@pretense/cli 0.3.1 → 0.4.0

package/dist/index.js

@@ -2,8 +2,16 @@
 
 // src/index.ts
 import { Command } from "commander";
-import chalk7 from "chalk";
-import { readFileSync as readFileSync6, existsSync as existsSync6, readdirSync, statSync, openSync, readSync as readSync2, closeSync } from "fs";
+import chalk9 from "chalk";
+import {
+  readFileSync as readFileSync7,
+  existsSync as existsSync7,
+  readdirSync,
+  statSync,
+  openSync,
+  readSync as readSync2,
+  closeSync
+} from "fs";
 import { readFile, stat as fsStat, open as fsOpen } from "fs/promises";
 import { resolve as resolve2, extname, join as join5, basename } from "path";
 import os from "os";
@@ -449,6 +457,15 @@ function scanTypeScript(code) {
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     // Multi-line comment
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Quoted HTTP header names (fetch/axios headers objects) — mutated, not vendor-identifying literals
+    { re: /"(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)"/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    { re: /'(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)'/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    // Unquoted `Authorization` key — value must start with a string/template (skips interface/type shapes)
+    {
+      re: /(?:\{|\,)\s*(Authorization)\s*:\s*(?=[`'"])/g,
+      type: "HttpHeaderString" /* HttpHeaderString */,
+      groupIndex: 1
+    },
     // Import source (the module path string)
     { re: /\bimport\b[^'"]*['"]([^'"]+)['"]/g, type: "Import" /* Import */, groupIndex: 1 },
     // Class name
@@ -456,11 +473,18 @@ function scanTypeScript(code) {
     // Function/method name (function keyword)
     { re: /\bfunction\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Function" /* Function */, groupIndex: 1 },
     // Arrow function assigned to const/let/var
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
     // Method: identifier followed by (
     { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
-    // Variable declarations
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Env-style binding names with hyphens or dots (e.g. AWS-SECRET-KEY, AWS.SECRET.KEY) — not valid JS identifiers but common in pasted config
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*(?:(?:-|\.)(?:[A-Za-z0-9_$]+))+)(?=\s*=)/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Variable declarations (exclude names continued with -/. so AWS-SECRET-KEY is captured only by the rule above)
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Member receiver: matches in matches.push, row in row.patientId, def in def.name
+    { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:\.|\?\.)[^0-9]/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Property after . or ?. when not immediately followed by ( — method calls use Method rule
+    { re: /\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
+    { re: /\?\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Template literals (preserve backtick wrapper)
     { re: /`[^`]*`/g, type: "String" /* String */ },
     // Double-quoted strings
@@ -478,9 +502,12 @@ function scanTypeScript(code) {
       if (!captureValue || captureValue.trim() === "") continue;
       if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (TS_JS_KEYWORDS.has(captureValue)) continue;
-        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename)$/.test(captureValue)) continue;
+        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename|Intl|WebAssembly)$/.test(captureValue)) continue;
         if (captureValue.length <= 1) continue;
       }
+      if (type === "Property" /* Property */ && captureValue === "meta" && code.slice(Math.max(0, captureStart - 7), captureStart) === "import.") {
+        continue;
+      }
       tokens.push({
         type,
         value: captureValue,
@@ -490,7 +517,18 @@ function scanTypeScript(code) {
       });
     }
   }
-  return deduplicate(tokens);
+  const commentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const stringLikeSpans = tokens.filter(
+    (t) => t.type === "String" /* String */ || t.type === "HttpHeaderString" /* HttpHeaderString */
+  );
+  const dropsSpanOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (commentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (stringLikeSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsSpanOverlap));
 }
 function scanPython(code) {
   const tokens = [];
@@ -508,6 +546,11 @@ function scanPython(code) {
     { re: /\bclass\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
     // Function/method def
     { re: /\bdef\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Call site: method name in obj.method(
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // obj.attr receiver and attribute (matches.push-style)
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\.\s*(?=[a-zA-Z_])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    { re: /\.([A-Za-z_][A-Za-z0-9_]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Variable assignment (simple name = ...)
     { re: /^([A-Za-z_][A-Za-z0-9_]*)\s*=/gm, type: "Variable" /* Variable */, groupIndex: 1 },
     // Double-quoted strings
@@ -523,7 +566,7 @@ function scanPython(code) {
       const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
       const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
       if (!captureValue || captureValue.trim() === "") continue;
-      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (PYTHON_KEYWORDS.has(captureValue)) continue;
         if (captureValue.length <= 1) continue;
         if (captureValue.startsWith("__") && captureValue.endsWith("__")) continue;
@@ -537,7 +580,16 @@ function scanPython(code) {
       });
     }
   }
-  return deduplicate(tokens);
+  const pyCommentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const pyStringSpans = tokens.filter((t) => t.type === "String" /* String */);
+  const dropsPyOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (pyCommentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (pyStringSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsPyOverlap));
 }
 function scanGo(code) {
   const tokens = [];
@@ -850,7 +902,7 @@ function buildSaltedSeed(baseSeed) {
   return `${baseSeed}:${getMutationSalt()}`;
 }
 
-// src/mutator.ts
+// src/deterministic-id.ts
 function hash32(str) {
   let h = 5381;
   for (let i = 0; i < str.length; i++) {
@@ -868,11 +920,13 @@ function toAlphaNum(n, len) {
   }
   return result;
 }
-function deterministicId(original, seed, prefix, len = 4) {
+function deterministicSyntheticId(original, seed, prefix, len = 4) {
   const combined = `${seed}:${prefix}:${original}`;
   const h = hash32(combined);
   return prefix + toAlphaNum(h, len);
 }
+
+// src/mutator.ts
 function prefixForType(type) {
   switch (type) {
     case "Class" /* Class */:
@@ -884,6 +938,8 @@ function prefixForType(type) {
       return "_v";
     case "Property" /* Property */:
       return "_prop";
+    case "HttpHeaderString" /* HttpHeaderString */:
+      return "_hk";
     default:
       return "_tok";
   }
@@ -910,11 +966,24 @@ function mutate(code, language, seed = "pretense") {
     if (token.type === "String" /* String */) {
       continue;
     }
+    if (token.type === "HttpHeaderString" /* HttpHeaderString */) {
+      const qm = /^("|')(.+)\1$/.exec(token.value);
+      if (qm) {
+        const inner = qm[2];
+        const q = qm[1];
+        const syntheticInner = deterministicSyntheticId(inner, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, `${q}${syntheticInner}${q}`);
+      } else {
+        const syntheticInner = deterministicSyntheticId(token.value, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, syntheticInner);
+      }
+      continue;
+    }
     if (token.type === "Import" /* Import */) {
       continue;
     }
     const prefix = prefixForType(token.type);
-    const synthetic = deterministicId(token.value, effectiveSeed, prefix);
+    const synthetic = deterministicSyntheticId(token.value, effectiveSeed, prefix);
     map.set(token.value, synthetic);
   }
   const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
@@ -942,22 +1011,31 @@ function mutate(code, language, seed = "pretense") {
 }
 
 // src/reverser.ts
-function reverse(mutatedCode, map) {
-  if (!mutatedCode || map.size === 0) return mutatedCode;
-  const reverseMap = /* @__PURE__ */ new Map();
-  for (const [original, synthetic] of map.entries()) {
-    if (synthetic === "" || !synthetic) continue;
-    reverseMap.set(synthetic, original);
-  }
-  if (reverseMap.size === 0) return mutatedCode;
-  const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+function reverse(mutatedCode, map, secretsMap) {
+  if (!mutatedCode) return mutatedCode;
   let result = mutatedCode;
-  for (const [synthetic, original] of sortedEntries) {
-    const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
-      result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
-    } else {
-      result = result.split(synthetic).join(original);
+  if (map.size > 0) {
+    const reverseMap = /* @__PURE__ */ new Map();
+    for (const [original, synthetic] of map.entries()) {
+      if (synthetic === "" || !synthetic) continue;
+      reverseMap.set(synthetic, original);
+    }
+    if (reverseMap.size > 0) {
+      const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+      for (const [synthetic, original] of sortedEntries) {
+        const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
+          result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
+        } else {
+          result = result.split(synthetic).join(original);
+        }
+      }
+    }
+  }
+  if (secretsMap && secretsMap.size > 0) {
+    const sortedSecrets = [...secretsMap.entries()].sort((a, b) => b[0].length - a[0].length);
+    for (const [placeholder, original] of sortedSecrets) {
+      result = result.split(placeholder).join(original);
     }
   }
   return result;
@@ -966,16 +1044,40 @@ function reverse(mutatedCode, map) {
 // src/secrets.ts
 var SECRET_PATTERNS = [
   { name: "anthropic-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,}/g },
-  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-[A-Za-z0-9]{20,}/g },
+  /** Legacy `sk-…` and modern `sk-proj-…` (hyphenated body); aligned with @pretense/scanner */
+  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: "aws-access-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /AKIA[0-9A-Z]{16}/g },
-  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/g },
+  /** `AWS_SECRET = '…40 chars…'` (not `AWS_SECRET_ACCESS_KEY`, which is covered below). */
+  { name: "aws-secret-assignment", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bAWS_SECRET\s*=\s*['"]([A-Za-z0-9/+=]{40})['"]/gd, valueGroup: 1 },
+  /**
+   * Env-style labels with `-` or `.` (e.g. `AWS-SECRET-KEY`, `AWS.SECRET.KEY`, long `ACCESS` forms).
+   * Case-insensitive `AWS` / `SECRET` / `KEY`. Value: 40-char secret; quotes optional (matches aws-secret-key).
+   */
+  {
+    name: "aws-secret-key-delimited",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bAWS[-.]SECRET(?:[-.]ACCESS)?[-.]KEY\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gdi,
+    valueGroup: 1
+  },
+  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gd, valueGroup: 1 },
   { name: "github-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g },
   { name: "github-fine-grained", category: "secret", severity: "critical", defaultAction: "block", pattern: /github_pat_[A-Za-z0-9_]{22,}/g },
   { name: "stripe-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}/g },
-  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  /** Three base64url JWT segments; payload segment is not required to start with `eyJ` (Supabase and many issuers use compact payloads). */
+  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}/g },
   { name: "database-url", category: "credential", severity: "critical", defaultAction: "block", pattern: /(?:postgres|mysql|mongodb|redis|amqp):\/\/[^\s'"\\)]+:[^\s'"\\)]+@[^\s'"\\)]+/g },
-  { name: "generic-password", category: "credential", severity: "high", defaultAction: "redact", pattern: /(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"][^\s'"]{8,}['"]/gi },
+  {
+    name: "generic-password",
+    category: "credential",
+    severity: "high",
+    defaultAction: "redact",
+    // Do not match `token` / `secret` inside identifiers (e.g. GITHUB_TOKEN, AWS_SECRET): require no word/underscore before keyword.
+    pattern: /(?<![A-Za-z0-9_])(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"]([^\s'"]{8,})['"]/gid,
+    valueGroup: 1
+  },
   { name: "slack-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/g },
   { name: "google-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /AIza[A-Za-z0-9_-]{35}/g },
   { name: "npm-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /npm_[A-Za-z0-9]{36}/g },
@@ -1009,7 +1111,28 @@ var SECRET_PATTERNS = [
   { name: "x509-certificate", category: "secret", severity: "high", defaultAction: "redact", pattern: /-----BEGIN CERTIFICATE-----/g },
   { name: "launchdarkly-sdk-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bsdk-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
   { name: "launchdarkly-mobile-key", category: "secret", severity: "high", defaultAction: "block", pattern: /\bmob-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
-  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{32,}\b/g }
+  /** Stripe signing secrets are often 32+ chars; allow shorter synthetic/test tails so redaction still applies. */
+  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g },
+  /** Stripe Price / product IDs (`price_…`) — identifiers, not card data, but leak billing context. */
+  { name: "stripe-price-id", category: "secret", severity: "high", defaultAction: "block", pattern: /\bprice_[A-Za-z0-9_]{14,}\b/g },
+  /** `FOO_PASSWORD = '…'` / `NEXT_PUBLIC_*_PASSWORD` — generic-password skips when `password` is preceded by `_`. */
+  {
+    name: "env-password-assignment",
+    category: "credential",
+    severity: "high",
+    defaultAction: "block",
+    pattern: /\b[A-Z][A-Z0-9_]*PASSWORD\s*=\s*['"]([^'"]{6,})['"]/gd,
+    valueGroup: 1
+  },
+  /** Quoted common DB dialect names — stack hints when mutating env-style config. */
+  {
+    name: "quoted-db-dialect",
+    category: "credential",
+    severity: "medium",
+    defaultAction: "block",
+    pattern: /(['"])(postgres|mysql|redis)\1/gd,
+    valueGroup: 2
+  }
 ];
 var PII_PATTERNS = [
   { name: "ssn", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
@@ -1076,7 +1199,17 @@ function scan2(text, actionOverrides) {
     def.pattern.lastIndex = 0;
     let m;
     while ((m = def.pattern.exec(text)) !== null) {
-      const value = m[0];
+      let value = m[0];
+      let start2 = m.index;
+      let end = start2 + value.length;
+      if (def.valueGroup !== void 0) {
+        const span = m.indices?.[def.valueGroup];
+        if (!span) continue;
+        const [gs, ge] = span;
+        value = text.slice(gs, ge);
+        start2 = gs;
+        end = ge;
+      }
       if (def.validate && !def.validate(value)) continue;
       const action = actionOverrides?.[def.name] ?? def.defaultAction;
       matchCounter++;
@@ -1086,8 +1219,8 @@ function scan2(text, actionOverrides) {
         type: def.name,
         value,
         masked: maskValue(value, def.name),
-        start: m.index,
-        end: m.index + value.length,
+        start: start2,
+        end,
         severity: def.severity,
         action
       });
@@ -1151,14 +1284,26 @@ function scan2(text, actionOverrides) {
   };
 }
 function applyRedactions(text, matches) {
-  const sorted = [...matches].sort((a, b) => b.start - a.start);
+  return applyRedactionsTracked(text, matches).redactedCode;
+}
+var SECRET_LITERAL_PREFIX = "_sl";
+function applyRedactionsTracked(text, matches, mutationSeed = buildSaltedSeed("pretense")) {
+  const actionable = matches.filter((m) => m.action === "block" || m.action === "redact");
+  const sorted = [...actionable].sort((a, b) => b.start - a.start);
+  const secretsMap = /* @__PURE__ */ new Map();
+  const placeholders = /* @__PURE__ */ new Map();
+  const forward = [...actionable].sort((a, b) => a.start - b.start);
+  for (const match of forward) {
+    const tag = deterministicSyntheticId(`${match.id}:${match.start}`, mutationSeed, SECRET_LITERAL_PREFIX);
+    placeholders.set(match.id, tag);
+    secretsMap.set(tag, match.value);
+  }
   let result = text;
   for (const match of sorted) {
-    if (match.action === "block" || match.action === "redact") {
-      result = result.slice(0, match.start) + `[PRETENSE:${match.type.toUpperCase()}]` + result.slice(match.end);
-    }
+    const tag = placeholders.get(match.id);
+    result = result.slice(0, match.start) + tag + result.slice(match.end);
   }
-  return result;
+  return { redactedCode: result, secretsMap };
 }
 
 // src/store.ts
@@ -1405,6 +1550,11 @@ function detectTier() {
   if (key.startsWith("pre_pro_") && isValidLicenseKey(key, "pre_pro_")) return "pro";
   return "free";
 }
+function tierFromDashboardPlan(plan, fallback) {
+  if (plan === "ENTERPRISE") return "enterprise";
+  if (plan === "PRO") return "pro";
+  return fallback;
+}
 function getTierLimits(tier) {
   switch (tier) {
     case "enterprise":
@@ -1512,6 +1662,7 @@ import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { nanoid } from "nanoid";
 import { createServer } from "net";
+import { existsSync as existsSync6, watch } from "fs";
 
 // src/auth.ts
 import { createHash } from "crypto";
@@ -1575,7 +1726,657 @@ function sessionCount() {
   return sessions.size;
 }
 
+// src/git-context.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var GIT_TIMEOUT_MS = 2e3;
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      timeout: GIT_TIMEOUT_MS,
+      windowsHide: true
+    });
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sanitizeRemote(raw) {
+  if (/^[\w.-]+@[^:]+:/.test(raw) && !raw.includes("://")) {
+    return raw;
+  }
+  try {
+    const url = new URL(raw);
+    url.username = "";
+    url.password = "";
+    return url.toString();
+  } catch {
+    return raw;
+  }
+}
+async function collectGitContext(cwd = process.cwd()) {
+  const insideRepo = await runGit(["rev-parse", "--is-inside-work-tree"], cwd);
+  if (insideRepo !== "true") return {};
+  const [remote, branch, sha] = await Promise.all([
+    runGit(["remote", "get-url", "origin"], cwd),
+    runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd),
+    runGit(["rev-parse", "HEAD"], cwd)
+  ]);
+  const ctx = {};
+  if (remote) ctx.git_remote = sanitizeRemote(remote);
+  if (branch && branch !== "HEAD") ctx.git_branch = branch;
+  if (sha) ctx.git_commit_sha = sha;
+  return ctx;
+}
+var CACHE_TTL_MS = 3e4;
+var cache = /* @__PURE__ */ new Map();
+async function collectGitContextCached(cwd = process.cwd(), now = Date.now()) {
+  const hit = cache.get(cwd);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const value = await collectGitContext(cwd);
+  cache.set(cwd, { value, expiresAt: now + CACHE_TTL_MS });
+  return value;
+}
+
+// src/commands/login.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+import readline from "readline/promises";
+import chalk from "chalk";
+var CONFIG_DIR_NAME2 = ".pretense";
+var CONFIG_FILE2 = "config.json";
+function getUserDashboardConfigDir() {
+  return join4(homedir2(), CONFIG_DIR_NAME2);
+}
+function getUserDashboardConfigPath() {
+  return join4(getUserDashboardConfigDir(), CONFIG_FILE2);
+}
+function isValidKeyShape(key) {
+  const trimmed = key.trim();
+  if (trimmed.length < 24) return false;
+  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
+  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_") || trimmed.startsWith("prtns_live_");
+}
+function readStdinIfPiped() {
+  if (process.stdin.isTTY) return "";
+  try {
+    const chunks = [];
+    const buf = Buffer.alloc(4096);
+    let bytesRead = 0;
+    do {
+      try {
+        bytesRead = readSync(0, buf, 0, buf.length, null);
+      } catch {
+        bytesRead = 0;
+      }
+      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
+    } while (bytesRead === buf.length);
+    return Buffer.concat(chunks).toString("utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function maskKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 12) return trimmed;
+  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
+}
+function logDashboardCredentialHint() {
+  const env = process.env["PRETENSE_API_KEY"]?.trim() ?? "";
+  const envOk = env.length > 0 && isValidKeyShape(env);
+  const abs = getUserDashboardConfigPath();
+  const fk = loadApiKey();
+  if (envOk) {
+    console.error(
+      chalk.gray(
+        `[pretense] Dashboard key source: PRETENSE_API_KEY in environment (${maskKey(env)}) \u2014 unset this variable after logout if you expect no key.`
+      )
+    );
+  } else if (fk && isValidKeyShape(fk)) {
+    console.error(chalk.gray(`[pretense] Dashboard key source: ${abs} (${maskKey(fk)})`));
+  } else {
+    console.error(chalk.gray("[pretense] Dashboard key source: none configured."));
+  }
+}
+function saveApiKey(key, configDir = getUserDashboardConfigDir()) {
+  if (!existsSync5(configDir)) {
+    mkdirSync5(configDir, { recursive: true });
+  }
+  const path = join4(configDir, CONFIG_FILE2);
+  let existing = {};
+  if (existsSync5(path)) {
+    try {
+      existing = JSON.parse(readFileSync5(path, "utf-8"));
+    } catch {
+      existing = {};
+    }
+  }
+  const next = {
+    ...existing,
+    api_key: key.trim(),
+    saved_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return path;
+}
+function removeSavedDashboardCredentials(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return { removed: false, path };
+  let existing = {};
+  try {
+    existing = JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return { removed: false, path };
+  }
+  const ak = existing.api_key;
+  const hadKey = typeof ak === "string" && ak.trim().length > 0;
+  if (!hadKey) return { removed: false, path };
+  delete existing.api_key;
+  delete existing.saved_at;
+  writeFileSync4(path, JSON.stringify(existing, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return { removed: true, path };
+}
+function loadApiKey(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return null;
+  try {
+    const raw = readFileSync5(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.api_key === "string") {
+      const t = parsed.api_key.trim();
+      if (t.length > 0) return t;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveDashboardKeyCandidate() {
+  const env = (process.env["PRETENSE_API_KEY"] ?? "").trim();
+  if (env.length > 0) {
+    if (!isValidKeyShape(env)) {
+      return { key: null, fromFile: false, badEnv: true };
+    }
+    return { key: env, fromFile: false, badEnv: false };
+  }
+  const fileKey = loadApiKey();
+  if (fileKey && isValidKeyShape(fileKey)) {
+    return { key: fileKey.trim(), fromFile: true, badEnv: false };
+  }
+  return { key: null, fromFile: Boolean(fileKey), badEnv: false };
+}
+function installDashboardKeyForCurrentProcess(key) {
+  const trimmed = key.trim();
+  const path = saveApiKey(trimmed);
+  process.env["PRETENSE_API_KEY"] = trimmed;
+  return path;
+}
+async function promptDashboardApiKeyAfterFailure() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const line = (await rl.question(chalk.bold("Pretense dashboard API key: "))).trim();
+    return line.length > 0 ? line : null;
+  } finally {
+    rl.close();
+  }
+}
+async function ensureDashboardKeyForStart() {
+  const { key, fromFile, badEnv } = resolveDashboardKeyCandidate();
+  if (badEnv) {
+    console.error(chalk.red("Error: PRETENSE_API_KEY is set but is not a valid Pretense dashboard API key shape."));
+    console.error(
+      chalk.gray("Keys look like prtns_live_\u2026 or pk_live_\u2026. Fix the variable or unset it to use ~/.pretense/config.json.")
+    );
+    process.exit(1);
+  }
+  if (key) {
+    return;
+  }
+  if (fromFile) {
+    console.warn(
+      chalk.yellow(
+        "Ignoring invalid `api_key` in ~/.pretense/config.json (wrong shape). Enter a new key or run `pretense login --key ...`."
+      )
+    );
+  }
+  const stdinOk = process.stdin.isTTY;
+  const stdoutOk = process.stdout.isTTY;
+  if (!stdinOk || !stdoutOk) {
+    console.error(chalk.red("Error: Pretense API key required to start the proxy."));
+    console.error(
+      chalk.gray(
+        "Save one with `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+      )
+    );
+    process.exit(1);
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    console.log(chalk.cyan("No Pretense API key found in ~/.pretense/config.json or $PRETENSE_API_KEY."));
+    const entered = (await rl.question(chalk.bold("Enter your Pretense API key: "))).trim();
+    if (!entered) {
+      console.error(chalk.red("No key entered; exiting."));
+      process.exit(1);
+    }
+    if (!isValidKeyShape(entered)) {
+      console.error(chalk.red("That does not look like a Pretense API key (expect prtns_live_\u2026 or pk_live_\u2026)."));
+      console.error(chalk.gray("Get one from your Pretense dashboard, then run `pretense login --key ...`."));
+      process.exit(1);
+    }
+    const path = installDashboardKeyForCurrentProcess(entered);
+    console.log(chalk.green("Saved API key to"), chalk.bold(path));
+    console.log(chalk.gray(`  ${maskKey(entered)}`));
+  } finally {
+    rl.close();
+  }
+  const persisted = resolveDashboardKeyCandidate();
+  if (!persisted.key || persisted.badEnv) {
+    console.error(chalk.red("Error: Pretense dashboard API key could not be confirmed after login prompt."));
+    process.exit(1);
+  }
+}
+function runLogin(opts = {}) {
+  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
+  if (!candidate) {
+    console.error(chalk.red("Error: no API key provided."));
+    console.error(
+      chalk.gray("Try: pretense login --key pk_live_xxxxx")
+    );
+    console.error(
+      chalk.gray("  or: echo $PRETENSE_API_KEY | pretense login")
+    );
+    return 1;
+  }
+  if (!isValidKeyShape(candidate)) {
+    console.error(chalk.red("Error: that does not look like a Pretense API key."));
+    console.error(
+      chalk.gray("Keys start with prtns_live_ (or pk_live_) and are at least 24 characters long.")
+    );
+    console.error(
+      chalk.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
+    );
+    return 1;
+  }
+  const path = saveApiKey(candidate, opts.configDir);
+  console.log(chalk.green("Saved API key to"), chalk.bold(path));
+  console.log(chalk.gray(`  ${maskKey(candidate)}`));
+  console.log(chalk.gray("  File mode 600 \u2014 readable only by you."));
+  return 0;
+}
+
+// src/backend-client.ts
+function usageSummaryFromValidate(v) {
+  return {
+    plan: v.plan,
+    monthlyMutationLimit: v.monthlyMutationLimit,
+    mutationsUsed: v.mutationsUsed,
+    mutationsRemaining: v.mutationsRemaining,
+    requestsThisPeriod: 0,
+    secretsBlockedThisPeriod: 0,
+    periodResetsAt: v.periodResetsAt,
+    keyExpiresAt: null,
+    keyStatus: "active"
+  };
+}
+var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+function getConfiguredApiRoot(rootOverride) {
+  const raw = (rootOverride ?? process.env["PRETENSE_API_URL"] ?? DEFAULT_PRETENSE_API_URL).trim();
+  if (!raw) {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+  let normalized = raw;
+  if (!/^https?:\/\//i.test(normalized)) {
+    normalized = `https://${normalized}`;
+  }
+  try {
+    const u = new URL(normalized);
+    const origin = /^pretense\.ai$/i.test(u.hostname) ? "https://api.pretense.ai" : u.origin;
+    const path = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${origin}${path}`;
+  } catch {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+}
+function getCliApiUrl(pathWithinCli, rootOverride) {
+  const root = getConfiguredApiRoot(rootOverride);
+  const tail = pathWithinCli.replace(/^\/+/, "");
+  return `${root}/api/cli/${tail}`;
+}
+function getApiRequestTimeoutMs() {
+  const raw = process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return DEFAULT_REQUEST_TIMEOUT_MS;
+  const n = parseInt(raw, 10);
+  return Math.min(Math.max(n, 3e3), 12e4);
+}
+function getApiKey() {
+  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
+  if (fromEnv) return fromEnv;
+  const fromFile = loadApiKey();
+  if (!fromFile) return null;
+  const t = fromFile.trim();
+  return t.length > 0 ? t : null;
+}
+function getPretenseApiKey() {
+  return getApiKey();
+}
+var cachedValidation = null;
+var lastValidationSuccessAt = 0;
+var VALIDATION_CACHE_FRESH_MS = 45e3;
+function getCachedValidation() {
+  return cachedValidation;
+}
+function clearValidationCache() {
+  cachedValidation = null;
+  lastValidationSuccessAt = 0;
+}
+function bumpCachedUsageAfterLog(identifiersMutated) {
+  if (!cachedValidation || identifiersMutated <= 0) return;
+  cachedValidation.mutationsUsed += identifiersMutated;
+  if (cachedValidation.mutationsRemaining !== -1) {
+    cachedValidation.mutationsRemaining = Math.max(
+      0,
+      cachedValidation.mutationsRemaining - identifiersMutated
+    );
+  }
+}
+function makeBackendReachabilityError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+async function validateKey(opts = {}) {
+  const enforceReachability = opts.enforceReachability === true;
+  const now = Date.now();
+  const cacheFresh = cachedValidation !== null && now - lastValidationSuccessAt < VALIDATION_CACHE_FRESH_MS;
+  if (!opts.force && cacheFresh) {
+    return cachedValidation;
+  }
+  const validateUrl = getCliApiUrl("auth/validate");
+  const timeoutMs = getApiRequestTimeoutMs();
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    if (enforceReachability) {
+      const err = new Error("Missing Pretense dashboard API key");
+      err.code = "MISSING_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    return null;
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(validateUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (resp.status === 401 || resp.status === 403) {
+      const raw = await resp.json().catch(() => ({}));
+      const msg = typeof raw.message === "string" ? raw.message : "API key rejected by server";
+      const err = new Error(msg);
+      err.code = typeof raw.code === "string" ? raw.code : "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    if (!resp.ok) {
+      const msg = `Pretense API returned HTTP ${resp.status} from ${validateUrl}`;
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError("AUTH_BACKEND_REJECTED", msg);
+      }
+      return null;
+    }
+    let data;
+    try {
+      data = await resp.json();
+    } catch {
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError(
+          "AUTH_BACKEND_REJECTED",
+          `Invalid JSON from ${validateUrl}`
+        );
+      }
+      return null;
+    }
+    if (typeof data.valid === "boolean" && data.valid === false) {
+      const err = new Error("API key is not valid");
+      err.code = "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    cachedValidation = data;
+    lastValidationSuccessAt = Date.now();
+    return data;
+  } catch (err) {
+    if (err.code === "KEY_REVOKED" || err.code === "KEY_EXPIRED" || err.code === "INVALID_API_KEY" || err.code === "AUTH_ERROR" || err.code === "ORG_INACTIVE" || err.code === "MISSING_API_KEY" || err.code === "BACKEND_UNAVAILABLE" || err.code === "AUTH_BACKEND_REJECTED") {
+      throw err;
+    }
+    if (enforceReachability) {
+      const msg = err.name === "AbortError" ? `Timed out after ${timeoutMs}ms reaching ${validateUrl} (raise PRETENSE_API_TIMEOUT_MS)` : `Cannot reach Pretense API at ${validateUrl}: ${err.message}`;
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw makeBackendReachabilityError("BACKEND_UNAVAILABLE", msg);
+    }
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Backend validation failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchUsageSummary(opts = {}) {
+  const summaryUrl = getCliApiUrl("usage/summary");
+  const apiKey = getApiKey();
+  if (!apiKey) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), getApiRequestTimeoutMs());
+  try {
+    const resp = await fetch(summaryUrl, {
+      method: "GET",
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (!resp.ok) return null;
+    return await resp.json();
+  } catch (err) {
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Usage summary fetch failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function isWithinLimits() {
+  const v = getCachedValidation();
+  if (!v) return { allowed: true };
+  if (v.mutationsRemaining !== -1 && v.mutationsRemaining <= 0) {
+    return {
+      allowed: false,
+      reason: `Monthly mutation limit reached (${v.mutationsUsed}/${v.monthlyMutationLimit}). Upgrade at https://pretense.ai/pricing`
+    };
+  }
+  return { allowed: true };
+}
+
+// src/log-uploader.ts
+async function uploadLog(event, options) {
+  const apiRoot = options.apiUrl?.trim() || void 0;
+  const endpoint = getCliApiUrl("log", apiRoot);
+  const { apiKey, verbose = false, timeoutMs = getApiRequestTimeoutMs() } = options;
+  if (!apiKey) return;
+  const gitCtx = options.gitContext ?? await collectGitContextCached(options.cwd);
+  const body = {
+    ...event,
+    ...gitCtx,
+    repo_remote_url: gitCtx.git_remote,
+    git_branch: gitCtx.git_branch,
+    commit_sha: gitCtx.git_commit_sha
+  };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    if (!resp.ok && verbose) {
+      process.stderr.write(`[PRETENSE] log upload HTTP ${resp.status}
+`);
+    }
+  } catch (err) {
+    if (verbose) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[PRETENSE] log upload failed: ${msg}
+`);
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/start-client-instructions.ts
+import chalk2 from "chalk";
+function printStartClientInstructions(port) {
+  const host = `http://localhost:${port}`;
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Client setup (environment variables) \u2500\u2500"));
+  console.log(chalk2.gray("Point the CLI at the Pretense backend API (optional if using default):"));
+  console.log(
+    chalk2.white(`export PRETENSE_API_URL='https://api.pretense.ai'`)
+  );
+  console.log();
+  console.log(chalk2.gray("Log in with your Pretense dashboard API key:"));
+  console.log(chalk2.white("pretense login --key your-pretense-api-key"));
+  console.log();
+  console.log(
+    chalk2.gray("Set the LLM base URL for your provider (proxy below):")
+  );
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL="${host}"`));
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL=${host}`));
+  console.log(chalk2.white(`export OPENAI_BASE_URL=${host}/v1`));
+  console.log(chalk2.white(`export GEMINI_BASE_URL=${host}/v1beta`));
+  console.log(chalk2.white(`export OLLAMA_HOST=${host}`));
+  console.log();
+  console.log(chalk2.gray("Set your real upstream LLM API key (unchanged):"));
+  console.log(chalk2.white('export ANTHROPIC_API_KEY="sk-ant-API-KEY"'));
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Stop & log out \u2500\u2500"));
+  console.log(
+    chalk2.gray(
+      "Stop the proxy: press Ctrl+C in the terminal where pretense start is running."
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "Remove the saved Pretense dashboard key from ~/.pretense/config.json:"
+    )
+  );
+  console.log(chalk2.white("pretense logout"));
+  console.log(
+    chalk2.gray(
+      "(confirm with y / cancel with n.) Mutations stop immediately unless this proxy was started with"
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "PRETENSE_API_KEY set in that same terminal \u2014 then press Ctrl+C and run pretense start again."
+    )
+  );
+  console.log();
+}
+
+// src/version.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { fileURLToPath } from "url";
+var cached = null;
+function getCliSemver() {
+  if (cached !== null) return cached;
+  try {
+    const url = new URL("../package.json", import.meta.url);
+    const raw = readFileSync6(fileURLToPath(url), "utf-8");
+    cached = JSON.parse(raw).version ?? "0.0.0";
+  } catch {
+    cached = "0.0.0";
+  }
+  return cached;
+}
+
 // src/proxy.ts
+var dashboardSavedCredentialsRevoked = false;
+function attachDashboardLogoutWatcher(enabled) {
+  if (!enabled) return;
+  const dir = getUserDashboardConfigDir();
+  let debounceTimer;
+  const applyFilesystemCredentialState = () => {
+    const fk = loadApiKey();
+    if (!fk) {
+      if (dashboardSavedCredentialsRevoked) return;
+      dashboardSavedCredentialsRevoked = true;
+      delete process.env["PRETENSE_API_KEY"];
+      clearValidationCache();
+      try {
+        process.stderr.write(
+          `\x1B[33m[PRETENSE] Saved dashboard API key removed (~/.pretense/config.json, e.g. pretense logout). LLM proxy POST requests are disabled until you run pretense login and restart pretense start.\x1B[0m
+`
+        );
+      } catch {
+      }
+      return;
+    }
+    if (dashboardSavedCredentialsRevoked) {
+      dashboardSavedCredentialsRevoked = false;
+      clearValidationCache();
+    }
+  };
+  const schedule = () => {
+    if (debounceTimer) clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(applyFilesystemCredentialState, 120);
+  };
+  try {
+    if (!existsSync6(dir)) return;
+    watch(dir, () => {
+      schedule();
+    });
+  } catch {
+  }
+}
 function anthropicUpstream() {
   return process.env["ANTHROPIC_UPSTREAM_URL"] ?? "https://api.anthropic.com";
 }
@@ -1606,6 +2407,12 @@ function detectProvider(path) {
   if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return "ollama";
   return "anthropic";
 }
+function stripPretenseOnlyForwardingHeaders(headers) {
+  const drop = /* @__PURE__ */ new Set(["x-pretense-api-key", "x-pretense-key"]);
+  for (const k of [...Object.keys(headers)]) {
+    if (drop.has(k.toLowerCase())) delete headers[k];
+  }
+}
 function extractText(body) {
   const parts = [];
   if (typeof body["system"] === "string") parts.push(body["system"]);
@@ -1688,7 +2495,7 @@ function createProxy(opts = {}) {
     "/",
     (c) => c.json({
       name: "pretense",
-      version: "0.3.0",
+      version: getCliSemver(),
       status: "running",
       routes: {
         "GET /": "This welcome page",
@@ -1705,7 +2512,7 @@ function createProxy(opts = {}) {
     "/health",
     (c) => c.json({
       status: "ok",
-      version: "0.3.0",
+      version: getCliSemver(),
       uptime: Math.floor((Date.now() - stats.startedAt) / 1e3),
       stats: {
         requestsProcessed: stats.requestsProcessed,
@@ -1735,6 +2542,7 @@ function createProxy(opts = {}) {
       });
       delete headers2["host"];
       headers2["host"] = new URL(upstream2).host;
+      stripPretenseOnlyForwardingHeaders(headers2);
       const resp = await fetch(url, { method: c.req.method, headers: headers2 });
       return new Response(resp.body, { status: resp.status, headers: Object.fromEntries(resp.headers.entries()) });
     }
@@ -1751,9 +2559,69 @@ function createProxy(opts = {}) {
     const requestId = nanoid(12);
     const upstream = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
     const provider = detectProvider(c.req.path);
+    if (dashboardSavedCredentialsRevoked) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_session_logged_out",
+            message: "Saved Pretense dashboard credentials were removed (for example pretense logout). Run pretense login, then restart pretense start. If you started the proxy with PRETENSE_API_KEY in this shell, stop it (Ctrl+C) and start again after logout."
+          }
+        },
+        401
+      );
+    }
+    const pretenseDashboardKey = getPretenseApiKey();
+    if (!pretenseDashboardKey) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_dashboard_key_required",
+            message: "Configure your Pretense dashboard API key: run `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+          }
+        },
+        401
+      );
+    }
+    try {
+      await validateKey({ verbose, force: false, enforceReachability: true });
+    } catch (err) {
+      const code = err.code ?? "";
+      const msg = err.message;
+      const knownAuthCodes = /* @__PURE__ */ new Set([
+        "KEY_REVOKED",
+        "KEY_EXPIRED",
+        "INVALID_API_KEY",
+        "MISSING_API_KEY"
+      ]);
+      if (knownAuthCodes.has(code)) {
+        return c.json(
+          { error: { type: "pretense_auth_error", code, message: msg } },
+          401
+        );
+      }
+      if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+        return c.json(
+          { error: { type: "pretense_auth_backend_error", code, message: msg } },
+          503
+        );
+      }
+      if (code === "ORG_INACTIVE") {
+        return c.json(
+          { error: { type: "pretense_org_inactive", code, message: msg } },
+          403
+        );
+      }
+      return c.json(
+        { error: { type: "pretense_auth_error", message: msg } },
+        401
+      );
+    }
     const sessHash = c.get("sessionHash");
     const session = getSession(sessHash);
-    const tier = detectTier();
+    const tier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
     const { monthlyMutations } = getTierLimits(tier);
     const usage = loadUsage();
     if (tier === "free" && usage.mutations >= monthlyMutations) {
@@ -1767,6 +2635,30 @@ function createProxy(opts = {}) {
         429
       );
     }
+    const backendLimits = await isWithinLimits();
+    if (!backendLimits.allowed) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_rate_limit",
+            message: backendLimits.reason ?? "Mutation limit exceeded."
+          }
+        },
+        429
+      );
+    }
+    const cliAuth = getCachedValidation();
+    if (cliAuth?.permission === "read_only") {
+      return c.json(
+        {
+          error: {
+            type: "pretense_forbidden",
+            message: "This API key is read-only. Create a read_write key in the dashboard to use the Pretense proxy."
+          }
+        },
+        403
+      );
+    }
     const fullText = extractText(body);
     const secretScan = scan2(fullText);
     const blockedSecrets = secretScan.matches.filter((m) => m.action === "block");
@@ -1790,7 +2682,17 @@ function createProxy(opts = {}) {
     let tokensMutated = 0;
     const mutatedBody = applyToBody(processedBody, (text) => {
       const blocks = extractCodeBlocks(text);
-      if (blocks.length === 0) return text;
+      if (blocks.length === 0) {
+        const lang = detectLanguage(text);
+        const result = mutate(text, lang);
+        for (const [k, v] of result.map) {
+          mutationMap.set(k, v);
+          session.mutationMap.set(k, v);
+          session.reverseMap.set(v, k);
+        }
+        tokensMutated += result.stats.tokensMutated;
+        return result.mutatedCode;
+      }
       const mutatedBlocks = [];
       for (const block of blocks) {
         const result = mutate(block.code, block.language);
@@ -1806,6 +2708,20 @@ function createProxy(opts = {}) {
     });
     usage.mutations += tokensMutated;
     saveUsage(usage);
+    const remoteLogDisabled = process.env["PRETENSE_DISABLE_REMOTE_LOG"] === "1";
+    if (pretenseDashboardKey && !remoteLogDisabled) {
+      void uploadLog(
+        {
+          file_count: 0,
+          identifiers_mutated: tokensMutated,
+          secrets_blocked: blockedSecrets.length,
+          llm_provider: provider,
+          cli_version: getCliSemver()
+        },
+        { apiKey: pretenseDashboardKey, verbose }
+      );
+      bumpCachedUsageAfterLog(tokensMutated);
+    }
     const warningThreshold = Math.floor(monthlyMutations * 0.8);
     if (tier === "free" && usage.mutations >= warningThreshold && usage.mutations - tokensMutated < warningThreshold) {
       printUpgradeNudge(`${usage.mutations}/${monthlyMutations} monthly mutations used. Running low!`);
@@ -1839,6 +2755,7 @@ function createProxy(opts = {}) {
     delete headers["content-length"];
     headers["host"] = new URL(upstream).host;
     headers["x-pretense-request-id"] = requestId;
+    stripPretenseOnlyForwardingHeaders(headers);
     const forwardBody = JSON.stringify(mutatedBody);
     let upstreamResp;
     try {
@@ -1953,8 +2870,103 @@ async function findAvailablePort(startPort, maxAttempts = 10) {
 function startProxy(opts = {}) {
   const requestedPort = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
   const app = createProxy(opts);
-  const tier = detectTier();
   void (async () => {
+    const pretenseDashboardKeyFromEnvAtLaunch = !!process.env["PRETENSE_API_KEY"]?.trim();
+    const dashboardKey = getPretenseApiKey();
+    if (!dashboardKey || !isValidKeyShape(dashboardKey)) {
+      process.stderr.write(
+        `\x1B[31m[PRETENSE] API key required or invalid shape. Run \`pretense login --key prtns_live_...\`\x1B[0m
+\x1B[31m[PRETENSE] or set PRETENSE_API_KEY. Get a key at https://pretense.ai/dashboard/settings/api-keys\x1B[0m
+`
+      );
+      process.exit(1);
+    }
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    for (; ; ) {
+      try {
+        const validation = await validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        });
+        if (!validation) {
+          process.stderr.write(
+            `\x1B[31m[PRETENSE] Startup validation failed (no API key or unreachable backend). Cannot start proxy.\x1B[0m
+`
+          );
+          process.exit(1);
+        }
+        const plan = validation.plan ?? "FREE";
+        const remaining = validation.mutationsRemaining === -1 ? "unlimited" : String(validation.mutationsRemaining);
+        process.stdout.write(
+          `\x1B[32m[PRETENSE] Key validated: ${plan} plan` + (validation.organizationName ? ` (${validation.organizationName})` : "") + ` \u2014 ${remaining} mutations remaining\x1B[0m
+`
+        );
+        break;
+      } catch (err) {
+        const code = err.code;
+        const msg = err.message;
+        if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Fix network or set PRETENSE_API_URL if using a custom API.\x1B[0m
+`);
+          process.exit(1);
+        }
+        if (code === "ORG_INACTIVE") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Your organization is inactive; contact support.\x1B[0m
+`);
+          process.exit(1);
+        }
+        const authRetryable = code === "INVALID_API_KEY" || code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "AUTH_ERROR" || code === "MISSING_API_KEY";
+        if (authRetryable && interactive) {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(
+            `\x1B[33m[PRETENSE] Enter your Pretense dashboard API key and press Enter (Ctrl+C to quit).\x1B[0m
+`
+          );
+          let entered = null;
+          for (; ; ) {
+            entered = await promptDashboardApiKeyAfterFailure();
+            if (!entered) {
+              process.stderr.write(`\x1B[31m[PRETENSE] No key entered; exiting.\x1B[0m
+`);
+              process.exit(1);
+            }
+            if (isValidKeyShape(entered)) break;
+            process.stderr.write(
+              `\x1B[31m[PRETENSE] That does not look like a Pretense dashboard key (expect prtns_live_\u2026 or pk_live_\u2026).\x1B[0m
+`
+            );
+          }
+          const savedPath = installDashboardKeyForCurrentProcess(entered);
+          process.stdout.write(`\x1B[32m[PRETENSE] Saved API key to ${savedPath}\x1B[0m
+`);
+          clearValidationCache();
+          continue;
+        }
+        if (code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "INVALID_API_KEY" || code === "AUTH_ERROR" || code === "MISSING_API_KEY") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' to fix.\x1B[0m
+`);
+          process.exit(1);
+        }
+        process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+        process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' or check connectivity.\x1B[0m
+`);
+        process.exit(1);
+      }
+    }
+    attachDashboardLogoutWatcher(!pretenseDashboardKeyFromEnvAtLaunch);
+    const bannerTier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
     let port;
     try {
       port = await findAvailablePort(requestedPort, 10);
@@ -1969,10 +2981,11 @@ function startProxy(opts = {}) {
 `
       );
     }
+    printStartClientInstructions(port);
     serve({ fetch: app.fetch, port }, () => {
       const portStr = String(port);
       process.stdout.write(`
-\x1B[36mPretense v0.3.0  [${tier.toUpperCase()}]\x1B[0m
+\x1B[36mPretense v${getCliSemver()}  [${bannerTier.toUpperCase()}]\x1B[0m
   Your code hits AI naked. We fix that.
 
   Proxy:    http://localhost:${portStr}
@@ -1992,12 +3005,22 @@ function startProxy(opts = {}) {
     /v1beta/...               -> Google Gemini
     /api/chat, /api/generate  -> Ollama (local)
 `);
+      setInterval(() => {
+        if (dashboardSavedCredentialsRevoked) return;
+        if (!getPretenseApiKey()) return;
+        void validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        }).catch(() => {
+        });
+      }, 6e4);
     });
   })();
 }
 
 // src/token-footer.ts
-import chalk from "chalk";
+import chalk3 from "chalk";
 var PLAN_LIMITS = {
   free: { monthlyMutations: 1e3, monthlyScans: 5e3, seats: 3, pricePerMonth: "$0/month" },
   pro: { monthlyMutations: 1e5, monthlyScans: 5e5, seats: 25, pricePerMonth: "$29/seat/month" },
@@ -2021,7 +3044,7 @@ function printTokenFooter(filesScanned, mutationsMade) {
   const usage = loadUsage();
   if (tier === "enterprise") {
     process.stderr.write(
-      chalk.gray(`
+      chalk3.gray(`
   ${filesScanned} files, ${mutationsMade} mutations  \xB7  Plan: Enterprise (unlimited)
 
 `)
@@ -2031,22 +3054,22 @@ function printTokenFooter(filesScanned, mutationsMade) {
   const used = usage.mutations;
   const cap = limits.monthlyMutations;
   const pct = cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
-  const usageStr = pct >= 80 ? chalk.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk.gray(`${fmt(used)} / ${fmt(cap)}`);
+  const usageStr = pct >= 80 ? chalk3.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk3.gray(`${fmt(used)} / ${fmt(cap)}`);
   process.stderr.write(
     `
-  ${chalk.cyan(filesScanned + " files")}, ${chalk.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
+  ${chalk3.cyan(filesScanned + " files")}, ${chalk3.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk3.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
 `
   );
   if (tier === "free") {
     if (pct >= 80) {
       process.stderr.write(
-        chalk.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk.bold("pretense upgrade")}
+        chalk3.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk3.bold("pretense upgrade")}
 
 `)
       );
     } else {
       process.stderr.write(
-        chalk.gray(`  Run ${chalk.bold("pretense status")} for details, ${chalk.bold("pretense upgrade")} to remove limits.
+        chalk3.gray(`  Run ${chalk3.bold("pretense status")} for details, ${chalk3.bold("pretense upgrade")} to remove limits.
 
 `)
       );
@@ -2057,7 +3080,7 @@ function printTokenFooter(filesScanned, mutationsMade) {
 }
 
 // src/banner.ts
-import chalk2 from "chalk";
+import chalk4 from "chalk";
 var BANNER_RAW = `\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588    pretense
 \u2588\u2588          \u2588\u2588
 \u2588\u2588          \u2588\u2588    Stop your code from
@@ -2077,7 +3100,7 @@ function shouldPrint() {
 }
 function tint(line) {
   try {
-    return chalk2.hex(ICE_BLUE)(line);
+    return chalk4.hex(ICE_BLUE)(line);
   } catch {
     return line;
   }
@@ -2092,53 +3115,85 @@ function printBanner() {
 }
 
 // src/commands/status.ts
-import chalk3 from "chalk";
+import chalk5 from "chalk";
 var PLAN_LABEL = {
   free: "Free",
   pro: "Pro",
   enterprise: "Enterprise"
 };
 function fmt2(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
-function runStatus() {
+async function runStatus() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const plan = remote.plan;
+    const tierBadge2 = plan === "ENTERPRISE" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : plan === "PRO" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
+    const lines2 = [];
+    lines2.push("");
+    lines2.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge2}  ${chalk5.green("(synced)")}`);
+    lines2.push("");
+    lines2.push(`  Plan:        ${chalk5.bold(plan)}`);
+    lines2.push(`  Mutations:   ${fmt2(remote.mutationsUsed)} / ${fmt2(remote.monthlyMutationLimit)} this month`);
+    lines2.push(`  Remaining:   ${fmt2(remote.mutationsRemaining)}`);
+    lines2.push(`  Requests:    ${fmt2(remote.requestsThisPeriod)} this period`);
+    lines2.push(`  Secrets:     ${fmt2(remote.secretsBlockedThisPeriod)} blocked`);
+    lines2.push(`  Key status:  ${remote.keyStatus === "active" ? chalk5.green("active") : chalk5.red("revoked")}`);
+    lines2.push(`  Resets at:   ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    if (remote.keyExpiresAt) {
+      lines2.push(`  Key expires: ${new Date(remote.keyExpiresAt).toLocaleDateString()}`);
+    }
+    lines2.push("");
+    if (plan === "FREE") {
+      lines2.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+      lines2.push("");
+    }
+    process.stdout.write(lines2.join("\n") + "\n");
+    return;
+  }
   const tier = detectTier();
   const planLimits = getPlanLimits(tier);
   const tierLimits = getTierLimits(tier);
   const usage = loadUsage();
-  const tierBadge = tier === "enterprise" ? chalk3.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk3.bgBlue.white.bold(" PRO ") : chalk3.bgGray.white.bold(" FREE ");
+  const tierBadge = tier === "enterprise" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
   const lines = [];
   lines.push("");
-  lines.push(`${chalk3.cyan("Pretense")} ${chalk3.gray("v0.3.0")}  ${tierBadge}`);
+  lines.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge}  ${chalk5.yellow("(offline)")}`);
   lines.push("");
-  lines.push(`  Plan:        ${chalk3.bold(PLAN_LABEL[tier])} ${chalk3.gray("(" + planLimits.pricePerMonth + ")")}`);
+  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL[tier])} ${chalk5.gray("(" + planLimits.pricePerMonth + ")")}`);
   lines.push(`  Mutations:   ${fmt2(usage.mutations)} / ${fmt2(planLimits.monthlyMutations)} this month`);
   lines.push(`  Scans:       0 / ${fmt2(planLimits.monthlyScans)} this month`);
   lines.push(`  Seats:       1 / ${fmt2(planLimits.seats)}`);
   lines.push(`  Audit log:   ${Number.isFinite(tierLimits.auditRetentionDays) ? `${tierLimits.auditRetentionDays} days` : "unlimited"}`);
   lines.push("");
   if (tier === "free") {
-    lines.push(`  ${chalk3.gray("Upgrade:")}  ${chalk3.bold("pretense upgrade")}`);
-    lines.push(`  ${chalk3.gray("Credits:")}  ${chalk3.bold("pretense credits")}`);
+    lines.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+    lines.push(`  ${chalk5.gray("Credits:")}  ${chalk5.bold("pretense credits")}`);
     lines.push("");
   }
   process.stdout.write(lines.join("\n") + "\n");
 }
 
 // src/commands/upgrade.ts
-import chalk4 from "chalk";
+import chalk6 from "chalk";
 var PRICING_URL = "https://pretense.ai/pricing";
 function runUpgrade() {
   const tier = detectTier();
   const lines = [];
   lines.push("");
-  lines.push(chalk4.cyan.bold("  Pretense Plans"));
+  lines.push(chalk6.cyan.bold("  Pretense Plans"));
   lines.push("");
-  lines.push(chalk4.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  lines.push(chalk4.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
-  lines.push(chalk4.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  lines.push(`  \u2502 Price/seat   \u2502 ${chalk4.bold("$0")}      \u2502 ${chalk4.bold("$29")}     \u2502 ${chalk4.bold("$99")}         \u2502`);
+  lines.push(chalk6.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  lines.push(chalk6.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
+  lines.push(chalk6.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  lines.push(`  \u2502 Price/seat   \u2502 ${chalk6.bold("$0")}      \u2502 ${chalk6.bold("$29")}     \u2502 ${chalk6.bold("$99")}         \u2502`);
   lines.push("  \u2502 Mutations/mo \u2502 1,000    \u2502 100,000  \u2502 unlimited   \u2502");
   lines.push("  \u2502 Scans/mo     \u2502 5,000    \u2502 500,000  \u2502 unlimited   \u2502");
   lines.push("  \u2502 Seats        \u2502 3        \u2502 25       \u2502 unlimited   \u2502");
@@ -2146,37 +3201,70 @@ function runUpgrade() {
   lines.push("  \u2502 SSO/SAML     \u2502   -      \u2502   -      \u2502     yes     \u2502");
   lines.push("  \u2502 On-prem      \u2502   -      \u2502   -      \u2502     yes     \u2502");
   lines.push("  \u2502 SLA          \u2502   -      \u2502   -      \u2502   24/7      \u2502");
-  lines.push(chalk4.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  lines.push(chalk6.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
   lines.push("");
-  lines.push(`  ${chalk4.gray("Current plan:")} ${chalk4.bold(tier.toUpperCase())}`);
-  lines.push(`  ${chalk4.gray("Upgrade at:")}    ${chalk4.cyan.underline(PRICING_URL)}`);
+  lines.push(`  ${chalk6.gray("Current plan:")} ${chalk6.bold(tier.toUpperCase())}`);
+  lines.push(`  ${chalk6.gray("Upgrade at:")}    ${chalk6.cyan.underline(PRICING_URL)}`);
   lines.push("");
-  lines.push(chalk4.gray("  After purchase, set:"));
-  lines.push(chalk4.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
+  lines.push(chalk6.gray("  After purchase, set:"));
+  lines.push(chalk6.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
   lines.push("");
   process.stdout.write(lines.join("\n") + "\n");
 }
 
 // src/commands/credits.ts
-import chalk5 from "chalk";
+import chalk7 from "chalk";
 var PLAN_LABEL2 = {
   free: "Free",
   pro: "Pro",
   enterprise: "Enterprise"
 };
 function fmt3(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
 function progressBar(used, cap, width = 24) {
-  if (!Number.isFinite(cap) || cap <= 0) return chalk5.green("[" + "=".repeat(width) + "]");
+  if (cap === -1 || !Number.isFinite(cap) || cap <= 0) return chalk7.green("[" + "=".repeat(width) + "]");
   const pct = Math.min(1, used / cap);
   const filled = Math.round(pct * width);
   const bar = "=".repeat(filled) + "-".repeat(width - filled);
-  const colored = pct >= 0.8 ? chalk5.yellow(bar) : pct >= 1 ? chalk5.red(bar) : chalk5.green(bar);
+  const colored = pct >= 0.8 ? chalk7.yellow(bar) : pct >= 1 ? chalk7.red(bar) : chalk7.green(bar);
   return "[" + colored + "]";
 }
-function runCredits() {
+async function runCredits() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const used2 = remote.mutationsUsed;
+    const cap2 = remote.monthlyMutationLimit;
+    const remaining2 = remote.mutationsRemaining;
+    const pct2 = cap2 > 0 && cap2 !== -1 ? Math.round(used2 / cap2 * 100) : 0;
+    const lines2 = [];
+    lines2.push("");
+    lines2.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.green("(synced)"));
+    lines2.push("");
+    lines2.push(`  Plan:        ${chalk7.bold(remote.plan)}`);
+    lines2.push(`  Resets:      ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    lines2.push("");
+    lines2.push(`  Mutations:   ${progressBar(used2, cap2)}  ${fmt3(used2)} / ${fmt3(cap2)}`);
+    lines2.push(`  Used:        ${pct2}%`);
+    lines2.push(`  Remaining:   ${fmt3(remaining2)}`);
+    lines2.push("");
+    if (remote.plan === "FREE" && cap2 !== -1 && used2 >= cap2 * 0.8) {
+      lines2.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+      lines2.push("");
+    } else if (remote.plan === "FREE") {
+      lines2.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+      lines2.push("");
+    }
+    process.stdout.write(lines2.join("\n") + "\n");
+    return;
+  }
   const tier = detectTier();
   const limits = getPlanLimits(tier);
   const usage = loadUsage();
@@ -2186,9 +3274,9 @@ function runCredits() {
   const pct = Number.isFinite(cap) && cap > 0 ? Math.round(used / cap * 100) : 0;
   const lines = [];
   lines.push("");
-  lines.push(chalk5.cyan.bold("  Pretense Credits"));
+  lines.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.yellow("(offline)"));
   lines.push("");
-  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL2[tier])}`);
+  lines.push(`  Plan:        ${chalk7.bold(PLAN_LABEL2[tier])}`);
   lines.push(`  Month:       ${usage.month}`);
   lines.push("");
   lines.push(`  Mutations:   ${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
@@ -2196,106 +3284,59 @@ function runCredits() {
   lines.push(`  Remaining:   ${fmt3(remaining)}`);
   lines.push("");
   if (tier === "free" && Number.isFinite(cap) && used >= cap * 0.8) {
-    lines.push(chalk5.yellow("  \u26A0  Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+    lines.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
     lines.push("");
   } else if (tier === "free") {
-    lines.push(chalk5.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+    lines.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
     lines.push("");
   }
   process.stdout.write(lines.join("\n") + "\n");
 }
 
-// src/commands/login.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir2 } from "os";
-import chalk6 from "chalk";
-var CONFIG_DIR_NAME2 = ".pretense";
-var CONFIG_FILE2 = "config.json";
-function getUserConfigDir() {
-  return join4(homedir2(), CONFIG_DIR_NAME2);
-}
-function isValidKeyShape(key) {
-  const trimmed = key.trim();
-  if (trimmed.length < 24) return false;
-  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
-  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_");
-}
-function readStdinIfPiped() {
-  if (process.stdin.isTTY) return "";
-  try {
-    const chunks = [];
-    const buf = Buffer.alloc(4096);
-    let bytesRead = 0;
-    do {
-      try {
-        bytesRead = readSync(0, buf, 0, buf.length, null);
-      } catch {
-        bytesRead = 0;
-      }
-      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
-    } while (bytesRead === buf.length);
-    return Buffer.concat(chunks).toString("utf-8").trim();
-  } catch {
-    return "";
-  }
-}
-function maskKey(key) {
-  const trimmed = key.trim();
-  if (trimmed.length <= 12) return trimmed;
-  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
-}
-function saveApiKey(key, configDir = getUserConfigDir()) {
-  if (!existsSync5(configDir)) {
-    mkdirSync5(configDir, { recursive: true });
-  }
-  const path = join4(configDir, CONFIG_FILE2);
-  let existing = {};
-  if (existsSync5(path)) {
+// src/commands/logout.ts
+import readline2 from "readline/promises";
+import chalk8 from "chalk";
+async function runLogout(opts = {}) {
+  if (!loadApiKey()) {
+    console.log(chalk8.gray("No saved Pretense dashboard API key in ~/.pretense/config.json."));
+    console.log(chalk8.gray("If you use PRETENSE_API_KEY in your shell, run unset PRETENSE_API_KEY."));
+    return 0;
+  }
+  if (!opts.assumeYes) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      console.error(chalk8.red("Error: confirmation requires an interactive terminal."));
+      console.error(chalk8.gray("Run `pretense logout --yes` to skip the prompt."));
+      return 1;
+    }
+    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     try {
-      existing = JSON.parse(readFileSync5(path, "utf-8"));
-    } catch {
-      existing = {};
+      const raw = await rl.question(
+        chalk8.bold("Log out and remove your saved API key? Type y for yes, n for no: ")
+      );
+      const answer = raw.trim().toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        console.log(chalk8.yellow("Logout cancelled."));
+        return 0;
+      }
+    } finally {
+      rl.close();
     }
   }
-  const next = {
-    ...existing,
-    api_key: key.trim(),
-    saved_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-  return path;
-}
-function runLogin(opts = {}) {
-  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
-  if (!candidate) {
-    console.error(chalk6.red("Error: no API key provided."));
-    console.error(
-      chalk6.gray("Try: pretense login --key pk_live_xxxxx")
-    );
-    console.error(
-      chalk6.gray("  or: echo $PRETENSE_API_KEY | pretense login")
-    );
-    return 1;
-  }
-  if (!isValidKeyShape(candidate)) {
-    console.error(chalk6.red("Error: that does not look like a Pretense API key."));
-    console.error(
-      chalk6.gray("Keys start with pk_live_ and are at least 24 characters long.")
-    );
-    console.error(
-      chalk6.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
-    );
-    return 1;
+  const hadEnvDashboardKey = !!process.env["PRETENSE_API_KEY"]?.trim();
+  const { removed, path } = removeSavedDashboardCredentials();
+  clearValidationCache();
+  delete process.env["PRETENSE_API_KEY"];
+  if (removed) {
+    console.log(chalk8.green("Logged out. Removed saved API key from"), chalk8.bold(path));
+    console.log(chalk8.gray("Other terminals: run unset PRETENSE_API_KEY if that variable is still exported (e.g. in ~/.zshrc)."));
+    if (hadEnvDashboardKey) {
+      console.log(
+        chalk8.yellow(
+          "This shell had PRETENSE_API_KEY set; it was cleared for this process only. Restart any running pretense proxy (Ctrl+C, then pretense start)."
+        )
+      );
+    }
   }
-  const path = saveApiKey(candidate, opts.configDir);
-  console.log(chalk6.green("Saved API key to"), chalk6.bold(path));
-  console.log(chalk6.gray(`  ${maskKey(candidate)}`));
-  console.log(chalk6.gray("  File mode 600 \u2014 readable only by you."));
   return 0;
 }
 
@@ -2312,7 +3353,7 @@ function runLogin(opts = {}) {
     process.exit(1);
   }
 }
-var VERSION = "0.3.0";
+var VERSION = getCliSemver();
 var SCAN_CONCURRENCY = Math.max(2, os.cpus().length);
 var PROGRESS_INTERVAL_MS = 500;
 var SUPPORTED_LANGUAGES = ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"];
@@ -2436,17 +3477,33 @@ function validateLanguage(lang) {
 }
 function collectFiles(target) {
   const abs = resolve2(target);
-  if (!existsSync6(abs)) {
+  if (!existsSync7(abs)) {
     return [];
   }
   const stat = statSync(abs);
   if (stat.isFile()) return [abs];
   const files = [];
   function walk(dir) {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    const skipDirs = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".git",
+      "dist",
+      "build",
+      ".pretense",
+      ".next",
+      "__pycache__",
+      ".Trash"
+    ]);
+    for (const entry of entries) {
       const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
-        if (["node_modules", ".git", "dist", "build", ".pretense", ".next", "__pycache__"].includes(entry.name)) continue;
+        if (skipDirs.has(entry.name)) continue;
         walk(fullPath);
       } else if (entry.isFile() && isScannableFile(entry.name)) {
         files.push(fullPath);
@@ -2462,7 +3519,7 @@ program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary
 });
 program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
   const dir = resolve2(opts.dir);
-  console.log(chalk7.cyan("Initializing Pretense in"), chalk7.bold(dir));
+  console.log(chalk9.cyan("Initializing Pretense in"), chalk9.bold(dir));
   const configDir = initConfig(dir);
   const files = collectFiles(dir);
   const langCounts = {};
@@ -2470,23 +3527,25 @@ program.command("init").description("Initialize .pretense/ config in current dir
     const lang = langFromExt(f);
     langCounts[lang] = (langCounts[lang] ?? 0) + 1;
   }
-  console.log(chalk7.green("\n  .pretense/ created at"), chalk7.bold(configDir));
-  console.log(chalk7.gray(`
+  console.log(chalk9.green("\n  .pretense/ created at"), chalk9.bold(configDir));
+  console.log(chalk9.gray(`
   Scanned ${files.length} source files:`));
   for (const [lang, count] of Object.entries(langCounts)) {
-    console.log(chalk7.gray(`    ${lang}: ${count} files`));
+    console.log(chalk9.gray(`    ${lang}: ${count} files`));
   }
-  console.log(chalk7.cyan("\n  Next: run"), chalk7.bold("pretense start"), chalk7.cyan("to launch the proxy"));
+  console.log(chalk9.cyan("\n  Next: run"), chalk9.bold("pretense start"), chalk9.cyan("to launch the proxy"));
   console.log();
 });
-program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action((opts) => {
+program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action(async (opts) => {
   const config = loadConfig();
   const port = validatePort(opts.port);
   if (port === null) {
-    console.error(chalk7.red("Error: Invalid port number:"), chalk7.bold(opts.port));
-    console.error(chalk7.gray("Port must be an integer between 1 and 65535."));
+    console.error(chalk9.red("Error: Invalid port number:"), chalk9.bold(opts.port));
+    console.error(chalk9.gray("Port must be an integer between 1 and 65535."));
     process.exit(1);
   }
+  await ensureDashboardKeyForStart();
+  logDashboardCredentialHint();
   startProxy({ config, port, verbose: opts.verbose });
 });
 async function scanOneFile(file, opts) {
@@ -2596,29 +3655,29 @@ function parseSizeOption(value) {
 }
 program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).option("--max-file-size <size>", "Skip files larger than this (e.g. 10mb, 500k)", "10mb").option("--concurrency <n>", "Max files scanned in parallel", String(SCAN_CONCURRENCY)).option("--quiet", "Suppress progress output", false).action(async (target, opts) => {
   const absTarget = resolve2(target);
-  if (!existsSync6(absTarget)) {
-    console.error(chalk7.red("Error: Path not found:"), chalk7.bold(absTarget));
+  if (!existsSync7(absTarget)) {
+    console.error(chalk9.red("Error: Path not found:"), chalk9.bold(absTarget));
     process.exit(1);
   }
   const maxFileSize = parseSizeOption(opts.maxFileSize);
   if (maxFileSize === null) {
-    console.error(chalk7.red("Error: Invalid --max-file-size value:"), chalk7.bold(opts.maxFileSize));
-    console.error(chalk7.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
+    console.error(chalk9.red("Error: Invalid --max-file-size value:"), chalk9.bold(opts.maxFileSize));
+    console.error(chalk9.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
     process.exit(1);
   }
   const concurrency = Math.max(1, parseInt(opts.concurrency, 10) || SCAN_CONCURRENCY);
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk7.gray(`Discovering files in ${absTarget}...
+    process.stderr.write(chalk9.gray(`Discovering files in ${absTarget}...
 `));
   }
   const files = collectFiles(target);
   if (files.length === 0) {
-    console.error(chalk7.red("Error: No source files found at"), chalk7.bold(absTarget));
-    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk9.red("Error: No source files found at"), chalk9.bold(absTarget));
+    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk7.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
+    process.stderr.write(chalk9.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
 `));
   }
   const startedAt = Date.now();
@@ -2644,34 +3703,34 @@ program.command("scan <target>").description("Scan file or directory for identif
       interrupted
     }, null, 2));
   } else {
-    console.log(chalk7.cyan("\nPretense Scan Results\n"));
+    console.log(chalk9.cyan("\nPretense Scan Results\n"));
     for (const r of allResults) {
       if (r.skipped) {
         if (r.skipped === "too-large") {
           const mb = ((r.sizeBytes ?? 0) / 1024 / 1024).toFixed(1);
-          console.log(chalk7.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
+          console.log(chalk9.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
         }
         continue;
       }
-      const secretBadge = r.secrets > 0 ? chalk7.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      const secretBadge = r.secrets > 0 ? chalk9.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
       const showRow = r.secrets > 0 || !opts.secretsOnly && r.identifiers > 0;
       if (!showRow) continue;
       console.log(
-        chalk7.gray("  ") + chalk7.white(r.file) + chalk7.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+        chalk9.gray("  ") + chalk9.white(r.file) + chalk9.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
       );
       if (r.secrets > 0) {
         for (const t of r.secretTypes) {
-          console.log(chalk7.red(`    ! ${t}`));
+          console.log(chalk9.red(`    ! ${t}`));
         }
       }
     }
-    const skipNote = skippedLarge + skippedBinary > 0 ? chalk7.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
+    const skipNote = skippedLarge + skippedBinary > 0 ? chalk9.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
     console.log(
-      chalk7.gray(`
-  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk7.red(`${totalSecrets} secrets found`) : chalk7.green("0 secrets")) + skipNote
+      chalk9.gray(`
+  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk9.red(`${totalSecrets} secrets found`) : chalk9.green("0 secrets")) + skipNote
     );
     if (interrupted) {
-      console.log(chalk7.yellow("\n  Interrupted \u2014 partial results shown above."));
+      console.log(chalk9.yellow("\n  Interrupted \u2014 partial results shown above."));
     }
     console.log();
   }
@@ -2685,28 +3744,32 @@ program.command("scan <target>").description("Scan file or directory for identif
     process.exit(2);
   }
 });
-program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
+program.command("mutate <file>").description("Mutate identifiers for stdout (scanner redacts secrets/PII in the source first)").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync6(absPath)) {
-    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
+  if (!existsSync7(absPath)) {
+    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
     process.exit(1);
   }
   if (opts.language) {
     const validLang = validateLanguage(opts.language);
     if (!validLang) {
-      console.error(chalk7.red("Error: Unsupported language:"), chalk7.bold(opts.language));
-      console.error(chalk7.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
+      console.error(chalk9.red("Error: Unsupported language:"), chalk9.bold(opts.language));
+      console.error(chalk9.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
       process.exit(1);
     }
   }
   if (!SUPPORTED_EXTENSIONS.has(extname(absPath).toLowerCase()) && isBinaryFile(absPath)) {
-    console.error(chalk7.red("Error: Not a supported source file:"), chalk7.bold(absPath));
-    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk9.red("Error: Not a supported source file:"), chalk9.bold(absPath));
+    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
-  const code = readFileSync6(absPath, "utf-8");
+  const code = readFileSync7(absPath, "utf-8");
   const lang = opts.language ? validateLanguage(opts.language) : langFromExt(absPath);
-  const result = mutate(code, lang, opts.seed);
+  const secretScan = scan2(code);
+  const effectiveSeed = opts.seed === "pretense" ? buildSaltedSeed(opts.seed) : opts.seed;
+  const { redactedCode: redacted, secretsMap } = applyRedactionsTracked(code, secretScan.matches, effectiveSeed);
+  const secretsRedacted = secretsMap.size;
+  const result = mutate(redacted, lang, opts.seed);
   if (opts.save) {
     const configDir = getConfigDir();
     const store = new MutationStore(join5(configDir, "mutation-map.json"));
@@ -2715,22 +3778,31 @@ program.command("mutate <file>").description("Mutate a file and print result to
       id: absPath,
       originalHash: absPath,
       mapEntries: MutationStore.fromMap(result.map),
+      secretsMapEntries: [...secretsMap.entries()],
       timestamp: Date.now(),
       language: lang
     });
     store.persist();
-    process.stderr.write(chalk7.gray(`Mutation map saved to ${configDir}/mutation-map.json
+    process.stderr.write(chalk9.gray(`Mutation map saved to ${configDir}/mutation-map.json
 `));
   }
   if (opts.json) {
     console.log(JSON.stringify({
       mutatedCode: result.mutatedCode,
       map: Object.fromEntries(result.map),
-      stats: result.stats
+      stats: result.stats,
+      secretsRedacted,
+      secretsMap: Object.fromEntries(secretsMap)
     }, null, 2));
   } else {
     process.stdout.write(result.mutatedCode);
-    process.stderr.write(chalk7.gray(`
+    if (secretsRedacted > 0) {
+      process.stderr.write(
+        chalk9.gray(`--- ${secretsRedacted} secret/PII span(s) redacted before identifier mutation ---
+`)
+      );
+    }
+    process.stderr.write(chalk9.gray(`
 --- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
 `));
     printTokenFooter(1, result.stats.tokensMutated);
@@ -2738,15 +3810,15 @@ program.command("mutate <file>").description("Mutate a file and print result to
 });
 program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync6(absPath)) {
-    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
+  if (!existsSync7(absPath)) {
+    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
     process.exit(1);
   }
-  const mutatedCode = readFileSync6(absPath, "utf-8");
+  const mutatedCode = readFileSync7(absPath, "utf-8");
   const mapPath = opts.map ? resolve2(opts.map) : join5(getConfigDir(), "mutation-map.json");
-  if (!existsSync6(mapPath)) {
-    console.error(chalk7.red("Error: Mutation map not found:"), chalk7.bold(mapPath));
-    console.error(chalk7.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+  if (!existsSync7(mapPath)) {
+    console.error(chalk9.red("Error: Mutation map not found:"), chalk9.bold(mapPath));
+    console.error(chalk9.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
     process.exit(1);
   }
   let store;
@@ -2754,21 +3826,24 @@ program.command("reverse <file>").description("Reverse mutations using stored ma
     store = new MutationStore(mapPath);
     store.load();
   } catch {
-    console.error(chalk7.red("Error: Failed to load mutation map:"), chalk7.bold(mapPath));
-    console.error(chalk7.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
+    console.error(chalk9.red("Error: Failed to load mutation map:"), chalk9.bold(mapPath));
+    console.error(chalk9.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
     process.exit(1);
   }
   const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
   if (!entry) {
-    console.error(chalk7.red("Error: No mutation map entries found."));
-    console.error(chalk7.gray("Run 'pretense mutate --save <file>' first to generate a map."));
+    console.error(chalk9.red("Error: No mutation map entries found."));
+    console.error(chalk9.gray("Run 'pretense mutate --save <file>' first to generate a map."));
     process.exit(1);
   }
   const map = MutationStore.toMap(entry);
-  const restored = reverse(mutatedCode, map);
+  const secretsMap = entry.secretsMapEntries ? new Map(entry.secretsMapEntries) : void 0;
+  const restored = reverse(mutatedCode, map, secretsMap);
   process.stdout.write(restored);
-  process.stderr.write(chalk7.gray(`
---- Reversed ${map.size} mutations ---
+  const secretsCount = secretsMap?.size ?? 0;
+  const secretsSuffix = secretsCount > 0 ? ` + ${secretsCount} secret(s)` : "";
+  process.stderr.write(chalk9.gray(`
+--- Reversed ${map.size} mutations${secretsSuffix} ---
 `));
 });
 program.command("audit").description("View the audit log").option("--json", "Output as JSON", false).option("--csv", "Output as CSV", false).option("-l, --limit <number>", "Limit entries", "50").action((opts) => {
@@ -2781,30 +3856,34 @@ program.command("audit").description("View the audit log").option("--json", "Out
 program.command("version").description("Print Pretense CLI version").action(() => {
   console.log(`@pretense/cli v${VERSION}`);
 });
-program.command("status").description("Show current plan, monthly quota, seat usage").action(() => {
-  runStatus();
+program.command("status").description("Show current plan, monthly quota, seat usage").action(async () => {
+  await runStatus();
 });
-program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(() => {
-  runStatus();
+program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(async () => {
+  await runStatus();
 });
-program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(() => {
-  runCredits();
+program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(async () => {
+  await runCredits();
 });
 program.command("upgrade").description("Compare plans and upgrade to Pro or Enterprise").action(() => {
   runUpgrade();
 });
-program.command("credits").description("Show remaining mutation/scan budget for the current month").action(() => {
-  runCredits();
+program.command("credits").description("Show remaining mutation/scan budget for the current month").action(async () => {
+  await runCredits();
 });
-program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
+program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (prtns_live_... or pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
   const code = runLogin({ key: opts.key });
   if (code !== 0) process.exit(code);
 });
+program.command("logout").description("Remove the saved Pretense dashboard API key from ~/.pretense/config.json").option("-y, --yes", "Skip confirmation prompt", false).action(async (opts) => {
+  const code = await runLogout({ assumeYes: opts.yes === true });
+  if (code !== 0) process.exit(code);
+});
 function handleFatalError(err) {
   if (err instanceof Error && err.message) {
-    console.error(chalk7.red("Error:"), err.message);
+    console.error(chalk9.red("Error:"), err.message);
   } else {
-    console.error(chalk7.red("An unexpected error occurred."));
+    console.error(chalk9.red("An unexpected error occurred."));
   }
   process.exit(1);
 }