@oculum/cli 1.0.1 → 1.0.3

package/dist/index.js

@@ -14406,6 +14406,44 @@ var require_layer1 = __commonJS({
     var weak_crypto_1 = require_weak_crypto();
     var tiers_1 = require_tiers();
     var path_exclusions_1 = require_path_exclusions();
+    function processFileLayer1(file) {
+      const stats = {
+        known_secrets: 0,
+        weak_crypto: 0,
+        sensitive_urls: 0,
+        entropy: 0,
+        config_audit: 0,
+        file_flags: 0,
+        ai_comments: 0
+      };
+      const entropyFindings = (0, entropy_1.detectHighEntropyStrings)(file.content, file.path);
+      const patternFindings = (0, patterns_1.detectKnownPatterns)(file.content, file.path);
+      const configFindings = (0, config_audit_1.auditConfiguration)(file.content, file.path);
+      const fileFlags = (0, file_flags_1.detectDangerousFiles)(file.content, file.path);
+      const commentFindings = (0, comments_1.detectAICommentPatterns)(file.content, file.path);
+      const urlFindings = (0, urls_1.detectSensitiveURLs)(file.content, file.path);
+      const cryptoFindings = (0, weak_crypto_1.detectWeakCrypto)(file.content, file.path);
+      stats.entropy = entropyFindings.length;
+      stats.known_secrets = patternFindings.length;
+      stats.config_audit = configFindings.length;
+      stats.file_flags = fileFlags.length;
+      stats.ai_comments = commentFindings.length;
+      stats.sensitive_urls = urlFindings.length;
+      stats.weak_crypto = cryptoFindings.length;
+      return {
+        findings: [
+          ...entropyFindings,
+          ...patternFindings,
+          ...configFindings,
+          ...fileFlags,
+          ...commentFindings,
+          ...urlFindings,
+          ...cryptoFindings
+        ],
+        stats
+      };
+    }
+    var LAYER1_PARALLEL_BATCH_SIZE = 50;
     async function runLayer1Scan(files) {
       const startTime = Date.now();
       const vulnerabilities = [];
@@ -14418,50 +14456,24 @@ var require_layer1 = __commonJS({
         file_flags: 0,
         ai_comments: 0
       };
-      for (const file of files) {
-        const entropyFindings = (0, entropy_1.detectHighEntropyStrings)(file.content, file.path);
-        const patternFindings = (0, patterns_1.detectKnownPatterns)(file.content, file.path);
-        const configFindings = (0, config_audit_1.auditConfiguration)(file.content, file.path);
-        const fileFlags = (0, file_flags_1.detectDangerousFiles)(file.content, file.path);
-        const commentFindings = (0, comments_1.detectAICommentPatterns)(file.content, file.path);
-        const urlFindings = (0, urls_1.detectSensitiveURLs)(file.content, file.path);
-        const cryptoFindings = (0, weak_crypto_1.detectWeakCrypto)(file.content, file.path);
-        rawStats.entropy += entropyFindings.length;
-        rawStats.known_secrets += patternFindings.length;
-        rawStats.config_audit += configFindings.length;
-        rawStats.file_flags += fileFlags.length;
-        rawStats.ai_comments += commentFindings.length;
-        rawStats.sensitive_urls += urlFindings.length;
-        rawStats.weak_crypto += cryptoFindings.length;
-        vulnerabilities.push(...entropyFindings, ...patternFindings, ...configFindings, ...fileFlags, ...commentFindings, ...urlFindings, ...cryptoFindings);
+      for (let i = 0; i < files.length; i += LAYER1_PARALLEL_BATCH_SIZE) {
+        const batch = files.slice(i, i + LAYER1_PARALLEL_BATCH_SIZE);
+        const results = await Promise.all(batch.map((file) => Promise.resolve(processFileLayer1(file))));
+        for (const result of results) {
+          vulnerabilities.push(...result.findings);
+          for (const [key, value] of Object.entries(result.stats)) {
+            rawStats[key] += value;
+          }
+        }
       }
       const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
       const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities);
-      if (suppressed.length > 0) {
-        const byReason = {};
-        for (const s of suppressed) {
-          const reason = s.reason || "unknown";
-          byReason[reason] = (byReason[reason] || 0) + 1;
-        }
-        console.log(`[Layer 1] Suppressed ${suppressed.length} findings in test/seed/example files:`);
-        for (const [reason, count] of Object.entries(byReason)) {
-          console.log(`  - ${reason}: ${count}`);
-        }
-      }
       const dedupedStats = {};
       for (const vuln of uniqueVulnerabilities) {
         const cat = vuln.category;
         dedupedStats[cat] = (dedupedStats[cat] || 0) + 1;
       }
       const tierStats = (0, tiers_1.computeTierStats)(uniqueVulnerabilities.map((v2) => ({ category: v2.category, layer: 1 })));
-      console.log("[Layer 1] Heuristic breakdown (raw findings before dedupe):");
-      for (const [name, count] of Object.entries(rawStats)) {
-        if (count > 0) {
-          const tier = (0, tiers_1.getLayer1DetectorTier)(name);
-          console.log(`  - ${name}: ${count} (${tier})`);
-        }
-      }
-      console.log(`[Layer 1] Tier breakdown (after dedupe): ${(0, tiers_1.formatTierStats)(tierStats)}`);
       return {
         vulnerabilities: uniqueVulnerabilities,
         filesScanned: files.length,
@@ -17678,7 +17690,7 @@ var require_ai_fingerprinting = __commonJS({
         return vulnerabilities;
       }
       const anyUsageByContext = categorizeAnyUsage(lines, filePath);
-      const priorityAny = anyUsageByContext.filter((usage) => usage.context === "api_boundary" || usage.context === "database_layer" || usage.context === "auth_handler");
+      const priorityAny = anyUsageByContext.filter((usage2) => usage2.context === "api_boundary" || usage2.context === "database_layer" || usage2.context === "auth_handler");
       const cappedAny = priorityAny.slice(0, 5);
       if (cappedAny.length === 0) {
         return vulnerabilities;
@@ -17708,21 +17720,21 @@ var require_ai_fingerprinting = __commonJS({
           layer: 2
         });
       } else {
-        for (const usage of cappedAny) {
+        for (const usage2 of cappedAny) {
           const contextNames = {
             "api_boundary": "API request/response handler",
             "database_layer": "Database query",
             "auth_handler": "Authentication logic"
           };
           vulnerabilities.push({
-            id: `ai-fingerprint-any-${filePath}-${usage.lineNumber}`,
+            id: `ai-fingerprint-any-${filePath}-${usage2.lineNumber}`,
             filePath,
-            lineNumber: usage.lineNumber,
-            lineContent: usage.lineContent,
+            lineNumber: usage2.lineNumber,
+            lineContent: usage2.lineContent,
             severity: "low",
             category: "ai_pattern",
-            title: `[AI Pattern] TypeScript 'any' in ${contextNames[usage.context] || usage.context}`,
-            description: `Using 'any' type at a security boundary bypasses type checking and can lead to type confusion vulnerabilities. This is especially risky in ${contextNames[usage.context] || usage.context}.`,
+            title: `[AI Pattern] TypeScript 'any' in ${contextNames[usage2.context] || usage2.context}`,
+            description: `Using 'any' type at a security boundary bypasses type checking and can lead to type confusion vulnerabilities. This is especially risky in ${contextNames[usage2.context] || usage2.context}.`,
             suggestedFix: 'Replace "any" with an explicit type. Use typed request schemas, ORM models, or interface definitions.',
             confidence: "medium",
             layer: 2
@@ -20677,6 +20689,85 @@ var require_layer2 = __commonJS({
     var ai_endpoint_protection_1 = require_ai_endpoint_protection();
     var ai_schema_validation_1 = require_ai_schema_validation();
     var tiers_1 = require_tiers();
+    function processFileLayer2(file, options, authHelperContext) {
+      const stats = {
+        variables: 0,
+        logicGates: 0,
+        dangerousFunctions: 0,
+        riskyImports: 0,
+        authAntipatterns: 0,
+        frameworkIssues: 0,
+        aiFingerprints: 0,
+        dataExposure: 0,
+        byokPatterns: 0,
+        promptHygiene: 0,
+        executionSinks: 0,
+        agentTools: 0,
+        ragSafety: 0,
+        endpointProtection: 0,
+        schemaValidation: 0
+      };
+      if (!isCodeFile(file.path)) {
+        return { findings: [], stats };
+      }
+      const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path);
+      const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path);
+      const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path);
+      const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path);
+      const authFindings = (0, auth_antipatterns_1.detectAuthAntipatterns)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig,
+        authHelpers: authHelperContext,
+        fileAuthImports: options.fileAuthImports
+      });
+      const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path);
+      const aiFindings = (0, ai_fingerprinting_1.detectAIFingerprints)(file.content, file.path);
+      const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path);
+      const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig);
+      const promptHygieneFindings = (0, ai_prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path);
+      const executionSinkFindings = (0, ai_execution_sinks_1.detectAIExecutionSinks)(file.content, file.path);
+      const agentToolFindings = (0, ai_agent_tools_1.detectAIAgentTools)(file.content, file.path);
+      const ragSafetyFindings = (0, ai_rag_safety_1.detectRAGSafetyIssues)(file.content, file.path);
+      const endpointProtectionFindings = (0, ai_endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig
+      });
+      const schemaValidationFindings = (0, ai_schema_validation_1.detectAISchemaValidation)(file.content, file.path);
+      stats.variables = variableFindings.length;
+      stats.logicGates = logicFindings.length;
+      stats.dangerousFunctions = dangerousFuncFindings.length;
+      stats.riskyImports = riskyImportFindings.length;
+      stats.authAntipatterns = authFindings.length;
+      stats.frameworkIssues = frameworkFindings.length;
+      stats.aiFingerprints = aiFindings.length;
+      stats.dataExposure = dataExposureFindings.length;
+      stats.byokPatterns = byokFindings.length;
+      stats.promptHygiene = promptHygieneFindings.length;
+      stats.executionSinks = executionSinkFindings.length;
+      stats.agentTools = agentToolFindings.length;
+      stats.ragSafety = ragSafetyFindings.length;
+      stats.endpointProtection = endpointProtectionFindings.length;
+      stats.schemaValidation = schemaValidationFindings.length;
+      return {
+        findings: [
+          ...variableFindings,
+          ...logicFindings,
+          ...dangerousFuncFindings,
+          ...riskyImportFindings,
+          ...authFindings,
+          ...frameworkFindings,
+          ...aiFindings,
+          ...dataExposureFindings,
+          ...byokFindings,
+          ...promptHygieneFindings,
+          ...executionSinkFindings,
+          ...agentToolFindings,
+          ...ragSafetyFindings,
+          ...endpointProtectionFindings,
+          ...schemaValidationFindings
+        ],
+        stats
+      };
+    }
+    var LAYER2_PARALLEL_BATCH_SIZE = 50;
     async function runLayer2Scan(files, options = {}) {
       const startTime = Date.now();
       const vulnerabilities = [];
@@ -20693,51 +20784,19 @@ var require_layer2 = __commonJS({
         promptHygiene: 0,
         executionSinks: 0,
         agentTools: 0,
-        // M5: New AI-era detectors
         ragSafety: 0,
         endpointProtection: 0,
         schemaValidation: 0
       };
       const authHelperContext = options.authHelperContext || (0, auth_helper_detector_1.detectAuthHelpers)(files);
-      for (const file of files) {
-        if (isCodeFile(file.path)) {
-          const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path);
-          const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path);
-          const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path);
-          const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path);
-          const authFindings = (0, auth_antipatterns_1.detectAuthAntipatterns)(file.content, file.path, {
-            middlewareConfig: options.middlewareConfig,
-            authHelpers: authHelperContext,
-            fileAuthImports: options.fileAuthImports
-          });
-          const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path);
-          const aiFindings = (0, ai_fingerprinting_1.detectAIFingerprints)(file.content, file.path);
-          const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path);
-          const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig);
-          const promptHygieneFindings = (0, ai_prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path);
-          const executionSinkFindings = (0, ai_execution_sinks_1.detectAIExecutionSinks)(file.content, file.path);
-          const agentToolFindings = (0, ai_agent_tools_1.detectAIAgentTools)(file.content, file.path);
-          const ragSafetyFindings = (0, ai_rag_safety_1.detectRAGSafetyIssues)(file.content, file.path);
-          const endpointProtectionFindings = (0, ai_endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
-            middlewareConfig: options.middlewareConfig
-          });
-          const schemaValidationFindings = (0, ai_schema_validation_1.detectAISchemaValidation)(file.content, file.path);
-          stats.variables += variableFindings.length;
-          stats.logicGates += logicFindings.length;
-          stats.dangerousFunctions += dangerousFuncFindings.length;
-          stats.riskyImports += riskyImportFindings.length;
-          stats.authAntipatterns += authFindings.length;
-          stats.frameworkIssues += frameworkFindings.length;
-          stats.aiFingerprints += aiFindings.length;
-          stats.dataExposure += dataExposureFindings.length;
-          stats.byokPatterns += byokFindings.length;
-          stats.promptHygiene += promptHygieneFindings.length;
-          stats.executionSinks += executionSinkFindings.length;
-          stats.agentTools += agentToolFindings.length;
-          stats.ragSafety += ragSafetyFindings.length;
-          stats.endpointProtection += endpointProtectionFindings.length;
-          stats.schemaValidation += schemaValidationFindings.length;
-          vulnerabilities.push(...variableFindings, ...logicFindings, ...dangerousFuncFindings, ...riskyImportFindings, ...authFindings, ...frameworkFindings, ...aiFindings, ...dataExposureFindings, ...byokFindings, ...promptHygieneFindings, ...executionSinkFindings, ...agentToolFindings, ...ragSafetyFindings, ...endpointProtectionFindings, ...schemaValidationFindings);
+      for (let i = 0; i < files.length; i += LAYER2_PARALLEL_BATCH_SIZE) {
+        const batch = files.slice(i, i + LAYER2_PARALLEL_BATCH_SIZE);
+        const results = await Promise.all(batch.map((file) => Promise.resolve(processFileLayer2(file, options, authHelperContext))));
+        for (const result of results) {
+          vulnerabilities.push(...result.findings);
+          for (const [key, value] of Object.entries(result.stats)) {
+            stats[key] += value;
+          }
         }
       }
       const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
@@ -20757,16 +20816,6 @@ var require_layer2 = __commonJS({
         ];
       }
       const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities, Object.keys(exclusionConfig).length > 0 ? exclusionConfig : void 0);
-      if (suppressed.length > 0) {
-        console.log(`[Layer 2] Suppressed ${suppressed.length} findings in test/seed/example files:`);
-        const byReason = /* @__PURE__ */ new Map();
-        for (const { reason } of suppressed) {
-          byReason.set(reason || "unknown", (byReason.get(reason || "unknown") || 0) + 1);
-        }
-        for (const [reason, count] of byReason) {
-          console.log(`  - ${reason}: ${count}`);
-        }
-      }
       const rawStats = {
         sensitive_variables: stats.variables,
         logic_gates: stats.logicGates,
@@ -20813,15 +20862,6 @@ var require_layer2 = __commonJS({
         ai_endpoint_protection: "ai_endpoint_protection",
         ai_schema_validation: "ai_schema_validation"
       };
-      console.log("[Layer 2] Heuristic breakdown (raw findings before dedupe):");
-      for (const [name, count] of Object.entries(rawStats)) {
-        if (count > 0) {
-          const detectorName = detectorNameMap[name];
-          const tier = detectorName ? (0, tiers_1.getLayer2DetectorTier)(detectorName) : "unknown";
-          console.log(`  - ${name}: ${count} (${tier})`);
-        }
-      }
-      console.log(`[Layer 2] Tier breakdown (after dedupe): ${(0, tiers_1.formatTierStats)(tierStats)}`);
       return {
         vulnerabilities: uniqueVulnerabilities,
         filesScanned: files.filter((f) => isCodeFile(f.path)).length,
@@ -29411,11 +29451,11 @@ var require_AbstractChatCompletionRunner = __commonJS({
         prompt_tokens: 0,
         total_tokens: 0
       };
-      for (const { usage } of this._chatCompletions) {
-        if (usage) {
-          total.completion_tokens += usage.completion_tokens;
-          total.prompt_tokens += usage.prompt_tokens;
-          total.total_tokens += usage.total_tokens;
+      for (const { usage: usage2 } of this._chatCompletions) {
+        if (usage2) {
+          total.completion_tokens += usage2.completion_tokens;
+          total.prompt_tokens += usage2.prompt_tokens;
+          total.total_tokens += usage2.total_tokens;
         }
       }
       return total;
@@ -36127,8 +36167,8 @@ var require_anthropic = __commonJS({
     var context_helpers_1 = require_context_helpers();
     var project_context_builder_1 = require_project_context_builder();
     var tiers_1 = require_tiers();
-    var FILES_PER_API_BATCH = 5;
-    var PARALLEL_API_BATCHES = 4;
+    var FILES_PER_API_BATCH = 8;
+    var PARALLEL_API_BATCHES = 6;
     function getAnthropicClient() {
       const apiKey = process.env.ANTHROPIC_API_KEY;
       if (!apiKey) {
@@ -37001,11 +37041,11 @@ For each candidate finding, return:
             max_completion_tokens: 4096
           }));
           statsLock.apiCalls++;
-          const usage = response.usage;
-          if (usage) {
-            const promptTokens = usage.prompt_tokens || 0;
-            const completionTokens = usage.completion_tokens || 0;
-            const cachedTokens = usage.prompt_tokens_details?.cached_tokens || 0;
+          const usage2 = response.usage;
+          if (usage2) {
+            const promptTokens = usage2.prompt_tokens || 0;
+            const completionTokens = usage2.completion_tokens || 0;
+            const cachedTokens = usage2.prompt_tokens_details?.cached_tokens || 0;
             const freshInputTokens = promptTokens - cachedTokens;
             statsLock.estimatedInputTokens += freshInputTokens;
             statsLock.estimatedOutputTokens += completionTokens;
@@ -37226,19 +37266,19 @@ For each candidate finding, return:
           }));
           stats.apiCalls++;
           totalApiBatches++;
-          const usage = response.usage;
-          if (usage) {
+          const usage2 = response.usage;
+          if (usage2) {
             console.log(`[DEBUG] Batch ${batchNum} - Full API Response Usage:`);
-            console.log(JSON.stringify(usage, null, 2));
+            console.log(JSON.stringify(usage2, null, 2));
             console.log(`[DEBUG] Breakdown:`);
-            console.log(`  - input_tokens: ${usage.input_tokens || 0}`);
-            console.log(`  - output_tokens: ${usage.output_tokens || 0}`);
-            console.log(`  - cache_creation_input_tokens: ${usage.cache_creation_input_tokens || 0}`);
-            console.log(`  - cache_read_input_tokens: ${usage.cache_read_input_tokens || 0}`);
-            stats.estimatedInputTokens += usage.input_tokens || 0;
-            stats.estimatedOutputTokens += usage.output_tokens || 0;
-            const cacheCreation = usage.cache_creation_input_tokens || 0;
-            const cacheRead = usage.cache_read_input_tokens || 0;
+            console.log(`  - input_tokens: ${usage2.input_tokens || 0}`);
+            console.log(`  - output_tokens: ${usage2.output_tokens || 0}`);
+            console.log(`  - cache_creation_input_tokens: ${usage2.cache_creation_input_tokens || 0}`);
+            console.log(`  - cache_read_input_tokens: ${usage2.cache_read_input_tokens || 0}`);
+            stats.estimatedInputTokens += usage2.input_tokens || 0;
+            stats.estimatedOutputTokens += usage2.output_tokens || 0;
+            const cacheCreation = usage2.cache_creation_input_tokens || 0;
+            const cacheRead = usage2.cache_read_input_tokens || 0;
             stats.cacheCreationTokens += cacheCreation;
             stats.cacheReadTokens += cacheRead;
           }
@@ -38758,9 +38798,15 @@ var require_dist = __commonJS({
       const scanModeConfig = resolveScanModeConfig(options);
       const isIncremental = scanModeConfig.mode === "incremental";
       const depth = scanModeConfig.scanDepth || "cheap";
-      console.log(`[Scanner] repo=${repoInfo.name} mode=${scanModeConfig.mode} depth=${depth} files=${files.length}`);
+      const quiet = options.quiet ?? false;
+      const log = (message) => {
+        if (!quiet) {
+          console.log(message);
+        }
+      };
+      log(`[Scanner] repo=${repoInfo.name} mode=${scanModeConfig.mode} depth=${depth} files=${files.length}`);
       if (isIncremental && scanModeConfig.changedFiles) {
-        console.log(`[Scanner] repo=${repoInfo.name} incremental_files=${scanModeConfig.changedFiles.length}`);
+        log(`[Scanner] repo=${repoInfo.name} incremental_files=${scanModeConfig.changedFiles.length}`);
       }
       const reportProgress = (status2, message, vulnerabilitiesFound = allVulnerabilities.length) => {
         if (onProgress) {
@@ -38777,12 +38823,12 @@ var require_dist = __commonJS({
       try {
         const middlewareConfig = (0, middleware_detector_1.detectGlobalAuthMiddleware)(files);
         if (middlewareConfig.hasAuthMiddleware) {
-          console.log(`[Scanner] repo=${repoInfo.name} auth_middleware=${middlewareConfig.authType || "unknown"} file=${middlewareConfig.middlewareFile}`);
+          log(`[Scanner] repo=${repoInfo.name} auth_middleware=${middlewareConfig.authType || "unknown"} file=${middlewareConfig.middlewareFile}`);
         }
         const fileAuthImports = (0, imported_auth_detector_1.buildFileAuthImports)(files);
         const filesWithImportedAuth = Array.from(fileAuthImports.values()).filter((f) => f.usesImportedAuth).length;
         if (filesWithImportedAuth > 0) {
-          console.log(`[Scanner] repo=${repoInfo.name} files_with_imported_auth=${filesWithImportedAuth}`);
+          log(`[Scanner] repo=${repoInfo.name} files_with_imported_auth=${filesWithImportedAuth}`);
         }
         reportProgress("layer1", "Running surface scan (patterns, entropy, config)...");
         let layer1Result = await (0, layer1_1.runLayer1Scan)(files);
@@ -38791,18 +38837,18 @@ var require_dist = __commonJS({
           ...layer1Result,
           vulnerabilities: (0, urls_1.aggregateLocalhostFindings)(layer1Result.vulnerabilities)
         };
-        console.log(`[Layer1] repo=${repoInfo.name} findings_raw=${layer1RawCount} findings_deduped=${layer1Result.vulnerabilities.length}`);
+        log(`[Layer1] repo=${repoInfo.name} findings_raw=${layer1RawCount} findings_deduped=${layer1Result.vulnerabilities.length}`);
         reportProgress("layer2", "Running structural scan (variables, logic gates)...", layer1Result.vulnerabilities.length);
         const layer2Result = await (0, layer2_1.runLayer2Scan)(files, { middlewareConfig, fileAuthImports });
         const heuristicBreakdown = Object.entries(layer2Result.stats.raw).filter(([, count]) => count > 0).map(([name, count]) => `${name}:${count}`).join(",");
-        console.log(`[Layer2] repo=${repoInfo.name} findings_raw=${Object.values(layer2Result.stats.raw).reduce((a, b3) => a + b3, 0)} findings_deduped=${layer2Result.vulnerabilities.length} heuristic_breakdown={${heuristicBreakdown}}`);
+        log(`[Layer2] repo=${repoInfo.name} findings_raw=${Object.values(layer2Result.stats.raw).reduce((a, b3) => a + b3, 0)} findings_deduped=${layer2Result.vulnerabilities.length} heuristic_breakdown={${heuristicBreakdown}}`);
         const layer12Findings = [...layer1Result.vulnerabilities, ...layer2Result.vulnerabilities];
         const beforeAggregationCount = layer12Findings.length;
         const aggregatedFindings = aggregateNoisyFindings(layer12Findings);
         const aggregatedCount = beforeAggregationCount - aggregatedFindings.length;
         const tierFiltered = filterByTierAndDepth(aggregatedFindings, depth);
-        console.log(`[Scanner] repo=${repoInfo.name} tier_breakdown=${(0, tiers_1.formatTierStats)(tierFiltered.tierStats)}`);
-        console.log(`[Scanner] repo=${repoInfo.name} depth=${depth} tier_routing: surface=${tierFiltered.toSurface.length} validate=${tierFiltered.toValidate.length} hidden=${tierFiltered.hidden.length}`);
+        log(`[Scanner] repo=${repoInfo.name} tier_breakdown=${(0, tiers_1.formatTierStats)(tierFiltered.tierStats)}`);
+        log(`[Scanner] repo=${repoInfo.name} depth=${depth} tier_routing: surface=${tierFiltered.toSurface.length} validate=${tierFiltered.toValidate.length} hidden=${tierFiltered.hidden.length}`);
         const additionalValidation = tierFiltered.toSurface.filter(
           (v2) => v2.requiresAIValidation || v2.category === "ai_prompt_injection" || // Story B1: Prompt hygiene
           v2.category === "ai_unsafe_execution" || // Story B2: LLM output execution
@@ -38817,7 +38863,7 @@ var require_dist = __commonJS({
           autoDismissBySeverity[d3.finding.severity] = (autoDismissBySeverity[d3.finding.severity] || 0) + 1;
         }
         if (autoDismissed.length > 0) {
-          console.log(`[Layer2] repo=${repoInfo.name} auto_dismissed_total=${autoDismissed.length} by_severity={info:${autoDismissBySeverity.info},low:${autoDismissBySeverity.low},medium:${autoDismissBySeverity.medium},high:${autoDismissBySeverity.high}}`);
+          log(`[Layer2] repo=${repoInfo.name} auto_dismissed_total=${autoDismissed.length} by_severity={info:${autoDismissBySeverity.info},low:${autoDismissBySeverity.low},medium:${autoDismissBySeverity.medium},high:${autoDismissBySeverity.high}}`);
         }
         const maxValidationFiles = scanModeConfig.maxAIValidationFiles || MAX_VALIDATION_CANDIDATES_PER_FILE;
         const cappedValidation = capValidationCandidatesPerFile(afterAutoDismiss, maxValidationFiles);
@@ -38832,13 +38878,13 @@ var require_dist = __commonJS({
             validatedFindings = validationResult.vulnerabilities;
             const { stats: validationStats } = validationResult;
             capturedValidationStats = validationStats;
-            console.log(`[AI Validation] repo=${repoInfo.name} depth=${depth} candidates=${findingsToValidate.length} capped_from=${requiresValidation.length} auto_dismissed=${autoDismissed.length} kept=${validationStats.confirmedFindings} rejected=${validationStats.dismissedFindings} downgraded=${validationStats.downgradedFindings}`);
-            console.log(`[AI Validation] cost_estimate: input_tokens=${validationStats.estimatedInputTokens} output_tokens=${validationStats.estimatedOutputTokens} cost=$${validationStats.estimatedCost.toFixed(4)} api_calls=${validationStats.apiCalls}`);
+            log(`[AI Validation] repo=${repoInfo.name} depth=${depth} candidates=${findingsToValidate.length} capped_from=${requiresValidation.length} auto_dismissed=${autoDismissed.length} kept=${validationStats.confirmedFindings} rejected=${validationStats.dismissedFindings} downgraded=${validationStats.downgradedFindings}`);
+            log(`[AI Validation] cost_estimate: input_tokens=${validationStats.estimatedInputTokens} output_tokens=${validationStats.estimatedOutputTokens} cost=$${validationStats.estimatedCost.toFixed(4)} api_calls=${validationStats.apiCalls}`);
             const notValidated = cappedValidation.filter((v2) => !findingsToValidate.includes(v2));
             validatedFindings.push(...notValidated);
           }
         } else if (scanModeConfig.skipAIValidation) {
-          console.log(`[AI Validation] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
+          log(`[AI Validation] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
         }
         allVulnerabilities.push(...validatedFindings, ...noValidationNeeded);
         const shouldRunLayer3 = options.enableAI !== false && !scanModeConfig.skipLayer3;
@@ -38863,9 +38909,9 @@ var require_dist = __commonJS({
             }
           });
           allVulnerabilities.push(...layer3Result.vulnerabilities);
-          console.log(`[Layer3] repo=${repoInfo.name} depth=${depth} files_analyzed=${layer3Result.aiAnalyzed} findings=${layer3Result.vulnerabilities.length}`);
+          log(`[Layer3] repo=${repoInfo.name} depth=${depth} files_analyzed=${layer3Result.aiAnalyzed} findings=${layer3Result.vulnerabilities.length}`);
         } else if (scanModeConfig.skipLayer3) {
-          console.log(`[Layer3] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
+          log(`[Layer3] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
         }
         const uniqueVulnerabilities = deduplicateVulnerabilities(allVulnerabilities);
         const resolvedVulnerabilities = resolveContradictions(uniqueVulnerabilities, middlewareConfig);
@@ -38976,9 +39022,6 @@ Found ${group.length} occurrences at lines: ${lineDisplay}`,
         });
         const capped = sorted.slice(0, maxPerFile);
         result.push(...capped);
-        if (sorted.length > maxPerFile) {
-          console.log(`[Scanner] Capped ${filePath}: ${sorted.length} \u2192 ${maxPerFile} validation candidates`);
-        }
       }
       return result;
     }
@@ -39031,7 +39074,6 @@ Found ${group.length} occurrences at lines: ${lineDisplay}`,
           for (const vuln of otherAuthFindings) {
             if (vuln.severity === "critical" || vuln.severity === "high") {
               const reason = isAPIRouteProtected ? "API route protected by middleware" : isClientCallingProtectedAPI ? "client component calling protected API" : "route is protected";
-              console.log(`[Contradiction] Dropping "${vuln.title}" (${vuln.severity}) - ${reason}`);
               continue;
             }
             result.push(vuln);
@@ -42827,6 +42869,27 @@ async function pollForLogin(deviceCode) {
     tier: result.tier
   };
 }
+async function getUsage(apiKey) {
+  const baseUrl = getApiBaseUrl();
+  const url = `${baseUrl}/v1/usage`;
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${apiKey}`,
+        "X-Oculum-Client": "cli",
+        "X-Oculum-Version": "1.0.0"
+      }
+    });
+    const result = await response.json();
+    return result;
+  } catch (error) {
+    return {
+      success: false,
+      error: "Failed to fetch usage data. Please check your internet connection."
+    };
+  }
+}
 
 // src/utils/errors.ts
 function enhanceError(error) {
@@ -43477,18 +43540,19 @@ async function runScanOnce(targetPath, options) {
   }
   spinner.succeed(`Found ${files.length} files to scan`);
   const onProgress = (progress) => {
+    const fileInfo = source_default.dim(`(${progress.totalFiles} files)`);
     switch (progress.status) {
       case "layer1":
-        spinner.text = `Scanning patterns... ${source_default.dim(`(${progress.vulnerabilitiesFound} potential issues)`)}`;
+        spinner.text = `Layer 1: Pattern matching ${fileInfo} ${source_default.dim(`\u2192 ${progress.vulnerabilitiesFound} candidates`)}`;
         break;
       case "layer2":
-        spinner.text = `Analyzing code structure... ${source_default.dim(`(${progress.vulnerabilitiesFound} findings)`)}`;
+        spinner.text = `Layer 2: Code structure analysis ${fileInfo} ${source_default.dim(`\u2192 ${progress.vulnerabilitiesFound} findings`)}`;
         break;
       case "validating":
-        spinner.text = `AI validating findings... ${source_default.dim(`(${progress.vulnerabilitiesFound} candidates)`)}`;
+        spinner.text = `AI validation ${source_default.dim(`\u2192 reviewing ${progress.vulnerabilitiesFound} candidates`)}`;
         break;
       case "layer3":
-        spinner.text = `Deep AI analysis in progress...`;
+        spinner.text = `Layer 3: Deep AI analysis ${source_default.dim(`\u2192 semantic security check`)}`;
         break;
       case "complete":
         const issueText = progress.vulnerabilitiesFound === 1 ? "issue" : "issues";
@@ -43522,6 +43586,7 @@ async function runScanOnce(targetPath, options) {
       spinner.succeed(`Backend scan complete`);
     } else {
       const enableAI = options.depth !== "cheap" && hasLocalAI;
+      const shouldBeQuiet = options.quiet ?? !options.verbose;
       result = await (0, import_scanner.runScan)(
         files,
         {
@@ -43531,7 +43596,8 @@ async function runScanOnce(targetPath, options) {
         },
         {
           enableAI,
-          scanDepth: options.depth
+          scanDepth: options.depth,
+          quiet: shouldBeQuiet
         },
         onProgress
       );
@@ -43574,6 +43640,7 @@ async function runScan(targetPath, cliOptions) {
     failOn: cliOptions.failOn ?? "high",
     color: cliOptions.color,
     quiet: cliOptions.quiet,
+    verbose: cliOptions.verbose,
     incremental: cliOptions.incremental,
     diff: cliOptions.diff,
     output: cliOptions.output
@@ -43584,6 +43651,7 @@ async function runScan(targetPath, cliOptions) {
     format: baseOptions.format ?? projectConfig?.format ?? "terminal",
     failOn: baseOptions.failOn ?? projectConfig?.failOn ?? "high",
     quiet: baseOptions.quiet ?? projectConfig?.quiet,
+    verbose: baseOptions.verbose,
     output: baseOptions.output ?? projectConfig?.output
   };
   try {
@@ -43598,7 +43666,7 @@ async function runScan(targetPath, cliOptions) {
     process.exit(1);
   }
 }
-var scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: cheap (free), validated, deep", "cheap").option("-m, --mode <mode>", "alias for --depth (quick, validated, deep)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown", "terminal").option("--fail-on <severity>", "exit with error code if findings at severity", "high").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-o, --output <file>", "write output to file").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").addHelpText("after", `
+var scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: cheap (free), validated, deep", "cheap").option("-m, --mode <mode>", "alias for --depth (quick, validated, deep)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown", "terminal").option("--fail-on <severity>", "exit with error code if findings at severity", "high").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-v, --verbose", "show detailed scanner logs (debug mode)").option("-o, --output <file>", "write output to file").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").addHelpText("after", `
 Examples:
   $ oculum scan .                    # Scan current directory (quick/free)
   $ oculum scan ./src                # Scan specific directory
@@ -43654,12 +43722,14 @@ async function login(options) {
     console.log(source_default.dim("  " + "\u2500".repeat(38)));
     console.log("");
     spinner.start("Initiating login...");
-    const { authUrl, deviceCode } = await initiateLogin();
+    const { authUrl, deviceCode, userCode } = await initiateLogin();
     spinner.stop();
     console.log(source_default.white("  Open this URL in your browser to login:"));
     console.log("");
     console.log(source_default.cyan.bold(`    ${authUrl}`));
     console.log("");
+    console.log(source_default.white("  Or enter this code manually: ") + source_default.yellow.bold(userCode));
+    console.log("");
     console.log(source_default.dim("  Waiting for browser authorization..."));
     console.log(source_default.dim("  (This will timeout after 5 minutes)"));
     console.log("");
@@ -46587,6 +46657,7 @@ async function showFeatureExploration() {
   console.log(source_default.dim("  oculum watch .             ") + source_default.white("Watch for changes"));
   console.log(source_default.dim("  oculum ui                  ") + source_default.white("Interactive mode"));
   console.log(source_default.dim("  oculum login               ") + source_default.white("Authenticate for Pro features"));
+  console.log(source_default.dim("  oculum usage               ") + source_default.white("View credits and quota"));
   console.log(source_default.dim("  oculum --help              ") + source_default.white("Show all commands\n"));
   await ve({
     message: "Press Enter to continue",
@@ -47028,6 +47099,8 @@ async function runScanWizard() {
       format,
       failOn,
       color: true,
+      quiet: true,
+      // Suppress scanner logs in interactive UI mode
       incremental,
       diff: diffRef,
       output: outputPath
@@ -47055,7 +47128,9 @@ async function runQuickScan(targetPath = ".") {
       depth: "cheap",
       format: "terminal",
       failOn: "high",
-      color: true
+      color: true,
+      quiet: true
+      // Suppress scanner logs in interactive UI mode
     },
     cancelled: false
   };
@@ -47508,7 +47583,9 @@ async function runUI() {
         depth,
         format: "terminal",
         failOn: "high",
-        color: true
+        color: true,
+        quiet: true
+        // Suppress scanner logs in interactive UI mode
       });
       console.log(output);
       recordScan();
@@ -47677,6 +47754,119 @@ var uiCommand = new Command("ui").description("Interactive terminal UI").action(
   await runUI();
 });
 
+// src/commands/usage.ts
+function formatNumber(num) {
+  if (num === -1) return "unlimited";
+  return num.toLocaleString();
+}
+function createProgressBar(percentage, width = 20) {
+  const filled = Math.round(percentage / 100 * width);
+  const empty = width - filled;
+  const bar = "\u2588".repeat(filled) + "\u2591".repeat(empty);
+  if (percentage >= 90) return source_default.red(bar);
+  if (percentage >= 70) return source_default.yellow(bar);
+  return source_default.green(bar);
+}
+function formatDate(dateStr) {
+  const date = new Date(dateStr);
+  return date.toLocaleDateString("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric"
+  });
+}
+async function usage(options) {
+  const config = getConfig();
+  if (!isAuthenticated()) {
+    console.log("");
+    console.log(source_default.yellow("  \u26A0 Not logged in"));
+    console.log("");
+    console.log(source_default.dim("  Login to view your usage and quota:"));
+    console.log(source_default.cyan("    oculum login"));
+    console.log("");
+    process.exit(1);
+  }
+  const spinner = ora("Fetching usage data...").start();
+  try {
+    const result = await getUsage(config.apiKey);
+    if (!result.success || !result.usage || !result.plan) {
+      spinner.fail("Failed to fetch usage data");
+      console.log("");
+      console.log(source_default.dim("  Error: ") + source_default.red(result.error || "Unknown error"));
+      console.log("");
+      process.exit(1);
+    }
+    spinner.stop();
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    const { plan, usage: usageData } = result;
+    console.log("");
+    console.log(source_default.bold("  \u{1F4CA} Oculum Usage"));
+    console.log(source_default.dim("  " + "\u2500".repeat(38)));
+    console.log("");
+    const planBadge = plan.name === "pro" ? source_default.bgBlue.white(" PRO ") : plan.name === "enterprise" || plan.name === "max" ? source_default.bgMagenta.white(" MAX ") : plan.name === "starter" ? source_default.bgCyan.white(" STARTER ") : source_default.bgGray.white(" FREE ");
+    console.log(source_default.dim("  Plan: ") + planBadge + source_default.white(` ${plan.displayName}`));
+    console.log(source_default.dim("  Month: ") + source_default.white(usageData.month));
+    console.log("");
+    console.log(source_default.bold("  Credits Usage"));
+    console.log("");
+    const creditsDisplay = usageData.creditsLimit === -1 ? `${formatNumber(usageData.creditsUsed)} / unlimited` : `${formatNumber(usageData.creditsUsed)} / ${formatNumber(usageData.creditsLimit)}`;
+    console.log(source_default.dim("  Used:      ") + source_default.white(creditsDisplay));
+    if (usageData.creditsLimit !== -1) {
+      console.log(source_default.dim("  Remaining: ") + source_default.white(formatNumber(usageData.creditsRemaining)));
+      console.log("");
+      console.log(source_default.dim("  ") + createProgressBar(usageData.usagePercentage) + source_default.dim(` ${usageData.usagePercentage.toFixed(1)}%`));
+    }
+    console.log("");
+    console.log(source_default.bold("  This Month"));
+    console.log("");
+    console.log(source_default.dim("  Scans:     ") + source_default.white(formatNumber(usageData.totalScans)));
+    console.log(source_default.dim("  Files:     ") + source_default.white(formatNumber(usageData.totalFiles)));
+    console.log("");
+    console.log(source_default.dim("  Resets on: ") + source_default.white(formatDate(usageData.resetDate)));
+    console.log("");
+    if (result.recentScans && result.recentScans.length > 0) {
+      console.log(source_default.bold("  Recent Scans"));
+      console.log("");
+      const recentToShow = result.recentScans.slice(0, 5);
+      for (const scan of recentToShow) {
+        const date = new Date(scan.createdAt);
+        const timeAgo = getTimeAgo(date);
+        console.log(source_default.dim("  \u2022 ") + source_default.white(scan.repoName || "unknown") + source_default.dim(` (${timeAgo})`));
+        console.log(source_default.dim("    ") + source_default.dim(`${scan.filesScanned} files, ${scan.findingsCount} findings, ${scan.creditsUsed} credits`));
+      }
+      console.log("");
+    }
+    if (plan.name === "free" || plan.name === "starter") {
+      console.log(source_default.dim("  " + "\u2500".repeat(38)));
+      console.log("");
+      console.log(source_default.dim("  Need more credits? ") + source_default.cyan("oculum upgrade"));
+      console.log("");
+    }
+  } catch (error) {
+    spinner.fail("Failed to fetch usage data");
+    console.log("");
+    console.log(source_default.dim("  Error: ") + source_default.red(String(error)));
+    console.log("");
+    process.exit(1);
+  }
+}
+function getTimeAgo(date) {
+  const now = /* @__PURE__ */ new Date();
+  const diffMs = now.getTime() - date.getTime();
+  const diffMins = Math.floor(diffMs / 6e4);
+  const diffHours = Math.floor(diffMs / 36e5);
+  const diffDays = Math.floor(diffMs / 864e5);
+  if (diffMins < 1) return "just now";
+  if (diffMins < 60) return `${diffMins}m ago`;
+  if (diffHours < 24) return `${diffHours}h ago`;
+  if (diffDays < 7) return `${diffDays}d ago`;
+  return date.toLocaleDateString("en-US", { month: "short", day: "numeric" });
+}
+var usageCommand = new Command("usage").description("Show current usage and quota").option("--json", "Output as JSON").action(usage);
+
 // src/index.ts
 var program2 = new Command();
 program2.name("oculum").description("AI-native security scanner for detecting vulnerabilities in LLM-generated code").version("1.0.0").addHelpText("after", `
@@ -47691,6 +47881,7 @@ Common Commands:
   ui                       Interactive terminal UI
   login                    Authenticate with Oculum
   status                   Check authentication status
+  usage                    View credits and quota
 
 Learn More:
   $ oculum scan --help     Detailed scan options
@@ -47703,6 +47894,7 @@ program2.addCommand(authCommand);
 program2.addCommand(loginCommand);
 program2.addCommand(statusCommand);
 program2.addCommand(upgradeCommand);
+program2.addCommand(usageCommand);
 program2.addCommand(watchCommand);
 program2.addCommand(uiCommand);
 program2.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oculum/cli",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "AI-native security scanner CLI for detecting vulnerabilities in AI-generated code, BYOK patterns, and modern web applications",
   "main": "dist/index.js",
   "bin": {