@oculum/cli 1.0.19 → 1.0.20

package/dist/index.js

@@ -22260,6 +22260,222 @@ var require_patterns = __commonJS({
   }
 });
 
+// ../scanner/dist/shared/registry-clients.js
+var require_registry_clients = __commonJS({
+  "../scanner/dist/shared/registry-clients.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.fetchNPMMetadata = fetchNPMMetadata;
+    exports2.fetchPyPIMetadata = fetchPyPIMetadata;
+    exports2.extractNpmDependencies = extractNpmDependencies;
+    exports2.extractPythonRequirements = extractPythonRequirements;
+    exports2.extractPyprojectDependencies = extractPyprojectDependencies;
+    exports2.getPackageFileType = getPackageFileType;
+    exports2.calculatePackageAgeDays = calculatePackageAgeDays;
+    exports2.rateLimitDelay = rateLimitDelay;
+    exports2.clearRegistryCaches = clearRegistryCaches;
+    var npmMetadataCache = /* @__PURE__ */ new Map();
+    var pypiMetadataCache = /* @__PURE__ */ new Map();
+    var RATE_LIMIT_DELAY_MS = 100;
+    async function fetchNPMMetadata(packageName) {
+      if (npmMetadataCache.has(packageName)) {
+        return npmMetadataCache.get(packageName) || null;
+      }
+      try {
+        const registryResponse = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+          headers: {
+            "Accept": "application/json"
+          }
+        });
+        if (!registryResponse.ok) {
+          if (registryResponse.status === 404) {
+            npmMetadataCache.set(packageName, null);
+            return null;
+          }
+          console.warn(`[Registry] npm registry error for ${packageName}: ${registryResponse.status}`);
+          return null;
+        }
+        const data = await registryResponse.json();
+        let weeklyDownloads = 0;
+        try {
+          const downloadsResponse = await fetch(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}`);
+          if (downloadsResponse.ok) {
+            const downloadsData = await downloadsResponse.json();
+            weeklyDownloads = downloadsData.downloads || 0;
+          }
+        } catch {
+        }
+        const metadata = {
+          name: data.name,
+          version: data["dist-tags"]?.latest || "",
+          description: data.description,
+          maintainers: data.maintainers || [],
+          time: data.time || { created: "", modified: "" },
+          repository: data.repository,
+          homepage: data.homepage,
+          license: data.license,
+          downloads: { weekly: weeklyDownloads }
+        };
+        npmMetadataCache.set(packageName, metadata);
+        return metadata;
+      } catch (error) {
+        console.warn(`[Registry] Failed to fetch npm metadata for ${packageName}:`, error);
+        return null;
+      }
+    }
+    async function fetchPyPIMetadata(packageName) {
+      if (pypiMetadataCache.has(packageName)) {
+        return pypiMetadataCache.get(packageName) || null;
+      }
+      try {
+        const response = await fetch(`https://pypi.org/pypi/${encodeURIComponent(packageName)}/json`, {
+          headers: {
+            "Accept": "application/json"
+          }
+        });
+        if (!response.ok) {
+          if (response.status === 404) {
+            pypiMetadataCache.set(packageName, null);
+            return null;
+          }
+          console.warn(`[Registry] PyPI registry error for ${packageName}: ${response.status}`);
+          return null;
+        }
+        const data = await response.json();
+        const info = data.info || {};
+        let releaseDate;
+        const releases = data.releases?.[info.version];
+        if (releases && releases.length > 0) {
+          releaseDate = releases[0].upload_time;
+        }
+        const metadata = {
+          name: info.name,
+          version: info.version,
+          summary: info.summary,
+          author: info.author,
+          authorEmail: info.author_email,
+          license: info.license,
+          projectUrls: info.project_urls,
+          releaseDate,
+          requiresPython: info.requires_python
+        };
+        pypiMetadataCache.set(packageName, metadata);
+        return metadata;
+      } catch (error) {
+        console.warn(`[Registry] Failed to fetch PyPI metadata for ${packageName}:`, error);
+        return null;
+      }
+    }
+    function extractNpmDependencies(content) {
+      try {
+        const pkg = JSON.parse(content);
+        const deps = [];
+        const lines = content.split("\n");
+        const depSections = [
+          { key: "dependencies", source: "dependencies" },
+          { key: "devDependencies", source: "devDependencies" },
+          { key: "peerDependencies", source: "peerDependencies" },
+          { key: "optionalDependencies", source: "optionalDependencies" }
+        ];
+        for (const { key, source } of depSections) {
+          const depsObj = pkg[key];
+          if (!depsObj || typeof depsObj !== "object")
+            continue;
+          for (const [name, version] of Object.entries(depsObj)) {
+            const lineIndex = lines.findIndex((l2) => l2.includes(`"${name}"`));
+            deps.push({
+              name,
+              version,
+              source,
+              line: lineIndex >= 0 ? lineIndex + 1 : 1
+            });
+          }
+        }
+        return deps;
+      } catch {
+        return [];
+      }
+    }
+    function extractPythonRequirements(content) {
+      const deps = [];
+      const lines = content.split("\n");
+      lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("-")) {
+          return;
+        }
+        const match3 = trimmed.match(/^([a-zA-Z0-9_-]+)(?:\[.*?\])?(?:[=<>~!]+(.+))?/);
+        if (match3) {
+          deps.push({
+            name: match3[1],
+            version: match3[2],
+            source: "requirements",
+            line: index + 1
+          });
+        }
+      });
+      return deps;
+    }
+    function extractPyprojectDependencies(content) {
+      const deps = [];
+      const lines = content.split("\n");
+      let inDependencies = false;
+      lines.forEach((line, index) => {
+        const trimmed = line.trim();
+        if (trimmed === "[project.dependencies]" || trimmed === "dependencies = [") {
+          inDependencies = true;
+          return;
+        }
+        if (inDependencies && (trimmed.startsWith("[") || trimmed === "]")) {
+          inDependencies = false;
+          return;
+        }
+        if (inDependencies) {
+          const match3 = trimmed.match(/^["']?([a-zA-Z0-9_-]+)(?:\[.*?\])?(?:[=<>~!]+)?/);
+          if (match3 && match3[1]) {
+            deps.push({
+              name: match3[1],
+              version: void 0,
+              source: "requirements",
+              line: index + 1
+            });
+          }
+        }
+      });
+      return deps;
+    }
+    function getPackageFileType(filePath) {
+      const fileName = filePath.split("/").pop()?.toLowerCase() || "";
+      if (fileName === "package.json" || fileName === "package-lock.json" || fileName === "yarn.lock" || fileName === "pnpm-lock.yaml") {
+        return "npm";
+      }
+      if (fileName === "requirements.txt" || fileName === "pyproject.toml" || fileName === "pipfile" || fileName === "pipfile.lock") {
+        return "python";
+      }
+      return null;
+    }
+    function calculatePackageAgeDays(createdDate) {
+      if (!createdDate)
+        return Infinity;
+      try {
+        const created = new Date(createdDate);
+        const now = /* @__PURE__ */ new Date();
+        const diffMs = now.getTime() - created.getTime();
+        return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
+      } catch {
+        return Infinity;
+      }
+    }
+    async function rateLimitDelay() {
+      return new Promise((resolve9) => setTimeout(resolve9, RATE_LIMIT_DELAY_MS));
+    }
+    function clearRegistryCaches() {
+      npmMetadataCache.clear();
+      pypiMetadataCache.clear();
+    }
+  }
+});
+
 // ../scanner/dist/detect/secrets/config-audit.js
 var require_config_audit = __commonJS({
   "../scanner/dist/detect/secrets/config-audit.js"(exports2) {
@@ -22267,6 +22483,8 @@ var require_config_audit = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.CONFIG_RULES = void 0;
     exports2.auditConfiguration = auditConfiguration;
+    exports2.enrichPostinstallFindings = enrichPostinstallFindings;
+    var registry_clients_1 = require_registry_clients();
     var BASE_CONFIDENCE = 0.5;
     exports2.CONFIG_RULES = [
       // Dockerfile rules
@@ -22541,6 +22759,79 @@ var require_config_audit = __commonJS({
       };
       return fixes[ruleName] || "Review and fix the security configuration";
     }
+    function extractPostinstallCommand(lineContent) {
+      const match3 = lineContent.match(/"(?:postinstall|preinstall)"\s*:\s*"([^"]+)"/);
+      return match3?.[1] || null;
+    }
+    function extractScriptBinary(command) {
+      const trimmed = command.trim();
+      if (trimmed.startsWith("npx ")) {
+        const parts2 = trimmed.slice(4).trim().split(/\s+/);
+        return parts2[0] || null;
+      }
+      if (trimmed.startsWith("npm run ") || trimmed.startsWith("npm exec ")) {
+        return null;
+      }
+      if (trimmed.startsWith("node ") || trimmed.startsWith("sh ") || trimmed.startsWith("bash ")) {
+        return null;
+      }
+      const parts = trimmed.split(/\s+/);
+      return parts[0] || null;
+    }
+    function formatDownloads(n) {
+      if (n >= 1e6)
+        return `${(n / 1e6).toFixed(1)}M`;
+      if (n >= 1e3)
+        return `${(n / 1e3).toFixed(0)}k`;
+      return `${n}`;
+    }
+    async function enrichPostinstallFindings(findings) {
+      const result = [];
+      for (const finding of findings) {
+        if (finding.category !== "insecure_config" || !finding.description.includes("install scripts")) {
+          result.push(finding);
+          continue;
+        }
+        const command = extractPostinstallCommand(finding.lineContent);
+        if (!command) {
+          result.push(finding);
+          continue;
+        }
+        const scriptBinary = extractScriptBinary(command);
+        if (scriptBinary) {
+          const metadata = await (0, registry_clients_1.fetchNPMMetadata)(scriptBinary);
+          if (metadata) {
+            const weeklyDownloads = metadata.downloads?.weekly || 0;
+            const ageDays = (0, registry_clients_1.calculatePackageAgeDays)(metadata.time?.created);
+            if (weeklyDownloads >= 1e6 && ageDays >= 365) {
+              continue;
+            }
+            if (weeklyDownloads >= 1e5 && ageDays >= 180) {
+              finding.severity = "info";
+              finding.description = `postinstall runs "${command}" (${scriptBinary}: ${formatDownloads(weeklyDownloads)}/week, ${Math.floor(ageDays / 365)}+ years old)`;
+              result.push(finding);
+              continue;
+            }
+            if (weeklyDownloads >= 1e4 && ageDays >= 90) {
+              finding.severity = "low";
+              result.push(finding);
+              continue;
+            }
+            finding.severity = "medium";
+            finding.description = `postinstall runs "${command}" \u2014 ${scriptBinary} has only ${formatDownloads(weeklyDownloads)} weekly downloads (${ageDays} days old). Review carefully.`;
+            result.push(finding);
+            continue;
+          } else {
+            finding.severity = "high";
+            finding.description = `postinstall runs "${command}" \u2014 "${scriptBinary}" not found on npm registry. Possible supply chain risk.`;
+            result.push(finding);
+            continue;
+          }
+        }
+        result.push(finding);
+      }
+      return result;
+    }
   }
 });
 
@@ -63466,6 +63757,770 @@ var require_pipeline = __commonJS({
   }
 });
 
+// ../scanner/dist/detect/config/osv-check.js
+var require_osv_check = __commonJS({
+  "../scanner/dist/detect/config/osv-check.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.advisoryCache = void 0;
+    exports2.checkPackageAdvisories = checkPackageAdvisories;
+    exports2.queryOSV = queryOSV;
+    exports2.queryOSVBatch = queryOSVBatch;
+    exports2.mapOSVSeverity = mapOSVSeverity;
+    exports2.isMaliciousPackage = isMaliciousPackage;
+    exports2.getCacheKey = getCacheKey;
+    var registry_clients_1 = require_registry_clients();
+    var OSV_API_URL = "https://api.osv.dev/v1/query";
+    var OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
+    var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+    var MAX_PACKAGES_TO_CHECK = 100;
+    var advisoryCache = /* @__PURE__ */ new Map();
+    exports2.advisoryCache = advisoryCache;
+    function getCacheKey(name, ecosystem) {
+      return `${ecosystem}:${name.toLowerCase()}`;
+    }
+    function isCacheValid(cached) {
+      return Date.now() - cached.timestamp < CACHE_TTL_MS;
+    }
+    function getCachedAdvisories(name, ecosystem) {
+      const key = getCacheKey(name, ecosystem);
+      const cached = advisoryCache.get(key);
+      if (cached && isCacheValid(cached)) {
+        return cached.advisories;
+      }
+      return null;
+    }
+    function cacheAdvisories(name, ecosystem, advisories) {
+      const key = getCacheKey(name, ecosystem);
+      advisoryCache.set(key, {
+        timestamp: Date.now(),
+        advisories
+      });
+    }
+    async function queryOSV(packageName, ecosystem, version) {
+      const cached = getCachedAdvisories(packageName, ecosystem);
+      if (cached !== null) {
+        return cached;
+      }
+      try {
+        const query = {
+          package: {
+            name: packageName,
+            ecosystem
+          }
+        };
+        if (version) {
+          query.version = version;
+        }
+        const response = await fetch(OSV_API_URL, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(query)
+        });
+        if (!response.ok) {
+          cacheAdvisories(packageName, ecosystem, []);
+          return [];
+        }
+        const data = await response.json();
+        const advisories = data.vulns || [];
+        cacheAdvisories(packageName, ecosystem, advisories);
+        return advisories;
+      } catch {
+        return [];
+      }
+    }
+    async function queryOSVBatch(packages) {
+      const results = /* @__PURE__ */ new Map();
+      const uncached = [];
+      for (let i = 0; i < packages.length; i++) {
+        const pkg = packages[i];
+        const cached = getCachedAdvisories(pkg.name, pkg.ecosystem);
+        if (cached !== null) {
+          results.set(getCacheKey(pkg.name, pkg.ecosystem), cached);
+        } else {
+          uncached.push({ ...pkg, index: i });
+        }
+      }
+      if (uncached.length === 0) {
+        return results;
+      }
+      try {
+        const queries = uncached.map((pkg) => ({
+          package: {
+            name: pkg.name,
+            ecosystem: pkg.ecosystem
+          },
+          version: pkg.version
+        }));
+        const response = await fetch(OSV_BATCH_URL, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ queries })
+        });
+        if (!response.ok) {
+          for (const pkg of uncached) {
+            cacheAdvisories(pkg.name, pkg.ecosystem, []);
+            results.set(getCacheKey(pkg.name, pkg.ecosystem), []);
+          }
+          return results;
+        }
+        const data = await response.json();
+        for (let i = 0; i < uncached.length; i++) {
+          const pkg = uncached[i];
+          const advisories = data.results[i]?.vulns || [];
+          cacheAdvisories(pkg.name, pkg.ecosystem, advisories);
+          results.set(getCacheKey(pkg.name, pkg.ecosystem), advisories);
+        }
+        return results;
+      } catch {
+        for (const pkg of uncached) {
+          results.set(getCacheKey(pkg.name, pkg.ecosystem), []);
+        }
+        return results;
+      }
+    }
+    function mapOSVSeverity(vuln) {
+      if (vuln.database_specific?.malicious) {
+        return "critical";
+      }
+      const cvss = vuln.severity?.find((s) => s.type === "CVSS_V3");
+      if (cvss) {
+        const score = parseFloat(cvss.score);
+        if (score >= 9)
+          return "critical";
+        if (score >= 7)
+          return "high";
+        if (score >= 4)
+          return "medium";
+        return "low";
+      }
+      const dbSeverity = vuln.database_specific?.severity?.toLowerCase();
+      if (dbSeverity) {
+        if (dbSeverity === "critical")
+          return "critical";
+        if (dbSeverity === "high")
+          return "high";
+        if (dbSeverity === "moderate" || dbSeverity === "medium")
+          return "medium";
+        if (dbSeverity === "low")
+          return "low";
+      }
+      return "high";
+    }
+    function isMaliciousPackage(vuln) {
+      return vuln.database_specific?.malicious === true || vuln.id.startsWith("MAL-") || (vuln.summary?.toLowerCase().includes("malicious") ?? false);
+    }
+    async function checkPackageAdvisories(content, filePath) {
+      const vulnerabilities = [];
+      const fileType = (0, registry_clients_1.getPackageFileType)(filePath);
+      if (!fileType) {
+        return vulnerabilities;
+      }
+      let dependencies = [];
+      if (fileType === "npm" && filePath.endsWith("package.json")) {
+        dependencies = (0, registry_clients_1.extractNpmDependencies)(content);
+      } else if (fileType === "python") {
+        dependencies = (0, registry_clients_1.extractPythonRequirements)(content);
+      }
+      if (dependencies.length === 0) {
+        return vulnerabilities;
+      }
+      const lines = content.split("\n");
+      const ecosystem = fileType === "npm" ? "npm" : "PyPI";
+      const limitedDeps = dependencies.slice(0, MAX_PACKAGES_TO_CHECK);
+      const packagesToQuery = limitedDeps.map((dep) => ({
+        name: dep.name,
+        ecosystem,
+        version: dep.version
+      }));
+      const advisoriesMap = await queryOSVBatch(packagesToQuery);
+      for (const dep of limitedDeps) {
+        const key = getCacheKey(dep.name, ecosystem);
+        const advisories = advisoriesMap.get(key) || [];
+        if (advisories.length === 0)
+          continue;
+        let mostSevere = null;
+        let highestSeverity = "info";
+        const severityOrder = ["info", "low", "medium", "high", "critical"];
+        for (const adv of advisories) {
+          const sev = mapOSVSeverity(adv);
+          if (severityOrder.indexOf(sev) > severityOrder.indexOf(highestSeverity)) {
+            highestSeverity = sev;
+            mostSevere = adv;
+          }
+        }
+        if (!mostSevere)
+          continue;
+        const isMalicious = advisories.some((a) => isMaliciousPackage(a));
+        const category = isMalicious ? "ai_package_malicious" : "suspicious_package";
+        const advIds = advisories.map((a) => a.id).slice(0, 3).join(", ");
+        const moreCount = advisories.length > 3 ? ` +${advisories.length - 3} more` : "";
+        const description = isMalicious ? `Package "${dep.name}" is flagged as MALICIOUS in OSV.dev (${advIds}${moreCount}). This package may contain malware or data exfiltration code.` : `Package "${dep.name}" has ${advisories.length} known security advisories (${advIds}${moreCount}). ${mostSevere.summary || "Review before use."}`;
+        const suggestedFix = isMalicious ? `Remove "${dep.name}" immediately. Do not use this package.` : `Update "${dep.name}" to a patched version or find an alternative. Check: https://osv.dev/list?ecosystem=${ecosystem}&q=${encodeURIComponent(dep.name)}`;
+        vulnerabilities.push({
+          id: `osv-${filePath}-${dep.name}`,
+          filePath,
+          lineNumber: dep.line,
+          lineContent: lines[dep.line - 1]?.trim() || dep.name,
+          severity: highestSeverity,
+          category,
+          title: isMalicious ? `Malicious package: ${dep.name}` : `Vulnerable package: ${dep.name} (${advisories.length} advisories)`,
+          description,
+          suggestedFix,
+          confidence: "high",
+          layer: 3,
+          source: "config",
+          requiresAIValidation: false
+          // OSV data is authoritative
+        });
+        await (0, registry_clients_1.rateLimitDelay)();
+      }
+      return vulnerabilities;
+    }
+  }
+});
+
+// ../scanner/dist/detect/config/package-check.js
+var require_package_check = __commonJS({
+  "../scanner/dist/detect/config/package-check.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LEGITIMATE_PACKAGES = exports2.POPULAR_PYTHON_PACKAGES = exports2.POPULAR_NPM_PACKAGES = void 0;
+    exports2.checkPackages = checkPackages;
+    exports2.levenshteinDistance = levenshteinDistance;
+    exports2.checkTyposquatting = checkTyposquatting;
+    exports2.hasSuspiciousNamingPattern = hasSuspiciousNamingPattern;
+    exports2.computeNPMRiskScore = computeNPMRiskScore;
+    exports2.computePyPIRiskScore = computePyPIRiskScore;
+    var registry_clients_1 = require_registry_clients();
+    var MAX_PACKAGES_TO_CHECK = 50;
+    var POPULAR_NPM_PACKAGES = /* @__PURE__ */ new Set([
+      // Core frameworks
+      "react",
+      "vue",
+      "angular",
+      "svelte",
+      "next",
+      "nuxt",
+      "gatsby",
+      "express",
+      "fastify",
+      "koa",
+      "hapi",
+      "nest",
+      "nestjs",
+      // Utilities
+      "lodash",
+      "underscore",
+      "ramda",
+      "date-fns",
+      "dayjs",
+      "moment",
+      "axios",
+      "node-fetch",
+      "got",
+      "request",
+      "superagent",
+      // Build tools
+      "webpack",
+      "rollup",
+      "vite",
+      "parcel",
+      "esbuild",
+      "swc",
+      "babel",
+      "typescript",
+      "eslint",
+      "prettier",
+      "jest",
+      "vitest",
+      "mocha",
+      // Database
+      "mongoose",
+      "sequelize",
+      "prisma",
+      "typeorm",
+      "knex",
+      "pg",
+      "mysql",
+      "sqlite3",
+      // Other popular
+      "socket.io",
+      "ws",
+      "graphql",
+      "apollo",
+      "redux",
+      "mobx",
+      "zustand",
+      "tailwindcss",
+      "styled-components",
+      "emotion",
+      "sass",
+      "postcss",
+      "dotenv",
+      "cors",
+      "helmet",
+      "morgan",
+      "winston",
+      "pino",
+      "uuid",
+      "crypto-js",
+      "bcrypt",
+      "jsonwebtoken",
+      "passport",
+      "commander",
+      "yargs",
+      "inquirer",
+      "chalk",
+      "ora"
+    ]);
+    exports2.POPULAR_NPM_PACKAGES = POPULAR_NPM_PACKAGES;
+    var POPULAR_PYTHON_PACKAGES = /* @__PURE__ */ new Set([
+      "requests",
+      "flask",
+      "django",
+      "fastapi",
+      "numpy",
+      "pandas",
+      "scipy",
+      "matplotlib",
+      "tensorflow",
+      "pytorch",
+      "torch",
+      "keras",
+      "scikit-learn",
+      "sklearn",
+      "pillow",
+      "opencv-python",
+      "beautifulsoup4",
+      "sqlalchemy",
+      "celery",
+      "redis",
+      "boto3",
+      "pytest",
+      "black",
+      "flake8",
+      "pydantic",
+      "httpx",
+      "aiohttp",
+      "uvicorn",
+      "gunicorn"
+    ]);
+    exports2.POPULAR_PYTHON_PACKAGES = POPULAR_PYTHON_PACKAGES;
+    var LEGITIMATE_PACKAGES = /* @__PURE__ */ new Set([
+      // Scoped packages from trusted orgs
+      "@supabase/ssr",
+      "@supabase/supabase-js",
+      "@supabase/auth-helpers-nextjs",
+      "@anthropic-ai/sdk",
+      "@openai/openai",
+      "@langchain/core",
+      "@langchain/openai",
+      "@octokit/rest",
+      "@octokit/core",
+      "@radix-ui/react-avatar",
+      "@radix-ui/react-dialog",
+      "@radix-ui/react-dropdown-menu",
+      "@radix-ui/react-scroll-area",
+      "@radix-ui/react-slot",
+      "@radix-ui/react-tabs",
+      "@tailwindcss/postcss",
+      "@tailwindcss/typography",
+      "@types/node",
+      "@types/react",
+      "@types/react-dom",
+      // Common packages with unusual names
+      "class-variance-authority",
+      "clsx",
+      "tailwind-merge",
+      "cva",
+      "lucide-react",
+      "next-themes",
+      "sonner",
+      "zod",
+      "zustand",
+      "geist",
+      "sharp",
+      "turbo",
+      "tsup",
+      "tsx",
+      // Known short names
+      "ms",
+      "qs",
+      "ws",
+      "pg",
+      "ip",
+      "os",
+      "fs",
+      "vm"
+    ]);
+    exports2.LEGITIMATE_PACKAGES = LEGITIMATE_PACKAGES;
+    function levenshteinDistance(a, b3) {
+      const matrix = [];
+      for (let i = 0; i <= b3.length; i++) {
+        matrix[i] = [i];
+      }
+      for (let j2 = 0; j2 <= a.length; j2++) {
+        matrix[0][j2] = j2;
+      }
+      for (let i = 1; i <= b3.length; i++) {
+        for (let j2 = 1; j2 <= a.length; j2++) {
+          if (b3.charAt(i - 1) === a.charAt(j2 - 1)) {
+            matrix[i][j2] = matrix[i - 1][j2 - 1];
+          } else {
+            matrix[i][j2] = Math.min(matrix[i - 1][j2 - 1] + 1, matrix[i][j2 - 1] + 1, matrix[i - 1][j2] + 1);
+          }
+        }
+      }
+      return matrix[b3.length][a.length];
+    }
+    function checkTyposquatting(packageName, ecosystem) {
+      const name = packageName.toLowerCase();
+      const popularPackages = ecosystem === "npm" ? POPULAR_NPM_PACKAGES : POPULAR_PYTHON_PACKAGES;
+      for (const popular of popularPackages) {
+        if (name === popular)
+          continue;
+        const distance = levenshteinDistance(name, popular);
+        if (distance === 1 && Math.abs(name.length - popular.length) <= 1) {
+          return { isSimilar: true, similarTo: popular, distance };
+        }
+        if (distance === 2 && name.length >= 5 && Math.abs(name.length - popular.length) <= 1) {
+          return { isSimilar: true, similarTo: popular, distance };
+        }
+      }
+      return { isSimilar: false };
+    }
+    function hasSuspiciousNamingPattern(packageName) {
+      const suspiciousPatterns = [
+        { pattern: /^[a-z]+-js$/, desc: "package-js suffix (common typosquat pattern)" },
+        { pattern: /^node-[a-z]{2,}$/, desc: "node-package prefix" },
+        { pattern: /^[a-z]+-node$/, desc: "package-node suffix" },
+        { pattern: /-\d{3,}$/, desc: "ends with many numbers" },
+        { pattern: /^[a-z]{1,2}-[a-z]+$/, desc: "very short prefix" },
+        { pattern: /[0o][0o]|[1l][1l]/i, desc: "character substitution (0/o, 1/l)" }
+      ];
+      for (const { pattern, desc } of suspiciousPatterns) {
+        if (pattern.test(packageName)) {
+          return { suspicious: true, pattern: desc };
+        }
+      }
+      return { suspicious: false };
+    }
+    async function computeNPMRiskScore(dep, metadata) {
+      const factors = [];
+      let totalScore = 0;
+      if (!metadata) {
+        factors.push({
+          name: "package_not_found",
+          score: 100,
+          description: "Package does not exist in npm registry. Likely a hallucinated package name."
+        });
+        return {
+          package: dep.name,
+          ecosystem: "npm",
+          totalScore: 100,
+          factors,
+          recommendation: "block",
+          severity: "critical"
+        };
+      }
+      const ageInDays = (0, registry_clients_1.calculatePackageAgeDays)(metadata.time?.created);
+      if (ageInDays < 7) {
+        factors.push({
+          name: "very_new_package",
+          score: 30,
+          description: `Package created ${ageInDays} days ago (< 7 days)`
+        });
+        totalScore += 30;
+      } else if (ageInDays < 30) {
+        factors.push({
+          name: "new_package",
+          score: 15,
+          description: `Package created ${ageInDays} days ago (< 30 days)`
+        });
+        totalScore += 15;
+      }
+      const weeklyDownloads = metadata.downloads?.weekly || 0;
+      if (weeklyDownloads < 10) {
+        factors.push({
+          name: "no_downloads",
+          score: 25,
+          description: `Only ${weeklyDownloads} weekly downloads`
+        });
+        totalScore += 25;
+      } else if (weeklyDownloads < 100) {
+        factors.push({
+          name: "low_downloads",
+          score: 15,
+          description: `Only ${weeklyDownloads} weekly downloads (< 100)`
+        });
+        totalScore += 15;
+      } else if (weeklyDownloads < 1e3) {
+        factors.push({
+          name: "moderate_downloads",
+          score: 5,
+          description: `${weeklyDownloads} weekly downloads (< 1000)`
+        });
+        totalScore += 5;
+      }
+      const typoCheck = checkTyposquatting(dep.name, "npm");
+      if (typoCheck.isSimilar && typoCheck.distance === 1) {
+        factors.push({
+          name: "likely_typosquat",
+          score: 40,
+          description: `Name differs by 1 character from popular package "${typoCheck.similarTo}"`
+        });
+        totalScore += 40;
+      } else if (typoCheck.isSimilar && typoCheck.distance === 2) {
+        factors.push({
+          name: "possible_typosquat",
+          score: 20,
+          description: `Name similar to popular package "${typoCheck.similarTo}" (${typoCheck.distance} char diff)`
+        });
+        totalScore += 20;
+      }
+      const namingCheck = hasSuspiciousNamingPattern(dep.name);
+      if (namingCheck.suspicious) {
+        factors.push({
+          name: "suspicious_name",
+          score: 15,
+          description: `Suspicious naming pattern: ${namingCheck.pattern}`
+        });
+        totalScore += 15;
+      }
+      const hasRepo = !!metadata.repository?.url;
+      const hasHomepage = !!metadata.homepage;
+      if (!hasRepo && !hasHomepage) {
+        factors.push({
+          name: "no_source_links",
+          score: 15,
+          description: "Package has no repository or homepage link"
+        });
+        totalScore += 15;
+      }
+      if (!metadata.description || metadata.description.length < 10) {
+        factors.push({
+          name: "no_description",
+          score: 10,
+          description: "Package has no meaningful description"
+        });
+        totalScore += 10;
+      }
+      const maintainerCount = metadata.maintainers?.length || 0;
+      if (maintainerCount === 1 && ageInDays < 30) {
+        factors.push({
+          name: "single_new_maintainer",
+          score: 10,
+          description: "Single maintainer on a new package"
+        });
+        totalScore += 10;
+      }
+      let recommendation;
+      let severity;
+      if (totalScore >= 70) {
+        recommendation = "block";
+        severity = "high";
+      } else if (totalScore >= 40) {
+        recommendation = "review";
+        severity = "medium";
+      } else if (totalScore >= 20) {
+        recommendation = "review";
+        severity = "low";
+      } else {
+        recommendation = "allow";
+        severity = "info";
+      }
+      return {
+        package: dep.name,
+        ecosystem: "npm",
+        totalScore: Math.min(totalScore, 100),
+        factors,
+        recommendation,
+        severity
+      };
+    }
+    async function computePyPIRiskScore(dep, metadata) {
+      const factors = [];
+      let totalScore = 0;
+      if (!metadata) {
+        factors.push({
+          name: "package_not_found",
+          score: 100,
+          description: "Package does not exist in PyPI registry. Likely a hallucinated package name."
+        });
+        return {
+          package: dep.name,
+          ecosystem: "python",
+          totalScore: 100,
+          factors,
+          recommendation: "block",
+          severity: "critical"
+        };
+      }
+      const typoCheck = checkTyposquatting(dep.name, "python");
+      if (typoCheck.isSimilar && typoCheck.distance === 1) {
+        factors.push({
+          name: "likely_typosquat",
+          score: 40,
+          description: `Name differs by 1 character from popular package "${typoCheck.similarTo}"`
+        });
+        totalScore += 40;
+      } else if (typoCheck.isSimilar && typoCheck.distance === 2) {
+        factors.push({
+          name: "possible_typosquat",
+          score: 20,
+          description: `Name similar to popular package "${typoCheck.similarTo}"`
+        });
+        totalScore += 20;
+      }
+      const namingCheck = hasSuspiciousNamingPattern(dep.name);
+      if (namingCheck.suspicious) {
+        factors.push({
+          name: "suspicious_name",
+          score: 15,
+          description: `Suspicious naming pattern: ${namingCheck.pattern}`
+        });
+        totalScore += 15;
+      }
+      const hasProjectUrls = metadata.projectUrls && Object.keys(metadata.projectUrls).length > 0;
+      if (!hasProjectUrls) {
+        factors.push({
+          name: "no_project_urls",
+          score: 15,
+          description: "Package has no project URLs (repository, homepage, etc.)"
+        });
+        totalScore += 15;
+      }
+      if (!metadata.summary || metadata.summary.length < 10) {
+        factors.push({
+          name: "no_description",
+          score: 10,
+          description: "Package has no meaningful description"
+        });
+        totalScore += 10;
+      }
+      let recommendation;
+      let severity;
+      if (totalScore >= 70) {
+        recommendation = "block";
+        severity = "high";
+      } else if (totalScore >= 40) {
+        recommendation = "review";
+        severity = "medium";
+      } else if (totalScore >= 20) {
+        recommendation = "review";
+        severity = "low";
+      } else {
+        recommendation = "allow";
+        severity = "info";
+      }
+      return {
+        package: dep.name,
+        ecosystem: "python",
+        totalScore: Math.min(totalScore, 100),
+        factors,
+        recommendation,
+        severity
+      };
+    }
+    function buildRiskDescription(risk) {
+      const factorList = risk.factors.map((f) => `- ${f.description}`).join("\n");
+      if (risk.totalScore >= 70) {
+        return `Package "${risk.package}" has high risk indicators (score: ${risk.totalScore}/100):
+${factorList}
+
+This may be a hallucinated package name or a typosquatting attempt.`;
+      }
+      if (risk.totalScore >= 40) {
+        return `Package "${risk.package}" has moderate risk indicators (score: ${risk.totalScore}/100):
+${factorList}
+
+Review this dependency before using.`;
+      }
+      return `Package "${risk.package}" has some risk factors (score: ${risk.totalScore}/100):
+${factorList}`;
+    }
+    function buildRiskSuggestedFix(risk) {
+      if (risk.factors.some((f) => f.name === "package_not_found")) {
+        return "Verify the package name is correct. This package does not exist in the registry - it may be a hallucinated name from an AI tool.";
+      }
+      if (risk.factors.some((f) => f.name.includes("typosquat"))) {
+        const typoFactor = risk.factors.find((f) => f.name.includes("typosquat"));
+        const match3 = typoFactor?.description.match(/"([^"]+)"/);
+        const intendedPackage = match3?.[1];
+        return `Verify this is the intended package. Did you mean "${intendedPackage}"?`;
+      }
+      if (risk.totalScore >= 40) {
+        return "Review this package before using. Check the repository, maintainers, and recent activity.";
+      }
+      return "Consider reviewing this package's repository and maintainers.";
+    }
+    async function checkPackages(content, filePath) {
+      const vulnerabilities = [];
+      const fileType = (0, registry_clients_1.getPackageFileType)(filePath);
+      if (!fileType) {
+        return vulnerabilities;
+      }
+      let dependencies = [];
+      if (fileType === "npm" && filePath.endsWith("package.json")) {
+        dependencies = (0, registry_clients_1.extractNpmDependencies)(content);
+      } else if (fileType === "python") {
+        dependencies = (0, registry_clients_1.extractPythonRequirements)(content);
+      }
+      if (dependencies.length === 0) {
+        return vulnerabilities;
+      }
+      const lines = content.split("\n");
+      const packagesToCheck = dependencies.filter((dep) => {
+        if (dep.name.startsWith("@"))
+          return false;
+        if (LEGITIMATE_PACKAGES.has(dep.name))
+          return false;
+        if (POPULAR_NPM_PACKAGES.has(dep.name.toLowerCase()))
+          return false;
+        if (POPULAR_PYTHON_PACKAGES.has(dep.name.toLowerCase()))
+          return false;
+        return true;
+      });
+      const limitedPackages = packagesToCheck.slice(0, MAX_PACKAGES_TO_CHECK);
+      for (const dep of limitedPackages) {
+        let risk;
+        if (fileType === "npm") {
+          const metadata = await (0, registry_clients_1.fetchNPMMetadata)(dep.name);
+          risk = await computeNPMRiskScore(dep, metadata);
+        } else {
+          const metadata = await (0, registry_clients_1.fetchPyPIMetadata)(dep.name);
+          risk = await computePyPIRiskScore(dep, metadata);
+        }
+        if (risk.recommendation !== "allow") {
+          vulnerabilities.push({
+            id: `pkg-risk-${filePath}-${dep.name}`,
+            filePath,
+            lineNumber: dep.line,
+            lineContent: lines[dep.line - 1]?.trim() || dep.name,
+            severity: risk.severity,
+            category: "suspicious_package",
+            title: risk.totalScore >= 70 ? "Potentially hallucinated dependency" : "Suspicious dependency",
+            description: buildRiskDescription(risk),
+            suggestedFix: buildRiskSuggestedFix(risk),
+            confidence: risk.totalScore >= 70 ? "high" : "medium",
+            layer: 3,
+            source: "config",
+            requiresAIValidation: risk.totalScore < 70
+            // High-confidence issues don't need AI validation
+          });
+        }
+        await (0, registry_clients_1.rateLimitDelay)();
+      }
+      return vulnerabilities;
+    }
+  }
+});
+
 // ../scanner/dist/pipeline/index.js
 var require_pipeline2 = __commonJS({
   "../scanner/dist/pipeline/index.js"(exports2) {
@@ -63487,6 +64542,9 @@ var require_pipeline2 = __commonJS({
     var summary_1 = require_summary();
     var dedup_1 = require_dedup();
     var contradictions_1 = require_contradictions();
+    var config_audit_1 = require_config_audit();
+    var osv_check_1 = require_osv_check();
+    var package_check_1 = require_package_check();
     async function runScan2(files, repoInfo, options = {}, onProgress) {
       const startTime = Date.now();
       const allVulnerabilities = [];
@@ -63574,11 +64632,24 @@ var require_pipeline2 = __commonJS({
         const phaseTiming = {
           ...detectorOutput.phaseTiming
         };
-        const beforeAggregationCount = detectorOutput.findings.length;
-        const aggregatedFindings = (0, aggregation_1.aggregateNoisyFindings)(detectorOutput.findings);
+        const enableDepChecks = (options.enableDependencyChecks ?? false) && depth !== "local";
+        let enrichedPostinstallFindings = detectorOutput.findings;
+        if (enableDepChecks) {
+          for (const file of files) {
+            const osvFindings = await (0, osv_check_1.checkPackageAdvisories)(file.content, file.path);
+            const pkgFindings = await (0, package_check_1.checkPackages)(file.content, file.path);
+            enrichedPostinstallFindings.push(...osvFindings, ...pkgFindings);
+          }
+          enrichedPostinstallFindings = await (0, config_audit_1.enrichPostinstallFindings)(enrichedPostinstallFindings);
+          log(`[DepAudit] repo=${repoInfo.name} osv+pkg checks completed`);
+        } else if (depth !== "local") {
+          log(`[DepAudit] repo=${repoInfo.name} skipped=true reason=tier_gated`);
+        }
+        const beforeAggregationCount = enrichedPostinstallFindings.length;
+        const aggregatedFindings = (0, aggregation_1.aggregateNoisyFindings)(enrichedPostinstallFindings);
         if (filterPipeline.isEnabled) {
           const afterIds = new Set(aggregatedFindings.map(fid));
-          for (const v2 of detectorOutput.findings) {
+          for (const v2 of enrichedPostinstallFindings) {
             if (!afterIds.has(fid(v2))) {
               filterPipeline.record(fid(v2), { stage: "noisy_aggregation", action: "aggregated", reason: "Aggregated noisy finding (3+ similar per file)" });
             }
@@ -66844,26 +67915,115 @@ var init_auth_types = __esm({
   }
 });
 
+// ../shared/dist/billing-constants.js
+var init_billing_constants = __esm({
+  "../shared/dist/billing-constants.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/index.js
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
     init_auth_types();
+    init_billing_constants();
   }
 });
 
 // src/utils/api.ts
+function getMaxFilesForTier(tier) {
+  switch (tier) {
+    case "max":
+      return Infinity;
+    case "pro":
+      return 2500;
+    case "starter":
+      return 1e3;
+    default:
+      return 500;
+  }
+}
+function batchFilesForBackend(files, tier) {
+  const maxFiles = getMaxFilesForTier(tier);
+  const capped = files.slice(0, maxFiles === Infinity ? files.length : maxFiles);
+  const truncated = files.length > maxFiles;
+  const batches = [];
+  for (let i = 0; i < capped.length; i += MAX_FILES_PER_REQUEST) {
+    const chunk = capped.slice(i, i + MAX_FILES_PER_REQUEST);
+    const prepared = prepareFilesForBackend(chunk);
+    batches.push(prepared.files);
+  }
+  return { batches, totalFiles: capped.length, truncated };
+}
+async function callBackendAPIBatched(batches, depth, apiKey, repoInfo, onBatchProgress) {
+  if (batches.length === 1) {
+    return callBackendAPI(batches[0], depth, apiKey, repoInfo);
+  }
+  const results = [];
+  for (let i = 0; i < batches.length; i++) {
+    onBatchProgress?.(i + 1, batches.length);
+    const result = await callBackendAPI(batches[i], depth, apiKey, repoInfo);
+    results.push(result);
+  }
+  return mergeResults(results);
+}
+function mergeResults(results) {
+  const merged = {
+    ...results[0],
+    vulnerabilities: [...results[0].vulnerabilities],
+    severityCounts: { ...results[0].severityCounts },
+    categoryCounts: { ...results[0].categoryCounts }
+  };
+  if (merged.validationStats) {
+    merged.validationStats = { ...merged.validationStats };
+  }
+  for (let i = 1; i < results.length; i++) {
+    const r2 = results[i];
+    merged.vulnerabilities.push(...r2.vulnerabilities);
+    merged.filesScanned += r2.filesScanned;
+    merged.filesSkipped += r2.filesSkipped;
+    merged.scanDuration += r2.scanDuration;
+    for (const [sev, count] of Object.entries(r2.severityCounts)) {
+      const key = sev;
+      merged.severityCounts[key] = (merged.severityCounts[key] || 0) + (count || 0);
+    }
+    for (const [cat, count] of Object.entries(r2.categoryCounts)) {
+      const key = cat;
+      merged.categoryCounts[key] = (merged.categoryCounts[key] || 0) + (count || 0);
+    }
+    if (r2.validationStats && merged.validationStats) {
+      merged.validationStats.totalFindings += r2.validationStats.totalFindings;
+      merged.validationStats.validatedFindings += r2.validationStats.validatedFindings;
+      merged.validationStats.confirmedFindings += r2.validationStats.confirmedFindings;
+      merged.validationStats.dismissedFindings += r2.validationStats.dismissedFindings;
+      merged.validationStats.downgradedFindings += r2.validationStats.downgradedFindings;
+      merged.validationStats.autoDismissedFindings += r2.validationStats.autoDismissedFindings;
+      merged.validationStats.estimatedInputTokens += r2.validationStats.estimatedInputTokens;
+      merged.validationStats.estimatedOutputTokens += r2.validationStats.estimatedOutputTokens;
+      merged.validationStats.estimatedCost += r2.validationStats.estimatedCost;
+      merged.validationStats.apiCalls += r2.validationStats.apiCalls;
+      merged.validationStats.cacheCreationTokens += r2.validationStats.cacheCreationTokens;
+      merged.validationStats.cacheReadTokens += r2.validationStats.cacheReadTokens;
+      const totalCacheReads = results.reduce((sum, res) => sum + (res.validationStats?.cacheReadTokens || 0), 0);
+      const totalTokens = results.reduce((sum, res) => sum + (res.validationStats?.estimatedInputTokens || 0), 0);
+      merged.validationStats.cacheHitRate = totalTokens > 0 ? totalCacheReads / totalTokens : 0;
+    }
+    merged.hasBlockingIssues = merged.hasBlockingIssues || r2.hasBlockingIssues;
+  }
+  return merged;
+}
 function prepareFilesForBackend(files) {
   const originalCount = files.length;
   let totalSize = 0;
   const result = [];
   for (const file of files) {
-    if (result.length >= MAX_FILES_FOR_BACKEND) {
+    if (result.length >= MAX_FILES_PER_REQUEST) {
       return {
         files: result,
         truncated: true,
         originalCount,
-        reason: `file count limit (${MAX_FILES_FOR_BACKEND} files)`
+        reason: `file count limit (${MAX_FILES_PER_REQUEST} files)`
       };
     }
     const fileJsonSize = file.content.length + file.path.length + 200;
@@ -67027,7 +68187,7 @@ async function getUsage(apiKey) {
     };
   }
 }
-var APIError, MAX_FILES_FOR_BACKEND, MAX_TOTAL_SIZE_BYTES;
+var APIError, MAX_FILES_PER_REQUEST, MAX_TOTAL_SIZE_BYTES;
 var init_api = __esm({
   "src/utils/api.ts"() {
     "use strict";
@@ -67042,7 +68202,7 @@ var init_api = __esm({
         this.name = "APIError";
       }
     };
-    MAX_FILES_FOR_BACKEND = 500;
+    MAX_FILES_PER_REQUEST = 500;
     MAX_TOTAL_SIZE_BYTES = 4 * 1024 * 1024;
   }
 });
@@ -67076,10 +68236,10 @@ function enhanceAPIError(error) {
       if (error.reason === "insufficient_tier") {
         return {
           message: "This feature requires a Pro subscription",
-          suggestion: "Validated and deep scans require a Pro plan.",
+          suggestion: "Validated scans use AI credits from your plan.",
           category: "auth",
           errorCode: "OCU-E403-TIER",
-          quickFix: "oculum scan . --depth cheap",
+          quickFix: "oculum scan . --depth local",
           learnMoreUrl: "https://oculum.dev/billing",
           recoveryActions: [
             { label: "View pricing", action: "upgrade" },
@@ -67132,10 +68292,10 @@ function enhanceAPIError(error) {
         suggestion: rateLimitSuggestion,
         category: "server",
         errorCode: error.reason === "quota_exceeded" ? "OCU-E429-QUOTA" : "OCU-E429-RATE",
-        quickFix: "oculum scan . --depth cheap",
+        quickFix: "oculum scan . --depth local",
         learnMoreUrl: "https://oculum.dev/dashboard/usage",
         recoveryActions: [
-          { label: "Use free local scan", command: "oculum scan . --depth cheap", action: "fallback" },
+          { label: "Use free local scan", command: "oculum scan . --depth local", action: "fallback" },
           { label: "View usage & upgrade", action: "upgrade" },
           { label: "Retry in 30 seconds", action: "retry" }
         ],
@@ -67149,7 +68309,7 @@ function enhanceAPIError(error) {
         suggestion: "This is temporary. Try again in a few minutes.",
         category: "server",
         errorCode: `OCU-E${error.statusCode}`,
-        quickFix: "oculum scan . --depth cheap",
+        quickFix: "oculum scan . --depth local",
         learnMoreUrl: "https://status.oculum.dev",
         recoveryActions: [
           { label: "Retry", action: "retry" },
@@ -67162,11 +68322,11 @@ function enhanceAPIError(error) {
         suggestion: "The scan may be too large for the server.",
         category: "server",
         errorCode: "OCU-E504",
-        quickFix: "oculum scan . --depth cheap",
+        quickFix: "oculum scan . --depth local",
         learnMoreUrl: "https://oculum.dev/docs/troubleshooting#timeout",
         recoveryActions: [
           { label: "Retry", action: "retry" },
-          { label: "Use quick scan", action: "fallback" }
+          { label: "Use local scan", action: "fallback" }
         ]
       };
     default:
@@ -67181,7 +68341,7 @@ function detectNetworkErrorType(msg) {
   if (msg.includes("econnrefused")) {
     return {
       type: "Connection refused",
-      suggestion: "The Oculum server may be down or unreachable. Try again later or use `--depth cheap` for offline scans."
+      suggestion: "The Oculum server may be down or unreachable. Try again later or use `--depth local` for offline scans."
     };
   }
   if (msg.includes("enotfound") || msg.includes("dns")) {
@@ -67241,10 +68401,10 @@ function enhanceStandardError(error) {
       suggestion: "Your network may be intercepting HTTPS traffic (corporate proxy).",
       category: "network",
       errorCode: "OCU-E003",
-      quickFix: "oculum scan . --depth cheap",
+      quickFix: "oculum scan . --depth local",
       learnMoreUrl: "https://oculum.dev/docs/troubleshooting#ssl",
       recoveryActions: [
-        { label: "Use offline scan", command: "oculum scan . --depth cheap", action: "fallback" },
+        { label: "Use offline scan", command: "oculum scan . --depth local", action: "fallback" },
         { label: "View help", action: "help" }
       ]
     };
@@ -67256,7 +68416,7 @@ function enhanceStandardError(error) {
       suggestion,
       category: "network",
       errorCode: "OCU-E004",
-      quickFix: "oculum scan . --depth cheap",
+      quickFix: "oculum scan . --depth local",
       learnMoreUrl: "https://oculum.dev/docs/troubleshooting#network",
       recoveryActions: [
         { label: "Retry", action: "retry" },
@@ -68116,29 +69276,35 @@ async function runScanOnce(targetPath, options, ignorePatterns = []) {
     spinner.start("Starting scan...");
     const hasLocalAI = !!(process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY);
     if (options.depth !== "local" && isAuthenticated() && !hasLocalAI) {
-      const prepared = prepareFilesForBackend(files);
-      if (prepared.truncated) {
+      const { batches, totalFiles, truncated } = batchFilesForBackend(files, config.tier);
+      if (truncated) {
         spinner.warn(source_default.yellow(
-          `Truncating scan from ${prepared.originalCount} to ${prepared.files.length} files due to ${prepared.reason}`
+          `Truncating scan from ${files.length} to ${totalFiles} files (${config.tier || "free"} plan limit)`
         ));
         if (!options.quiet) {
-          console.log(source_default.dim("  Tip: Use --ignore patterns to exclude files, or scan a subdirectory"));
+          console.log(source_default.dim("  Tip: Upgrade to Pro or Max for higher limits"));
           console.log("");
         }
       }
-      spinner.text = `Backend ${options.depth} scan analyzing ${prepared.files.length} files...`;
-      result = await callBackendAPI(
-        prepared.files,
+      if (batches.length > 1 && !options.quiet) {
+        console.log(source_default.dim(`  Scanning ${totalFiles} files in ${batches.length} batches`));
+      }
+      spinner.text = `Backend ${options.depth} scan analyzing ${totalFiles} files...`;
+      result = await callBackendAPIBatched(
+        batches,
         options.depth,
         config.apiKey,
         {
           name: (0, import_path4.basename)((0, import_path4.resolve)(targetPath)),
           url: "",
           branch: "local"
+        },
+        (batch, total) => {
+          spinner.text = `Backend ${options.depth} scan \u2014 batch ${batch}/${total}...`;
         }
       );
-      if (prepared.truncated) {
-        result.filesSkipped = prepared.originalCount - prepared.files.length;
+      if (truncated) {
+        result.filesSkipped = files.length - totalFiles;
       }
       spinner.succeed(`Backend ${options.depth} scan complete`);
     } else {
@@ -68496,7 +69662,7 @@ var init_scan = __esm({
       stopAndPersist: () => quietSpinner,
       text: ""
     };
-    scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: local (free), verified, deep").option("-m, --mode <mode>", "alias for --depth (local, verified, deep)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown").option("--fail-on <severity>", "exit with error code if findings at severity").option("--fail-on-categories <categories>", "fail only on specific categories (comma-separated, supports wildcards like ai-*)").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-v, --verbose", "show additional details (references, validation notes)").option("-c, --compact", "minimal output (severity + title + location only)").option("-o, --output <file>", "write output to file").option("-p, --profile <name>", "use named profile from oculum.config.json").option("-i, --ignore <pattern...>", "ignore files matching pattern (can be used multiple times)").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").option("--show-suppressed", "include suppressed findings in output").option("--new", "only show findings new since baseline").option("--all", "show all findings (default, ignores baseline)").option("--ai-context", "generate .oculum/ai-context.md for AI assistants").option("--cursor", "generate .cursor/rules/security.mdc for Cursor IDE").option("--windsurf", "generate .windsurfrules for Windsurf IDE").option("--claude-code", "update CLAUDE.md with security section").option("--ide-rules", "auto-detect and update all IDE configs").option("--clear", "clear IDE rule files (use after fixing issues)").addHelpText("after", `
+    scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: local (free), verified").option("-m, --mode <mode>", "alias for --depth (local, verified)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown").option("--fail-on <severity>", "exit with error code if findings at severity").option("--fail-on-categories <categories>", "fail only on specific categories (comma-separated, supports wildcards like ai-*)").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-v, --verbose", "show additional details (references, validation notes)").option("-c, --compact", "minimal output (severity + title + location only)").option("-o, --output <file>", "write output to file").option("-p, --profile <name>", "use named profile from oculum.config.json").option("-i, --ignore <pattern...>", "ignore files matching pattern (can be used multiple times)").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").option("--show-suppressed", "include suppressed findings in output").option("--new", "only show findings new since baseline").option("--all", "show all findings (default, ignores baseline)").option("--ai-context", "generate .oculum/ai-context.md for AI assistants").option("--cursor", "generate .cursor/rules/security.mdc for Cursor IDE").option("--windsurf", "generate .windsurfrules for Windsurf IDE").option("--claude-code", "update CLAUDE.md with security section").option("--ide-rules", "auto-detect and update all IDE configs").option("--clear", "clear IDE rule files (use after fixing issues)").addHelpText("after", `
 Scan Modes:
   local       Free      Fast pattern matching, runs locally
                         Best for: Quick checks, CI/CD pipelines
@@ -68504,9 +69670,6 @@ Scan Modes:
   verified    ~$0.03    AI validates findings, ~70% fewer false positives
                         Best for: Pre-commit checks, PR reviews
 
-  deep        ~$0.10    Full semantic analysis with AI reasoning
-                        Best for: Security audits, release checks
-
 Examples:
   $ oculum scan .                      Scan current directory (free)
   $ oculum scan . -d verified          AI-verified scan
@@ -70405,7 +71568,7 @@ async function watch2(targetPath, options) {
     console.log(source_default.dim("  " + "\u2500".repeat(50)));
     console.log("");
     console.log(source_default.dim("  Watching: ") + source_default.white(absolutePath));
-    console.log(source_default.dim("  Depth:    ") + source_default.white(options.depth === "local" ? "Quick (pattern matching)" : options.depth));
+    console.log(source_default.dim("  Depth:    ") + source_default.white(options.depth === "local" ? "Local (pattern matching)" : options.depth));
     console.log(source_default.dim("  Status:   ") + (isPaused ? source_default.yellow("Paused") : source_default.green("Active")));
     if (scanCount > 0) {
       console.log(source_default.dim("  Scans:    ") + source_default.white(`${scanCount} (${totalIssues} issues found)`));
@@ -70739,7 +71902,7 @@ var init_watch = __esm({
       "**/.env.*.local",
       "**/**.env"
     ];
-    watchCommand = new Command("watch").description("Watch files and scan on changes").argument("[path]", "path to watch", ".").option("-d, --depth <depth>", "scan depth: local, verified, deep", "local").option("--debounce <ms>", "debounce time in milliseconds", "500").option("--cooldown <seconds>", "minimum seconds between scans", "10").option("--clear", "clear console before each scan", false).option("-q, --quiet", "minimal output (only show findings)").addHelpText("after", `
+    watchCommand = new Command("watch").description("Watch files and scan on changes").argument("[path]", "path to watch", ".").option("-d, --depth <depth>", "scan depth: local, verified", "local").option("--debounce <ms>", "debounce time in milliseconds", "500").option("--cooldown <seconds>", "minimum seconds between scans", "10").option("--clear", "clear console before each scan", false).option("-q, --quiet", "minimal output (only show findings)").addHelpText("after", `
 Examples:
   $ oculum watch .              # Watch current directory
   $ oculum watch ./src          # Watch specific directory
@@ -71155,7 +72318,7 @@ Files:
   Baseline is saved to .oculum/baseline.json
   Add this to .gitignore or commit to share across team
 `);
-    baselineCommand.command("create").description("Create a baseline from current scan").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: local (default), verified, deep", "local").option("-q, --quiet", "minimal output").action(createBaseline);
+    baselineCommand.command("create").description("Create a baseline from current scan").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: local (default), verified", "local").option("-q, --quiet", "minimal output").action(createBaseline);
     baselineCommand.command("show").description("Show baseline summary").argument("[path]", "project path", ".").action(showBaseline);
     baselineCommand.command("clear").description("Remove baseline").argument("[path]", "project path", ".").action(clearBaseline);
   }
@@ -72333,7 +73496,7 @@ function renderLogo() {
 }
 function renderHeader() {
   const config = getConfig();
-  const version = true ? "1.0.19" : "0.0.0";
+  const version = true ? "1.0.20" : "0.0.0";
   const authState = isAuthenticated() ? `${config.email || config.tier || "authenticated"}` : "local";
   console.log("");
   console.log(source_default.bold(`oculum v${version}`) + source_default.dim(` | ${authState}`));
@@ -72434,8 +73597,7 @@ async function runConfigure(initialPath) {
     message: "Scan depth",
     options: [
       { value: "local", label: "local", hint: "Free, pattern matching" },
-      { value: "verified", label: "verified", hint: "~$0.03, AI validation" },
-      { value: "deep", label: "deep", hint: "~$0.10, full AI analysis" }
+      { value: "verified", label: "verified", hint: "~$0.03, AI validation" }
     ]
   });
   if (pD(depth)) return null;
@@ -72459,8 +73621,8 @@ async function handleScan(args) {
     console.log(source_default.red(`Path not found: ${targetPath}`));
     return;
   }
-  if (!["local", "verified", "deep"].includes(depth)) {
-    console.log(source_default.red(`Invalid depth: ${depth}`) + source_default.dim(" (use local, verified, or deep)"));
+  if (!["local", "verified"].includes(depth)) {
+    console.log(source_default.red(`Invalid depth: ${depth}`) + source_default.dim(" (use local or verified)"));
     return;
   }
   const options = {
@@ -72816,7 +73978,7 @@ function showCommandTable() {
     console.log(`  ${source_default.cyan(cmd.padEnd(28))} ${source_default.dim(desc)}`);
   }
   console.log("");
-  console.log(source_default.dim("  /help scan-modes  - Compare scan depths"));
+  console.log(source_default.dim("  help scan-modes  - Compare scan depths"));
   console.log("");
 }
 function showScanModes2() {
@@ -72826,9 +73988,8 @@ function showScanModes2() {
   console.log("");
   console.log(source_default.green("  local     ") + source_default.white("Free  ") + source_default.dim("Pattern matching + heuristics"));
   console.log(source_default.blue("  verified  ") + source_default.white("~$0.03") + source_default.dim(" AI validation, ~70% fewer FPs"));
-  console.log(source_default.magenta("  deep      ") + source_default.white("~$0.10") + source_default.dim(" Full semantic analysis"));
   console.log("");
-  console.log(source_default.dim("  Usage: /scan . -d verified"));
+  console.log(source_default.dim("  Usage: scan . -d verified"));
   console.log("");
 }
 var COMMAND_TABLE, TOPICS2;
@@ -72837,20 +73998,20 @@ var init_help = __esm({
     "use strict";
     init_source();
     COMMAND_TABLE = [
-      { cmd: "/scan [path]", desc: "Scan for vulnerabilities (default: current dir)" },
-      { cmd: "/scan [path] -d verified", desc: "AI-verified scan" },
-      { cmd: "/scan --configure", desc: "Configure scan with prompts" },
-      { cmd: "/show [n]", desc: "View finding details from last scan" },
-      { cmd: "/fix [n]", desc: "Show fix suggestions" },
-      { cmd: "/watch [path]", desc: "Watch files and scan on changes" },
-      { cmd: "/baseline <cmd>", desc: "Manage scan baselines" },
-      { cmd: "/ignore [hash]", desc: "Manage finding suppressions" },
-      { cmd: "/history", desc: "View scan history" },
-      { cmd: "/login", desc: "Authenticate with Oculum" },
-      { cmd: "/logout", desc: "Clear authentication" },
-      { cmd: "/status", desc: "Check auth status" },
-      { cmd: "/usage", desc: "View credits and quota" },
-      { cmd: "/exit", desc: "Exit" }
+      { cmd: "scan [path]", desc: "Scan for vulnerabilities (default: current dir)" },
+      { cmd: "scan [path] -d verified", desc: "AI-verified scan" },
+      { cmd: "scan --configure", desc: "Configure scan with prompts" },
+      { cmd: "show [n]", desc: "View finding details from last scan" },
+      { cmd: "fix [n]", desc: "Show fix suggestions" },
+      { cmd: "watch [path]", desc: "Watch files and scan on changes" },
+      { cmd: "baseline <cmd>", desc: "Manage scan baselines" },
+      { cmd: "ignore [hash]", desc: "Manage finding suppressions" },
+      { cmd: "history", desc: "View scan history" },
+      { cmd: "login", desc: "Authenticate with Oculum" },
+      { cmd: "logout", desc: "Clear authentication" },
+      { cmd: "status", desc: "Check auth status" },
+      { cmd: "usage", desc: "View credits and quota" },
+      { cmd: "exit", desc: "Exit" }
     ];
     TOPICS2 = {
       "scan-modes": showScanModes2,
@@ -72971,9 +74132,9 @@ function suggestCommand(input) {
   const names = Object.keys(COMMANDS);
   const match3 = names.find((n) => n.startsWith(input));
   if (match3) {
-    console.log(source_default.yellow(`Unknown command: ${input}`) + source_default.dim(` Did you mean /${match3}?`));
+    console.log(source_default.yellow(`Unknown command: ${input}`) + source_default.dim(` Did you mean ${match3}?`));
   } else {
-    console.log(source_default.yellow(`Unknown command: ${input}`) + source_default.dim(" Type /help for available commands."));
+    console.log(source_default.yellow(`Unknown command: ${input}`) + source_default.dim(" Type help for available commands."));
   }
 }
 var COMMANDS;
@@ -72991,8 +74152,8 @@ var init_command_router = __esm({
       scan: {
         description: "Scan for vulnerabilities",
         flags: [
-          { name: "-d", description: "Scan depth (local, verified, deep)", takesValue: true },
-          { name: "--depth", description: "Scan depth (local, verified, deep)", takesValue: true },
+          { name: "-d", description: "Scan depth", takesValue: true, values: ["local", "verified"] },
+          { name: "--depth", description: "Scan depth", takesValue: true, values: ["local", "verified"] },
           { name: "--configure", description: "Interactive scan configuration" }
         ]
       },
@@ -73024,8 +74185,8 @@ var init_command_router = __esm({
       watch: {
         description: "Watch files and scan on changes",
         flags: [
-          { name: "-d", description: "Scan depth (local, verified, deep)", takesValue: true },
-          { name: "--depth", description: "Scan depth (local, verified, deep)", takesValue: true },
+          { name: "-d", description: "Scan depth", takesValue: true, values: ["local", "verified"] },
+          { name: "--depth", description: "Scan depth", takesValue: true, values: ["local", "verified"] },
           { name: "--debounce", description: "Debounce time in milliseconds", takesValue: true },
           { name: "--cooldown", description: "Min seconds between scans", takesValue: true },
           { name: "--clear", description: "Clear console before each scan" },
@@ -73049,8 +74210,8 @@ var init_command_router = __esm({
         flags: [
           { name: "-a", description: "Show all fix suggestions" },
           { name: "--all", description: "Show all fix suggestions" },
-          { name: "-s", description: "Filter by severity level", takesValue: true },
-          { name: "--severity", description: "Filter by severity level", takesValue: true }
+          { name: "-s", description: "Filter by severity", takesValue: true, values: ["critical", "high", "medium", "low", "info"] },
+          { name: "--severity", description: "Filter by severity", takesValue: true, values: ["critical", "high", "medium", "low", "info"] }
         ]
       },
       baseline: {
@@ -73059,7 +74220,7 @@ var init_command_router = __esm({
           { name: "create", description: "Create baseline from current scan" },
           { name: "show", description: "Display baseline summary" },
           { name: "clear", description: "Remove the baseline file" },
-          { name: "-d", description: "Scan depth for create", takesValue: true },
+          { name: "-d", description: "Scan depth for create", takesValue: true, values: ["local", "verified"] },
           { name: "-q", description: "Minimal output" }
         ]
       },
@@ -73095,18 +74256,18 @@ async function promptLine(prompt, commands) {
     let suggestions = [];
     const cols = process.stdout.columns || 80;
     function getCommandSuggestions() {
-      if (!input.startsWith("/") || input.includes(" ")) return [];
-      const prefix = input.slice(1).toLowerCase();
+      if (input.includes(" ")) return [];
+      const prefix = (input.startsWith("/") ? input.slice(1) : input).toLowerCase();
       return commands.filter((c) => c.name.toLowerCase().startsWith(prefix)).slice(0, MAX_SUGGESTIONS).map((c) => ({
-        label: `/${c.name}`,
+        label: c.name,
         description: c.description,
-        completion: `/${c.name} `
+        completion: c.name + " "
       }));
     }
     function getFlagSuggestions() {
-      if (!input.startsWith("/") || !input.includes(" ")) return [];
+      if (!input.includes(" ")) return [];
       const parts = input.split(/\s+/);
-      const cmdName = parts[0].slice(1).toLowerCase();
+      const cmdName = (parts[0].startsWith("/") ? parts[0].slice(1) : parts[0]).toLowerCase();
       const cmd = commands.find((c) => c.name === cmdName);
       if (!cmd?.flags) return [];
       const lastSpace = input.lastIndexOf(" ");
@@ -73128,13 +74289,35 @@ async function promptLine(prompt, commands) {
         completion: f.name + (f.takesValue ? " " : " ")
       }));
     }
+    function getValueSuggestions() {
+      if (!input.includes(" ")) return [];
+      const parts = input.split(/\s+/);
+      const cmdName = (parts[0].startsWith("/") ? parts[0].slice(1) : parts[0]).toLowerCase();
+      const cmd = commands.find((c) => c.name === cmdName);
+      if (!cmd?.flags) return [];
+      const lastSpace = input.lastIndexOf(" ");
+      const currentToken = input.slice(lastSpace + 1).toLowerCase();
+      if (cursor <= lastSpace) return [];
+      const beforeCurrent = input.slice(0, lastSpace).trimEnd();
+      const prevParts = beforeCurrent.split(/\s+/);
+      const prevToken = prevParts[prevParts.length - 1];
+      const flag = cmd.flags.find((f) => f.name === prevToken && f.takesValue && f.values);
+      if (!flag?.values) return [];
+      return flag.values.filter((v2) => !currentToken || v2.toLowerCase().startsWith(currentToken)).slice(0, MAX_SUGGESTIONS).map((v2) => ({
+        label: v2,
+        description: `${flag.name} ${v2}`,
+        completion: v2 + " "
+      }));
+    }
     function getSuggestions() {
       const cmdSuggestions = getCommandSuggestions();
       if (cmdSuggestions.length > 0) return cmdSuggestions;
+      const valueSuggestions = getValueSuggestions();
+      if (valueSuggestions.length > 0) return valueSuggestions;
       return getFlagSuggestions();
     }
     function isCommandMode() {
-      return input.startsWith("/") && !input.includes(" ");
+      return !input.includes(" ");
     }
     function render() {
       suggestions = getSuggestions();
@@ -73147,16 +74330,16 @@ async function promptLine(prompt, commands) {
       if (suggestions.length > 0) {
         for (let i = 0; i < suggestions.length; i++) {
           const sg = suggestions[i];
-          const label = `  ${sg.label}`;
+          const label = sg.label;
           const desc = sg.description;
-          const pad = Math.max(1, 20 - label.length);
-          const maxDesc = cols - label.length - pad - 2;
+          const pad = Math.max(1, 18 - label.length);
+          const maxDesc = cols - label.length - pad - 6;
           const truncDesc = desc.length > maxDesc ? desc.slice(0, maxDesc - 1) + "\u2026" : desc;
           out += "\n";
           if (i === selectedIndex) {
-            out += `\x1B[7m${label}${" ".repeat(pad)}${truncDesc}\x1B[27m`;
+            out += `  \x1B[36m\u25B8\x1B[0m \x1B[1m${label}\x1B[0m${" ".repeat(pad)}\x1B[2m${truncDesc}\x1B[22m`;
           } else {
-            out += `\x1B[2m${label}${" ".repeat(pad)}${truncDesc}\x1B[22m`;
+            out += `    \x1B[2m${label}${" ".repeat(pad)}${truncDesc}\x1B[22m`;
           }
         }
         out += `\x1B[${suggestions.length}A`;
@@ -73208,17 +74391,9 @@ async function promptLine(prompt, commands) {
       }
       if (s === "\r" || s === "\n") {
         if (suggestions.length > 0 && isCommandMode()) {
-          const typed = input.slice(1).toLowerCase();
-          const exactMatch = commands.some((c) => c.name.toLowerCase() === typed);
-          if (exactMatch) {
-            submit(input);
-            return;
-          }
           completeSuggestion();
-          render();
-          return;
         }
-        submit(input);
+        submit(input.trimEnd());
         return;
       }
       if (s === "	") {
@@ -73274,6 +74449,19 @@ async function promptLine(prompt, commands) {
         render();
         return;
       }
+      if (s === "") {
+        if (cursor > 0) {
+          let end = cursor;
+          while (end > 0 && input[end - 1] === " ") end--;
+          let start = end;
+          while (start > 0 && input[start - 1] !== " ") start--;
+          input = input.slice(0, start) + input.slice(cursor);
+          cursor = start;
+          selectedIndex = 0;
+        }
+        render();
+        return;
+      }
       if (s === "") {
         input = "";
         cursor = 0;
@@ -73331,7 +74519,7 @@ async function startREPL() {
   renderLogo();
   renderHeader();
   if (isFirstTimeUser()) {
-    console.log(source_default.dim("Welcome to Oculum! Type /help to see commands, or /scan to get started."));
+    console.log(source_default.dim("Welcome to Oculum! Type help to see commands, or scan to get started."));
     console.log("");
   }
   const commandList = Object.entries(COMMANDS).filter(([name]) => name !== "quit").map(([name, def]) => ({ name, description: def.description, flags: def.flags }));
@@ -73471,7 +74659,7 @@ async function status() {
     console.log(source_default.yellow("  Status: ") + source_default.white("Not logged in"));
     console.log("");
     console.log(source_default.dim("  You can use Oculum without logging in for free local scans."));
-    console.log(source_default.dim("  Login to unlock AI-powered validation and deep analysis."));
+    console.log(source_default.dim("  Login to unlock AI-powered validation."));
     console.log("");
     console.log(source_default.bold("  Quick Start:"));
     console.log(source_default.cyan("    oculum scan .") + source_default.dim("        Free pattern-based scan"));
@@ -73504,13 +74692,7 @@ async function status() {
   console.log(source_default.bold("  Available Scan Depths:"));
   console.log("");
   console.log(source_default.green("  \u2713 ") + source_default.white("local") + source_default.dim("      Fast pattern matching (always free)"));
-  if (normalizedTier === "pro" || normalizedTier === "max") {
-    console.log(source_default.green("  \u2713 ") + source_default.white("verified") + source_default.dim("   AI validation (~70% fewer false positives)"));
-    console.log(source_default.dim("    ") + source_default.white("deep") + source_default.dim("       Multi-agent analysis (coming soon)"));
-  } else {
-    console.log(source_default.dim("    ") + source_default.white("verified") + source_default.dim("   AI validation (requires Pro)"));
-    console.log(source_default.dim("    ") + source_default.white("deep") + source_default.dim("       Multi-agent analysis (requires Pro)"));
-  }
+  console.log(source_default.green("  \u2713 ") + source_default.white("verified") + source_default.dim("   AI validation (~70% fewer false positives)"));
   console.log("");
   console.log(source_default.dim("  Manage subscription: ") + source_default.cyan("https://oculum.dev/billing"));
   console.log("");
@@ -73687,7 +74869,7 @@ function showTopicList() {
   console.log(source_default.bold("\nOculum Help Topics\n"));
   console.log(source_default.dim("\u2500".repeat(50)));
   console.log();
-  console.log(source_default.cyan("  scan-modes      ") + source_default.white("Compare local, verified, and deep scans"));
+  console.log(source_default.cyan("  scan-modes      ") + source_default.white("Compare local and verified scans"));
   console.log(source_default.cyan("  ci-setup        ") + source_default.white("GitHub Actions and GitLab CI examples"));
   console.log(source_default.cyan("  config          ") + source_default.white("Configuration file documentation"));
   console.log(source_default.cyan("  troubleshooting ") + source_default.white("Common issues and solutions"));
@@ -73699,7 +74881,7 @@ function showTopicList() {
 function showScanModes() {
   console.log(source_default.bold("\nScan Modes Comparison\n"));
   console.log(source_default.dim("\u2500".repeat(60) + "\n"));
-  console.log(source_default.green.bold("  LOCAL (Quick Scan)"));
+  console.log(source_default.green.bold("  LOCAL (Pattern Matching)"));
   console.log(source_default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log(source_default.white("  Cost:       ") + source_default.green("Free"));
   console.log(source_default.white("  Speed:      ") + source_default.white("~1000 files/second"));
@@ -73713,18 +74895,10 @@ function showScanModes() {
   console.log(source_default.white("  How:        ") + source_default.dim("Pattern matching + AI validation"));
   console.log(source_default.white("  Best for:   ") + source_default.dim("Pre-commit checks, PR reviews"));
   console.log(source_default.white("  Benefit:    ") + source_default.dim("~70% fewer false positives\n"));
-  console.log(source_default.magenta.bold("  DEEP"));
-  console.log(source_default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(source_default.white("  Cost:       ") + source_default.yellow("~$0.10 per 300 files"));
-  console.log(source_default.white("  Speed:      ") + source_default.white("~60 seconds for 300 files"));
-  console.log(source_default.white("  How:        ") + source_default.dim("Full semantic analysis with AI reasoning"));
-  console.log(source_default.white("  Best for:   ") + source_default.dim("Security audits, release checks"));
-  console.log(source_default.white("  Benefit:    ") + source_default.dim("Deepest analysis, remediation advice\n"));
   console.log(source_default.dim("\u2500".repeat(60)));
   console.log(source_default.bold("\nUsage Examples:\n"));
   console.log(source_default.dim("  $ oculum scan .                ") + source_default.white("# Quick scan (free)"));
   console.log(source_default.dim("  $ oculum scan . -d verified    ") + source_default.white("# AI-verified scan"));
-  console.log(source_default.dim("  $ oculum scan . -d deep        ") + source_default.white("# Deep semantic analysis"));
   console.log();
 }
 function showCISetup() {
@@ -73787,7 +74961,7 @@ function showConfig() {
   }`));
   console.log(source_default.dim("\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
   console.log(source_default.bold("  Config Options\n"));
-  console.log(source_default.white("  depth      ") + source_default.dim("Scan depth: local | verified | deep"));
+  console.log(source_default.white("  depth      ") + source_default.dim("Scan depth: local | verified"));
   console.log(source_default.white("  failOn     ") + source_default.dim("Exit code 1 on: critical | high | medium | low | none"));
   console.log(source_default.white("  format     ") + source_default.dim("Output format: terminal | json | sarif | markdown"));
   console.log(source_default.white("  output     ") + source_default.dim("Output file path"));
@@ -73813,7 +74987,7 @@ function showTroubleshooting() {
   console.log(source_default.dim("    \u2192 Run `oculum login` to re-authenticate"));
   console.log(source_default.dim("    \u2192 Check key at https://oculum.dev/dashboard/api-keys\n"));
   console.log(source_default.white('  "Insufficient tier"'));
-  console.log(source_default.dim("    \u2192 Validated/deep scans require Pro subscription"));
+  console.log(source_default.dim("    \u2192 Validated scans use AI credits from your plan"));
   console.log(source_default.dim("    \u2192 Visit https://oculum.dev/billing to upgrade\n"));
   console.log(source_default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
   console.log(source_default.yellow.bold("  Network Errors\n"));
@@ -74109,7 +75283,7 @@ function shouldRunUI() {
   return isOcAlias || isUICommand;
 }
 var program2 = new Command();
-program2.name("oculum").description("AI-native security scanner for detecting vulnerabilities in LLM-generated code").version("1.0.19").addHelpText("after", `
+program2.name("oculum").description("AI-native security scanner for detecting vulnerabilities in LLM-generated code").version("1.0.20").addHelpText("after", `
 Quick Start:
   $ oculum scan .          Scan current directory (free)
   $ oculum show 1          View finding details