbo
Code Quality
Files: 36 · Functions: 183 · Avg complexity: 2.62 · Avg length: 21.13 lines
Max nesting: 2 · Circular deps: 0 · Dead code: 0%
God files: apps/admin/src/pages/Products (448 lines)
Database Schema
postgresql · 8 models · 1 enum
Models: Address, CartItem, Category, Order, OrderItem (+3 more)
Findings (16 errors, 11 warnings)
✖ Node.js runtime ">=18.0.0" reached end-of-life on 2025-04-30 (latest: 24.0.0).
vibgrate/runtime-eol in .
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in .
✖ 60% of dependencies are 2+ major versions behind in node-turborepo.
vibgrate/dependency-rot in .
✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.2).
vibgrate/dependency-major-lag in .
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/admin
✖ Vite is 3 major versions behind (current: 5.4.21, latest: 8.2.0).
vibgrate/framework-major-lag in apps/admin
✖ vite is 3 major versions behind (spec: ^5.0.12, latest: 8.2.0).
vibgrate/dependency-major-lag in apps/admin
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/api
✖ Vitest is 3 major versions behind (current: 1.6.1, latest: 4.1.10).
vibgrate/framework-major-lag in apps/api
✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.2).
vibgrate/dependency-major-lag in apps/api
✖ vitest is 3 major versions behind (spec: ^1.2.1, latest: 4.1.10).
vibgrate/dependency-major-lag in apps/api
⚠ Next.js is 2 major versions behind (current: 14.2.35, latest: 16.2.12).
vibgrate/framework-major-lag in apps/web
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/web
✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.1.2).
vibgrate/dependency-major-lag in apps/web
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/config
✖ 56% of dependencies are 2+ major versions behind in @repo/config.
vibgrate/dependency-rot in packages/config
✖ eslint-plugin-react-hooks is 3 major versions behind (spec: ^4.6.0, latest: 7.1.1).
vibgrate/dependency-major-lag in packages/config
⚠ Prisma is 2 major versions behind (current: 5.22.0, latest: 7.9.1).
vibgrate/framework-major-lag in packages/database
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/database
✖ 75% of dependencies are 2+ major versions behind in @repo/database.
vibgrate/dependency-rot in packages/database
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/types
✖ 100% of dependencies are 2+ major versions behind in @repo/types.
vibgrate/dependency-rot in packages/types
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/ui
⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/utils
✖ Vitest is 3 major versions behind (current: 1.6.1, latest: 4.1.10).
vibgrate/framework-major-lag in packages/utils
✖ 67% of dependencies are 2+ major versions behind in @repo/utils.
vibgrate/dependency-rot in packages/utils
✖ vitest is 3 major versions behind (spec: ^1.2.1, latest: 4.1.10).
vibgrate/dependency-major-lag in packages/utils
╭──────────────────────────────────────────╮
│ Top Priority Actions │
╰──────────────────────────────────────────╯
1. Upgrade EOL runtime in node-turborepo
End-of-life runtimes no longer receive security patches and block ecosystem upgrades.
./.
>=18.0.0 → 24.0.0 (6 majors behind)
Impact: −10 drift points (runtime & EOL)
2. Fix security posture: no lockfile found
Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.
./
Missing: package-lock.json, pnpm-lock.yaml, or yarn.lock
3. Upgrade Vite 5.4.21 → 8.2.0 in @repo/admin (+2 more)
3 major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.
./apps/admin
Vite: 5.4.21 → 8.2.0 (3 majors behind)
./apps/api
Vitest: 1.6.1 → 4.1.10 (3 majors behind)
./packages/utils
Vitest: 1.6.1 → 4.1.10 (3 majors behind)
Impact: −5–15 drift points
4. Reduce dependency rot in @repo/types (100% severely outdated)
1 of 1 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.
./packages/types
typescript: 5.9.3 → 7.0.2 (2 majors behind)
Impact: −5–10 drift points
5. Reduce dependency rot in @repo/database (75% severely outdated)
3 of 4 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.
./packages/database
@prisma/client: 5.22.0 → 7.9.1 (2 majors behind)
prisma: 5.22.0 → 7.9.1 (2 majors behind)
typescript: 5.9.3 → 7.0.2 (2 majors behind)
Impact: −5–10 drift points
╭──────────────────────────────────────────╮
│ Architecture Layers │
╰──────────────────────────────────────────╯
Archetype: monorepo (80% confidence)
Files classified: 29 (6 unclassified)
presentation 9 files drift ████████████████████ 100 risk high
routing 4 files drift ████████████████████ 100 risk high
middleware 2 files drift ███████▍░░░░░░░░░░░░ 37 risk moderate
domain 4 files drift ████████████████████ 100 risk high
data-access 2 files drift ████████████████████ 100 risk high
infrastructure 0 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none
config 3 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none
shared 5 files drift ████████████████████ 100 risk high
testing 0 files drift ████████████████████ 100 risk high
╭──────────────────────────────────────────╮
│ DriftScore Summary │
╰──────────────────────────────────────────╯
DriftScore: 66/100
Risk Level: HIGH
Projects: 9
Classified: 8 nano · 1 micro · 0 small · 0 standard
Billable: 0.42 · 9 detected → 0.42 billable projects (micro-project pricing)
0.1 micro · 0.32 nano
These fractions add up across repositories, then round down to whole billable projects.
Score Breakdown
Runtime: ████████████████████ 100
Frameworks: █████████▏░░░░░░░░░░ 46
Dependencies: ██████░░░░░░░░░░░░░░ 30
EOL Risk: ████████████████████ 100
Scanned at 2026-08-03T16:30:52.736Z · 19.2s · 286 files scanned · 56 workspace files · 27 dirs
Press Run to start.