@pretense/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -2,15 +2,25 @@
 
 // src/index.ts
 import { Command } from "commander";
-import chalk from "chalk";
-import { readFileSync as readFileSync4, existsSync as existsSync4, readdirSync, statSync } from "fs";
-import { resolve as resolve2, extname, join as join3 } from "path";
+import chalk9 from "chalk";
+import {
+  readFileSync as readFileSync7,
+  existsSync as existsSync7,
+  readdirSync,
+  statSync,
+  openSync,
+  readSync as readSync2,
+  closeSync
+} from "fs";
+import { readFile, stat as fsStat, open as fsOpen } from "fs/promises";
+import { resolve as resolve2, extname, join as join5, basename } from "path";
+import os from "os";
 
 // src/types.ts
 var DEFAULT_CONFIG = {
   port: 9339,
   targetApis: ["https://api.anthropic.com", "https://api.openai.com"],
-  languages: ["typescript", "javascript", "python", "go", "java"],
+  languages: ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"],
   mutationRules: [
     { tokenType: "Variable" /* Variable */, prefix: "_v" },
     { tokenType: "Function" /* Function */, prefix: "_fn" },
@@ -262,29 +272,200 @@ var JAVA_KEYWORDS = /* @__PURE__ */ new Set([
   "permits",
   "yield"
 ]);
+var CSHARP_KEYWORDS = /* @__PURE__ */ new Set([
+  "class",
+  "interface",
+  "namespace",
+  "public",
+  "private",
+  "protected",
+  "internal",
+  "static",
+  "void",
+  "return",
+  "new",
+  "using",
+  "override",
+  "sealed",
+  "abstract",
+  "virtual",
+  "readonly",
+  "const",
+  "var",
+  "int",
+  "string",
+  "bool",
+  "double",
+  "float",
+  "object",
+  "null",
+  "true",
+  "false",
+  "if",
+  "else",
+  "for",
+  "foreach",
+  "while",
+  "do",
+  "switch",
+  "case",
+  "break",
+  "continue",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "async",
+  "await",
+  "get",
+  "set",
+  "partial",
+  "enum",
+  "struct",
+  "delegate",
+  "event"
+]);
+var RUBY_KEYWORDS = /* @__PURE__ */ new Set([
+  "def",
+  "class",
+  "module",
+  "end",
+  "do",
+  "if",
+  "else",
+  "elsif",
+  "unless",
+  "while",
+  "until",
+  "for",
+  "begin",
+  "rescue",
+  "ensure",
+  "raise",
+  "return",
+  "yield",
+  "self",
+  "super",
+  "true",
+  "false",
+  "nil",
+  "and",
+  "or",
+  "not",
+  "in",
+  "then",
+  "case",
+  "when",
+  "puts",
+  "print",
+  "require",
+  "require_relative",
+  "include",
+  "extend",
+  "attr_accessor",
+  "attr_reader",
+  "attr_writer",
+  "initialize",
+  "new",
+  "public",
+  "private",
+  "protected"
+]);
+var RUST_KEYWORDS = /* @__PURE__ */ new Set([
+  "fn",
+  "struct",
+  "enum",
+  "trait",
+  "impl",
+  "mod",
+  "pub",
+  "let",
+  "mut",
+  "const",
+  "type",
+  "use",
+  "crate",
+  "self",
+  "super",
+  "move",
+  "ref",
+  "match",
+  "if",
+  "else",
+  "loop",
+  "while",
+  "for",
+  "return",
+  "break",
+  "continue",
+  "where",
+  "as",
+  "in",
+  "true",
+  "false",
+  "unsafe",
+  "extern",
+  "dyn",
+  "box",
+  "static",
+  "async",
+  "await",
+  "Box",
+  "String",
+  "Vec",
+  "Option",
+  "Result",
+  "Ok",
+  "Err",
+  "Some",
+  "None"
+]);
 function detectLanguage(code) {
   if (/:[\s]*\w+[\s]*[;,{)]/.test(code) || /import.*from\s+['"]/.test(code) || /interface\s+\w+/.test(code)) return "typescript";
   if (/\bdef\s+\w+\s*\(/.test(code) || /\bimport\s+\w+/.test(code) && /:$/.test(code)) return "python";
   if (/\bfunc\s+\w+\s*\(/.test(code) || /\bpackage\s+\w+/.test(code)) return "go";
   if (/\bpublic\s+class\s+\w+/.test(code) || /\bimport\s+java\./.test(code)) return "java";
+  if (/\bnamespace\s+\w+/.test(code) || /\busing\s+System/.test(code)) return "csharp";
+  if (/\bfn\s+\w+\s*\(/.test(code) || /\blet\s+mut\s+\w+/.test(code)) return "rust";
+  if (/\bdef\s+\w+/.test(code) && /\bend\b/.test(code)) return "ruby";
   if (/\bconst\s+\w+\s*=/.test(code) || /\bfunction\s+\w+\s*\(/.test(code)) return "javascript";
   return "typescript";
 }
-function lineAt(code, index) {
-  let line = 1;
-  for (let i = 0; i < index && i < code.length; i++) {
-    if (code[i] === "\n") line++;
+function buildLineIndex(code) {
+  const offsets = [];
+  for (let i = 0; i < code.length; i++) {
+    if (code.charCodeAt(i) === 10) offsets.push(i);
   }
-  return line;
+  return offsets;
+}
+function lineFromIndex(lineOffsets, index) {
+  let lo = 0;
+  let hi = lineOffsets.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lineOffsets[mid] < index) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo + 1;
 }
 function scanTypeScript(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     // Single-line comment
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     // Multi-line comment
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Quoted HTTP header names (fetch/axios headers objects) — mutated, not vendor-identifying literals
+    { re: /"(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)"/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    { re: /'(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)'/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    // Unquoted `Authorization` key — value must start with a string/template (skips interface/type shapes)
+    {
+      re: /(?:\{|\,)\s*(Authorization)\s*:\s*(?=[`'"])/g,
+      type: "HttpHeaderString" /* HttpHeaderString */,
+      groupIndex: 1
+    },
     // Import source (the module path string)
     { re: /\bimport\b[^'"]*['"]([^'"]+)['"]/g, type: "Import" /* Import */, groupIndex: 1 },
     // Class name
@@ -292,11 +473,18 @@ function scanTypeScript(code) {
     // Function/method name (function keyword)
     { re: /\bfunction\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Function" /* Function */, groupIndex: 1 },
     // Arrow function assigned to const/let/var
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
     // Method: identifier followed by (
     { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
-    // Variable declarations
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Env-style binding names with hyphens or dots (e.g. AWS-SECRET-KEY, AWS.SECRET.KEY) — not valid JS identifiers but common in pasted config
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*(?:(?:-|\.)(?:[A-Za-z0-9_$]+))+)(?=\s*=)/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Variable declarations (exclude names continued with -/. so AWS-SECRET-KEY is captured only by the rule above)
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Member receiver: matches in matches.push, row in row.patientId, def in def.name
+    { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:\.|\?\.)[^0-9]/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Property after . or ?. when not immediately followed by ( — method calls use Method rule
+    { re: /\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
+    { re: /\?\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Template literals (preserve backtick wrapper)
     { re: /`[^`]*`/g, type: "String" /* String */ },
     // Double-quoted strings
@@ -314,23 +502,38 @@ function scanTypeScript(code) {
       if (!captureValue || captureValue.trim() === "") continue;
       if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (TS_JS_KEYWORDS.has(captureValue)) continue;
-        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename)$/.test(captureValue)) continue;
+        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename|Intl|WebAssembly)$/.test(captureValue)) continue;
         if (captureValue.length <= 1) continue;
       }
+      if (type === "Property" /* Property */ && captureValue === "meta" && code.slice(Math.max(0, captureStart - 7), captureStart) === "import.") {
+        continue;
+      }
       tokens.push({
         type,
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
-  return deduplicate(tokens);
+  const commentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const stringLikeSpans = tokens.filter(
+    (t) => t.type === "String" /* String */ || t.type === "HttpHeaderString" /* HttpHeaderString */
+  );
+  const dropsSpanOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (commentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (stringLikeSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsSpanOverlap));
 }
 function scanPython(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     // Triple-quoted docstrings
     { re: /"""[\s\S]*?"""|'''[\s\S]*?'''/g, type: "Comment" /* Comment */ },
@@ -343,6 +546,11 @@ function scanPython(code) {
     { re: /\bclass\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
     // Function/method def
     { re: /\bdef\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Call site: method name in obj.method(
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // obj.attr receiver and attribute (matches.push-style)
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\.\s*(?=[a-zA-Z_])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    { re: /\.([A-Za-z_][A-Za-z0-9_]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Variable assignment (simple name = ...)
     { re: /^([A-Za-z_][A-Za-z0-9_]*)\s*=/gm, type: "Variable" /* Variable */, groupIndex: 1 },
     // Double-quoted strings
@@ -358,7 +566,7 @@ function scanPython(code) {
       const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
       const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
       if (!captureValue || captureValue.trim() === "") continue;
-      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (PYTHON_KEYWORDS.has(captureValue)) continue;
         if (captureValue.length <= 1) continue;
         if (captureValue.startsWith("__") && captureValue.endsWith("__")) continue;
@@ -368,15 +576,25 @@ function scanPython(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
-  return deduplicate(tokens);
+  const pyCommentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const pyStringSpans = tokens.filter((t) => t.type === "String" /* String */);
+  const dropsPyOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (pyCommentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (pyStringSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsPyOverlap));
 }
 function scanGo(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
@@ -413,7 +631,7 @@ function scanGo(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -422,6 +640,7 @@ function scanGo(code) {
 function scanJava(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
@@ -454,7 +673,137 @@ function scanJava(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanCSharp(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Namespace/using import
+    { re: /\busing\s+([\w.]+);/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Class/interface/struct/enum names
+    { re: /\b(?:class|interface|struct|enum)\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Method/property declaration
+    { re: /\b(?:public|private|protected|internal|static|virtual|override|async)\s+(?:\w+\s+)+([a-zA-Z_]\w*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // Local variable declarations
+    { re: /\b(?:var|int|string|bool|double|float|object)\s+([a-zA-Z_]\w*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Verbatim strings
+    { re: /@"(?:[^"]|"")*"/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Method" /* Method */ || type === "Class" /* Class */) {
+        if (CSHARP_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+        if (/^(String|Object|Integer|Boolean|Double|Float|List|Dictionary|Array|Exception|Task|Console|Math|Enum|Delegate)$/.test(captureValue)) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanRuby(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    // Single-line comment
+    { re: /#[^\n]*/g, type: "Comment" /* Comment */ },
+    // Method names
+    { re: /\bdef\s+([a-zA-Z_]\w*[!?]?)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Class and module names
+    { re: /\b(?:class|module)\s+([A-Z][a-zA-Z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Instance variables
+    { re: /@([a-zA-Z_]\w*)/g, type: "Property" /* Property */, groupIndex: 1 },
+    // All-caps constants (3+ chars to avoid single-letter constants)
+    { re: /\b([A-Z][A-Z0-9_]{2,})\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Single-quoted strings
+    { re: /'(?:[^'\\]|\\.)*'/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Property" /* Property */) {
+        if (RUBY_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanRust(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Use declarations
+    { re: /\buse\s+([\w:]+)/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Named type declarations (struct, enum, trait)
+    { re: /\b(?:struct|enum|trait)\s+([A-Z][a-zA-Z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Function names
+    { re: /\bfn\s+([a-zA-Z_]\w*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Constants (ALL_CAPS)
+    { re: /\bconst\s+([A-Z_][A-Z0-9_]*)\s*:/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Variable bindings
+    { re: /\blet\s+(?:mut\s+)?([a-zA-Z_]\w*)/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+        if (RUST_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -498,13 +847,62 @@ function scan(code, language) {
     case "java":
       tokens = scanJava(code);
       break;
+    case "csharp":
+    case "cs":
+      tokens = scanCSharp(code);
+      break;
+    case "ruby":
+    case "rb":
+      tokens = scanRuby(code);
+      break;
+    case "rust":
+    case "rs":
+      tokens = scanRust(code);
+      break;
     default:
       tokens = scanTypeScript(code);
   }
   return { tokens, language: lang };
 }
 
-// src/mutator.ts
+// src/salt.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { randomBytes } from "crypto";
+var SALT_BYTES = 32;
+function getSaltPath() {
+  const dir = join(homedir(), ".pretense");
+  return { dir, path: join(dir, "mutation.salt") };
+}
+var _cachedSalt = null;
+function getMutationSalt() {
+  if (_cachedSalt) return _cachedSalt;
+  const { dir, path } = getSaltPath();
+  if (existsSync(path)) {
+    try {
+      const raw = readFileSync(path, "utf-8").trim();
+      if (/^[0-9a-f]{64}$/i.test(raw)) {
+        _cachedSalt = raw.toLowerCase();
+        return _cachedSalt;
+      }
+    } catch {
+    }
+  }
+  const salt = randomBytes(SALT_BYTES).toString("hex");
+  try {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(path, salt, { mode: 384 });
+  } catch {
+  }
+  _cachedSalt = salt;
+  return salt;
+}
+function buildSaltedSeed(baseSeed) {
+  return `${baseSeed}:${getMutationSalt()}`;
+}
+
+// src/deterministic-id.ts
 function hash32(str) {
   let h = 5381;
   for (let i = 0; i < str.length; i++) {
@@ -522,11 +920,13 @@ function toAlphaNum(n, len) {
   }
   return result;
 }
-function deterministicId(original, seed, prefix, len = 4) {
+function deterministicSyntheticId(original, seed, prefix, len = 4) {
   const combined = `${seed}:${prefix}:${original}`;
   const h = hash32(combined);
   return prefix + toAlphaNum(h, len);
 }
+
+// src/mutator.ts
 function prefixForType(type) {
   switch (type) {
     case "Class" /* Class */:
@@ -538,6 +938,8 @@ function prefixForType(type) {
       return "_v";
     case "Property" /* Property */:
       return "_prop";
+    case "HttpHeaderString" /* HttpHeaderString */:
+      return "_hk";
     default:
       return "_tok";
   }
@@ -553,6 +955,7 @@ function mutate(code, language, seed = "pretense") {
       stats: { tokensScanned: 0, tokensMutated: 0, durationMs: 0, language: lang }
     };
   }
+  const effectiveSeed = seed === "pretense" ? buildSaltedSeed(seed) : seed;
   const { tokens } = scan(code, lang);
   const map = /* @__PURE__ */ new Map();
   for (const token of tokens) {
@@ -563,11 +966,24 @@ function mutate(code, language, seed = "pretense") {
     if (token.type === "String" /* String */) {
       continue;
     }
+    if (token.type === "HttpHeaderString" /* HttpHeaderString */) {
+      const qm = /^("|')(.+)\1$/.exec(token.value);
+      if (qm) {
+        const inner = qm[2];
+        const q = qm[1];
+        const syntheticInner = deterministicSyntheticId(inner, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, `${q}${syntheticInner}${q}`);
+      } else {
+        const syntheticInner = deterministicSyntheticId(token.value, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, syntheticInner);
+      }
+      continue;
+    }
     if (token.type === "Import" /* Import */) {
       continue;
     }
     const prefix = prefixForType(token.type);
-    const synthetic = deterministicId(token.value, seed, prefix);
+    const synthetic = deterministicSyntheticId(token.value, effectiveSeed, prefix);
     map.set(token.value, synthetic);
   }
   const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
@@ -595,22 +1011,31 @@ function mutate(code, language, seed = "pretense") {
 }
 
 // src/reverser.ts
-function reverse(mutatedCode, map) {
-  if (!mutatedCode || map.size === 0) return mutatedCode;
-  const reverseMap = /* @__PURE__ */ new Map();
-  for (const [original, synthetic] of map.entries()) {
-    if (synthetic === "" || !synthetic) continue;
-    reverseMap.set(synthetic, original);
-  }
-  if (reverseMap.size === 0) return mutatedCode;
-  const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+function reverse(mutatedCode, map, secretsMap) {
+  if (!mutatedCode) return mutatedCode;
   let result = mutatedCode;
-  for (const [synthetic, original] of sortedEntries) {
-    const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
-      result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
-    } else {
-      result = result.split(synthetic).join(original);
+  if (map.size > 0) {
+    const reverseMap = /* @__PURE__ */ new Map();
+    for (const [original, synthetic] of map.entries()) {
+      if (synthetic === "" || !synthetic) continue;
+      reverseMap.set(synthetic, original);
+    }
+    if (reverseMap.size > 0) {
+      const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+      for (const [synthetic, original] of sortedEntries) {
+        const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
+          result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
+        } else {
+          result = result.split(synthetic).join(original);
+        }
+      }
+    }
+  }
+  if (secretsMap && secretsMap.size > 0) {
+    const sortedSecrets = [...secretsMap.entries()].sort((a, b) => b[0].length - a[0].length);
+    for (const [placeholder, original] of sortedSecrets) {
+      result = result.split(placeholder).join(original);
     }
   }
   return result;
@@ -619,16 +1044,40 @@ function reverse(mutatedCode, map) {
 // src/secrets.ts
 var SECRET_PATTERNS = [
   { name: "anthropic-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,}/g },
-  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-[A-Za-z0-9]{20,}/g },
+  /** Legacy `sk-…` and modern `sk-proj-…` (hyphenated body); aligned with @pretense/scanner */
+  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: "aws-access-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /AKIA[0-9A-Z]{16}/g },
-  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/g },
+  /** `AWS_SECRET = '…40 chars…'` (not `AWS_SECRET_ACCESS_KEY`, which is covered below). */
+  { name: "aws-secret-assignment", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bAWS_SECRET\s*=\s*['"]([A-Za-z0-9/+=]{40})['"]/gd, valueGroup: 1 },
+  /**
+   * Env-style labels with `-` or `.` (e.g. `AWS-SECRET-KEY`, `AWS.SECRET.KEY`, long `ACCESS` forms).
+   * Case-insensitive `AWS` / `SECRET` / `KEY`. Value: 40-char secret; quotes optional (matches aws-secret-key).
+   */
+  {
+    name: "aws-secret-key-delimited",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bAWS[-.]SECRET(?:[-.]ACCESS)?[-.]KEY\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gdi,
+    valueGroup: 1
+  },
+  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gd, valueGroup: 1 },
   { name: "github-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g },
   { name: "github-fine-grained", category: "secret", severity: "critical", defaultAction: "block", pattern: /github_pat_[A-Za-z0-9_]{22,}/g },
   { name: "stripe-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}/g },
-  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  /** Three base64url JWT segments; payload segment is not required to start with `eyJ` (Supabase and many issuers use compact payloads). */
+  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}/g },
   { name: "database-url", category: "credential", severity: "critical", defaultAction: "block", pattern: /(?:postgres|mysql|mongodb|redis|amqp):\/\/[^\s'"\\)]+:[^\s'"\\)]+@[^\s'"\\)]+/g },
-  { name: "generic-password", category: "credential", severity: "high", defaultAction: "redact", pattern: /(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"][^\s'"]{8,}['"]/gi },
+  {
+    name: "generic-password",
+    category: "credential",
+    severity: "high",
+    defaultAction: "redact",
+    // Do not match `token` / `secret` inside identifiers (e.g. GITHUB_TOKEN, AWS_SECRET): require no word/underscore before keyword.
+    pattern: /(?<![A-Za-z0-9_])(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"]([^\s'"]{8,})['"]/gid,
+    valueGroup: 1
+  },
   { name: "slack-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/g },
   { name: "google-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /AIza[A-Za-z0-9_-]{35}/g },
   { name: "npm-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /npm_[A-Za-z0-9]{36}/g },
@@ -654,7 +1103,36 @@ var SECRET_PATTERNS = [
   { name: "hashicorp-vault-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /hvs\.[A-Za-z0-9_-]{24,}/g },
   { name: "fastly-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /fastly_[A-Za-z0-9]{32}/g },
   { name: "algolia-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /[a-f0-9]{32}/g, validate: (m) => /ALGOLIA|algolia/.test(m) },
-  { name: "pulumi-token", category: "secret", severity: "high", defaultAction: "block", pattern: /pul-[a-f0-9]{40}/g }
+  { name: "pulumi-token", category: "secret", severity: "high", defaultAction: "block", pattern: /pul-[a-f0-9]{40}/g },
+  // ─── Extended patterns (v0.6 unit 8) ─────────────────────────────────────────
+  { name: "google-oauth-refresh", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bGOCSPX-[A-Za-z0-9_-]{20,}\b/g },
+  { name: "slack-webhook-url", category: "secret", severity: "critical", defaultAction: "block", pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g },
+  { name: "sentry-dsn", category: "secret", severity: "high", defaultAction: "redact", pattern: /https:\/\/[a-f0-9]{32}@o\d+\.ingest\.sentry\.io\/\d+/g },
+  { name: "x509-certificate", category: "secret", severity: "high", defaultAction: "redact", pattern: /-----BEGIN CERTIFICATE-----/g },
+  { name: "launchdarkly-sdk-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bsdk-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
+  { name: "launchdarkly-mobile-key", category: "secret", severity: "high", defaultAction: "block", pattern: /\bmob-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
+  /** Stripe signing secrets are often 32+ chars; allow shorter synthetic/test tails so redaction still applies. */
+  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g },
+  /** Stripe Price / product IDs (`price_…`) — identifiers, not card data, but leak billing context. */
+  { name: "stripe-price-id", category: "secret", severity: "high", defaultAction: "block", pattern: /\bprice_[A-Za-z0-9_]{14,}\b/g },
+  /** `FOO_PASSWORD = '…'` / `NEXT_PUBLIC_*_PASSWORD` — generic-password skips when `password` is preceded by `_`. */
+  {
+    name: "env-password-assignment",
+    category: "credential",
+    severity: "high",
+    defaultAction: "block",
+    pattern: /\b[A-Z][A-Z0-9_]*PASSWORD\s*=\s*['"]([^'"]{6,})['"]/gd,
+    valueGroup: 1
+  },
+  /** Quoted common DB dialect names — stack hints when mutating env-style config. */
+  {
+    name: "quoted-db-dialect",
+    category: "credential",
+    severity: "medium",
+    defaultAction: "block",
+    pattern: /(['"])(postgres|mysql|redis)\1/gd,
+    valueGroup: 2
+  }
 ];
 var PII_PATTERNS = [
   { name: "ssn", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
@@ -712,6 +1190,7 @@ function maskValue(value, type) {
   return "***";
 }
 var matchCounter = 0;
+var ENTROPY_SCAN_MAX_BYTES = 512 * 1024;
 function scan2(text, actionOverrides) {
   const start = performance.now();
   const matches = [];
@@ -720,7 +1199,17 @@ function scan2(text, actionOverrides) {
     def.pattern.lastIndex = 0;
     let m;
     while ((m = def.pattern.exec(text)) !== null) {
-      const value = m[0];
+      let value = m[0];
+      let start2 = m.index;
+      let end = start2 + value.length;
+      if (def.valueGroup !== void 0) {
+        const span = m.indices?.[def.valueGroup];
+        if (!span) continue;
+        const [gs, ge] = span;
+        value = text.slice(gs, ge);
+        start2 = gs;
+        end = ge;
+      }
       if (def.validate && !def.validate(value)) continue;
       const action = actionOverrides?.[def.name] ?? def.defaultAction;
       matchCounter++;
@@ -730,35 +1219,51 @@ function scan2(text, actionOverrides) {
         type: def.name,
         value,
         masked: maskValue(value, def.name),
-        start: m.index,
-        end: m.index + value.length,
+        start: start2,
+        end,
         severity: def.severity,
         action
       });
     }
   }
-  const highEntropyPattern = /\b[A-Za-z0-9_\-/.+=$]{21,}\b/g;
-  highEntropyPattern.lastIndex = 0;
-  let hem;
-  while ((hem = highEntropyPattern.exec(text)) !== null) {
-    const value = hem[0];
-    const alreadyMatched = matches.some(
-      (m) => m.start <= hem.index && m.end >= hem.index + value.length
-    );
-    if (alreadyMatched) continue;
-    if (isHighEntropy(value)) {
-      matchCounter++;
-      matches.push({
-        id: `scan_${matchCounter}`,
-        category: "secret",
-        type: "high-entropy-string",
-        value,
-        masked: value.slice(0, 6) + "..." + value.slice(-4),
-        start: hem.index,
-        end: hem.index + value.length,
-        severity: "medium",
-        action: actionOverrides?.["high-entropy-string"] ?? "warn"
-      });
+  if (text.length <= ENTROPY_SCAN_MAX_BYTES) {
+    const sortedByStart = [...matches].sort((a, b) => a.start - b.start);
+    const coveredEnd = (idx) => {
+      let lo = 0;
+      let hi = sortedByStart.length - 1;
+      let best = -1;
+      while (lo <= hi) {
+        const mid = lo + hi >> 1;
+        if (sortedByStart[mid].start <= idx) {
+          best = mid;
+          lo = mid + 1;
+        } else {
+          hi = mid - 1;
+        }
+      }
+      return best >= 0 ? sortedByStart[best].end : -1;
+    };
+    const highEntropyPattern = /\b[A-Za-z0-9_\-/.+=$]{21,}\b/g;
+    highEntropyPattern.lastIndex = 0;
+    let hem;
+    while ((hem = highEntropyPattern.exec(text)) !== null) {
+      const value = hem[0];
+      const end = hem.index + value.length;
+      if (coveredEnd(hem.index) >= end) continue;
+      if (isHighEntropy(value)) {
+        matchCounter++;
+        matches.push({
+          id: `scan_${matchCounter}`,
+          category: "secret",
+          type: "high-entropy-string",
+          value,
+          masked: value.slice(0, 6) + "..." + value.slice(-4),
+          start: hem.index,
+          end,
+          severity: "medium",
+          action: actionOverrides?.["high-entropy-string"] ?? "warn"
+        });
+      }
     }
   }
   const severityRank = { critical: 4, high: 3, medium: 2, low: 1 };
@@ -779,18 +1284,30 @@ function scan2(text, actionOverrides) {
   };
 }
 function applyRedactions(text, matches) {
-  const sorted = [...matches].sort((a, b) => b.start - a.start);
+  return applyRedactionsTracked(text, matches).redactedCode;
+}
+var SECRET_LITERAL_PREFIX = "_sl";
+function applyRedactionsTracked(text, matches, mutationSeed = buildSaltedSeed("pretense")) {
+  const actionable = matches.filter((m) => m.action === "block" || m.action === "redact");
+  const sorted = [...actionable].sort((a, b) => b.start - a.start);
+  const secretsMap = /* @__PURE__ */ new Map();
+  const placeholders = /* @__PURE__ */ new Map();
+  const forward = [...actionable].sort((a, b) => a.start - b.start);
+  for (const match of forward) {
+    const tag = deterministicSyntheticId(`${match.id}:${match.start}`, mutationSeed, SECRET_LITERAL_PREFIX);
+    placeholders.set(match.id, tag);
+    secretsMap.set(tag, match.value);
+  }
   let result = text;
   for (const match of sorted) {
-    if (match.action === "block" || match.action === "redact") {
-      result = result.slice(0, match.start) + `[PRETENSE:${match.type.toUpperCase()}]` + result.slice(match.end);
-    }
+    const tag = placeholders.get(match.id);
+    result = result.slice(0, match.start) + tag + result.slice(match.end);
   }
-  return result;
+  return { redactedCode: result, secretsMap };
 }
 
 // src/store.ts
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "fs";
 import { dirname } from "path";
 var MutationStore = class {
   entries = /* @__PURE__ */ new Map();
@@ -855,20 +1372,20 @@ var MutationStore = class {
    */
   persist() {
     const dir = dirname(this.filePath);
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
+    if (!existsSync2(dir)) {
+      mkdirSync2(dir, { recursive: true });
     }
     const data = JSON.stringify([...this.entries.values()], null, 2);
-    writeFileSync(this.filePath, data, "utf-8");
+    writeFileSync2(this.filePath, data, "utf-8");
   }
   /**
    * Load entries from the JSON file into memory.
    * No-ops if the file doesn't exist.
    */
   load() {
-    if (!existsSync(this.filePath)) return;
+    if (!existsSync2(this.filePath)) return;
     try {
-      const raw = readFileSync(this.filePath, "utf-8");
+      const raw = readFileSync2(this.filePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.entries.clear();
       for (const entry of parsed) {
@@ -901,8 +1418,9 @@ var MutationStore = class {
 };
 
 // src/config.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join, resolve } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join2, resolve } from "path";
+import { createHmac } from "crypto";
 var CONFIG_DIR_NAME = ".pretense";
 var CONFIG_FILE = "config.json";
 var MUTATION_MAP_FILE = "mutation-map.json";
@@ -914,30 +1432,33 @@ function getConfigDir(baseDir) {
 }
 function initConfig(dir) {
   const configDir = getConfigDir(dir);
-  if (!existsSync2(configDir)) {
-    mkdirSync2(configDir, { recursive: true });
+  if (!existsSync3(configDir)) {
+    mkdirSync3(configDir, { recursive: true });
   }
-  const configPath = join(configDir, CONFIG_FILE);
-  if (!existsSync2(configPath)) {
+  const configPath = join2(configDir, CONFIG_FILE);
+  if (!existsSync3(configPath)) {
     const config = {
       ...DEFAULT_CONFIG,
       storePath: configDir
     };
-    writeFileSync2(configPath, JSON.stringify(config, null, 2), "utf-8");
-  }
-  const mapPath = join(configDir, MUTATION_MAP_FILE);
-  if (!existsSync2(mapPath)) {
-    writeFileSync2(mapPath, "[]", "utf-8");
+    writeFileSync3(configPath, JSON.stringify(config, null, 2), "utf-8");
   }
-  const auditPath = join(configDir, AUDIT_LOG_FILE);
-  if (!existsSync2(auditPath)) {
-    writeFileSync2(auditPath, "", "utf-8");
+  const mapPath = join2(configDir, MUTATION_MAP_FILE);
+  if (!existsSync3(mapPath)) {
+    writeFileSync3(mapPath, "[]", "utf-8");
   }
-  const usagePath = join(configDir, USAGE_FILE);
-  if (!existsSync2(usagePath)) {
-    writeFileSync2(
+  const auditPath = join2(configDir, AUDIT_LOG_FILE);
+  if (!existsSync3(auditPath)) {
+    writeFileSync3(auditPath, "", "utf-8");
+  }
+  const usagePath = join2(configDir, USAGE_FILE);
+  if (!existsSync3(usagePath)) {
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const month = today.slice(0, 7);
+    const usageData = { month, mutations: 0, firstUseDate: today };
+    writeFileSync3(
       usagePath,
-      JSON.stringify({ date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), mutations: 0, firstUseDate: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) }, null, 2),
+      JSON.stringify({ ...usageData, date: today, checksum: computeUsageChecksum(usageData) }, null, 2),
       "utf-8"
     );
   }
@@ -945,71 +1466,116 @@ function initConfig(dir) {
 }
 function loadConfig(dir) {
   const configDir = getConfigDir(dir);
-  const configPath = join(configDir, CONFIG_FILE);
-  if (!existsSync2(configPath)) {
+  const configPath = join2(configDir, CONFIG_FILE);
+  if (!existsSync3(configPath)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = readFileSync2(configPath, "utf-8");
+    const raw = readFileSync3(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return { ...DEFAULT_CONFIG, ...parsed };
   } catch {
     return { ...DEFAULT_CONFIG };
   }
 }
+var USAGE_HMAC_SECRET = "pretense_usage_integrity_v1";
+function getUsageSecret() {
+  return process.env["PRETENSE_USAGE_SECRET"] ?? USAGE_HMAC_SECRET;
+}
+function computeUsageChecksum(data) {
+  const payload = JSON.stringify({ month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate });
+  return createHmac("sha256", getUsageSecret()).update(payload).digest("hex");
+}
+function verifyUsageChecksum(data) {
+  if (!data.checksum) return false;
+  return data.checksum === computeUsageChecksum(data);
+}
 function loadUsage(dir) {
   const configDir = getConfigDir(dir);
-  const usagePath = join(configDir, USAGE_FILE);
+  const usagePath = join2(configDir, USAGE_FILE);
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  if (!existsSync2(usagePath)) {
-    return { date: today, mutations: 0, firstUseDate: today };
+  const currentMonth = today.slice(0, 7);
+  if (!existsSync3(usagePath)) {
+    return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
   try {
-    const raw = readFileSync2(usagePath, "utf-8");
+    const raw = readFileSync3(usagePath, "utf-8");
     const data = JSON.parse(raw);
-    if (data.date !== today) {
-      return { date: today, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    if (data.date && !data.month) {
+      const legacyDate = data.date;
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? legacyDate };
     }
-    return data;
+    if (!verifyUsageChecksum({ month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate, checksum: data.checksum })) {
+      process.stderr.write("[PRETENSE] Warning: usage.json integrity check failed. Resetting usage counter.\n");
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    }
+    if (data.month !== currentMonth) {
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    }
+    return { month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate };
   } catch {
-    return { date: today, mutations: 0, firstUseDate: today };
+    return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
 }
 function saveUsage(usage, dir) {
   const configDir = getConfigDir(dir);
-  if (!existsSync2(configDir)) {
-    mkdirSync2(configDir, { recursive: true });
+  if (!existsSync3(configDir)) {
+    mkdirSync3(configDir, { recursive: true });
   }
-  const usagePath = join(configDir, USAGE_FILE);
-  writeFileSync2(usagePath, JSON.stringify(usage, null, 2), "utf-8");
+  const usagePath = join2(configDir, USAGE_FILE);
+  const checksum = computeUsageChecksum(usage);
+  writeFileSync3(usagePath, JSON.stringify({ ...usage, checksum }, null, 2), "utf-8");
+}
+var MIN_LICENSE_KEY_LENGTH = 40;
+var LICENSE_PAYLOAD_REGEX = /^[a-zA-Z0-9]+$/;
+function isValidLicenseKey(key, prefix) {
+  if (key.length < MIN_LICENSE_KEY_LENGTH) return false;
+  const afterPrefix = key.slice(prefix.length);
+  const hmacSecret = process.env["PRETENSE_LICENSE_SECRET"];
+  if (hmacSecret) {
+    const lastUnderscore = afterPrefix.lastIndexOf("_");
+    if (lastUnderscore === -1) return false;
+    const payload = afterPrefix.slice(0, lastUnderscore);
+    const providedHmac = afterPrefix.slice(lastUnderscore + 1);
+    if (!payload || !providedHmac) return false;
+    if (!LICENSE_PAYLOAD_REGEX.test(payload)) return false;
+    const expectedHmac = createHmac("sha256", hmacSecret).update(payload).digest("hex").slice(0, 16);
+    return providedHmac === expectedHmac;
+  }
+  return LICENSE_PAYLOAD_REGEX.test(afterPrefix);
 }
 function detectTier() {
   const key = process.env["PRETENSE_LICENSE_KEY"] ?? "";
-  if (key.startsWith("pre_ent_")) return "enterprise";
-  if (key.startsWith("pre_pro_")) return "pro";
+  if (key.startsWith("pre_ent_") && isValidLicenseKey(key, "pre_ent_")) return "enterprise";
+  if (key.startsWith("pre_pro_") && isValidLicenseKey(key, "pre_pro_")) return "pro";
   return "free";
 }
+function tierFromDashboardPlan(plan, fallback) {
+  if (plan === "ENTERPRISE") return "enterprise";
+  if (plan === "PRO") return "pro";
+  return fallback;
+}
 function getTierLimits(tier) {
   switch (tier) {
     case "enterprise":
-      return { dailyMutations: Infinity, auditRetentionDays: Infinity };
+      return { monthlyMutations: Infinity, auditRetentionDays: Infinity };
     case "pro":
-      return { dailyMutations: Infinity, auditRetentionDays: 90 };
+      return { monthlyMutations: Infinity, auditRetentionDays: 90 };
     case "free":
     default:
-      return { dailyMutations: 500, auditRetentionDays: 3 };
+      return { monthlyMutations: 1e3, auditRetentionDays: 30 };
   }
 }
 
 // src/audit.ts
-import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
+import { appendFileSync, existsSync as existsSync4, readFileSync as readFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { join as join3, dirname as dirname2 } from "path";
 function writeAuditEntry(entry, dir) {
   const configDir = getConfigDir(dir);
-  const auditPath = join2(configDir, "audit.log");
+  const auditPath = join3(configDir, "audit.log");
   const logDir = dirname2(auditPath);
-  if (!existsSync3(logDir)) {
-    mkdirSync3(logDir, { recursive: true });
+  if (!existsSync4(logDir)) {
+    mkdirSync4(logDir, { recursive: true });
   }
   const line = JSON.stringify(entry) + "\n";
   appendFileSync(auditPath, line, "utf-8");
@@ -1028,11 +1594,11 @@ function createAuditEntry(sessionId, file, identifiersMutated, secretsBlocked, l
 function readAuditLog(options = {}) {
   const { limit, dir } = options;
   const configDir = getConfigDir(dir);
-  const auditPath = join2(configDir, "audit.log");
-  if (!existsSync3(auditPath)) {
+  const auditPath = join3(configDir, "audit.log");
+  if (!existsSync4(auditPath)) {
     return [];
   }
-  const raw = readFileSync3(auditPath, "utf-8");
+  const raw = readFileSync4(auditPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   let entries = [];
   for (const line of lines) {
@@ -1095,18 +1661,758 @@ function formatAudit(entries, format = "text") {
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { nanoid } from "nanoid";
-function detectUpstream(path) {
-  if (path.includes("/v1/messages")) return "https://api.anthropic.com";
-  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "https://api.openai.com";
-  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "https://generativelanguage.googleapis.com";
-  return "https://api.openai.com";
-}
-function detectProvider(path) {
-  if (path.includes("/v1/messages")) return "anthropic";
-  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "openai";
-  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "google";
-  return "openai";
-}
+import { createServer } from "net";
+import { existsSync as existsSync6, watch } from "fs";
+
+// src/auth.ts
+import { createHash } from "crypto";
+var AUTH_HEADERS = ["authorization", "x-api-key", "x-goog-api-key"];
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/",
+  "/health",
+  "/stats",
+  "/audit",
+  "/tokens"
+]);
+function extractApiKey(c) {
+  for (const h of AUTH_HEADERS) {
+    const v = c.req.header(h);
+    if (v && v.length > 0) {
+      return v.replace(/^Bearer\s+/i, "").trim();
+    }
+  }
+  return null;
+}
+function sessionHash(apiKey) {
+  return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+var requireApiKey = async (c, next) => {
+  if (PUBLIC_PATHS.has(c.req.path)) {
+    return next();
+  }
+  const key = extractApiKey(c);
+  if (!key) {
+    return c.json(
+      {
+        error: {
+          type: "missing_api_key",
+          message: "Authorization header required (Authorization, x-api-key, or x-goog-api-key)"
+        }
+      },
+      401
+    );
+  }
+  c.set("sessionHash", sessionHash(key));
+  return next();
+};
+
+// src/session-store.ts
+var sessions = /* @__PURE__ */ new Map();
+function getSession(hash) {
+  let s = sessions.get(hash);
+  if (!s) {
+    s = {
+      mutationMap: /* @__PURE__ */ new Map(),
+      reverseMap: /* @__PURE__ */ new Map(),
+      createdAt: Date.now(),
+      lastUsed: Date.now()
+    };
+    sessions.set(hash, s);
+  }
+  s.lastUsed = Date.now();
+  return s;
+}
+function sessionCount() {
+  return sessions.size;
+}
+
+// src/git-context.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var GIT_TIMEOUT_MS = 2e3;
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      timeout: GIT_TIMEOUT_MS,
+      windowsHide: true
+    });
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sanitizeRemote(raw) {
+  if (/^[\w.-]+@[^:]+:/.test(raw) && !raw.includes("://")) {
+    return raw;
+  }
+  try {
+    const url = new URL(raw);
+    url.username = "";
+    url.password = "";
+    return url.toString();
+  } catch {
+    return raw;
+  }
+}
+async function collectGitContext(cwd = process.cwd()) {
+  const insideRepo = await runGit(["rev-parse", "--is-inside-work-tree"], cwd);
+  if (insideRepo !== "true") return {};
+  const [remote, branch, sha] = await Promise.all([
+    runGit(["remote", "get-url", "origin"], cwd),
+    runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd),
+    runGit(["rev-parse", "HEAD"], cwd)
+  ]);
+  const ctx = {};
+  if (remote) ctx.git_remote = sanitizeRemote(remote);
+  if (branch && branch !== "HEAD") ctx.git_branch = branch;
+  if (sha) ctx.git_commit_sha = sha;
+  return ctx;
+}
+var CACHE_TTL_MS = 3e4;
+var cache = /* @__PURE__ */ new Map();
+async function collectGitContextCached(cwd = process.cwd(), now = Date.now()) {
+  const hit = cache.get(cwd);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const value = await collectGitContext(cwd);
+  cache.set(cwd, { value, expiresAt: now + CACHE_TTL_MS });
+  return value;
+}
+
+// src/commands/login.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+import readline from "readline/promises";
+import chalk from "chalk";
+var CONFIG_DIR_NAME2 = ".pretense";
+var CONFIG_FILE2 = "config.json";
+function getUserDashboardConfigDir() {
+  return join4(homedir2(), CONFIG_DIR_NAME2);
+}
+function getUserDashboardConfigPath() {
+  return join4(getUserDashboardConfigDir(), CONFIG_FILE2);
+}
+function isValidKeyShape(key) {
+  const trimmed = key.trim();
+  if (trimmed.length < 24) return false;
+  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
+  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_") || trimmed.startsWith("prtns_live_");
+}
+function readStdinIfPiped() {
+  if (process.stdin.isTTY) return "";
+  try {
+    const chunks = [];
+    const buf = Buffer.alloc(4096);
+    let bytesRead = 0;
+    do {
+      try {
+        bytesRead = readSync(0, buf, 0, buf.length, null);
+      } catch {
+        bytesRead = 0;
+      }
+      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
+    } while (bytesRead === buf.length);
+    return Buffer.concat(chunks).toString("utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function maskKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 12) return trimmed;
+  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
+}
+function logDashboardCredentialHint() {
+  const env = process.env["PRETENSE_API_KEY"]?.trim() ?? "";
+  const envOk = env.length > 0 && isValidKeyShape(env);
+  const abs = getUserDashboardConfigPath();
+  const fk = loadApiKey();
+  if (envOk) {
+    console.error(
+      chalk.gray(
+        `[pretense] Dashboard key source: PRETENSE_API_KEY in environment (${maskKey(env)}) \u2014 unset this variable after logout if you expect no key.`
+      )
+    );
+  } else if (fk && isValidKeyShape(fk)) {
+    console.error(chalk.gray(`[pretense] Dashboard key source: ${abs} (${maskKey(fk)})`));
+  } else {
+    console.error(chalk.gray("[pretense] Dashboard key source: none configured."));
+  }
+}
+function saveApiKey(key, configDir = getUserDashboardConfigDir()) {
+  if (!existsSync5(configDir)) {
+    mkdirSync5(configDir, { recursive: true });
+  }
+  const path = join4(configDir, CONFIG_FILE2);
+  let existing = {};
+  if (existsSync5(path)) {
+    try {
+      existing = JSON.parse(readFileSync5(path, "utf-8"));
+    } catch {
+      existing = {};
+    }
+  }
+  const next = {
+    ...existing,
+    api_key: key.trim(),
+    saved_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return path;
+}
+function removeSavedDashboardCredentials(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return { removed: false, path };
+  let existing = {};
+  try {
+    existing = JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return { removed: false, path };
+  }
+  const ak = existing.api_key;
+  const hadKey = typeof ak === "string" && ak.trim().length > 0;
+  if (!hadKey) return { removed: false, path };
+  delete existing.api_key;
+  delete existing.saved_at;
+  writeFileSync4(path, JSON.stringify(existing, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return { removed: true, path };
+}
+function loadApiKey(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return null;
+  try {
+    const raw = readFileSync5(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.api_key === "string") {
+      const t = parsed.api_key.trim();
+      if (t.length > 0) return t;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveDashboardKeyCandidate() {
+  const env = (process.env["PRETENSE_API_KEY"] ?? "").trim();
+  if (env.length > 0) {
+    if (!isValidKeyShape(env)) {
+      return { key: null, fromFile: false, badEnv: true };
+    }
+    return { key: env, fromFile: false, badEnv: false };
+  }
+  const fileKey = loadApiKey();
+  if (fileKey && isValidKeyShape(fileKey)) {
+    return { key: fileKey.trim(), fromFile: true, badEnv: false };
+  }
+  return { key: null, fromFile: Boolean(fileKey), badEnv: false };
+}
+function installDashboardKeyForCurrentProcess(key) {
+  const trimmed = key.trim();
+  const path = saveApiKey(trimmed);
+  process.env["PRETENSE_API_KEY"] = trimmed;
+  return path;
+}
+async function promptDashboardApiKeyAfterFailure() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const line = (await rl.question(chalk.bold("Pretense dashboard API key: "))).trim();
+    return line.length > 0 ? line : null;
+  } finally {
+    rl.close();
+  }
+}
+async function ensureDashboardKeyForStart() {
+  const { key, fromFile, badEnv } = resolveDashboardKeyCandidate();
+  if (badEnv) {
+    console.error(chalk.red("Error: PRETENSE_API_KEY is set but is not a valid Pretense dashboard API key shape."));
+    console.error(
+      chalk.gray("Keys look like prtns_live_\u2026 or pk_live_\u2026. Fix the variable or unset it to use ~/.pretense/config.json.")
+    );
+    process.exit(1);
+  }
+  if (key) {
+    return;
+  }
+  if (fromFile) {
+    console.warn(
+      chalk.yellow(
+        "Ignoring invalid `api_key` in ~/.pretense/config.json (wrong shape). Enter a new key or run `pretense login --key ...`."
+      )
+    );
+  }
+  const stdinOk = process.stdin.isTTY;
+  const stdoutOk = process.stdout.isTTY;
+  if (!stdinOk || !stdoutOk) {
+    console.error(chalk.red("Error: Pretense API key required to start the proxy."));
+    console.error(
+      chalk.gray(
+        "Save one with `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+      )
+    );
+    process.exit(1);
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    console.log(chalk.cyan("No Pretense API key found in ~/.pretense/config.json or $PRETENSE_API_KEY."));
+    const entered = (await rl.question(chalk.bold("Enter your Pretense API key: "))).trim();
+    if (!entered) {
+      console.error(chalk.red("No key entered; exiting."));
+      process.exit(1);
+    }
+    if (!isValidKeyShape(entered)) {
+      console.error(chalk.red("That does not look like a Pretense API key (expect prtns_live_\u2026 or pk_live_\u2026)."));
+      console.error(chalk.gray("Get one from your Pretense dashboard, then run `pretense login --key ...`."));
+      process.exit(1);
+    }
+    const path = installDashboardKeyForCurrentProcess(entered);
+    console.log(chalk.green("Saved API key to"), chalk.bold(path));
+    console.log(chalk.gray(`  ${maskKey(entered)}`));
+  } finally {
+    rl.close();
+  }
+  const persisted = resolveDashboardKeyCandidate();
+  if (!persisted.key || persisted.badEnv) {
+    console.error(chalk.red("Error: Pretense dashboard API key could not be confirmed after login prompt."));
+    process.exit(1);
+  }
+}
+function runLogin(opts = {}) {
+  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
+  if (!candidate) {
+    console.error(chalk.red("Error: no API key provided."));
+    console.error(
+      chalk.gray("Try: pretense login --key pk_live_xxxxx")
+    );
+    console.error(
+      chalk.gray("  or: echo $PRETENSE_API_KEY | pretense login")
+    );
+    return 1;
+  }
+  if (!isValidKeyShape(candidate)) {
+    console.error(chalk.red("Error: that does not look like a Pretense API key."));
+    console.error(
+      chalk.gray("Keys start with prtns_live_ (or pk_live_) and are at least 24 characters long.")
+    );
+    console.error(
+      chalk.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
+    );
+    return 1;
+  }
+  const path = saveApiKey(candidate, opts.configDir);
+  console.log(chalk.green("Saved API key to"), chalk.bold(path));
+  console.log(chalk.gray(`  ${maskKey(candidate)}`));
+  console.log(chalk.gray("  File mode 600 \u2014 readable only by you."));
+  return 0;
+}
+
+// src/backend-client.ts
+function usageSummaryFromValidate(v) {
+  return {
+    plan: v.plan,
+    monthlyMutationLimit: v.monthlyMutationLimit,
+    mutationsUsed: v.mutationsUsed,
+    mutationsRemaining: v.mutationsRemaining,
+    requestsThisPeriod: 0,
+    secretsBlockedThisPeriod: 0,
+    periodResetsAt: v.periodResetsAt,
+    keyExpiresAt: null,
+    keyStatus: "active"
+  };
+}
+var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+function getConfiguredApiRoot(rootOverride) {
+  const raw = (rootOverride ?? process.env["PRETENSE_API_URL"] ?? DEFAULT_PRETENSE_API_URL).trim();
+  if (!raw) {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+  let normalized = raw;
+  if (!/^https?:\/\//i.test(normalized)) {
+    normalized = `https://${normalized}`;
+  }
+  try {
+    const u = new URL(normalized);
+    const origin = /^pretense\.ai$/i.test(u.hostname) ? "https://api.pretense.ai" : u.origin;
+    const path = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${origin}${path}`;
+  } catch {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+}
+function getCliApiUrl(pathWithinCli, rootOverride) {
+  const root = getConfiguredApiRoot(rootOverride);
+  const tail = pathWithinCli.replace(/^\/+/, "");
+  return `${root}/api/cli/${tail}`;
+}
+function getApiRequestTimeoutMs() {
+  const raw = process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return DEFAULT_REQUEST_TIMEOUT_MS;
+  const n = parseInt(raw, 10);
+  return Math.min(Math.max(n, 3e3), 12e4);
+}
+function getApiKey() {
+  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
+  if (fromEnv) return fromEnv;
+  const fromFile = loadApiKey();
+  if (!fromFile) return null;
+  const t = fromFile.trim();
+  return t.length > 0 ? t : null;
+}
+function getPretenseApiKey() {
+  return getApiKey();
+}
+var cachedValidation = null;
+var lastValidationSuccessAt = 0;
+var VALIDATION_CACHE_FRESH_MS = 45e3;
+function getCachedValidation() {
+  return cachedValidation;
+}
+function clearValidationCache() {
+  cachedValidation = null;
+  lastValidationSuccessAt = 0;
+}
+function bumpCachedUsageAfterLog(identifiersMutated) {
+  if (!cachedValidation || identifiersMutated <= 0) return;
+  cachedValidation.mutationsUsed += identifiersMutated;
+  if (cachedValidation.mutationsRemaining !== -1) {
+    cachedValidation.mutationsRemaining = Math.max(
+      0,
+      cachedValidation.mutationsRemaining - identifiersMutated
+    );
+  }
+}
+function makeBackendReachabilityError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+async function validateKey(opts = {}) {
+  const enforceReachability = opts.enforceReachability === true;
+  const now = Date.now();
+  const cacheFresh = cachedValidation !== null && now - lastValidationSuccessAt < VALIDATION_CACHE_FRESH_MS;
+  if (!opts.force && cacheFresh) {
+    return cachedValidation;
+  }
+  const validateUrl = getCliApiUrl("auth/validate");
+  const timeoutMs = getApiRequestTimeoutMs();
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    if (enforceReachability) {
+      const err = new Error("Missing Pretense dashboard API key");
+      err.code = "MISSING_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    return null;
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(validateUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (resp.status === 401 || resp.status === 403) {
+      const raw = await resp.json().catch(() => ({}));
+      const msg = typeof raw.message === "string" ? raw.message : "API key rejected by server";
+      const err = new Error(msg);
+      err.code = typeof raw.code === "string" ? raw.code : "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    if (!resp.ok) {
+      const msg = `Pretense API returned HTTP ${resp.status} from ${validateUrl}`;
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError("AUTH_BACKEND_REJECTED", msg);
+      }
+      return null;
+    }
+    let data;
+    try {
+      data = await resp.json();
+    } catch {
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError(
+          "AUTH_BACKEND_REJECTED",
+          `Invalid JSON from ${validateUrl}`
+        );
+      }
+      return null;
+    }
+    if (typeof data.valid === "boolean" && data.valid === false) {
+      const err = new Error("API key is not valid");
+      err.code = "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    cachedValidation = data;
+    lastValidationSuccessAt = Date.now();
+    return data;
+  } catch (err) {
+    if (err.code === "KEY_REVOKED" || err.code === "KEY_EXPIRED" || err.code === "INVALID_API_KEY" || err.code === "AUTH_ERROR" || err.code === "ORG_INACTIVE" || err.code === "MISSING_API_KEY" || err.code === "BACKEND_UNAVAILABLE" || err.code === "AUTH_BACKEND_REJECTED") {
+      throw err;
+    }
+    if (enforceReachability) {
+      const msg = err.name === "AbortError" ? `Timed out after ${timeoutMs}ms reaching ${validateUrl} (raise PRETENSE_API_TIMEOUT_MS)` : `Cannot reach Pretense API at ${validateUrl}: ${err.message}`;
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw makeBackendReachabilityError("BACKEND_UNAVAILABLE", msg);
+    }
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Backend validation failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchUsageSummary(opts = {}) {
+  const summaryUrl = getCliApiUrl("usage/summary");
+  const apiKey = getApiKey();
+  if (!apiKey) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), getApiRequestTimeoutMs());
+  try {
+    const resp = await fetch(summaryUrl, {
+      method: "GET",
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (!resp.ok) return null;
+    return await resp.json();
+  } catch (err) {
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Usage summary fetch failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function isWithinLimits() {
+  const v = getCachedValidation();
+  if (!v) return { allowed: true };
+  if (v.mutationsRemaining !== -1 && v.mutationsRemaining <= 0) {
+    return {
+      allowed: false,
+      reason: `Monthly mutation limit reached (${v.mutationsUsed}/${v.monthlyMutationLimit}). Upgrade at https://pretense.ai/pricing`
+    };
+  }
+  return { allowed: true };
+}
+
+// src/log-uploader.ts
+async function uploadLog(event, options) {
+  const apiRoot = options.apiUrl?.trim() || void 0;
+  const endpoint = getCliApiUrl("log", apiRoot);
+  const { apiKey, verbose = false, timeoutMs = getApiRequestTimeoutMs() } = options;
+  if (!apiKey) return;
+  const gitCtx = options.gitContext ?? await collectGitContextCached(options.cwd);
+  const body = {
+    ...event,
+    ...gitCtx,
+    repo_remote_url: gitCtx.git_remote,
+    git_branch: gitCtx.git_branch,
+    commit_sha: gitCtx.git_commit_sha
+  };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    if (!resp.ok && verbose) {
+      process.stderr.write(`[PRETENSE] log upload HTTP ${resp.status}
+`);
+    }
+  } catch (err) {
+    if (verbose) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[PRETENSE] log upload failed: ${msg}
+`);
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/start-client-instructions.ts
+import chalk2 from "chalk";
+function printStartClientInstructions(port) {
+  const host = `http://localhost:${port}`;
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Client setup (environment variables) \u2500\u2500"));
+  console.log(chalk2.gray("Point the CLI at the Pretense backend API (optional if using default):"));
+  console.log(
+    chalk2.white(`export PRETENSE_API_URL='https://api.pretense.ai'`)
+  );
+  console.log();
+  console.log(chalk2.gray("Log in with your Pretense dashboard API key:"));
+  console.log(chalk2.white("pretense login --key your-pretense-api-key"));
+  console.log();
+  console.log(
+    chalk2.gray("Set the LLM base URL for your provider (proxy below):")
+  );
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL="${host}"`));
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL=${host}`));
+  console.log(chalk2.white(`export OPENAI_BASE_URL=${host}/v1`));
+  console.log(chalk2.white(`export GEMINI_BASE_URL=${host}/v1beta`));
+  console.log(chalk2.white(`export OLLAMA_HOST=${host}`));
+  console.log();
+  console.log(chalk2.gray("Set your real upstream LLM API key (unchanged):"));
+  console.log(chalk2.white('export ANTHROPIC_API_KEY="sk-ant-API-KEY"'));
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Stop & log out \u2500\u2500"));
+  console.log(
+    chalk2.gray(
+      "Stop the proxy: press Ctrl+C in the terminal where pretense start is running."
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "Remove the saved Pretense dashboard key from ~/.pretense/config.json:"
+    )
+  );
+  console.log(chalk2.white("pretense logout"));
+  console.log(
+    chalk2.gray(
+      "(confirm with y / cancel with n.) Mutations stop immediately unless this proxy was started with"
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "PRETENSE_API_KEY set in that same terminal \u2014 then press Ctrl+C and run pretense start again."
+    )
+  );
+  console.log();
+}
+
+// src/version.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { fileURLToPath } from "url";
+var cached = null;
+function getCliSemver() {
+  if (cached !== null) return cached;
+  try {
+    const url = new URL("../package.json", import.meta.url);
+    const raw = readFileSync6(fileURLToPath(url), "utf-8");
+    cached = JSON.parse(raw).version ?? "0.0.0";
+  } catch {
+    cached = "0.0.0";
+  }
+  return cached;
+}
+
+// src/proxy.ts
+var dashboardSavedCredentialsRevoked = false;
+function attachDashboardLogoutWatcher(enabled) {
+  if (!enabled) return;
+  const dir = getUserDashboardConfigDir();
+  let debounceTimer;
+  const applyFilesystemCredentialState = () => {
+    const fk = loadApiKey();
+    if (!fk) {
+      if (dashboardSavedCredentialsRevoked) return;
+      dashboardSavedCredentialsRevoked = true;
+      delete process.env["PRETENSE_API_KEY"];
+      clearValidationCache();
+      try {
+        process.stderr.write(
+          `\x1B[33m[PRETENSE] Saved dashboard API key removed (~/.pretense/config.json, e.g. pretense logout). LLM proxy POST requests are disabled until you run pretense login and restart pretense start.\x1B[0m
+`
+        );
+      } catch {
+      }
+      return;
+    }
+    if (dashboardSavedCredentialsRevoked) {
+      dashboardSavedCredentialsRevoked = false;
+      clearValidationCache();
+    }
+  };
+  const schedule = () => {
+    if (debounceTimer) clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(applyFilesystemCredentialState, 120);
+  };
+  try {
+    if (!existsSync6(dir)) return;
+    watch(dir, () => {
+      schedule();
+    });
+  } catch {
+  }
+}
+function anthropicUpstream() {
+  return process.env["ANTHROPIC_UPSTREAM_URL"] ?? "https://api.anthropic.com";
+}
+function openaiUpstream() {
+  return process.env["OPENAI_UPSTREAM_URL"] ?? "https://api.openai.com";
+}
+function geminiUpstream() {
+  return process.env["GEMINI_UPSTREAM_URL"] ?? "https://generativelanguage.googleapis.com";
+}
+function ollamaUpstream() {
+  return process.env["OLLAMA_UPSTREAM_URL"] ?? "http://localhost:11434";
+}
+function detectUpstream(path) {
+  if (path.startsWith("/v1/messages")) return anthropicUpstream();
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return openaiUpstream();
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return geminiUpstream();
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return ollamaUpstream();
+  return anthropicUpstream();
+}
+function detectProvider(path) {
+  if (path.startsWith("/v1/messages")) return "anthropic";
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return "openai";
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return "google";
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return "ollama";
+  return "anthropic";
+}
+function stripPretenseOnlyForwardingHeaders(headers) {
+  const drop = /* @__PURE__ */ new Set(["x-pretense-api-key", "x-pretense-key"]);
+  for (const k of [...Object.keys(headers)]) {
+    if (drop.has(k.toLowerCase())) delete headers[k];
+  }
+}
 function extractText(body) {
   const parts = [];
   if (typeof body["system"] === "string") parts.push(body["system"]);
@@ -1184,11 +2490,29 @@ function createProxy(opts = {}) {
   const store = opts.store ?? new MutationStore(`${config.storePath}/proxy-store.json`);
   const verbose = opts.verbose ?? false;
   const app = new Hono();
+  app.use("*", requireApiKey);
+  app.get(
+    "/",
+    (c) => c.json({
+      name: "pretense",
+      version: getCliSemver(),
+      status: "running",
+      routes: {
+        "GET /": "This welcome page",
+        "GET /health": "Health check with uptime",
+        "GET /stats": "Mutation statistics",
+        "GET /audit": "Audit log (?limit=50)",
+        "POST /*": "Proxy to upstream LLM API (Anthropic, OpenAI, Google auto-detected)"
+      },
+      languages: ["TypeScript", "JavaScript", "Python", "Go", "Java", "C#", "Ruby", "Rust"],
+      docs: "https://pretense.ai/docs"
+    })
+  );
   app.get(
     "/health",
     (c) => c.json({
       status: "ok",
-      version: "0.3.0",
+      version: getCliSemver(),
       uptime: Math.floor((Date.now() - stats.startedAt) / 1e3),
       stats: {
         requestsProcessed: stats.requestsProcessed,
@@ -1200,7 +2524,8 @@ function createProxy(opts = {}) {
     "/stats",
     (c) => c.json({
       ...stats,
-      storeSize: store.size
+      storeSize: store.size,
+      activeSessions: sessionCount()
     })
   );
   app.get("/audit", (c) => {
@@ -1217,6 +2542,7 @@ function createProxy(opts = {}) {
       });
       delete headers2["host"];
       headers2["host"] = new URL(upstream2).host;
+      stripPretenseOnlyForwardingHeaders(headers2);
       const resp = await fetch(url, { method: c.req.method, headers: headers2 });
       return new Response(resp.body, { status: resp.status, headers: Object.fromEntries(resp.headers.entries()) });
     }
@@ -1233,20 +2559,106 @@ function createProxy(opts = {}) {
     const requestId = nanoid(12);
     const upstream = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
     const provider = detectProvider(c.req.path);
-    const tier = detectTier();
-    const { dailyMutations } = getTierLimits(tier);
+    if (dashboardSavedCredentialsRevoked) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_session_logged_out",
+            message: "Saved Pretense dashboard credentials were removed (for example pretense logout). Run pretense login, then restart pretense start. If you started the proxy with PRETENSE_API_KEY in this shell, stop it (Ctrl+C) and start again after logout."
+          }
+        },
+        401
+      );
+    }
+    const pretenseDashboardKey = getPretenseApiKey();
+    if (!pretenseDashboardKey) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_dashboard_key_required",
+            message: "Configure your Pretense dashboard API key: run `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+          }
+        },
+        401
+      );
+    }
+    try {
+      await validateKey({ verbose, force: false, enforceReachability: true });
+    } catch (err) {
+      const code = err.code ?? "";
+      const msg = err.message;
+      const knownAuthCodes = /* @__PURE__ */ new Set([
+        "KEY_REVOKED",
+        "KEY_EXPIRED",
+        "INVALID_API_KEY",
+        "MISSING_API_KEY"
+      ]);
+      if (knownAuthCodes.has(code)) {
+        return c.json(
+          { error: { type: "pretense_auth_error", code, message: msg } },
+          401
+        );
+      }
+      if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+        return c.json(
+          { error: { type: "pretense_auth_backend_error", code, message: msg } },
+          503
+        );
+      }
+      if (code === "ORG_INACTIVE") {
+        return c.json(
+          { error: { type: "pretense_org_inactive", code, message: msg } },
+          403
+        );
+      }
+      return c.json(
+        { error: { type: "pretense_auth_error", message: msg } },
+        401
+      );
+    }
+    const sessHash = c.get("sessionHash");
+    const session = getSession(sessHash);
+    const tier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
+    const { monthlyMutations } = getTierLimits(tier);
     const usage = loadUsage();
-    if (tier === "free" && usage.mutations >= dailyMutations) {
+    if (tier === "free" && usage.mutations >= monthlyMutations) {
       return c.json(
         {
           error: {
             type: "pretense_rate_limit",
-            message: `Daily mutation limit reached (${dailyMutations}/day). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
+            message: `Monthly mutation limit reached (${monthlyMutations}/month). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
           }
         },
         429
       );
     }
+    const backendLimits = await isWithinLimits();
+    if (!backendLimits.allowed) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_rate_limit",
+            message: backendLimits.reason ?? "Mutation limit exceeded."
+          }
+        },
+        429
+      );
+    }
+    const cliAuth = getCachedValidation();
+    if (cliAuth?.permission === "read_only") {
+      return c.json(
+        {
+          error: {
+            type: "pretense_forbidden",
+            message: "This API key is read-only. Create a read_write key in the dashboard to use the Pretense proxy."
+          }
+        },
+        403
+      );
+    }
     const fullText = extractText(body);
     const secretScan = scan2(fullText);
     const blockedSecrets = secretScan.matches.filter((m) => m.action === "block");
@@ -1270,11 +2682,25 @@ function createProxy(opts = {}) {
     let tokensMutated = 0;
     const mutatedBody = applyToBody(processedBody, (text) => {
       const blocks = extractCodeBlocks(text);
-      if (blocks.length === 0) return text;
+      if (blocks.length === 0) {
+        const lang = detectLanguage(text);
+        const result = mutate(text, lang);
+        for (const [k, v] of result.map) {
+          mutationMap.set(k, v);
+          session.mutationMap.set(k, v);
+          session.reverseMap.set(v, k);
+        }
+        tokensMutated += result.stats.tokensMutated;
+        return result.mutatedCode;
+      }
       const mutatedBlocks = [];
       for (const block of blocks) {
         const result = mutate(block.code, block.language);
-        for (const [k, v] of result.map.entries()) mutationMap.set(k, v);
+        for (const [k, v] of result.map) {
+          mutationMap.set(k, v);
+          session.mutationMap.set(k, v);
+          session.reverseMap.set(v, k);
+        }
         tokensMutated += result.stats.tokensMutated;
         mutatedBlocks.push(result.mutatedCode);
       }
@@ -1282,8 +2708,23 @@ function createProxy(opts = {}) {
     });
     usage.mutations += tokensMutated;
     saveUsage(usage);
-    if (tier === "free" && usage.mutations >= 400 && usage.mutations - tokensMutated < 400) {
-      printUpgradeNudge(`${usage.mutations}/${dailyMutations} daily mutations used. Running low!`);
+    const remoteLogDisabled = process.env["PRETENSE_DISABLE_REMOTE_LOG"] === "1";
+    if (pretenseDashboardKey && !remoteLogDisabled) {
+      void uploadLog(
+        {
+          file_count: 0,
+          identifiers_mutated: tokensMutated,
+          secrets_blocked: blockedSecrets.length,
+          llm_provider: provider,
+          cli_version: getCliSemver()
+        },
+        { apiKey: pretenseDashboardKey, verbose }
+      );
+      bumpCachedUsageAfterLog(tokensMutated);
+    }
+    const warningThreshold = Math.floor(monthlyMutations * 0.8);
+    if (tier === "free" && usage.mutations >= warningThreshold && usage.mutations - tokensMutated < warningThreshold) {
+      printUpgradeNudge(`${usage.mutations}/${monthlyMutations} monthly mutations used. Running low!`);
     }
     if (tier === "free" && daysSinceFirstUse() >= 7) {
       printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited mutations, 90-day audit, Slack alerts.");
@@ -1314,6 +2755,7 @@ function createProxy(opts = {}) {
     delete headers["content-length"];
     headers["host"] = new URL(upstream).host;
     headers["x-pretense-request-id"] = requestId;
+    stripPretenseOnlyForwardingHeaders(headers);
     const forwardBody = JSON.stringify(mutatedBody);
     let upstreamResp;
     try {
@@ -1326,14 +2768,59 @@ function createProxy(opts = {}) {
       return c.json({ error: { type: "pretense_upstream_error", message: "Failed to reach upstream provider" } }, 502);
     }
     if (body["stream"] === true) {
-      return new Response(upstreamResp.body, {
+      const streamReverseMap = new Map(mutationMap);
+      const upstream2 = upstreamResp.body;
+      if (!upstream2 || tokensMutated === 0) {
+        return new Response(upstream2, {
+          status: upstreamResp.status,
+          headers: {
+            "content-type": upstreamResp.headers.get("content-type") ?? "text/event-stream",
+            "cache-control": "no-cache",
+            "x-pretense-request-id": requestId,
+            "x-pretense-protected": "true",
+            "x-pretense-mutations": String(tokensMutated)
+          }
+        });
+      }
+      const decoder = new TextDecoder();
+      const encoder = new TextEncoder();
+      let buffer = "";
+      const transform = new TransformStream({
+        transform(chunk, controller) {
+          buffer += decoder.decode(chunk, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() ?? "";
+          for (const line of lines) {
+            if (line.startsWith("data: ") && line !== "data: [DONE]") {
+              try {
+                const json = JSON.parse(line.slice(6));
+                const reversed = applyToBody(json, (text) => reverse(text, streamReverseMap));
+                controller.enqueue(encoder.encode(`data: ${JSON.stringify(reversed)}
+`));
+              } catch {
+                controller.enqueue(encoder.encode(line + "\n"));
+              }
+            } else {
+              controller.enqueue(encoder.encode(line + "\n"));
+            }
+          }
+        },
+        flush(controller) {
+          if (buffer.length > 0) {
+            controller.enqueue(encoder.encode(buffer));
+          }
+        }
+      });
+      const reversedStream = upstream2.pipeThrough(transform);
+      return new Response(reversedStream, {
         status: upstreamResp.status,
         headers: {
           "content-type": upstreamResp.headers.get("content-type") ?? "text/event-stream",
           "cache-control": "no-cache",
           "x-pretense-request-id": requestId,
           "x-pretense-protected": "true",
-          "x-pretense-mutations": String(tokensMutated)
+          "x-pretense-mutations": String(tokensMutated),
+          "x-pretense-stream-reversal": "active"
         }
       });
     }
@@ -1363,31 +2850,559 @@ function createProxy(opts = {}) {
   });
   return app;
 }
+function isPortAvailable(port) {
+  return new Promise((resolve3) => {
+    const tester = createServer().once("error", () => resolve3(false)).once("listening", () => {
+      tester.once("close", () => resolve3(true)).close();
+    }).listen(port, "127.0.0.1");
+  });
+}
+async function findAvailablePort(startPort, maxAttempts = 10) {
+  for (let i = 0; i < maxAttempts; i++) {
+    const candidate = startPort + i;
+    if (candidate < 1 || candidate > 65535) break;
+    if (await isPortAvailable(candidate)) return candidate;
+  }
+  throw new Error(
+    `No available port found in range ${startPort}-${startPort + maxAttempts - 1}. Free a port or pass --port <number>.`
+  );
+}
 function startProxy(opts = {}) {
-  const port = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
+  const requestedPort = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
   const app = createProxy(opts);
-  const tier = detectTier();
-  serve({ fetch: app.fetch, port }, () => {
-    process.stdout.write(`
-\x1B[36m\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502                                             \u2502
-\u2502   \x1B[1mPretense\x1B[0m\x1B[36m v0.3.0  [${tier.toUpperCase()}]${" ".repeat(20 - tier.length)}\u2502
-\u2502   Your code hits AI naked. We fix that.     \u2502
-\u2502                                             \u2502
-\u2502   Proxy:  http://localhost:${port}              \u2502
-\u2502   Health: http://localhost:${port}/health       \u2502
-\u2502   Stats:  http://localhost:${port}/stats        \u2502
-\u2502                                             \u2502
-\u2502   ANTHROPIC_BASE_URL=http://localhost:${port}   \u2502
-\u2502   OPENAI_BASE_URL=http://localhost:${port}/v1   \u2502
-\u2502                                             \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\x1B[0m
+  void (async () => {
+    const pretenseDashboardKeyFromEnvAtLaunch = !!process.env["PRETENSE_API_KEY"]?.trim();
+    const dashboardKey = getPretenseApiKey();
+    if (!dashboardKey || !isValidKeyShape(dashboardKey)) {
+      process.stderr.write(
+        `\x1B[31m[PRETENSE] API key required or invalid shape. Run \`pretense login --key prtns_live_...\`\x1B[0m
+\x1B[31m[PRETENSE] or set PRETENSE_API_KEY. Get a key at https://pretense.ai/dashboard/settings/api-keys\x1B[0m
+`
+      );
+      process.exit(1);
+    }
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    for (; ; ) {
+      try {
+        const validation = await validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        });
+        if (!validation) {
+          process.stderr.write(
+            `\x1B[31m[PRETENSE] Startup validation failed (no API key or unreachable backend). Cannot start proxy.\x1B[0m
+`
+          );
+          process.exit(1);
+        }
+        const plan = validation.plan ?? "FREE";
+        const remaining = validation.mutationsRemaining === -1 ? "unlimited" : String(validation.mutationsRemaining);
+        process.stdout.write(
+          `\x1B[32m[PRETENSE] Key validated: ${plan} plan` + (validation.organizationName ? ` (${validation.organizationName})` : "") + ` \u2014 ${remaining} mutations remaining\x1B[0m
+`
+        );
+        break;
+      } catch (err) {
+        const code = err.code;
+        const msg = err.message;
+        if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
 `);
-  });
+          process.stderr.write(`\x1B[31m[PRETENSE] Fix network or set PRETENSE_API_URL if using a custom API.\x1B[0m
+`);
+          process.exit(1);
+        }
+        if (code === "ORG_INACTIVE") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Your organization is inactive; contact support.\x1B[0m
+`);
+          process.exit(1);
+        }
+        const authRetryable = code === "INVALID_API_KEY" || code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "AUTH_ERROR" || code === "MISSING_API_KEY";
+        if (authRetryable && interactive) {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(
+            `\x1B[33m[PRETENSE] Enter your Pretense dashboard API key and press Enter (Ctrl+C to quit).\x1B[0m
+`
+          );
+          let entered = null;
+          for (; ; ) {
+            entered = await promptDashboardApiKeyAfterFailure();
+            if (!entered) {
+              process.stderr.write(`\x1B[31m[PRETENSE] No key entered; exiting.\x1B[0m
+`);
+              process.exit(1);
+            }
+            if (isValidKeyShape(entered)) break;
+            process.stderr.write(
+              `\x1B[31m[PRETENSE] That does not look like a Pretense dashboard key (expect prtns_live_\u2026 or pk_live_\u2026).\x1B[0m
+`
+            );
+          }
+          const savedPath = installDashboardKeyForCurrentProcess(entered);
+          process.stdout.write(`\x1B[32m[PRETENSE] Saved API key to ${savedPath}\x1B[0m
+`);
+          clearValidationCache();
+          continue;
+        }
+        if (code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "INVALID_API_KEY" || code === "AUTH_ERROR" || code === "MISSING_API_KEY") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' to fix.\x1B[0m
+`);
+          process.exit(1);
+        }
+        process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+        process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' or check connectivity.\x1B[0m
+`);
+        process.exit(1);
+      }
+    }
+    attachDashboardLogoutWatcher(!pretenseDashboardKeyFromEnvAtLaunch);
+    const bannerTier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
+    let port;
+    try {
+      port = await findAvailablePort(requestedPort, 10);
+    } catch (err) {
+      process.stderr.write(`\x1B[31m[PRETENSE] ${err.message}\x1B[0m
+`);
+      process.exit(1);
+    }
+    if (port !== requestedPort) {
+      process.stderr.write(
+        `\x1B[33m[PRETENSE] Port ${requestedPort} in use, falling back to ${port}.\x1B[0m
+`
+      );
+    }
+    printStartClientInstructions(port);
+    serve({ fetch: app.fetch, port }, () => {
+      const portStr = String(port);
+      process.stdout.write(`
+\x1B[36mPretense v${getCliSemver()}  [${bannerTier.toUpperCase()}]\x1B[0m
+  Your code hits AI naked. We fix that.
+
+  Proxy:    http://localhost:${portStr}
+  Health:   http://localhost:${portStr}/health
+  Stats:    http://localhost:${portStr}/stats
+
+  Drop-in env vars:
+    ANTHROPIC_BASE_URL=http://localhost:${portStr}
+    OPENAI_BASE_URL=http://localhost:${portStr}/v1
+    GEMINI_BASE_URL=http://localhost:${portStr}/v1beta
+    OLLAMA_HOST=http://localhost:${portStr}
+
+  Routes intercepted:
+    /v1/messages              -> Anthropic (Claude Code, SDK)
+    /v1/chat/completions      -> OpenAI (ChatGPT, Cursor)
+    /v1/responses             -> OpenAI (Codex CLI)
+    /v1beta/...               -> Google Gemini
+    /api/chat, /api/generate  -> Ollama (local)
+`);
+      setInterval(() => {
+        if (dashboardSavedCredentialsRevoked) return;
+        if (!getPretenseApiKey()) return;
+        void validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        }).catch(() => {
+        });
+      }, 6e4);
+    });
+  })();
+}
+
+// src/token-footer.ts
+import chalk3 from "chalk";
+var PLAN_LIMITS = {
+  free: { monthlyMutations: 1e3, monthlyScans: 5e3, seats: 3, pricePerMonth: "$0/month" },
+  pro: { monthlyMutations: 1e5, monthlyScans: 5e5, seats: 25, pricePerMonth: "$29/seat/month" },
+  enterprise: {
+    monthlyMutations: Number.POSITIVE_INFINITY,
+    monthlyScans: Number.POSITIVE_INFINITY,
+    seats: Number.POSITIVE_INFINITY,
+    pricePerMonth: "$99/seat/month"
+  }
+};
+function getPlanLimits(tier) {
+  return PLAN_LIMITS[tier];
+}
+function fmt(n) {
+  if (!Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+function printTokenFooter(filesScanned, mutationsMade) {
+  const tier = detectTier();
+  const limits = getPlanLimits(tier);
+  const usage = loadUsage();
+  if (tier === "enterprise") {
+    process.stderr.write(
+      chalk3.gray(`
+  ${filesScanned} files, ${mutationsMade} mutations  \xB7  Plan: Enterprise (unlimited)
+
+`)
+    );
+    return;
+  }
+  const used = usage.mutations;
+  const cap = limits.monthlyMutations;
+  const pct = cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
+  const usageStr = pct >= 80 ? chalk3.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk3.gray(`${fmt(used)} / ${fmt(cap)}`);
+  process.stderr.write(
+    `
+  ${chalk3.cyan(filesScanned + " files")}, ${chalk3.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk3.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
+`
+  );
+  if (tier === "free") {
+    if (pct >= 80) {
+      process.stderr.write(
+        chalk3.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk3.bold("pretense upgrade")}
+
+`)
+      );
+    } else {
+      process.stderr.write(
+        chalk3.gray(`  Run ${chalk3.bold("pretense status")} for details, ${chalk3.bold("pretense upgrade")} to remove limits.
+
+`)
+      );
+    }
+  } else {
+    process.stderr.write("\n");
+  }
+}
+
+// src/banner.ts
+import chalk4 from "chalk";
+var BANNER_RAW = `\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588    pretense
+\u2588\u2588          \u2588\u2588
+\u2588\u2588          \u2588\u2588    Stop your code from
+\u2588\u2588          \u2588\u2588    leaking to any LLM.
+\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588
+\u2588\u2588                pretense.ai
+\u2588\u2588
+\u2588\u2588
+\u2588\u2588
+\u2588\u2588`;
+var ICE_BLUE = "#7DD3FC";
+function shouldPrint() {
+  if (process.env.PRETENSE_NO_BANNER === "1") return false;
+  if (!process.stdout.isTTY) return false;
+  if (process.env.CI) return false;
+  return true;
+}
+function tint(line) {
+  try {
+    return chalk4.hex(ICE_BLUE)(line);
+  } catch {
+    return line;
+  }
+}
+function printBanner() {
+  if (!shouldPrint()) return;
+  const lines = BANNER_RAW.split("\n");
+  for (const line of lines) {
+    process.stderr.write(tint(line) + "\n");
+  }
+  process.stderr.write("\n");
+}
+
+// src/commands/status.ts
+import chalk5 from "chalk";
+var PLAN_LABEL = {
+  free: "Free",
+  pro: "Pro",
+  enterprise: "Enterprise"
+};
+function fmt2(n) {
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+async function runStatus() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const plan = remote.plan;
+    const tierBadge2 = plan === "ENTERPRISE" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : plan === "PRO" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
+    const lines2 = [];
+    lines2.push("");
+    lines2.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge2}  ${chalk5.green("(synced)")}`);
+    lines2.push("");
+    lines2.push(`  Plan:        ${chalk5.bold(plan)}`);
+    lines2.push(`  Mutations:   ${fmt2(remote.mutationsUsed)} / ${fmt2(remote.monthlyMutationLimit)} this month`);
+    lines2.push(`  Remaining:   ${fmt2(remote.mutationsRemaining)}`);
+    lines2.push(`  Requests:    ${fmt2(remote.requestsThisPeriod)} this period`);
+    lines2.push(`  Secrets:     ${fmt2(remote.secretsBlockedThisPeriod)} blocked`);
+    lines2.push(`  Key status:  ${remote.keyStatus === "active" ? chalk5.green("active") : chalk5.red("revoked")}`);
+    lines2.push(`  Resets at:   ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    if (remote.keyExpiresAt) {
+      lines2.push(`  Key expires: ${new Date(remote.keyExpiresAt).toLocaleDateString()}`);
+    }
+    lines2.push("");
+    if (plan === "FREE") {
+      lines2.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+      lines2.push("");
+    }
+    process.stdout.write(lines2.join("\n") + "\n");
+    return;
+  }
+  const tier = detectTier();
+  const planLimits = getPlanLimits(tier);
+  const tierLimits = getTierLimits(tier);
+  const usage = loadUsage();
+  const tierBadge = tier === "enterprise" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
+  const lines = [];
+  lines.push("");
+  lines.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge}  ${chalk5.yellow("(offline)")}`);
+  lines.push("");
+  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL[tier])} ${chalk5.gray("(" + planLimits.pricePerMonth + ")")}`);
+  lines.push(`  Mutations:   ${fmt2(usage.mutations)} / ${fmt2(planLimits.monthlyMutations)} this month`);
+  lines.push(`  Scans:       0 / ${fmt2(planLimits.monthlyScans)} this month`);
+  lines.push(`  Seats:       1 / ${fmt2(planLimits.seats)}`);
+  lines.push(`  Audit log:   ${Number.isFinite(tierLimits.auditRetentionDays) ? `${tierLimits.auditRetentionDays} days` : "unlimited"}`);
+  lines.push("");
+  if (tier === "free") {
+    lines.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+    lines.push(`  ${chalk5.gray("Credits:")}  ${chalk5.bold("pretense credits")}`);
+    lines.push("");
+  }
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/upgrade.ts
+import chalk6 from "chalk";
+var PRICING_URL = "https://pretense.ai/pricing";
+function runUpgrade() {
+  const tier = detectTier();
+  const lines = [];
+  lines.push("");
+  lines.push(chalk6.cyan.bold("  Pretense Plans"));
+  lines.push("");
+  lines.push(chalk6.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  lines.push(chalk6.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
+  lines.push(chalk6.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  lines.push(`  \u2502 Price/seat   \u2502 ${chalk6.bold("$0")}      \u2502 ${chalk6.bold("$29")}     \u2502 ${chalk6.bold("$99")}         \u2502`);
+  lines.push("  \u2502 Mutations/mo \u2502 1,000    \u2502 100,000  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Scans/mo     \u2502 5,000    \u2502 500,000  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Seats        \u2502 3        \u2502 25       \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Audit log    \u2502 30 days  \u2502 90 days  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 SSO/SAML     \u2502   -      \u2502   -      \u2502     yes     \u2502");
+  lines.push("  \u2502 On-prem      \u2502   -      \u2502   -      \u2502     yes     \u2502");
+  lines.push("  \u2502 SLA          \u2502   -      \u2502   -      \u2502   24/7      \u2502");
+  lines.push(chalk6.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  lines.push("");
+  lines.push(`  ${chalk6.gray("Current plan:")} ${chalk6.bold(tier.toUpperCase())}`);
+  lines.push(`  ${chalk6.gray("Upgrade at:")}    ${chalk6.cyan.underline(PRICING_URL)}`);
+  lines.push("");
+  lines.push(chalk6.gray("  After purchase, set:"));
+  lines.push(chalk6.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
+  lines.push("");
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/credits.ts
+import chalk7 from "chalk";
+var PLAN_LABEL2 = {
+  free: "Free",
+  pro: "Pro",
+  enterprise: "Enterprise"
+};
+function fmt3(n) {
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+function progressBar(used, cap, width = 24) {
+  if (cap === -1 || !Number.isFinite(cap) || cap <= 0) return chalk7.green("[" + "=".repeat(width) + "]");
+  const pct = Math.min(1, used / cap);
+  const filled = Math.round(pct * width);
+  const bar = "=".repeat(filled) + "-".repeat(width - filled);
+  const colored = pct >= 0.8 ? chalk7.yellow(bar) : pct >= 1 ? chalk7.red(bar) : chalk7.green(bar);
+  return "[" + colored + "]";
+}
+async function runCredits() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const used2 = remote.mutationsUsed;
+    const cap2 = remote.monthlyMutationLimit;
+    const remaining2 = remote.mutationsRemaining;
+    const pct2 = cap2 > 0 && cap2 !== -1 ? Math.round(used2 / cap2 * 100) : 0;
+    const lines2 = [];
+    lines2.push("");
+    lines2.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.green("(synced)"));
+    lines2.push("");
+    lines2.push(`  Plan:        ${chalk7.bold(remote.plan)}`);
+    lines2.push(`  Resets:      ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    lines2.push("");
+    lines2.push(`  Mutations:   ${progressBar(used2, cap2)}  ${fmt3(used2)} / ${fmt3(cap2)}`);
+    lines2.push(`  Used:        ${pct2}%`);
+    lines2.push(`  Remaining:   ${fmt3(remaining2)}`);
+    lines2.push("");
+    if (remote.plan === "FREE" && cap2 !== -1 && used2 >= cap2 * 0.8) {
+      lines2.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+      lines2.push("");
+    } else if (remote.plan === "FREE") {
+      lines2.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+      lines2.push("");
+    }
+    process.stdout.write(lines2.join("\n") + "\n");
+    return;
+  }
+  const tier = detectTier();
+  const limits = getPlanLimits(tier);
+  const usage = loadUsage();
+  const used = usage.mutations;
+  const cap = limits.monthlyMutations;
+  const remaining = Number.isFinite(cap) ? Math.max(0, cap - used) : Number.POSITIVE_INFINITY;
+  const pct = Number.isFinite(cap) && cap > 0 ? Math.round(used / cap * 100) : 0;
+  const lines = [];
+  lines.push("");
+  lines.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.yellow("(offline)"));
+  lines.push("");
+  lines.push(`  Plan:        ${chalk7.bold(PLAN_LABEL2[tier])}`);
+  lines.push(`  Month:       ${usage.month}`);
+  lines.push("");
+  lines.push(`  Mutations:   ${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
+  lines.push(`  Used:        ${pct}%`);
+  lines.push(`  Remaining:   ${fmt3(remaining)}`);
+  lines.push("");
+  if (tier === "free" && Number.isFinite(cap) && used >= cap * 0.8) {
+    lines.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+    lines.push("");
+  } else if (tier === "free") {
+    lines.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+    lines.push("");
+  }
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/logout.ts
+import readline2 from "readline/promises";
+import chalk8 from "chalk";
+async function runLogout(opts = {}) {
+  if (!loadApiKey()) {
+    console.log(chalk8.gray("No saved Pretense dashboard API key in ~/.pretense/config.json."));
+    console.log(chalk8.gray("If you use PRETENSE_API_KEY in your shell, run unset PRETENSE_API_KEY."));
+    return 0;
+  }
+  if (!opts.assumeYes) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      console.error(chalk8.red("Error: confirmation requires an interactive terminal."));
+      console.error(chalk8.gray("Run `pretense logout --yes` to skip the prompt."));
+      return 1;
+    }
+    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      const raw = await rl.question(
+        chalk8.bold("Log out and remove your saved API key? Type y for yes, n for no: ")
+      );
+      const answer = raw.trim().toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        console.log(chalk8.yellow("Logout cancelled."));
+        return 0;
+      }
+    } finally {
+      rl.close();
+    }
+  }
+  const hadEnvDashboardKey = !!process.env["PRETENSE_API_KEY"]?.trim();
+  const { removed, path } = removeSavedDashboardCredentials();
+  clearValidationCache();
+  delete process.env["PRETENSE_API_KEY"];
+  if (removed) {
+    console.log(chalk8.green("Logged out. Removed saved API key from"), chalk8.bold(path));
+    console.log(chalk8.gray("Other terminals: run unset PRETENSE_API_KEY if that variable is still exported (e.g. in ~/.zshrc)."));
+    if (hadEnvDashboardKey) {
+      console.log(
+        chalk8.yellow(
+          "This shell had PRETENSE_API_KEY set; it was cleared for this process only. Restart any running pretense proxy (Ctrl+C, then pretense start)."
+        )
+      );
+    }
+  }
+  return 0;
 }
 
 // src/index.ts
-var VERSION = "0.3.0";
+{
+  const major = parseInt(process.versions.node.split(".")[0], 10);
+  if (Number.isNaN(major) || major < 18) {
+    process.stderr.write(
+      `pretense requires Node.js 18 or newer (you have v${process.versions.node}).
+`
+    );
+    process.stderr.write(`Upgrade via nvm: nvm install 20 && nvm use 20
+`);
+    process.exit(1);
+  }
+}
+var VERSION = getCliSemver();
+var SCAN_CONCURRENCY = Math.max(2, os.cpus().length);
+var PROGRESS_INTERVAL_MS = 500;
+var SUPPORTED_LANGUAGES = ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"];
+var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java", ".cs", ".rb", ".rs"]);
+var SUPPORTED_CONFIG_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".json",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".env",
+  ".cfg",
+  ".ini",
+  ".tf",
+  ".tfstate",
+  ".tfvars",
+  ".hcl",
+  ".properties",
+  ".conf",
+  ".xml",
+  ".plist",
+  ".pem",
+  ".key",
+  ".crt",
+  ".pub",
+  ".pfx",
+  ".p12",
+  ".htpasswd"
+]);
+var SUPPORTED_FILENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".env.development",
+  ".env.staging",
+  ".env.test",
+  ".npmrc",
+  ".netrc",
+  ".pypirc",
+  "Dockerfile",
+  "docker-compose.yml",
+  "docker-compose.yaml"
+]);
+function isScannableFile(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return SUPPORTED_EXTENSIONS.has(ext) || SUPPORTED_CONFIG_EXTENSIONS.has(ext) || SUPPORTED_FILENAMES.has(basename(filePath));
+}
+function isSourceCodeFile(filePath) {
+  return SUPPORTED_EXTENSIONS.has(extname(filePath).toLowerCase());
+}
 function langFromExt(filePath) {
   const ext = extname(filePath).toLowerCase();
   const map = {
@@ -1399,26 +3414,98 @@ function langFromExt(filePath) {
     ".cjs": "javascript",
     ".py": "python",
     ".go": "go",
-    ".java": "java"
+    ".java": "java",
+    ".cs": "csharp",
+    ".rb": "ruby",
+    ".rs": "rust"
   };
   return map[ext] ?? "typescript";
 }
+function validatePort(value) {
+  const port = parseInt(value, 10);
+  if (isNaN(port) || port.toString() !== value.trim()) return null;
+  if (port < 1 || port > 65535) return null;
+  return port;
+}
+function isBinaryFile(filePath) {
+  let fd;
+  try {
+    fd = openSync(filePath, "r");
+    const buf = Buffer.alloc(8192);
+    const bytesRead = readSync2(fd, buf, 0, 8192, 0);
+    for (let i = 0; i < bytesRead; i++) {
+      if (buf[i] === 0) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+async function isBinaryFileAsync(filePath) {
+  let handle;
+  try {
+    handle = await fsOpen(filePath, "r");
+    const buf = Buffer.alloc(8192);
+    const { bytesRead } = await handle.read(buf, 0, 8192, 0);
+    for (let i = 0; i < bytesRead; i++) {
+      if (buf[i] === 0) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (handle) await handle.close().catch(() => {
+    });
+  }
+}
+function validateLanguage(lang) {
+  const normalized = lang.toLowerCase();
+  const aliases = {
+    ts: "typescript",
+    tsx: "typescript",
+    js: "javascript",
+    jsx: "javascript",
+    py: "python",
+    cs: "csharp",
+    rb: "ruby",
+    rs: "rust"
+  };
+  const resolved = aliases[normalized] ?? normalized;
+  return SUPPORTED_LANGUAGES.includes(resolved) ? resolved : null;
+}
 function collectFiles(target) {
   const abs = resolve2(target);
-  if (!existsSync4(abs)) {
+  if (!existsSync7(abs)) {
     return [];
   }
   const stat = statSync(abs);
   if (stat.isFile()) return [abs];
   const files = [];
-  const supportedExts = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java"]);
   function walk(dir) {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = join3(dir, entry.name);
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    const skipDirs = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".git",
+      "dist",
+      "build",
+      ".pretense",
+      ".next",
+      "__pycache__",
+      ".Trash"
+    ]);
+    for (const entry of entries) {
+      const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
-        if (["node_modules", ".git", "dist", "build", ".pretense", ".next", "__pycache__"].includes(entry.name)) continue;
+        if (skipDirs.has(entry.name)) continue;
         walk(fullPath);
-      } else if (entry.isFile() && supportedExts.has(extname(entry.name).toLowerCase())) {
+      } else if (entry.isFile() && isScannableFile(entry.name)) {
         files.push(fullPath);
       }
     }
@@ -1427,10 +3514,12 @@ function collectFiles(target) {
   return files;
 }
 var program = new Command();
-program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION);
+program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION).hook("preAction", () => {
+  printBanner();
+});
 program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
   const dir = resolve2(opts.dir);
-  console.log(chalk.cyan("Initializing Pretense in"), chalk.bold(dir));
+  console.log(chalk9.cyan("Initializing Pretense in"), chalk9.bold(dir));
   const configDir = initConfig(dir);
   const files = collectFiles(dir);
   const langCounts = {};
@@ -1438,133 +3527,323 @@ program.command("init").description("Initialize .pretense/ config in current dir
     const lang = langFromExt(f);
     langCounts[lang] = (langCounts[lang] ?? 0) + 1;
   }
-  console.log(chalk.green("\n  .pretense/ created at"), chalk.bold(configDir));
-  console.log(chalk.gray(`
+  console.log(chalk9.green("\n  .pretense/ created at"), chalk9.bold(configDir));
+  console.log(chalk9.gray(`
   Scanned ${files.length} source files:`));
   for (const [lang, count] of Object.entries(langCounts)) {
-    console.log(chalk.gray(`    ${lang}: ${count} files`));
+    console.log(chalk9.gray(`    ${lang}: ${count} files`));
   }
-  console.log(chalk.cyan("\n  Next: run"), chalk.bold("pretense start"), chalk.cyan("to launch the proxy"));
+  console.log(chalk9.cyan("\n  Next: run"), chalk9.bold("pretense start"), chalk9.cyan("to launch the proxy"));
   console.log();
 });
-program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action((opts) => {
+program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action(async (opts) => {
   const config = loadConfig();
-  const port = parseInt(opts.port) || config.port;
+  const port = validatePort(opts.port);
+  if (port === null) {
+    console.error(chalk9.red("Error: Invalid port number:"), chalk9.bold(opts.port));
+    console.error(chalk9.gray("Port must be an integer between 1 and 65535."));
+    process.exit(1);
+  }
+  await ensureDashboardKeyForStart();
+  logDashboardCredentialHint();
   startProxy({ config, port, verbose: opts.verbose });
 });
-program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).action((target, opts) => {
-  const files = collectFiles(target);
-  if (files.length === 0) {
-    console.error(chalk.red("No source files found at"), chalk.bold(target));
-    process.exit(1);
+async function scanOneFile(file, opts) {
+  let size = 0;
+  try {
+    const st = await fsStat(file);
+    size = st.size;
+    if (st.size > opts.maxFileSize) {
+      return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "too-large", sizeBytes: size };
+    }
+  } catch {
+    return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "read-error" };
   }
-  let totalIdentifiers = 0;
-  let totalSecrets = 0;
-  const allResults = [];
-  for (const file of files) {
-    const code = readFileSync4(file, "utf-8");
-    const lang = langFromExt(file);
-    let identifiers = 0;
-    if (!opts.secretsOnly) {
+  if (!isSourceCodeFile(file)) {
+    try {
+      if (await isBinaryFileAsync(file)) {
+        return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "binary", sizeBytes: size };
+      }
+    } catch {
+    }
+  }
+  let code;
+  try {
+    code = await readFile(file, "utf-8");
+  } catch {
+    return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "read-error", sizeBytes: size };
+  }
+  const lang = langFromExt(file);
+  let identifiers = 0;
+  if (!opts.secretsOnly && isSourceCodeFile(file)) {
+    try {
       const scanResult = scan(code, lang);
       identifiers = scanResult.tokens.length;
-      totalIdentifiers += identifiers;
+    } catch {
     }
+  }
+  let blocked = [];
+  try {
     const secretResult = scan2(code);
-    const blocked = secretResult.matches.filter((m) => m.action === "block" || m.action === "redact");
-    totalSecrets += blocked.length;
-    allResults.push({
-      file,
-      identifiers,
-      secrets: blocked.length,
-      secretTypes: blocked.map((m) => m.type)
-    });
+    blocked = secretResult.matches.filter((m) => m.action === "block" || m.action === "redact");
+  } catch {
+  }
+  return {
+    file,
+    identifiers,
+    secrets: blocked.length,
+    secretTypes: blocked.map((m) => m.type),
+    sizeBytes: size
+  };
+}
+async function scanFilesParallel(files, opts) {
+  const results = [];
+  let cursor = 0;
+  let done = 0;
+  let lastPrint = 0;
+  let interrupted = false;
+  const stopHandler = () => {
+    interrupted = true;
+  };
+  process.on("SIGINT", stopHandler);
+  process.on("SIGTERM", stopHandler);
+  const isTTY = process.stderr.isTTY === true;
+  const printProgress = (force = false) => {
+    if (opts.quiet) return;
+    const now = Date.now();
+    if (!force && now - lastPrint < PROGRESS_INTERVAL_MS) return;
+    lastPrint = now;
+    const found = results.reduce((acc, r) => acc + r.secrets, 0);
+    const msg = `Scanning ${done}/${files.length} files (${found} secrets so far)...`;
+    if (isTTY) {
+      process.stderr.write(`\r\x1B[K${msg}`);
+    } else {
+      process.stderr.write(`${msg}
+`);
+    }
+  };
+  async function worker() {
+    while (!interrupted) {
+      const i = cursor++;
+      if (i >= files.length) return;
+      const file = files[i];
+      const row = await scanOneFile(file, { secretsOnly: opts.secretsOnly, maxFileSize: opts.maxFileSize });
+      if (row) results.push(row);
+      done++;
+      printProgress();
+    }
+  }
+  printProgress(true);
+  const workers = Array.from({ length: Math.min(opts.concurrency, files.length || 1) }, () => worker());
+  await Promise.all(workers);
+  process.removeListener("SIGINT", stopHandler);
+  process.removeListener("SIGTERM", stopHandler);
+  if (!opts.quiet && isTTY) {
+    process.stderr.write(`\r\x1B[K`);
+  }
+  return { results, interrupted };
+}
+function parseSizeOption(value) {
+  const trimmed = value.trim().toLowerCase();
+  const m = /^(\d+(?:\.\d+)?)\s*(b|k|kb|m|mb|g|gb)?$/.exec(trimmed);
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  if (!isFinite(n) || n <= 0) return null;
+  const unit = m[2] ?? "b";
+  const mult = unit.startsWith("g") ? 1024 ** 3 : unit.startsWith("m") ? 1024 ** 2 : unit.startsWith("k") ? 1024 : 1;
+  return Math.floor(n * mult);
+}
+program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).option("--max-file-size <size>", "Skip files larger than this (e.g. 10mb, 500k)", "10mb").option("--concurrency <n>", "Max files scanned in parallel", String(SCAN_CONCURRENCY)).option("--quiet", "Suppress progress output", false).action(async (target, opts) => {
+  const absTarget = resolve2(target);
+  if (!existsSync7(absTarget)) {
+    console.error(chalk9.red("Error: Path not found:"), chalk9.bold(absTarget));
+    process.exit(1);
+  }
+  const maxFileSize = parseSizeOption(opts.maxFileSize);
+  if (maxFileSize === null) {
+    console.error(chalk9.red("Error: Invalid --max-file-size value:"), chalk9.bold(opts.maxFileSize));
+    console.error(chalk9.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
+    process.exit(1);
+  }
+  const concurrency = Math.max(1, parseInt(opts.concurrency, 10) || SCAN_CONCURRENCY);
+  if (!opts.quiet && !opts.json) {
+    process.stderr.write(chalk9.gray(`Discovering files in ${absTarget}...
+`));
+  }
+  const files = collectFiles(target);
+  if (files.length === 0) {
+    console.error(chalk9.red("Error: No source files found at"), chalk9.bold(absTarget));
+    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    process.exit(1);
+  }
+  if (!opts.quiet && !opts.json) {
+    process.stderr.write(chalk9.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
+`));
   }
+  const startedAt = Date.now();
+  const { results: allResults, interrupted } = await scanFilesParallel(files, {
+    secretsOnly: opts.secretsOnly,
+    maxFileSize,
+    quiet: opts.quiet || opts.json,
+    concurrency
+  });
+  const elapsedMs = Date.now() - startedAt;
+  const totalIdentifiers = allResults.reduce((acc, r) => acc + r.identifiers, 0);
+  const totalSecrets = allResults.reduce((acc, r) => acc + r.secrets, 0);
+  const skippedLarge = allResults.filter((r) => r.skipped === "too-large").length;
+  const skippedBinary = allResults.filter((r) => r.skipped === "binary").length;
   if (opts.json) {
-    console.log(JSON.stringify({ files: allResults, totalIdentifiers, totalSecrets }, null, 2));
+    console.log(JSON.stringify({
+      files: allResults,
+      totalIdentifiers,
+      totalSecrets,
+      skippedLarge,
+      skippedBinary,
+      elapsedMs,
+      interrupted
+    }, null, 2));
   } else {
-    console.log(chalk.cyan("\nPretense Scan Results\n"));
+    console.log(chalk9.cyan("\nPretense Scan Results\n"));
     for (const r of allResults) {
-      const secretBadge = r.secrets > 0 ? chalk.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      if (r.skipped) {
+        if (r.skipped === "too-large") {
+          const mb = ((r.sizeBytes ?? 0) / 1024 / 1024).toFixed(1);
+          console.log(chalk9.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
+        }
+        continue;
+      }
+      const secretBadge = r.secrets > 0 ? chalk9.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      const showRow = r.secrets > 0 || !opts.secretsOnly && r.identifiers > 0;
+      if (!showRow) continue;
       console.log(
-        chalk.gray("  ") + chalk.white(r.file) + chalk.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+        chalk9.gray("  ") + chalk9.white(r.file) + chalk9.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
       );
       if (r.secrets > 0) {
         for (const t of r.secretTypes) {
-          console.log(chalk.red(`    ! ${t}`));
+          console.log(chalk9.red(`    ! ${t}`));
         }
       }
     }
-    console.log(chalk.gray(`
-  Total: ${files.length} files, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk.red(`${totalSecrets} secrets found`) : chalk.green("0 secrets")));
+    const skipNote = skippedLarge + skippedBinary > 0 ? chalk9.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
+    console.log(
+      chalk9.gray(`
+  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk9.red(`${totalSecrets} secrets found`) : chalk9.green("0 secrets")) + skipNote
+    );
+    if (interrupted) {
+      console.log(chalk9.yellow("\n  Interrupted \u2014 partial results shown above."));
+    }
     console.log();
   }
+  if (!opts.json) {
+    printTokenFooter(allResults.length, totalIdentifiers);
+  }
+  if (interrupted) {
+    process.exit(130);
+  }
   if (totalSecrets > 0) {
     process.exit(2);
   }
 });
-program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
+program.command("mutate <file>").description("Mutate identifiers for stdout (scanner redacts secrets/PII in the source first)").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync4(absPath)) {
-    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+  if (!existsSync7(absPath)) {
+    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
     process.exit(1);
   }
-  const code = readFileSync4(absPath, "utf-8");
-  const lang = langFromExt(absPath);
-  const result = mutate(code, lang, opts.seed);
+  if (opts.language) {
+    const validLang = validateLanguage(opts.language);
+    if (!validLang) {
+      console.error(chalk9.red("Error: Unsupported language:"), chalk9.bold(opts.language));
+      console.error(chalk9.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
+      process.exit(1);
+    }
+  }
+  if (!SUPPORTED_EXTENSIONS.has(extname(absPath).toLowerCase()) && isBinaryFile(absPath)) {
+    console.error(chalk9.red("Error: Not a supported source file:"), chalk9.bold(absPath));
+    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    process.exit(1);
+  }
+  const code = readFileSync7(absPath, "utf-8");
+  const lang = opts.language ? validateLanguage(opts.language) : langFromExt(absPath);
+  const secretScan = scan2(code);
+  const effectiveSeed = opts.seed === "pretense" ? buildSaltedSeed(opts.seed) : opts.seed;
+  const { redactedCode: redacted, secretsMap } = applyRedactionsTracked(code, secretScan.matches, effectiveSeed);
+  const secretsRedacted = secretsMap.size;
+  const result = mutate(redacted, lang, opts.seed);
   if (opts.save) {
     const configDir = getConfigDir();
-    const store = new MutationStore(join3(configDir, "mutation-map.json"));
+    const store = new MutationStore(join5(configDir, "mutation-map.json"));
     store.load();
     store.save({
       id: absPath,
       originalHash: absPath,
       mapEntries: MutationStore.fromMap(result.map),
+      secretsMapEntries: [...secretsMap.entries()],
       timestamp: Date.now(),
       language: lang
     });
     store.persist();
-    process.stderr.write(chalk.gray(`Mutation map saved to ${configDir}/mutation-map.json
+    process.stderr.write(chalk9.gray(`Mutation map saved to ${configDir}/mutation-map.json
 `));
   }
   if (opts.json) {
     console.log(JSON.stringify({
       mutatedCode: result.mutatedCode,
       map: Object.fromEntries(result.map),
-      stats: result.stats
+      stats: result.stats,
+      secretsRedacted,
+      secretsMap: Object.fromEntries(secretsMap)
     }, null, 2));
   } else {
     process.stdout.write(result.mutatedCode);
-    process.stderr.write(chalk.gray(`
+    if (secretsRedacted > 0) {
+      process.stderr.write(
+        chalk9.gray(`--- ${secretsRedacted} secret/PII span(s) redacted before identifier mutation ---
+`)
+      );
+    }
+    process.stderr.write(chalk9.gray(`
 --- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
 `));
+    printTokenFooter(1, result.stats.tokensMutated);
   }
 });
 program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync4(absPath)) {
-    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+  if (!existsSync7(absPath)) {
+    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
     process.exit(1);
   }
-  const mutatedCode = readFileSync4(absPath, "utf-8");
-  const mapPath = opts.map ? resolve2(opts.map) : join3(getConfigDir(), "mutation-map.json");
-  if (!existsSync4(mapPath)) {
-    console.error(chalk.red("Mutation map not found:"), chalk.bold(mapPath));
-    console.error(chalk.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+  const mutatedCode = readFileSync7(absPath, "utf-8");
+  const mapPath = opts.map ? resolve2(opts.map) : join5(getConfigDir(), "mutation-map.json");
+  if (!existsSync7(mapPath)) {
+    console.error(chalk9.red("Error: Mutation map not found:"), chalk9.bold(mapPath));
+    console.error(chalk9.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+    process.exit(1);
+  }
+  let store;
+  try {
+    store = new MutationStore(mapPath);
+    store.load();
+  } catch {
+    console.error(chalk9.red("Error: Failed to load mutation map:"), chalk9.bold(mapPath));
+    console.error(chalk9.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
     process.exit(1);
   }
-  const store = new MutationStore(mapPath);
-  store.load();
   const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
   if (!entry) {
-    console.error(chalk.red("No mutation map found for this file."));
+    console.error(chalk9.red("Error: No mutation map entries found."));
+    console.error(chalk9.gray("Run 'pretense mutate --save <file>' first to generate a map."));
     process.exit(1);
   }
   const map = MutationStore.toMap(entry);
-  const restored = reverse(mutatedCode, map);
+  const secretsMap = entry.secretsMapEntries ? new Map(entry.secretsMapEntries) : void 0;
+  const restored = reverse(mutatedCode, map, secretsMap);
   process.stdout.write(restored);
-  process.stderr.write(chalk.gray(`
---- Reversed ${map.size} mutations ---
+  const secretsCount = secretsMap?.size ?? 0;
+  const secretsSuffix = secretsCount > 0 ? ` + ${secretsCount} secret(s)` : "";
+  process.stderr.write(chalk9.gray(`
+--- Reversed ${map.size} mutations${secretsSuffix} ---
 `));
 });
 program.command("audit").description("View the audit log").option("--json", "Output as JSON", false).option("--csv", "Output as CSV", false).option("-l, --limit <number>", "Limit entries", "50").action((opts) => {
@@ -1577,5 +3856,39 @@ program.command("audit").description("View the audit log").option("--json", "Out
 program.command("version").description("Print Pretense CLI version").action(() => {
   console.log(`@pretense/cli v${VERSION}`);
 });
+program.command("status").description("Show current plan, monthly quota, seat usage").action(async () => {
+  await runStatus();
+});
+program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(async () => {
+  await runStatus();
+});
+program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(async () => {
+  await runCredits();
+});
+program.command("upgrade").description("Compare plans and upgrade to Pro or Enterprise").action(() => {
+  runUpgrade();
+});
+program.command("credits").description("Show remaining mutation/scan budget for the current month").action(async () => {
+  await runCredits();
+});
+program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (prtns_live_... or pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
+  const code = runLogin({ key: opts.key });
+  if (code !== 0) process.exit(code);
+});
+program.command("logout").description("Remove the saved Pretense dashboard API key from ~/.pretense/config.json").option("-y, --yes", "Skip confirmation prompt", false).action(async (opts) => {
+  const code = await runLogout({ assumeYes: opts.yes === true });
+  if (code !== 0) process.exit(code);
+});
+function handleFatalError(err) {
+  if (err instanceof Error && err.message) {
+    console.error(chalk9.red("Error:"), err.message);
+  } else {
+    console.error(chalk9.red("An unexpected error occurred."));
+  }
+  process.exit(1);
+}
+process.on("uncaughtException", handleFatalError);
+process.on("unhandledRejection", handleFatalError);
+program.showSuggestionAfterError(true).showHelpAfterError("(use --help for available commands)");
 program.parse();
 //# sourceMappingURL=index.js.map