@pretense/cli 0.6.11 → 0.6.13

package/dist/{chunk-5GO2CY5W.js → chunk-HWSWJ4EC.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.11" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.13" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-5GO2CY5W.js";
+} from "./chunk-HWSWJ4EC.js";
 import {
   __commonJS,
   __toESM,
@@ -7565,8 +7565,8 @@ var DETECTOR_FRAMEWORKS = {
   "swift-bic": ["FADP", "GDPR", "UK_GDPR"],
   "twilio-account-sid": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
   "twilio-auth-token": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
-  "uk-nhs-number-labeled": ["GDPR", "UK_GDPR"],
-  "uk-nino-labeled": ["APPI", "AU_PRIVACY", "CCPA_CPRA", "CJIS", "DPDP", "FADP", "FISMA", "GDPR", "IRS_1075", "ISO_27001", "ISO_27701", "LGPD", "PDPA_SG", "PDPA_TH", "PIPA_KR", "PIPEDA", "PIPL", "POPIA", "UK_GDPR"],
+  "uk-nhs-number-labeled": ["UK_GDPR"],
+  "uk-nino-labeled": ["UK_GDPR"],
   "us-ein": ["APRA_CPS234", "DORA", "GLBA", "IRS_1075", "NYDFS_500", "SOX"],
   "vat-number": ["FADP", "GDPR", "UK_GDPR"],
   "vault-token": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
@@ -12171,6 +12171,19 @@ var SECRET_PATTERNS = [
     defaultAction: "block",
     pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g
   },
+  // FIX 1 (v0.6.13) — HuggingFace access tokens. `hf_` user and fine-grained
+  // access tokens are `hf_` + 34+ base62 chars. Confirmed leaking on 0.6.12:
+  // an `hf_` token in bare prose scanned clean (a real credential egressed to
+  // the LLM) because no `hf_`/`huggingface` pattern existed. The `hf_` prefix
+  // plus a 34+ base62 body is a near-zero-false-positive signal. Critical/block
+  // because a live model-registry token grants push access to private models.
+  {
+    name: "huggingface-token",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /\bhf_[A-Za-z0-9]{34,}\b/g
+  },
   {
     name: "gitlab-token",
     category: "secret",
@@ -12745,8 +12758,9 @@ var ENV_PATTERNS = [
     // variable references (`$VAR`, `${VAR}`, `process.env.X`, `os.environ…`),
     // connection URLs (handled by `database-url`), and values that begin with a
     // recognised structured-secret prefix (Stripe `sk_`/`pk_`/`rk_`, OpenAI
-    // `sk-`, Slack `xox*`, GitHub `gh*_`/`glpat-`, AWS `AKIA`, Google `AIza`,
-    // Stripe webhook `whsec_`) are deliberately skipped so a generic
+    // `sk-`, Slack `xox*`, GitHub `gh*_`/`glpat-`, HuggingFace `hf_`, AWS
+    // `AKIA`, Google `AIza`, Stripe webhook `whsec_`) are deliberately skipped
+    // so a generic
     // `KEY=variable` reference is not flagged and the dedicated, higher-fidelity
     // patterns above own those matches. Placed last so more-specific patterns
     // win overlap deduplication on ties.
@@ -12760,7 +12774,7 @@ var ENV_PATTERNS = [
     // specific env-var names rather than generic secret-label tails, so they do
     // not belong in the shared vocabulary.
     pattern: new RegExp(
-      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
+      `(?<![A-Za-z0-9])(?:[A-Z0-9]+[._-])*(?:${ENV_SECRET_LABEL_ALTERNATION}|DATABASE_URL|VAULT_TOKEN)\\s*[=:]\\s*(?!['"\\s])(?!\\$)(?!process\\.env)(?!os\\.environ)(?![A-Za-z][A-Za-z0-9+.-]*:\\/\\/)(?!sk[-_]|pk_|rk_|whsec_|xox[bpors]-|ghp_|gho_|ghs_|glpat-|hf_|AKIA|AIza)[A-Za-z0-9/+._@:!#%^&*?~-]{8,}`,
       "gi"
     ),
     // PRECISION: reject `PASSWORD=changeme`, `PASSWORD=<your-password>` and
@@ -13827,6 +13841,8 @@ function overlapsAny(m, sorted) {
 }
 async function scanLevel2(text, language, opts = {}) {
   const lang = language ?? opts.language ?? "typescript";
+  const t0 = performance.now();
+  const elapsed = () => Math.round((performance.now() - t0) * 100) / 100;
   const base = opts.presidioUrl ? await scanWithPresidio(text, opts.presidioUrl, opts) : scan(text, opts);
   const l1Matches = base.matches.map((m) => ({ ...m, level: 1 }));
   const l1Findings = base.findings.map((f) => ({ ...f, level: 1 }));
@@ -13834,6 +13850,8 @@ async function scanLevel2(text, language, opts = {}) {
     ...base,
     matches: l1Matches,
     findings: l1Findings,
+    // Real wall time up to this early return, not the L1 sub-phase alone.
+    durationMs: elapsed(),
     l2: status
   });
   const native = loadNative();
@@ -13911,7 +13929,9 @@ async function scanLevel2(text, language, opts = {}) {
     matches: merged,
     findings: mergedFindings,
     scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    durationMs: base.durationMs,
+    // Real elapsed wall time for the full L1+L2 scan (was base.durationMs, the
+    // L1-only time, which undercounted the AST work ~25x — see FIX 3/TASK-16).
+    durationMs: elapsed(),
     patternCount: base.patternCount,
     // Bounded-work state is a property of the underlying scan and MUST survive
     // this merge — dropping it here would re-create the silent-incomplete hole
@@ -16425,11 +16445,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.11" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.13" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "b21055a9648ee90cddf55cbe5f9ad921f2363665".length > 0 ? "b21055a9648ee90cddf55cbe5f9ad921f2363665" : UNKNOWN_COMMIT;
+  return "a36bf5d80a91cfd8fbf57e6c5a6a9b9114826309".length > 0 ? "a36bf5d80a91cfd8fbf57e6c5a6a9b9114826309" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -16517,10 +16537,15 @@ var PlanEnforcer = class {
     }
     const QUOTA_PERIOD_DAYS3 = 7;
     const resetDate = new Date(Date.now() + QUOTA_PERIOD_DAYS3 * 864e5).toISOString().split("T")[0];
-    if (worstBlocked || overallPercent >= 100) {
+    const atOrOverLimit = (key) => {
+      const check = limits[key];
+      return check.limit !== void 0 && check.limit !== null && (check.current ?? 0) >= check.limit;
+    };
+    const anyAtOrOverLimit = metricKeys.some(atOrOverLimit);
+    if (worstBlocked || anyAtOrOverLimit) {
       for (const key of metricKeys) {
         const check = limits[key];
-        if ((check.usagePercent ?? 0) >= 100 && check.limit !== void 0 && check.limit !== null) {
+        if (atOrOverLimit(key)) {
           worstMetric = key;
           worstCurrent = check.current ?? 0;
           worstLimit = check.limit;
@@ -16839,7 +16864,10 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
   (async () => {
     const reader = upstreamResp.body?.getReader();
     if (!reader) {
-      await writer.close();
+      try {
+        await writer.close();
+      } catch {
+      }
       return;
     }
     let lineBuffer = "";
@@ -16897,9 +16925,17 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
         if (tail) await writer.write(encoder.encode(tail));
       }
     } finally {
-      await writer.close();
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      try {
+        await writer.close();
+      } catch {
+      }
     }
-  })();
+  })().catch(() => {
+  });
   return new Response(readable, {
     status: upstreamResp.status,
     headers: {
@@ -17025,7 +17061,6 @@ function getTelemetryEmitter(dashboardUrl, pushToken) {
   _emitter = new TelemetryEmitter(url, token);
   return _emitter;
 }
-var TIER_ORDER2 = { free: 0, pro: 1, enterprise: 2 };
 var riskScorer = new RiskScorer();
 function detectUpstream(path2, overrideHeader) {
   if (overrideHeader) return overrideHeader;
@@ -17034,12 +17069,66 @@ function detectUpstream(path2, overrideHeader) {
   if (path2.includes("/v1beta/") || path2.includes("/v1/models")) return "https://generativelanguage.googleapis.com";
   return "https://api.openai.com";
 }
-function detectProvider(upstream) {
-  if (upstream.includes("anthropic")) return "anthropic";
-  if (upstream.includes("openai")) return "openai";
-  if (upstream.includes("google")) return "google";
+function detectProviderFromPath(path2) {
+  if (path2.includes("/v1/messages")) return "anthropic";
+  if (path2.includes("/v1beta/") || path2.includes("/v1/models")) return "google";
+  if (path2.includes("/v1/chat/completions") || path2.includes("/v1/completions")) return "openai";
   return "openai-compatible";
 }
+function modelFromPath(path2) {
+  const m = path2.match(/\/models\/([^:/?]+)/);
+  return m?.[1];
+}
+var _tierCache = /* @__PURE__ */ new Map();
+var TIER_CACHE_OK_MS = 6e4;
+var TIER_CACHE_FAIL_MS = 1e4;
+var TIER_VALIDATE_TIMEOUT_MS = 3e3;
+function tierApiRoot() {
+  const raw2 = (process.env["PRETENSE_API_URL"] ?? "https://api.pretense.ai").trim();
+  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
+  return normalized.replace(/\/$/, "");
+}
+async function validateDashboardKeyTier(apiKey) {
+  const url = `${tierApiRoot()}/api/cli/auth/validate`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIER_VALIDATE_TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (!resp.ok) return { tier: "free", ok: false };
+    const body = await resp.json();
+    if (body["valid"] === false) return { tier: "free", ok: true };
+    switch (String(body["plan"]).toUpperCase()) {
+      case "PRO":
+        return { tier: "pro", ok: true };
+      case "ENTERPRISE":
+        return { tier: "enterprise", ok: true };
+      case "FREE":
+        return { tier: "free", ok: true };
+      default:
+        return { tier: "free", ok: false };
+    }
+  } catch {
+    return { tier: "free", ok: false };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveKeyTier(apiKey) {
+  if (!apiKey) return "free";
+  const fromPrefix = tierFromApiKey(apiKey);
+  if (fromPrefix) return fromPrefix;
+  if (!apiKey.startsWith("prtns_")) return "free";
+  const cached = _tierCache.get(apiKey);
+  if (cached && cached.expiresAt > Date.now()) return cached.tier;
+  const { tier, ok } = await validateDashboardKeyTier(apiKey);
+  _tierCache.set(apiKey, { tier, expiresAt: Date.now() + (ok ? TIER_CACHE_OK_MS : TIER_CACHE_FAIL_MS) });
+  return tier;
+}
 function extractAllText(body) {
   const parts = [];
   if (typeof body["system"] === "string") parts.push(body["system"]);
@@ -17054,6 +17143,19 @@ function extractAllText(body) {
     }
   }
   if (typeof body["prompt"] === "string") parts.push(body["prompt"]);
+  const gWalkParts = (v) => {
+    if (!Array.isArray(v)) return;
+    for (const part of v) {
+      if (part && typeof part["text"] === "string") parts.push(part["text"]);
+    }
+  };
+  if (Array.isArray(body["contents"])) {
+    for (const c of body["contents"]) {
+      if (c) gWalkParts(c["parts"]);
+    }
+  }
+  const sysInstr = body["systemInstruction"] ?? body["system_instruction"];
+  if (sysInstr && typeof sysInstr === "object") gWalkParts(sysInstr["parts"]);
   return parts.join("\n");
 }
 var TRANSFORM_MAX_DEPTH = 256;
@@ -17377,11 +17479,7 @@ function createProxy(opts = {}) {
     }
     {
       const _apiKey = c.req.header("x-pretense-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
-      const _keyTier = tierFromApiKey(_apiKey);
-      const _effectiveTier = (() => {
-        if (!_keyTier) return "free";
-        return TIER_ORDER2[_keyTier] <= TIER_ORDER2[planCfg.tier] ? _keyTier : planCfg.tier;
-      })();
+      const _effectiveTier = await resolveKeyTier(_apiKey);
       const _requestEnforcer = new PlanEnforcer(_effectiveTier, planCfg.tenantId);
       const QUOTA_PERIOD_DAYS3 = 7;
       const _periodMs = QUOTA_PERIOD_DAYS3 * 864e5;
@@ -17450,8 +17548,8 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       }
     }
     const upstream = detectUpstream(c.req.path, c.req.header("x-pretense-upstream"));
-    const provider = detectProvider(upstream);
-    const model = body["model"] ?? "unknown";
+    const provider = detectProviderFromPath(c.req.path);
+    const model = body["model"] ?? (provider === "google" ? modelFromPath(c.req.path) : void 0) ?? "unknown";
     const fullText = extractAllText(body);
     const scanT0 = performance.now();
     const deep = tokenizeBodyDeep(
@@ -17648,12 +17746,26 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
     });
     delete headers["host"];
     delete headers["content-length"];
+    delete headers["expect"];
+    delete headers["connection"];
+    delete headers["keep-alive"];
+    delete headers["transfer-encoding"];
+    delete headers["te"];
+    delete headers["upgrade"];
     headers["host"] = new URL(upstream).host;
     headers["x-pretense-request-id"] = requestId;
     if (riskResult.recommendation === "warn") {
       headers["x-pretense-risk-score"] = String(riskResult.score);
     }
-    const forwardBody = JSON.stringify(mutatedBody);
+    let forwardBody;
+    try {
+      forwardBody = JSON.stringify(mutatedBody);
+    } catch {
+      return c.json(
+        { error: { type: "invalid_request", message: "Request body is too deeply nested to process" } },
+        400
+      );
+    }
     const originalSize = fullText.length;
     const processedSize = forwardBody.length;
     let upstreamResp;
@@ -17786,6 +17898,15 @@ function startProxy(opts = {}) {
     });
   }
 }
+function renderClientEnvLines(port, protocol) {
+  const base = `${protocol}://localhost:${port}`;
+  return [
+    "  Point your AI client at Pretense:",
+    `    ANTHROPIC_BASE_URL=${base}`,
+    `    OPENAI_BASE_URL=${base}/v1`,
+    `    GOOGLE_GEMINI_BASE_URL=${base}`
+  ].join("\n") + "\n";
+}
 function printBanner(port, protocol, tls) {
   const tlsLabel = tls ? " [TLS]" : "";
   const version = productVersion();
@@ -17800,10 +17921,9 @@ function printBanner(port, protocol, tls) {
 \u2502   Proxy:      ${protocol}://localhost:${port}${tls ? " " : "           "}\u2502
 \u2502   Health:     ${protocol}://localhost:${port}/health    \u2502
 \u2502                                             \u2502
-\u2502   ANTHROPIC_BASE_URL=${protocol}://localhost:${port}    \u2502
-\u2502                                             \u2502
 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\x1B[0m
-`
+
+` + renderClientEnvLines(port, protocol) + "\n"
   );
 }
 var isMain = process.argv[1]?.endsWith("server.js") || process.argv[1]?.endsWith("server.ts");
@@ -18223,9 +18343,24 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".idea",
   ".vscode"
 ]);
+function isSkippableWalkError(err) {
+  const code = err?.code;
+  return code === "EACCES" || code === "EPERM" || code === "ENOENT" || code === "ELOOP" || code === "ENOTDIR";
+}
 function walkDir(dir) {
   const files = [];
-  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch (err) {
+    if (isSkippableWalkError(err)) {
+      const code = err.code;
+      console.error(chalk4.yellow(`  Skipping unreadable path (${code}): ${dir}`));
+      return files;
+    }
+    throw err;
+  }
+  for (const entry of entries) {
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRS.has(entry.name)) continue;
       files.push(...walkDir(join7(dir, entry.name)));
@@ -18278,6 +18413,18 @@ function l2LanguageFor(filePath) {
   if (!filePath) return void 0;
   return L2_LANGUAGE_BY_EXT[extname2(filePath).toLowerCase()];
 }
+var L2_LARGE_FILE_WARN_BYTES = 5 * 1024 * 1024;
+function warnIfLargeForL2(byteLength, filePath) {
+  if (byteLength <= L2_LARGE_FILE_WARN_BYTES) return false;
+  const mb = (byteLength / (1024 * 1024)).toFixed(1);
+  const where = filePath ? ` \u2014 ${basename(filePath)}` : "";
+  console.error(
+    chalk4.yellow(
+      `  Note: L2 AST scanning is slow on very large files (${mb}MB${where}); this may take a while.`
+    )
+  );
+  return true;
+}
 async function scanContent(content, opts, filePath) {
   return withLocations(await scanContentRaw(content, opts, filePath), content);
 }
@@ -18321,6 +18468,7 @@ async function scanContentRaw(content, opts, filePath) {
       }
     };
   }
+  warnIfLargeForL2(Buffer.byteLength(content, "utf-8"), filePath);
   const result = await scanLevel2(content, language, scanOpts);
   if (opts.level === 2) {
     const only2 = result.matches.filter((m) => m.level === 2);
@@ -18806,9 +18954,21 @@ function scanCommand() {
         process.exit(1);
       }
     } else {
+      if (process.stdin.isTTY) {
+        console.error(
+          chalk4.yellow("\n  x Nothing to scan.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+        );
+        process.exit(USAGE_EXIT);
+      }
       const chunks = [];
       for await (const chunk of process.stdin) chunks.push(chunk);
       content = Buffer.concat(chunks).toString("utf-8");
+      if (content.trim() === "") {
+        console.error(
+          chalk4.yellow("\n  x Nothing to scan \u2014 no file argument and empty input.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+        );
+        process.exit(USAGE_EXIT);
+      }
     }
     const rawResult = await scanContent(content, opts, file);
     const filteredMatches = filterBySeverity(rawResult.matches, opts?.severity);
@@ -18881,18 +19041,25 @@ function statusCommand() {
     const fingerprintPath = join8(dir, ".pretense", "fingerprint.json");
     const configPath = join8(dir, "pretense.yaml");
     console.log(chalk5.cyan("\n  Pretense Status\n"));
-    let proxyRunning = false;
-    try {
-      const resp = await fetch("http://localhost:9339/health", { signal: AbortSignal.timeout(1e3) });
-      if (resp.ok) {
+    const record = readProxyRecord(pidFilePath());
+    if (record && !isProcessAlive(record.pid)) {
+      console.log(
+        chalk5.yellow(
+          `  \u25CB Proxy not running  ${chalk5.dim(`(stale record for pid ${record.pid}; run: pretense start)`)}`
+        )
+      );
+    } else {
+      const port = record && record.port > 0 ? record.port : 9339;
+      try {
+        const resp = await fetch(`http://localhost:${port}/health`, { signal: AbortSignal.timeout(1e3) });
+        if (!resp.ok) throw new Error(`health returned ${resp.status}`);
         const health = await resp.json();
-        proxyRunning = true;
-        console.log(chalk5.green(`  \u2713 Proxy running on :9339 (uptime: ${health["uptime"]}s)`));
+        console.log(chalk5.green(`  \u2713 Proxy running on :${port} (uptime: ${health["uptime"]}s)`));
         const stats = health["stats"];
         console.log(chalk5.dim(`    Requests: ${stats["requestsProcessed"] ?? 0} | Mutations: ${stats["mutationsApplied"] ?? 0} | Blocked: ${stats["secretsBlocked"] ?? 0}`));
+      } catch {
+        console.log(chalk5.yellow(`  \u25CB Proxy not running  ${chalk5.dim("(run: pretense start)")}`));
       }
-    } catch {
-      console.log(chalk5.yellow(`  \u25CB Proxy not running  ${chalk5.dim("(run: pretense start)")}`));
     }
     if (existsSync8(configPath)) {
       console.log(chalk5.green(`  \u2713 Config: pretense.yaml`));
@@ -20407,7 +20574,8 @@ function quickstartCommand() {
     console.log(`  ${chalk13.green("2.")} ${chalk13.cyan("pretense install")}          Install pre-commit + pre-push git hooks`);
     console.log(`  ${chalk13.green("3.")} Set your LLM client to use the proxy:`);
     console.log(`     ${chalk13.dim("ANTHROPIC_BASE_URL=http://localhost:9339 claude")}`);
-    console.log(`     ${chalk13.dim("OPENAI_BASE_URL=http://localhost:9339/openai openai ...")}
+    console.log(`     ${chalk13.dim("OPENAI_BASE_URL=http://localhost:9339/v1 openai ...")}`);
+    console.log(`     ${chalk13.dim("GOOGLE_GEMINI_BASE_URL=http://localhost:9339 gemini ...")}
 `);
     console.log(chalk13.bold.green("  Protected. Happy coding.\n"));
   });

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-5GO2CY5W.js";
+} from "./chunk-HWSWJ4EC.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -24,13 +24,13 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
     "@pretense/protocol": "0.1.0",
-    "@pretense/compliance-engine": "0.1.0",
     "@pretense/learner": "0.2.0",
-    "@pretense/billing": "0.1.0",
+    "@pretense/compliance-engine": "0.1.0",
     "@pretense/mutator": "0.2.0",
+    "@pretense/billing": "0.1.0",
     "@pretense/proxy": "0.1.0",
-    "@pretense/scanner-rs": "0.2.0",
     "@pretense/scanner": "0.2.0",
+    "@pretense/scanner-rs": "0.2.0",
     "@pretense/store": "0.2.0"
   },
   "publishConfig": {