Skip to main content
Commands

vg code

VG Code — propose a minimal, graph-grounded code edit for a plain-language instruction, routed to a local or hosted model you choose. Dry-run by default; never writes without your consent.

Overview

vg code "<instruction>" is VG Code: it proposes a minimal code edit for an instruction in plain language, grounded in Vibgrate's deterministic code map and routed to a model you choose — local or hosted. It is a capability of the Vibgrate CLI, not a separate product.

vg code is dry-run by default: it prints the proposed diff and writes nothing. Writing is opt-in and always consented — there is no quick-apply back-door.

Quick Start: build the map once with vg build, then run vg code "add a --timeout flag to the scan command" to see the proposed diff.


Usage

vg code [instruction...] [options]

Run vg code with no instruction for guided interactive mode (needs a terminal). Pass an instruction to run non-interactively.


Grounded in the code map

vg code reads the deterministic code graph built by vg build, so the model sees the real symbols, files, and relationships in your project rather than guessing from a filename. Build the map first; vg code uses it to keep the edit surface small and the diff minimal.


Bring your own model — no surprise egress or install

No model is bundled, and nothing is installed by default. vg code picks a backend only from signals already present:

  • a configured hosted key (for example OPENROUTER_API_KEY), or
  • a model you have already pulled locally (Ollama, LM Studio, Foundry Local), or
  • a Code Mode pack from vg models install (Spark / Flow / Forge).

Prefer --mode spark|flow|forge over a raw model name when you use Code Modes; omit both --mode and --model to auto-fit from live memory and repo signals.

It never dials a cloud endpoint you didn't configure. Under --local only on-device backends are eligible — if none are available it fails with an actionable message rather than reaching the network. The only path that installs a package, --provider llama-cpp, does so once, on first use, and only with --yes.

--providerBackend
ollamaLocal Ollama server
lmstudioLocal LM Studio server
foundry-localMicrosoft Foundry Local (OpenAI-compatible; default http://127.0.0.1:5272/v1, override with FOUNDRY_LOCAL_BASE_URL)
llama-cppOn-device gguf (needs --model-path; installs once with --yes)
openrouterHosted router (the reference best-in-breed)
litellm · openai · togetherOther hosted, OpenAI-compatible backends

Set the model with --model or VG_CODE_MODEL; no model id is hard-coded, so pick the current best for your backend.


Dry-run, then apply with consent

# Propose only — prints the diff, writes nothing (the default)
vg code "rename getUser to fetchUser across the api package"

# Restrict the edit surface to specific files (repeatable)
vg code "add input validation" -f src/routes/users.ts

# Write the change — still needs --yes or an interactive y/N confirm
vg code "add a --timeout flag to the scan command" --apply --yes

An --apply without consent degrades to a dry-run — it is never destructive by default. Every write walks the same inspect → assess → approve → execute → verify → log lifecycle the rest of the platform enforces.


The agent, and one-shot mode

With a real model, vg code runs a multi-step agent (tool calling) that approves each edit and command as it goes. It needs a terminal to approve interactively, or --auto to run autonomously:

# Autonomous: auto-approve every edit and command (use with care)
vg code "migrate the config loader to zod" --auto --max-steps 30

# One-shot planner: a single proposed edit instead of the agent
vg code "fix the off-by-one in paginate()" --single

# After the agent finishes, run tests and make it fix failures
vg code "upgrade the express routes to v5" --auto --verify

--verify [command] runs your project's test command (from .vibgrate/code.json, or the command you pass) after the agent finishes and feeds failures back for a fix. --continue resumes the most recent session.


External tools (MCP)

vg code adopts the ecosystem-standard MCP config files — .mcp.json, .cursor/mcp.json, .vscode/mcp.json — and merges them with servers in your own config (yours wins on a name conflict). The agent may call those external tools, approval-gated like any other action.


Tool results are compressed

Inside the agent loop there is no wire to sit on, so vg code applies context compression itself: a bulky run_command, search_code or web_fetch result is compressed once on the way into the transcript instead of being re-billed on every later step. Reads an edit is computed from, and failed results, are never touched. The original stays in the local retrievable store and the model gets a vg_retrieve tool, so it can pull back the whole result or just the lines it needs. Tokens are counted in the routed model's tokenizer; the run reports what it saved and vg savings counts it under the vg-code client. Set VG_CODE_COMPRESS=0 to turn it off.


Configure once: .vibgrate/code.json

Set your model and preferences once so you can just run vg code. Flags win over the file; the file wins over the built-in defaults. A missing or malformed file is simply "no config", never an error.

{
  "provider": "openrouter",
  "model": "anthropic/claude-sonnet-5",
  "testCommand": "npm test",
  "maxSteps": 24,
  "denyCommands": ["rm -rf", "git push"],
  "mcpServers": {}
}

Host UIs: --stream-json

--stream-json is a machine protocol for host UIs such as the VS Code panel: NDJSON agent events on stdout, approval decisions read as JSON lines on stdin. Governance is preserved — the host answers the same approval gate a human would.


Options

FlagDescription
--provider <id>Backend: ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp
--model <id>Model id (or set VG_CODE_MODEL)
--mode <mode>Code Mode: spark | flow | forge (preferred over raw model names; auto-fits when omitted and no --model)
--model-path <gguf>gguf path for --provider llama-cpp (weights are never auto-downloaded)
-f, --file <path>Restrict the edit surface to this file (repeatable)
-b, --budget <n>Approx context token budget (default 3000)
--applyWrite the change (still requires --yes or an interactive confirm)
--yesConsent to write / to a first-use package install, non-interactively
--autoAutonomous agent: auto-approve every edit and command
--max-steps <n>Cap the number of agent steps (default 24)
--singleOne-shot planner (single edit) instead of the multi-step agent
--verify [command]After the agent finishes, run tests and fix failures
--continueResume the most recent session
--capsuleSource-bearing Context Capsule for first context (Fusion)
--no-capsuleDisable the Context Capsule even if enabled in .vibgrate/code.json
--security-tier <tier>Shell isolation: L0 (host), L1 (Seatbelt/bubblewrap when available); L2/L3 reserved
--mock <file>Scripted reply from a file instead of a model (offline; tests/CI)
--streamStream the model output live
--stream-jsonMachine protocol (NDJSON) for host UIs
--localOn-device backends only (no network)
-o, --out <file>Write the JSON result to a file (for CI/benchmarks)

Exit codes

CodeMeaning
0Success (dry-run, or an applied change that verified)
1Agent or operational error
2--apply was asked for but the change did not apply or failed to verify

Related

  • VG Code — what the capability does across the CLI and Vibgrate for VS Code
  • vg build — build the code map vg code is grounded in
  • vg models — Code Modes and local model backends vg code can route to
  • vg ask — ask questions about the same code map
  • vg fix — ranked, risk-tiered dependency upgrade plans
No live demo for this command

vg code drives a model backend (local or hosted) and edits your working tree through an interactive approval loop, so there is nothing fixed to replay. The commands and output shape above are the real format.

Related Documentation

Related Help Articles

Vibgrate CLI

See a real scan run

A replay of the actual CLI running against our test repositories — live progress, real findings, a genuine DriftScore. Nothing executes in your browser.

Replay
demo@vibgrate — bash
npx @vibgrate/cli scan
 
╭──────────────────────────────────────────╮
Vibgrate Drift Report
╰──────────────────────────────────────────╯
 
── node-turborepo (node) .
Runtime: >=18.0.0 (6 majors behind)
Frameworks:
Turbo: 1.13.4 → 2.10.12 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
1 current 1 1-behind 3 2+ behind 1 unknown
 
── @repo/admin (node) apps/admin
Frameworks:
TanStack Query: 5.102.8 → 5.102.8 (current)
React: 18.3.1 → 19.3.0 (1 behind)
React DOM: 18.3.1 → 19.3.0 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vite: 5.4.21 → 8.3.0 (3 behind)
Dependencies:
3 current 9 1-behind 3 2+ behind 4 unknown
 
── @repo/api (node) apps/api
Frameworks:
Express: 4.22.2 → 5.2.1 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vitest: 1.6.1 → 5.0.0 (4 behind)
Dependencies:
7 current 5 1-behind 3 2+ behind 4 unknown
 
── @repo/web (node) apps/web
Frameworks:
Next.js: 14.2.35 → 16.3.4 (2 behind)
React: 18.3.1 → 19.3.0 (1 behind)
React DOM: 18.3.1 → 19.3.0 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
2 current 6 1-behind 3 2+ behind 5 unknown
 
── @repo/config (node) packages/config
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
2 current 2 1-behind 5 2+ behind 0 unknown
 
── @repo/database (node) packages/database
Frameworks:
Prisma: 5.22.0 → 7.10.0 (2 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
1 current 0 1-behind 3 2+ behind 1 unknown
 
── @repo/types (node) packages/types
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Dependencies:
0 current 0 1-behind 1 2+ behind 1 unknown
 
── @repo/ui (node) packages/ui
Frameworks:
React: 18.3.1 → 19.3.0 (1 behind)
TypeScript: 5.9.3 → 7.0.2 (2 behind)
React: 18.3.1 → 19.3.0 (1 behind)
Dependencies:
1 current 4 1-behind 1 2+ behind 1 unknown
 
── @repo/utils (node) packages/utils
Frameworks:
TypeScript: 5.9.3 → 7.0.2 (2 behind)
Vitest: 1.6.1 → 5.0.0 (4 behind)
Dependencies:
0 current 1 1-behind 2 2+ behind 1 unknown
 
Tech Stack
Frontend: React, React DOM
Meta-frameworks: Next.js
Bundlers: tsx, Turbo, Vite
CSS / UI: Autoprefixer, PostCSS, Tailwind CSS
Backend: Express
ORM / Database: Prisma, Prisma Client
Testing: Vitest
Lint & Format: ESLint, ESLint Prettier, ESLint React, Prettier, typescript-eslint
 
TypeScript
v5.3.3 · strict ✔ · MIXED · target: ES2022
 
Build & Deploy
Package Managers: pnpm
Monorepo: npm-workspaces, pnpm-workspaces, turbo
 
Product Purpose Signals
Frameworks: react, nextjs
Evidence: 177
Top Signals:
- [heading] Dashboard (apps/admin/src/pages/Dashboard.tsx)
- [title] Revenue Overview (apps/admin/src/pages/Dashboard.tsx)
- [copy] workspace:* (packages/ui/package.json)
- [copy] ./dist (packages/ui/tsconfig.json)
- [copy] ./src/index.ts (packages/ui/package.json)
- [copy] @repo/config/tsconfig-base.json (packages/ui/tsconfig.json)
- [copy] @repo/ui (packages/ui/package.json)
- [copy] #3b82f6 (apps/admin/src/pages/Dashboard.tsx)
Unknowns:
- No pricing or billing evidence found.
- No integrations/connectors evidence found.
- No route structure evidence found.
 
Security Posture
Lockfile ✖ · .env ✔ · node_modules ✔
 
Platform
Native modules: turbo
 
Code Quality
Files: 36 · Functions: 183 · Avg complexity: 2.62 · Avg length: 21.13 lines
Max nesting: 2 · Circular deps: 0 · Dead code: 0%
God files: apps/admin/src/pages/Products (448 lines)
 
Database Schema
postgresql · 8 models · 1 enum
Models: Address, CartItem, Category, Order, OrderItem (+3 more)
 
Findings (16 errors, 11 warnings)
Node.js runtime ">=18.0.0" reached end-of-life on 2025-04-30 (latest: 24.0.0).
vibgrate/runtime-eol in .
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in .
60% of dependencies are 2+ major versions behind in node-turborepo.
vibgrate/dependency-rot in .
@types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.5.1).
vibgrate/dependency-major-lag in .
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/admin
Vite is 3 major versions behind (current: 5.4.21, latest: 8.3.0).
vibgrate/framework-major-lag in apps/admin
vite is 3 major versions behind (spec: ^5.0.12, latest: 8.3.0).
vibgrate/dependency-major-lag in apps/admin
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/api
Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.0).
vibgrate/framework-major-lag in apps/api
@types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.5.1).
vibgrate/dependency-major-lag in apps/api
vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.0).
vibgrate/dependency-major-lag in apps/api
Next.js is 2 major versions behind (current: 14.2.35, latest: 16.3.4).
vibgrate/framework-major-lag in apps/web
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in apps/web
@types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.5.1).
vibgrate/dependency-major-lag in apps/web
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/config
56% of dependencies are 2+ major versions behind in @repo/config.
vibgrate/dependency-rot in packages/config
eslint-plugin-react-hooks is 3 major versions behind (spec: ^4.6.0, latest: 7.1.1).
vibgrate/dependency-major-lag in packages/config
Prisma is 2 major versions behind (current: 5.22.0, latest: 7.10.0).
vibgrate/framework-major-lag in packages/database
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/database
75% of dependencies are 2+ major versions behind in @repo/database.
vibgrate/dependency-rot in packages/database
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/types
100% of dependencies are 2+ major versions behind in @repo/types.
vibgrate/dependency-rot in packages/types
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/ui
TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).
vibgrate/framework-major-lag in packages/utils
Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.0).
vibgrate/framework-major-lag in packages/utils
67% of dependencies are 2+ major versions behind in @repo/utils.
vibgrate/dependency-rot in packages/utils
vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.0).
vibgrate/dependency-major-lag in packages/utils
 
╭──────────────────────────────────────────╮
Top Priority Actions
╰──────────────────────────────────────────╯
 
1. Upgrade EOL runtime in node-turborepo
End-of-life runtimes no longer receive security patches and block ecosystem upgrades.
./.
>=18.0.0 → 24.0.0 (6 majors behind)
Impact: −10 drift points (runtime & EOL)
 
2. Fix security posture: no lockfile found
Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.
./
Missing: package-lock.json, pnpm-lock.yaml, or yarn.lock
 
3. Upgrade Vitest 1.6.1 → 5.0.0 in @repo/api (+2 more)
4 major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.
./apps/api
Vitest: 1.6.1 → 5.0.0 (4 majors behind)
./packages/utils
Vitest: 1.6.1 → 5.0.0 (4 majors behind)
./apps/admin
Vite: 5.4.21 → 8.3.0 (3 majors behind)
Impact: −5–15 drift points
 
4. Reduce dependency rot in @repo/types (100% severely outdated)
1 of 1 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.
./packages/types
typescript: 5.9.3 → 7.0.2 (2 majors behind)
Impact: −5–10 drift points
 
5. Reduce dependency rot in @repo/database (75% severely outdated)
3 of 4 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.
./packages/database
@prisma/client: 5.22.0 → 7.10.0 (2 majors behind)
prisma: 5.22.0 → 7.10.0 (2 majors behind)
typescript: 5.9.3 → 7.0.2 (2 majors behind)
Impact: −5–10 drift points
 
╭──────────────────────────────────────────╮
Architecture Layers
╰──────────────────────────────────────────╯
 
Archetype: nextjs (80% confidence)
Files classified: 24 (11 unclassified)
Folders classified: 8
apps/admin/src presentation 100% 4 files
apps/admin/src/pages presentation 100% 2 files
apps/api/src/middleware middleware 100% 2 files
apps/api/src/routes routing 100% 2 files
apps/web/src/app presentation 100% 4 files
apps/web/src/app/products presentation 100% 2 files
apps/web/src/app/products/[id] presentation 100% 1 file
packages/ui/src presentation 100% 6 files
Unclassified source (sample): 11
 
presentation 15 files drift ████████████████████ 100 risk high
routing 4 files drift ████████████████████ 100 risk high
middleware 2 files drift ███████▍░░░░░░░░░░░░ 37 risk moderate
config 2 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none
shared 1 file drift ████████████████████ 100 risk high
 
╭──────────────────────────────────────────╮
DriftScore Summary
╰──────────────────────────────────────────╯
 
DriftScore: 70/100
Risk Level: HIGH
Projects: 9
Classified: 8 nano · 1 micro · 0 small · 0 standard
Billable: 0.42 · 9 detected → 0.42 billable projects (micro-project pricing)
0.1 micro · 0.32 nano
These fractions add up across repositories, then round down to whole billable projects.
 
Score Breakdown
Runtime: ████████████████████ 100
Frameworks: ███████████▊░░░░░░░░ 59
Dependencies: ██████▌░░░░░░░░░░░░░ 33
EOL Risk: ████████████████████ 100
 
Scanned at 2026-09-11T17:01:34.639Z · 7.9s · 286 files scanned · 56 workspace files · 27 dirs
Press Run to start.