@oculum/cli 1.0.2 → 1.0.3

package/dist/index.js

@@ -14406,6 +14406,44 @@ var require_layer1 = __commonJS({
     var weak_crypto_1 = require_weak_crypto();
     var tiers_1 = require_tiers();
     var path_exclusions_1 = require_path_exclusions();
+    function processFileLayer1(file) {
+      const stats = {
+        known_secrets: 0,
+        weak_crypto: 0,
+        sensitive_urls: 0,
+        entropy: 0,
+        config_audit: 0,
+        file_flags: 0,
+        ai_comments: 0
+      };
+      const entropyFindings = (0, entropy_1.detectHighEntropyStrings)(file.content, file.path);
+      const patternFindings = (0, patterns_1.detectKnownPatterns)(file.content, file.path);
+      const configFindings = (0, config_audit_1.auditConfiguration)(file.content, file.path);
+      const fileFlags = (0, file_flags_1.detectDangerousFiles)(file.content, file.path);
+      const commentFindings = (0, comments_1.detectAICommentPatterns)(file.content, file.path);
+      const urlFindings = (0, urls_1.detectSensitiveURLs)(file.content, file.path);
+      const cryptoFindings = (0, weak_crypto_1.detectWeakCrypto)(file.content, file.path);
+      stats.entropy = entropyFindings.length;
+      stats.known_secrets = patternFindings.length;
+      stats.config_audit = configFindings.length;
+      stats.file_flags = fileFlags.length;
+      stats.ai_comments = commentFindings.length;
+      stats.sensitive_urls = urlFindings.length;
+      stats.weak_crypto = cryptoFindings.length;
+      return {
+        findings: [
+          ...entropyFindings,
+          ...patternFindings,
+          ...configFindings,
+          ...fileFlags,
+          ...commentFindings,
+          ...urlFindings,
+          ...cryptoFindings
+        ],
+        stats
+      };
+    }
+    var LAYER1_PARALLEL_BATCH_SIZE = 50;
     async function runLayer1Scan(files) {
       const startTime = Date.now();
       const vulnerabilities = [];
@@ -14418,50 +14456,24 @@ var require_layer1 = __commonJS({
         file_flags: 0,
         ai_comments: 0
       };
-      for (const file of files) {
-        const entropyFindings = (0, entropy_1.detectHighEntropyStrings)(file.content, file.path);
-        const patternFindings = (0, patterns_1.detectKnownPatterns)(file.content, file.path);
-        const configFindings = (0, config_audit_1.auditConfiguration)(file.content, file.path);
-        const fileFlags = (0, file_flags_1.detectDangerousFiles)(file.content, file.path);
-        const commentFindings = (0, comments_1.detectAICommentPatterns)(file.content, file.path);
-        const urlFindings = (0, urls_1.detectSensitiveURLs)(file.content, file.path);
-        const cryptoFindings = (0, weak_crypto_1.detectWeakCrypto)(file.content, file.path);
-        rawStats.entropy += entropyFindings.length;
-        rawStats.known_secrets += patternFindings.length;
-        rawStats.config_audit += configFindings.length;
-        rawStats.file_flags += fileFlags.length;
-        rawStats.ai_comments += commentFindings.length;
-        rawStats.sensitive_urls += urlFindings.length;
-        rawStats.weak_crypto += cryptoFindings.length;
-        vulnerabilities.push(...entropyFindings, ...patternFindings, ...configFindings, ...fileFlags, ...commentFindings, ...urlFindings, ...cryptoFindings);
+      for (let i = 0; i < files.length; i += LAYER1_PARALLEL_BATCH_SIZE) {
+        const batch = files.slice(i, i + LAYER1_PARALLEL_BATCH_SIZE);
+        const results = await Promise.all(batch.map((file) => Promise.resolve(processFileLayer1(file))));
+        for (const result of results) {
+          vulnerabilities.push(...result.findings);
+          for (const [key, value] of Object.entries(result.stats)) {
+            rawStats[key] += value;
+          }
+        }
       }
       const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
       const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities);
-      if (suppressed.length > 0) {
-        const byReason = {};
-        for (const s of suppressed) {
-          const reason = s.reason || "unknown";
-          byReason[reason] = (byReason[reason] || 0) + 1;
-        }
-        console.log(`[Layer 1] Suppressed ${suppressed.length} findings in test/seed/example files:`);
-        for (const [reason, count] of Object.entries(byReason)) {
-          console.log(`  - ${reason}: ${count}`);
-        }
-      }
       const dedupedStats = {};
       for (const vuln of uniqueVulnerabilities) {
         const cat = vuln.category;
         dedupedStats[cat] = (dedupedStats[cat] || 0) + 1;
       }
       const tierStats = (0, tiers_1.computeTierStats)(uniqueVulnerabilities.map((v2) => ({ category: v2.category, layer: 1 })));
-      console.log("[Layer 1] Heuristic breakdown (raw findings before dedupe):");
-      for (const [name, count] of Object.entries(rawStats)) {
-        if (count > 0) {
-          const tier = (0, tiers_1.getLayer1DetectorTier)(name);
-          console.log(`  - ${name}: ${count} (${tier})`);
-        }
-      }
-      console.log(`[Layer 1] Tier breakdown (after dedupe): ${(0, tiers_1.formatTierStats)(tierStats)}`);
       return {
         vulnerabilities: uniqueVulnerabilities,
         filesScanned: files.length,
@@ -20677,6 +20689,85 @@ var require_layer2 = __commonJS({
     var ai_endpoint_protection_1 = require_ai_endpoint_protection();
     var ai_schema_validation_1 = require_ai_schema_validation();
     var tiers_1 = require_tiers();
+    function processFileLayer2(file, options, authHelperContext) {
+      const stats = {
+        variables: 0,
+        logicGates: 0,
+        dangerousFunctions: 0,
+        riskyImports: 0,
+        authAntipatterns: 0,
+        frameworkIssues: 0,
+        aiFingerprints: 0,
+        dataExposure: 0,
+        byokPatterns: 0,
+        promptHygiene: 0,
+        executionSinks: 0,
+        agentTools: 0,
+        ragSafety: 0,
+        endpointProtection: 0,
+        schemaValidation: 0
+      };
+      if (!isCodeFile(file.path)) {
+        return { findings: [], stats };
+      }
+      const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path);
+      const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path);
+      const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path);
+      const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path);
+      const authFindings = (0, auth_antipatterns_1.detectAuthAntipatterns)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig,
+        authHelpers: authHelperContext,
+        fileAuthImports: options.fileAuthImports
+      });
+      const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path);
+      const aiFindings = (0, ai_fingerprinting_1.detectAIFingerprints)(file.content, file.path);
+      const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path);
+      const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig);
+      const promptHygieneFindings = (0, ai_prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path);
+      const executionSinkFindings = (0, ai_execution_sinks_1.detectAIExecutionSinks)(file.content, file.path);
+      const agentToolFindings = (0, ai_agent_tools_1.detectAIAgentTools)(file.content, file.path);
+      const ragSafetyFindings = (0, ai_rag_safety_1.detectRAGSafetyIssues)(file.content, file.path);
+      const endpointProtectionFindings = (0, ai_endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
+        middlewareConfig: options.middlewareConfig
+      });
+      const schemaValidationFindings = (0, ai_schema_validation_1.detectAISchemaValidation)(file.content, file.path);
+      stats.variables = variableFindings.length;
+      stats.logicGates = logicFindings.length;
+      stats.dangerousFunctions = dangerousFuncFindings.length;
+      stats.riskyImports = riskyImportFindings.length;
+      stats.authAntipatterns = authFindings.length;
+      stats.frameworkIssues = frameworkFindings.length;
+      stats.aiFingerprints = aiFindings.length;
+      stats.dataExposure = dataExposureFindings.length;
+      stats.byokPatterns = byokFindings.length;
+      stats.promptHygiene = promptHygieneFindings.length;
+      stats.executionSinks = executionSinkFindings.length;
+      stats.agentTools = agentToolFindings.length;
+      stats.ragSafety = ragSafetyFindings.length;
+      stats.endpointProtection = endpointProtectionFindings.length;
+      stats.schemaValidation = schemaValidationFindings.length;
+      return {
+        findings: [
+          ...variableFindings,
+          ...logicFindings,
+          ...dangerousFuncFindings,
+          ...riskyImportFindings,
+          ...authFindings,
+          ...frameworkFindings,
+          ...aiFindings,
+          ...dataExposureFindings,
+          ...byokFindings,
+          ...promptHygieneFindings,
+          ...executionSinkFindings,
+          ...agentToolFindings,
+          ...ragSafetyFindings,
+          ...endpointProtectionFindings,
+          ...schemaValidationFindings
+        ],
+        stats
+      };
+    }
+    var LAYER2_PARALLEL_BATCH_SIZE = 50;
     async function runLayer2Scan(files, options = {}) {
       const startTime = Date.now();
       const vulnerabilities = [];
@@ -20693,51 +20784,19 @@ var require_layer2 = __commonJS({
         promptHygiene: 0,
         executionSinks: 0,
         agentTools: 0,
-        // M5: New AI-era detectors
         ragSafety: 0,
         endpointProtection: 0,
         schemaValidation: 0
       };
       const authHelperContext = options.authHelperContext || (0, auth_helper_detector_1.detectAuthHelpers)(files);
-      for (const file of files) {
-        if (isCodeFile(file.path)) {
-          const variableFindings = (0, variables_1.detectSensitiveVariables)(file.content, file.path);
-          const logicFindings = (0, logic_gates_1.detectLogicGates)(file.content, file.path);
-          const dangerousFuncFindings = (0, dangerous_functions_1.detectDangerousFunctions)(file.content, file.path);
-          const riskyImportFindings = (0, risky_imports_1.detectRiskyImports)(file.content, file.path);
-          const authFindings = (0, auth_antipatterns_1.detectAuthAntipatterns)(file.content, file.path, {
-            middlewareConfig: options.middlewareConfig,
-            authHelpers: authHelperContext,
-            fileAuthImports: options.fileAuthImports
-          });
-          const frameworkFindings = (0, framework_checks_1.detectFrameworkIssues)(file.content, file.path);
-          const aiFindings = (0, ai_fingerprinting_1.detectAIFingerprints)(file.content, file.path);
-          const dataExposureFindings = (0, data_exposure_1.detectDataExposure)(file.content, file.path);
-          const byokFindings = (0, byok_patterns_1.detectBYOKPatterns)(file.content, file.path, options.middlewareConfig);
-          const promptHygieneFindings = (0, ai_prompt_hygiene_1.detectAIPromptHygiene)(file.content, file.path);
-          const executionSinkFindings = (0, ai_execution_sinks_1.detectAIExecutionSinks)(file.content, file.path);
-          const agentToolFindings = (0, ai_agent_tools_1.detectAIAgentTools)(file.content, file.path);
-          const ragSafetyFindings = (0, ai_rag_safety_1.detectRAGSafetyIssues)(file.content, file.path);
-          const endpointProtectionFindings = (0, ai_endpoint_protection_1.detectAIEndpointProtection)(file.content, file.path, {
-            middlewareConfig: options.middlewareConfig
-          });
-          const schemaValidationFindings = (0, ai_schema_validation_1.detectAISchemaValidation)(file.content, file.path);
-          stats.variables += variableFindings.length;
-          stats.logicGates += logicFindings.length;
-          stats.dangerousFunctions += dangerousFuncFindings.length;
-          stats.riskyImports += riskyImportFindings.length;
-          stats.authAntipatterns += authFindings.length;
-          stats.frameworkIssues += frameworkFindings.length;
-          stats.aiFingerprints += aiFindings.length;
-          stats.dataExposure += dataExposureFindings.length;
-          stats.byokPatterns += byokFindings.length;
-          stats.promptHygiene += promptHygieneFindings.length;
-          stats.executionSinks += executionSinkFindings.length;
-          stats.agentTools += agentToolFindings.length;
-          stats.ragSafety += ragSafetyFindings.length;
-          stats.endpointProtection += endpointProtectionFindings.length;
-          stats.schemaValidation += schemaValidationFindings.length;
-          vulnerabilities.push(...variableFindings, ...logicFindings, ...dangerousFuncFindings, ...riskyImportFindings, ...authFindings, ...frameworkFindings, ...aiFindings, ...dataExposureFindings, ...byokFindings, ...promptHygieneFindings, ...executionSinkFindings, ...agentToolFindings, ...ragSafetyFindings, ...endpointProtectionFindings, ...schemaValidationFindings);
+      for (let i = 0; i < files.length; i += LAYER2_PARALLEL_BATCH_SIZE) {
+        const batch = files.slice(i, i + LAYER2_PARALLEL_BATCH_SIZE);
+        const results = await Promise.all(batch.map((file) => Promise.resolve(processFileLayer2(file, options, authHelperContext))));
+        for (const result of results) {
+          vulnerabilities.push(...result.findings);
+          for (const [key, value] of Object.entries(result.stats)) {
+            stats[key] += value;
+          }
         }
       }
       const dedupedVulnerabilities = deduplicateFindings(vulnerabilities);
@@ -20757,16 +20816,6 @@ var require_layer2 = __commonJS({
         ];
       }
       const { kept: uniqueVulnerabilities, suppressed } = (0, path_exclusions_1.filterFindingsByPath)(dedupedVulnerabilities, Object.keys(exclusionConfig).length > 0 ? exclusionConfig : void 0);
-      if (suppressed.length > 0) {
-        console.log(`[Layer 2] Suppressed ${suppressed.length} findings in test/seed/example files:`);
-        const byReason = /* @__PURE__ */ new Map();
-        for (const { reason } of suppressed) {
-          byReason.set(reason || "unknown", (byReason.get(reason || "unknown") || 0) + 1);
-        }
-        for (const [reason, count] of byReason) {
-          console.log(`  - ${reason}: ${count}`);
-        }
-      }
       const rawStats = {
         sensitive_variables: stats.variables,
         logic_gates: stats.logicGates,
@@ -20813,15 +20862,6 @@ var require_layer2 = __commonJS({
         ai_endpoint_protection: "ai_endpoint_protection",
         ai_schema_validation: "ai_schema_validation"
       };
-      console.log("[Layer 2] Heuristic breakdown (raw findings before dedupe):");
-      for (const [name, count] of Object.entries(rawStats)) {
-        if (count > 0) {
-          const detectorName = detectorNameMap[name];
-          const tier = detectorName ? (0, tiers_1.getLayer2DetectorTier)(detectorName) : "unknown";
-          console.log(`  - ${name}: ${count} (${tier})`);
-        }
-      }
-      console.log(`[Layer 2] Tier breakdown (after dedupe): ${(0, tiers_1.formatTierStats)(tierStats)}`);
       return {
         vulnerabilities: uniqueVulnerabilities,
         filesScanned: files.filter((f) => isCodeFile(f.path)).length,
@@ -36127,8 +36167,8 @@ var require_anthropic = __commonJS({
     var context_helpers_1 = require_context_helpers();
     var project_context_builder_1 = require_project_context_builder();
     var tiers_1 = require_tiers();
-    var FILES_PER_API_BATCH = 5;
-    var PARALLEL_API_BATCHES = 4;
+    var FILES_PER_API_BATCH = 8;
+    var PARALLEL_API_BATCHES = 6;
     function getAnthropicClient() {
       const apiKey = process.env.ANTHROPIC_API_KEY;
       if (!apiKey) {
@@ -38758,9 +38798,15 @@ var require_dist = __commonJS({
       const scanModeConfig = resolveScanModeConfig(options);
       const isIncremental = scanModeConfig.mode === "incremental";
       const depth = scanModeConfig.scanDepth || "cheap";
-      console.log(`[Scanner] repo=${repoInfo.name} mode=${scanModeConfig.mode} depth=${depth} files=${files.length}`);
+      const quiet = options.quiet ?? false;
+      const log = (message) => {
+        if (!quiet) {
+          console.log(message);
+        }
+      };
+      log(`[Scanner] repo=${repoInfo.name} mode=${scanModeConfig.mode} depth=${depth} files=${files.length}`);
       if (isIncremental && scanModeConfig.changedFiles) {
-        console.log(`[Scanner] repo=${repoInfo.name} incremental_files=${scanModeConfig.changedFiles.length}`);
+        log(`[Scanner] repo=${repoInfo.name} incremental_files=${scanModeConfig.changedFiles.length}`);
       }
       const reportProgress = (status2, message, vulnerabilitiesFound = allVulnerabilities.length) => {
         if (onProgress) {
@@ -38777,12 +38823,12 @@ var require_dist = __commonJS({
       try {
         const middlewareConfig = (0, middleware_detector_1.detectGlobalAuthMiddleware)(files);
         if (middlewareConfig.hasAuthMiddleware) {
-          console.log(`[Scanner] repo=${repoInfo.name} auth_middleware=${middlewareConfig.authType || "unknown"} file=${middlewareConfig.middlewareFile}`);
+          log(`[Scanner] repo=${repoInfo.name} auth_middleware=${middlewareConfig.authType || "unknown"} file=${middlewareConfig.middlewareFile}`);
         }
         const fileAuthImports = (0, imported_auth_detector_1.buildFileAuthImports)(files);
         const filesWithImportedAuth = Array.from(fileAuthImports.values()).filter((f) => f.usesImportedAuth).length;
         if (filesWithImportedAuth > 0) {
-          console.log(`[Scanner] repo=${repoInfo.name} files_with_imported_auth=${filesWithImportedAuth}`);
+          log(`[Scanner] repo=${repoInfo.name} files_with_imported_auth=${filesWithImportedAuth}`);
         }
         reportProgress("layer1", "Running surface scan (patterns, entropy, config)...");
         let layer1Result = await (0, layer1_1.runLayer1Scan)(files);
@@ -38791,18 +38837,18 @@ var require_dist = __commonJS({
           ...layer1Result,
           vulnerabilities: (0, urls_1.aggregateLocalhostFindings)(layer1Result.vulnerabilities)
         };
-        console.log(`[Layer1] repo=${repoInfo.name} findings_raw=${layer1RawCount} findings_deduped=${layer1Result.vulnerabilities.length}`);
+        log(`[Layer1] repo=${repoInfo.name} findings_raw=${layer1RawCount} findings_deduped=${layer1Result.vulnerabilities.length}`);
         reportProgress("layer2", "Running structural scan (variables, logic gates)...", layer1Result.vulnerabilities.length);
         const layer2Result = await (0, layer2_1.runLayer2Scan)(files, { middlewareConfig, fileAuthImports });
         const heuristicBreakdown = Object.entries(layer2Result.stats.raw).filter(([, count]) => count > 0).map(([name, count]) => `${name}:${count}`).join(",");
-        console.log(`[Layer2] repo=${repoInfo.name} findings_raw=${Object.values(layer2Result.stats.raw).reduce((a, b3) => a + b3, 0)} findings_deduped=${layer2Result.vulnerabilities.length} heuristic_breakdown={${heuristicBreakdown}}`);
+        log(`[Layer2] repo=${repoInfo.name} findings_raw=${Object.values(layer2Result.stats.raw).reduce((a, b3) => a + b3, 0)} findings_deduped=${layer2Result.vulnerabilities.length} heuristic_breakdown={${heuristicBreakdown}}`);
         const layer12Findings = [...layer1Result.vulnerabilities, ...layer2Result.vulnerabilities];
         const beforeAggregationCount = layer12Findings.length;
         const aggregatedFindings = aggregateNoisyFindings(layer12Findings);
         const aggregatedCount = beforeAggregationCount - aggregatedFindings.length;
         const tierFiltered = filterByTierAndDepth(aggregatedFindings, depth);
-        console.log(`[Scanner] repo=${repoInfo.name} tier_breakdown=${(0, tiers_1.formatTierStats)(tierFiltered.tierStats)}`);
-        console.log(`[Scanner] repo=${repoInfo.name} depth=${depth} tier_routing: surface=${tierFiltered.toSurface.length} validate=${tierFiltered.toValidate.length} hidden=${tierFiltered.hidden.length}`);
+        log(`[Scanner] repo=${repoInfo.name} tier_breakdown=${(0, tiers_1.formatTierStats)(tierFiltered.tierStats)}`);
+        log(`[Scanner] repo=${repoInfo.name} depth=${depth} tier_routing: surface=${tierFiltered.toSurface.length} validate=${tierFiltered.toValidate.length} hidden=${tierFiltered.hidden.length}`);
         const additionalValidation = tierFiltered.toSurface.filter(
           (v2) => v2.requiresAIValidation || v2.category === "ai_prompt_injection" || // Story B1: Prompt hygiene
           v2.category === "ai_unsafe_execution" || // Story B2: LLM output execution
@@ -38817,7 +38863,7 @@ var require_dist = __commonJS({
           autoDismissBySeverity[d3.finding.severity] = (autoDismissBySeverity[d3.finding.severity] || 0) + 1;
         }
         if (autoDismissed.length > 0) {
-          console.log(`[Layer2] repo=${repoInfo.name} auto_dismissed_total=${autoDismissed.length} by_severity={info:${autoDismissBySeverity.info},low:${autoDismissBySeverity.low},medium:${autoDismissBySeverity.medium},high:${autoDismissBySeverity.high}}`);
+          log(`[Layer2] repo=${repoInfo.name} auto_dismissed_total=${autoDismissed.length} by_severity={info:${autoDismissBySeverity.info},low:${autoDismissBySeverity.low},medium:${autoDismissBySeverity.medium},high:${autoDismissBySeverity.high}}`);
         }
         const maxValidationFiles = scanModeConfig.maxAIValidationFiles || MAX_VALIDATION_CANDIDATES_PER_FILE;
         const cappedValidation = capValidationCandidatesPerFile(afterAutoDismiss, maxValidationFiles);
@@ -38832,13 +38878,13 @@ var require_dist = __commonJS({
             validatedFindings = validationResult.vulnerabilities;
             const { stats: validationStats } = validationResult;
             capturedValidationStats = validationStats;
-            console.log(`[AI Validation] repo=${repoInfo.name} depth=${depth} candidates=${findingsToValidate.length} capped_from=${requiresValidation.length} auto_dismissed=${autoDismissed.length} kept=${validationStats.confirmedFindings} rejected=${validationStats.dismissedFindings} downgraded=${validationStats.downgradedFindings}`);
-            console.log(`[AI Validation] cost_estimate: input_tokens=${validationStats.estimatedInputTokens} output_tokens=${validationStats.estimatedOutputTokens} cost=$${validationStats.estimatedCost.toFixed(4)} api_calls=${validationStats.apiCalls}`);
+            log(`[AI Validation] repo=${repoInfo.name} depth=${depth} candidates=${findingsToValidate.length} capped_from=${requiresValidation.length} auto_dismissed=${autoDismissed.length} kept=${validationStats.confirmedFindings} rejected=${validationStats.dismissedFindings} downgraded=${validationStats.downgradedFindings}`);
+            log(`[AI Validation] cost_estimate: input_tokens=${validationStats.estimatedInputTokens} output_tokens=${validationStats.estimatedOutputTokens} cost=$${validationStats.estimatedCost.toFixed(4)} api_calls=${validationStats.apiCalls}`);
             const notValidated = cappedValidation.filter((v2) => !findingsToValidate.includes(v2));
             validatedFindings.push(...notValidated);
           }
         } else if (scanModeConfig.skipAIValidation) {
-          console.log(`[AI Validation] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
+          log(`[AI Validation] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
         }
         allVulnerabilities.push(...validatedFindings, ...noValidationNeeded);
         const shouldRunLayer3 = options.enableAI !== false && !scanModeConfig.skipLayer3;
@@ -38863,9 +38909,9 @@ var require_dist = __commonJS({
             }
           });
           allVulnerabilities.push(...layer3Result.vulnerabilities);
-          console.log(`[Layer3] repo=${repoInfo.name} depth=${depth} files_analyzed=${layer3Result.aiAnalyzed} findings=${layer3Result.vulnerabilities.length}`);
+          log(`[Layer3] repo=${repoInfo.name} depth=${depth} files_analyzed=${layer3Result.aiAnalyzed} findings=${layer3Result.vulnerabilities.length}`);
         } else if (scanModeConfig.skipLayer3) {
-          console.log(`[Layer3] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
+          log(`[Layer3] repo=${repoInfo.name} depth=${depth} skipped=true reason=scan_mode_config`);
         }
         const uniqueVulnerabilities = deduplicateVulnerabilities(allVulnerabilities);
         const resolvedVulnerabilities = resolveContradictions(uniqueVulnerabilities, middlewareConfig);
@@ -38976,9 +39022,6 @@ Found ${group.length} occurrences at lines: ${lineDisplay}`,
         });
         const capped = sorted.slice(0, maxPerFile);
         result.push(...capped);
-        if (sorted.length > maxPerFile) {
-          console.log(`[Scanner] Capped ${filePath}: ${sorted.length} \u2192 ${maxPerFile} validation candidates`);
-        }
       }
       return result;
     }
@@ -39031,7 +39074,6 @@ Found ${group.length} occurrences at lines: ${lineDisplay}`,
           for (const vuln of otherAuthFindings) {
             if (vuln.severity === "critical" || vuln.severity === "high") {
               const reason = isAPIRouteProtected ? "API route protected by middleware" : isClientCallingProtectedAPI ? "client component calling protected API" : "route is protected";
-              console.log(`[Contradiction] Dropping "${vuln.title}" (${vuln.severity}) - ${reason}`);
               continue;
             }
             result.push(vuln);
@@ -43498,18 +43540,19 @@ async function runScanOnce(targetPath, options) {
   }
   spinner.succeed(`Found ${files.length} files to scan`);
   const onProgress = (progress) => {
+    const fileInfo = source_default.dim(`(${progress.totalFiles} files)`);
     switch (progress.status) {
       case "layer1":
-        spinner.text = `Scanning patterns... ${source_default.dim(`(${progress.vulnerabilitiesFound} potential issues)`)}`;
+        spinner.text = `Layer 1: Pattern matching ${fileInfo} ${source_default.dim(`\u2192 ${progress.vulnerabilitiesFound} candidates`)}`;
         break;
       case "layer2":
-        spinner.text = `Analyzing code structure... ${source_default.dim(`(${progress.vulnerabilitiesFound} findings)`)}`;
+        spinner.text = `Layer 2: Code structure analysis ${fileInfo} ${source_default.dim(`\u2192 ${progress.vulnerabilitiesFound} findings`)}`;
         break;
       case "validating":
-        spinner.text = `AI validating findings... ${source_default.dim(`(${progress.vulnerabilitiesFound} candidates)`)}`;
+        spinner.text = `AI validation ${source_default.dim(`\u2192 reviewing ${progress.vulnerabilitiesFound} candidates`)}`;
         break;
       case "layer3":
-        spinner.text = `Deep AI analysis in progress...`;
+        spinner.text = `Layer 3: Deep AI analysis ${source_default.dim(`\u2192 semantic security check`)}`;
         break;
       case "complete":
         const issueText = progress.vulnerabilitiesFound === 1 ? "issue" : "issues";
@@ -43543,6 +43586,7 @@ async function runScanOnce(targetPath, options) {
       spinner.succeed(`Backend scan complete`);
     } else {
       const enableAI = options.depth !== "cheap" && hasLocalAI;
+      const shouldBeQuiet = options.quiet ?? !options.verbose;
       result = await (0, import_scanner.runScan)(
         files,
         {
@@ -43552,7 +43596,8 @@ async function runScanOnce(targetPath, options) {
         },
         {
           enableAI,
-          scanDepth: options.depth
+          scanDepth: options.depth,
+          quiet: shouldBeQuiet
         },
         onProgress
       );
@@ -43595,6 +43640,7 @@ async function runScan(targetPath, cliOptions) {
     failOn: cliOptions.failOn ?? "high",
     color: cliOptions.color,
     quiet: cliOptions.quiet,
+    verbose: cliOptions.verbose,
     incremental: cliOptions.incremental,
     diff: cliOptions.diff,
     output: cliOptions.output
@@ -43605,6 +43651,7 @@ async function runScan(targetPath, cliOptions) {
     format: baseOptions.format ?? projectConfig?.format ?? "terminal",
     failOn: baseOptions.failOn ?? projectConfig?.failOn ?? "high",
     quiet: baseOptions.quiet ?? projectConfig?.quiet,
+    verbose: baseOptions.verbose,
     output: baseOptions.output ?? projectConfig?.output
   };
   try {
@@ -43619,7 +43666,7 @@ async function runScan(targetPath, cliOptions) {
     process.exit(1);
   }
 }
-var scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: cheap (free), validated, deep", "cheap").option("-m, --mode <mode>", "alias for --depth (quick, validated, deep)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown", "terminal").option("--fail-on <severity>", "exit with error code if findings at severity", "high").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-o, --output <file>", "write output to file").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").addHelpText("after", `
+var scanCommand = new Command("scan").description("Scan a directory or file for security vulnerabilities").argument("[path]", "path to scan", ".").option("-d, --depth <depth>", "scan depth: cheap (free), validated, deep", "cheap").option("-m, --mode <mode>", "alias for --depth (quick, validated, deep)").option("-f, --format <format>", "output format: terminal, json, sarif, markdown", "terminal").option("--fail-on <severity>", "exit with error code if findings at severity", "high").option("--no-color", "disable colored output").option("-q, --quiet", "minimal output for CI (suppress spinners and decorations)").option("-v, --verbose", "show detailed scanner logs (debug mode)").option("-o, --output <file>", "write output to file").option("--incremental", "only scan changed files (requires git)").option("--diff <ref>", "diff against branch/commit for incremental scan").addHelpText("after", `
 Examples:
   $ oculum scan .                    # Scan current directory (quick/free)
   $ oculum scan ./src                # Scan specific directory
@@ -47052,6 +47099,8 @@ async function runScanWizard() {
       format,
       failOn,
       color: true,
+      quiet: true,
+      // Suppress scanner logs in interactive UI mode
       incremental,
       diff: diffRef,
       output: outputPath
@@ -47079,7 +47128,9 @@ async function runQuickScan(targetPath = ".") {
       depth: "cheap",
       format: "terminal",
       failOn: "high",
-      color: true
+      color: true,
+      quiet: true
+      // Suppress scanner logs in interactive UI mode
     },
     cancelled: false
   };
@@ -47532,7 +47583,9 @@ async function runUI() {
         depth,
         format: "terminal",
         failOn: "high",
-        color: true
+        color: true,
+        quiet: true
+        // Suppress scanner logs in interactive UI mode
       });
       console.log(output);
       recordScan();
@@ -47771,7 +47824,6 @@ async function usage(options) {
     console.log("");
     console.log(source_default.dim("  Scans:     ") + source_default.white(formatNumber(usageData.totalScans)));
     console.log(source_default.dim("  Files:     ") + source_default.white(formatNumber(usageData.totalFiles)));
-    console.log(source_default.dim("  Cost:      ") + source_default.white(`$${usageData.totalCostDollars.toFixed(4)}`));
     console.log("");
     console.log(source_default.dim("  Resets on: ") + source_default.white(formatDate(usageData.resetDate)));
     console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oculum/cli",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "AI-native security scanner CLI for detecting vulnerabilities in AI-generated code, BYOK patterns, and modern web applications",
   "main": "dist/index.js",
   "bin": {