@pretense/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command } from "commander";
-import chalk9 from "chalk";
+import { Command as Command2 } from "commander";
+import chalk10 from "chalk";
 import {
-  readFileSync as readFileSync7,
-  existsSync as existsSync7,
+  readFileSync as readFileSync8,
+  existsSync as existsSync8,
   readdirSync,
   statSync,
   openSync,
@@ -13,7 +13,7 @@ import {
   closeSync
 } from "fs";
 import { readFile, stat as fsStat, open as fsOpen } from "fs/promises";
-import { resolve as resolve2, extname, join as join5, basename } from "path";
+import { resolve as resolve3, extname, join as join6, basename } from "path";
 import os from "os";
 
 // src/types.ts
@@ -901,6 +901,12 @@ function getMutationSalt() {
 function buildSaltedSeed(baseSeed) {
   return `${baseSeed}:${getMutationSalt()}`;
 }
+function effectiveSeedForMutation(userSeed) {
+  if (userSeed === "pretense" || userSeed === "pretest") {
+    return buildSaltedSeed("pretense");
+  }
+  return userSeed;
+}
 
 // src/deterministic-id.ts
 function hash32(str) {
@@ -1517,15 +1523,6 @@ function loadUsage(dir) {
     return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
 }
-function saveUsage(usage, dir) {
-  const configDir = getConfigDir(dir);
-  if (!existsSync3(configDir)) {
-    mkdirSync3(configDir, { recursive: true });
-  }
-  const usagePath = join2(configDir, USAGE_FILE);
-  const checksum = computeUsageChecksum(usage);
-  writeFileSync3(usagePath, JSON.stringify({ ...usage, checksum }, null, 2), "utf-8");
-}
 var MIN_LICENSE_KEY_LENGTH = 40;
 var LICENSE_PAYLOAD_REGEX = /^[a-zA-Z0-9]+$/;
 function isValidLicenseKey(key, prefix) {
@@ -1641,7 +1638,7 @@ function formatText(entries) {
   if (entries.length === 0) return "No audit entries found.";
   const lines = entries.map((e) => {
     const date = new Date(e.timestamp).toLocaleString();
-    return `[${date}] ${e.file} | ${e.identifiersMutated} mutated | ${e.secretsBlocked} secrets blocked | ${e.llmProvider} | ${e.latencyMs}ms`;
+    return `[${date}] ${e.file} | ${e.identifiersMutated} protected | ${e.secretsBlocked} secrets blocked | ${e.llmProvider} | ${e.latencyMs}ms`;
   });
   return lines.join("\n");
 }
@@ -2016,6 +2013,27 @@ function runLogin(opts = {}) {
   return 0;
 }
 
+// src/dashboard-env.ts
+var DASHBOARD_API_KEY_ENVS = ["PRETENSE_API_KEY", "PRETEST_API_KEY"];
+var DASHBOARD_API_URL_ENVS = ["PRETENSE_API_URL", "PRETEST_API_URL"];
+function firstNonEmptyEnv(names) {
+  for (const name of names) {
+    const v = process.env[name]?.trim();
+    if (v) return v;
+  }
+  return "";
+}
+function clearDashboardApiKeyFromProcess() {
+  delete process.env["PRETEST_API_KEY"];
+  delete process.env["PRETENSE_API_KEY"];
+}
+function hasDashboardApiKeyInEnv() {
+  return DASHBOARD_API_KEY_ENVS.some((n) => !!process.env[n]?.trim());
+}
+
+// src/publish-info.ts
+var PUBLISH_PACKAGE_URL = "https://www.npmjs.com/package/@pretense/cli";
+
 // src/backend-client.ts
 function usageSummaryFromValidate(v) {
   return {
@@ -2031,9 +2049,9 @@ function usageSummaryFromValidate(v) {
   };
 }
 var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
-var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
 function getConfiguredApiRoot(rootOverride) {
-  const raw = (rootOverride ?? process.env["PRETENSE_API_URL"] ?? DEFAULT_PRETENSE_API_URL).trim();
+  const raw = (rootOverride?.trim() || firstNonEmptyEnv(DASHBOARD_API_URL_ENVS) || DEFAULT_PRETENSE_API_URL).trim();
   if (!raw) {
     return DEFAULT_PRETENSE_API_URL.replace(/\/$/, "");
   }
@@ -2043,7 +2061,7 @@ function getConfiguredApiRoot(rootOverride) {
   }
   try {
     const u = new URL(normalized);
-    const origin = /^pretense\.ai$/i.test(u.hostname) ? "https://api.pretense.ai" : u.origin;
+    const origin = /^pretense\.ai$/i.test(u.hostname) ? DEFAULT_PRETENSE_API_URL.replace(/\/$/, "") : u.origin;
     const path = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
     return `${origin}${path}`;
   } catch {
@@ -2056,20 +2074,20 @@ function getCliApiUrl(pathWithinCli, rootOverride) {
   return `${root}/api/cli/${tail}`;
 }
 function getApiRequestTimeoutMs() {
-  const raw = process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
+  const raw = process.env["PRETEST_API_TIMEOUT_MS"]?.trim() || process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
   if (!raw || !/^\d+$/.test(raw)) return DEFAULT_REQUEST_TIMEOUT_MS;
   const n = parseInt(raw, 10);
   return Math.min(Math.max(n, 3e3), 12e4);
 }
 function getApiKey() {
-  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
+  const fromEnv = firstNonEmptyEnv(DASHBOARD_API_KEY_ENVS);
   if (fromEnv) return fromEnv;
   const fromFile = loadApiKey();
   if (!fromFile) return null;
   const t = fromFile.trim();
   return t.length > 0 ? t : null;
 }
-function getPretenseApiKey() {
+function getDashboardApiKey() {
   return getApiKey();
 }
 var cachedValidation = null;
@@ -2092,6 +2110,15 @@ function bumpCachedUsageAfterLog(identifiersMutated) {
     );
   }
 }
+function syncCachedUsageFromServer(codeProtectionsUsed, limit) {
+  if (!cachedValidation) return;
+  if (codeProtectionsUsed < cachedValidation.mutationsUsed) return;
+  cachedValidation.mutationsUsed = codeProtectionsUsed;
+  cachedValidation.monthlyMutationLimit = limit;
+  if (limit !== -1) {
+    cachedValidation.mutationsRemaining = Math.max(0, limit - codeProtectionsUsed);
+  }
+}
 function makeBackendReachabilityError(code, message) {
   const err = new Error(message);
   err.code = code;
@@ -2109,7 +2136,7 @@ async function validateKey(opts = {}) {
   const apiKey = getApiKey();
   if (!apiKey) {
     if (enforceReachability) {
-      const err = new Error("Missing Pretense dashboard API key");
+      const err = new Error("Missing dashboard API key");
       err.code = "MISSING_API_KEY";
       cachedValidation = null;
       lastValidationSuccessAt = 0;
@@ -2130,16 +2157,16 @@ async function validateKey(opts = {}) {
       signal: controller.signal
     });
     if (resp.status === 401 || resp.status === 403) {
-      const raw = await resp.json().catch(() => ({}));
-      const msg = typeof raw.message === "string" ? raw.message : "API key rejected by server";
+      const raw2 = await resp.json().catch(() => ({}));
+      const msg = typeof raw2.message === "string" ? raw2.message : "API key rejected by server";
       const err = new Error(msg);
-      err.code = typeof raw.code === "string" ? raw.code : "INVALID_API_KEY";
+      err.code = typeof raw2.code === "string" ? raw2.code : "INVALID_API_KEY";
       cachedValidation = null;
       lastValidationSuccessAt = 0;
       throw err;
     }
     if (!resp.ok) {
-      const msg = `Pretense API returned HTTP ${resp.status} from ${validateUrl}`;
+      const msg = `Dashboard API returned HTTP ${resp.status} from ${validateUrl}`;
       if (enforceReachability) {
         cachedValidation = null;
         lastValidationSuccessAt = 0;
@@ -2147,9 +2174,9 @@ async function validateKey(opts = {}) {
       }
       return null;
     }
-    let data;
+    let raw;
     try {
-      data = await resp.json();
+      raw = await resp.json();
     } catch {
       if (enforceReachability) {
         cachedValidation = null;
@@ -2161,6 +2188,12 @@ async function validateKey(opts = {}) {
       }
       return null;
     }
+    const data = {
+      ...raw,
+      mutationsRemaining: raw["mutationsRemaining"] ?? raw["codeProtectionsRemaining"] ?? -1,
+      mutationsUsed: raw["mutationsUsed"] ?? raw["codeProtectionsUsed"] ?? 0,
+      monthlyMutationLimit: raw["monthlyMutationLimit"] ?? raw["monthlyCodeProtectionLimit"] ?? -1
+    };
     if (typeof data.valid === "boolean" && data.valid === false) {
       const err = new Error("API key is not valid");
       err.code = "INVALID_API_KEY";
@@ -2176,7 +2209,7 @@ async function validateKey(opts = {}) {
       throw err;
     }
     if (enforceReachability) {
-      const msg = err.name === "AbortError" ? `Timed out after ${timeoutMs}ms reaching ${validateUrl} (raise PRETENSE_API_TIMEOUT_MS)` : `Cannot reach Pretense API at ${validateUrl}: ${err.message}`;
+      const msg = err.name === "AbortError" ? `Timed out after ${timeoutMs}ms reaching ${validateUrl} (raise PRETENSE_API_TIMEOUT_MS or PRETEST_API_TIMEOUT_MS)` : `Cannot reach dashboard API at ${validateUrl}: ${err.message}`;
       cachedValidation = null;
       lastValidationSuccessAt = 0;
       throw makeBackendReachabilityError("BACKEND_UNAVAILABLE", msg);
@@ -2205,7 +2238,13 @@ async function fetchUsageSummary(opts = {}) {
       signal: controller.signal
     });
     if (!resp.ok) return null;
-    return await resp.json();
+    const raw = await resp.json();
+    return {
+      ...raw,
+      mutationsUsed: raw["mutationsUsed"] ?? raw["codeProtectionsUsed"] ?? 0,
+      mutationsRemaining: raw["mutationsRemaining"] ?? raw["codeProtectionsRemaining"] ?? -1,
+      monthlyMutationLimit: raw["monthlyMutationLimit"] ?? raw["monthlyCodeProtectionLimit"] ?? -1
+    };
   } catch (err) {
     if (opts.verbose) {
       process.stderr.write(
@@ -2222,27 +2261,91 @@ async function isWithinLimits() {
   const v = getCachedValidation();
   if (!v) return { allowed: true };
   if (v.mutationsRemaining !== -1 && v.mutationsRemaining <= 0) {
-    return {
-      allowed: false,
-      reason: `Monthly mutation limit reached (${v.mutationsUsed}/${v.monthlyMutationLimit}). Upgrade at https://pretense.ai/pricing`
-    };
+    const fresh = await validateKey({ force: true }).catch(() => null);
+    const check = fresh ?? v;
+    if (check.mutationsRemaining !== -1 && check.mutationsRemaining <= 0) {
+      return {
+        allowed: false,
+        reason: `Monthly security token limit reached (${check.mutationsUsed}/${check.monthlyMutationLimit}). See ${PUBLISH_PACKAGE_URL}`
+      };
+    }
+    return { allowed: true };
   }
   return { allowed: true };
 }
 
 // src/log-uploader.ts
-async function uploadLog(event, options) {
+var FLUSH_INTERVAL_MS = 5e3;
+var buffer = [];
+var flushTimer = null;
+function startFlushTimer(verbose) {
+  if (flushTimer !== null) return;
+  flushTimer = setInterval(() => {
+    void flushBuffer(verbose);
+  }, FLUSH_INTERVAL_MS);
+  if (typeof flushTimer.unref === "function") flushTimer.unref();
+}
+function attachExitFlush() {
+  const flush = () => {
+    void flushBuffer(false);
+  };
+  process.once("exit", flush);
+  process.once("SIGINT", () => {
+    flush();
+    process.exit(0);
+  });
+  process.once("SIGTERM", () => {
+    flush();
+    process.exit(0);
+  });
+}
+var exitFlushAttached = false;
+async function flushBuffer(verbose) {
+  if (buffer.length === 0) return;
+  const snapshot = buffer;
+  buffer = [];
+  const last = snapshot[snapshot.length - 1];
+  const { options } = last;
+  let file_count = 0;
+  let identifiers_mutated = 0;
+  let secrets_blocked = 0;
+  let scan_tokens = 0;
+  let mutation_tokens = 0;
+  let read_tokens = 0;
+  let llm_provider = "unknown";
+  let cli_version;
+  for (const { event } of snapshot) {
+    file_count += event.file_count ?? 0;
+    identifiers_mutated += event.identifiers_mutated ?? 0;
+    secrets_blocked += event.secrets_blocked ?? 0;
+    scan_tokens += event.scan_tokens ?? 0;
+    mutation_tokens += event.mutation_tokens ?? 0;
+    read_tokens += event.read_tokens ?? 0;
+    if (event.llm_provider) llm_provider = event.llm_provider;
+    if (event.cli_version) cli_version = event.cli_version;
+  }
   const apiRoot = options.apiUrl?.trim() || void 0;
   const endpoint = getCliApiUrl("log", apiRoot);
-  const { apiKey, verbose = false, timeoutMs = getApiRequestTimeoutMs() } = options;
+  const { apiKey, timeoutMs = getApiRequestTimeoutMs(), onResponse } = options;
   if (!apiKey) return;
   const gitCtx = options.gitContext ?? await collectGitContextCached(options.cwd);
+  const idempotency_key = crypto.randomUUID();
   const body = {
-    ...event,
-    ...gitCtx,
+    file_count,
+    identifiers_mutated,
+    identifiers_code_protected: identifiers_mutated,
+    secrets_blocked,
+    llm_provider,
+    scan_tokens,
+    code_protection_tokens: mutation_tokens,
+    read_tokens,
+    idempotency_key,
+    ...cli_version ? { cli_version } : {},
+    git_remote: gitCtx.git_remote,
     repo_remote_url: gitCtx.git_remote,
     git_branch: gitCtx.git_branch,
-    commit_sha: gitCtx.git_commit_sha
+    commit_sha: gitCtx.git_commit_sha,
+    git_commit_sha: gitCtx.git_commit_sha
   };
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -2256,8 +2359,14 @@ async function uploadLog(event, options) {
       body: JSON.stringify(body),
       signal: controller.signal
     });
-    if (!resp.ok && verbose) {
-      process.stderr.write(`[PRETENSE] log upload HTTP ${resp.status}
+    if (resp.ok) {
+      const data = await resp.json().catch(() => null);
+      if (data && typeof data.codeProtectionsUsed === "number" && typeof data.limit === "number") {
+        onResponse?.(data.codeProtectionsUsed, data.limit);
+      }
+    } else if (verbose) {
+      const detail = await resp.text().catch(() => "");
+      process.stderr.write(`[PRETENSE] log upload HTTP ${resp.status} (batch of ${snapshot.length}): ${detail}
 `);
     }
   } catch (err) {
@@ -2270,6 +2379,15 @@ async function uploadLog(event, options) {
     clearTimeout(timer);
   }
 }
+async function uploadLog(event, options) {
+  if (!options.apiKey) return;
+  buffer.push({ event, options });
+  startFlushTimer(options.verbose ?? false);
+  if (!exitFlushAttached) {
+    exitFlushAttached = true;
+    attachExitFlush();
+  }
+}
 
 // src/start-client-instructions.ts
 import chalk2 from "chalk";
@@ -2328,6 +2446,10 @@ import { fileURLToPath } from "url";
 var cached = null;
 function getCliSemver() {
   if (cached !== null) return cached;
+  if (typeof __BINARY_VERSION__ !== "undefined" && __BINARY_VERSION__) {
+    cached = __BINARY_VERSION__;
+    return cached;
+  }
   try {
     const url = new URL("../package.json", import.meta.url);
     const raw = readFileSync6(fileURLToPath(url), "utf-8");
@@ -2349,7 +2471,7 @@ function attachDashboardLogoutWatcher(enabled) {
     if (!fk) {
       if (dashboardSavedCredentialsRevoked) return;
       dashboardSavedCredentialsRevoked = true;
-      delete process.env["PRETENSE_API_KEY"];
+      clearDashboardApiKeyFromProcess();
       clearValidationCache();
       try {
         process.stderr.write(
@@ -2480,7 +2602,7 @@ function printUpgradeNudge(reason) {
   process.stdout.write(
     `
 \x1B[33m[PRETENSE] ${reason}\x1B[0m
-\x1B[33m[PRETENSE] Upgrade to Pro: https://pretense.ai/pricing\x1B[0m
+\x1B[33m[PRETENSE] Upgrade to Pro: ${PUBLISH_PACKAGE_URL}\x1B[0m
 
 `
   );
@@ -2505,7 +2627,7 @@ function createProxy(opts = {}) {
         "POST /*": "Proxy to upstream LLM API (Anthropic, OpenAI, Google auto-detected)"
       },
       languages: ["TypeScript", "JavaScript", "Python", "Go", "Java", "C#", "Ruby", "Rust"],
-      docs: "https://pretense.ai/docs"
+      docs: PUBLISH_PACKAGE_URL
     })
   );
   app.get(
@@ -2564,19 +2686,19 @@ function createProxy(opts = {}) {
         {
           error: {
             type: "pretense_session_logged_out",
-            message: "Saved Pretense dashboard credentials were removed (for example pretense logout). Run pretense login, then restart pretense start. If you started the proxy with PRETENSE_API_KEY in this shell, stop it (Ctrl+C) and start again after logout."
+            message: "Saved dashboard credentials were removed (for example pretense logout). Run pretense login, then restart pretense start. If you started the proxy with a dashboard API key in this shell, stop it (Ctrl+C) and start again after logout."
           }
         },
         401
       );
     }
-    const pretenseDashboardKey = getPretenseApiKey();
-    if (!pretenseDashboardKey) {
+    const dashboardApiKey = getDashboardApiKey();
+    if (!dashboardApiKey) {
       return c.json(
         {
           error: {
             type: "pretense_dashboard_key_required",
-            message: "Configure your Pretense dashboard API key: run `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
+            message: "Configure your dashboard API key: run `pretense login --key prtns_live_...` or set PRETENSE_API_KEY."
           }
         },
         401
@@ -2622,26 +2744,13 @@ function createProxy(opts = {}) {
       getCachedValidation()?.plan,
       detectTier()
     );
-    const { monthlyMutations } = getTierLimits(tier);
-    const usage = loadUsage();
-    if (tier === "free" && usage.mutations >= monthlyMutations) {
-      return c.json(
-        {
-          error: {
-            type: "pretense_rate_limit",
-            message: `Monthly mutation limit reached (${monthlyMutations}/month). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
-          }
-        },
-        429
-      );
-    }
     const backendLimits = await isWithinLimits();
     if (!backendLimits.allowed) {
       return c.json(
         {
           error: {
             type: "pretense_rate_limit",
-            message: backendLimits.reason ?? "Mutation limit exceeded."
+            message: backendLimits.reason ?? "Security token limit exceeded."
           }
         },
         429
@@ -2706,10 +2815,9 @@ function createProxy(opts = {}) {
       }
       return replaceCodeBlocks(text, blocks, mutatedBlocks);
     });
-    usage.mutations += tokensMutated;
-    saveUsage(usage);
     const remoteLogDisabled = process.env["PRETENSE_DISABLE_REMOTE_LOG"] === "1";
-    if (pretenseDashboardKey && !remoteLogDisabled) {
+    if (dashboardApiKey && !remoteLogDisabled) {
+      bumpCachedUsageAfterLog(tokensMutated);
       void uploadLog(
         {
           file_count: 0,
@@ -2718,16 +2826,26 @@ function createProxy(opts = {}) {
           llm_provider: provider,
           cli_version: getCliSemver()
         },
-        { apiKey: pretenseDashboardKey, verbose }
+        {
+          apiKey: dashboardApiKey,
+          verbose,
+          onResponse: (codeProtectionsUsed, limit) => {
+            syncCachedUsageFromServer(codeProtectionsUsed, limit);
+          }
+        }
       );
-      bumpCachedUsageAfterLog(tokensMutated);
     }
-    const warningThreshold = Math.floor(monthlyMutations * 0.8);
-    if (tier === "free" && usage.mutations >= warningThreshold && usage.mutations - tokensMutated < warningThreshold) {
-      printUpgradeNudge(`${usage.mutations}/${monthlyMutations} monthly mutations used. Running low!`);
+    const warnCache = getCachedValidation();
+    if (warnCache && warnCache.monthlyMutationLimit !== -1 && tier === "free") {
+      const limit = warnCache.monthlyMutationLimit;
+      const used = warnCache.mutationsUsed;
+      const warningThreshold = Math.floor(limit * 0.8);
+      if (used >= warningThreshold && used - tokensMutated < warningThreshold) {
+        printUpgradeNudge(`${used}/${limit} monthly security tokens used. Running low!`);
+      }
     }
     if (tier === "free" && daysSinceFirstUse() >= 7) {
-      printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited mutations, 90-day audit, Slack alerts.");
+      printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited security tokens, 90-day audit, Slack alerts.");
     }
     const entry = {
       id: requestId,
@@ -2744,7 +2862,7 @@ function createProxy(opts = {}) {
       createAuditEntry(requestId, "proxy-request", tokensMutated, blockedSecrets.length, provider, latencyMs)
     );
     if (verbose && tokensMutated > 0) {
-      process.stdout.write(`[PRETENSE] ${tokensMutated} tokens mutated for request ${requestId}
+      process.stdout.write(`[PRETENSE] ${tokensMutated} security tokens protected for request ${requestId}
 `);
     }
     const headers = {};
@@ -2784,12 +2902,12 @@ function createProxy(opts = {}) {
       }
       const decoder = new TextDecoder();
       const encoder = new TextEncoder();
-      let buffer = "";
+      let buffer2 = "";
       const transform = new TransformStream({
         transform(chunk, controller) {
-          buffer += decoder.decode(chunk, { stream: true });
-          const lines = buffer.split("\n");
-          buffer = lines.pop() ?? "";
+          buffer2 += decoder.decode(chunk, { stream: true });
+          const lines = buffer2.split("\n");
+          buffer2 = lines.pop() ?? "";
           for (const line of lines) {
             if (line.startsWith("data: ") && line !== "data: [DONE]") {
               try {
@@ -2806,8 +2924,8 @@ function createProxy(opts = {}) {
           }
         },
         flush(controller) {
-          if (buffer.length > 0) {
-            controller.enqueue(encoder.encode(buffer));
+          if (buffer2.length > 0) {
+            controller.enqueue(encoder.encode(buffer2));
           }
         }
       });
@@ -2851,9 +2969,9 @@ function createProxy(opts = {}) {
   return app;
 }
 function isPortAvailable(port) {
-  return new Promise((resolve3) => {
-    const tester = createServer().once("error", () => resolve3(false)).once("listening", () => {
-      tester.once("close", () => resolve3(true)).close();
+  return new Promise((resolve4) => {
+    const tester = createServer().once("error", () => resolve4(false)).once("listening", () => {
+      tester.once("close", () => resolve4(true)).close();
     }).listen(port, "127.0.0.1");
   });
 }
@@ -2871,12 +2989,12 @@ function startProxy(opts = {}) {
   const requestedPort = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
   const app = createProxy(opts);
   void (async () => {
-    const pretenseDashboardKeyFromEnvAtLaunch = !!process.env["PRETENSE_API_KEY"]?.trim();
-    const dashboardKey = getPretenseApiKey();
+    const dashboardKeyFromEnvAtLaunch = hasDashboardApiKeyInEnv();
+    const dashboardKey = getDashboardApiKey();
     if (!dashboardKey || !isValidKeyShape(dashboardKey)) {
       process.stderr.write(
         `\x1B[31m[PRETENSE] API key required or invalid shape. Run \`pretense login --key prtns_live_...\`\x1B[0m
-\x1B[31m[PRETENSE] or set PRETENSE_API_KEY. Get a key at https://pretense.ai/dashboard/settings/api-keys\x1B[0m
+\x1B[31m[PRETENSE] or set PRETENSE_API_KEY. See ${PUBLISH_PACKAGE_URL}\x1B[0m
 `
       );
       process.exit(1);
@@ -2899,7 +3017,7 @@ function startProxy(opts = {}) {
         const plan = validation.plan ?? "FREE";
         const remaining = validation.mutationsRemaining === -1 ? "unlimited" : String(validation.mutationsRemaining);
         process.stdout.write(
-          `\x1B[32m[PRETENSE] Key validated: ${plan} plan` + (validation.organizationName ? ` (${validation.organizationName})` : "") + ` \u2014 ${remaining} mutations remaining\x1B[0m
+          `\x1B[32m[PRETENSE] Key validated: ${plan} plan` + (validation.organizationName ? ` (${validation.organizationName})` : "") + ` \u2014 ${remaining} security tokens remaining\x1B[0m
 `
         );
         break;
@@ -2909,7 +3027,7 @@ function startProxy(opts = {}) {
         if (code === "BACKEND_UNAVAILABLE" || code === "AUTH_BACKEND_REJECTED") {
           process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
 `);
-          process.stderr.write(`\x1B[31m[PRETENSE] Fix network or set PRETENSE_API_URL if using a custom API.\x1B[0m
+          process.stderr.write(`\x1B[31m[PRETENSE] Fix network or set PRETENSE_API_URL (or PRETEST_API_URL) if using a custom API.\x1B[0m
 `);
           process.exit(1);
         }
@@ -2925,7 +3043,7 @@ function startProxy(opts = {}) {
           process.stderr.write(`\x1B[31m[PRETENSE] ${msg}\x1B[0m
 `);
           process.stderr.write(
-            `\x1B[33m[PRETENSE] Enter your Pretense dashboard API key and press Enter (Ctrl+C to quit).\x1B[0m
+            `\x1B[33m[PRETENSE] Enter your dashboard API key and press Enter (Ctrl+C to quit).\x1B[0m
 `
           );
           let entered = null;
@@ -2938,7 +3056,7 @@ function startProxy(opts = {}) {
             }
             if (isValidKeyShape(entered)) break;
             process.stderr.write(
-              `\x1B[31m[PRETENSE] That does not look like a Pretense dashboard key (expect prtns_live_\u2026 or pk_live_\u2026).\x1B[0m
+              `\x1B[31m[PRETENSE] That does not look like a dashboard key (expect prtns_live_\u2026 or pk_live_\u2026).\x1B[0m
 `
             );
           }
@@ -2962,7 +3080,7 @@ function startProxy(opts = {}) {
         process.exit(1);
       }
     }
-    attachDashboardLogoutWatcher(!pretenseDashboardKeyFromEnvAtLaunch);
+    attachDashboardLogoutWatcher(!dashboardKeyFromEnvAtLaunch);
     const bannerTier = tierFromDashboardPlan(
       getCachedValidation()?.plan,
       detectTier()
@@ -3007,7 +3125,7 @@ function startProxy(opts = {}) {
 `);
       setInterval(() => {
         if (dashboardSavedCredentialsRevoked) return;
-        if (!getPretenseApiKey()) return;
+        if (!getDashboardApiKey()) return;
         void validateKey({
           force: true,
           verbose: opts.verbose,
@@ -3031,39 +3149,43 @@ var PLAN_LIMITS = {
     pricePerMonth: "$99/seat/month"
   }
 };
-function getPlanLimits(tier) {
-  return PLAN_LIMITS[tier];
-}
 function fmt(n) {
-  if (!Number.isFinite(n)) return "unlimited";
+  if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
 }
 function printTokenFooter(filesScanned, mutationsMade) {
-  const tier = detectTier();
-  const limits = getPlanLimits(tier);
-  const usage = loadUsage();
-  if (tier === "enterprise") {
+  const cached2 = getCachedValidation();
+  if (!cached2) {
+    process.stderr.write(chalk3.gray(`
+  ${filesScanned} files, ${mutationsMade} security tokens
+
+`));
+    return;
+  }
+  const plan = cached2.plan;
+  if (plan === "ENTERPRISE") {
     process.stderr.write(
       chalk3.gray(`
-  ${filesScanned} files, ${mutationsMade} mutations  \xB7  Plan: Enterprise (unlimited)
+  ${filesScanned} files, ${mutationsMade} security tokens  \xB7  Plan: Enterprise (unlimited)
 
 `)
     );
     return;
   }
-  const used = usage.mutations;
-  const cap = limits.monthlyMutations;
-  const pct = cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
-  const usageStr = pct >= 80 ? chalk3.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk3.gray(`${fmt(used)} / ${fmt(cap)}`);
+  const used = cached2.mutationsUsed;
+  const cap = cached2.monthlyMutationLimit;
+  const unlimited = cap === -1 || !Number.isFinite(cap);
+  const pct = !unlimited && cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
+  const usageStr = unlimited ? chalk3.gray(`${fmt(used)} / unlimited`) : pct >= 80 ? chalk3.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk3.gray(`${fmt(used)} / ${fmt(cap)}`);
   process.stderr.write(
     `
-  ${chalk3.cyan(filesScanned + " files")}, ${chalk3.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk3.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
+  ${chalk3.cyan(filesScanned + " files")}, ${chalk3.cyan(mutationsMade + " security tokens")}  \xB7  Plan: ${chalk3.bold(plan)}  \xB7  Security tokens this month: ${usageStr}${!unlimited ? ` (${pct}%)` : ""}
 `
   );
-  if (tier === "free") {
+  if (plan === "FREE") {
     if (pct >= 80) {
       process.stderr.write(
-        chalk3.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk3.bold("pretense upgrade")}
+        chalk3.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk3.bold(PUBLISH_PACKAGE_URL)}
 
 `)
       );
@@ -3116,11 +3238,6 @@ function printBanner() {
 
 // src/commands/status.ts
 import chalk5 from "chalk";
-var PLAN_LABEL = {
-  free: "Free",
-  pro: "Pro",
-  enterprise: "Enterprise"
-};
 function fmt2(n) {
   if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
@@ -3135,50 +3252,36 @@ async function runStatus() {
   }
   if (remote) {
     const plan = remote.plan;
-    const tierBadge2 = plan === "ENTERPRISE" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : plan === "PRO" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
-    const lines2 = [];
-    lines2.push("");
-    lines2.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge2}  ${chalk5.green("(synced)")}`);
-    lines2.push("");
-    lines2.push(`  Plan:        ${chalk5.bold(plan)}`);
-    lines2.push(`  Mutations:   ${fmt2(remote.mutationsUsed)} / ${fmt2(remote.monthlyMutationLimit)} this month`);
-    lines2.push(`  Remaining:   ${fmt2(remote.mutationsRemaining)}`);
-    lines2.push(`  Requests:    ${fmt2(remote.requestsThisPeriod)} this period`);
-    lines2.push(`  Secrets:     ${fmt2(remote.secretsBlockedThisPeriod)} blocked`);
-    lines2.push(`  Key status:  ${remote.keyStatus === "active" ? chalk5.green("active") : chalk5.red("revoked")}`);
-    lines2.push(`  Resets at:   ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    const tierBadge = plan === "ENTERPRISE" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : plan === "PRO" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
+    const lines = [];
+    lines.push("");
+    lines.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge}  ${chalk5.green("(synced)")}`);
+    lines.push("");
+    lines.push(`  Plan:        ${chalk5.bold(plan)}`);
+    lines.push(`  Security tokens:${fmt2(remote.mutationsUsed)} / ${fmt2(remote.monthlyMutationLimit)} this month`);
+    lines.push(`  Remaining:   ${fmt2(remote.mutationsRemaining)}`);
+    lines.push(`  Requests:    ${fmt2(remote.requestsThisPeriod)} this period`);
+    lines.push(`  Secrets:     ${fmt2(remote.secretsBlockedThisPeriod)} blocked`);
+    lines.push(`  Key status:  ${remote.keyStatus === "active" ? chalk5.green("active") : chalk5.red("revoked")}`);
+    lines.push(`  Resets at:   ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
     if (remote.keyExpiresAt) {
-      lines2.push(`  Key expires: ${new Date(remote.keyExpiresAt).toLocaleDateString()}`);
+      lines.push(`  Key expires: ${new Date(remote.keyExpiresAt).toLocaleDateString()}`);
     }
-    lines2.push("");
+    lines.push("");
     if (plan === "FREE") {
-      lines2.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
-      lines2.push("");
+      lines.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
+      lines.push("");
     }
-    process.stdout.write(lines2.join("\n") + "\n");
+    process.stdout.write(lines.join("\n") + "\n");
     return;
   }
-  const tier = detectTier();
-  const planLimits = getPlanLimits(tier);
-  const tierLimits = getTierLimits(tier);
-  const usage = loadUsage();
-  const tierBadge = tier === "enterprise" ? chalk5.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk5.bgBlue.white.bold(" PRO ") : chalk5.bgGray.white.bold(" FREE ");
-  const lines = [];
-  lines.push("");
-  lines.push(`${chalk5.cyan("Pretense")} ${chalk5.gray(`v${getCliSemver()}`)}  ${tierBadge}  ${chalk5.yellow("(offline)")}`);
-  lines.push("");
-  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL[tier])} ${chalk5.gray("(" + planLimits.pricePerMonth + ")")}`);
-  lines.push(`  Mutations:   ${fmt2(usage.mutations)} / ${fmt2(planLimits.monthlyMutations)} this month`);
-  lines.push(`  Scans:       0 / ${fmt2(planLimits.monthlyScans)} this month`);
-  lines.push(`  Seats:       1 / ${fmt2(planLimits.seats)}`);
-  lines.push(`  Audit log:   ${Number.isFinite(tierLimits.auditRetentionDays) ? `${tierLimits.auditRetentionDays} days` : "unlimited"}`);
-  lines.push("");
-  if (tier === "free") {
-    lines.push(`  ${chalk5.gray("Upgrade:")}  ${chalk5.bold("pretense upgrade")}`);
-    lines.push(`  ${chalk5.gray("Credits:")}  ${chalk5.bold("pretense credits")}`);
-    lines.push("");
-  }
-  process.stdout.write(lines.join("\n") + "\n");
+  process.stderr.write(
+    chalk5.yellow(`
+  [pretense] Could not reach server \u2014 usage data unavailable.
+`) + chalk5.gray(`  Check your connection or run \`pretense login\` if your key has changed.
+
+`)
+  );
 }
 
 // src/commands/upgrade.ts
@@ -3214,11 +3317,6 @@ function runUpgrade() {
 
 // src/commands/credits.ts
 import chalk7 from "chalk";
-var PLAN_LABEL2 = {
-  free: "Free",
-  pro: "Pro",
-  enterprise: "Enterprise"
-};
 function fmt3(n) {
   if (n === -1 || !Number.isFinite(n)) return "unlimited";
   return n.toLocaleString("en-US");
@@ -3240,57 +3338,38 @@ async function runCredits() {
     }
   }
   if (remote) {
-    const used2 = remote.mutationsUsed;
-    const cap2 = remote.monthlyMutationLimit;
-    const remaining2 = remote.mutationsRemaining;
-    const pct2 = cap2 > 0 && cap2 !== -1 ? Math.round(used2 / cap2 * 100) : 0;
-    const lines2 = [];
-    lines2.push("");
-    lines2.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.green("(synced)"));
-    lines2.push("");
-    lines2.push(`  Plan:        ${chalk7.bold(remote.plan)}`);
-    lines2.push(`  Resets:      ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
-    lines2.push("");
-    lines2.push(`  Mutations:   ${progressBar(used2, cap2)}  ${fmt3(used2)} / ${fmt3(cap2)}`);
-    lines2.push(`  Used:        ${pct2}%`);
-    lines2.push(`  Remaining:   ${fmt3(remaining2)}`);
-    lines2.push("");
-    if (remote.plan === "FREE" && cap2 !== -1 && used2 >= cap2 * 0.8) {
-      lines2.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
-      lines2.push("");
+    const used = remote.mutationsUsed;
+    const cap = remote.monthlyMutationLimit;
+    const remaining = remote.mutationsRemaining;
+    const pct = cap > 0 && cap !== -1 ? Math.round(used / cap * 100) : 0;
+    const lines = [];
+    lines.push("");
+    lines.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.green("(synced)"));
+    lines.push("");
+    lines.push(`  Plan:        ${chalk7.bold(remote.plan)}`);
+    lines.push(`  Resets:      ${new Date(remote.periodResetsAt).toLocaleDateString()}`);
+    lines.push("");
+    lines.push(`  Security tokens:${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
+    lines.push(`  Used:        ${pct}%`);
+    lines.push(`  Remaining:   ${fmt3(remaining)}`);
+    lines.push("");
+    if (remote.plan === "FREE" && cap !== -1 && used >= cap * 0.8) {
+      lines.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+      lines.push("");
     } else if (remote.plan === "FREE") {
-      lines2.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
-      lines2.push("");
+      lines.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+      lines.push("");
     }
-    process.stdout.write(lines2.join("\n") + "\n");
+    process.stdout.write(lines.join("\n") + "\n");
     return;
   }
-  const tier = detectTier();
-  const limits = getPlanLimits(tier);
-  const usage = loadUsage();
-  const used = usage.mutations;
-  const cap = limits.monthlyMutations;
-  const remaining = Number.isFinite(cap) ? Math.max(0, cap - used) : Number.POSITIVE_INFINITY;
-  const pct = Number.isFinite(cap) && cap > 0 ? Math.round(used / cap * 100) : 0;
-  const lines = [];
-  lines.push("");
-  lines.push(chalk7.cyan.bold("  Pretense Credits") + "  " + chalk7.yellow("(offline)"));
-  lines.push("");
-  lines.push(`  Plan:        ${chalk7.bold(PLAN_LABEL2[tier])}`);
-  lines.push(`  Month:       ${usage.month}`);
-  lines.push("");
-  lines.push(`  Mutations:   ${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
-  lines.push(`  Used:        ${pct}%`);
-  lines.push(`  Remaining:   ${fmt3(remaining)}`);
-  lines.push("");
-  if (tier === "free" && Number.isFinite(cap) && used >= cap * 0.8) {
-    lines.push(chalk7.yellow("  Warning: Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
-    lines.push("");
-  } else if (tier === "free") {
-    lines.push(chalk7.gray("  Tip: Run 'pretense upgrade' to compare plans."));
-    lines.push("");
-  }
-  process.stdout.write(lines.join("\n") + "\n");
+  process.stderr.write(
+    chalk7.yellow(`
+  [pretense] Could not reach server \u2014 usage data unavailable.
+`) + chalk7.gray(`  Check your connection or run \`pretense login\` if your key has changed.
+
+`)
+  );
 }
 
 // src/commands/logout.ts
@@ -3340,6 +3419,100 @@ async function runLogout(opts = {}) {
   return 0;
 }
 
+// src/commands/install.ts
+import { Command } from "commander";
+import chalk9 from "chalk";
+import {
+  existsSync as existsSync7,
+  writeFileSync as writeFileSync5,
+  chmodSync as chmodSync2,
+  readFileSync as readFileSync7,
+  mkdirSync as mkdirSync6
+} from "fs";
+import { join as join5, resolve as resolve2 } from "path";
+var HOOK_SCRIPTS = {
+  "pre-commit": `#!/bin/sh
+# Pretense AI Firewall \u2014 pre-commit hook
+# Installed by: pretense install --mode pre-commit
+
+pretense scan pre-commit
+exit $?
+`,
+  "pre-push": `#!/bin/sh
+# Pretense AI Firewall \u2014 pre-push hook
+# Installed by: pretense install --mode pre-push
+
+pretense scan pre-push
+exit $?
+`
+};
+var VALID_MODES = ["pre-commit", "pre-push"];
+function findGitDir(cwd) {
+  const gitDir = join5(cwd, ".git");
+  if (existsSync7(gitDir)) return gitDir;
+  return null;
+}
+function installHook(hooksDir, mode, force) {
+  const hookPath = join5(hooksDir, mode);
+  const script = HOOK_SCRIPTS[mode];
+  if (existsSync7(hookPath) && !force) {
+    const existing = readFileSync7(hookPath, "utf-8");
+    if (existing.includes("Pretense AI Firewall")) {
+      return { installed: false, path: hookPath, skipped: true };
+    }
+    return { installed: false, path: hookPath };
+  }
+  writeFileSync5(hookPath, script, "utf-8");
+  chmodSync2(hookPath, 493);
+  return { installed: true, path: hookPath };
+}
+function installCommand() {
+  return new Command("install").description("Install Pretense git hooks (pre-commit and/or pre-push)").option("-m, --mode <mode>", "Hook mode: pre-commit, pre-push (omit to install both)").option("-f, --force", "Overwrite existing hooks without prompting", false).option("-d, --dir <path>", "Project directory (defaults to cwd)", ".").action((opts) => {
+    const dir = resolve2(opts.dir);
+    const force = opts.force;
+    const modeArg = opts.mode;
+    if (modeArg && !VALID_MODES.includes(modeArg)) {
+      console.error(
+        chalk9.red(`
+  Error: Invalid mode "${modeArg}". Use: ${VALID_MODES.join(", ")}
+`)
+      );
+      process.exit(1);
+    }
+    const modes = modeArg ? [modeArg] : [...VALID_MODES];
+    const gitDir = findGitDir(dir);
+    if (!gitDir) {
+      console.error(
+        chalk9.red(`
+  Error: No .git directory found in ${dir}
+  Run this command from a git repository root.
+`)
+      );
+      process.exit(1);
+    }
+    const hooksDir = join5(gitDir, "hooks");
+    mkdirSync6(hooksDir, { recursive: true });
+    console.log(chalk9.cyan("\n  Pretense hook installer\n"));
+    let hasError = false;
+    for (const mode of modes) {
+      const result = installHook(hooksDir, mode, force);
+      if (result.installed) {
+        console.log(chalk9.green(`  Installed ${mode} hook at ${result.path}`));
+      } else if (result.skipped) {
+        console.log(chalk9.dim(`  Pretense ${mode} hook already installed at ${result.path}`));
+      } else {
+        console.error(chalk9.yellow(`  Hook already exists at ${result.path}. Use --force to overwrite.`));
+        hasError = true;
+      }
+    }
+    if (hasError) {
+      console.log("");
+      process.exit(1);
+    }
+    console.log(chalk9.bold.green("\n  Git hooks installed successfully.\n"));
+  });
+}
+
 // src/index.ts
 {
   const major = parseInt(process.versions.node.split(".")[0], 10);
@@ -3476,8 +3649,8 @@ function validateLanguage(lang) {
   return SUPPORTED_LANGUAGES.includes(resolved) ? resolved : null;
 }
 function collectFiles(target) {
-  const abs = resolve2(target);
-  if (!existsSync7(abs)) {
+  const abs = resolve3(target);
+  if (!existsSync8(abs)) {
     return [];
   }
   const stat = statSync(abs);
@@ -3495,13 +3668,14 @@ function collectFiles(target) {
       ".git",
       "dist",
       "build",
+      ".pretest",
       ".pretense",
       ".next",
       "__pycache__",
       ".Trash"
     ]);
     for (const entry of entries) {
-      const fullPath = join5(dir, entry.name);
+      const fullPath = join6(dir, entry.name);
       if (entry.isDirectory()) {
         if (skipDirs.has(entry.name)) continue;
         walk(fullPath);
@@ -3513,13 +3687,13 @@ function collectFiles(target) {
   walk(abs);
   return files;
 }
-var program = new Command();
+var program = new Command2();
 program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION).hook("preAction", () => {
   printBanner();
 });
 program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
-  const dir = resolve2(opts.dir);
-  console.log(chalk9.cyan("Initializing Pretense in"), chalk9.bold(dir));
+  const dir = resolve3(opts.dir);
+  console.log(chalk10.cyan("Initializing Pretense in"), chalk10.bold(dir));
   const configDir = initConfig(dir);
   const files = collectFiles(dir);
   const langCounts = {};
@@ -3527,21 +3701,21 @@ program.command("init").description("Initialize .pretense/ config in current dir
     const lang = langFromExt(f);
     langCounts[lang] = (langCounts[lang] ?? 0) + 1;
   }
-  console.log(chalk9.green("\n  .pretense/ created at"), chalk9.bold(configDir));
-  console.log(chalk9.gray(`
+  console.log(chalk10.green("\n  .pretense/ created at"), chalk10.bold(configDir));
+  console.log(chalk10.gray(`
   Scanned ${files.length} source files:`));
   for (const [lang, count] of Object.entries(langCounts)) {
-    console.log(chalk9.gray(`    ${lang}: ${count} files`));
+    console.log(chalk10.gray(`    ${lang}: ${count} files`));
   }
-  console.log(chalk9.cyan("\n  Next: run"), chalk9.bold("pretense start"), chalk9.cyan("to launch the proxy"));
+  console.log(chalk10.cyan("\n  Next: run"), chalk10.bold("pretense start"), chalk10.cyan("to launch the proxy"));
   console.log();
 });
 program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action(async (opts) => {
   const config = loadConfig();
   const port = validatePort(opts.port);
   if (port === null) {
-    console.error(chalk9.red("Error: Invalid port number:"), chalk9.bold(opts.port));
-    console.error(chalk9.gray("Port must be an integer between 1 and 65535."));
+    console.error(chalk10.red("Error: Invalid port number:"), chalk10.bold(opts.port));
+    console.error(chalk10.gray("Port must be an integer between 1 and 65535."));
     process.exit(1);
   }
   await ensureDashboardKeyForStart();
@@ -3654,30 +3828,30 @@ function parseSizeOption(value) {
   return Math.floor(n * mult);
 }
 program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).option("--max-file-size <size>", "Skip files larger than this (e.g. 10mb, 500k)", "10mb").option("--concurrency <n>", "Max files scanned in parallel", String(SCAN_CONCURRENCY)).option("--quiet", "Suppress progress output", false).action(async (target, opts) => {
-  const absTarget = resolve2(target);
-  if (!existsSync7(absTarget)) {
-    console.error(chalk9.red("Error: Path not found:"), chalk9.bold(absTarget));
+  const absTarget = resolve3(target);
+  if (!existsSync8(absTarget)) {
+    console.error(chalk10.red("Error: Path not found:"), chalk10.bold(absTarget));
     process.exit(1);
   }
   const maxFileSize = parseSizeOption(opts.maxFileSize);
   if (maxFileSize === null) {
-    console.error(chalk9.red("Error: Invalid --max-file-size value:"), chalk9.bold(opts.maxFileSize));
-    console.error(chalk9.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
+    console.error(chalk10.red("Error: Invalid --max-file-size value:"), chalk10.bold(opts.maxFileSize));
+    console.error(chalk10.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
     process.exit(1);
   }
   const concurrency = Math.max(1, parseInt(opts.concurrency, 10) || SCAN_CONCURRENCY);
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk9.gray(`Discovering files in ${absTarget}...
+    process.stderr.write(chalk10.gray(`Discovering files in ${absTarget}...
 `));
   }
   const files = collectFiles(target);
   if (files.length === 0) {
-    console.error(chalk9.red("Error: No source files found at"), chalk9.bold(absTarget));
-    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk10.red("Error: No source files found at"), chalk10.bold(absTarget));
+    console.error(chalk10.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
   if (!opts.quiet && !opts.json) {
-    process.stderr.write(chalk9.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
+    process.stderr.write(chalk10.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
 `));
   }
   const startedAt = Date.now();
@@ -3703,34 +3877,34 @@ program.command("scan <target>").description("Scan file or directory for identif
       interrupted
     }, null, 2));
   } else {
-    console.log(chalk9.cyan("\nPretense Scan Results\n"));
+    console.log(chalk10.cyan("\nPretense Scan Results\n"));
     for (const r of allResults) {
       if (r.skipped) {
         if (r.skipped === "too-large") {
           const mb = ((r.sizeBytes ?? 0) / 1024 / 1024).toFixed(1);
-          console.log(chalk9.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
+          console.log(chalk10.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
         }
         continue;
       }
-      const secretBadge = r.secrets > 0 ? chalk9.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      const secretBadge = r.secrets > 0 ? chalk10.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
       const showRow = r.secrets > 0 || !opts.secretsOnly && r.identifiers > 0;
       if (!showRow) continue;
       console.log(
-        chalk9.gray("  ") + chalk9.white(r.file) + chalk9.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+        chalk10.gray("  ") + chalk10.white(r.file) + chalk10.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
       );
       if (r.secrets > 0) {
         for (const t of r.secretTypes) {
-          console.log(chalk9.red(`    ! ${t}`));
+          console.log(chalk10.red(`    ! ${t}`));
         }
       }
     }
-    const skipNote = skippedLarge + skippedBinary > 0 ? chalk9.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
+    const skipNote = skippedLarge + skippedBinary > 0 ? chalk10.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
     console.log(
-      chalk9.gray(`
-  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk9.red(`${totalSecrets} secrets found`) : chalk9.green("0 secrets")) + skipNote
+      chalk10.gray(`
+  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk10.red(`${totalSecrets} secrets found`) : chalk10.green("0 secrets")) + skipNote
     );
     if (interrupted) {
-      console.log(chalk9.yellow("\n  Interrupted \u2014 partial results shown above."));
+      console.log(chalk10.yellow("\n  Interrupted \u2014 partial results shown above."));
     }
     console.log();
   }
@@ -3745,34 +3919,34 @@ program.command("scan <target>").description("Scan file or directory for identif
   }
 });
 program.command("mutate <file>").description("Mutate identifiers for stdout (scanner redacts secrets/PII in the source first)").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
-  const absPath = resolve2(file);
-  if (!existsSync7(absPath)) {
-    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
+  const absPath = resolve3(file);
+  if (!existsSync8(absPath)) {
+    console.error(chalk10.red("Error: File not found:"), chalk10.bold(absPath));
     process.exit(1);
   }
   if (opts.language) {
     const validLang = validateLanguage(opts.language);
     if (!validLang) {
-      console.error(chalk9.red("Error: Unsupported language:"), chalk9.bold(opts.language));
-      console.error(chalk9.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
+      console.error(chalk10.red("Error: Unsupported language:"), chalk10.bold(opts.language));
+      console.error(chalk10.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
       process.exit(1);
     }
   }
   if (!SUPPORTED_EXTENSIONS.has(extname(absPath).toLowerCase()) && isBinaryFile(absPath)) {
-    console.error(chalk9.red("Error: Not a supported source file:"), chalk9.bold(absPath));
-    console.error(chalk9.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    console.error(chalk10.red("Error: Not a supported source file:"), chalk10.bold(absPath));
+    console.error(chalk10.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
-  const code = readFileSync7(absPath, "utf-8");
+  const code = readFileSync8(absPath, "utf-8");
   const lang = opts.language ? validateLanguage(opts.language) : langFromExt(absPath);
   const secretScan = scan2(code);
-  const effectiveSeed = opts.seed === "pretense" ? buildSaltedSeed(opts.seed) : opts.seed;
+  const effectiveSeed = effectiveSeedForMutation(opts.seed);
   const { redactedCode: redacted, secretsMap } = applyRedactionsTracked(code, secretScan.matches, effectiveSeed);
   const secretsRedacted = secretsMap.size;
   const result = mutate(redacted, lang, opts.seed);
   if (opts.save) {
     const configDir = getConfigDir();
-    const store = new MutationStore(join5(configDir, "mutation-map.json"));
+    const store = new MutationStore(join6(configDir, "mutation-map.json"));
     store.load();
     store.save({
       id: absPath,
@@ -3783,7 +3957,7 @@ program.command("mutate <file>").description("Mutate identifiers for stdout (sca
       language: lang
     });
     store.persist();
-    process.stderr.write(chalk9.gray(`Mutation map saved to ${configDir}/mutation-map.json
+    process.stderr.write(chalk10.gray(`Mutation map saved to ${configDir}/mutation-map.json
 `));
   }
   if (opts.json) {
@@ -3798,27 +3972,27 @@ program.command("mutate <file>").description("Mutate identifiers for stdout (sca
     process.stdout.write(result.mutatedCode);
     if (secretsRedacted > 0) {
       process.stderr.write(
-        chalk9.gray(`--- ${secretsRedacted} secret/PII span(s) redacted before identifier mutation ---
+        chalk10.gray(`--- ${secretsRedacted} secret/PII span(s) redacted before code protection ---
 `)
       );
     }
-    process.stderr.write(chalk9.gray(`
---- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
+    process.stderr.write(chalk10.gray(`
+--- ${result.stats.tokensMutated} identifiers protected in ${result.stats.durationMs}ms ---
 `));
     printTokenFooter(1, result.stats.tokensMutated);
   }
 });
 program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
-  const absPath = resolve2(file);
-  if (!existsSync7(absPath)) {
-    console.error(chalk9.red("Error: File not found:"), chalk9.bold(absPath));
+  const absPath = resolve3(file);
+  if (!existsSync8(absPath)) {
+    console.error(chalk10.red("Error: File not found:"), chalk10.bold(absPath));
     process.exit(1);
   }
-  const mutatedCode = readFileSync7(absPath, "utf-8");
-  const mapPath = opts.map ? resolve2(opts.map) : join5(getConfigDir(), "mutation-map.json");
-  if (!existsSync7(mapPath)) {
-    console.error(chalk9.red("Error: Mutation map not found:"), chalk9.bold(mapPath));
-    console.error(chalk9.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+  const mutatedCode = readFileSync8(absPath, "utf-8");
+  const mapPath = opts.map ? resolve3(opts.map) : join6(getConfigDir(), "mutation-map.json");
+  if (!existsSync8(mapPath)) {
+    console.error(chalk10.red("Error: Mutation map not found:"), chalk10.bold(mapPath));
+    console.error(chalk10.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
     process.exit(1);
   }
   let store;
@@ -3826,14 +4000,14 @@ program.command("reverse <file>").description("Reverse mutations using stored ma
     store = new MutationStore(mapPath);
     store.load();
   } catch {
-    console.error(chalk9.red("Error: Failed to load mutation map:"), chalk9.bold(mapPath));
-    console.error(chalk9.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
+    console.error(chalk10.red("Error: Failed to load mutation map:"), chalk10.bold(mapPath));
+    console.error(chalk10.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
     process.exit(1);
   }
   const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
   if (!entry) {
-    console.error(chalk9.red("Error: No mutation map entries found."));
-    console.error(chalk9.gray("Run 'pretense mutate --save <file>' first to generate a map."));
+    console.error(chalk10.red("Error: No mutation map entries found."));
+    console.error(chalk10.gray("Run 'pretense mutate --save <file>' first to generate a map."));
     process.exit(1);
   }
   const map = MutationStore.toMap(entry);
@@ -3842,8 +4016,8 @@ program.command("reverse <file>").description("Reverse mutations using stored ma
   process.stdout.write(restored);
   const secretsCount = secretsMap?.size ?? 0;
   const secretsSuffix = secretsCount > 0 ? ` + ${secretsCount} secret(s)` : "";
-  process.stderr.write(chalk9.gray(`
---- Reversed ${map.size} mutations${secretsSuffix} ---
+  process.stderr.write(chalk10.gray(`
+--- Reversed ${map.size} security tokens${secretsSuffix} ---
 `));
 });
 program.command("audit").description("View the audit log").option("--json", "Output as JSON", false).option("--csv", "Output as CSV", false).option("-l, --limit <number>", "Limit entries", "50").action((opts) => {
@@ -3862,7 +4036,7 @@ program.command("status").description("Show current plan, monthly quota, seat us
 program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(async () => {
   await runStatus();
 });
-program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(async () => {
+program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining security token budget").action(async () => {
   await runCredits();
 });
 program.command("upgrade").description("Compare plans and upgrade to Pro or Enterprise").action(() => {
@@ -3871,19 +4045,20 @@ program.command("upgrade").description("Compare plans and upgrade to Pro or Ente
 program.command("credits").description("Show remaining mutation/scan budget for the current month").action(async () => {
   await runCredits();
 });
-program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (prtns_live_... or pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
+program.command("login").description("Save a dashboard API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (prtns_live_... or pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
   const code = runLogin({ key: opts.key });
   if (code !== 0) process.exit(code);
 });
-program.command("logout").description("Remove the saved Pretense dashboard API key from ~/.pretense/config.json").option("-y, --yes", "Skip confirmation prompt", false).action(async (opts) => {
+program.command("logout").description("Remove the saved dashboard API key from ~/.pretense/config.json").option("-y, --yes", "Skip confirmation prompt", false).action(async (opts) => {
   const code = await runLogout({ assumeYes: opts.yes === true });
   if (code !== 0) process.exit(code);
 });
+program.addCommand(installCommand());
 function handleFatalError(err) {
   if (err instanceof Error && err.message) {
-    console.error(chalk9.red("Error:"), err.message);
+    console.error(chalk10.red("Error:"), err.message);
   } else {
-    console.error(chalk9.red("An unexpected error occurred."));
+    console.error(chalk10.red("An unexpected error occurred."));
   }
   process.exit(1);
 }