@pretense/cli 0.3.1 → 0.5.0

package/dist/index.js

@@ -1,11 +1,19 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command } from "commander";
-import chalk7 from "chalk";
-import { readFileSync as readFileSync6, existsSync as existsSync6, readdirSync, statSync, openSync, readSync as readSync2, closeSync } from "fs";
+import { Command as Command2 } from "commander";
+import chalk10 from "chalk";
+import {
+  readFileSync as readFileSync8,
+  existsSync as existsSync8,
+  readdirSync,
+  statSync,
+  openSync,
+  readSync as readSync2,
+  closeSync
+} from "fs";
 import { readFile, stat as fsStat, open as fsOpen } from "fs/promises";
-import { resolve as resolve2, extname, join as join5, basename } from "path";
+import { resolve as resolve3, extname, join as join6, basename } from "path";
 import os from "os";
 
 // src/types.ts
@@ -449,6 +457,15 @@ function scanTypeScript(code) {
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     // Multi-line comment
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Quoted HTTP header names (fetch/axios headers objects) — mutated, not vendor-identifying literals
+    { re: /"(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)"/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    { re: /'(?:x-[a-z0-9][a-z0-9-]*|authorization|api-key)'/gi, type: "HttpHeaderString" /* HttpHeaderString */ },
+    // Unquoted `Authorization` key — value must start with a string/template (skips interface/type shapes)
+    {
+      re: /(?:\{|\,)\s*(Authorization)\s*:\s*(?=[`'"])/g,
+      type: "HttpHeaderString" /* HttpHeaderString */,
+      groupIndex: 1
+    },
     // Import source (the module path string)
     { re: /\bimport\b[^'"]*['"]([^'"]+)['"]/g, type: "Import" /* Import */, groupIndex: 1 },
     // Class name
@@ -456,11 +473,18 @@ function scanTypeScript(code) {
     // Function/method name (function keyword)
     { re: /\bfunction\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Function" /* Function */, groupIndex: 1 },
     // Arrow function assigned to const/let/var
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
     // Method: identifier followed by (
     { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
-    // Variable declarations
-    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Env-style binding names with hyphens or dots (e.g. AWS-SECRET-KEY, AWS.SECRET.KEY) — not valid JS identifiers but common in pasted config
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*(?:(?:-|\.)(?:[A-Za-z0-9_$]+))+)(?=\s*=)/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Variable declarations (exclude names continued with -/. so AWS-SECRET-KEY is captured only by the rule above)
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*[-.][A-Za-z0-9_$])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Member receiver: matches in matches.push, row in row.patientId, def in def.name
+    { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*(?:\.|\?\.)[^0-9]/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Property after . or ?. when not immediately followed by ( — method calls use Method rule
+    { re: /\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
+    { re: /\?\.([A-Za-z_$][A-Za-z0-9_$]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Template literals (preserve backtick wrapper)
     { re: /`[^`]*`/g, type: "String" /* String */ },
     // Double-quoted strings
@@ -478,9 +502,12 @@ function scanTypeScript(code) {
       if (!captureValue || captureValue.trim() === "") continue;
       if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (TS_JS_KEYWORDS.has(captureValue)) continue;
-        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename)$/.test(captureValue)) continue;
+        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename|Intl|WebAssembly)$/.test(captureValue)) continue;
         if (captureValue.length <= 1) continue;
       }
+      if (type === "Property" /* Property */ && captureValue === "meta" && code.slice(Math.max(0, captureStart - 7), captureStart) === "import.") {
+        continue;
+      }
       tokens.push({
         type,
         value: captureValue,
@@ -490,7 +517,18 @@ function scanTypeScript(code) {
       });
     }
   }
-  return deduplicate(tokens);
+  const commentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const stringLikeSpans = tokens.filter(
+    (t) => t.type === "String" /* String */ || t.type === "HttpHeaderString" /* HttpHeaderString */
+  );
+  const dropsSpanOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (commentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (stringLikeSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsSpanOverlap));
 }
 function scanPython(code) {
   const tokens = [];
@@ -508,6 +546,11 @@ function scanPython(code) {
     { re: /\bclass\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
     // Function/method def
     { re: /\bdef\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Call site: method name in obj.method(
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // obj.attr receiver and attribute (matches.push-style)
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*\.\s*(?=[a-zA-Z_])/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    { re: /\.([A-Za-z_][A-Za-z0-9_]*)\b(?!\s*\()/g, type: "Property" /* Property */, groupIndex: 1 },
     // Variable assignment (simple name = ...)
     { re: /^([A-Za-z_][A-Za-z0-9_]*)\s*=/gm, type: "Variable" /* Variable */, groupIndex: 1 },
     // Double-quoted strings
@@ -523,7 +566,7 @@ function scanPython(code) {
       const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
       const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
       if (!captureValue || captureValue.trim() === "") continue;
-      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
         if (PYTHON_KEYWORDS.has(captureValue)) continue;
         if (captureValue.length <= 1) continue;
         if (captureValue.startsWith("__") && captureValue.endsWith("__")) continue;
@@ -537,7 +580,16 @@ function scanPython(code) {
       });
     }
   }
-  return deduplicate(tokens);
+  const pyCommentSpans = tokens.filter((t) => t.type === "Comment" /* Comment */);
+  const pyStringSpans = tokens.filter((t) => t.type === "String" /* String */);
+  const dropsPyOverlap = (t) => {
+    if (t.type === "Variable" /* Variable */ || t.type === "Function" /* Function */ || t.type === "Class" /* Class */ || t.type === "Method" /* Method */ || t.type === "Property" /* Property */) {
+      if (pyCommentSpans.some((c) => t.start < c.end && t.end > c.start)) return false;
+      if (pyStringSpans.some((s) => t.start < s.end && t.end > s.start)) return false;
+    }
+    return true;
+  };
+  return deduplicate(tokens.filter(dropsPyOverlap));
 }
 function scanGo(code) {
   const tokens = [];
@@ -849,8 +901,14 @@ function getMutationSalt() {
 function buildSaltedSeed(baseSeed) {
   return `${baseSeed}:${getMutationSalt()}`;
 }
+function effectiveSeedForMutation(userSeed) {
+  if (userSeed === "pretense" || userSeed === "pretest") {
+    return buildSaltedSeed("pretense");
+  }
+  return userSeed;
+}
 
-// src/mutator.ts
+// src/deterministic-id.ts
 function hash32(str) {
   let h = 5381;
   for (let i = 0; i < str.length; i++) {
@@ -868,11 +926,13 @@ function toAlphaNum(n, len) {
   }
   return result;
 }
-function deterministicId(original, seed, prefix, len = 4) {
+function deterministicSyntheticId(original, seed, prefix, len = 4) {
   const combined = `${seed}:${prefix}:${original}`;
   const h = hash32(combined);
   return prefix + toAlphaNum(h, len);
 }
+
+// src/mutator.ts
 function prefixForType(type) {
   switch (type) {
     case "Class" /* Class */:
@@ -884,6 +944,8 @@ function prefixForType(type) {
       return "_v";
     case "Property" /* Property */:
       return "_prop";
+    case "HttpHeaderString" /* HttpHeaderString */:
+      return "_hk";
     default:
       return "_tok";
   }
@@ -910,11 +972,24 @@ function mutate(code, language, seed = "pretense") {
     if (token.type === "String" /* String */) {
       continue;
     }
+    if (token.type === "HttpHeaderString" /* HttpHeaderString */) {
+      const qm = /^("|')(.+)\1$/.exec(token.value);
+      if (qm) {
+        const inner = qm[2];
+        const q = qm[1];
+        const syntheticInner = deterministicSyntheticId(inner, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, `${q}${syntheticInner}${q}`);
+      } else {
+        const syntheticInner = deterministicSyntheticId(token.value, effectiveSeed, prefixForType("HttpHeaderString" /* HttpHeaderString */));
+        map.set(token.value, syntheticInner);
+      }
+      continue;
+    }
     if (token.type === "Import" /* Import */) {
       continue;
     }
     const prefix = prefixForType(token.type);
-    const synthetic = deterministicId(token.value, effectiveSeed, prefix);
+    const synthetic = deterministicSyntheticId(token.value, effectiveSeed, prefix);
     map.set(token.value, synthetic);
   }
   const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
@@ -942,22 +1017,31 @@ function mutate(code, language, seed = "pretense") {
 }
 
 // src/reverser.ts
-function reverse(mutatedCode, map) {
-  if (!mutatedCode || map.size === 0) return mutatedCode;
-  const reverseMap = /* @__PURE__ */ new Map();
-  for (const [original, synthetic] of map.entries()) {
-    if (synthetic === "" || !synthetic) continue;
-    reverseMap.set(synthetic, original);
-  }
-  if (reverseMap.size === 0) return mutatedCode;
-  const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+function reverse(mutatedCode, map, secretsMap) {
+  if (!mutatedCode) return mutatedCode;
   let result = mutatedCode;
-  for (const [synthetic, original] of sortedEntries) {
-    const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
-      result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
-    } else {
-      result = result.split(synthetic).join(original);
+  if (map.size > 0) {
+    const reverseMap = /* @__PURE__ */ new Map();
+    for (const [original, synthetic] of map.entries()) {
+      if (synthetic === "" || !synthetic) continue;
+      reverseMap.set(synthetic, original);
+    }
+    if (reverseMap.size > 0) {
+      const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+      for (const [synthetic, original] of sortedEntries) {
+        const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
+          result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
+        } else {
+          result = result.split(synthetic).join(original);
+        }
+      }
+    }
+  }
+  if (secretsMap && secretsMap.size > 0) {
+    const sortedSecrets = [...secretsMap.entries()].sort((a, b) => b[0].length - a[0].length);
+    for (const [placeholder, original] of sortedSecrets) {
+      result = result.split(placeholder).join(original);
     }
   }
   return result;
@@ -966,16 +1050,40 @@ function reverse(mutatedCode, map) {
 // src/secrets.ts
 var SECRET_PATTERNS = [
   { name: "anthropic-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,}/g },
-  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-[A-Za-z0-9]{20,}/g },
+  /** Legacy `sk-…` and modern `sk-proj-…` (hyphenated body); aligned with @pretense/scanner */
+  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
   { name: "aws-access-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /AKIA[0-9A-Z]{16}/g },
-  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/g },
+  /** `AWS_SECRET = '…40 chars…'` (not `AWS_SECRET_ACCESS_KEY`, which is covered below). */
+  { name: "aws-secret-assignment", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bAWS_SECRET\s*=\s*['"]([A-Za-z0-9/+=]{40})['"]/gd, valueGroup: 1 },
+  /**
+   * Env-style labels with `-` or `.` (e.g. `AWS-SECRET-KEY`, `AWS.SECRET.KEY`, long `ACCESS` forms).
+   * Case-insensitive `AWS` / `SECRET` / `KEY`. Value: 40-char secret; quotes optional (matches aws-secret-key).
+   */
+  {
+    name: "aws-secret-key-delimited",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bAWS[-.]SECRET(?:[-.]ACCESS)?[-.]KEY\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gdi,
+    valueGroup: 1
+  },
+  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gd, valueGroup: 1 },
   { name: "github-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g },
   { name: "github-fine-grained", category: "secret", severity: "critical", defaultAction: "block", pattern: /github_pat_[A-Za-z0-9_]{22,}/g },
   { name: "stripe-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}/g },
-  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  /** Three base64url JWT segments; payload segment is not required to start with `eyJ` (Supabase and many issuers use compact payloads). */
+  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}/g },
   { name: "database-url", category: "credential", severity: "critical", defaultAction: "block", pattern: /(?:postgres|mysql|mongodb|redis|amqp):\/\/[^\s'"\\)]+:[^\s'"\\)]+@[^\s'"\\)]+/g },
-  { name: "generic-password", category: "credential", severity: "high", defaultAction: "redact", pattern: /(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"][^\s'"]{8,}['"]/gi },
+  {
+    name: "generic-password",
+    category: "credential",
+    severity: "high",
+    defaultAction: "redact",
+    // Do not match `token` / `secret` inside identifiers (e.g. GITHUB_TOKEN, AWS_SECRET): require no word/underscore before keyword.
+    pattern: /(?<![A-Za-z0-9_])(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"]([^\s'"]{8,})['"]/gid,
+    valueGroup: 1
+  },
   { name: "slack-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/g },
   { name: "google-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /AIza[A-Za-z0-9_-]{35}/g },
   { name: "npm-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /npm_[A-Za-z0-9]{36}/g },
@@ -1009,7 +1117,28 @@ var SECRET_PATTERNS = [
   { name: "x509-certificate", category: "secret", severity: "high", defaultAction: "redact", pattern: /-----BEGIN CERTIFICATE-----/g },
   { name: "launchdarkly-sdk-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bsdk-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
   { name: "launchdarkly-mobile-key", category: "secret", severity: "high", defaultAction: "block", pattern: /\bmob-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
-  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{32,}\b/g }
+  /** Stripe signing secrets are often 32+ chars; allow shorter synthetic/test tails so redaction still applies. */
+  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g },
+  /** Stripe Price / product IDs (`price_…`) — identifiers, not card data, but leak billing context. */
+  { name: "stripe-price-id", category: "secret", severity: "high", defaultAction: "block", pattern: /\bprice_[A-Za-z0-9_]{14,}\b/g },
+  /** `FOO_PASSWORD = '…'` / `NEXT_PUBLIC_*_PASSWORD` — generic-password skips when `password` is preceded by `_`. */
+  {
+    name: "env-password-assignment",
+    category: "credential",
+    severity: "high",
+    defaultAction: "block",
+    pattern: /\b[A-Z][A-Z0-9_]*PASSWORD\s*=\s*['"]([^'"]{6,})['"]/gd,
+    valueGroup: 1
+  },
+  /** Quoted common DB dialect names — stack hints when mutating env-style config. */
+  {
+    name: "quoted-db-dialect",
+    category: "credential",
+    severity: "medium",
+    defaultAction: "block",
+    pattern: /(['"])(postgres|mysql|redis)\1/gd,
+    valueGroup: 2
+  }
 ];
 var PII_PATTERNS = [
   { name: "ssn", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
@@ -1076,7 +1205,17 @@ function scan2(text, actionOverrides) {
     def.pattern.lastIndex = 0;
     let m;
     while ((m = def.pattern.exec(text)) !== null) {
-      const value = m[0];
+      let value = m[0];
+      let start2 = m.index;
+      let end = start2 + value.length;
+      if (def.valueGroup !== void 0) {
+        const span = m.indices?.[def.valueGroup];
+        if (!span) continue;
+        const [gs, ge] = span;
+        value = text.slice(gs, ge);
+        start2 = gs;
+        end = ge;
+      }
       if (def.validate && !def.validate(value)) continue;
       const action = actionOverrides?.[def.name] ?? def.defaultAction;
       matchCounter++;
@@ -1086,8 +1225,8 @@ function scan2(text, actionOverrides) {
         type: def.name,
         value,
         masked: maskValue(value, def.name),
-        start: m.index,
-        end: m.index + value.length,
+        start: start2,
+        end,
         severity: def.severity,
         action
       });
@@ -1151,14 +1290,26 @@ function scan2(text, actionOverrides) {
   };
 }
 function applyRedactions(text, matches) {
-  const sorted = [...matches].sort((a, b) => b.start - a.start);
+  return applyRedactionsTracked(text, matches).redactedCode;
+}
+var SECRET_LITERAL_PREFIX = "_sl";
+function applyRedactionsTracked(text, matches, mutationSeed = buildSaltedSeed("pretense")) {
+  const actionable = matches.filter((m) => m.action === "block" || m.action === "redact");
+  const sorted = [...actionable].sort((a, b) => b.start - a.start);
+  const secretsMap = /* @__PURE__ */ new Map();
+  const placeholders = /* @__PURE__ */ new Map();
+  const forward = [...actionable].sort((a, b) => a.start - b.start);
+  for (const match of forward) {
+    const tag = deterministicSyntheticId(`${match.id}:${match.start}`, mutationSeed, SECRET_LITERAL_PREFIX);
+    placeholders.set(match.id, tag);
+    secretsMap.set(tag, match.value);
+  }
   let result = text;
   for (const match of sorted) {
-    if (match.action === "block" || match.action === "redact") {
-      result = result.slice(0, match.start) + `[PRETENSE:${match.type.toUpperCase()}]` + result.slice(match.end);
-    }
+    const tag = placeholders.get(match.id);
+    result = result.slice(0, match.start) + tag + result.slice(match.end);
   }
-  return result;
+  return { redactedCode: result, secretsMap };
 }
 
 // src/store.ts
@@ -1372,15 +1523,6 @@ function loadUsage(dir) {
     return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
 }
-function saveUsage(usage, dir) {
-  const configDir = getConfigDir(dir);
-  if (!existsSync3(configDir)) {
-    mkdirSync3(configDir, { recursive: true });
-  }
-  const usagePath = join2(configDir, USAGE_FILE);
-  const checksum = computeUsageChecksum(usage);
-  writeFileSync3(usagePath, JSON.stringify({ ...usage, checksum }, null, 2), "utf-8");
-}
 var MIN_LICENSE_KEY_LENGTH = 40;
 var LICENSE_PAYLOAD_REGEX = /^[a-zA-Z0-9]+$/;
 function isValidLicenseKey(key, prefix) {
@@ -1405,6 +1547,11 @@ function detectTier() {
   if (key.startsWith("pre_pro_") && isValidLicenseKey(key, "pre_pro_")) return "pro";
   return "free";
 }
+function tierFromDashboardPlan(plan, fallback) {
+  if (plan === "ENTERPRISE") return "enterprise";
+  if (plan === "PRO") return "pro";
+  return fallback;
+}
 function getTierLimits(tier) {
   switch (tier) {
     case "enterprise":
@@ -1491,7 +1638,7 @@ function formatText(entries) {
   if (entries.length === 0) return "No audit entries found.";
   const lines = entries.map((e) => {
     const date = new Date(e.timestamp).toLocaleString();
-    return `[${date}] ${e.file} | ${e.identifiersMutated} mutated | ${e.secretsBlocked} secrets blocked | ${e.llmProvider} | ${e.latencyMs}ms`;
+    return `[${date}] ${e.file} | ${e.identifiersMutated} protected | ${e.secretsBlocked} secrets blocked | ${e.llmProvider} | ${e.latencyMs}ms`;
   });
   return lines.join("\n");
 }
@@ -1512,6 +1659,7 @@ import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { nanoid } from "nanoid";
 import { createServer } from "net";
+import { existsSync as existsSync6, watch } from "fs";
 
 // src/auth.ts
 import { createHash } from "crypto";
@@ -1575,111 +1723,892 @@ function sessionCount() {
   return sessions.size;
 }
 
-// src/proxy.ts
-function anthropicUpstream() {
-  return process.env["ANTHROPIC_UPSTREAM_URL"] ?? "https://api.anthropic.com";
+// src/git-context.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var GIT_TIMEOUT_MS = 2e3;
+async function runGit(args, cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      timeout: GIT_TIMEOUT_MS,
+      windowsHide: true
+    });
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : void 0;
+  } catch {
+    return void 0;
+  }
 }
-function openaiUpstream() {
-  return process.env["OPENAI_UPSTREAM_URL"] ?? "https://api.openai.com";
+function sanitizeRemote(raw) {
+  if (/^[\w.-]+@[^:]+:/.test(raw) && !raw.includes("://")) {
+    return raw;
+  }
+  try {
+    const url = new URL(raw);
+    url.username = "";
+    url.password = "";
+    return url.toString();
+  } catch {
+    return raw;
+  }
+}
+async function collectGitContext(cwd = process.cwd()) {
+  const insideRepo = await runGit(["rev-parse", "--is-inside-work-tree"], cwd);
+  if (insideRepo !== "true") return {};
+  const [remote, branch, sha] = await Promise.all([
+    runGit(["remote", "get-url", "origin"], cwd),
+    runGit(["rev-parse", "--abbrev-ref", "HEAD"], cwd),
+    runGit(["rev-parse", "HEAD"], cwd)
+  ]);
+  const ctx = {};
+  if (remote) ctx.git_remote = sanitizeRemote(remote);
+  if (branch && branch !== "HEAD") ctx.git_branch = branch;
+  if (sha) ctx.git_commit_sha = sha;
+  return ctx;
+}
+var CACHE_TTL_MS = 3e4;
+var cache = /* @__PURE__ */ new Map();
+async function collectGitContextCached(cwd = process.cwd(), now = Date.now()) {
+  const hit = cache.get(cwd);
+  if (hit && hit.expiresAt > now) return hit.value;
+  const value = await collectGitContext(cwd);
+  cache.set(cwd, { value, expiresAt: now + CACHE_TTL_MS });
+  return value;
 }
-function geminiUpstream() {
-  return process.env["GEMINI_UPSTREAM_URL"] ?? "https://generativelanguage.googleapis.com";
+
+// src/commands/login.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+import readline from "readline/promises";
+import chalk from "chalk";
+var CONFIG_DIR_NAME2 = ".pretense";
+var CONFIG_FILE2 = "config.json";
+function getUserDashboardConfigDir() {
+  return join4(homedir2(), CONFIG_DIR_NAME2);
 }
-function ollamaUpstream() {
-  return process.env["OLLAMA_UPSTREAM_URL"] ?? "http://localhost:11434";
+function getUserDashboardConfigPath() {
+  return join4(getUserDashboardConfigDir(), CONFIG_FILE2);
 }
-function detectUpstream(path) {
-  if (path.startsWith("/v1/messages")) return anthropicUpstream();
-  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
-    return openaiUpstream();
+function isValidKeyShape(key) {
+  const trimmed = key.trim();
+  if (trimmed.length < 24) return false;
+  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
+  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_") || trimmed.startsWith("prtns_live_");
+}
+function readStdinIfPiped() {
+  if (process.stdin.isTTY) return "";
+  try {
+    const chunks = [];
+    const buf = Buffer.alloc(4096);
+    let bytesRead = 0;
+    do {
+      try {
+        bytesRead = readSync(0, buf, 0, buf.length, null);
+      } catch {
+        bytesRead = 0;
+      }
+      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
+    } while (bytesRead === buf.length);
+    return Buffer.concat(chunks).toString("utf-8").trim();
+  } catch {
+    return "";
   }
-  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return geminiUpstream();
-  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return ollamaUpstream();
-  return anthropicUpstream();
 }
-function detectProvider(path) {
-  if (path.startsWith("/v1/messages")) return "anthropic";
-  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
-    return "openai";
+function maskKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 12) return trimmed;
+  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
+}
+function logDashboardCredentialHint() {
+  const env = process.env["PRETENSE_API_KEY"]?.trim() ?? "";
+  const envOk = env.length > 0 && isValidKeyShape(env);
+  const abs = getUserDashboardConfigPath();
+  const fk = loadApiKey();
+  if (envOk) {
+    console.error(
+      chalk.gray(
+        `[pretense] Dashboard key source: PRETENSE_API_KEY in environment (${maskKey(env)}) \u2014 unset this variable after logout if you expect no key.`
+      )
+    );
+  } else if (fk && isValidKeyShape(fk)) {
+    console.error(chalk.gray(`[pretense] Dashboard key source: ${abs} (${maskKey(fk)})`));
+  } else {
+    console.error(chalk.gray("[pretense] Dashboard key source: none configured."));
   }
-  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return "google";
-  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return "ollama";
-  return "anthropic";
 }
-function extractText(body) {
-  const parts = [];
-  if (typeof body["system"] === "string") parts.push(body["system"]);
-  if (Array.isArray(body["messages"])) {
-    for (const msg of body["messages"]) {
-      if (typeof msg["content"] === "string") parts.push(msg["content"]);
-      else if (Array.isArray(msg["content"])) {
-        for (const block of msg["content"]) {
-          if (block["type"] === "text" && typeof block["text"] === "string") parts.push(block["text"]);
-        }
-      }
+function saveApiKey(key, configDir = getUserDashboardConfigDir()) {
+  if (!existsSync5(configDir)) {
+    mkdirSync5(configDir, { recursive: true });
+  }
+  const path = join4(configDir, CONFIG_FILE2);
+  let existing = {};
+  if (existsSync5(path)) {
+    try {
+      existing = JSON.parse(readFileSync5(path, "utf-8"));
+    } catch {
+      existing = {};
     }
   }
-  return parts.join("\n");
+  const next = {
+    ...existing,
+    api_key: key.trim(),
+    saved_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return path;
 }
-function extractCodeBlocks(text) {
-  const blocks = [];
-  const re = /```(\w*)\n([\s\S]*?)```/g;
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    blocks.push({
-      code: m[2] ?? "",
-      language: m[1] ?? "typescript",
-      start: m.index,
-      end: m.index + m[0].length
-    });
+function removeSavedDashboardCredentials(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return { removed: false, path };
+  let existing = {};
+  try {
+    existing = JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return { removed: false, path };
+  }
+  const ak = existing.api_key;
+  const hadKey = typeof ak === "string" && ak.trim().length > 0;
+  if (!hadKey) return { removed: false, path };
+  delete existing.api_key;
+  delete existing.saved_at;
+  writeFileSync4(path, JSON.stringify(existing, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
   }
-  return blocks;
+  return { removed: true, path };
 }
-function replaceCodeBlocks(text, blocks, replacements) {
-  let result = text;
-  for (let i = blocks.length - 1; i >= 0; i--) {
-    const block = blocks[i];
-    const replacement = replacements[i] ?? block.code;
-    const lang = block.language ?? "typescript";
-    result = result.slice(0, block.start) + "```" + lang + "\n" + replacement + "```" + result.slice(block.end);
+function loadApiKey(configDir = getUserDashboardConfigDir()) {
+  const path = join4(configDir, CONFIG_FILE2);
+  if (!existsSync5(path)) return null;
+  try {
+    const raw = readFileSync5(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.api_key === "string") {
+      const t = parsed.api_key.trim();
+      if (t.length > 0) return t;
+    }
+  } catch {
   }
-  return result;
+  return null;
 }
-function applyToBody(body, transform) {
-  const mutateField = (val) => {
-    if (typeof val === "string") return transform(val);
-    if (Array.isArray(val)) return val.map(mutateField);
-    if (val && typeof val === "object") {
-      const obj = val;
-      return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, mutateField(v)]));
+function resolveDashboardKeyCandidate() {
+  const env = (process.env["PRETENSE_API_KEY"] ?? "").trim();
+  if (env.length > 0) {
+    if (!isValidKeyShape(env)) {
+      return { key: null, fromFile: false, badEnv: true };
     }
-    return val;
-  };
-  return mutateField(body);
+    return { key: env, fromFile: false, badEnv: false };
+  }
+  const fileKey = loadApiKey();
+  if (fileKey && isValidKeyShape(fileKey)) {
+    return { key: fileKey.trim(), fromFile: true, badEnv: false };
+  }
+  return { key: null, fromFile: Boolean(fileKey), badEnv: false };
 }
-var stats = {
-  requestsProcessed: 0,
-  totalTokensMutated: 0,
-  totalSecretsBlocked: 0,
-  startedAt: Date.now()
-};
-function daysSinceFirstUse() {
-  const usage = loadUsage();
-  if (!usage.firstUseDate) return 0;
-  const first = new Date(usage.firstUseDate).getTime();
-  return Math.floor((Date.now() - first) / (24 * 60 * 60 * 1e3));
+function installDashboardKeyForCurrentProcess(key) {
+  const trimmed = key.trim();
+  const path = saveApiKey(trimmed);
+  process.env["PRETENSE_API_KEY"] = trimmed;
+  return path;
+}
+async function promptDashboardApiKeyAfterFailure() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const line = (await rl.question(chalk.bold("Pretense dashboard API key: "))).trim();
+    return line.length > 0 ? line : null;
+  } finally {
+    rl.close();
+  }
+}
+async function ensureDashboardKeyForStart() {
+  const { key, fromFile, badEnv } = resolveDashboardKeyCandidate();
+  if (badEnv) {
+    console.error(chalk.red("Error: PRETENSE_API_KEY is set but is not a valid Pretense dashboard API key shape."));
+    console.error(
+      chalk.gray("Keys look like prtns_live_\u2026 or pk_live_\u2026. Fix the variable or unset it to use ~/.pretense/config.json.")
+    );
+    process.exit(1);
+  }
+  if (key) {
+    return;
+  }
+  if (fromFile) {
+    console.warn(
+      chalk.yellow(
+        "Ignoring invalid `api_key` in ~/.pretense/config.json (wrong shape). Enter a new key or run `pretense login --key ...`."
+      )
+    );
+  }
+  const stdinOk = process.stdin.isTTY;
+  const stdoutOk = process.stdout.isTTY;
+  if (!stdinOk || !stdoutOk) {
+    console.error(chalk.red("Error: Pretense API key required to start the proxy."));
+    console.error(
+      chalk.gray(
+        "Save one with `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+      )
+    );
+    process.exit(1);
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    console.log(chalk.cyan("No Pretense API key found in ~/.pretense/config.json or $PRETENSE_API_KEY."));
+    const entered = (await rl.question(chalk.bold("Enter your Pretense API key: "))).trim();
+    if (!entered) {
+      console.error(chalk.red("No key entered; exiting."));
+      process.exit(1);
+    }
+    if (!isValidKeyShape(entered)) {
+      console.error(chalk.red("That does not look like a Pretense API key (expect prtns_live_\u2026 or pk_live_\u2026)."));
+      console.error(chalk.gray("Get one from your Pretense dashboard, then run `pretense login --key ...`."));
+      process.exit(1);
+    }
+    const path = installDashboardKeyForCurrentProcess(entered);
+    console.log(chalk.green("Saved API key to"), chalk.bold(path));
+    console.log(chalk.gray(`  ${maskKey(entered)}`));
+  } finally {
+    rl.close();
+  }
+  const persisted = resolveDashboardKeyCandidate();
+  if (!persisted.key || persisted.badEnv) {
+    console.error(chalk.red("Error: Pretense dashboard API key could not be confirmed after login prompt."));
+    process.exit(1);
+  }
+}
+function runLogin(opts = {}) {
+  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
+  if (!candidate) {
+    console.error(chalk.red("Error: no API key provided."));
+    console.error(
+      chalk.gray("Try: pretense login --key pk_live_xxxxx")
+    );
+    console.error(
+      chalk.gray("  or: echo $PRETENSE_API_KEY | pretense login")
+    );
+    return 1;
+  }
+  if (!isValidKeyShape(candidate)) {
+    console.error(chalk.red("Error: that does not look like a Pretense API key."));
+    console.error(
+      chalk.gray("Keys start with prtns_live_ (or pk_live_) and are at least 24 characters long.")
+    );
+    console.error(
+      chalk.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
+    );
+    return 1;
+  }
+  const path = saveApiKey(candidate, opts.configDir);
+  console.log(chalk.green("Saved API key to"), chalk.bold(path));
+  console.log(chalk.gray(`  ${maskKey(candidate)}`));
+  console.log(chalk.gray("  File mode 600 \u2014 readable only by you."));
+  return 0;
 }
-function printUpgradeNudge(reason) {
-  process.stdout.write(
-    `
-\x1B[33m[PRETENSE] ${reason}\x1B[0m
-\x1B[33m[PRETENSE] Upgrade to Pro: https://pretense.ai/pricing\x1B[0m
 
-`
-  );
+// src/dashboard-env.ts
+var DASHBOARD_API_KEY_ENVS = ["PRETENSE_API_KEY", "PRETEST_API_KEY"];
+var DASHBOARD_API_URL_ENVS = ["PRETENSE_API_URL", "PRETEST_API_URL"];
+function firstNonEmptyEnv(names) {
+  for (const name of names) {
+    const v = process.env[name]?.trim();
+    if (v) return v;
+  }
+  return "";
 }
-function createProxy(opts = {}) {
-  const config = { ...DEFAULT_CONFIG, ...opts.config };
+function clearDashboardApiKeyFromProcess() {
+  delete process.env["PRETEST_API_KEY"];
+  delete process.env["PRETENSE_API_KEY"];
+}
+function hasDashboardApiKeyInEnv() {
+  return DASHBOARD_API_KEY_ENVS.some((n) => !!process.env[n]?.trim());
+}
+
+// src/publish-info.ts
+var PUBLISH_PACKAGE_URL = "https://www.npmjs.com/package/@pretense/cli";
+
+// src/backend-client.ts
+function usageSummaryFromValidate(v) {
+  return {
+    plan: v.plan,
+    monthlyMutationLimit: v.monthlyMutationLimit,
+    mutationsUsed: v.mutationsUsed,
+    mutationsRemaining: v.mutationsRemaining,
+    requestsThisPeriod: 0,
+    secretsBlockedThisPeriod: 0,
+    periodResetsAt: v.periodResetsAt,
+    keyExpiresAt: null,
+    keyStatus: "active"
+  };
+}
+var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
+var DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+function getConfiguredApiRoot(rootOverride) {
+  const raw = (rootOverride?.trim() || firstNonEmptyEnv(DASHBOARD_API_URL_ENVS) || DEFAULT_PRETENSE_API_URL).trim();
+  if (!raw) {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+  let normalized = raw;
+  if (!/^https?:\/\//i.test(normalized)) {
+    normalized = `https://${normalized}`;
+  }
+  try {
+    const u = new URL(normalized);
+    const origin = /^pretense\.ai$/i.test(u.hostname) ? DEFAULT_PRETENSE_API_URL.replace(/\/$/, "") : u.origin;
+    const path = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${origin}${path}`;
+  } catch {
+    return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
+  }
+}
+function getCliApiUrl(pathWithinCli, rootOverride) {
+  const root = getConfiguredApiRoot(rootOverride);
+  const tail = pathWithinCli.replace(/^\/+/, "");
+  return `${root}/api/cli/${tail}`;
+}
+function getApiRequestTimeoutMs() {
+  const raw = process.env["PRETEST_API_TIMEOUT_MS"]?.trim() || process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return DEFAULT_REQUEST_TIMEOUT_MS;
+  const n = parseInt(raw, 10);
+  return Math.min(Math.max(n, 3e3), 12e4);
+}
+function getApiKey() {
+  const fromEnv = firstNonEmptyEnv(DASHBOARD_API_KEY_ENVS);
+  if (fromEnv) return fromEnv;
+  const fromFile = loadApiKey();
+  if (!fromFile) return null;
+  const t = fromFile.trim();
+  return t.length > 0 ? t : null;
+}
+function getDashboardApiKey() {
+  return getApiKey();
+}
+var cachedValidation = null;
+var lastValidationSuccessAt = 0;
+var VALIDATION_CACHE_FRESH_MS = 45e3;
+function getCachedValidation() {
+  return cachedValidation;
+}
+function clearValidationCache() {
+  cachedValidation = null;
+  lastValidationSuccessAt = 0;
+}
+function bumpCachedUsageAfterLog(identifiersMutated) {
+  if (!cachedValidation || identifiersMutated <= 0) return;
+  cachedValidation.mutationsUsed += identifiersMutated;
+  if (cachedValidation.mutationsRemaining !== -1) {
+    cachedValidation.mutationsRemaining = Math.max(
+      0,
+      cachedValidation.mutationsRemaining - identifiersMutated
+    );
+  }
+}
+function syncCachedUsageFromServer(codeProtectionsUsed, limit) {
+  if (!cachedValidation) return;
+  if (codeProtectionsUsed < cachedValidation.mutationsUsed) return;
+  cachedValidation.mutationsUsed = codeProtectionsUsed;
+  cachedValidation.monthlyMutationLimit = limit;
+  if (limit !== -1) {
+    cachedValidation.mutationsRemaining = Math.max(0, limit - codeProtectionsUsed);
+  }
+}
+function makeBackendReachabilityError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+async function validateKey(opts = {}) {
+  const enforceReachability = opts.enforceReachability === true;
+  const now = Date.now();
+  const cacheFresh = cachedValidation !== null && now - lastValidationSuccessAt < VALIDATION_CACHE_FRESH_MS;
+  if (!opts.force && cacheFresh) {
+    return cachedValidation;
+  }
+  const validateUrl = getCliApiUrl("auth/validate");
+  const timeoutMs = getApiRequestTimeoutMs();
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    if (enforceReachability) {
+      const err = new Error("Missing dashboard API key");
+      err.code = "MISSING_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    return null;
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(validateUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (resp.status === 401 || resp.status === 403) {
+      const raw2 = await resp.json().catch(() => ({}));
+      const msg = typeof raw2.message === "string" ? raw2.message : "API key rejected by server";
+      const err = new Error(msg);
+      err.code = typeof raw2.code === "string" ? raw2.code : "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    if (!resp.ok) {
+      const msg = `Dashboard API returned HTTP ${resp.status} from ${validateUrl}`;
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError("AUTH_BACKEND_REJECTED", msg);
+      }
+      return null;
+    }
+    let raw;
+    try {
+      raw = await resp.json();
+    } catch {
+      if (enforceReachability) {
+        cachedValidation = null;
+        lastValidationSuccessAt = 0;
+        throw makeBackendReachabilityError(
+          "AUTH_BACKEND_REJECTED",
+          `Invalid JSON from ${validateUrl}`
+        );
+      }
+      return null;
+    }
+    const data = {
+      ...raw,
+      mutationsRemaining: raw["mutationsRemaining"] ?? raw["codeProtectionsRemaining"] ?? -1,
+      mutationsUsed: raw["mutationsUsed"] ?? raw["codeProtectionsUsed"] ?? 0,
+      monthlyMutationLimit: raw["monthlyMutationLimit"] ?? raw["monthlyCodeProtectionLimit"] ?? -1
+    };
+    if (typeof data.valid === "boolean" && data.valid === false) {
+      const err = new Error("API key is not valid");
+      err.code = "INVALID_API_KEY";
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw err;
+    }
+    cachedValidation = data;
+    lastValidationSuccessAt = Date.now();
+    return data;
+  } catch (err) {
+    if (err.code === "KEY_REVOKED" || err.code === "KEY_EXPIRED" || err.code === "INVALID_API_KEY" || err.code === "AUTH_ERROR" || err.code === "ORG_INACTIVE" || err.code === "MISSING_API_KEY" || err.code === "BACKEND_UNAVAILABLE" || err.code === "AUTH_BACKEND_REJECTED") {
+      throw err;
+    }
+    if (enforceReachability) {
+      const msg = err.name === "AbortError" ? `Timed out after ${timeoutMs}ms reaching ${validateUrl} (raise PRETENSE_API_TIMEOUT_MS or PRETEST_API_TIMEOUT_MS)` : `Cannot reach dashboard API at ${validateUrl}: ${err.message}`;
+      cachedValidation = null;
+      lastValidationSuccessAt = 0;
+      throw makeBackendReachabilityError("BACKEND_UNAVAILABLE", msg);
+    }
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Backend validation failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchUsageSummary(opts = {}) {
+  const summaryUrl = getCliApiUrl("usage/summary");
+  const apiKey = getApiKey();
+  if (!apiKey) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), getApiRequestTimeoutMs());
+  try {
+    const resp = await fetch(summaryUrl, {
+      method: "GET",
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (!resp.ok) return null;
+    const raw = await resp.json();
+    return {
+      ...raw,
+      mutationsUsed: raw["mutationsUsed"] ?? raw["codeProtectionsUsed"] ?? 0,
+      mutationsRemaining: raw["mutationsRemaining"] ?? raw["codeProtectionsRemaining"] ?? -1,
+      monthlyMutationLimit: raw["monthlyMutationLimit"] ?? raw["monthlyCodeProtectionLimit"] ?? -1
+    };
+  } catch (err) {
+    if (opts.verbose) {
+      process.stderr.write(
+        `[PRETENSE] Usage summary fetch failed: ${err.message}
+`
+      );
+    }
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function isWithinLimits() {
+  const v = getCachedValidation();
+  if (!v) return { allowed: true };
+  if (v.mutationsRemaining !== -1 && v.mutationsRemaining <= 0) {
+    const fresh = await validateKey({ force: true }).catch(() => null);
+    const check = fresh ?? v;
+    if (check.mutationsRemaining !== -1 && check.mutationsRemaining <= 0) {
+      return {
+        allowed: false,
+        reason: `Monthly security token limit reached (${check.mutationsUsed}/${check.monthlyMutationLimit}). See ${PUBLISH_PACKAGE_URL}`
+      };
+    }
+    return { allowed: true };
+  }
+  return { allowed: true };
+}
+
+// src/log-uploader.ts
+var FLUSH_INTERVAL_MS = 5e3;
+var buffer = [];
+var flushTimer = null;
+function startFlushTimer(verbose) {
+  if (flushTimer !== null) return;
+  flushTimer = setInterval(() => {
+    void flushBuffer(verbose);
+  }, FLUSH_INTERVAL_MS);
+  if (typeof flushTimer.unref === "function") flushTimer.unref();
+}
+function attachExitFlush() {
+  const flush = () => {
+    void flushBuffer(false);
+  };
+  process.once("exit", flush);
+  process.once("SIGINT", () => {
+    flush();
+    process.exit(0);
+  });
+  process.once("SIGTERM", () => {
+    flush();
+    process.exit(0);
+  });
+}
+var exitFlushAttached = false;
+async function flushBuffer(verbose) {
+  if (buffer.length === 0) return;
+  const snapshot = buffer;
+  buffer = [];
+  const last = snapshot[snapshot.length - 1];
+  const { options } = last;
+  let file_count = 0;
+  let identifiers_mutated = 0;
+  let secrets_blocked = 0;
+  let scan_tokens = 0;
+  let mutation_tokens = 0;
+  let read_tokens = 0;
+  let llm_provider = "unknown";
+  let cli_version;
+  for (const { event } of snapshot) {
+    file_count += event.file_count ?? 0;
+    identifiers_mutated += event.identifiers_mutated ?? 0;
+    secrets_blocked += event.secrets_blocked ?? 0;
+    scan_tokens += event.scan_tokens ?? 0;
+    mutation_tokens += event.mutation_tokens ?? 0;
+    read_tokens += event.read_tokens ?? 0;
+    if (event.llm_provider) llm_provider = event.llm_provider;
+    if (event.cli_version) cli_version = event.cli_version;
+  }
+  const apiRoot = options.apiUrl?.trim() || void 0;
+  const endpoint = getCliApiUrl("log", apiRoot);
+  const { apiKey, timeoutMs = getApiRequestTimeoutMs(), onResponse } = options;
+  if (!apiKey) return;
+  const gitCtx = options.gitContext ?? await collectGitContextCached(options.cwd);
+  const idempotency_key = crypto.randomUUID();
+  const body = {
+    file_count,
+    identifiers_mutated,
+    identifiers_code_protected: identifiers_mutated,
+    secrets_blocked,
+    llm_provider,
+    scan_tokens,
+    code_protection_tokens: mutation_tokens,
+    read_tokens,
+    idempotency_key,
+    ...cli_version ? { cli_version } : {},
+    git_remote: gitCtx.git_remote,
+    repo_remote_url: gitCtx.git_remote,
+    git_branch: gitCtx.git_branch,
+    commit_sha: gitCtx.git_commit_sha,
+    git_commit_sha: gitCtx.git_commit_sha
+  };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    if (resp.ok) {
+      const data = await resp.json().catch(() => null);
+      if (data && typeof data.codeProtectionsUsed === "number" && typeof data.limit === "number") {
+        onResponse?.(data.codeProtectionsUsed, data.limit);
+      }
+    } else if (verbose) {
+      const detail = await resp.text().catch(() => "");
+      process.stderr.write(`[PRETENSE] log upload HTTP ${resp.status} (batch of ${snapshot.length}): ${detail}
+`);
+    }
+  } catch (err) {
+    if (verbose) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[PRETENSE] log upload failed: ${msg}
+`);
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function uploadLog(event, options) {
+  if (!options.apiKey) return;
+  buffer.push({ event, options });
+  startFlushTimer(options.verbose ?? false);
+  if (!exitFlushAttached) {
+    exitFlushAttached = true;
+    attachExitFlush();
+  }
+}
+
+// src/start-client-instructions.ts
+import chalk2 from "chalk";
+function printStartClientInstructions(port) {
+  const host = `http://localhost:${port}`;
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Client setup (environment variables) \u2500\u2500"));
+  console.log(chalk2.gray("Point the CLI at the Pretense backend API (optional if using default):"));
+  console.log(
+    chalk2.white(`export PRETENSE_API_URL='https://api.pretense.ai'`)
+  );
+  console.log();
+  console.log(chalk2.gray("Log in with your Pretense dashboard API key:"));
+  console.log(chalk2.white("pretense login --key your-pretense-api-key"));
+  console.log();
+  console.log(
+    chalk2.gray("Set the LLM base URL for your provider (proxy below):")
+  );
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL="${host}"`));
+  console.log(chalk2.white(`export ANTHROPIC_BASE_URL=${host}`));
+  console.log(chalk2.white(`export OPENAI_BASE_URL=${host}/v1`));
+  console.log(chalk2.white(`export GEMINI_BASE_URL=${host}/v1beta`));
+  console.log(chalk2.white(`export OLLAMA_HOST=${host}`));
+  console.log();
+  console.log(chalk2.gray("Set your real upstream LLM API key (unchanged):"));
+  console.log(chalk2.white('export ANTHROPIC_API_KEY="sk-ant-API-KEY"'));
+  console.log();
+  console.log(chalk2.cyan.bold("\u2500\u2500 Stop & log out \u2500\u2500"));
+  console.log(
+    chalk2.gray(
+      "Stop the proxy: press Ctrl+C in the terminal where pretense start is running."
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "Remove the saved Pretense dashboard key from ~/.pretense/config.json:"
+    )
+  );
+  console.log(chalk2.white("pretense logout"));
+  console.log(
+    chalk2.gray(
+      "(confirm with y / cancel with n.) Mutations stop immediately unless this proxy was started with"
+    )
+  );
+  console.log(
+    chalk2.gray(
+      "PRETENSE_API_KEY set in that same terminal \u2014 then press Ctrl+C and run pretense start again."
+    )
+  );
+  console.log();
+}
+
+// src/version.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { fileURLToPath } from "url";
+var cached = null;
+function getCliSemver() {
+  if (cached !== null) return cached;
+  if (typeof __BINARY_VERSION__ !== "undefined" && __BINARY_VERSION__) {
+    cached = __BINARY_VERSION__;
+    return cached;
+  }
+  try {
+    const url = new URL("../package.json", import.meta.url);
+    const raw = readFileSync6(fileURLToPath(url), "utf-8");
+    cached = JSON.parse(raw).version ?? "0.0.0";
+  } catch {
+    cached = "0.0.0";
+  }
+  return cached;
+}
+
+// src/proxy.ts
+var dashboardSavedCredentialsRevoked = false;
+function attachDashboardLogoutWatcher(enabled) {
+  if (!enabled) return;
+  const dir = getUserDashboardConfigDir();
+  let debounceTimer;
+  const applyFilesystemCredentialState = () => {
+    const fk = loadApiKey();
+    if (!fk) {
+      if (dashboardSavedCredentialsRevoked) return;
+      dashboardSavedCredentialsRevoked = true;
+      clearDashboardApiKeyFromProcess();
+      clearValidationCache();
+      try {
+        process.stderr.write(
+          `\x1B[33m[PRETENSE] Saved dashboard API key removed (~/.pretense/config.json, e.g. pretense logout). LLM proxy POST requests are disabled until you run pretense login and restart pretense start.\x1B[0m
+`
+        );
+      } catch {
+      }
+      return;
+    }
+    if (dashboardSavedCredentialsRevoked) {
+      dashboardSavedCredentialsRevoked = false;
+      clearValidationCache();
+    }
+  };
+  const schedule = () => {
+    if (debounceTimer) clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(applyFilesystemCredentialState, 120);
+  };
+  try {
+    if (!existsSync6(dir)) return;
+    watch(dir, () => {
+      schedule();
+    });
+  } catch {
+  }
+}
+function anthropicUpstream() {
+  return process.env["ANTHROPIC_UPSTREAM_URL"] ?? "https://api.anthropic.com";
+}
+function openaiUpstream() {
+  return process.env["OPENAI_UPSTREAM_URL"] ?? "https://api.openai.com";
+}
+function geminiUpstream() {
+  return process.env["GEMINI_UPSTREAM_URL"] ?? "https://generativelanguage.googleapis.com";
+}
+function ollamaUpstream() {
+  return process.env["OLLAMA_UPSTREAM_URL"] ?? "http://localhost:11434";
+}
+function detectUpstream(path) {
+  if (path.startsWith("/v1/messages")) return anthropicUpstream();
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return openaiUpstream();
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return geminiUpstream();
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return ollamaUpstream();
+  return anthropicUpstream();
+}
+function detectProvider(path) {
+  if (path.startsWith("/v1/messages")) return "anthropic";
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return "openai";
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return "google";
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return "ollama";
+  return "anthropic";
+}
+function stripPretenseOnlyForwardingHeaders(headers) {
+  const drop = /* @__PURE__ */ new Set(["x-pretense-api-key", "x-pretense-key"]);
+  for (const k of [...Object.keys(headers)]) {
+    if (drop.has(k.toLowerCase())) delete headers[k];
+  }
+}
+function extractText(body) {
+  const parts = [];
+  if (typeof body["system"] === "string") parts.push(body["system"]);
+  if (Array.isArray(body["messages"])) {
+    for (const msg of body["messages"]) {
+      if (typeof msg["content"] === "string") parts.push(msg["content"]);
+      else if (Array.isArray(msg["content"])) {
+        for (const block of msg["content"]) {
+          if (block["type"] === "text" && typeof block["text"] === "string") parts.push(block["text"]);
+        }
+      }
+    }
+  }
+  return parts.join("\n");
+}
+function extractCodeBlocks(text) {
+  const blocks = [];
+  const re = /```(\w*)\n([\s\S]*?)```/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    blocks.push({
+      code: m[2] ?? "",
+      language: m[1] ?? "typescript",
+      start: m.index,
+      end: m.index + m[0].length
+    });
+  }
+  return blocks;
+}
+function replaceCodeBlocks(text, blocks, replacements) {
+  let result = text;
+  for (let i = blocks.length - 1; i >= 0; i--) {
+    const block = blocks[i];
+    const replacement = replacements[i] ?? block.code;
+    const lang = block.language ?? "typescript";
+    result = result.slice(0, block.start) + "```" + lang + "\n" + replacement + "```" + result.slice(block.end);
+  }
+  return result;
+}
+function applyToBody(body, transform) {
+  const mutateField = (val) => {
+    if (typeof val === "string") return transform(val);
+    if (Array.isArray(val)) return val.map(mutateField);
+    if (val && typeof val === "object") {
+      const obj = val;
+      return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, mutateField(v)]));
+    }
+    return val;
+  };
+  return mutateField(body);
+}
+var stats = {
+  requestsProcessed: 0,
+  totalTokensMutated: 0,
+  totalSecretsBlocked: 0,
+  startedAt: Date.now()
+};
+function daysSinceFirstUse() {
+  const usage = loadUsage();
+  if (!usage.firstUseDate) return 0;
+  const first = new Date(usage.firstUseDate).getTime();
+  return Math.floor((Date.now() - first) / (24 * 60 * 60 * 1e3));
+}
+function printUpgradeNudge(reason) {
+  process.stdout.write(
+    `
+\x1B[33m[PRETENSE] ${reason}\x1B[0m
+\x1B[33m[PRETENSE] Upgrade to Pro: ${PUBLISH_PACKAGE_URL}\x1B[0m
+
+`
+  );
+}
+function createProxy(opts = {}) {
+  const config = { ...DEFAULT_CONFIG, ...opts.config };
   const store = opts.store ?? new MutationStore(`${config.storePath}/proxy-store.json`);
   const verbose = opts.verbose ?? false;
   const app = new Hono();
@@ -1688,7 +2617,7 @@ function createProxy(opts = {}) {
     "/",
     (c) => c.json({
       name: "pretense",
-      version: "0.3.0",
+      version: getCliSemver(),
       status: "running",
       routes: {
         "GET /": "This welcome page",
@@ -1698,14 +2627,14 @@ function createProxy(opts = {}) {
         "POST /*": "Proxy to upstream LLM API (Anthropic, OpenAI, Google auto-detected)"
       },
       languages: ["TypeScript", "JavaScript", "Python", "Go", "Java", "C#", "Ruby", "Rust"],
-      docs: "https://pretense.ai/docs"
+      docs: PUBLISH_PACKAGE_URL
     })
   );
   app.get(
     "/health",
     (c) => c.json({
       status: "ok",
-      version: "0.3.0",
+      version: getCliSemver(),
       uptime: Math.floor((Date.now() - stats.startedAt) / 1e3),
       stats: {
         requestsProcessed: stats.requestsProcessed,
@@ -1735,6 +2664,7 @@ function createProxy(opts = {}) {
       });
       delete headers2["host"];
       headers2["host"] = new URL(upstream2).host;
+      stripPretenseOnlyForwardingHeaders(headers2);
       const resp = await fetch(url, { method: c.req.method, headers: headers2 });
       return new Response(resp.body, { status: resp.status, headers: Object.fromEntries(resp.headers.entries()) });
     }
@@ -1751,22 +2681,93 @@ function createProxy(opts = {}) {
     const requestId = nanoid(12);
     const upstream = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
     const provider = detectProvider(c.req.path);
+    if (dashboardSavedCredentialsRevoked) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_session_logged_out",
+            message: "Saved dashboard credentials were removed (for example pretense logout). Run pretense login, then restart pretense start. If you started the proxy with a dashboard API key in this shell, stop it (Ctrl+C) and start again after logout."
+          }
+        },
+        401
+      );
+    }
+    const dashboardApiKey = getDashboardApiKey();
+    if (!dashboardApiKey) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_dashboard_key_required",
+            message: "Configure your dashboard API key: run `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+          }
+        },
+        401
+      );
+    }
+    try {
+      await validateKey({ verbose, force: false, enforceReachability: true });
+    } catch (err) {
+      const code = err.code ?? "";
+      const msg = err.message;
+      const knownAuthCodes = /* @__PURE__ */ new Set([
+        "KEY_REVOKED",
+        "KEY_EXPIRED",
+        "INVALID_API_KEY",
+        "MISSING_API_KEY"
+      ]);
+      if (knownAuthCodes.has(code)) {
+        return c.json(
+          { error: { type: "pretense_auth_error", code, message: msg } },
+          401
+        );
+      }
+      if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+        return c.json(
+          { error: { type: "pretense_auth_backend_error", code, message: msg } },
+          503
+        );
+      }
+      if (code === "ORG_INACTIVE") {
+        return c.json(
+          { error: { type: "pretense_org_inactive", code, message: msg } },
+          403
+        );
+      }
+      return c.json(
+        { error: { type: "pretense_auth_error", message: msg } },
+        401
+      );
+    }
     const sessHash = c.get("sessionHash");
     const session = getSession(sessHash);
-    const tier = detectTier();
-    const { monthlyMutations } = getTierLimits(tier);
-    const usage = loadUsage();
-    if (tier === "free" && usage.mutations >= monthlyMutations) {
+    const tier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
+    const backendLimits = await isWithinLimits();
+    if (!backendLimits.allowed) {
       return c.json(
         {
           error: {
             type: "pretense_rate_limit",
-            message: `Monthly mutation limit reached (${monthlyMutations}/month). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
+            message: backendLimits.reason ?? "Security token limit exceeded."
           }
         },
         429
       );
     }
+    const cliAuth = getCachedValidation();
+    if (cliAuth?.permission === "read_only") {
+      return c.json(
+        {
+          error: {
+            type: "pretense_forbidden",
+            message: "This API key is read-only. Create a read_write key in the dashboard to use the Pretense proxy."
+          }
+        },
+        403
+      );
+    }
     const fullText = extractText(body);
     const secretScan = scan2(fullText);
     const blockedSecrets = secretScan.matches.filter((m) => m.action === "block");
@@ -1790,7 +2791,17 @@ function createProxy(opts = {}) {
     let tokensMutated = 0;
     const mutatedBody = applyToBody(processedBody, (text) => {
       const blocks = extractCodeBlocks(text);
-      if (blocks.length === 0) return text;
+      if (blocks.length === 0) {
+        const lang = detectLanguage(text);
+        const result = mutate(text, lang);
+        for (const [k, v] of result.map) {
+          mutationMap.set(k, v);
+          session.mutationMap.set(k, v);
+          session.reverseMap.set(v, k);
+        }
+        tokensMutated += result.stats.tokensMutated;
+        return result.mutatedCode;
+      }
       const mutatedBlocks = [];
       for (const block of blocks) {
         const result = mutate(block.code, block.language);
@@ -1804,14 +2815,37 @@ function createProxy(opts = {}) {
       }
       return replaceCodeBlocks(text, blocks, mutatedBlocks);
     });
-    usage.mutations += tokensMutated;
-    saveUsage(usage);
-    const warningThreshold = Math.floor(monthlyMutations * 0.8);
-    if (tier === "free" && usage.mutations >= warningThreshold && usage.mutations - tokensMutated < warningThreshold) {
-      printUpgradeNudge(`${usage.mutations}/${monthlyMutations} monthly mutations used. Running low!`);
+    const remoteLogDisabled = process.env["PRETENSE_DISABLE_REMOTE_LOG"] === "1";
+    if (dashboardApiKey && !remoteLogDisabled) {
+      bumpCachedUsageAfterLog(tokensMutated);
+      void uploadLog(
+        {
+          file_count: 0,
+          identifiers_mutated: tokensMutated,
+          secrets_blocked: blockedSecrets.length,
+          llm_provider: provider,
+          cli_version: getCliSemver()
+        },
+        {
+          apiKey: dashboardApiKey,
+          verbose,
+          onResponse: (codeProtectionsUsed, limit) => {
+            syncCachedUsageFromServer(codeProtectionsUsed, limit);
+          }
+        }
+      );
+    }
+    const warnCache = getCachedValidation();
+    if (warnCache && warnCache.monthlyMutationLimit !== -1 && tier === "free") {
+      const limit = warnCache.monthlyMutationLimit;
+      const used = warnCache.mutationsUsed;
+      const warningThreshold = Math.floor(limit * 0.8);
+      if (used >= warningThreshold && used - tokensMutated < warningThreshold) {
+        printUpgradeNudge(`${used}/${limit} monthly security tokens used. Running low!`);
+      }
     }
     if (tier === "free" && daysSinceFirstUse() >= 7) {
-      printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited mutations, 90-day audit, Slack alerts.");
+      printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited security tokens, 90-day audit, Slack alerts.");
     }
     const entry = {
       id: requestId,
@@ -1828,7 +2862,7 @@ function createProxy(opts = {}) {
       createAuditEntry(requestId, "proxy-request", tokensMutated, blockedSecrets.length, provider, latencyMs)
     );
     if (verbose && tokensMutated > 0) {
-      process.stdout.write(`[PRETENSE] ${tokensMutated} tokens mutated for request ${requestId}
+      process.stdout.write(`[PRETENSE] ${tokensMutated} security tokens protected for request ${requestId}
 `);
     }
     const headers = {};
@@ -1839,6 +2873,7 @@ function createProxy(opts = {}) {
     delete headers["content-length"];
     headers["host"] = new URL(upstream).host;
     headers["x-pretense-request-id"] = requestId;
+    stripPretenseOnlyForwardingHeaders(headers);
     const forwardBody = JSON.stringify(mutatedBody);
     let upstreamResp;
     try {
@@ -1867,12 +2902,12 @@ function createProxy(opts = {}) {
       }
       const decoder = new TextDecoder();
       const encoder = new TextEncoder();
-      let buffer = "";
+      let buffer2 = "";
       const transform = new TransformStream({
         transform(chunk, controller) {
-          buffer += decoder.decode(chunk, { stream: true });
-          const lines = buffer.split("\n");
-          buffer = lines.pop() ?? "";
+          buffer2 += decoder.decode(chunk, { stream: true });
+          const lines = buffer2.split("\n");
+          buffer2 = lines.pop() ?? "";
           for (const line of lines) {
             if (line.startsWith("data: ") && line !== "data: [DONE]") {
               try {
@@ -1889,8 +2924,8 @@ function createProxy(opts = {}) {
           }
         },
         flush(controller) {
-          if (buffer.length > 0) {
-            controller.enqueue(encoder.encode(buffer));
+          if (buffer2.length > 0) {
+            controller.enqueue(encoder.encode(buffer2));
           }
         }
       });
@@ -1934,9 +2969,9 @@ function createProxy(opts = {}) {
   return app;
 }
 function isPortAvailable(port) {
-  return new Promise((resolve3) => {
-    const tester = createServer().once("error", () => resolve3(false)).once("listening", () => {
-      tester.once("close", () => resolve3(true)).close();
+  return new Promise((resolve4) => {
+    const tester = createServer().once("error", () => resolve4(false)).once("listening", () => {
+      tester.once("close", () => resolve4(true)).close();
     }).listen(port, "127.0.0.1");
   });
 }
@@ -1953,8 +2988,103 @@ async function findAvailablePort(startPort, maxAttempts = 10) {
 function startProxy(opts = {}) {
   const requestedPort = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
   const app = createProxy(opts);
-  const tier = detectTier();
   void (async () => {
+    const dashboardKeyFromEnvAtLaunch = hasDashboardApiKeyInEnv();
+    const dashboardKey = getDashboardApiKey();
+    if (!dashboardKey || !isValidKeyShape(dashboardKey)) {
+      process.stderr.write(
+        `\x1B[31m[PRETENSE] API key required or invalid shape. Run \`pretense login --key prtns_live_...\`\x1B[0m
+\x1B[31m[PRETENSE] or set PRETENSE_API_KEY. See ${PUBLISH_PACKAGE_URL}\x1B[0m
+`
+      );
+      process.exit(1);
+    }
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    for (; ; ) {
+      try {
+        const validation = await validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        });
+        if (!validation) {
+          process.stderr.write(
+            `\x1B[31m[PRETENSE] Startup validation failed (no API key or unreachable backend). Cannot start proxy.\x1B[0m
+`
+          );
+          process.exit(1);
+        }
+        const plan = validation.plan ?? "FREE";
+        const remaining = validation.mutationsRemaining === -1 ? "unlimited" : String(validation.mutationsRemaining);
+        process.stdout.write(
+          `\x1B[32m[PRETENSE] Key validated: ${plan} plan` + (validation.organizationName ? ` (${validation.organizationName})` : "") + ` \u2014 ${remaining} security tokens remaining\x1B[0m
+`
+        );
+        break;
+      } catch (err) {
+        const code = err.code;
+        const msg = err.message;
+        if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Fix network or set PRETENSE_API_URL (or PRETEST_API_URL) if using a custom API.\x1B[0m
+`);
+          process.exit(1);
+        }
+        if (code === "ORG_INACTIVE") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Your organization is inactive; contact support.\x1B[0m
+`);
+          process.exit(1);
+        }
+        const authRetryable = code === "INVALID_API_KEY" || code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "AUTH_ERROR" || code === "MISSING_API_KEY";
+        if (authRetryable && interactive) {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(
+            `\x1B[33m[PRETENSE] Enter your dashboard API key and press Enter (Ctrl+C to quit).\x1B[0m
+`
+          );
+          let entered = null;
+          for (; ; ) {
+            entered = await promptDashboardApiKeyAfterFailure();
+            if (!entered) {
+              process.stderr.write(`\x1B[31m[PRETENSE] No key entered; exiting.\x1B[0m
+`);
+              process.exit(1);
+            }
+            if (isValidKeyShape(entered)) break;
+            process.stderr.write(
+              `\x1B[31m[PRETENSE] That does not look like a dashboard key (expect prtns_live_\u2026 or pk_live_\u2026).\x1B[0m
+`
+            );
+          }
+          const savedPath = installDashboardKeyForCurrentProcess(entered);
+          process.stdout.write(`\x1B[32m[PRETENSE] Saved API key to ${savedPath}\x1B[0m
+`);
+          clearValidationCache();
+          continue;
+        }
+        if (code === "KEY_REVOKED" || code === "KEY_EXPIRED" || code === "INVALID_API_KEY" || code === "AUTH_ERROR" || code === "MISSING_API_KEY") {
+          process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+          process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' to fix.\x1B[0m
+`);
+          process.exit(1);
+        }
+        process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
+`);
+        process.stderr.write(`\x1B[31m[PRETENSE] Run 'pretense login --key <new-key>' or check connectivity.\x1B[0m
+`);
+        process.exit(1);
+      }
+    }
+    attachDashboardLogoutWatcher(!dashboardKeyFromEnvAtLaunch);
+    const bannerTier = tierFromDashboardPlan(
+      getCachedValidation()?.plan,
+      detectTier()
+    );
     let port;
     try {
       port = await findAvailablePort(requestedPort, 10);
@@ -1969,10 +3099,11 @@ function startProxy(opts = {}) {
 `
       );
     }
+    printStartClientInstructions(port);
     serve({ fetch: app.fetch, port }, () => {
       const portStr = String(port);
       process.stdout.write(`
-\x1B[36mPretense v0.3.0  [${tier.toUpperCase()}]\x1B[0m
+\x1B[36mPretense v${getCliSemver()}  [${bannerTier.toUpperCase()}]\x1B[0m
   Your code hits AI naked. We fix that.
 
   Proxy:    http://localhost:${portStr}
@@ -1992,12 +3123,22 @@ function startProxy(opts = {}) {
     /v1beta/...               -> Google Gemini
     /api/chat, /api/generate  -> Ollama (local)
 `);
+      setInterval(() => {
+        if (dashboardSavedCredentialsRevoked) return;
+        if (!getDashboardApiKey()) return;
+        void validateKey({
+          force: true,
+          verbose: opts.verbose,
+          enforceReachability: true
+        }).catch(() => {
+        });
+      }, 6e4);
     });
   })();
 }
 
 // src/token-footer.ts
-import chalk from "chalk";
+import chalk3 from "chalk";
 var PLAN_LIMITS = {
   free: { monthlyMutations: 1e3, monthlyScans: 5e3, seats: 3, pricePerMonth: "$0/month" },
   pro: { monthlyMutations: 1e5, monthlyScans: 5e5, seats: 25, pricePerMonth: "$29/seat/month" },
@@ -2008,45 +3149,49 @@ var PLAN_LIMITS = {
     pricePerMonth: "$99/seat/month"
   }
 };
-function getPlanLimits(tier) {
-  return PLAN_LIMITS[tier];
-}
 function fmt(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
 function printTokenFooter(filesScanned, mutationsMade) {
-  const tier = detectTier();
-  const limits = getPlanLimits(tier);
-  const usage = loadUsage();
-  if (tier === "enterprise") {
+  const cached2 = getCachedValidation();
+  if (!cached2) {
+    process.stderr.write(chalk3.gray(`
+  ${filesScanned} files, ${mutationsMade} security tokens
+
+`));
+    return;
+  }
+  const plan = cached2.plan;
+  if (plan === "ENTERPRISE") {
     process.stderr.write(
-      chalk.gray(`
-  ${filesScanned} files, ${mutationsMade} mutations  \xB7  Plan: Enterprise (unlimited)
+      chalk3.gray(`
+  ${filesScanned} files, ${mutationsMade} security tokens  \xB7  Plan: Enterprise (unlimited)
 
 `)
     );
     return;
   }
-  const used = usage.mutations;
-  const cap = limits.monthlyMutations;
-  const pct = cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
-  const usageStr = pct >= 80 ? chalk.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk.gray(`${fmt(used)} / ${fmt(cap)}`);
+  const used = cached2.mutationsUsed;
+  const cap = cached2.monthlyMutationLimit;
+  const unlimited = cap === -1 || !Number.isFinite(cap);
+  const pct = !unlimited && cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
+  const usageStr = unlimited ? chalk3.gray(`${fmt(used)} / unlimited`) : pct >= 80 ? chalk3.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk3.gray(`${fmt(used)} / ${fmt(cap)}`);
   process.stderr.write(
     `
-  ${chalk.cyan(filesScanned + " files")}, ${chalk.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
+  ${chalk3.cyan(filesScanned + " files")}, ${chalk3.cyan(mutationsMade + " security tokens")}  \xB7  Plan: ${chalk3.bold(plan)}  \xB7  Security tokens this month: ${usageStr}${!unlimited ? ` (${pct}%)` : ""}
 `
   );
-  if (tier === "free") {
+  if (plan === "FREE") {
     if (pct >= 80) {
       process.stderr.write(
-        chalk.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk.bold("pretense upgrade")}
+        chalk3.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk3.bold(PUBLISH_PACKAGE_URL)}
 
 `)
       );
     } else {
       process.stderr.write(
-        chalk.gray(`  Run ${chalk.bold("pretense status")} for details, ${chalk.bold("pretense upgrade")} to remove limits.
+        chalk3.gray(`  Run ${chalk3.bold("pretense status")} for details, ${chalk3.bold("pretense upgrade")} to remove limits.
 
 `)
       );
@@ -2057,7 +3202,7 @@ function printTokenFooter(filesScanned, mutationsMade) {
 }
 
 // src/banner.ts
-import chalk2 from "chalk";
+import chalk4 from "chalk";
 var BANNER_RAW = `\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588    pretense
 \u2588\u2588          \u2588\u2588
 \u2588\u2588          \u2588\u2588    Stop your code from
@@ -2077,7 +3222,7 @@ function shouldPrint() {
 }
 function tint(line) {
   try {
-    return chalk2.hex(ICE_BLUE)(line);
+    return chalk4.hex(ICE_BLUE)(line);
   } catch {
     return line;
   }
@@ -2092,53 +3237,66 @@ function printBanner() {
 }
 
 // src/commands/status.ts
-import chalk3 from "chalk";
-var PLAN_LABEL = {
-  free: "Free",
-  pro: "Pro",
-  enterprise: "Enterprise"
-};
+import chalk5 from "chalk";
 function fmt2(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
-function runStatus() {
-  const tier = detectTier();
-  const planLimits = getPlanLimits(tier);
-  const tierLimits = getTierLimits(tier);
-  const usage = loadUsage();
-  const tierBadge = tier === "enterprise" ? chalk3.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk3.bgBlue.white.bold(" PRO ") : chalk3.bgGray.white.bold(" FREE ");
-  const lines = [];
-  lines.push("");
-  lines.push(`${chalk3.cyan("Pretense")} ${chalk3.gray("v0.3.0")}  ${tierBadge}`);
-  lines.push("");
-  lines.push(`  Plan:        ${chalk3.bold(PLAN_LABEL[tier])} ${chalk3.gray("(" + planLimits.pricePerMonth + ")")}`);
-  lines.push(`  Mutations:   ${fmt2(usage.mutations)} / ${fmt2(planLimits.monthlyMutations)} this month`);
-  lines.push(`  Scans:       0 / ${fmt2(planLimits.monthlyScans)} this month`);
-  lines.push(`  Seats:       1 / ${fmt2(planLimits.seats)}`);
-  lines.push(`  Audit log:   ${Number.isFinite(tierLimits.auditRetentionDays) ? `${tierLimits.auditRetentionDays} days` : "unlimited"}`);
-  lines.push("");
-  if (tier === "free") {
-    lines.push(`  ${chalk3.gray("Upgrade:")}  ${chalk3.bold("pretense upgrade")}`);
-    lines.push(`  ${chalk3.gray("Credits:")}  ${chalk3.bold("pretense credits")}`);
+async function runStatus() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const plan = remote.plan;
+    const tierBadge = plan === "ENTERPRISE" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : plan === "PRO" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
+    const lines = [];
+    lines.push("");
+    lines.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge}  ${chalk5.green("(synced)")}`);
     lines.push("");
+    lines.push(`  Plan:        ${chalk5.bold(plan)}`);
+    lines.push(`  Security tokens:${fmt2(remote.mutationsUsed)} / ${fmt2(remote.monthlyMutationLimit)} this month`);
+    lines.push(`  Remaining:   ${fmt2(remote.mutationsRemaining)}`);
+    lines.push(`  Requests:    ${fmt2(remote.requestsThisPeriod)} this period`);
+    lines.push(`  Secrets:     ${fmt2(remote.secretsBlockedThisPeriod)} blocked`);
+    lines.push(`  Key status:  ${remote.keyStatus === "active" ? chalk5.green("active") : chalk5.red("revoked")}`);
+    lines.push(`  Resets at:   ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    if (remote.keyExpiresAt) {
+      lines.push(`  Key expires: ${new Date(remote.keyExpiresAt).toLocaleDateString()}`);
+    }
+    lines.push("");
+    if (plan === "FREE") {
+      lines.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+      lines.push("");
+    }
+    process.stdout.write(lines.join("\n") + "\n");
+    return;
   }
-  process.stdout.write(lines.join("\n") + "\n");
+  process.stderr.write(
+    chalk5.yellow(`
+  [pretense] Could not reach server \u2014 usage data unavailable.
+`) + chalk5.gray(`  Check your connection or run \`pretense login\` if your key has changed.
+
+`)
+  );
 }
 
 // src/commands/upgrade.ts
-import chalk4 from "chalk";
+import chalk6 from "chalk";
 var PRICING_URL = "https://pretense.ai/pricing";
 function runUpgrade() {
   const tier = detectTier();
   const lines = [];
   lines.push("");
-  lines.push(chalk4.cyan.bold("  Pretense Plans"));
+  lines.push(chalk6.cyan.bold("  Pretense Plans"));
   lines.push("");
-  lines.push(chalk4.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-  lines.push(chalk4.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
-  lines.push(chalk4.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
-  lines.push(`  \u2502 Price/seat   \u2502 ${chalk4.bold("$0")}      \u2502 ${chalk4.bold("$29")}     \u2502 ${chalk4.bold("$99")}         \u2502`);
+  lines.push(chalk6.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  lines.push(chalk6.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
+  lines.push(chalk6.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  lines.push(`  \u2502 Price/seat   \u2502 ${chalk6.bold("$0")}      \u2502 ${chalk6.bold("$29")}     \u2502 ${chalk6.bold("$99")}         \u2502`);
   lines.push("  \u2502 Mutations/mo \u2502 1,000    \u2502 100,000  \u2502 unlimited   \u2502");
   lines.push("  \u2502 Scans/mo     \u2502 5,000    \u2502 500,000  \u2502 unlimited   \u2502");
   lines.push("  \u2502 Seats        \u2502 3        \u2502 25       \u2502 unlimited   \u2502");
@@ -2146,159 +3304,215 @@ function runUpgrade() {
   lines.push("  \u2502 SSO/SAML     \u2502   -      \u2502   -      \u2502     yes     \u2502");
   lines.push("  \u2502 On-prem      \u2502   -      \u2502   -      \u2502     yes     \u2502");
   lines.push("  \u2502 SLA          \u2502   -      \u2502   -      \u2502   24/7      \u2502");
-  lines.push(chalk4.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  lines.push(chalk6.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
   lines.push("");
-  lines.push(`  ${chalk4.gray("Current plan:")} ${chalk4.bold(tier.toUpperCase())}`);
-  lines.push(`  ${chalk4.gray("Upgrade at:")}    ${chalk4.cyan.underline(PRICING_URL)}`);
+  lines.push(`  ${chalk6.gray("Current plan:")} ${chalk6.bold(tier.toUpperCase())}`);
+  lines.push(`  ${chalk6.gray("Upgrade at:")}    ${chalk6.cyan.underline(PRICING_URL)}`);
   lines.push("");
-  lines.push(chalk4.gray("  After purchase, set:"));
-  lines.push(chalk4.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
+  lines.push(chalk6.gray("  After purchase, set:"));
+  lines.push(chalk6.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
   lines.push("");
   process.stdout.write(lines.join("\n") + "\n");
 }
 
 // src/commands/credits.ts
-import chalk5 from "chalk";
-var PLAN_LABEL2 = {
-  free: "Free",
-  pro: "Pro",
-  enterprise: "Enterprise"
-};
+import chalk7 from "chalk";
 function fmt3(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
 function progressBar(used, cap, width = 24) {
-  if (!Number.isFinite(cap) || cap <= 0) return chalk5.green("[" + "=".repeat(width) + "]");
+  if (cap === -1 || !Number.isFinite(cap) || cap <= 0) return chalk7.green("[" + "=".repeat(width) + "]");
   const pct = Math.min(1, used / cap);
   const filled = Math.round(pct * width);
   const bar = "=".repeat(filled) + "-".repeat(width - filled);
-  const colored = pct >= 0.8 ? chalk5.yellow(bar) : pct >= 1 ? chalk5.red(bar) : chalk5.green(bar);
+  const colored = pct >= 0.8 ? chalk7.yellow(bar) : pct >= 1 ? chalk7.red(bar) : chalk7.green(bar);
   return "[" + colored + "]";
 }
-function runCredits() {
-  const tier = detectTier();
-  const limits = getPlanLimits(tier);
-  const usage = loadUsage();
-  const used = usage.mutations;
-  const cap = limits.monthlyMutations;
-  const remaining = Number.isFinite(cap) ? Math.max(0, cap - used) : Number.POSITIVE_INFINITY;
-  const pct = Number.isFinite(cap) && cap > 0 ? Math.round(used / cap * 100) : 0;
-  const lines = [];
-  lines.push("");
-  lines.push(chalk5.cyan.bold("  Pretense Credits"));
-  lines.push("");
-  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL2[tier])}`);
-  lines.push(`  Month:       ${usage.month}`);
-  lines.push("");
-  lines.push(`  Mutations:   ${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
-  lines.push(`  Used:        ${pct}%`);
-  lines.push(`  Remaining:   ${fmt3(remaining)}`);
-  lines.push("");
-  if (tier === "free" && Number.isFinite(cap) && used >= cap * 0.8) {
-    lines.push(chalk5.yellow("  \u26A0  Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+async function runCredits() {
+  let remote = await fetchUsageSummary();
+  if (!remote) {
+    const v = await validateKey({ force: true });
+    if (v?.valid) {
+      remote = usageSummaryFromValidate(v);
+    }
+  }
+  if (remote) {
+    const used = remote.mutationsUsed;
+    const cap = remote.monthlyMutationLimit;
+    const remaining = remote.mutationsRemaining;
+    const pct = cap > 0 && cap !== -1 ? Math.round(used / cap * 100) : 0;
+    const lines = [];
+    lines.push("");
+    lines.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.green("(synced)"));
     lines.push("");
-  } else if (tier === "free") {
-    lines.push(chalk5.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+    lines.push(`  Plan:        ${chalk7.bold(remote.plan)}`);
+    lines.push(`  Resets:      ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
     lines.push("");
+    lines.push(`  Security tokens:${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
+    lines.push(`  Used:        ${pct}%`);
+    lines.push(`  Remaining:   ${fmt3(remaining)}`);
+    lines.push("");
+    if (remote.plan === "FREE" && cap !== -1 && used >= cap * 0.8) {
+      lines.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+      lines.push("");
+    } else if (remote.plan === "FREE") {
+      lines.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+      lines.push("");
+    }
+    process.stdout.write(lines.join("\n") + "\n");
+    return;
   }
-  process.stdout.write(lines.join("\n") + "\n");
-}
+  process.stderr.write(
+    chalk7.yellow(`
+  [pretense] Could not reach server \u2014 usage data unavailable.
+`) + chalk7.gray(`  Check your connection or run \`pretense login\` if your key has changed.
 
-// src/commands/login.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir2 } from "os";
-import chalk6 from "chalk";
-var CONFIG_DIR_NAME2 = ".pretense";
-var CONFIG_FILE2 = "config.json";
-function getUserConfigDir() {
-  return join4(homedir2(), CONFIG_DIR_NAME2);
-}
-function isValidKeyShape(key) {
-  const trimmed = key.trim();
-  if (trimmed.length < 24) return false;
-  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
-  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_");
-}
-function readStdinIfPiped() {
-  if (process.stdin.isTTY) return "";
-  try {
-    const chunks = [];
-    const buf = Buffer.alloc(4096);
-    let bytesRead = 0;
-    do {
-      try {
-        bytesRead = readSync(0, buf, 0, buf.length, null);
-      } catch {
-        bytesRead = 0;
-      }
-      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
-    } while (bytesRead === buf.length);
-    return Buffer.concat(chunks).toString("utf-8").trim();
-  } catch {
-    return "";
-  }
-}
-function maskKey(key) {
-  const trimmed = key.trim();
-  if (trimmed.length <= 12) return trimmed;
-  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
+`)
+  );
 }
-function saveApiKey(key, configDir = getUserConfigDir()) {
-  if (!existsSync5(configDir)) {
-    mkdirSync5(configDir, { recursive: true });
-  }
-  const path = join4(configDir, CONFIG_FILE2);
-  let existing = {};
-  if (existsSync5(path)) {
+
+// src/commands/logout.ts
+import readline2 from "readline/promises";
+import chalk8 from "chalk";
+async function runLogout(opts = {}) {
+  if (!loadApiKey()) {
+    console.log(chalk8.gray("No saved Pretense dashboard API key in ~/.pretense/config.json."));
+    console.log(chalk8.gray("If you use PRETENSE_API_KEY in your shell, run unset PRETENSE_API_KEY."));
+    return 0;
+  }
+  if (!opts.assumeYes) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      console.error(chalk8.red("Error: confirmation requires an interactive terminal."));
+      console.error(chalk8.gray("Run `pretense logout --yes` to skip the prompt."));
+      return 1;
+    }
+    const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     try {
-      existing = JSON.parse(readFileSync5(path, "utf-8"));
-    } catch {
-      existing = {};
+      const raw = await rl.question(
+        chalk8.bold("Log out and remove your saved API key? Type y for yes, n for no: ")
+      );
+      const answer = raw.trim().toLowerCase();
+      if (answer !== "y" && answer !== "yes") {
+        console.log(chalk8.yellow("Logout cancelled."));
+        return 0;
+      }
+    } finally {
+      rl.close();
     }
   }
-  const next = {
-    ...existing,
-    api_key: key.trim(),
-    saved_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-  return path;
-}
-function runLogin(opts = {}) {
-  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
-  if (!candidate) {
-    console.error(chalk6.red("Error: no API key provided."));
-    console.error(
-      chalk6.gray("Try: pretense login --key pk_live_xxxxx")
-    );
-    console.error(
-      chalk6.gray("  or: echo $PRETENSE_API_KEY | pretense login")
-    );
-    return 1;
-  }
-  if (!isValidKeyShape(candidate)) {
-    console.error(chalk6.red("Error: that does not look like a Pretense API key."));
-    console.error(
-      chalk6.gray("Keys start with pk_live_ and are at least 24 characters long.")
-    );
-    console.error(
-      chalk6.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
-    );
-    return 1;
+  const hadEnvDashboardKey = !!process.env["PRETENSE_API_KEY"]?.trim();
+  const { removed, path } = removeSavedDashboardCredentials();
+  clearValidationCache();
+  delete process.env["PRETENSE_API_KEY"];
+  if (removed) {
+    console.log(chalk8.green("Logged out. Removed saved API key from"), chalk8.bold(path));
+    console.log(chalk8.gray("Other terminals: run unset PRETENSE_API_KEY if that variable is still exported (e.g. in ~/.zshrc)."));
+    if (hadEnvDashboardKey) {
+      console.log(
+        chalk8.yellow(
+          "This shell had PRETENSE_API_KEY set; it was cleared for this process only. Restart any running pretense proxy (Ctrl+C, then pretense start)."
+        )
+      );
+    }
   }
-  const path = saveApiKey(candidate, opts.configDir);
-  console.log(chalk6.green("Saved API key to"), chalk6.bold(path));
-  console.log(chalk6.gray(`  ${maskKey(candidate)}`));
-  console.log(chalk6.gray("  File mode 600 \u2014 readable only by you."));
   return 0;
 }
 
+// src/commands/install.ts
+import { Command } from "commander";
+import chalk9 from "chalk";
+import {
+  existsSync as existsSync7,
+  writeFileSync as writeFileSync5,
+  chmodSync as chmodSync2,
+  readFileSync as readFileSync7,
+  mkdirSync as mkdirSync6
+} from "fs";
+import { join as join5, resolve as resolve2 } from "path";
+var HOOK_SCRIPTS = {
+  "pre-commit": `#!/bin/sh
+# Pretense AI Firewall \u2014 pre-commit hook
+# Installed by: pretense install --mode pre-commit
+
+pretense scan pre-commit
+exit $?
+`,
+  "pre-push": `#!/bin/sh
+# Pretense AI Firewall \u2014 pre-push hook
+# Installed by: pretense install --mode pre-push
+
+pretense scan pre-push
+exit $?
+`
+};
+var VALID_MODES = ["pre-commit", "pre-push"];
+function findGitDir(cwd) {
+  const gitDir = join5(cwd, ".git");
+  if (existsSync7(gitDir)) return gitDir;
+  return null;
+}
+function installHook(hooksDir, mode, force) {
+  const hookPath = join5(hooksDir, mode);
+  const script = HOOK_SCRIPTS[mode];
+  if (existsSync7(hookPath) && !force) {
+    const existing = readFileSync7(hookPath, "utf-8");
+    if (existing.includes("Pretense AI Firewall")) {
+      return { installed: false, path: hookPath, skipped: true };
+    }
+    return { installed: false, path: hookPath };
+  }
+  writeFileSync5(hookPath, script, "utf-8");
+  chmodSync2(hookPath, 493);
+  return { installed: true, path: hookPath };
+}
+function installCommand() {
+  return new Command("install").description("Install Pretense git hooks (pre-commit and/or pre-push)").option("-m, --mode <mode>", "Hook mode: pre-commit, pre-push (omit to install both)").option("-f, --force", "Overwrite existing hooks without prompting", false).option("-d, --dir <path>", "Project directory (defaults to cwd)", ".").action((opts) => {
+    const dir = resolve2(opts.dir);
+    const force = opts.force;
+    const modeArg = opts.mode;
+    if (modeArg && !VALID_MODES.includes(modeArg)) {
+      console.error(
+        chalk9.red(`
+  Error: Invalid mode "${modeArg}". Use: ${VALID_MODES.join(", ")}
+`)
+      );
+      process.exit(1);
+    }
+    const modes = modeArg ? [modeArg] : [...VALID_MODES];
+    const gitDir = findGitDir(dir);
+    if (!gitDir) {
+      console.error(
+        chalk9.red(`
+  Error: No .git directory found in ${dir}
+  Run this command from a git repository root.
+`)
+      );
+      process.exit(1);
+    }
+    const hooksDir = join5(gitDir, "hooks");
+    mkdirSync6(hooksDir, { recursive: true });
+    console.log(chalk9.cyan("\n  Pretense hook installer\n"));
+    let hasError = false;
+    for (const mode of modes) {
+      const result = installHook(hooksDir, mode, force);
+      if (result.installed) {
+        console.log(chalk9.green(`  Installed ${mode} hook at ${result.path}`));
+      } else if (result.skipped) {
+        console.log(chalk9.dim(`  Pretense ${mode} hook already installed at ${result.path}`));
+      } else {
+        console.error(chalk9.yellow(`  Hook already exists at ${result.path}. Use --force to overwrite.`));
+        hasError = true;
+      }
+    }
+    if (hasError) {
+      console.log("");
+      process.exit(1);
+    }
+    console.log(chalk9.bold.green("\n  Git hooks installed successfully.\n"));
+  });
+}
+
 // src/index.ts
 {
   const major = parseInt(process.versions.node.split(".")[0], 10);
@@ -2312,7 +3526,7 @@ function runLogin(opts = {}) {
     process.exit(1);
   }
 }
-var VERSION = "0.3.0";
+var VERSION = getCliSemver();
 var SCAN_CONCURRENCY = Math.max(2, os.cpus().length);
 var PROGRESS_INTERVAL_MS = 500;
 var SUPPORTED_LANGUAGES = ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"];
@@ -2435,18 +3649,35 @@ function validateLanguage(lang) {
   return SUPPORTED_LANGUAGES.includes(resolved) ? resolved : null;
 }
 function collectFiles(target) {
-  const abs = resolve2(target);
-  if (!existsSync6(abs)) {
+  const abs = resolve3(target);
+  if (!existsSync8(abs)) {
     return [];
   }
   const stat = statSync(abs);
   if (stat.isFile()) return [abs];
   const files = [];
   function walk(dir) {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = join5(dir, entry.name);
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    const skipDirs = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".git",
+      "dist",
+      "build",
+      ".pretest",
+      ".pretense",
+      ".next",
+      "__pycache__",
+      ".Trash"
+    ]);
+    for (const entry of entries) {
+      const fullPath = join6(dir, entry.name);
       if (entry.isDirectory()) {
-        if (["node_modules", ".git", "dist", "build", ".pretense", ".next", "__pycache__"].includes(entry.name)) continue;
+        if (skipDirs.has(entry.name)) continue;
         walk(fullPath);
       } else if (entry.isFile() && isScannableFile(entry.name)) {
         files.push(fullPath);
@@ -2456,13 +3687,13 @@ function collectFiles(target) {
   walk(abs);
   return files;
 }
-var program = new Command();
+var program = new Command2();
 program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION).hook("preAction", () => {
   printBanner();
 });
 program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
-  const dir = resolve2(opts.dir);
-  console.log(chalk7.cyan("Initializing Pretense in"), chalk7.bold(dir));
+  const dir = resolve3(opts.dir);
+  console.log(chalk10.cyan("Initializing Pretense in"), chalk10.bold(dir));
   const configDir = initConfig(dir);
   const files = collectFiles(dir);
   const langCounts = {};
@@ -2470,23 +3701,25 @@ program.command("init").description("Initialize .pretense/ config in current dir
     const lang = langFromExt(f);
     langCounts[lang] = (langCounts[lang] ?? 0) + 1;
   }
-  console.log(chalk7.green("\n  .pretense/ created at"), chalk7.bold(configDir));
-  console.log(chalk7.gray(`
+  console.log(chalk10.green("\n  .pretense/ created at"), chalk10.bold(configDir));
+  console.log(chalk10.gray(`
   Scanned ${files.length} source files:`));
   for (const [lang, count] of Object.entries(langCounts)) {
-    console.log(chalk7.gray(`    ${lang}: ${count} files`));
+    console.log(chalk10.gray(`    ${lang}: ${count} files`));
   }
-  console.log(chalk7.cyan("\n  Next: run"), chalk7.bold("pretense start"), chalk7.cyan("to launch the proxy"));
+  console.log(chalk10.cyan("\n  Next: run"), chalk10.bold("pretense start"), chalk10.cyan("to launch the proxy"));
   console.log();
 });
-program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action((opts) => {
+program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action(async (opts) => {
   const config = loadConfig();
   const port = validatePort(opts.port);
   if (port === null) {
-    console.error(chalk7.red("Error: Invalid port number:"), chalk7.bold(opts.port));
-    console.error(chalk7.gray("Port must be an integer between 1 and 65535."));
+    console.error(chalk10.red("Error: Invalid port number:"), chalk10.bold(opts.port));
+    console.error(chalk10.gray("Port must be an integer between 1 and 65535."));
     process.exit(1);
   }
+  await ensureDashboardKeyForStart();
+  logDashboardCredentialHint();
   startProxy({ config, port, verbose: opts.verbose });
 });
 async function scanOneFile(file, opts) {
@@ -2595,30 +3828,30 @@ function parseSizeOption(value) {
   return Math.floor(n * mult);
 }
 program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).option("--max-file-size <size>", "Skip files larger than this (e.g. 10mb, 500k)", "10mb").option("--concurrency <n>", "Max files scanned in parallel", String(SCAN_CONCURRENCY)).option("--quiet", "Suppress progress output", false).action(async (target, opts) => {
-  const absTarget = resolve2(target);
-  if (!existsSync6(absTarget)) {
-    console.error(chalk7.red("Error: Path not found:"), chalk7.bold(absTarget));
+  const absTarget = resolve3(target);
+  if (!existsSync8(absTarget)) {
+    console.error(chalk10.red("Error: Path not found:"), chalk10.bold(absTarget));
     process.exit(1);
   }
   const maxFileSize = parseSizeOption(opts.maxFileSize);
   if (maxFileSize === null) {
-    console.error(chalk7.red("Error: Invalid --max-file-size value:"), chalk7.bold(opts.maxFileSize));
-    console.error(chalk7.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
+    console.error(chalk10.red("Error: Invalid --max-file-size value:"), chalk10.bold(opts.maxFileSize));
+    console.error(chalk10.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
     process.exit(1);
   }
   const concurrency = Math.max(1, parseInt(opts.concurrency, 10) || SCAN_CONCURRENCY);
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk7.gray(`Discovering files in ${absTarget}...
+    process.stderr.write(chalk10.gray(`Discovering files in ${absTarget}...
 `));
   }
   const files = collectFiles(target);
   if (files.length === 0) {
-    console.error(chalk7.red("Error: No source files found at"), chalk7.bold(absTarget));
-    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk10.red("Error: No source files found at"), chalk10.bold(absTarget));
+    console.error(chalk10.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk7.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
+    process.stderr.write(chalk10.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
 `));
   }
   const startedAt = Date.now();
@@ -2644,34 +3877,34 @@ program.command("scan <target>").description("Scan file or directory for identif
       interrupted
     }, null, 2));
   } else {
-    console.log(chalk7.cyan("\nPretense Scan Results\n"));
+    console.log(chalk10.cyan("\nPretense Scan Results\n"));
     for (const r of allResults) {
       if (r.skipped) {
         if (r.skipped === "too-large") {
           const mb = ((r.sizeBytes ?? 0) / 1024 / 1024).toFixed(1);
-          console.log(chalk7.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
+          console.log(chalk10.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
         }
         continue;
       }
-      const secretBadge = r.secrets > 0 ? chalk7.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      const secretBadge = r.secrets > 0 ? chalk10.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
       const showRow = r.secrets > 0 || !opts.secretsOnly && r.identifiers > 0;
       if (!showRow) continue;
       console.log(
-        chalk7.gray("  ") + chalk7.white(r.file) + chalk7.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+        chalk10.gray("  ") + chalk10.white(r.file) + chalk10.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
       );
       if (r.secrets > 0) {
         for (const t of r.secretTypes) {
-          console.log(chalk7.red(`    ! ${t}`));
+          console.log(chalk10.red(`    ! ${t}`));
         }
       }
     }
-    const skipNote = skippedLarge + skippedBinary > 0 ? chalk7.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
+    const skipNote = skippedLarge + skippedBinary > 0 ? chalk10.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
     console.log(
-      chalk7.gray(`
-  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk7.red(`${totalSecrets} secrets found`) : chalk7.green("0 secrets")) + skipNote
+      chalk10.gray(`
+  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk10.red(`${totalSecrets} secrets found`) : chalk10.green("0 secrets")) + skipNote
     );
     if (interrupted) {
-      console.log(chalk7.yellow("\n  Interrupted \u2014 partial results shown above."));
+      console.log(chalk10.yellow("\n  Interrupted \u2014 partial results shown above."));
     }
     console.log();
   }
@@ -2685,68 +3918,81 @@ program.command("scan <target>").description("Scan file or directory for identif
     process.exit(2);
   }
 });
-program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
-  const absPath = resolve2(file);
-  if (!existsSync6(absPath)) {
-    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
+program.command("mutate <file>").description("Mutate identifiers for stdout (scanner redacts secrets/PII in the source first)").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
+  const absPath = resolve3(file);
+  if (!existsSync8(absPath)) {
+    console.error(chalk10.red("Error: File not found:"), chalk10.bold(absPath));
     process.exit(1);
   }
   if (opts.language) {
     const validLang = validateLanguage(opts.language);
     if (!validLang) {
-      console.error(chalk7.red("Error: Unsupported language:"), chalk7.bold(opts.language));
-      console.error(chalk7.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
+      console.error(chalk10.red("Error: Unsupported language:"), chalk10.bold(opts.language));
+      console.error(chalk10.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
       process.exit(1);
     }
   }
   if (!SUPPORTED_EXTENSIONS.has(extname(absPath).toLowerCase()) && isBinaryFile(absPath)) {
-    console.error(chalk7.red("Error: Not a supported source file:"), chalk7.bold(absPath));
-    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk10.red("Error: Not a supported source file:"), chalk10.bold(absPath));
+    console.error(chalk10.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
-  const code = readFileSync6(absPath, "utf-8");
+  const code = readFileSync8(absPath, "utf-8");
   const lang = opts.language ? validateLanguage(opts.language) : langFromExt(absPath);
-  const result = mutate(code, lang, opts.seed);
+  const secretScan = scan2(code);
+  const effectiveSeed = effectiveSeedForMutation(opts.seed);
+  const { redactedCode: redacted, secretsMap } = applyRedactionsTracked(code, secretScan.matches, effectiveSeed);
+  const secretsRedacted = secretsMap.size;
+  const result = mutate(redacted, lang, opts.seed);
   if (opts.save) {
     const configDir = getConfigDir();
-    const store = new MutationStore(join5(configDir, "mutation-map.json"));
+    const store = new MutationStore(join6(configDir, "mutation-map.json"));
     store.load();
     store.save({
       id: absPath,
       originalHash: absPath,
       mapEntries: MutationStore.fromMap(result.map),
+      secretsMapEntries: [...secretsMap.entries()],
       timestamp: Date.now(),
       language: lang
     });
     store.persist();
-    process.stderr.write(chalk7.gray(`Mutation map saved to ${configDir}/mutation-map.json
+    process.stderr.write(chalk10.gray(`Mutation map saved to ${configDir}/mutation-map.json
 `));
   }
   if (opts.json) {
     console.log(JSON.stringify({
       mutatedCode: result.mutatedCode,
       map: Object.fromEntries(result.map),
-      stats: result.stats
+      stats: result.stats,
+      secretsRedacted,
+      secretsMap: Object.fromEntries(secretsMap)
     }, null, 2));
   } else {
     process.stdout.write(result.mutatedCode);
-    process.stderr.write(chalk7.gray(`
---- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
+    if (secretsRedacted > 0) {
+      process.stderr.write(
+        chalk10.gray(`--- ${secretsRedacted} secret/PII span(s) redacted before code protection ---
+`)
+      );
+    }
+    process.stderr.write(chalk10.gray(`
+--- ${result.stats.tokensMutated} identifiers protected in ${result.stats.durationMs}ms ---
 `));
     printTokenFooter(1, result.stats.tokensMutated);
   }
 });
 program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
-  const absPath = resolve2(file);
-  if (!existsSync6(absPath)) {
-    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
+  const absPath = resolve3(file);
+  if (!existsSync8(absPath)) {
+    console.error(chalk10.red("Error: File not found:"), chalk10.bold(absPath));
     process.exit(1);
   }
-  const mutatedCode = readFileSync6(absPath, "utf-8");
-  const mapPath = opts.map ? resolve2(opts.map) : join5(getConfigDir(), "mutation-map.json");
-  if (!existsSync6(mapPath)) {
-    console.error(chalk7.red("Error: Mutation map not found:"), chalk7.bold(mapPath));
-    console.error(chalk7.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+  const mutatedCode = readFileSync8(absPath, "utf-8");
+  const mapPath = opts.map ? resolve3(opts.map) : join6(getConfigDir(), "mutation-map.json");
+  if (!existsSync8(mapPath)) {
+    console.error(chalk10.red("Error: Mutation map not found:"), chalk10.bold(mapPath));
+    console.error(chalk10.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
     process.exit(1);
   }
   let store;
@@ -2754,21 +4000,24 @@ program.command("reverse <file>").description("Reverse mutations using stored ma
     store = new MutationStore(mapPath);
     store.load();
   } catch {
-    console.error(chalk7.red("Error: Failed to load mutation map:"), chalk7.bold(mapPath));
-    console.error(chalk7.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
+    console.error(chalk10.red("Error: Failed to load mutation map:"), chalk10.bold(mapPath));
+    console.error(chalk10.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
     process.exit(1);
   }
   const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
   if (!entry) {
-    console.error(chalk7.red("Error: No mutation map entries found."));
-    console.error(chalk7.gray("Run 'pretense mutate --save <file>' first to generate a map."));
+    console.error(chalk10.red("Error: No mutation map entries found."));
+    console.error(chalk10.gray("Run 'pretense mutate --save <file>' first to generate a map."));
     process.exit(1);
   }
   const map = MutationStore.toMap(entry);
-  const restored = reverse(mutatedCode, map);
+  const secretsMap = entry.secretsMapEntries ? new Map(entry.secretsMapEntries) : void 0;
+  const restored = reverse(mutatedCode, map, secretsMap);
   process.stdout.write(restored);
-  process.stderr.write(chalk7.gray(`
---- Reversed ${map.size} mutations ---
+  const secretsCount = secretsMap?.size ?? 0;
+  const secretsSuffix = secretsCount > 0 ? ` + ${secretsCount} secret(s)` : "";
+  process.stderr.write(chalk10.gray(`
+--- Reversed ${map.size} security tokens${secretsSuffix} ---
 `));
 });
 program.command("audit").description("View the audit log").option("--json", "Output as JSON", false).option("--csv", "Output as CSV", false).option("-l, --limit <number>", "Limit entries", "50").action((opts) => {
@@ -2781,30 +4030,35 @@ program.command("audit").description("View the audit log").option("--json", "Out
 program.command("version").description("Print Pretense CLI version").action(() => {
   console.log(`@pretense/cli v${VERSION}`);
 });
-program.command("status").description("Show current plan, monthly quota, seat usage").action(() => {
-  runStatus();
+program.command("status").description("Show current plan, monthly quota, seat usage").action(async () => {
+  await runStatus();
 });
-program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(() => {
-  runStatus();
+program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(async () => {
+  await runStatus();
 });
-program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(() => {
-  runCredits();
+program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining security token budget").action(async () => {
+  await runCredits();
 });
 program.command("upgrade").description("Compare plans and upgrade to Pro or Enterprise").action(() => {
   runUpgrade();
 });
-program.command("credits").description("Show remaining mutation/scan budget for the current month").action(() => {
-  runCredits();
+program.command("credits").description("Show remaining mutation/scan budget for the current month").action(async () => {
+  await runCredits();
 });
-program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
+program.command("login").description("Save a dashboard API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (prtns_live_... or pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
   const code = runLogin({ key: opts.key });
   if (code !== 0) process.exit(code);
 });
+program.command("logout").description("Remove the saved dashboard API key from ~/.pretense/config.json").option("-y, --yes", "Skip confirmation prompt", false).action(async (opts) => {
+  const code = await runLogout({ assumeYes: opts.yes === true });
+  if (code !== 0) process.exit(code);
+});
+program.addCommand(installCommand());
 function handleFatalError(err) {
   if (err instanceof Error && err.message) {
-    console.error(chalk7.red("Error:"), err.message);
+    console.error(chalk10.red("Error:"), err.message);
   } else {
-    console.error(chalk7.red("An unexpected error occurred."));
+    console.error(chalk10.red("An unexpected error occurred."));
   }
   process.exit(1);
 }