@pretense/cli 0.6.15 → 0.6.17

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-AULCU5QN.js";
+} from "./chunk-EFDPBFXJ.js";
 import {
   __commonJS,
   __toESM,
@@ -221,8 +221,8 @@ var require_brace_expansion = __commonJS({
 
 // src/index.ts
 init_esm_shims();
-import { Command as Command22 } from "commander";
-import chalk21 from "chalk";
+import { Command as Command23 } from "commander";
+import chalk23 from "chalk";
 
 // src/commands/init.ts
 init_esm_shims();
@@ -3892,10 +3892,10 @@ var Minipass = class extends EventEmitter {
    * Return a void Promise that resolves once the stream ends.
    */
   async promise() {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       this.on(DESTROYED, () => reject(new Error("stream destroyed")));
       this.on("error", (er) => reject(er));
-      this.on("end", () => resolve7());
+      this.on("end", () => resolve8());
     });
   }
   /**
@@ -3919,7 +3919,7 @@ var Minipass = class extends EventEmitter {
         return Promise.resolve({ done: false, value: res });
       if (this[EOF])
         return stop();
-      let resolve7;
+      let resolve8;
       let reject;
       const onerr = (er) => {
         this.off("data", ondata);
@@ -3933,19 +3933,19 @@ var Minipass = class extends EventEmitter {
         this.off("end", onend);
         this.off(DESTROYED, ondestroy);
         this.pause();
-        resolve7({ value, done: !!this[EOF] });
+        resolve8({ value, done: !!this[EOF] });
       };
       const onend = () => {
         this.off("error", onerr);
         this.off("data", ondata);
         this.off(DESTROYED, ondestroy);
         stop();
-        resolve7({ done: true, value: void 0 });
+        resolve8({ done: true, value: void 0 });
       };
       const ondestroy = () => onerr(new Error("stream destroyed"));
       return new Promise((res2, rej) => {
         reject = rej;
-        resolve7 = res2;
+        resolve8 = res2;
         this.once(DESTROYED, ondestroy);
         this.once("error", onerr);
         this.once("end", onend);
@@ -4917,9 +4917,9 @@ var PathBase = class {
     if (this.#asyncReaddirInFlight) {
       await this.#asyncReaddirInFlight;
     } else {
-      let resolve7 = () => {
+      let resolve8 = () => {
       };
-      this.#asyncReaddirInFlight = new Promise((res) => resolve7 = res);
+      this.#asyncReaddirInFlight = new Promise((res) => resolve8 = res);
       try {
         for (const e of await this.#fs.promises.readdir(fullpath, {
           withFileTypes: true
@@ -4932,7 +4932,7 @@ var PathBase = class {
         children.provisional = 0;
       }
       this.#asyncReaddirInFlight = void 0;
-      resolve7();
+      resolve8();
     }
     return children.slice(0, children.provisional);
   }
@@ -7572,16 +7572,29 @@ var DETECTOR_FRAMEWORKS = {
   "vault-token": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
   "vehicle-vin": ["APPI", "AU_PRIVACY", "CCPA_CPRA", "COPPA", "DPDP", "FADP", "FERPA", "GDPR", "HIPAA", "HITECH", "HITRUST", "ISO_27701", "LGPD", "PDPA_SG", "PDPA_TH", "PIPA_KR", "PIPEDA", "PIPL", "POPIA", "UK_GDPR"]
 };
+var FRAMEWORK_ALIASES = {
+  SOC_1: "SOX"
+};
+function canonicalFrameworkKey(input) {
+  return input.trim().toUpperCase().replace(/[\s._-]+/g, "");
+}
+var ALIAS_BASE_BY_CANON = new Map(Object.entries(FRAMEWORK_ALIASES).map(([name, base]) => [canonicalFrameworkKey(name), base]));
+var POLICY_FRAMEWORKS = [
+  ...COMPLIANCE_FRAMEWORKS,
+  ...Object.keys(FRAMEWORK_ALIASES)
+];
 function frameworksForDetector(detector) {
   return Object.prototype.hasOwnProperty.call(DETECTOR_FRAMEWORKS, detector) ? DETECTOR_FRAMEWORKS[detector] : [];
 }
 function detectorsMatchFramework(detectors, framework) {
-  const want = framework.toUpperCase();
-  return detectors.some((d) => frameworksForDetector(d).some((f) => f.toUpperCase() === want));
+  const canon = canonicalFrameworkKey(framework);
+  const base = ALIAS_BASE_BY_CANON.get(canon);
+  const target = base ? canonicalFrameworkKey(base) : canon;
+  return detectors.some((d) => frameworksForDetector(d).some((f) => canonicalFrameworkKey(f) === target));
 }
 function resolveFrameworkName(input) {
-  const want = input.toUpperCase();
-  return COMPLIANCE_FRAMEWORKS.find((f) => f.toUpperCase() === want) ?? null;
+  const canon = canonicalFrameworkKey(input);
+  return POLICY_FRAMEWORKS.find((f) => canonicalFrameworkKey(f) === canon) ?? null;
 }
 
 // src/compliance-preset.ts
@@ -7611,21 +7624,21 @@ function detectorsForFramework(framework) {
   return ALL_TAGGED_DETECTORS.filter((d) => detectorsMatchFramework([d], framework));
 }
 function policyChoices() {
-  return [...COMPLIANCE_FRAMEWORKS, ...COMPLIANCE_PRESET_IDS];
+  return [...POLICY_FRAMEWORKS, ...COMPLIANCE_PRESET_IDS];
 }
 function resolvePolicyName(input) {
-  const key = normalizePolicyKey(input);
-  const shortId = key.toLowerCase();
+  const shortId = input.trim().toLowerCase();
   const viaShortId = isCompliancePresetId(shortId) ? SHORT_PRESET_ALIASES[shortId] : void 0;
-  const framework = viaShortId ?? COMPLIANCE_FRAMEWORKS.find((f) => normalizePolicyKey(f) === key);
+  const canon = canonicalFrameworkKey(input);
+  const framework = viaShortId ?? POLICY_FRAMEWORKS.find((f) => canonicalFrameworkKey(f) === canon);
   if (!framework) {
     throw new Error(
-      `Unknown compliance preset: "${input}". Valid presets: ${COMPLIANCE_PRESET_IDS.join(", ")}. Any of the ${COMPLIANCE_FRAMEWORKS.length} framework names from \`pretense audit --list-frameworks\` is also accepted (case- and separator-insensitive, e.g. pci-dss, PCI_DSS, pci_dss).`
+      `Unknown compliance preset: "${input}". Valid presets: ${COMPLIANCE_PRESET_IDS.join(", ")}. Any of the ${POLICY_FRAMEWORKS.length} framework names from \`pretense audit --list-frameworks\` is also accepted (case- and separator-insensitive, e.g. pci-dss, PCI_DSS, pci_dss).`
     );
   }
   const detectors = detectorsForFramework(framework);
   const fingerprint = detectors.join("|");
-  const sharedWith = COMPLIANCE_FRAMEWORKS.filter(
+  const sharedWith = POLICY_FRAMEWORKS.filter(
     (f) => f !== framework && detectorsForFramework(f).join("|") === fingerprint
   );
   const scannerPreset = SCANNER_PRESET_BY_FRAMEWORK[framework];
@@ -7818,7 +7831,7 @@ function startSpinner(text) {
 
 // src/commands/start.ts
 init_esm_shims();
-import { Command as Command2 } from "commander";
+import { Command as Command2, InvalidArgumentError } from "commander";
 import chalk2 from "chalk";
 import { execSync } from "child_process";
 
@@ -10400,7 +10413,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve7) => setTimeout(resolve7));
+            await new Promise((resolve8) => setTimeout(resolve8));
             maxReadCount = 3;
             continue;
           }
@@ -12002,6 +12015,70 @@ var EXTENDED_PATTERNS = [
     validate: looksLikeSecretValue
   }
 ];
+var THRESHOLD_HIGH_ENTROPY = 4.5;
+function shannonEntropy(str) {
+  if (str.length === 0) return 0;
+  const freq = {};
+  for (const c of str) {
+    freq[c] = (freq[c] ?? 0) + 1;
+  }
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / str.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+var MIN_ENTROPY_LENGTH = 20;
+var SECRET_CHARSET_RE = /^[A-Za-z0-9+/=_\-]+$/;
+var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var HEX_BLOB_RE = /^[a-f0-9]{32,}$/;
+var BASE64_BLOB_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+var SECRET_KEYWORD_RE = /\b(?:password|passwd|pwd|secret|key|token|credential|creds?|api[_-]?key|apikey|auth|authorization|bearer|private[_-]?key|access[_-]?key|client[_-]?secret)\b/i;
+var SECRET_KEY_NAME_RE = /(?:password|passwd|pwd|secret|token|credential|cred|apikey|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key|authorization|bearer|\bauth\b|\bkey\b)/i;
+function isAllowlistedShape(value) {
+  if (UUID_RE.test(value)) return true;
+  if (HEX_BLOB_RE.test(value)) return true;
+  if (BASE64_BLOB_RE.test(value) && value.length % 4 === 0 && !/[_-]/.test(value)) {
+    return true;
+  }
+  return false;
+}
+function hasSecretContext(text, start, end) {
+  const WINDOW = 80;
+  const before = text.slice(Math.max(0, start - WINDOW), start);
+  const after = text.slice(end, Math.min(text.length, end + WINDOW));
+  if (SECRET_KEYWORD_RE.test(before) || SECRET_KEYWORD_RE.test(after)) {
+    return true;
+  }
+  const assignMatch = before.match(/([A-Za-z0-9_$'"-]+)\s*[:=]\s*['"`]?\s*$/);
+  if (assignMatch && SECRET_KEY_NAME_RE.test(assignMatch[1])) {
+    return true;
+  }
+  return false;
+}
+function findHighEntropyStrings(text) {
+  const matches = [];
+  const tokenRe = /(?:['"`])([A-Za-z0-9+/=_\-]{20,})(?:['"`])/g;
+  let m;
+  while ((m = tokenRe.exec(text)) !== null) {
+    const value = m[1];
+    if (value.length < MIN_ENTROPY_LENGTH) continue;
+    if (!SECRET_CHARSET_RE.test(value)) continue;
+    const entropy = shannonEntropy(value);
+    if (entropy < THRESHOLD_HIGH_ENTROPY) continue;
+    const start = m.index + 1;
+    const end = start + value.length;
+    if (isAllowlistedShape(value) && !hasSecretContext(text, start, end)) {
+      continue;
+    }
+    matches.push({ value, entropy, start, end });
+  }
+  return matches;
+}
+function awsSecretKeyIsHighEntropy(token) {
+  return shannonEntropy(token) >= 3.9;
+}
 function envAssignmentValueIsReal(match3) {
   const sep2 = match3.search(/[=:]/);
   if (sep2 === -1) return true;
@@ -12114,6 +12191,24 @@ var SECRET_PATTERNS = [
     defaultAction: "block",
     pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/g
   },
+  {
+    // BLOCKER: the assignment-anchored `aws-secret-key` above misses the SECRET
+    // access key when it appears in PROSE — "deploy with wJalrXUtnFEMI/K7MDENG/
+    // bPxRfiCYEXAMPLEKEY" or next to its AKIA id — and the raw 40-char key then
+    // reached the LLM verbatim (scan reported clean). This detector catches the
+    // bare token, but ONLY within 80 chars of AWS context (an AKIA id, "aws
+    // secret", or "secret access key"), so an unrelated 40-char base64 string is
+    // not swept up. `valueGroup: 1` scopes the block/tokenization to the token,
+    // never the surrounding words; the `d` flag is REQUIRED for that span, and
+    // the entropy `validate` is the secondary FP guard (rejects a git SHA).
+    name: "aws-secret-access-key-contextual",
+    category: "secret",
+    severity: "critical",
+    defaultAction: "block",
+    pattern: /(?:AKIA[0-9A-Z]{16}|aws[_\s-]{0,3}secret(?:[_\s-]{0,3}access)?[_\s-]{0,3}key|secret[_\s-]{0,3}access[_\s-]{0,3}key)[\s\S]{0,80}?(?<![A-Za-z0-9/+])([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+=])/gid,
+    valueGroup: 1,
+    validate: awsSecretKeyIsHighEntropy
+  },
   {
     name: "gcp-service-account",
     category: "secret",
@@ -12787,67 +12882,6 @@ var ALL_PATTERNS = [...SECRET_PATTERNS, ...PII_PATTERNS, ...ENV_PATTERNS, ...EXT
 function getPatternCount() {
   return ALL_PATTERNS.length;
 }
-var THRESHOLD_HIGH_ENTROPY = 4.5;
-function shannonEntropy(str) {
-  if (str.length === 0) return 0;
-  const freq = {};
-  for (const c of str) {
-    freq[c] = (freq[c] ?? 0) + 1;
-  }
-  let entropy = 0;
-  for (const count of Object.values(freq)) {
-    const p = count / str.length;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
-var MIN_ENTROPY_LENGTH = 20;
-var SECRET_CHARSET_RE = /^[A-Za-z0-9+/=_\-]+$/;
-var UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-var HEX_BLOB_RE = /^[a-f0-9]{32,}$/;
-var BASE64_BLOB_RE = /^[A-Za-z0-9+/]+={0,2}$/;
-var SECRET_KEYWORD_RE = /\b(?:password|passwd|pwd|secret|key|token|credential|creds?|api[_-]?key|apikey|auth|authorization|bearer|private[_-]?key|access[_-]?key|client[_-]?secret)\b/i;
-var SECRET_KEY_NAME_RE = /(?:password|passwd|pwd|secret|token|credential|cred|apikey|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key|authorization|bearer|\bauth\b|\bkey\b)/i;
-function isAllowlistedShape(value) {
-  if (UUID_RE.test(value)) return true;
-  if (HEX_BLOB_RE.test(value)) return true;
-  if (BASE64_BLOB_RE.test(value) && value.length % 4 === 0 && !/[_-]/.test(value)) {
-    return true;
-  }
-  return false;
-}
-function hasSecretContext(text, start, end) {
-  const WINDOW = 80;
-  const before = text.slice(Math.max(0, start - WINDOW), start);
-  const after = text.slice(end, Math.min(text.length, end + WINDOW));
-  if (SECRET_KEYWORD_RE.test(before) || SECRET_KEYWORD_RE.test(after)) {
-    return true;
-  }
-  const assignMatch = before.match(/([A-Za-z0-9_$'"-]+)\s*[:=]\s*['"`]?\s*$/);
-  if (assignMatch && SECRET_KEY_NAME_RE.test(assignMatch[1])) {
-    return true;
-  }
-  return false;
-}
-function findHighEntropyStrings(text) {
-  const matches = [];
-  const tokenRe = /(?:['"`])([A-Za-z0-9+/=_\-]{20,})(?:['"`])/g;
-  let m;
-  while ((m = tokenRe.exec(text)) !== null) {
-    const value = m[1];
-    if (value.length < MIN_ENTROPY_LENGTH) continue;
-    if (!SECRET_CHARSET_RE.test(value)) continue;
-    const entropy = shannonEntropy(value);
-    if (entropy < THRESHOLD_HIGH_ENTROPY) continue;
-    const start = m.index + 1;
-    const end = start + value.length;
-    if (isAllowlistedShape(value) && !hasSecretContext(text, start, end)) {
-      continue;
-    }
-    matches.push({ value, entropy, start, end });
-  }
-  return matches;
-}
 function icd10Check(match3) {
   const code = match3.trim().toUpperCase();
   return /^[A-Z]\d{2}(?:\.[A-Z0-9]{1,4})?$/.test(code);
@@ -14374,7 +14408,7 @@ import { createHmac, hkdfSync, randomBytes as randomBytes2 } from "crypto";
 import { createHash, randomBytes } from "crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync22 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join22, dirname, parse } from "path";
+import { join as join22, dirname, parse, resolve } from "path";
 import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
 import { join as join4 } from "path";
@@ -14447,6 +14481,7 @@ function tighten(path2, exact, kind) {
     );
   }
 }
+var PROJECT_ROOT_ENV = "PRETENSE_PROJECT_ROOT";
 var KEYS_DIR_NAME = join22(".pretense", "keys");
 function keysDir() {
   return join22(homedir2(), KEYS_DIR_NAME);
@@ -14469,7 +14504,25 @@ var PROJECT_MARKERS = [
   ".hg",
   ".svn"
 ];
+function markersAt(dir, home) {
+  return dir === home ? PROJECT_MARKERS.filter((m) => m !== ".pretense") : PROJECT_MARKERS;
+}
 function findProjectRoot(filePath) {
+  let dir = dirname(filePath);
+  const { root } = parse(dir);
+  const startDir = dir;
+  const home = homedir2();
+  while (true) {
+    if (markersAt(dir, home).some((m) => existsSync22(join22(dir, m)))) {
+      return dir;
+    }
+    if (dir === root) return startDir;
+    const parent = dirname(dir);
+    if (parent === dir) return startDir;
+    dir = parent;
+  }
+}
+function legacyFindProjectRoot(filePath) {
   let dir = dirname(filePath);
   const { root } = parse(dir);
   const startDir = dir;
@@ -14483,6 +14536,21 @@ function findProjectRoot(filePath) {
     dir = parent;
   }
 }
+function resolveProjectRoot(filePath) {
+  const override2 = process.env[PROJECT_ROOT_ENV];
+  if (override2 && override2.trim()) return resolve(override2.trim());
+  return findProjectRoot(filePath);
+}
+function candidateProjectRoots(filePath) {
+  const out = [];
+  const override2 = process.env[PROJECT_ROOT_ENV];
+  if (override2 && override2.trim()) out.push(resolve(override2.trim()));
+  out.push(findProjectRoot(filePath));
+  out.push(dirname(filePath));
+  out.push(legacyFindProjectRoot(filePath));
+  const seen = /* @__PURE__ */ new Set();
+  return out.filter((r) => seen.has(r) ? false : (seen.add(r), true));
+}
 function findProjectRootForDir(dir) {
   return findProjectRoot(join22(dir, "__pretense_probe__"));
 }
@@ -16118,6 +16186,7 @@ var AuditStore = class {
       blocked: 0,
       mutated: 0,
       redacted: 0,
+      reversed: 0,
       error: 0
     };
     for (const row of actionRows) {
@@ -16300,7 +16369,7 @@ import { join as join5 } from "path";
 import { parse as parseYaml } from "yaml";
 import { readFileSync as readFileSync23 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join23, resolve } from "path";
+import { dirname as dirname3, join as join23, resolve as resolve2 } from "path";
 import https from "https";
 
 // ../packages/tls/dist/index.js
@@ -16436,7 +16505,7 @@ function versionFromCliPackageJson() {
         }
       } catch {
       }
-      const parent = resolve(dir, "..");
+      const parent = resolve2(dir, "..");
       if (parent === dir) break;
       dir = parent;
     }
@@ -16445,11 +16514,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.15" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.17" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "538df7d688ce6d0c9f2b39578c555bb4b8281a55".length > 0 ? "538df7d688ce6d0c9f2b39578c555bb4b8281a55" : UNKNOWN_COMMIT;
+  return "6f467e565f6f035a63fe420acef1019ddf2455f0".length > 0 ? "6f467e565f6f035a63fe420acef1019ddf2455f0" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -16571,7 +16640,10 @@ var PlanEnforcer = class {
         upgradeMessage,
         upgradeTier,
         upgradeUrl,
-        resetDate
+        resetDate,
+        limitMetric: worstMetric,
+        limitCurrent: worstCurrent,
+        limitValue: worstLimit
       };
     }
     if (overallPercent >= 90) {
@@ -17514,20 +17586,26 @@ function createProxy(opts = {}) {
         if (_enforcement.upgradeUrl) c.header("X-Pretense-Upgrade-Url", _enforcement.upgradeUrl);
       }
       if (!_enforcement.allowed) {
-        const _planConfig = PLAN_CONFIGS[_effectiveTier];
-        const _mutLimit = _planConfig.mutationsPerPeriod ?? 0;
-        const _mutCurrent = _periodStats.totalMutationsApplied;
         const _upgradeTier = _enforcement.upgradeTier ?? "pro";
+        const _metric = _enforcement.limitMetric ?? "mutations";
+        const _mutCurrent = _enforcement.limitCurrent ?? _periodStats.totalMutationsApplied;
+        const _mutLimit = _enforcement.limitValue ?? (PLAN_CONFIGS[_effectiveTier].mutationsPerPeriod ?? 0);
+        const _metricLabel = {
+          mutations: "Mutation",
+          scans: "Request",
+          bytes: "Data",
+          seats: "Seat"
+        };
+        const _label = _metricLabel[_metric] ?? "Usage";
         return c.json({
           error: {
             type: "plan_limit_exceeded",
-            code: "MUTATION_LIMIT_EXCEEDED",
-            // Human-readable error matching the spec format
+            code: `${_metric.toUpperCase()}_LIMIT_EXCEEDED`,
             // 100,000 = PLAN_CONFIGS.pro.mutationsPerPeriod; $29/seat =
             // PLAN_CONFIGS.pro.pricePerSeatCents (monthly rate). Enterprise
             // prints no price and no self-serve `pretense upgrade` path: it
             // is contact-sales only. DO NOT restore "$99/seat".
-            message: `\u2717 Mutation limit reached for this 7-day period (${_mutCurrent.toLocaleString()}/${_mutLimit.toLocaleString()})
+            message: `\u2717 ${_label} limit reached for this 7-day period (${_mutCurrent.toLocaleString()}/${_mutLimit.toLocaleString()})
 
 ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014 contact sales for a quote.\n\u2192 visit pretense.ai/pricing" : "Upgrade to Pro for 100,000 mutations / 7 days ($29/seat)\n\u2192 pretense upgrade  OR  visit pretense.ai/pricing"}`,
             upgrade: {
@@ -17540,7 +17618,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
               current: _mutCurrent,
               limit: _mutLimit,
               percent: _enforcement.usagePercent,
-              metric: "mutations",
+              metric: _metric,
               resetDate: _enforcement.resetDate
             }
           }
@@ -17681,6 +17759,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       return replaceCodeBlocks(text, blocks, mutatedBlocks);
     });
     const mutDurationMs = Math.round((performance.now() - mutT0) * 100) / 100;
+    const mutationsApplied = tokensMutated + secretsTokenized + piiTokenized;
     const totalChars = fullText.length;
     const identifierExposureRate = totalChars > 0 ? Math.min(1, tokensMutated / Math.max(1, totalChars / 10)) : 0;
     const riskCtx = {
@@ -17709,7 +17788,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         processedSize: 0,
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationsApplied: tokensMutated,
+        mutationsApplied,
         scanDurationMs,
         mutationDurationMs: mutDurationMs,
         action: "blocked",
@@ -17791,7 +17870,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         processedSize,
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationsApplied: tokensMutated,
+        mutationsApplied,
         scanDurationMs,
         mutationDurationMs: mutDurationMs,
         action: "error",
@@ -17828,7 +17907,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       processedSize,
       secretsBlocked: secretsTokenized,
       piiRedacted: piiTokenized,
-      mutationsApplied: tokensMutated,
+      mutationsApplied,
       scanDurationMs,
       mutationDurationMs: mutDurationMs,
       action,
@@ -17904,10 +17983,16 @@ function renderClientEnvLines(port, protocol) {
     "  Easiest \u2014 let Pretense wire the env var and run the tool for you:",
     '    pretense run claude "build me X"      # or: cursor, gemini, any tool',
     "",
-    "  Or point your AI client at Pretense yourself:",
-    `    ANTHROPIC_BASE_URL=${base}`,
-    `    OPENAI_BASE_URL=${base}/v1`,
-    `    GOOGLE_GEMINI_BASE_URL=${base}`
+    // The manual lines are SAME-SHELL (env var and tool on one command) on
+    // purpose: a user who runs `export …BASE_URL=…` here and then `claude` in
+    // a NEW terminal is unprotected — env vars are per-shell. The warning
+    // below states that, and points back at `pretense run` as the fix.
+    "  Or point your AI client at Pretense yourself (SAME terminal as the tool):",
+    `    ANTHROPIC_BASE_URL=${base} claude`,
+    `    OPENAI_BASE_URL=${base}/v1 cursor`,
+    `    GOOGLE_GEMINI_BASE_URL=${base} gemini`,
+    "  \u26A0 Set this in the SAME terminal as your AI tool \u2014 a new terminal is NOT",
+    "    protected. Simplest: use `pretense run` and skip the export entirely."
   ].join("\n") + "\n";
 }
 function printBanner(port, protocol, tls) {
@@ -17938,14 +18023,14 @@ if (isMain) {
 init_esm_shims();
 import net from "net";
 function isPortFree(port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const srv = net.createServer();
     srv.once("error", () => {
-      srv.close(() => resolve7(false));
-      resolve7(false);
+      srv.close(() => resolve8(false));
+      resolve8(false);
     });
     srv.once("listening", () => {
-      srv.close(() => resolve7(true));
+      srv.close(() => resolve8(true));
     });
     srv.listen(port);
   });
@@ -18051,6 +18136,16 @@ async function stopProxy(path2 = pidFilePath(), graceMs = 2e3, pollMs = 50) {
 }
 
 // src/commands/start.ts
+function parsePort(raw2) {
+  if (!/^\d+$/.test(raw2.trim())) {
+    throw new InvalidArgumentError(`"${raw2}" is not a number. Use a port between 1 and 65535.`);
+  }
+  const n = Number(raw2);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    throw new InvalidArgumentError(`${raw2} is out of range. Use a port between 1 and 65535.`);
+  }
+  return String(n);
+}
 function pidListeningOn(port) {
   try {
     const out = execSync(`lsof -nP -iTCP:${port} -sTCP:LISTEN -t`, {
@@ -18084,7 +18179,7 @@ function explainAddrInUse(port) {
   );
 }
 function startCommand() {
-  return new Command2("start").description("Start the Pretense proxy server").option("-p, --port <port>", "Port to listen on", "9339").option("--verbose", "Enable verbose logging", false).option("-c, --config <path>", "Path to pretense.yaml").option("--strict-port", "Fail if the requested port is busy instead of auto-advancing", false).action(async (opts) => {
+  return new Command2("start").description("Start the Pretense proxy server").option("-p, --port <port>", "Port to listen on (1\u201365535)", parsePort, "9339").option("--verbose", "Enable verbose logging", false).option("-c, --config <path>", "Path to pretense.yaml").option("--strict-port", "Fail if the requested port is busy instead of auto-advancing", false).action(async (opts) => {
     const requested = parseInt(opts.port, 10);
     const existing = readProxyRecord();
     if (existing) {
@@ -18092,7 +18187,10 @@ function startCommand() {
         if (existing.port === requested) {
           console.error(
             chalk2.red(`
-  x Pretense proxy is already running (pid ${existing.pid}, port ${existing.port}).`) + chalk2.dim("\n    Stop it with ") + chalk2.cyan("pretense stop") + chalk2.dim(", or start this one on another port with ") + chalk2.cyan(`--port ${requested + 1}`) + "\n"
+  x Pretense proxy is already running (pid ${existing.pid}, port ${existing.port}).`) + // The proxy is UP — the next thing the user wants is to route a
+            // tool through it, and `pretense run` reuses this exact proxy
+            // (no second export, no second terminal). Lead with that.
+            chalk2.dim("\n    Route a tool through it with ") + chalk2.cyan('pretense run claude "\u2026"') + chalk2.dim(" (or cursor, gemini, any tool).") + chalk2.dim("\n    Stop it with ") + chalk2.cyan("pretense stop") + chalk2.dim(", or start this one on another port with ") + chalk2.cyan(`--port ${requested + 1}`) + "\n"
           );
           process.exit(1);
         }
@@ -18155,109 +18253,485 @@ function startCommand() {
 
 // src/commands/stop.ts
 init_esm_shims();
-import { Command as Command3 } from "commander";
-import chalk3 from "chalk";
-function stopCommand() {
-  return new Command3("stop").description("Stop the running Pretense proxy").option("--json", "Machine-readable outcome", false).action(async (opts) => {
-    const path2 = pidFilePath();
-    const outcome = await stopProxy(path2);
-    if (opts.json) {
-      console.log(JSON.stringify(outcome, null, 2));
-      process.exit(outcome.kind === "refused" || outcome.kind === "not-permitted" ? 1 : 0);
-    }
-    switch (outcome.kind) {
-      case "not-running":
-        console.log(
-          chalk3.dim(`
-  \xB7 No running Pretense proxy recorded (${path2} does not exist).`) + chalk3.dim(`
-    Start one with `) + chalk3.cyan("pretense start") + "\n"
-        );
-        process.exit(0);
-        break;
-      case "stale":
-        console.log(
-          chalk3.yellow(
-            `
-  \xB7 Stale PID file cleaned up${outcome.pid ? ` (pid ${outcome.pid} is not running)` : ""}.`
-          ) + chalk3.dim(`
-    No proxy was running.
-`)
-        );
-        process.exit(0);
-        break;
-      case "stopped":
-        console.log(
-          chalk3.green(
-            `
-  \u2713 Pretense proxy stopped (pid ${outcome.pid}${outcome.port ? `, port ${outcome.port}` : ""})` + (outcome.forced ? " \u2014 did not exit on SIGTERM, sent SIGKILL" : "") + "\n"
-          )
-        );
-        process.exit(0);
-        break;
-      case "not-permitted":
-        console.error(
-          chalk3.red(`
-  x Cannot stop pid ${outcome.pid}: it belongs to another user.`) + chalk3.dim(`
-    The proxy is still running. Stop it as its owner, or: sudo kill ${outcome.pid}
-`)
-        );
-        process.exit(1);
-        break;
-      case "refused":
-        console.error(
-          chalk3.red(`
-  x Pid ${outcome.pid} is still alive after SIGTERM and SIGKILL.`) + chalk3.dim(`
-    ${path2} was left in place so you can investigate: ps -p ${outcome.pid}
-`)
-        );
-        process.exit(1);
-        break;
-    }
-  });
-}
-
-// src/commands/scan.ts
-init_esm_shims();
-import { Command as Command4, Option, InvalidArgumentError } from "commander";
+import { Command as Command4 } from "commander";
 import chalk4 from "chalk";
-import { readFileSync as readFileSync7, statSync as statSync3, readdirSync as readdirSync2, openSync, readSync, closeSync } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { resolve as resolve2, join as join7, extname as extname2, basename } from "path";
 
-// src/safe-output.ts
+// src/commands/doctor.ts
 init_esm_shims();
-var UNSAFE_VALUES_FLAG = "--unsafe-show-values";
-function lineColFromOffset2(text, offset) {
-  const clamped = Math.max(0, Math.min(offset, text.length));
-  let line = 1;
-  let lineStart = 0;
-  for (let i = 0; i < clamped; i++) {
-    if (text.charCodeAt(i) === 10) {
-      line++;
-      lineStart = i + 1;
-    }
-  }
-  return { line, column: clamped - lineStart + 1 };
-}
-function withLocations(result, content) {
-  const locate = (m) => lineColFromOffset2(content, m.start);
-  return {
-    ...result,
-    matches: result.matches.map((m) => ({ ...m, ...locate(m) }))
-  };
-}
-function safeLocator(m) {
-  const len = Math.max(0, m.end - m.start);
-  if (m.deobfuscated && len === 0) return "len=0 unmapped";
-  const pos = m.line !== void 0 && m.column !== void 0 ? `L${m.line}:${m.column} ` : "";
-  return `${pos}len=${len}${m.deobfuscated ? " enc" : ""}`;
+import { Command as Command3 } from "commander";
+import chalk3 from "chalk";
+
+// src/plan-usage.ts
+init_esm_shims();
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
+import { homedir as homedir4 } from "os";
+function credentialsPath() {
+  return join7(homedir4(), ".pretense", "credentials.json");
 }
-var VALUE_FIELDS = ["value", "masked", "deobfuscatedValue"];
-function stripRow(row) {
-  const out = {};
-  for (const [k, v] of Object.entries(row)) {
-    if (VALUE_FIELDS.includes(k)) continue;
-    out[k] = v;
+function readApiKey() {
+  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
+  if (fromEnv) return fromEnv;
+  const path2 = credentialsPath();
+  if (!existsSync8(path2)) return null;
+  try {
+    const creds = JSON.parse(readFileSync7(path2, "utf-8"));
+    const key = creds["apiKey"] ?? creds["api_key"];
+    if (typeof key === "string" && key.trim().length > 0) return key.trim();
+  } catch {
+  }
+  return null;
+}
+var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
+var DEFAULT_TIER_TIMEOUT_MS = 5e3;
+function getConfiguredApiRoot() {
+  const raw2 = (process.env["PRETENSE_API_URL"] ?? DEFAULT_PRETENSE_API_URL).trim();
+  if (!raw2) return DEFAULT_PRETENSE_API_URL;
+  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
+  try {
+    const u = new URL(normalized);
+    const origin = /^pretense\.ai$/i.test(u.hostname) ? DEFAULT_PRETENSE_API_URL : u.origin;
+    const path2 = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${origin}${path2}`;
+  } catch {
+    return DEFAULT_PRETENSE_API_URL;
+  }
+}
+function tierRequestTimeoutMs() {
+  const raw2 = process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
+  if (!raw2 || !/^\d+$/.test(raw2)) return DEFAULT_TIER_TIMEOUT_MS;
+  return Math.min(Math.max(parseInt(raw2, 10), 1e3), 12e4);
+}
+function planToTier(plan) {
+  switch (String(plan).toUpperCase()) {
+    case "FREE":
+      return "free";
+    case "PRO":
+      return "pro";
+    case "ENTERPRISE":
+      return "enterprise";
+    default:
+      return null;
+  }
+}
+async function tierFromBackend(apiKey) {
+  const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), tierRequestTimeoutMs());
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (resp.status === 401 || resp.status === 403) {
+      return {
+        tier: null,
+        source: "unverified",
+        detail: "the server rejected this API key \u2014 run `pretense auth login` again"
+      };
+    }
+    if (!resp.ok) {
+      return {
+        tier: null,
+        source: "unverified",
+        detail: `the plan service returned HTTP ${resp.status}`
+      };
+    }
+    const body = await resp.json();
+    const tier = planToTier(body["plan"]);
+    if (body["valid"] === false || !tier) {
+      return {
+        tier: null,
+        source: "unverified",
+        detail: "the plan service did not report a recognizable plan"
+      };
+    }
+    return { tier, source: "backend" };
+  } catch (err) {
+    const aborted = err?.name === "AbortError";
+    return {
+      tier: null,
+      source: "unverified",
+      detail: aborted ? `could not reach ${url} within ${tierRequestTimeoutMs()}ms` : `could not reach ${url}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolvePlanTier(opts = {}) {
+  const apiKey = readApiKey();
+  if (!apiKey) return { tier: "free", source: "no-credentials" };
+  const fromPrefix = tierFromApiKey(apiKey);
+  if (fromPrefix) return { tier: fromPrefix, source: "key-prefix" };
+  if (opts.offline) {
+    return {
+      tier: null,
+      source: "unverified",
+      detail: "--offline was set, and a dashboard key carries no plan of its own"
+    };
+  }
+  return tierFromBackend(apiKey);
+}
+var QUOTA_PERIOD_DAYS2 = 7;
+function collectUsage(dbPath) {
+  const now = /* @__PURE__ */ new Date();
+  const periodMs = QUOTA_PERIOD_DAYS2 * 24 * 60 * 60 * 1e3;
+  const periodStartTs = Date.now() - periodMs;
+  const sinceMs = periodMs;
+  let store = null;
+  try {
+    store = new AuditStore(dbPath);
+    const stats = store.getStats(sinceMs);
+    return {
+      periodStartTs,
+      metrics: {
+        tenantId: "local",
+        // The trailing window these numbers actually cover — previously the
+        // calendar month, which did not match the aggregation OR the quota.
+        periodStart: new Date(periodStartTs).toISOString().split("T")[0],
+        periodEnd: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
+        mutationsApplied: stats.totalMutationsApplied,
+        secretsBlocked: stats.totalSecretsBlocked,
+        piiRedacted: stats.totalPiiRedacted,
+        totalScans: stats.totalRequests,
+        bytesProtected: 0,
+        activeSeats: 1,
+        providers: Object.fromEntries(stats.topProviders.map((p) => [p.provider, p.count]))
+      }
+    };
+  } catch {
+    return null;
+  } finally {
+    store?.close();
+  }
+}
+function resetCadenceLabel() {
+  return `every ${QUOTA_PERIOD_DAYS2} days`;
+}
+function priceLabel(tier) {
+  const cents = PLAN_CONFIGS[tier].pricePerSeatCents;
+  if (cents === null) return "custom \u2014 contact sales";
+  return cents === 0 ? "free" : `$${cents / 100}/seat/month`;
+}
+function tierName(tier) {
+  return { free: "Free", pro: "Pro", enterprise: "Enterprise" }[tier];
+}
+function tierLabel(tier) {
+  if (tier === null) return "Unknown (unverified)";
+  if (tier === "free") return "Free";
+  return `${tierName(tier)} (${priceLabel(tier)})`;
+}
+function planMismatchHint(resolution) {
+  if (resolution.tier !== "free" || resolution.source !== "backend") return [];
+  return [
+    "Not the plan you expected? An org flagged PRO without an active",
+    "subscription/comp resolves to Free \u2014 see pretense.ai/dashboard/settings or contact support."
+  ];
+}
+function unverifiedNote(detail) {
+  return [
+    `Could not confirm your plan: ${detail ?? "unknown reason"}.`,
+    "Limits are not shown because guessing could under- or over-state what you pay for."
+  ];
+}
+
+// src/commands/doctor.ts
+var BASE_URL_ENVS = [
+  { name: "ANTHROPIC_BASE_URL", provider: "Claude / Claude Code" },
+  { name: "OPENAI_BASE_URL", provider: "OpenAI / Cursor / any OpenAI-compatible" },
+  { name: "GEMINI_BASE_URL", provider: "Google Gemini" },
+  { name: "GOOGLE_GEMINI_BASE_URL", provider: "Google Gemini (legacy var)" }
+];
+var COMMON_PORTS = Array.from({ length: 7 }, (_, i) => 9339 + i);
+async function probePort(port, timeoutMs = 700) {
+  const ctrl = new AbortController();
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await fetch(`http://localhost:${port}/health`, { signal: ctrl.signal });
+    if (!res.ok) return { alive: true, isPretense: false };
+    const hasHeader = res.headers.has("x-pretense-version");
+    let body = {};
+    try {
+      body = await res.json();
+    } catch {
+      return { alive: true, isPretense: false };
+    }
+    const looksPretense = hasHeader && "auditAvailable" in body && "version" in body;
+    return {
+      alive: true,
+      isPretense: looksPretense,
+      status: typeof body["status"] === "string" ? body["status"] : void 0,
+      auditAvailable: typeof body["auditAvailable"] === "boolean" ? body["auditAvailable"] : void 0
+    };
+  } catch {
+    return { alive: false, isPretense: false };
+  } finally {
+    clearTimeout(t);
+  }
+}
+function portFromBaseUrl(value) {
+  try {
+    const u = new URL(value);
+    if (u.port) return parseInt(u.port, 10);
+    return u.protocol === "https:" ? 443 : 80;
+  } catch {
+    return null;
+  }
+}
+function doctorCommand() {
+  return new Command3("doctor").description("Diagnose why the proxy isn't catching your traffic (read-only; exits non-zero if this shell is unprotected)").option("--offline", "Skip the plan-service lookup", false).action(async (opts) => {
+    let problems = 0;
+    const note = (s) => console.log(s);
+    console.log(chalk3.bold.cyan("\n  Pretense Doctor\n"));
+    note(chalk3.bold("  Proxy"));
+    const record = readProxyRecord(pidFilePath());
+    let recordedPort = null;
+    if (record) {
+      if (isProcessAlive(record.pid)) {
+        const probe = await probePort(record.port);
+        if (probe.isPretense) {
+          recordedPort = record.port;
+          const degraded = probe.status === "degraded" || probe.auditAvailable === false;
+          note(chalk3.green(`  \u2713 Pretense proxy running on :${record.port} (pid ${record.pid}).`));
+          if (degraded) {
+            note(chalk3.yellow(`    \u26A0 Audit store unavailable \u2014 requests are still filtered, but ` + chalk3.cyan("pretense audit") + chalk3.yellow(" will be empty this session.")));
+          }
+        } else if (probe.alive) {
+          problems += 1;
+          note(chalk3.yellow(`  \u26A0 Pidfile says a proxy is on :${record.port} (pid ${record.pid}), but that port is answering as something ELSE.`));
+          note(chalk3.dim(`    Something took the port. Stop the stray process, then ` + chalk3.cyan("pretense start") + chalk3.dim(".")));
+        } else {
+          problems += 1;
+          note(chalk3.yellow(`  \u26A0 Pidfile records pid ${record.pid} on :${record.port}, but it is not answering /health.`));
+          note(chalk3.dim("    It may be starting, wedged, or dead. Try ") + chalk3.cyan("pretense stop") + chalk3.dim(" then ") + chalk3.cyan("pretense start") + chalk3.dim("."));
+        }
+      } else {
+        problems += 1;
+        note(chalk3.yellow(`  \u26A0 Stale pidfile: pid ${record.pid} (port ${record.port}) is no longer alive.`));
+        note(chalk3.dim("    Harmless, cleared on the next ") + chalk3.cyan("pretense start") + chalk3.dim("."));
+      }
+    } else {
+      note(chalk3.dim("  \u25CB No Pretense proxy recorded (pidfile absent)."));
+    }
+    const stray = [];
+    for (const p of COMMON_PORTS) {
+      if (p === recordedPort) continue;
+      const probe = await probePort(p, 400);
+      if (probe.isPretense) stray.push(p);
+    }
+    if (stray.length > 0) {
+      note(chalk3.yellow(`  \u26A0 Other Pretense proxies answering on: ${stray.map((p) => `:${p}`).join(", ")}.`));
+      note(chalk3.dim("    Multiple proxies can send your tool to the wrong one. ") + chalk3.cyan("pretense stop") + chalk3.dim(" clears the recorded one; stop extras by pid."));
+    }
+    note(chalk3.bold("\n  This shell"));
+    const setEnvs = BASE_URL_ENVS.filter((e) => (process.env[e.name] ?? "").trim() !== "");
+    let protectedHere = false;
+    if (setEnvs.length === 0) {
+      problems += 1;
+      note(chalk3.red("  \u2717 No base-URL env var is set in THIS terminal \u2014 your AI tool here is NOT protected."));
+      note(chalk3.dim("    Env vars are per-shell: a proxy running elsewhere does not protect this terminal."));
+      note(chalk3.dim("    Simplest fix (no export, no second terminal):"));
+      note("      " + chalk3.cyan('pretense run claude "\u2026"') + chalk3.dim("   # or cursor, gemini, any tool"));
+      if (recordedPort !== null) {
+        note(chalk3.dim("    Or, IN THIS terminal:"));
+        note("      " + chalk3.cyan(`export ANTHROPIC_BASE_URL=http://localhost:${recordedPort}`));
+      }
+    } else {
+      for (const e of setEnvs) {
+        const val = (process.env[e.name] ?? "").trim();
+        const port = portFromBaseUrl(val);
+        if (port === null) {
+          problems += 1;
+          note(chalk3.red(`  \u2717 ${e.name}=${val} is not a valid URL.`));
+          continue;
+        }
+        const probe = await probePort(port);
+        if (probe.isPretense) {
+          protectedHere = true;
+          note(chalk3.green(`  \u2713 ${e.name} \u2192 :${port} is a live Pretense proxy (${e.provider}).`));
+        } else if (probe.alive) {
+          problems += 1;
+          note(chalk3.red(`  \u2717 ${e.name} \u2192 :${port} is answering, but it is NOT a Pretense proxy.`));
+          note(chalk3.dim("    Your traffic is going somewhere, but not through the firewall. Fix the URL or use ") + chalk3.cyan("pretense run") + chalk3.dim("."));
+        } else {
+          problems += 1;
+          note(chalk3.red(`  \u2717 ${e.name} \u2192 :${port} is set, but nothing is listening there.`));
+          note(chalk3.dim("    Start the proxy (") + chalk3.cyan("pretense start") + chalk3.dim(") or, simplest, use ") + chalk3.cyan("pretense run") + chalk3.dim("."));
+        }
+      }
+    }
+    note(chalk3.bold("\n  Plan"));
+    try {
+      const resolution = await resolvePlanTier({ offline: opts.offline });
+      note(chalk3.dim(`  Plan: ${tierLabel(resolution.tier)}`));
+      for (const line of planMismatchHint(resolution)) {
+        note(chalk3.dim(`  ${line}`));
+      }
+    } catch {
+      note(chalk3.dim("  Plan: could not be resolved (offline or no credentials)."));
+    }
+    if (protectedHere && problems === 0) {
+      note(chalk3.bold.green("\n  \u2713 This shell is protected \u2014 traffic routes through Pretense.\n"));
+      process.exitCode = 0;
+    } else if (protectedHere) {
+      note(chalk3.bold.yellow(`
+  \u26A0 This shell is protected, but doctor found ${problems} thing(s) to look at above.
+`));
+      process.exitCode = 1;
+    } else {
+      note(chalk3.bold.red("\n  \u2717 This shell is NOT protected. Use ") + chalk3.cyan("pretense run <tool>") + chalk3.bold.red(" \u2014 it wires everything for you.\n"));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/stop.ts
+function pidListeningOn2(port) {
+  try {
+    const out = execSync2(`lsof -nP -iTCP:${port} -sTCP:LISTEN -t`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+    const pid = parseInt(out.split("\n")[0] ?? "", 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+async function isRecordOurs(record) {
+  const port = record.port;
+  if (port > 0) {
+    const probe = await probePort(port, 700);
+    const listener = pidListeningOn2(port);
+    if (probe.isPretense) {
+      return listener === null || listener === record.pid;
+    }
+    return listener !== null && listener === record.pid;
+  }
+  return true;
+}
+function stopCommand() {
+  return new Command4("stop").description("Stop the running Pretense proxy").option("--json", "Machine-readable outcome", false).action(async (opts) => {
+    const path2 = pidFilePath();
+    const record = readProxyRecord(path2);
+    if (record && isProcessAlive(record.pid) && !await isRecordOurs(record)) {
+      removeProxyRecord(path2);
+      const outcome2 = { kind: "foreign", pid: record.pid, port: record.port };
+      if (opts.json) {
+        console.log(JSON.stringify(outcome2, null, 2));
+        process.exit(0);
+      }
+      console.log(
+        chalk4.yellow(`
+  \xB7 Not stopping pid ${record.pid}: it is not the Pretense proxy.`) + chalk4.dim(`
+    The recorded proxy (port ${record.port}) is gone and that pid now`) + chalk4.dim(`
+    belongs to an unrelated process \u2014 Pretense will not signal it.`) + chalk4.dim(`
+    Cleaned up the stale record; nothing was killed.
+`)
+      );
+      process.exit(0);
+    }
+    const outcome = await stopProxy(path2);
+    if (opts.json) {
+      console.log(JSON.stringify(outcome, null, 2));
+      process.exit(outcome.kind === "refused" || outcome.kind === "not-permitted" ? 1 : 0);
+    }
+    switch (outcome.kind) {
+      case "not-running":
+        console.log(
+          chalk4.dim(`
+  \xB7 No running Pretense proxy recorded (${path2} does not exist).`) + chalk4.dim(`
+    Start one with `) + chalk4.cyan("pretense start") + "\n"
+        );
+        process.exit(0);
+        break;
+      case "stale":
+        console.log(
+          chalk4.yellow(
+            `
+  \xB7 Stale PID file cleaned up${outcome.pid ? ` (pid ${outcome.pid} is not running)` : ""}.`
+          ) + chalk4.dim(`
+    No proxy was running.
+`)
+        );
+        process.exit(0);
+        break;
+      case "stopped":
+        console.log(
+          chalk4.green(
+            `
+  \u2713 Pretense proxy stopped (pid ${outcome.pid}${outcome.port ? `, port ${outcome.port}` : ""})` + (outcome.forced ? " \u2014 did not exit on SIGTERM, sent SIGKILL" : "") + "\n"
+          )
+        );
+        process.exit(0);
+        break;
+      case "not-permitted":
+        console.error(
+          chalk4.red(`
+  x Cannot stop pid ${outcome.pid}: it belongs to another user.`) + chalk4.dim(`
+    The proxy is still running. Stop it as its owner, or: sudo kill ${outcome.pid}
+`)
+        );
+        process.exit(1);
+        break;
+      case "refused":
+        console.error(
+          chalk4.red(`
+  x Pid ${outcome.pid} is still alive after SIGTERM and SIGKILL.`) + chalk4.dim(`
+    ${path2} was left in place so you can investigate: ps -p ${outcome.pid}
+`)
+        );
+        process.exit(1);
+        break;
+    }
+  });
+}
+
+// src/commands/scan.ts
+init_esm_shims();
+import { Command as Command5, Option, InvalidArgumentError as InvalidArgumentError2 } from "commander";
+import chalk5 from "chalk";
+import { readFileSync as readFileSync8, statSync as statSync3, readdirSync as readdirSync2, openSync, readSync, closeSync } from "fs";
+import { execSync as execSync3 } from "child_process";
+import { resolve as resolve3, join as join8, extname as extname2, basename } from "path";
+
+// src/safe-output.ts
+init_esm_shims();
+var UNSAFE_VALUES_FLAG = "--unsafe-show-values";
+function lineColFromOffset2(text, offset) {
+  const clamped = Math.max(0, Math.min(offset, text.length));
+  let line = 1;
+  let lineStart = 0;
+  for (let i = 0; i < clamped; i++) {
+    if (text.charCodeAt(i) === 10) {
+      line++;
+      lineStart = i + 1;
+    }
+  }
+  return { line, column: clamped - lineStart + 1 };
+}
+function withLocations(result, content) {
+  const locate = (m) => lineColFromOffset2(content, m.start);
+  return {
+    ...result,
+    matches: result.matches.map((m) => ({ ...m, ...locate(m) }))
+  };
+}
+function safeLocator(m) {
+  const len = Math.max(0, m.end - m.start);
+  if (m.deobfuscated && len === 0) return "len=0 unmapped";
+  const pos = m.line !== void 0 && m.column !== void 0 ? `L${m.line}:${m.column} ` : "";
+  return `${pos}len=${len}${m.deobfuscated ? " enc" : ""}`;
+}
+var VALUE_FIELDS = ["value", "masked", "deobfuscatedValue"];
+function stripRow(row) {
+  const out = {};
+  for (const [k, v] of Object.entries(row)) {
+    if (VALUE_FIELDS.includes(k)) continue;
+    out[k] = v;
   }
   out.length = typeof row.end === "number" && typeof row.start === "number" ? row.end - row.start : 0;
   return out;
@@ -18349,7 +18823,7 @@ function isBinaryFile(filePath) {
 }
 var SEVERITY_ORDER = { low: 0, medium: 1, high: 2, critical: 3 };
 function collectFiles(target) {
-  const abs = resolve2(target);
+  const abs = resolve3(target);
   let stat;
   try {
     stat = statSync3(abs);
@@ -18404,7 +18878,7 @@ function walkDir(dir) {
   } catch (err) {
     if (isSkippableWalkError(err)) {
       const code = err.code;
-      console.error(chalk4.yellow(`  Skipping unreadable path (${code}): ${dir}`));
+      console.error(chalk5.yellow(`  Skipping unreadable path (${code}): ${dir}`));
       return files;
     }
     throw err;
@@ -18412,16 +18886,16 @@ function walkDir(dir) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRS.has(entry.name)) continue;
-      files.push(...walkDir(join7(dir, entry.name)));
+      files.push(...walkDir(join8(dir, entry.name)));
     } else if (entry.isFile()) {
-      files.push(join7(dir, entry.name));
+      files.push(join8(dir, entry.name));
     }
   }
   return files;
 }
 function gitExecChecked(cmd) {
   try {
-    const out = execSync2(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const out = execSync3(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     return { ok: true, lines: out ? out.split("\n").filter(Boolean) : [] };
   } catch (err) {
     const e = err;
@@ -18468,7 +18942,7 @@ function warnIfLargeForL2(byteLength, filePath) {
   const mb = (byteLength / (1024 * 1024)).toFixed(1);
   const where = filePath ? ` \u2014 ${basename(filePath)}` : "";
   console.error(
-    chalk4.yellow(
+    chalk5.yellow(
       `  Note: L2 AST scanning is slow on very large files (${mb}MB${where}); this may take a while.`
     )
   );
@@ -18531,14 +19005,14 @@ async function scanContentRaw(content, opts, filePath) {
   return result;
 }
 async function scanFile(filePath, opts) {
-  const content = readFileSync7(filePath, "utf-8");
+  const content = readFileSync8(filePath, "utf-8");
   return scanContent(content, opts, filePath);
 }
 function severityIcon(severity) {
   return severity === "critical" ? "\u{1F534}" : severity === "high" ? "\u{1F7E0}" : severity === "medium" ? "\u{1F7E1}" : "\u{1F535}";
 }
 function levelTag(level) {
-  return level === 2 ? chalk4.magenta("L2") : chalk4.blue("L1");
+  return level === 2 ? chalk5.magenta("L2") : chalk5.blue("L1");
 }
 function rowTail(match3, opts) {
   if (opts.unsafeShowValues) return match3.masked;
@@ -18549,12 +19023,12 @@ function emitResult(result, opts) {
 }
 function printFindings(filePath, result, opts) {
   if (result.clean) return;
-  console.log(chalk4.underline(`
+  console.log(chalk5.underline(`
   ${filePath}`));
   for (const match3 of result.matches) {
-    const actionColor = match3.action === "block" ? chalk4.red : match3.action === "redact" ? chalk4.yellow : chalk4.dim;
+    const actionColor = match3.action === "block" ? chalk5.red : match3.action === "redact" ? chalk5.yellow : chalk5.dim;
     console.log(
-      `    ${severityIcon(match3.severity)}  ${levelTag(match3.level)}  ${chalk4.bold(match3.type.padEnd(30))} ${actionColor(match3.action.padEnd(8))} ${chalk4.dim(rowTail(match3, opts))}`
+      `    ${severityIcon(match3.severity)}  ${levelTag(match3.level)}  ${chalk5.bold(match3.type.padEnd(30))} ${actionColor(match3.action.padEnd(8))} ${chalk5.dim(rowTail(match3, opts))}`
     );
   }
 }
@@ -18640,7 +19114,7 @@ async function scanFiles(files, opts) {
   let blocked = 0;
   for (const f of files) {
     if (isBinaryFile(f)) {
-      console.error(chalk4.dim(`  Skipping binary file: ${f}`));
+      console.error(chalk5.dim(`  Skipping binary file: ${f}`));
       continue;
     }
     try {
@@ -18682,17 +19156,17 @@ async function outputMultiFileResults(label, files, opts, { defaultSarif = false
     }
     if (files.length === 0) {
       console.error(
-        chalk4.yellow(`
-  No supported files found in ${label}.`) + chalk4.dim(`
+        chalk5.yellow(`
+  No supported files found in ${label}.`) + chalk5.dim(`
   Supported: ${SUPPORTED_EXTENSIONS_DISPLAY}
 `)
       );
     } else {
       console.log(
-        chalk4.yellow(`
-  No supported source files found.`) + chalk4.dim(`
+        chalk5.yellow(`
+  No supported source files found.`) + chalk5.dim(`
   Currently supports: TypeScript, JavaScript, Python, Go, Java, C#, Ruby, Rust
-`) + chalk4.dim(`  (${SUPPORTED_EXTENSIONS_DISPLAY})
+`) + chalk5.dim(`  (${SUPPORTED_EXTENSIONS_DISPLAY})
 `)
       );
     }
@@ -18723,18 +19197,18 @@ async function outputMultiFileResults(label, files, opts, { defaultSarif = false
   if (allResults.length === 0) {
     if (notice) console.log(notice);
     if (policyLine) console.log(policyLine);
-    console.log(chalk4.green(`  \u2713 No secrets or PII detected`));
+    console.log(chalk5.green(`  \u2713 No secrets or PII detected`));
     process.exit(0);
   }
-  console.log(chalk4.cyan(`
+  console.log(chalk5.cyan(`
   Pretense Scan \u2014 ${label}
 `));
-  console.log(chalk4.dim(`  Files: ${sourceFiles.length} | Patterns: ${getPatternCount()} | Levels: ${levelsLabel(opts)}
+  console.log(chalk5.dim(`  Files: ${sourceFiles.length} | Patterns: ${getPatternCount()} | Levels: ${levelsLabel(opts)}
 `));
   if (policyLine) console.log(policyLine + "\n");
   if (notice) console.log(notice + "\n");
   for (const { file, result } of allResults) printFindings(file, result, opts);
-  console.log(chalk4.dim(`
+  console.log(chalk5.dim(`
   Total: ${total} findings | ${blocked} blocked
 `));
   process.exit(findingsExitCode);
@@ -18764,7 +19238,7 @@ function levelOption() {
 function parseLevel(v) {
   if (v === "1") return 1;
   if (v === "2") return 2;
-  throw new InvalidArgumentError("Detection level must be 1 (regex) or 2 (AST).");
+  throw new InvalidArgumentError2("Detection level must be 1 (regex) or 2 (AST).");
 }
 function levelsLabel(opts) {
   if (opts.level === 1) return "L1 only (--level 1)";
@@ -18776,13 +19250,13 @@ function l2Notice(results, opts) {
   if (isAstCoreAvailable()) {
     const errored = results.filter((r) => r.result.l2?.parseErrors).length;
     if (errored > 0) {
-      return chalk4.yellow(
+      return chalk5.yellow(
         `  ! L2 parsed ${errored} file(s) with syntax errors \u2014 AST findings may be incomplete. L1 results are unaffected.`
       );
     }
     return null;
   }
-  return chalk4.yellow(
+  return chalk5.yellow(
     "  ! L2 unavailable \u2014 the native AST addon (@pretense/scanner-rs) is not installed for this platform.\n    Scanned with L1 (regex) only. All L1 findings are reported in full; no finding was dropped."
   );
 }
@@ -18794,9 +19268,9 @@ function validateScanFlags(opts) {
     const raw2 = String(opts.format).trim().toLowerCase();
     if (!VALID_FORMATS.includes(raw2)) {
       console.error(
-        chalk4.red(`
+        chalk5.red(`
   x Unknown --format: "${opts.format}"
-`) + chalk4.dim(`  Valid formats: ${VALID_FORMATS.join(", ")}.
+`) + chalk5.dim(`  Valid formats: ${VALID_FORMATS.join(", ")}.
 `)
       );
       process.exit(USAGE_EXIT);
@@ -18807,9 +19281,9 @@ function validateScanFlags(opts) {
     const raw2 = String(opts.severity).trim().toLowerCase();
     if (!VALID_SEVERITIES.includes(raw2)) {
       console.error(
-        chalk4.red(`
+        chalk5.red(`
   x Unknown --severity: "${opts.severity}"
-`) + chalk4.dim(`  Valid severities: ${VALID_SEVERITIES.join(", ")}.
+`) + chalk5.dim(`  Valid severities: ${VALID_SEVERITIES.join(", ")}.
 `)
       );
       process.exit(USAGE_EXIT);
@@ -18826,7 +19300,7 @@ function applyPolicy(opts) {
       if (resolved.scannerPreset) opts.presetName = resolved.scannerPreset;
     }
   } catch (err) {
-    console.error(chalk4.red(`
+    console.error(chalk5.red(`
   x ${err.message}
 `));
     process.exit(USAGE_EXIT);
@@ -18836,15 +19310,15 @@ function applyPolicy(opts) {
 function policyNotice(opts) {
   if (!opts.policyResolved) return null;
   const p = opts.policyResolved;
-  const line = chalk4.dim(`  ${describePolicy(p)}`);
-  return p.scannerPreset ? line : chalk4.yellow(`  ! ${describePolicy(p)}`);
+  const line = chalk5.dim(`  ${describePolicy(p)}`);
+  return p.scannerPreset ? line : chalk5.yellow(`  ! ${describePolicy(p)}`);
 }
 function inheritedScanOpts(cmd) {
   return cmd.optsWithGlobals();
 }
 function ciSubcommand() {
   return addScanOpts(
-    new Command4("ci").description("CI-optimized scan (non-interactive, exit code 0=clean 2=findings)").argument("[path]", "File or directory to scan (default: all git-tracked files)").allowExcessArguments(false)
+    new Command5("ci").description("CI-optimized scan (non-interactive, exit code 0=clean 2=findings)").argument("[path]", "File or directory to scan (default: all git-tracked files)").allowExcessArguments(false)
   ).action(async (target, opts, cmd) => {
     opts = inheritedScanOpts(cmd);
     applyPolicy(opts);
@@ -18852,8 +19326,8 @@ function ciSubcommand() {
       const files2 = collectFiles(target);
       if (files2.length === 0) {
         console.error(
-          chalk4.red(`
-  x Path not found or empty: ${target}`) + chalk4.dim(`
+          chalk5.red(`
+  x Path not found or empty: ${target}`) + chalk5.dim(`
   Try: pretense scan ci <file-or-directory>, or omit the path to scan git-tracked files.
 `)
         );
@@ -18865,11 +19339,11 @@ function ciSubcommand() {
     const tracked = gitExecChecked("git ls-files");
     if (!tracked.ok) {
       console.error(
-        chalk4.red(`
-  x scan ci could not enumerate git-tracked files \u2014 NOTHING WAS SCANNED.`) + chalk4.dim(`
-    git: ${tracked.error}`) + chalk4.dim(`
-    This is a scan FAILURE (exit 1), not a clean result. Reporting 0 here`) + chalk4.dim(`
-    would mark a CI gate green over a tree that was never read.`) + chalk4.dim(`
+        chalk5.red(`
+  x scan ci could not enumerate git-tracked files \u2014 NOTHING WAS SCANNED.`) + chalk5.dim(`
+    git: ${tracked.error}`) + chalk5.dim(`
+    This is a scan FAILURE (exit 1), not a clean result. Reporting 0 here`) + chalk5.dim(`
+    would mark a CI gate green over a tree that was never read.`) + chalk5.dim(`
     Fix the checkout, or scan a path directly: pretense scan ci <path>
 `)
       );
@@ -18885,7 +19359,7 @@ function ciSubcommand() {
 }
 function commitRangeSubcommand() {
   return addScanOpts(
-    new Command4("commit-range").description("Scan files changed between two commits").argument("<range>", "Commit range (e.g. base..head)")
+    new Command5("commit-range").description("Scan files changed between two commits").argument("<range>", "Commit range (e.g. base..head)")
   ).action(async (range, opts, cmd) => {
     opts = inheritedScanOpts(cmd);
     applyPolicy(opts);
@@ -18893,7 +19367,7 @@ function commitRangeSubcommand() {
     if (files.length === 0) {
       const fmt2 = resolveFormat(opts);
       if (fmt2 === "json") console.log(JSON.stringify({ clean: true, files: 0, findings: 0 }));
-      else console.log(chalk4.green("  \u2713 No changed files in range"));
+      else console.log(chalk5.green("  \u2713 No changed files in range"));
       process.exit(0);
     }
     await outputMultiFileResults(`commit-range ${range}`, files, opts);
@@ -18901,7 +19375,7 @@ function commitRangeSubcommand() {
 }
 function preCommitSubcommand() {
   return addScanOpts(
-    new Command4("pre-commit").description("Scan git staged files")
+    new Command5("pre-commit").description("Scan git staged files")
   ).action(async (opts, cmd) => {
     opts = inheritedScanOpts(cmd);
     applyPolicy(opts);
@@ -18909,23 +19383,79 @@ function preCommitSubcommand() {
     if (files.length === 0) {
       const fmt2 = resolveFormat(opts);
       if (fmt2 === "json") console.log(JSON.stringify({ clean: true, files: 0, findings: 0 }));
-      else console.log(chalk4.green("  \u2713 No staged files to scan"));
+      else console.log(chalk5.green("  \u2713 No staged files to scan"));
       process.exit(0);
     }
     await outputMultiFileResults(`pre-commit (${files.length} staged files)`, files, opts);
   });
 }
+function isZeroOid(oid) {
+  return /^0+$/.test(oid.trim());
+}
+function emptyTreeOid() {
+  const r = gitExecChecked("git hash-object -t tree /dev/null");
+  return r.ok && r.lines[0] ? r.lines[0] : "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+}
+function changedFilesForPush(localSha, remoteSha) {
+  if (isZeroOid(localSha)) return { ok: true, lines: [] };
+  if (!isZeroOid(remoteSha)) {
+    return gitExecChecked(`git diff --name-only ${remoteSha} ${localSha}`);
+  }
+  const revs = gitExecChecked(`git rev-list ${localSha} --not --remotes`);
+  if (revs.ok && revs.lines.length > 0) {
+    const oldest = revs.lines[revs.lines.length - 1];
+    const parent = gitExecChecked(`git rev-parse --verify --quiet ${oldest}^`);
+    const base = parent.ok && parent.lines[0] ? parent.lines[0] : emptyTreeOid();
+    return gitExecChecked(`git diff --name-only ${base} ${localSha}`);
+  }
+  if (!revs.ok) return revs;
+  return gitExecChecked(`git diff --name-only ${emptyTreeOid()} ${localSha}`);
+}
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  try {
+    for await (const c of process.stdin) chunks.push(c);
+  } catch {
+    return "";
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
 function prePushSubcommand() {
   return addScanOpts(
-    new Command4("pre-push").description("Scan files changed between local and remote")
+    new Command5("pre-push").description("Scan the commits being pushed (reads git's pre-push ref lines on stdin)")
   ).action(async (opts, cmd) => {
     opts = inheritedScanOpts(cmd);
     applyPolicy(opts);
-    const files = filterExisting(gitExec("git diff --name-only @{push}..HEAD"));
+    const stdin = await readStdin();
+    const refLines = stdin.split("\n").map((l) => l.trim()).filter(Boolean);
+    const changed = /* @__PURE__ */ new Set();
+    if (refLines.length > 0) {
+      for (const line of refLines) {
+        const [, localSha, , remoteSha] = line.split(/\s+/);
+        if (!localSha || !remoteSha) continue;
+        const r = changedFilesForPush(localSha, remoteSha);
+        if (!r.ok) {
+          console.error(
+            chalk5.red(`
+  x pre-push: could not determine what is being pushed \u2014 NOTHING WAS SCANNED.`) + chalk5.dim(`
+    git: ${r.error}`) + chalk5.dim(`
+    Blocking the push (exit 1) rather than letting an unscanned commit through.`) + chalk5.dim(`
+    Override at your own risk with: git push --no-verify
+`)
+          );
+          process.exit(1);
+        }
+        for (const f of r.lines) changed.add(f);
+      }
+    } else {
+      for (const f of gitExec("git diff --name-only @{push}..HEAD")) changed.add(f);
+    }
+    const files = filterExisting([...changed]);
     if (files.length === 0) {
       const fmt2 = resolveFormat(opts);
       if (fmt2 === "json") console.log(JSON.stringify({ clean: true, files: 0, findings: 0 }));
-      else console.log(chalk4.green("  \u2713 No changed files to push"));
+      else console.log(chalk5.green("  \u2713 No changed files to push"));
       process.exit(0);
     }
     await outputMultiFileResults(`pre-push (${files.length} changed files)`, files, opts);
@@ -18933,15 +19463,15 @@ function prePushSubcommand() {
 }
 function pathSubcommand() {
   return addScanOpts(
-    new Command4("path").description("Scan a file or directory (recursive)").argument("<target>", "File or directory to scan")
+    new Command5("path").description("Scan a file or directory (recursive)").argument("<target>", "File or directory to scan")
   ).action(async (target, opts, cmd) => {
     opts = inheritedScanOpts(cmd);
     applyPolicy(opts);
     const files = collectFiles(target);
     if (files.length === 0) {
       console.error(
-        chalk4.red(`
-  x Path not found or empty: ${target}`) + chalk4.dim(`
+        chalk5.red(`
+  x Path not found or empty: ${target}`) + chalk5.dim(`
   Try: pretense scan path <file-or-directory>
 `)
       );
@@ -18951,7 +19481,7 @@ function pathSubcommand() {
   });
 }
 function scanCommand() {
-  const cmd = new Command4("scan").description("Scan for secrets and PII (file, directory, or git-aware modes)").argument("[file]", "File to scan (omit to read from stdin)").allowExcessArguments(false).option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option(
+  const cmd = new Command5("scan").description("Scan for secrets and PII (file, directory, or git-aware modes)").argument("[file]", "File to scan (omit to read from stdin)").allowExcessArguments(false).option("--json", "Output results as JSON (alias for --format json)", false).option("--format <fmt>", "Output format: text, json, sarif, csv (default: text)").option("--severity <lvl>", "Minimum severity to report: low, medium, high, critical").option("--no-entropy", "Disable entropy-based detection", false).option(
     "--policy <preset>",
     // A preset RE-WEIGHTS detector severity/action for that framework
     // (see compliance-preset.ts `actionOverrides`). It does NOT narrow the
@@ -18974,8 +19504,8 @@ function scanCommand() {
           const allFiles = collectFiles(file);
           if (allFiles.length === 0) {
             console.error(
-              chalk4.yellow(`
-  No supported files found in ${file}.`) + chalk4.dim(`
+              chalk5.yellow(`
+  No supported files found in ${file}.`) + chalk5.dim(`
   Supported: ${SUPPORTED_EXTENSIONS_DISPLAY}
 `)
             );
@@ -18986,17 +19516,17 @@ function scanCommand() {
       } catch {
       }
       if (isBinaryFile(file)) {
-        console.error(chalk4.yellow(`
+        console.error(chalk5.yellow(`
   Skipping binary file: ${file}
 `));
         process.exit(0);
       }
       try {
-        content = readFileSync7(file, "utf-8");
+        content = readFileSync8(file, "utf-8");
       } catch {
         console.error(
-          chalk4.red(`
-  x Cannot read file: ${file}`) + chalk4.dim(`
+          chalk5.red(`
+  x Cannot read file: ${file}`) + chalk5.dim(`
   Try: check the file exists and you have read permission.
 `)
         );
@@ -19005,7 +19535,7 @@ function scanCommand() {
     } else {
       if (process.stdin.isTTY) {
         console.error(
-          chalk4.yellow("\n  x Nothing to scan.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+          chalk5.yellow("\n  x Nothing to scan.\n") + chalk5.dim("  Scan this project:   ") + chalk5.cyan("pretense scan .") + "\n" + chalk5.dim("  Scan a path:         ") + chalk5.cyan("pretense scan <file-or-dir>") + "\n" + chalk5.dim("  Or pipe content:     ") + chalk5.cyan("cat file | pretense scan") + "\n"
         );
         process.exit(USAGE_EXIT);
       }
@@ -19014,7 +19544,7 @@ function scanCommand() {
       content = Buffer.concat(chunks).toString("utf-8");
       if (content.trim() === "") {
         console.error(
-          chalk4.yellow("\n  x Nothing to scan \u2014 no file argument and empty input.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+          chalk5.yellow("\n  x Nothing to scan \u2014 no file argument and empty input.\n") + chalk5.dim("  Scan this project:   ") + chalk5.cyan("pretense scan .") + "\n" + chalk5.dim("  Scan a path:         ") + chalk5.cyan("pretense scan <file-or-dir>") + "\n" + chalk5.dim("  Or pipe content:     ") + chalk5.cyan("cat file | pretense scan") + "\n"
         );
         process.exit(USAGE_EXIT);
       }
@@ -19032,466 +19562,295 @@ function scanCommand() {
       console.log(JSON.stringify(toSarif(fileResults, opts ?? {}), null, 2));
       process.exit(result.clean ? 0 : 1);
     }
-    if (fmt2 === "csv") {
-      const fileResults = result.clean ? [] : [{ file: file ?? "stdin", result }];
-      console.log(toCsv(fileResults, opts ?? {}));
-      process.exit(result.clean ? 0 : 1);
-    }
-    console.log(chalk4.cyan(`
-  Pretense Scan \u2014 ${file ?? "stdin"}
-`));
-    console.log(chalk4.dim(`  Patterns: ${getPatternCount()} | Levels: ${levelsLabel(opts)} | Duration: ${result.durationMs}ms
-`));
-    {
-      const policyLine = policyNotice(opts);
-      if (policyLine) console.log(policyLine + "\n");
-    }
-    if (opts.level !== 1 && result.l2 && !result.l2.ran && result.l2.reason) {
-      console.log(chalk4.yellow(`  ! ${result.l2.reason}`));
-      console.log(chalk4.dim("    L1 (regex) ran in full; no finding was dropped.\n"));
-    }
-    if (result.clean) {
-      console.log(chalk4.green("  \u2713 No secrets or PII detected\n"));
-      process.exit(0);
-    }
-    for (const match3 of result.matches) {
-      const actionColor = match3.action === "block" ? chalk4.red : match3.action === "redact" ? chalk4.yellow : chalk4.dim;
-      console.log(
-        `  ${severityIcon(match3.severity)}  ${levelTag(match3.level)}  ${chalk4.bold(match3.type.padEnd(30))} ${actionColor(match3.action.padEnd(8))} ${chalk4.dim(rowTail(match3, opts ?? {}))}`
-      );
-    }
-    const blocked = result.matches.filter((m) => m.action === "block").length;
-    const redacted = result.matches.filter((m) => m.action === "redact").length;
-    console.log(chalk4.dim(`
-  Total: ${result.matches.length} findings | ${blocked} blocked, ${redacted} redacted
-`));
-    process.exit(1);
-  });
-  cmd.addCommand(ciSubcommand());
-  cmd.addCommand(commitRangeSubcommand());
-  cmd.addCommand(preCommitSubcommand());
-  cmd.addCommand(prePushSubcommand());
-  cmd.addCommand(pathSubcommand());
-  cmd.exitOverride((err) => {
-    process.exit(err.exitCode === 0 ? 0 : 3);
-  });
-  return cmd;
-}
-
-// src/commands/status.ts
-init_esm_shims();
-import { Command as Command5 } from "commander";
-import chalk5 from "chalk";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join8 } from "path";
-function statusCommand() {
-  return new Command5("status").description("Show Pretense protection status").action(async () => {
-    const dir = process.cwd();
-    const fingerprintPath = join8(dir, ".pretense", "fingerprint.json");
-    const configPath = join8(dir, "pretense.yaml");
-    console.log(chalk5.cyan("\n  Pretense Status\n"));
-    const record = readProxyRecord(pidFilePath());
-    if (record && !isProcessAlive(record.pid)) {
-      console.log(
-        chalk5.yellow(
-          `  \u25CB Proxy not running  ${chalk5.dim(`(stale record for pid ${record.pid}; run: pretense start)`)}`
-        )
-      );
-    } else {
-      const port = record && record.port > 0 ? record.port : 9339;
-      try {
-        const resp = await fetch(`http://localhost:${port}/health`, { signal: AbortSignal.timeout(1e3) });
-        if (!resp.ok) throw new Error(`health returned ${resp.status}`);
-        const health = await resp.json();
-        console.log(chalk5.green(`  \u2713 Proxy running on :${port} (uptime: ${health["uptime"]}s)`));
-        const stats = health["stats"];
-        console.log(chalk5.dim(`    Requests: ${stats["requestsProcessed"] ?? 0} | Mutations: ${stats["mutationsApplied"] ?? 0} | Blocked: ${stats["secretsBlocked"] ?? 0}`));
-      } catch {
-        console.log(chalk5.yellow(`  \u25CB Proxy not running  ${chalk5.dim("(run: pretense start)")}`));
-      }
-    }
-    if (existsSync8(configPath)) {
-      console.log(chalk5.green(`  \u2713 Config: pretense.yaml`));
-    } else {
-      console.log(chalk5.yellow(`  \u25CB No config  ${chalk5.dim("(run: pretense config)")}`));
-    }
-    if (existsSync8(fingerprintPath)) {
-      try {
-        const fp = JSON.parse(readFileSync8(fingerprintPath, "utf-8"));
-        const age = Math.round((Date.now() - fp.scannedAt) / (60 * 1e3));
-        console.log(chalk5.green(`  \u2713 Fingerprint: ${fp.filesScanned} files, ${fp.functions.length + fp.classes.length + fp.constants.length} identifiers`));
-        console.log(chalk5.dim(`    Last scanned: ${age} minutes ago`));
-      } catch {
-        console.log(chalk5.yellow("  \u26A0  Fingerprint corrupted  (run: pretense init)"));
-      }
-    } else {
-      console.log(chalk5.yellow(`  \u25CB No fingerprint  ${chalk5.dim("(run: pretense init)")}`));
-    }
-    console.log(chalk5.dim(`
-  Scanner: ${getPatternCount()} patterns active
-`));
-  });
-}
-
-// src/commands/config.ts
-init_esm_shims();
-import { Command as Command6 } from "commander";
-import chalk6 from "chalk";
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join9 } from "path";
-import YAML2 from "yaml";
-var DEFAULT_CONFIG = {
-  version: 1,
-  languages: ["typescript", "python", "java", "go", "ruby", "rust"],
-  exclude_paths: ["node_modules", ".git", "dist"],
-  mutation_mode: "full",
-  output_format: "interactive"
-};
-function findConfigPath() {
-  const cwd = process.cwd();
-  const candidates = [".pretense.yaml", "pretense.yaml"];
-  for (const name of candidates) {
-    const full = join9(cwd, name);
-    if (existsSync9(full)) return full;
-  }
-  return null;
-}
-function loadConfig2() {
-  const path2 = findConfigPath();
-  if (!path2) return { ...DEFAULT_CONFIG };
-  try {
-    const raw2 = readFileSync9(path2, "utf-8");
-    return YAML2.parse(raw2) ?? { ...DEFAULT_CONFIG };
-  } catch {
-    return { ...DEFAULT_CONFIG };
-  }
-}
-function configFilePath() {
-  return findConfigPath() ?? join9(process.cwd(), "pretense.yaml");
-}
-function getNestedValue(obj, key) {
-  const parts = key.split(".");
-  let cur = obj;
-  for (const p of parts) {
-    if (cur == null || typeof cur !== "object") return void 0;
-    cur = cur[p];
-  }
-  return cur;
-}
-function setNestedValue(obj, key, value) {
-  const parts = key.split(".");
-  const leaf = parts.pop();
-  if (leaf === void 0) return;
-  let cur = obj;
-  for (const p of parts) {
-    const child = cur[p];
-    if (child == null || typeof child !== "object" || Array.isArray(child)) {
-      cur[p] = {};
-    }
-    cur = cur[p];
-  }
-  cur[leaf] = value;
-}
-function parseValue(raw2) {
-  if (raw2.startsWith("[") && raw2.endsWith("]")) {
-    return raw2.slice(1, -1).split(",").map((s) => s.trim()).filter(Boolean);
-  }
-  if (raw2 === "true") return true;
-  if (raw2 === "false") return false;
-  const n = Number(raw2);
-  if (!Number.isNaN(n) && raw2.length > 0) return n;
-  return raw2;
-}
-function configCommand() {
-  const cmd = new Command6("config").description("Manage pretense configuration");
-  cmd.command("list").description("Print current configuration").action(() => {
-    const config = loadConfig2();
-    const path2 = findConfigPath();
-    console.log(
-      chalk6.cyan(`
-  Pretense Config`) + chalk6.dim(` (${path2 ?? "defaults - no config file found"})
-`)
-    );
-    console.log(YAML2.stringify(config).replace(/^/gm, "  "));
-  });
-  cmd.command("get").description("Print a single config value").argument("<key>", "Config key (supports dotted paths)").action((key) => {
-    const config = loadConfig2();
-    const val = getNestedValue(config, key);
-    if (val === void 0) {
-      console.error(chalk6.red(`
-  \u2717 Key not found: ${key}
-`));
-      process.exit(1);
-    }
-    const display = typeof val === "object" ? JSON.stringify(val) : String(val);
-    console.log(display);
-  });
-  cmd.command("set").description("Set a config value").argument("<key>", "Config key (supports dotted paths)").argument("<value>", "Value to set").action((key, rawValue) => {
-    const config = loadConfig2();
-    const value = parseValue(rawValue);
-    setNestedValue(config, key, value);
-    const outPath = configFilePath();
-    writeFileSync4(outPath, YAML2.stringify(config));
-    console.log(chalk6.green(`
-  \u2713 Set ${key} = ${JSON.stringify(value)} in ${outPath}
+    if (fmt2 === "csv") {
+      const fileResults = result.clean ? [] : [{ file: file ?? "stdin", result }];
+      console.log(toCsv(fileResults, opts ?? {}));
+      process.exit(result.clean ? 0 : 1);
+    }
+    console.log(chalk5.cyan(`
+  Pretense Scan \u2014 ${file ?? "stdin"}
 `));
-  });
-  cmd.option("--force", "Overwrite existing config with defaults", false).action((opts) => {
-    if (opts.force) {
-      const outPath = join9(process.cwd(), "pretense.yaml");
-      writeFileSync4(outPath, YAML2.stringify(DEFAULT_CONFIG));
-      console.log(chalk6.green(`
-  \u2713 Created pretense.yaml
+    console.log(chalk5.dim(`  Patterns: ${getPatternCount()} | Levels: ${levelsLabel(opts)} | Duration: ${result.durationMs}ms
 `));
-    } else {
-      cmd.help();
+    {
+      const policyLine = policyNotice(opts);
+      if (policyLine) console.log(policyLine + "\n");
+    }
+    if (opts.level !== 1 && result.l2 && !result.l2.ran && result.l2.reason) {
+      console.log(chalk5.yellow(`  ! ${result.l2.reason}`));
+      console.log(chalk5.dim("    L1 (regex) ran in full; no finding was dropped.\n"));
+    }
+    if (result.clean) {
+      console.log(chalk5.green("  \u2713 No secrets or PII detected\n"));
+      process.exit(0);
+    }
+    for (const match3 of result.matches) {
+      const actionColor = match3.action === "block" ? chalk5.red : match3.action === "redact" ? chalk5.yellow : chalk5.dim;
+      console.log(
+        `  ${severityIcon(match3.severity)}  ${levelTag(match3.level)}  ${chalk5.bold(match3.type.padEnd(30))} ${actionColor(match3.action.padEnd(8))} ${chalk5.dim(rowTail(match3, opts ?? {}))}`
+      );
     }
+    const blocked = result.matches.filter((m) => m.action === "block").length;
+    const redacted = result.matches.filter((m) => m.action === "redact").length;
+    console.log(chalk5.dim(`
+  Total: ${result.matches.length} findings | ${blocked} blocked, ${redacted} redacted
+`));
+    process.exit(1);
+  });
+  cmd.addCommand(ciSubcommand());
+  cmd.addCommand(commitRangeSubcommand());
+  cmd.addCommand(preCommitSubcommand());
+  cmd.addCommand(prePushSubcommand());
+  cmd.addCommand(pathSubcommand());
+  cmd.exitOverride((err) => {
+    process.exit(err.exitCode === 0 ? 0 : 3);
   });
   return cmd;
 }
 
-// src/commands/logs.ts
+// src/commands/status.ts
 init_esm_shims();
-import { Command as Command7 } from "commander";
-import chalk7 from "chalk";
-import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
-function logsCommand() {
-  return new Command7("logs").description("Show recent audit log entries").option("-l, --limit <n>", "Number of entries to show", "50").option("--json", "Output as JSON", false).action((opts) => {
-    const limit = parseInt(opts.limit, 10);
-    let store;
-    let entries;
-    try {
-      store = new AuditStore(join10(homedir4(), ".pretense", "audit.db"));
-      entries = store.getRecentEntries(limit);
-      store.close();
-    } catch {
-      if (opts.json) {
-        console.log("[]");
-        return;
+import { Command as Command6 } from "commander";
+import chalk6 from "chalk";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
+function statusCommand() {
+  return new Command6("status").description("Show Pretense protection status").action(async () => {
+    const dir = process.cwd();
+    const fingerprintPath = join9(dir, ".pretense", "fingerprint.json");
+    const configPath = join9(dir, "pretense.yaml");
+    console.log(chalk6.cyan("\n  Pretense Status\n"));
+    const record = readProxyRecord(pidFilePath());
+    if (record && !isProcessAlive(record.pid)) {
+      console.log(
+        chalk6.yellow(
+          `  \u25CB Proxy not running  ${chalk6.dim(`(stale record for pid ${record.pid}; run: pretense start)`)}`
+        )
+      );
+    } else {
+      const port = record && record.port > 0 ? record.port : 9339;
+      try {
+        const resp = await fetch(`http://localhost:${port}/health`, { signal: AbortSignal.timeout(1e3) });
+        if (!resp.ok) throw new Error(`health returned ${resp.status}`);
+        const health = await resp.json();
+        console.log(chalk6.green(`  \u2713 Proxy running on :${port} (uptime: ${health["uptime"]}s)`));
+        const stats = health["stats"];
+        console.log(chalk6.dim(`    Requests: ${stats["requestsProcessed"] ?? 0} | Mutations: ${stats["mutationsApplied"] ?? 0} | Blocked: ${stats["secretsBlocked"] ?? 0}`));
+      } catch {
+        console.log(chalk6.yellow(`  \u25CB Proxy not running  ${chalk6.dim("(run: pretense start)")}`));
       }
-      console.error(chalk7.dim("\n  No audit data available. The audit database has not been initialized yet."));
-      console.error(chalk7.dim("  Run " + chalk7.cyan("pretense start") + " and make some requests first.\n"));
-      return;
     }
-    if (opts.json) {
-      console.log(JSON.stringify(entries, null, 2));
-      return;
+    if (existsSync9(configPath)) {
+      console.log(chalk6.green(`  \u2713 Config: pretense.yaml`));
+    } else {
+      console.log(chalk6.yellow(`  \u25CB No config  ${chalk6.dim("(run: pretense config)")}`));
     }
-    if (entries.length === 0) {
-      console.log(chalk7.dim("\n  No audit entries yet. Run pretense start and make some requests.\n"));
-      return;
+    if (existsSync9(fingerprintPath)) {
+      try {
+        const fp = JSON.parse(readFileSync9(fingerprintPath, "utf-8"));
+        const age = Math.round((Date.now() - fp.scannedAt) / (60 * 1e3));
+        console.log(chalk6.green(`  \u2713 Fingerprint: ${fp.filesScanned} files, ${fp.functions.length + fp.classes.length + fp.constants.length} identifiers`));
+        console.log(chalk6.dim(`    Last scanned: ${age} minutes ago`));
+      } catch {
+        console.log(chalk6.yellow("  \u26A0  Fingerprint corrupted  (run: pretense init)"));
+      }
+    } else {
+      console.log(chalk6.yellow(`  \u25CB No fingerprint  ${chalk6.dim("(run: pretense init)")}`));
     }
-    console.log(chalk7.cyan(`
-  Pretense Audit Log \u2014 last ${entries.length} entries
+    console.log(chalk6.dim(`
+  Scanner: ${getPatternCount()} patterns active
 `));
-    console.log(chalk7.dim("  " + "TIME".padEnd(10) + "ACTION".padEnd(12) + "PROVIDER".padEnd(14) + "MUTATIONS".padEnd(12) + "BLOCKED".padEnd(10) + "MS"));
-    console.log(chalk7.dim("  " + "\u2500".repeat(70)));
-    for (const entry of entries) {
-      const time = new Date(entry.timestamp).toTimeString().slice(0, 8);
-      const actionColor = entry.action === "blocked" ? chalk7.red : entry.action === "mutated" ? chalk7.green : entry.action === "redacted" ? chalk7.yellow : entry.action === "error" ? chalk7.red : chalk7.dim;
-      console.log(
-        "  " + chalk7.dim(time.padEnd(10)) + actionColor(entry.action.padEnd(12)) + chalk7.dim(entry.provider.padEnd(14)) + chalk7.dim(String(entry.mutationsApplied).padEnd(12)) + (entry.secretsBlocked > 0 ? chalk7.red(String(entry.secretsBlocked).padEnd(10)) : chalk7.dim("0".padEnd(10))) + chalk7.dim(String(entry.scanDurationMs).slice(0, 5))
-      );
-    }
-    console.log();
   });
 }
 
-// src/commands/usage.ts
-init_esm_shims();
-import { Command as Command8 } from "commander";
-import chalk8 from "chalk";
-import { join as join12 } from "path";
-import { homedir as homedir6 } from "os";
-
-// src/plan-usage.ts
+// src/commands/config.ts
 init_esm_shims();
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
-import { join as join11 } from "path";
-import { homedir as homedir5 } from "os";
-function credentialsPath() {
-  return join11(homedir5(), ".pretense", "credentials.json");
-}
-function readApiKey() {
-  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
-  if (fromEnv) return fromEnv;
-  const path2 = credentialsPath();
-  if (!existsSync10(path2)) return null;
-  try {
-    const creds = JSON.parse(readFileSync10(path2, "utf-8"));
-    const key = creds["apiKey"] ?? creds["api_key"];
-    if (typeof key === "string" && key.trim().length > 0) return key.trim();
-  } catch {
-  }
-  return null;
-}
-var DEFAULT_PRETENSE_API_URL = "https://api.pretense.ai";
-var DEFAULT_TIER_TIMEOUT_MS = 5e3;
-function getConfiguredApiRoot() {
-  const raw2 = (process.env["PRETENSE_API_URL"] ?? DEFAULT_PRETENSE_API_URL).trim();
-  if (!raw2) return DEFAULT_PRETENSE_API_URL;
-  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
-  try {
-    const u = new URL(normalized);
-    const origin = /^pretense\.ai$/i.test(u.hostname) ? DEFAULT_PRETENSE_API_URL : u.origin;
-    const path2 = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
-    return `${origin}${path2}`;
-  } catch {
-    return DEFAULT_PRETENSE_API_URL;
-  }
-}
-function tierRequestTimeoutMs() {
-  const raw2 = process.env["PRETENSE_API_TIMEOUT_MS"]?.trim();
-  if (!raw2 || !/^\d+$/.test(raw2)) return DEFAULT_TIER_TIMEOUT_MS;
-  return Math.min(Math.max(parseInt(raw2, 10), 1e3), 12e4);
-}
-function planToTier(plan) {
-  switch (String(plan).toUpperCase()) {
-    case "FREE":
-      return "free";
-    case "PRO":
-      return "pro";
-    case "ENTERPRISE":
-      return "enterprise";
-    default:
-      return null;
-  }
-}
-async function tierFromBackend(apiKey) {
-  const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), tierRequestTimeoutMs());
-  try {
-    const resp = await fetch(url, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-      body: "{}",
-      signal: controller.signal
-    });
-    if (resp.status === 401 || resp.status === 403) {
-      return {
-        tier: null,
-        source: "unverified",
-        detail: "the server rejected this API key \u2014 run `pretense auth login` again"
-      };
-    }
-    if (!resp.ok) {
-      return {
-        tier: null,
-        source: "unverified",
-        detail: `the plan service returned HTTP ${resp.status}`
-      };
-    }
-    const body = await resp.json();
-    const tier = planToTier(body["plan"]);
-    if (body["valid"] === false || !tier) {
-      return {
-        tier: null,
-        source: "unverified",
-        detail: "the plan service did not report a recognizable plan"
-      };
-    }
-    return { tier, source: "backend" };
-  } catch (err) {
-    const aborted = err?.name === "AbortError";
-    return {
-      tier: null,
-      source: "unverified",
-      detail: aborted ? `could not reach ${url} within ${tierRequestTimeoutMs()}ms` : `could not reach ${url}`
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function resolvePlanTier(opts = {}) {
-  const apiKey = readApiKey();
-  if (!apiKey) return { tier: "free", source: "no-credentials" };
-  const fromPrefix = tierFromApiKey(apiKey);
-  if (fromPrefix) return { tier: fromPrefix, source: "key-prefix" };
-  if (opts.offline) {
-    return {
-      tier: null,
-      source: "unverified",
-      detail: "--offline was set, and a dashboard key carries no plan of its own"
-    };
-  }
-  return tierFromBackend(apiKey);
-}
-var QUOTA_PERIOD_DAYS2 = 7;
-function collectUsage(dbPath) {
-  const now = /* @__PURE__ */ new Date();
-  const periodMs = QUOTA_PERIOD_DAYS2 * 24 * 60 * 60 * 1e3;
-  const periodStartTs = Date.now() - periodMs;
-  const sinceMs = periodMs;
-  let store = null;
-  try {
-    store = new AuditStore(dbPath);
-    const stats = store.getStats(sinceMs);
-    return {
-      periodStartTs,
-      metrics: {
-        tenantId: "local",
-        // The trailing window these numbers actually cover — previously the
-        // calendar month, which did not match the aggregation OR the quota.
-        periodStart: new Date(periodStartTs).toISOString().split("T")[0],
-        periodEnd: (/* @__PURE__ */ new Date()).toISOString().split("T")[0],
-        mutationsApplied: stats.totalMutationsApplied,
-        secretsBlocked: stats.totalSecretsBlocked,
-        piiRedacted: stats.totalPiiRedacted,
-        totalScans: stats.totalRequests,
-        bytesProtected: 0,
-        activeSeats: 1,
-        providers: Object.fromEntries(stats.topProviders.map((p) => [p.provider, p.count]))
-      }
-    };
+import { Command as Command7 } from "commander";
+import chalk7 from "chalk";
+import { writeFileSync as writeFileSync4, readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join10 } from "path";
+import YAML2 from "yaml";
+var DEFAULT_CONFIG = {
+  version: 1,
+  languages: ["typescript", "python", "java", "go", "ruby", "rust"],
+  exclude_paths: ["node_modules", ".git", "dist"],
+  mutation_mode: "full",
+  output_format: "interactive"
+};
+function findConfigPath() {
+  const cwd = process.cwd();
+  const candidates = [".pretense.yaml", "pretense.yaml"];
+  for (const name of candidates) {
+    const full = join10(cwd, name);
+    if (existsSync10(full)) return full;
+  }
+  return null;
+}
+function loadConfig2() {
+  const path2 = findConfigPath();
+  if (!path2) return { ...DEFAULT_CONFIG };
+  try {
+    const raw2 = readFileSync10(path2, "utf-8");
+    return YAML2.parse(raw2) ?? { ...DEFAULT_CONFIG };
   } catch {
-    return null;
-  } finally {
-    store?.close();
+    return { ...DEFAULT_CONFIG };
   }
 }
-function resetCadenceLabel() {
-  return `every ${QUOTA_PERIOD_DAYS2} days`;
+function configFilePath() {
+  return findConfigPath() ?? join10(process.cwd(), "pretense.yaml");
 }
-function priceLabel(tier) {
-  const cents = PLAN_CONFIGS[tier].pricePerSeatCents;
-  if (cents === null) return "custom \u2014 contact sales";
-  return cents === 0 ? "free" : `$${cents / 100}/seat/month`;
+function getNestedValue(obj, key) {
+  const parts = key.split(".");
+  let cur = obj;
+  for (const p of parts) {
+    if (cur == null || typeof cur !== "object") return void 0;
+    cur = cur[p];
+  }
+  return cur;
 }
-function tierName(tier) {
-  return { free: "Free", pro: "Pro", enterprise: "Enterprise" }[tier];
+function setNestedValue(obj, key, value) {
+  const parts = key.split(".");
+  const leaf = parts.pop();
+  if (leaf === void 0) return;
+  let cur = obj;
+  for (const p of parts) {
+    const child = cur[p];
+    if (child == null || typeof child !== "object" || Array.isArray(child)) {
+      cur[p] = {};
+    }
+    cur = cur[p];
+  }
+  cur[leaf] = value;
 }
-function tierLabel(tier) {
-  if (tier === null) return "Unknown (unverified)";
-  if (tier === "free") return "Free";
-  return `${tierName(tier)} (${priceLabel(tier)})`;
+function parseValue(raw2) {
+  if (raw2.startsWith("[") && raw2.endsWith("]")) {
+    return raw2.slice(1, -1).split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (raw2 === "true") return true;
+  if (raw2 === "false") return false;
+  const n = Number(raw2);
+  if (!Number.isNaN(n) && raw2.length > 0) return n;
+  return raw2;
 }
-function unverifiedNote(detail) {
-  return [
-    `Could not confirm your plan: ${detail ?? "unknown reason"}.`,
-    "Limits are not shown because guessing could under- or over-state what you pay for."
-  ];
+function configCommand() {
+  const cmd = new Command7("config").description("Manage pretense configuration");
+  cmd.command("list").description("Print current configuration").action(() => {
+    const config = loadConfig2();
+    const path2 = findConfigPath();
+    console.log(
+      chalk7.cyan(`
+  Pretense Config`) + chalk7.dim(` (${path2 ?? "defaults - no config file found"})
+`)
+    );
+    console.log(YAML2.stringify(config).replace(/^/gm, "  "));
+  });
+  cmd.command("get").description("Print a single config value").argument("<key>", "Config key (supports dotted paths)").action((key) => {
+    const config = loadConfig2();
+    const val = getNestedValue(config, key);
+    if (val === void 0) {
+      console.error(chalk7.red(`
+  \u2717 Key not found: ${key}
+`));
+      process.exit(1);
+    }
+    const display = typeof val === "object" ? JSON.stringify(val) : String(val);
+    console.log(display);
+  });
+  cmd.command("set").description("Set a config value").argument("<key>", "Config key (supports dotted paths)").argument("<value>", "Value to set").action((key, rawValue) => {
+    const config = loadConfig2();
+    const value = parseValue(rawValue);
+    setNestedValue(config, key, value);
+    const outPath = configFilePath();
+    writeFileSync4(outPath, YAML2.stringify(config));
+    console.log(chalk7.green(`
+  \u2713 Set ${key} = ${JSON.stringify(value)} in ${outPath}
+`));
+  });
+  cmd.option("--force", "Overwrite existing config with defaults", false).action((opts) => {
+    if (opts.force) {
+      const outPath = join10(process.cwd(), "pretense.yaml");
+      writeFileSync4(outPath, YAML2.stringify(DEFAULT_CONFIG));
+      console.log(chalk7.green(`
+  \u2713 Created pretense.yaml
+`));
+    } else {
+      cmd.help();
+    }
+  });
+  return cmd;
+}
+
+// src/commands/logs.ts
+init_esm_shims();
+import { Command as Command8 } from "commander";
+import chalk8 from "chalk";
+import { homedir as homedir5 } from "os";
+import { join as join11 } from "path";
+function logsCommand() {
+  return new Command8("logs").description("Show recent audit log entries").option("-l, --limit <n>", "Number of entries to show", "50").option("--json", "Output as JSON", false).action((opts) => {
+    const limit = parseInt(opts.limit, 10);
+    let store;
+    let entries;
+    try {
+      store = new AuditStore(join11(homedir5(), ".pretense", "audit.db"));
+      entries = store.getRecentEntries(limit);
+      store.close();
+    } catch {
+      if (opts.json) {
+        console.log("[]");
+        return;
+      }
+      console.error(chalk8.dim("\n  No audit data available. The audit database has not been initialized yet."));
+      console.error(chalk8.dim("  Run " + chalk8.cyan("pretense start") + " and make some requests first.\n"));
+      return;
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(entries, null, 2));
+      return;
+    }
+    if (entries.length === 0) {
+      console.log(chalk8.dim("\n  No audit entries yet. Run pretense start and make some requests.\n"));
+      return;
+    }
+    console.log(chalk8.cyan(`
+  Pretense Audit Log \u2014 last ${entries.length} entries
+`));
+    console.log(chalk8.dim("  " + "TIME".padEnd(10) + "ACTION".padEnd(12) + "PROVIDER".padEnd(14) + "MUTATIONS".padEnd(12) + "BLOCKED".padEnd(10) + "MS"));
+    console.log(chalk8.dim("  " + "\u2500".repeat(70)));
+    for (const entry of entries) {
+      const time = new Date(entry.timestamp).toTimeString().slice(0, 8);
+      const actionColor = entry.action === "blocked" ? chalk8.red : entry.action === "mutated" ? chalk8.green : entry.action === "redacted" ? chalk8.yellow : entry.action === "error" ? chalk8.red : chalk8.dim;
+      console.log(
+        "  " + chalk8.dim(time.padEnd(10)) + actionColor(entry.action.padEnd(12)) + chalk8.dim(entry.provider.padEnd(14)) + chalk8.dim(String(entry.mutationsApplied).padEnd(12)) + (entry.secretsBlocked > 0 ? chalk8.red(String(entry.secretsBlocked).padEnd(10)) : chalk8.dim("0".padEnd(10))) + chalk8.dim(String(entry.scanDurationMs).slice(0, 5))
+      );
+    }
+    console.log();
+  });
 }
 
 // src/commands/usage.ts
+init_esm_shims();
+import { Command as Command9 } from "commander";
+import chalk9 from "chalk";
+import { join as join12 } from "path";
+import { homedir as homedir6 } from "os";
 function renderBar(percent, width = 30) {
   const filled = Math.min(Math.round(percent / 100 * width), width);
   const empty = width - filled;
   const bar2 = "\u2588".repeat(filled) + "\u2591".repeat(empty);
-  if (percent >= 100) return chalk8.red(bar2);
-  if (percent >= 90) return chalk8.yellow(bar2);
-  if (percent >= 80) return chalk8.yellow(bar2);
-  return chalk8.green(bar2);
+  if (percent >= 100) return chalk9.red(bar2);
+  if (percent >= 90) return chalk9.yellow(bar2);
+  if (percent >= 80) return chalk9.yellow(bar2);
+  return chalk9.green(bar2);
 }
 function formatMetric(value, limit) {
   if (limit === null) return `${value.toLocaleString("en-US")} / unlimited`;
   return `${value.toLocaleString("en-US")} / ${limit.toLocaleString("en-US")}`;
 }
 function percentLabel(percent) {
-  if (percent >= 100) return chalk8.red("OVER LIMIT");
-  if (percent >= 80) return chalk8.yellow(`${percent}%`);
-  return chalk8.green(`${percent}%`);
+  if (percent >= 100) return chalk9.red("OVER LIMIT");
+  if (percent >= 80) return chalk9.yellow(`${percent}%`);
+  return chalk9.green(`${percent}%`);
 }
 function emptyUsagePayload(resolution) {
   const tier = resolution.tier;
@@ -19513,7 +19872,7 @@ function emptyUsagePayload(resolution) {
   };
 }
 function usageCommand() {
-  return new Command8("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join12(homedir6(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command9("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join12(homedir6(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);
@@ -19524,7 +19883,7 @@ function usageCommand() {
         return;
       }
       console.log(
-        chalk8.yellow("\n  No audit data found. Run ") + chalk8.cyan("pretense start") + chalk8.yellow(" and make some requests first.\n")
+        chalk9.yellow("\n  No audit data found. Run ") + chalk9.cyan("pretense start") + chalk9.yellow(" and make some requests first.\n")
       );
       return;
     }
@@ -19567,7 +19926,7 @@ function usageCommand() {
     }
     const resetDate = resetCadenceLabel();
     console.log(
-      chalk8.cyan(
+      chalk9.cyan(
         "\n  Pretense Usage \u2014 " + // Header shows today's date, NOT a billing month: quotas roll on a
         // 7-day window anchored to signup, so a month name would imply a
         // reset boundary that does not exist.
@@ -19578,11 +19937,14 @@ function usageCommand() {
         })
       )
     );
-    console.log(chalk8.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetDate}
+    console.log(chalk9.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetDate}
 `));
+    for (const line of planMismatchHint(resolution)) {
+      console.log(chalk9.dim(`  ${line}`));
+    }
     if (!tier) {
       for (const line of unverifiedNote(resolution.detail)) {
-        console.log(chalk8.yellow(`  ${line}`));
+        console.log(chalk9.yellow(`  ${line}`));
       }
       console.log();
       console.log("  " + "Mutations".padEnd(20) + usageMetrics.mutationsApplied.toLocaleString("en-US"));
@@ -19595,42 +19957,42 @@ function usageCommand() {
     const overall = maxUsagePercent(usageMetrics, tier);
     const nextTier = recommendedTier(usageMetrics, tier);
     console.log(
-      "  " + chalk8.bold("Metric".padEnd(20)) + chalk8.bold("Used / Limit".padEnd(30)) + chalk8.bold("Progress")
+      "  " + chalk9.bold("Metric".padEnd(20)) + chalk9.bold("Used / Limit".padEnd(30)) + chalk9.bold("Progress")
     );
-    console.log("  " + chalk8.dim("\u2500".repeat(72)));
+    console.log("  " + chalk9.dim("\u2500".repeat(72)));
     const rows = [
       { label: "Mutations", value: usageMetrics.mutationsApplied, limit: planConfig.mutationsPerPeriod },
       { label: "API Requests", value: usageMetrics.totalScans, limit: planConfig.scansPerPeriod }
     ];
     for (const row of rows) {
       const percent = row.limit === null ? 0 : Math.round(row.value / row.limit * 100);
-      const bar2 = row.limit === null ? chalk8.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
+      const bar2 = row.limit === null ? chalk9.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
       console.log(
         "  " + row.label.padEnd(20) + formatMetric(row.value, row.limit).padEnd(30) + bar2 + "  " + (row.limit === null ? "" : percentLabel(percent))
       );
     }
     console.log(
-      "  " + "Secrets Blocked".padEnd(20) + String(usageMetrics.secretsBlocked.toLocaleString("en-US")).padEnd(30) + chalk8.dim("(no limit)")
+      "  " + "Secrets Blocked".padEnd(20) + String(usageMetrics.secretsBlocked.toLocaleString("en-US")).padEnd(30) + chalk9.dim("(no limit)")
     );
-    console.log("  " + chalk8.dim("\u2500".repeat(72)));
+    console.log("  " + chalk9.dim("\u2500".repeat(72)));
     if (tier === "enterprise") {
-      console.log(chalk8.green("\n  Enterprise plan \u2014 all limits are unlimited.\n"));
+      console.log(chalk9.green("\n  Enterprise plan \u2014 all limits are unlimited.\n"));
     } else if (overall >= 100) {
-      console.log(chalk8.red(`
+      console.log(chalk9.red(`
   LIMIT REACHED (${overall}% of ${tierLabel(tier)} plan used).`));
     } else if (overall >= 90) {
       console.log(
-        chalk8.yellow(
+        chalk9.yellow(
           `
   WARNING: ${overall}% of your ${tierLabel(tier)} plan used \u2014 approaching limit.`
         )
       );
     } else if (overall >= 80) {
-      console.log(chalk8.yellow(`
+      console.log(chalk9.yellow(`
   NOTICE: ${overall}% of your ${tierLabel(tier)} plan used.`));
     } else {
       console.log(
-        chalk8.green(`
+        chalk9.green(`
   ${overall}% of your ${tierLabel(tier)} plan used \u2014 you're in good shape.`)
       );
     }
@@ -19642,12 +20004,12 @@ function usageCommand() {
         enterprise: "Unlimited mutations + SSO + on-prem + SIEM"
       };
       console.log(
-        chalk8.cyan(`
+        chalk9.cyan(`
   Upgrade to ${tierName(nextTier)} (${priceLabel(nextTier)}):`)
       );
-      console.log(chalk8.dim(`  ${upgradeBenefit[nextTier]}`));
+      console.log(chalk9.dim(`  ${upgradeBenefit[nextTier]}`));
       console.log(
-        chalk8.bold(`
+        chalk9.bold(`
   \u2192 https://pretense.ai/pricing?ref=cli_usage&from=${tier}
 `)
       );
@@ -19659,12 +20021,12 @@ function usageCommand() {
 
 // src/commands/auth.ts
 init_esm_shims();
-import { Command as Command9 } from "commander";
-import chalk9 from "chalk";
+import { Command as Command10 } from "commander";
+import chalk10 from "chalk";
 import { existsSync as existsSync11, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
 import { join as join13 } from "path";
 import { homedir as homedir7 } from "os";
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 var CREDENTIALS_DIR = join13(homedir7(), ".pretense");
 var CREDENTIALS_PATH = join13(CREDENTIALS_DIR, "credentials.json");
 async function verifyApiKey(apiKey) {
@@ -19708,7 +20070,7 @@ async function verifyApiKey(apiKey) {
   }
 }
 function storageNotice() {
-  return chalk9.dim(`  Stored: ${CREDENTIALS_PATH}`) + chalk9.dim(`
+  return chalk10.dim(`  Stored: ${CREDENTIALS_PATH}`) + chalk10.dim(`
   Mode:   0600 (file), 0700 (~/.pretense) \u2014 plaintext, not encrypted
 `);
 }
@@ -19731,15 +20093,15 @@ function maskApiKey(key) {
 function openUrl(url) {
   try {
     if (process.platform === "darwin") {
-      execSync3(`open ${url}`, { stdio: "ignore" });
+      execSync4(`open ${url}`, { stdio: "ignore" });
     } else {
-      execSync3(`xdg-open ${url}`, { stdio: "ignore" });
+      execSync4(`xdg-open ${url}`, { stdio: "ignore" });
     }
   } catch {
   }
 }
 function authCommand() {
-  const auth = new Command9("auth").description("Manage CLI authentication");
+  const auth = new Command10("auth").description("Manage CLI authentication");
   auth.command("login").description("Verify and store a Pretense API key (or open the browser flow)").option("--api-key <key>", "API key to store (e.g. pt-****)").option("--key <key>", "API key to store (alias for --api-key)").option(
     "--offline",
     "Skip server verification and store the key unverified (says so in the output)",
@@ -19758,9 +20120,9 @@ function authCommand() {
       const isValidFormat = validPrefixes.some((prefix) => opts.apiKey.startsWith(prefix));
       if (!isValidFormat) {
         console.error(
-          chalk9.red(`
-  x Invalid API key format.`) + chalk9.dim(`
-  Key must start with prtns_live_, prtns_test_, or a legacy pt-free-/pt-pro-/pt-ent- prefix`) + chalk9.dim(`
+          chalk10.red(`
+  x Invalid API key format.`) + chalk10.dim(`
+  Key must start with prtns_live_, prtns_test_, or a legacy pt-free-/pt-pro-/pt-ent- prefix`) + chalk10.dim(`
   Try: pretense auth login  (opens browser to get a valid key)
 `)
         );
@@ -19775,10 +20137,10 @@ function authCommand() {
         const existing = readCredentials();
         if (existing?.verified === true) {
           console.error(
-            chalk9.red("\n  x The API key was rejected \u2014 your existing key was kept.") + chalk9.dim(`
-  Rejected: ${maskApiKey(opts.apiKey)}`) + chalk9.dim(`
-  Kept:     ${maskApiKey(existing.api_key)} (verified ${existing.verified_at ?? "?"})`) + chalk9.dim(`
-  Server:   ${verification.url}`) + chalk9.dim(`
+            chalk10.red("\n  x The API key was rejected \u2014 your existing key was kept.") + chalk10.dim(`
+  Rejected: ${maskApiKey(opts.apiKey)}`) + chalk10.dim(`
+  Kept:     ${maskApiKey(existing.api_key)} (verified ${existing.verified_at ?? "?"})`) + chalk10.dim(`
+  Server:   ${verification.url}`) + chalk10.dim(`
   Reason:   ${verification.detail}
 `)
           );
@@ -19793,10 +20155,10 @@ function authCommand() {
           rejected_by: verification.url
         });
         console.error(
-          chalk9.red("\n  x The Pretense API REJECTED this key. It will not work.") + chalk9.dim(`
-  Key:    ${maskApiKey(opts.apiKey)}`) + chalk9.dim(`
-  Server: ${verification.url}`) + chalk9.dim(`
-  Reason: ${verification.detail}`) + chalk9.dim(`
+          chalk10.red("\n  x The Pretense API REJECTED this key. It will not work.") + chalk10.dim(`
+  Key:    ${maskApiKey(opts.apiKey)}`) + chalk10.dim(`
+  Server: ${verification.url}`) + chalk10.dim(`
+  Reason: ${verification.detail}`) + chalk10.dim(`
   Get a current key at https://pretense.ai/auth
 `) + storageNotice()
         );
@@ -19814,19 +20176,22 @@ function authCommand() {
       };
       writeCredentials(creds);
       if (verified) {
+        const planIsFree = String(verification.plan ?? "").trim().toLowerCase() === "free";
         console.log(
-          chalk9.green("\n  Authenticated. The key was verified by the Pretense API.") + chalk9.dim(`
-  Key:    ${maskApiKey(opts.apiKey)}`) + chalk9.dim(`
-  Server: ${verification.url}`) + (verification.plan ? chalk9.dim(`
-  Plan:   ${verification.plan}`) : "") + "\n" + storageNotice()
+          chalk10.green("\n  Authenticated. The key was verified by the Pretense API.") + chalk10.dim(`
+  Key:    ${maskApiKey(opts.apiKey)}`) + chalk10.dim(`
+  Server: ${verification.url}`) + (verification.plan ? chalk10.dim(`
+  Plan:   ${verification.plan}`) : "") + (planIsFree ? chalk10.dim(
+            "\n  Not the plan you expected? A PRO-flagged org without an active\n  subscription/comp resolves to Free \u2014 see pretense.ai/dashboard/settings."
+          ) : "") + "\n" + storageNotice()
         );
         return;
       }
       console.log(
-        chalk9.yellow("\n  Key saved \u2014 NOT verified.") + chalk9.dim(`
-  Key:    ${maskApiKey(opts.apiKey)}`) + chalk9.dim(`
-  Server: ${verification.url}`) + chalk9.dim(`
-  Reason: ${verification.detail}`) + chalk9.dim(
+        chalk10.yellow("\n  Key saved \u2014 NOT verified.") + chalk10.dim(`
+  Key:    ${maskApiKey(opts.apiKey)}`) + chalk10.dim(`
+  Server: ${verification.url}`) + chalk10.dim(`
+  Reason: ${verification.detail}`) + chalk10.dim(
           `
   The key's format is valid; nothing has confirmed the key itself.
   Re-run \`pretense auth login --key <key>\` when online to verify it.
@@ -19836,58 +20201,58 @@ function authCommand() {
       return;
     }
     const authUrl = "https://pretense.ai/auth";
-    console.log(chalk9.cyan("\n  Opening browser to https://pretense.ai/auth"));
-    console.log(chalk9.white("  1. Sign in or create your account"));
-    console.log(chalk9.white("  2. Copy your API key from the page"));
-    console.log(chalk9.white("  3. Return here and run:"));
-    console.log(chalk9.green("     pretense auth login --api-key <your-api-key>\n"));
+    console.log(chalk10.cyan("\n  Opening browser to https://pretense.ai/auth"));
+    console.log(chalk10.white("  1. Sign in or create your account"));
+    console.log(chalk10.white("  2. Copy your API key from the page"));
+    console.log(chalk10.white("  3. Return here and run:"));
+    console.log(chalk10.green("     pretense auth login --api-key <your-api-key>\n"));
     openUrl(authUrl);
   });
   auth.command("logout").description("Remove stored credentials").action(() => {
     if (!existsSync11(CREDENTIALS_PATH)) {
-      console.log(chalk9.yellow("\n  No credentials found. Already logged out.\n"));
+      console.log(chalk10.yellow("\n  No credentials found. Already logged out.\n"));
       return;
     }
     unlinkSync2(CREDENTIALS_PATH);
-    console.log(chalk9.green("\n  Logged out. Credentials removed.\n"));
+    console.log(chalk10.green("\n  Logged out. Credentials removed.\n"));
   });
   auth.command("status").description("Show current authentication state").action(() => {
     const creds = readCredentials();
     if (!creds) {
-      console.log(chalk9.yellow("\n  Not authenticated."));
+      console.log(chalk10.yellow("\n  Not authenticated."));
       console.log(
-        chalk9.dim("  Run ") + chalk9.cyan("pretense auth login --api-key <key>") + chalk9.dim(" to authenticate.\n")
+        chalk10.dim("  Run ") + chalk10.cyan("pretense auth login --api-key <key>") + chalk10.dim(" to authenticate.\n")
       );
       return;
     }
     if (creds.verified === true) {
-      console.log(chalk9.green("\n  Authenticated (key verified by the Pretense API)"));
+      console.log(chalk10.green("\n  Authenticated (key verified by the Pretense API)"));
     } else if (creds.rejected_at) {
-      console.log(chalk9.red("\n  Key stored \u2014 REJECTED by the Pretense API"));
+      console.log(chalk10.red("\n  Key stored \u2014 REJECTED by the Pretense API"));
       console.log(
-        chalk9.dim(`  Rejected at ${creds.rejected_at} by ${creds.rejected_by ?? "?"}. `) + chalk9.dim("This key will not work; get a current one at https://pretense.ai/auth")
+        chalk10.dim(`  Rejected at ${creds.rejected_at} by ${creds.rejected_by ?? "?"}. `) + chalk10.dim("This key will not work; get a current one at https://pretense.ai/auth")
       );
     } else {
-      console.log(chalk9.yellow("\n  Key stored \u2014 NOT verified"));
+      console.log(chalk10.yellow("\n  Key stored \u2014 NOT verified"));
       console.log(
-        chalk9.dim("  No server has confirmed this key. Run ") + chalk9.cyan("pretense auth login --key <key>") + chalk9.dim(" while online to verify it.")
+        chalk10.dim("  No server has confirmed this key. Run ") + chalk10.cyan("pretense auth login --key <key>") + chalk10.dim(" while online to verify it.")
       );
     }
-    console.log(chalk9.dim(`  API Key:  ${maskApiKey(creds.api_key)}`));
+    console.log(chalk10.dim(`  API Key:  ${maskApiKey(creds.api_key)}`));
     if (creds.authenticated_at) {
-      console.log(chalk9.dim(`  Saved:    ${creds.authenticated_at}`));
+      console.log(chalk10.dim(`  Saved:    ${creds.authenticated_at}`));
     }
     if (creds.verified_at) {
-      console.log(chalk9.dim(`  Verified: ${creds.verified_at} by ${creds.verified_by ?? "?"}`));
+      console.log(chalk10.dim(`  Verified: ${creds.verified_at} by ${creds.verified_by ?? "?"}`));
     }
     if (creds.plan) {
-      console.log(chalk9.dim(`  Plan:     ${creds.plan}`));
+      console.log(chalk10.dim(`  Plan:     ${creds.plan}`));
     }
-    console.log(chalk9.dim(`  Stored:   ${CREDENTIALS_PATH} (mode 0600, plaintext)`));
+    console.log(chalk10.dim(`  Stored:   ${CREDENTIALS_PATH} (mode 0600, plaintext)`));
     if (creds.expires_at) {
       const expired = new Date(creds.expires_at) < /* @__PURE__ */ new Date();
-      const label = expired ? chalk9.red("Expired") : chalk9.green("Valid");
-      console.log(chalk9.dim(`  Expires:  ${creds.expires_at} (${label})`));
+      const label = expired ? chalk10.red("Expired") : chalk10.green("Valid");
+      console.log(chalk10.dim(`  Expires:  ${creds.expires_at} (${label})`));
     }
     console.log();
   });
@@ -19896,8 +20261,8 @@ function authCommand() {
 
 // src/commands/review.ts
 init_esm_shims();
-import { Command as Command10 } from "commander";
-import chalk10 from "chalk";
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
 import { readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
 import { join as join14, extname as extname3, relative, isAbsolute } from "path";
 var SUPPORTED_EXTENSIONS2 = /* @__PURE__ */ new Set([
@@ -20072,37 +20437,37 @@ function formatInteractive(results) {
   const filesWithFindings = results.filter((r) => r.mutations.length > 0 || r.secrets.length > 0);
   const totalMutations = results.reduce((sum, r) => sum + r.mutations.length, 0);
   const totalSecrets = results.reduce((sum, r) => sum + r.secrets.length, 0);
-  console.log(chalk10.cyan("\n  Pretense Review\n"));
-  console.log(chalk10.dim(`  Files scanned: ${results.length} | With findings: ${filesWithFindings.length}
+  console.log(chalk11.cyan("\n  Pretense Review\n"));
+  console.log(chalk11.dim(`  Files scanned: ${results.length} | With findings: ${filesWithFindings.length}
 `));
   if (totalMutations === 0 && totalSecrets === 0) {
-    console.log(chalk10.green("  No mutations or secrets detected.\n"));
+    console.log(chalk11.green("  No mutations or secrets detected.\n"));
     return;
   }
-  console.log(chalk10.bold(`  ${totalMutations} mutation(s) | ${totalSecrets} secret(s)
+  console.log(chalk11.bold(`  ${totalMutations} mutation(s) | ${totalSecrets} secret(s)
 `));
   for (const r of filesWithFindings) {
-    console.log(chalk10.bold(`  ${r.file}`));
+    console.log(chalk11.bold(`  ${r.file}`));
     for (const m of r.mutations) {
-      const catColor = m.category === "function" ? chalk10.blue : m.category === "class" ? chalk10.magenta : m.category === "constant" ? chalk10.yellow : chalk10.white;
-      console.log(`    ${catColor(m.category.padEnd(10))} ${chalk10.red(m.original)} ${chalk10.dim("->")} ${chalk10.green(m.mutated)} ${chalk10.dim(`L${m.line}`)}`);
+      const catColor = m.category === "function" ? chalk11.blue : m.category === "class" ? chalk11.magenta : m.category === "constant" ? chalk11.yellow : chalk11.white;
+      console.log(`    ${catColor(m.category.padEnd(10))} ${chalk11.red(m.original)} ${chalk11.dim("->")} ${chalk11.green(m.mutated)} ${chalk11.dim(`L${m.line}`)}`);
     }
     for (const s of r.secrets) {
-      const icon = s.severity === "critical" ? chalk10.red("CRIT") : s.severity === "high" ? chalk10.yellow("HIGH") : chalk10.dim(s.severity.toUpperCase());
-      console.log(`    ${icon.padEnd(10)} ${chalk10.bold(s.type)} ${chalk10.dim(s.locator)}`);
+      const icon = s.severity === "critical" ? chalk11.red("CRIT") : s.severity === "high" ? chalk11.yellow("HIGH") : chalk11.dim(s.severity.toUpperCase());
+      console.log(`    ${icon.padEnd(10)} ${chalk11.bold(s.type)} ${chalk11.dim(s.locator)}`);
     }
     console.log();
   }
 }
 function reviewCommand() {
-  return new Command10("review").description("Preview mutations and secrets that would be applied").argument("[path]", "Directory to review (defaults to current directory)").option("--plain", "Plain text output", false).option("--json", "JSON array output with metadata", false).option("--agent", "Structured JSON optimized for AI agent consumption", false).option("--prompt-only", "Minimal output suitable for piping", false).option("--interactive", "Interactive formatted output (default)", false).action(async (path2, opts) => {
+  return new Command11("review").description("Preview mutations and secrets that would be applied").argument("[path]", "Directory to review (defaults to current directory)").option("--plain", "Plain text output", false).option("--json", "JSON array output with metadata", false).option("--agent", "Structured JSON optimized for AI agent consumption", false).option("--prompt-only", "Minimal output suitable for piping", false).option("--interactive", "Interactive formatted output (default)", false).action(async (path2, opts) => {
     const targetDir = path2 ? isAbsolute(path2) ? path2 : join14(process.cwd(), path2) : process.cwd();
     const files = discoverFiles(targetDir);
     if (files.length === 0) {
       if (opts?.json || opts?.agent) {
         console.log("[]");
       } else {
-        console.error(chalk10.yellow("  No supported source files found.\n"));
+        console.error(chalk11.yellow("  No supported source files found.\n"));
       }
       return;
     }
@@ -20129,8 +20494,8 @@ function reviewCommand() {
 
 // src/commands/install.ts
 init_esm_shims();
-import { Command as Command11 } from "commander";
-import chalk11 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk12 from "chalk";
 import {
   existsSync as existsSync12,
   writeFileSync as writeFileSync5,
@@ -20138,7 +20503,7 @@ import {
   readFileSync as readFileSync13,
   mkdirSync as mkdirSync3
 } from "fs";
-import { join as join15, resolve as resolve3 } from "path";
+import { join as join15, resolve as resolve4 } from "path";
 var HOOK_SCRIPTS = {
   "pre-commit": `#!/bin/sh
 # Pretense AI Firewall \u2014 pre-commit hook
@@ -20176,16 +20541,16 @@ function installHook(hooksDir, mode, force) {
   return { installed: true, path: hookPath };
 }
 function installCommand() {
-  return new Command11("install").description("Install Pretense git hooks (pre-commit and/or pre-push)").option(
+  return new Command12("install").description("Install Pretense git hooks (pre-commit and/or pre-push)").option(
     "-m, --mode <mode>",
     "Hook mode: pre-commit, pre-push (omit to install both)"
   ).option("-f, --force", "Overwrite existing hooks without prompting", false).option("-d, --dir <path>", "Project directory (defaults to cwd)", ".").action((opts) => {
-    const dir = resolve3(opts.dir);
+    const dir = resolve4(opts.dir);
     const force = opts.force;
     const modeArg = opts.mode;
     if (modeArg && !VALID_MODES.includes(modeArg)) {
       console.error(
-        chalk11.red(
+        chalk12.red(
           `
   Error: Invalid mode "${modeArg}". Use: ${VALID_MODES.join(", ")}
 `
@@ -20197,7 +20562,7 @@ function installCommand() {
     const gitDir = findGitDir(dir);
     if (!gitDir) {
       console.error(
-        chalk11.red(
+        chalk12.red(
           `
   Error: No .git directory found in ${dir}
   Run this command from a git repository root.
@@ -20208,23 +20573,23 @@ function installCommand() {
     }
     const hooksDir = join15(gitDir, "hooks");
     mkdirSync3(hooksDir, { recursive: true });
-    console.log(chalk11.cyan("\n  Pretense hook installer\n"));
+    console.log(chalk12.cyan("\n  Pretense hook installer\n"));
     let hasError = false;
     for (const mode of modes) {
       const result = installHook(hooksDir, mode, force);
       if (result.installed) {
         console.log(
-          chalk11.green(`  Installed ${mode} hook at ${result.path}`)
+          chalk12.green(`  Installed ${mode} hook at ${result.path}`)
         );
       } else if (result.skipped) {
         console.log(
-          chalk11.dim(
+          chalk12.dim(
             `  Pretense ${mode} hook already installed at ${result.path}`
           )
         );
       } else {
         console.error(
-          chalk11.yellow(
+          chalk12.yellow(
             `  Hook already exists at ${result.path}. Use --force to overwrite.`
           )
         );
@@ -20235,14 +20600,14 @@ function installCommand() {
       console.log("");
       process.exit(1);
     }
-    console.log(chalk11.bold.green("\n  Git hooks installed successfully.\n"));
+    console.log(chalk12.bold.green("\n  Git hooks installed successfully.\n"));
   });
 }
 
 // src/commands/ignore.ts
 init_esm_shims();
-import { Command as Command12 } from "commander";
-import chalk12 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk13 from "chalk";
 import { appendFileSync as appendFileSync3, readFileSync as readFileSync14, existsSync as existsSync13 } from "fs";
 import { join as join16 } from "path";
 import { homedir as homedir8 } from "os";
@@ -20261,7 +20626,7 @@ function appendPattern(pattern) {
   const content = existsSync13(p) ? readFileSync14(p, "utf-8") : "";
   const lines = content.split("\n").filter((l) => l.length > 0);
   if (lines.includes(pattern)) {
-    console.log(chalk12.yellow(`
+    console.log(chalk13.yellow(`
   Pattern already exists: ${pattern}
 `));
     return;
@@ -20269,26 +20634,26 @@ function appendPattern(pattern) {
   const prefix = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
   appendFileSync3(p, `${prefix}${pattern}
 `);
-  console.log(chalk12.green(`
+  console.log(chalk13.green(`
   \u2713 Added to ${IGNORE_FILE}: ${pattern}
 `));
 }
 function ignoreCommand() {
-  return new Command12("ignore").description("Add patterns to .pretenseignore").argument("[pattern]", "Glob pattern to ignore").option("--last-found", "Ignore all identifiers from last scan results").option("--list", "List current ignore patterns").action((pattern, opts) => {
+  return new Command13("ignore").description("Add patterns to .pretenseignore").argument("[pattern]", "Glob pattern to ignore").option("--last-found", "Ignore all identifiers from last scan results").option("--list", "List current ignore patterns").action((pattern, opts) => {
     if (opts.list) {
       const patterns = readIgnoreFile();
       if (patterns.length === 0) {
-        console.log(chalk12.dim(`
+        console.log(chalk13.dim(`
   No ${IGNORE_FILE} found or file is empty.
 `));
         return;
       }
-      console.log(chalk12.cyan(`
+      console.log(chalk13.cyan(`
   ${IGNORE_FILE}:
 `));
       for (const line of patterns) {
         if (line.startsWith("#")) {
-          console.log(chalk12.dim(`  ${line}`));
+          console.log(chalk13.dim(`  ${line}`));
         } else {
           console.log(`  ${line}`);
         }
@@ -20298,10 +20663,10 @@ function ignoreCommand() {
     }
     if (opts.lastFound) {
       if (!existsSync13(LAST_SCAN_PATH)) {
-        console.error(chalk12.red(`
+        console.error(chalk13.red(`
   \u2717 No last scan results found at ${LAST_SCAN_PATH}
 `));
-        console.error(chalk12.dim("  Run 'pretense scan <file>' first.\n"));
+        console.error(chalk13.dim("  Run 'pretense scan <file>' first.\n"));
         process.exit(1);
       }
       try {
@@ -20309,7 +20674,7 @@ function ignoreCommand() {
         const data = JSON.parse(raw2);
         const matches = data.matches ?? [];
         if (matches.length === 0) {
-          console.log(chalk12.green("\n  \u2713 Last scan was clean - nothing to ignore.\n"));
+          console.log(chalk13.green("\n  \u2713 Last scan was clean - nothing to ignore.\n"));
           return;
         }
         let added = 0;
@@ -20320,11 +20685,11 @@ function ignoreCommand() {
             added++;
           }
         }
-        console.log(chalk12.green(`
+        console.log(chalk13.green(`
   \u2713 Added ${added} pattern(s) from last scan.
 `));
       } catch {
-        console.error(chalk12.red(`
+        console.error(chalk13.red(`
   \u2717 Failed to parse ${LAST_SCAN_PATH}
 `));
         process.exit(1);
@@ -20332,7 +20697,7 @@ function ignoreCommand() {
       return;
     }
     if (!pattern) {
-      console.error(chalk12.red("\n  \u2717 Please provide a pattern or use --last-found\n"));
+      console.error(chalk13.red("\n  \u2717 Please provide a pattern or use --last-found\n"));
       process.exit(1);
     }
     appendPattern(pattern);
@@ -20341,7 +20706,7 @@ function ignoreCommand() {
 
 // src/commands/completion.ts
 init_esm_shims();
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 var ZSH_COMPLETION = `
 # Pretense zsh completion
 _pretense() {
@@ -20533,7 +20898,7 @@ complete -c pretense -f -n "__fish_seen_subcommand_from completion" -a bash -d "
 complete -c pretense -f -n "__fish_seen_subcommand_from completion" -a fish -d "fish completion script"
 `.trim();
 function completionCommand() {
-  return new Command13("completion").description("Print shell tab-completion script").argument("<shell>", "Shell to generate completion for: zsh, bash, fish").action((shell) => {
+  return new Command14("completion").description("Print shell tab-completion script").argument("<shell>", "Shell to generate completion for: zsh, bash, fish").action((shell) => {
     switch (shell) {
       case "zsh":
         console.log(ZSH_COMPLETION);
@@ -20553,10 +20918,10 @@ function completionCommand() {
 
 // src/commands/quickstart.ts
 init_esm_shims();
-import { Command as Command14 } from "commander";
-import chalk13 from "chalk";
+import { Command as Command15 } from "commander";
+import chalk14 from "chalk";
 import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17, resolve as resolve4 } from "path";
+import { join as join17, resolve as resolve5 } from "path";
 var DEFAULT_CONFIG_YAML = `scan:
   secrets: block
   pii: redact
@@ -20582,63 +20947,65 @@ customPatterns: []
 verbose: false
 `;
 function quickstartCommand() {
-  return new Command14("quickstart").description("One-command setup: init + install hooks + show next steps").option("-d, --dir <path>", "Directory to scan", ".").option("--dry-run", "Print what would be written without writing", false).action(async (opts) => {
-    const dir = resolve4(opts.dir);
-    console.log(chalk13.bold.cyan("\n  Pretense Quickstart\n"));
-    console.log(chalk13.dim("  Setting up AI firewall for this project...\n"));
-    console.log(chalk13.dim("  [1/4] Scanning codebase..."));
+  return new Command15("quickstart").description("One-command setup: init + install hooks + show next steps").option("-d, --dir <path>", "Directory to scan", ".").option("--dry-run", "Print what would be written without writing", false).action(async (opts) => {
+    const dir = resolve5(opts.dir);
+    console.log(chalk14.bold.cyan("\n  Pretense Quickstart\n"));
+    console.log(chalk14.dim("  Setting up AI firewall for this project...\n"));
+    console.log(chalk14.dim("  [1/4] Scanning codebase..."));
     let fp;
     try {
       fp = await learn({ dir, minOccurrences: 1 });
-      console.log(chalk13.green(`         ${fp.filesScanned} files | ${fp.functions.length} functions | ${fp.classes.length} classes`));
+      console.log(chalk14.green(`         ${fp.filesScanned} files | ${fp.functions.length} functions | ${fp.classes.length} classes`));
     } catch (err) {
-      console.error(chalk13.red(`  \u2717 Scan failed: ${err.message}`));
+      console.error(chalk14.red(`  \u2717 Scan failed: ${err.message}`));
       process.exit(1);
     }
-    console.log(chalk13.dim("  [2/4] Writing config..."));
+    console.log(chalk14.dim("  [2/4] Writing config..."));
     const configPath = join17(dir, "pretense.yaml");
     if (!opts.dryRun) {
       if (!existsSync14(configPath)) {
         writeFileSync6(configPath, DEFAULT_CONFIG_YAML);
-        console.log(chalk13.green("         Created pretense.yaml"));
+        console.log(chalk14.green("         Created pretense.yaml"));
       } else {
-        console.log(chalk13.dim("         pretense.yaml already exists, skipping"));
+        console.log(chalk14.dim("         pretense.yaml already exists, skipping"));
       }
     }
-    console.log(chalk13.dim("  [3/4] Updating .gitignore..."));
+    console.log(chalk14.dim("  [3/4] Updating .gitignore..."));
     if (!opts.dryRun) {
       const gitignorePath = join17(dir, ".gitignore");
       let content = existsSync14(gitignorePath) ? (await import("fs")).default.readFileSync(gitignorePath, "utf-8") : "";
       if (!content.includes(".pretense/")) {
         content = content + (content.endsWith("\n") ? "" : "\n") + ".pretense/\n";
         writeFileSync6(gitignorePath, content);
-        console.log(chalk13.green("         Added .pretense/ to .gitignore"));
+        console.log(chalk14.green("         Added .pretense/ to .gitignore"));
       } else {
-        console.log(chalk13.dim("         .gitignore already includes .pretense/"));
-      }
-    }
-    console.log(chalk13.dim("  [4/4] Done.\n"));
-    console.log(chalk13.bold("  Next steps:\n"));
-    console.log(`  ${chalk13.green("1.")} ${chalk13.cyan('pretense run claude "build me X"')}   Run any AI tool through the proxy \u2014 zero setup`);
-    console.log(`     ${chalk13.dim("(auto-starts the proxy on a free port and sets the base-URL env var for you)")}`);
-    console.log(`  ${chalk13.green("2.")} ${chalk13.cyan("pretense install")}                  Install pre-commit + pre-push git hooks`);
-    console.log(`  ${chalk13.green("3.")} ${chalk13.dim("Prefer to wire it by hand? Start the proxy and set the base URL yourself:")}`);
-    console.log(`     ${chalk13.dim("pretense start")}`);
-    console.log(`     ${chalk13.dim("ANTHROPIC_BASE_URL=http://localhost:9339 claude")}`);
-    console.log(`     ${chalk13.dim("OPENAI_BASE_URL=http://localhost:9339/v1 cursor ...")}`);
-    console.log(`     ${chalk13.dim("GOOGLE_GEMINI_BASE_URL=http://localhost:9339 gemini ...")}
+        console.log(chalk14.dim("         .gitignore already includes .pretense/"));
+      }
+    }
+    console.log(chalk14.dim("  [4/4] Done.\n"));
+    console.log(chalk14.bold("  Next steps:\n"));
+    console.log(`  ${chalk14.green("1.")} ${chalk14.cyan('pretense run claude "build me X"')}   Run any AI tool through the proxy \u2014 zero setup`);
+    console.log(`     ${chalk14.dim("(auto-starts the proxy on a free port and sets the base-URL env var for you)")}`);
+    console.log(`     ${chalk14.dim("Works the same for any tool: ")}${chalk14.cyan("pretense run cursor")}${chalk14.dim(", ")}${chalk14.cyan("pretense run gemini")}`);
+    console.log(`  ${chalk14.green("2.")} ${chalk14.cyan("pretense install")}                  Install pre-commit + pre-push git hooks`);
+    console.log(`  ${chalk14.green("3.")} ${chalk14.dim("Prefer to wire it by hand? Set the base URL in the SAME command as the tool:")}`);
+    console.log(`     ${chalk14.dim("ANTHROPIC_BASE_URL=http://localhost:9339 claude")}`);
+    console.log(`     ${chalk14.dim("OPENAI_BASE_URL=http://localhost:9339/v1 cursor ...")}`);
+    console.log(`     ${chalk14.dim("GOOGLE_GEMINI_BASE_URL=http://localhost:9339 gemini ...")}`);
+    console.log(`     ${chalk14.bold.yellow("\u26A0 Set this in the SAME terminal as your AI tool \u2014 a new terminal is NOT protected.")}`);
+    console.log(`     ${chalk14.bold.yellow("  Simplest: use ")}${chalk14.cyan("pretense run")}${chalk14.bold.yellow(" and skip the export entirely.")}
 `);
-    console.log(chalk13.bold.green("  Protected. Happy coding.\n"));
+    console.log(chalk14.bold.green("  Protected. Happy coding.\n"));
   });
 }
 
 // src/commands/mutate.ts
 init_esm_shims();
-import { Command as Command15, Option as Option2 } from "commander";
-import chalk14 from "chalk";
+import { Command as Command16, Option as Option2 } from "commander";
+import chalk16 from "chalk";
 import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, chmodSync as chmodSync4, existsSync as existsSync15 } from "fs";
 import { createHash as createHash3 } from "crypto";
-import { resolve as resolve5, extname as extname4 } from "path";
+import { resolve as resolve6, extname as extname4 } from "path";
 
 // src/secret-crypto.ts
 init_esm_shims();
@@ -20761,6 +21128,48 @@ function ensureDefaultMapPath(absFilePath, override2) {
   return defaultMapPath(absFilePath, override2);
 }
 
+// src/local-audit.ts
+init_esm_shims();
+import { homedir as homedir10 } from "os";
+import { join as join21 } from "path";
+import { randomUUID } from "crypto";
+import chalk15 from "chalk";
+function localAuditDbPath() {
+  return join21(homedir10(), ".pretense", "audit.db");
+}
+function recordLocalAudit(rec, dbPath = localAuditDbPath()) {
+  let store = null;
+  try {
+    store = new AuditStore(dbPath);
+    store.logEntry({
+      timestamp: Date.now(),
+      requestId: randomUUID(),
+      provider: "cli",
+      model: "-",
+      direction: "outbound",
+      originalSize: rec.originalSize,
+      processedSize: rec.processedSize,
+      secretsBlocked: rec.secretsBlocked,
+      piiRedacted: rec.piiRedacted,
+      mutationsApplied: rec.mutationsApplied,
+      scanDurationMs: 0,
+      mutationDurationMs: rec.durationMs,
+      action: rec.action,
+      details: { source: rec.action === "reversed" ? "cli-reverse" : "cli-mutate", file: rec.file },
+      ...rec.detectorKinds && rec.detectorKinds.length > 0 ? { detectorKinds: rec.detectorKinds } : {}
+    });
+    return true;
+  } catch (err) {
+    console.error(
+      chalk15.yellow(`  ! Could not record this ${rec.action === "reversed" ? "reversal" : "mutation"} in the audit log`) + chalk15.dim(` (${err.message}).`) + chalk15.dim(`
+    The file was still ${rec.action === "reversed" ? "restored" : "mutated"}; only the audit entry is missing.`)
+    );
+    return false;
+  } finally {
+    store?.close();
+  }
+}
+
 // src/commands/mutate.ts
 var REVERSAL_MAP_VERSION = 3;
 function preflightReversalMap(mapPath, absFile, content, contentSha, force) {
@@ -20781,7 +21190,7 @@ function preflightReversalMap(mapPath, absFile, content, contentSha, force) {
     to overwrite it deliberately.`
     };
   }
-  const existingFile = existing.file ? resolve5(existing.file) : void 0;
+  const existingFile = existing.file ? resolve6(existing.file) : void 0;
   if (existingFile && existingFile !== absFile) {
     if (force) {
       return { action: "write", generation: 1, supersededSha: existing.originalSha };
@@ -20857,8 +21266,10 @@ async function collectMutationFindings(content, file, level, presetName) {
   const cannotMutate = (type) => {
     unmutatable.set(type, (unmutatable.get(type) ?? 0) + 1);
   };
+  const categoryByType = /* @__PURE__ */ new Map();
   for (const m of result.matches) {
     if (level === 2 && m.level !== 2) continue;
+    if (!categoryByType.has(m.type)) categoryByType.set(m.type, m.category);
     const offset = m.start;
     const length = m.end - m.start;
     if (length <= 0) {
@@ -20871,18 +21282,18 @@ async function collectMutationFindings(content, file, level, presetName) {
     }
     findings.push({ value: m.value, offset, length, type: m.type });
   }
-  return { findings, unmutatable };
+  return { findings, unmutatable, categoryByType };
 }
 function reportUnmutatable(unmutatable) {
   if (unmutatable.size === 0) return;
   const total = [...unmutatable.values()].reduce((a, b) => a + b, 0);
   const kinds = [...unmutatable.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([type, n]) => n > 1 ? `${type} (x${n})` : type).join(", ");
   console.error(
-    chalk14.yellow(`
-  ! ${total} detected value${total === 1 ? "" : "s"} could NOT be mutated: ${kinds}`) + chalk14.dim(`
-    These were found only inside an encoded form (base64/hex) or at a span`) + chalk14.dim(`
-    that does not map back to the file's bytes, so there is no range to`) + chalk14.dim(`
-    rewrite. They are STILL PRESENT in the output. Run \`pretense scan\` on`) + chalk14.dim(`
+    chalk16.yellow(`
+  ! ${total} detected value${total === 1 ? "" : "s"} could NOT be mutated: ${kinds}`) + chalk16.dim(`
+    These were found only inside an encoded form (base64/hex) or at a span`) + chalk16.dim(`
+    that does not map back to the file's bytes, so there is no range to`) + chalk16.dim(`
+    rewrite. They are STILL PRESENT in the output. Run \`pretense scan\` on`) + chalk16.dim(`
     this file to see them, and remove or re-encode them by hand.
 `)
   );
@@ -20892,9 +21303,9 @@ function writeReversalMap(mapPath, mapFile) {
     writeFileSync7(mapPath, JSON.stringify(mapFile, null, 2), { mode: 384 });
   } catch (e) {
     console.error(
-      chalk14.red(`
-  x Cannot write reversal map: ${mapPath}`) + chalk14.dim(`
-    ${e.message}`) + chalk14.dim(`
+      chalk16.red(`
+  x Cannot write reversal map: ${mapPath}`) + chalk16.dim(`
+    ${e.message}`) + chalk16.dim(`
   Nothing was mutated \u2014 without a map the original could not be restored.
 `)
     );
@@ -20905,7 +21316,7 @@ function writeReversalMap(mapPath, mapFile) {
   } catch {
   }
   console.error(
-    chalk14.green(`  \u2713 Wrote encrypted reversal map \u2192 ${mapPath}`) + chalk14.dim(" (AES-256-GCM, mode 0600)")
+    chalk16.green(`  \u2713 Wrote encrypted reversal map \u2192 ${mapPath}`) + chalk16.dim(" (AES-256-GCM, mode 0600)")
   );
   return 0;
 }
@@ -20914,7 +21325,7 @@ async function runMutate(file, opts = {}) {
   try {
     raw2 = readFileSync15(file);
   } catch {
-    console.error(chalk14.red(`
+    console.error(chalk16.red(`
   x Cannot read file: ${file}
 `));
     return 1;
@@ -20922,9 +21333,9 @@ async function runMutate(file, opts = {}) {
   const content = raw2.toString("utf-8");
   if (!Buffer.from(content, "utf-8").equals(raw2)) {
     console.error(
-      chalk14.red(`
-  x Not valid UTF-8: ${file}`) + chalk14.dim(`
-  Mutating would replace the undecodable bytes with U+FFFD and the`) + chalk14.dim(`
+      chalk16.red(`
+  x Not valid UTF-8: ${file}`) + chalk16.dim(`
+  Mutating would replace the undecodable bytes with U+FFFD and the`) + chalk16.dim(`
   original content could not be restored. File left untouched.
 `)
     );
@@ -20932,7 +21343,8 @@ async function runMutate(file, opts = {}) {
   }
   const preview = opts.stdout === true;
   const inPlace = !preview && !opts.output;
-  const { findings, unmutatable } = await collectMutationFindings(
+  const mutateStartMs = Date.now();
+  const { findings, unmutatable, categoryByType } = await collectMutationFindings(
     content,
     file,
     opts.level,
@@ -20940,7 +21352,7 @@ async function runMutate(file, opts = {}) {
   );
   if (findings.length === 0) {
     if (unmutatable.size === 0) {
-      console.error(chalk14.dim(`  No secrets found in ${file} \u2014 nothing to mutate.`));
+      console.error(chalk16.dim(`  No secrets found in ${file} \u2014 nothing to mutate.`));
     } else {
       reportUnmutatable(unmutatable);
     }
@@ -20948,8 +21360,8 @@ async function runMutate(file, opts = {}) {
     return 0;
   }
   reportUnmutatable(unmutatable);
-  const absFile = resolve5(file);
-  const projectRoot = findProjectRoot(absFile);
+  const absFile = resolve6(file);
+  const projectRoot = resolveProjectRoot(absFile);
   const result = mutateSecrets(content, findings, { projectRoot, keysDir: opts.keysDir });
   let effectiveMap;
   if (preview) {
@@ -20964,9 +21376,9 @@ async function runMutate(file, opts = {}) {
     const pre = preflightReversalMap(effectiveMap, absFile, content, contentSha, opts.forceMap === true);
     if (pre.action === "refuse") {
       console.error(
-        chalk14.red(`
-  x ${pre.code}: refusing to overwrite an existing reversal map.`) + chalk14.dim(`
-    ${pre.message}`) + chalk14.dim(`
+        chalk16.red(`
+  x ${pre.code}: refusing to overwrite an existing reversal map.`) + chalk16.dim(`
+    ${pre.message}`) + chalk16.dim(`
   Nothing was mutated. Both the file and the map are untouched.
 `)
       );
@@ -20976,8 +21388,8 @@ async function runMutate(file, opts = {}) {
     const isNoop = pre.action === "keep" && pre.expectedMutatedSha === mutatedSha;
     if (isNoop) {
       console.error(
-        chalk14.dim(`  = Reversal map ${effectiveMap} already describes ${file} at this exact content`) + chalk14.dim(`
-    hash \u2014 left unchanged (mutation is deterministic, so a rewrite would be`) + chalk14.dim(`
+        chalk16.dim(`  = Reversal map ${effectiveMap} already describes ${file} at this exact content`) + chalk16.dim(`
+    hash \u2014 left unchanged (mutation is deterministic, so a rewrite would be`) + chalk16.dim(`
     byte-identical).`)
       );
     } else {
@@ -21003,10 +21415,10 @@ async function runMutate(file, opts = {}) {
       if (written !== 0) return written;
       if (pre.action === "write" && pre.generation > 1) {
         console.error(
-          chalk14.yellow(`
-  ! --force-map: this map is mutation GENERATION ${pre.generation}.`) + chalk14.dim(`
-    Its "original" values are synthetics from the previous round, so`) + chalk14.dim(`
-    reversing with it returns the EARLIER MUTATED file, not your real`) + chalk14.dim(`
+          chalk16.yellow(`
+  ! --force-map: this map is mutation GENERATION ${pre.generation}.`) + chalk16.dim(`
+    Its "original" values are synthetics from the previous round, so`) + chalk16.dim(`
+    reversing with it returns the EARLIER MUTATED file, not your real`) + chalk16.dim(`
     secrets. \`pretense reverse\` will refuse it unless --allow-partial.
 `)
         );
@@ -21015,8 +21427,8 @@ async function runMutate(file, opts = {}) {
   }
   if (inPlace && !effectiveMap) {
     console.error(
-      chalk14.red(`
-  x Refusing to mutate ${file} in place with no reversal map \u2014 this would be irreversible.`) + chalk14.dim(`
+      chalk16.red(`
+  x Refusing to mutate ${file} in place with no reversal map \u2014 this would be irreversible.`) + chalk16.dim(`
     Pass --map <path>, or report this as a bug.
 `)
     );
@@ -21025,29 +21437,48 @@ async function runMutate(file, opts = {}) {
   try {
     if (inPlace) {
       writeFileAtomicSync(file, result.content);
-      console.error(chalk14.green(`  \u2713 Mutated ${result.mutations.length} secrets in ${file} (in-place)`));
+      console.error(chalk16.green(`  \u2713 Mutated ${result.mutations.length} secrets in ${file} (in-place)`));
     } else if (opts.output) {
       writeFileAtomicSync(opts.output, result.content);
-      console.error(chalk14.green(`  \u2713 Mutated ${result.mutations.length} secrets \u2192 ${opts.output}`));
+      console.error(chalk16.green(`  \u2713 Mutated ${result.mutations.length} secrets \u2192 ${opts.output}`));
     } else {
       process.stdout.write(result.content);
     }
   } catch (e) {
     console.error(
-      chalk14.red(`
-  x Cannot write mutated content: ${opts.output ?? file}`) + chalk14.dim(`
+      chalk16.red(`
+  x Cannot write mutated content: ${opts.output ?? file}`) + chalk16.dim(`
     ${e.message}
 `)
     );
     return 1;
   }
+  if (!preview && result.mutations.length > 0) {
+    let secretsBlocked = 0;
+    let piiRedacted = 0;
+    for (const m of result.mutations) {
+      if (categoryByType.get(m.type) === "pii") piiRedacted += 1;
+      else secretsBlocked += 1;
+    }
+    recordLocalAudit({
+      action: "mutated",
+      mutationsApplied: result.mutations.length,
+      secretsBlocked,
+      piiRedacted,
+      originalSize: Buffer.byteLength(content, "utf-8"),
+      processedSize: Buffer.byteLength(result.content, "utf-8"),
+      durationMs: Date.now() - mutateStartMs,
+      detectorKinds: [...new Set(result.mutations.map((m) => m.type))],
+      file: absFile
+    });
+  }
   if (opts.showMap) {
     console.error(JSON.stringify(result.mutations, null, 2));
   }
   return 0;
 }
 function mutateCommand() {
-  return new Command15("mutate").description(
+  return new Command16("mutate").description(
     "Mutate secrets IN PLACE and auto-write an encrypted reversal map (reverse with `pretense reverse <file>`; --stdout to preview instead)"
   ).argument("<file>", "File to mutate").option("-i, --in-place", "Write back to the input file (this is the default; kept for compatibility)").option("-o, --output <path>", "Write mutated content to a specific file instead of in place").option("--stdout", "Preview mutated content on stdout and write NOTHING (no file, no map)").option(
     "--map <path>",
@@ -21068,7 +21499,7 @@ function mutateCommand() {
       const resolved = resolvePolicy(opts.policy);
       if (resolved?.scannerPreset) opts.presetName = resolved.scannerPreset;
     } catch (err) {
-      console.error(chalk14.red(`
+      console.error(chalk16.red(`
   x ${err.message}
 `));
       process.exit(1);
@@ -21080,10 +21511,10 @@ function mutateCommand() {
 
 // src/commands/reverse.ts
 init_esm_shims();
-import { Command as Command16 } from "commander";
-import chalk15 from "chalk";
+import { Command as Command17 } from "commander";
+import chalk17 from "chalk";
 import { readFileSync as readFileSync16, existsSync as existsSync16, statSync as statSync6 } from "fs";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 import { createHash as createHash4 } from "crypto";
 function sha256Hex3(s) {
   return createHash4("sha256").update(s, "utf8").digest("hex");
@@ -21115,14 +21546,14 @@ function loadReversalMap(mapPath) {
   try {
     parsed = JSON.parse(readFileSync16(mapPath, "utf-8"));
   } catch {
-    console.error(chalk15.red(`
+    console.error(chalk17.red(`
   x Cannot read reversal map: ${mapPath}
 `));
     process.exit(1);
   }
   const map = parsed;
   if (!map || !Array.isArray(map.mutations)) {
-    console.error(chalk15.red(`
+    console.error(chalk17.red(`
   x Malformed reversal map (missing "mutations"): ${mapPath}
 `));
     process.exit(1);
@@ -21130,9 +21561,9 @@ function loadReversalMap(mapPath) {
   const version = typeof map.version === "number" ? map.version : 1;
   if (version > REVERSAL_MAP_VERSION) {
     console.error(
-      chalk15.red(`
-  x Reversal map is version ${version}; this build understands up to ${REVERSAL_MAP_VERSION}.`) + chalk15.dim(`
-    It was written by a newer Pretense. Upgrade the CLI to reverse it.`) + chalk15.dim(`
+      chalk17.red(`
+  x Reversal map is version ${version}; this build understands up to ${REVERSAL_MAP_VERSION}.`) + chalk17.dim(`
+    It was written by a newer Pretense. Upgrade the CLI to reverse it.`) + chalk17.dim(`
   File left untouched.
 `)
     );
@@ -21141,9 +21572,10 @@ function loadReversalMap(mapPath) {
   return map;
 }
 function runReverse(file, opts = {}) {
-  const absPath = resolve6(file);
+  const reverseStartMs = Date.now();
+  const absPath = resolve7(file);
   if (!existsSync16(absPath) || !statSync6(absPath).isFile()) {
-    console.error(chalk15.red(`
+    console.error(chalk17.red(`
   x File not found: ${file}
 `));
     return 1;
@@ -21151,11 +21583,11 @@ function runReverse(file, opts = {}) {
   const mapPath = opts.map ?? defaultMapPath(absPath, opts.mapsDir);
   if (!opts.map && !existsSync16(mapPath)) {
     console.error(
-      chalk15.red(`
-  x No reversal map found for ${absPath}`) + chalk15.dim(`
-    Looked in the default location: ${mapPath}`) + chalk15.dim(`
-    Mutate the file first with ${chalk15.cyan(`pretense mutate ${file}`)}, or pass`) + chalk15.dim(`
-    an explicit ${chalk15.cyan("--map <path>")} if you wrote the map somewhere else.
+      chalk17.red(`
+  x No reversal map found for ${absPath}`) + chalk17.dim(`
+    Looked in the default location: ${mapPath}`) + chalk17.dim(`
+    Mutate the file first with ${chalk17.cyan(`pretense mutate ${file}`)}, or pass`) + chalk17.dim(`
+    an explicit ${chalk17.cyan("--map <path>")} if you wrote the map somewhere else.
 `)
     );
     return 1;
@@ -21163,30 +21595,41 @@ function runReverse(file, opts = {}) {
   const mapFile = loadReversalMap(mapPath);
   let plainMutations;
   if (mapFile.encrypted) {
-    const projectRoot = findProjectRoot(mapFile.file ?? absPath);
-    const key = readProjectKey(projectRoot, opts.keysDir);
-    if (!key) {
-      console.error(
-        chalk15.red(`
-  x Encryption key not found for this project \u2014 cannot decrypt the reversal map.`) + chalk15.dim(`
-    Expected a key derived from ${projectRoot}. Reverse must run where the map was created.
-`)
-      );
-      return 1;
+    const keySource = mapFile.file ?? absPath;
+    const roots = candidateProjectRoots(keySource);
+    let decrypted;
+    let anyKeyPresent = false;
+    for (const root of roots) {
+      const key = readProjectKey(root, opts.keysDir);
+      if (!key) continue;
+      anyKeyPresent = true;
+      try {
+        decrypted = mapFile.mutations.map((m) => ({
+          original: decryptSecret(m.original, key),
+          replacement: m.replacement
+        }));
+        break;
+      } catch {
+        decrypted = void 0;
+      }
     }
-    try {
-      plainMutations = mapFile.mutations.map((m) => ({
-        original: decryptSecret(m.original, key),
-        replacement: m.replacement
-      }));
-    } catch {
+    if (!decrypted) {
+      const looked = roots.join("\n      ");
       console.error(
-        chalk15.red(`
-  x Failed to decrypt the reversal map (wrong key or corrupt data). File left untouched.
+        chalk17.red(`
+  x Encryption key not found for this file \u2014 cannot decrypt the reversal map.`) + (anyKeyPresent ? chalk17.dim(`
+    A key was present but did not decrypt this map (wrong key or corrupt data).`) : chalk17.dim(`
+    No key was found under any known project location for this file.`)) + chalk17.dim(`
+    Looked under these project roots (keys dir ${opts.keysDir ?? "~/.pretense/keys"}):`) + chalk17.dim(`
+      ${looked}`) + chalk17.dim(`
+    Run \`reverse\` on the SAME machine and HOME where you mutated the file,`) + chalk17.dim(`
+    or set ${chalk17.cyan("PRETENSE_PROJECT_ROOT")} to the project root used at mutate time.`) + chalk17.dim(`
+  File left untouched.
 `)
       );
       return 1;
     }
+    plainMutations = decrypted;
   } else {
     plainMutations = mapFile.mutations.map((m) => ({ original: m.original, replacement: m.replacement }));
   }
@@ -21195,10 +21638,10 @@ function runReverse(file, opts = {}) {
   const absentCount = plainMutations.length - appliedCount;
   if (typeof mapFile.mutatedSha === "string" && mapFile.mutatedSha !== sha256Hex3(mutatedContent)) {
     console.error(
-      chalk15.yellow(`
-  ! This file is not the exact output this map was written for.`) + chalk15.dim(`
-    map expects sha256 ${mapFile.mutatedSha}`) + chalk15.dim(`
-    file is     sha256 ${sha256Hex3(mutatedContent)}`) + chalk15.dim(`
+      chalk17.yellow(`
+  ! This file is not the exact output this map was written for.`) + chalk17.dim(`
+    map expects sha256 ${mapFile.mutatedSha}`) + chalk17.dim(`
+    file is     sha256 ${sha256Hex3(mutatedContent)}`) + chalk17.dim(`
     ${absentCount} of ${plainMutations.length} mapped tokens are not present in it.
 `)
     );
@@ -21208,8 +21651,8 @@ function runReverse(file, opts = {}) {
     restored = applyReverse(mutatedContent, plainMutations);
   } catch (e) {
     console.error(
-      chalk15.red(`
-  x ${e.message}`) + chalk15.dim(`
+      chalk17.red(`
+  x ${e.message}`) + chalk17.dim(`
   File left untouched.
 `)
     );
@@ -21217,8 +21660,8 @@ function runReverse(file, opts = {}) {
   }
   if (!mapFile.originalSha) {
     console.error(
-      chalk15.red(`
-  x Reversal map has no originalSha \u2014 cannot verify round-trip integrity.`) + chalk15.dim(`
+      chalk17.red(`
+  x Reversal map has no originalSha \u2014 cannot verify round-trip integrity.`) + chalk17.dim(`
   Refusing to write. File left untouched.
 `)
     );
@@ -21227,10 +21670,10 @@ function runReverse(file, opts = {}) {
   const restoredSha = sha256Hex3(restored);
   if (restoredSha !== mapFile.originalSha) {
     console.error(
-      chalk15.red(`
-  x Reversal integrity check failed for ${absPath}`) + chalk15.dim(`
-    expected sha256 ${mapFile.originalSha}`) + chalk15.dim(`
-    got      sha256 ${restoredSha}`) + chalk15.dim(`
+      chalk17.red(`
+  x Reversal integrity check failed for ${absPath}`) + chalk17.dim(`
+    expected sha256 ${mapFile.originalSha}`) + chalk17.dim(`
+    got      sha256 ${restoredSha}`) + chalk17.dim(`
   File left untouched.
 `)
     );
@@ -21241,30 +21684,30 @@ function runReverse(file, opts = {}) {
     const what = lineage.exact ? `This map is mutation GENERATION ${lineage.generation}.` : `This map's "original" values look like Pretense synthetics (${lineage.syntheticCount} of ${plainMutations.length}).`;
     if (!opts.allowPartial) {
       console.error(
-        chalk15.red(`
-  x NOT A RESTORE: ${what}`) + chalk15.dim(`
-    Its originals are themselves synthetics from an earlier mutation of this`) + chalk15.dim(`
-    file, so applying it would return the PREVIOUS MUTATED VERSION, not your`) + chalk15.dim(`
-    real secrets \u2014 while every integrity check passed, because the map is`) + chalk15.dim(`
-    self-consistent with the file. Reverse with the map from the FIRST`) + chalk15.dim(`
-    mutation round instead.`) + chalk15.dim(`
-    --allow-partial writes it anyway (useful only to walk a chain back one`) + chalk15.dim(`
-    generation at a time).`) + chalk15.dim(`
+        chalk17.red(`
+  x NOT A RESTORE: ${what}`) + chalk17.dim(`
+    Its originals are themselves synthetics from an earlier mutation of this`) + chalk17.dim(`
+    file, so applying it would return the PREVIOUS MUTATED VERSION, not your`) + chalk17.dim(`
+    real secrets \u2014 while every integrity check passed, because the map is`) + chalk17.dim(`
+    self-consistent with the file. Reverse with the map from the FIRST`) + chalk17.dim(`
+    mutation round instead.`) + chalk17.dim(`
+    --allow-partial writes it anyway (useful only to walk a chain back one`) + chalk17.dim(`
+    generation at a time).`) + chalk17.dim(`
   File left untouched.
 `)
       );
       return 1;
     }
     console.error(
-      chalk15.yellow(`
-  ! PARTIAL RESTORE (--allow-partial): ${what}`) + chalk15.dim(`
-    The output is the PREVIOUS MUTATED GENERATION of this file, NOT the`) + chalk15.dim(`
-    original. ${lineage.syntheticCount || "Some"} restored value(s) are still synthetic. Reverse again with`) + chalk15.dim(`
+      chalk17.yellow(`
+  ! PARTIAL RESTORE (--allow-partial): ${what}`) + chalk17.dim(`
+    The output is the PREVIOUS MUTATED GENERATION of this file, NOT the`) + chalk17.dim(`
+    original. ${lineage.syntheticCount || "Some"} restored value(s) are still synthetic. Reverse again with`) + chalk17.dim(`
     the earlier round's map to reach the real secrets.
 `)
     );
   }
-  const mark = lineage.ok ? chalk15.green("  \u2713 Restored") : chalk15.yellow("  ! Partially restored");
+  const mark = lineage.ok ? chalk17.green("  \u2713 Restored") : chalk17.yellow("  ! Partially restored");
   const detail = `${appliedCount} of ${plainMutations.length} mapped tokens` + (lineage.ok ? "" : " \u2014 to an earlier MUTATED generation, not the original");
   const preview = opts.stdout === true;
   const inPlace = !preview && !opts.output;
@@ -21277,6 +21720,19 @@ function runReverse(file, opts = {}) {
   } else {
     process.stdout.write(restored);
   }
+  if (!preview && appliedCount > 0) {
+    recordLocalAudit({
+      action: "reversed",
+      mutationsApplied: appliedCount,
+      secretsBlocked: 0,
+      piiRedacted: 0,
+      originalSize: Buffer.byteLength(mutatedContent, "utf-8"),
+      processedSize: Buffer.byteLength(restored, "utf-8"),
+      durationMs: Date.now() - reverseStartMs,
+      detectorKinds: [...new Set(mapFile.mutations.map((m) => m.type).filter((t) => typeof t === "string"))],
+      file: absPath
+    });
+  }
   if (opts.json) {
     console.error(
       JSON.stringify({
@@ -21294,7 +21750,7 @@ function runReverse(file, opts = {}) {
   return 0;
 }
 function reverseCommand() {
-  return new Command16("reverse").description(
+  return new Command17("reverse").description(
     "Restore a mutated file to its EXACT original bytes IN PLACE, auto-finding its reversal map (fails if the file was edited after mutation)"
   ).argument("<file>", "Mutated file to restore (must be byte-identical to the mutate output)").option(
     "--map <path>",
@@ -21309,8 +21765,8 @@ function reverseCommand() {
 
 // src/commands/run.ts
 init_esm_shims();
-import { Command as Command17 } from "commander";
-import chalk16 from "chalk";
+import { Command as Command18 } from "commander";
+import chalk18 from "chalk";
 import { spawn } from "child_process";
 import { basename as basename3 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -21384,20 +21840,23 @@ async function waitHealthy(port, deadlineMs, pollMs = 150) {
 }
 function spawnProxy(port) {
   const cliEntry = process.argv[1] ?? fileURLToPath4(import.meta.url);
-  return spawn(process.execPath, [cliEntry, "start", "--port", String(port), "--strict-port"], {
+  const startArgs = ["start", "--port", String(port), "--strict-port"];
+  const isCompiledBinary = cliEntry.includes("$bunfs") || cliEntry.includes("~BUN");
+  const spawnArgs = isCompiledBinary ? startArgs : [cliEntry, ...startArgs];
+  return spawn(process.execPath, spawnArgs, {
     stdio: ["ignore", "ignore", "pipe"],
     env: process.env
   });
 }
 function runCommand() {
-  return new Command17("run").alias("with").description(
+  return new Command18("run").alias("with").description(
     "Run an AI tool THROUGH the Pretense proxy with zero setup \u2014 auto-starts the proxy, sets the right base-URL env var, and stops the proxy it started when the tool exits"
   ).argument("<tool>", "The AI CLI to run (claude, cursor, gemini, \u2026)").argument("[args...]", "Arguments passed through to <tool>").option("--provider <name>", "Force the provider mapping: anthropic | openai | google").option("-p, --port <port>", "Preferred proxy port when starting one (default 9339)").option("--strict-port", "Fail instead of auto-advancing when starting a proxy on a busy port", false).passThroughOptions().allowUnknownOption().action(async (tool, args, opts) => {
     let provider;
     try {
       provider = resolveProvider(tool, opts.provider);
     } catch (err) {
-      console.error(chalk16.red(`
+      console.error(chalk18.red(`
   x ${err.message}
 `));
       process.exit(1);
@@ -21408,13 +21867,13 @@ function runCommand() {
     const rec = readProxyRecord();
     if (rec && isProcessAlive(rec.pid) && await isProxyHealthy(rec.port)) {
       port = rec.port;
-      console.error(chalk16.dim(`  \u21BA Reusing the Pretense proxy already running on port ${port}.`));
+      console.error(chalk18.dim(`  \u21BA Reusing the Pretense proxy already running on port ${port}.`));
     } else {
       const preferred = opts.port ? parseInt(opts.port, 10) : 9339;
       try {
         port = await findFreePort(preferred);
       } catch (err) {
-        console.error(chalk16.red(`
+        console.error(chalk18.red(`
   x ${err.message}
 `));
         process.exit(1);
@@ -21428,14 +21887,14 @@ function runCommand() {
       const ready = await waitHealthy(port, 15e3);
       if (!ready) {
         console.error(
-          chalk16.red(`
-  x Pretense proxy did not become healthy on port ${port} in time.`) + (proxyStderr ? chalk16.dim(`
+          chalk18.red(`
+  x Pretense proxy did not become healthy on port ${port} in time.`) + (proxyStderr ? chalk18.dim(`
 ${proxyStderr.split("\n").slice(-6).join("\n")}`) : "") + "\n"
         );
         proxyChild.kill("SIGTERM");
         process.exit(1);
       }
-      console.error(chalk16.green(`  \u2713 Started Pretense proxy on port ${port}.`));
+      console.error(chalk18.green(`  \u2713 Started Pretense proxy on port ${port}.`));
     }
     const stopStartedProxy = () => {
       if (startedByUs && proxyChild && !proxyChild.killed) {
@@ -21444,7 +21903,7 @@ ${proxyStderr.split("\n").slice(-6).join("\n")}`) : "") + "\n"
     };
     const inject = injectedEnvFor(provider, port);
     console.error(
-      chalk16.dim(
+      chalk18.dim(
         `  \u2192 Routing ${basename3(tool)} through the proxy (${primaryEnvVar(provider)}=http://localhost:${port}).
 `
       )
@@ -21463,15 +21922,15 @@ ${proxyStderr.split("\n").slice(-6).join("\n")}`) : "") + "\n"
     child.on("error", (err) => {
       if (err.code === "ENOENT") {
         console.error(
-          chalk16.red(`
-  x "${tool}" is not on your PATH.`) + chalk16.dim(`
-    Install it (e.g. the ${basename3(tool)} CLI) and try again, or check the name.`) + chalk16.dim(`
-    You can still point a client at the proxy yourself:`) + chalk16.dim(`
+          chalk18.red(`
+  x "${tool}" is not on your PATH.`) + chalk18.dim(`
+    Install it (e.g. the ${basename3(tool)} CLI) and try again, or check the name.`) + chalk18.dim(`
+    You can still point a client at the proxy yourself:`) + chalk18.dim(`
       ${primaryEnvVar(provider)}=http://localhost:${port}
 `)
         );
       } else {
-        console.error(chalk16.red(`
+        console.error(chalk18.red(`
   x Could not run "${tool}": ${err.message}
 `));
       }
@@ -21490,8 +21949,8 @@ ${proxyStderr.split("\n").slice(-6).join("\n")}`) : "") + "\n"
 
 // src/commands/policy.ts
 init_esm_shims();
-import { Command as Command18 } from "commander";
-import chalk17 from "chalk";
+import { Command as Command19 } from "commander";
+import chalk19 from "chalk";
 function listAction(opts) {
   const ids = listPresetIds();
   if (opts.json) {
@@ -21514,21 +21973,21 @@ function listAction(opts) {
     );
     return;
   }
-  console.log(chalk17.cyan("\n  Pretense Compliance Frameworks\n"));
+  console.log(chalk19.cyan("\n  Pretense Compliance Frameworks\n"));
   console.log(
-    chalk17.dim(
+    chalk19.dim(
       "  " + "ID".padEnd(8) + "NAME".padEnd(14) + "TIER".padEnd(12) + "AUDIT".padEnd(8) + "DETECTORS"
     )
   );
-  console.log(chalk17.dim("  " + "\u2500".repeat(64)));
+  console.log(chalk19.dim("  " + "\u2500".repeat(64)));
   for (const id of ids) {
     const p = COMPLIANCE_PRESETS[id];
     console.log(
-      "  " + chalk17.bold(p.id.padEnd(8)) + p.name.padEnd(14) + chalk17.dim(p.minTier.padEnd(12)) + (p.auditRequired ? chalk17.green("yes".padEnd(8)) : chalk17.dim("no".padEnd(8))) + chalk17.dim(`${Object.keys(p.actionOverrides).length} overrides`)
+      "  " + chalk19.bold(p.id.padEnd(8)) + p.name.padEnd(14) + chalk19.dim(p.minTier.padEnd(12)) + (p.auditRequired ? chalk19.green("yes".padEnd(8)) : chalk19.dim("no".padEnd(8))) + chalk19.dim(`${Object.keys(p.actionOverrides).length} overrides`)
     );
   }
-  console.log(chalk17.dim(`
-  Run ${chalk17.cyan("pretense policy show <id>")} for detector-level detail.
+  console.log(chalk19.dim(`
+  Run ${chalk19.cyan("pretense policy show <id>")} for detector-level detail.
 `));
 }
 function showAction(id, opts) {
@@ -21537,8 +21996,8 @@ function showAction(id, opts) {
     preset = loadPreset(id);
   } catch (err) {
     console.error(
-      chalk17.red(`
-  x ${err.message}`) + chalk17.dim(`
+      chalk19.red(`
+  x ${err.message}`) + chalk19.dim(`
   Valid frameworks: ${listPresetIds().join(", ")}
 `)
     );
@@ -21548,24 +22007,24 @@ function showAction(id, opts) {
     console.log(JSON.stringify(preset, null, 2));
     return;
   }
-  console.log(chalk17.cyan(`
-  ${preset.name}  `) + chalk17.dim(`(${preset.id})`));
-  console.log(chalk17.dim(`  ${preset.description}
+  console.log(chalk19.cyan(`
+  ${preset.name}  `) + chalk19.dim(`(${preset.id})`));
+  console.log(chalk19.dim(`  ${preset.description}
 `));
-  console.log(`  Minimum tier:   ${chalk17.bold(preset.minTier)}`);
-  console.log(`  Audit required: ${preset.auditRequired ? chalk17.green("yes") : chalk17.dim("no")}`);
-  console.log(`  Detector sets:  ${chalk17.dim(preset.detectorSets.join(", "))}
+  console.log(`  Minimum tier:   ${chalk19.bold(preset.minTier)}`);
+  console.log(`  Audit required: ${preset.auditRequired ? chalk19.green("yes") : chalk19.dim("no")}`);
+  console.log(`  Detector sets:  ${chalk19.dim(preset.detectorSets.join(", "))}
 `);
   const overrides = Object.entries(preset.actionOverrides);
-  console.log(chalk17.dim(`  Detector actions (${overrides.length}):`));
+  console.log(chalk19.dim(`  Detector actions (${overrides.length}):`));
   for (const [detector, action] of overrides) {
-    const color = action === "block" ? chalk17.red : action === "redact" ? chalk17.yellow : chalk17.dim;
+    const color = action === "block" ? chalk19.red : action === "redact" ? chalk19.yellow : chalk19.dim;
     console.log(`    ${detector.padEnd(24)} ${color(action)}`);
   }
   console.log();
 }
 function policyCommand() {
-  const cmd = new Command18("policy").description(
+  const cmd = new Command19("policy").description(
     "List and inspect the built-in compliance presets (5: hipaa, gdpr, soc2, nist, pci)"
   );
   cmd.command("list").description("List the 5 built-in compliance presets").option("--json", "Output as JSON").action((opts) => listAction(opts));
@@ -21576,10 +22035,10 @@ function policyCommand() {
 
 // src/commands/audit.ts
 init_esm_shims();
-import { Command as Command19 } from "commander";
-import chalk18 from "chalk";
-import { homedir as homedir10 } from "os";
-import { join as join21 } from "path";
+import { Command as Command20 } from "commander";
+import chalk20 from "chalk";
+import { homedir as homedir11 } from "os";
+import { join as join24 } from "path";
 var VALID_FORMATS2 = ["table", "csv", "json", "jsonl"];
 function toSafeAuditRow(e) {
   return {
@@ -21650,18 +22109,18 @@ function resolveFormat2(opts) {
   const raw2 = opts.format?.trim().toLowerCase();
   if (raw2 !== void 0 && !VALID_FORMATS2.includes(raw2)) {
     console.error(
-      chalk18.red(`
+      chalk20.red(`
   x Unknown --format: "${opts.format}"
-`) + chalk18.dim("  Valid formats: table, csv, json (alias: jsonl).\n")
+`) + chalk20.dim("  Valid formats: table, csv, json (alias: jsonl).\n")
     );
     return null;
   }
   const fromFormat = raw2 === void 0 ? void 0 : raw2 === "jsonl" ? "json" : raw2;
   if (opts.json && fromFormat !== void 0 && fromFormat !== "json") {
     console.error(
-      chalk18.red(`
+      chalk20.red(`
   x --json and --format ${fromFormat} request different outputs.
-`) + chalk18.dim("  Pick one.\n")
+`) + chalk20.dim("  Pick one.\n")
     );
     return null;
   }
@@ -21669,17 +22128,17 @@ function resolveFormat2(opts) {
   return opts.json ? "json" : "table";
 }
 function auditCommand() {
-  return new Command19("audit").description(
+  return new Command20("audit").description(
     "Show recent mutation/tokenization audit entries (leak-proof; JSONL with --json, RFC 4180 CSV with --format csv)"
   ).option("-l, --limit <n>", "Number of entries to show", "20").option("--json", "Output as JSONL (one JSON object per line, jq-pipeable)", false).option("--db <path>", "Path to the audit database (default: ~/.pretense/audit.db)").option(
     "--framework <name>",
-    "Only entries whose detectors map to this compliance framework (e.g. HIPAA, SOC2, PCI_DSS). Use --list-frameworks to see all 36."
+    "Only entries whose detectors map to this compliance framework (e.g. HIPAA, SOC2, PCI_DSS). Use --list-frameworks to see them all."
   ).option("--list-frameworks", "List the compliance frameworks that can be filtered on", false).option(
     "--format <fmt>",
     "Output format: table (default), csv (RFC 4180 compliance export), json (JSONL)"
   ).action((opts) => {
     if (opts.listFrameworks) {
-      for (const f of COMPLIANCE_FRAMEWORKS) console.log(f);
+      for (const f of POLICY_FRAMEWORKS) console.log(f);
       return;
     }
     const format = resolveFormat2(opts);
@@ -21689,21 +22148,21 @@ function auditCommand() {
       framework = resolveFrameworkName(opts.framework);
       if (!framework) {
         console.error(
-          chalk18.red(`
+          chalk20.red(`
   x Unknown framework: "${opts.framework}"
-`) + chalk18.dim("  Run ") + chalk18.cyan("pretense audit --list-frameworks") + chalk18.dim(" to see all 36.\n")
+`) + chalk20.dim("  Run ") + chalk20.cyan("pretense audit --list-frameworks") + chalk20.dim(" to see them all.\n")
         );
         process.exit(1);
       }
     }
     const limit = parseInt(opts.limit ?? "20", 10);
     if (!Number.isFinite(limit) || limit <= 0) {
-      console.error(chalk18.red(`
+      console.error(chalk20.red(`
   x Invalid --limit: "${opts.limit}". Provide a positive integer.
 `));
       process.exit(1);
     }
-    const dbPath = opts.db ?? join21(homedir10(), ".pretense", "audit.db");
+    const dbPath = opts.db ?? join24(homedir11(), ".pretense", "audit.db");
     let rows;
     try {
       const store = new AuditStore(dbPath);
@@ -21723,8 +22182,8 @@ function auditCommand() {
         console.error("pretense: no audit data \u2014 the audit database has not been initialized yet.");
         return;
       }
-      console.log(chalk18.dim("\n  No audit data available. The audit database has not been initialized yet."));
-      console.log(chalk18.dim("  Run " + chalk18.cyan("pretense start") + " and make some requests first.\n"));
+      console.log(chalk20.dim("\n  No audit data available. The audit database has not been initialized yet."));
+      console.log(chalk20.dim("  Run " + chalk20.cyan("pretense start") + " and make some requests first.\n"));
       return;
     }
     if (format === "csv") {
@@ -21736,23 +22195,23 @@ function auditCommand() {
       return;
     }
     if (rows.length === 0) {
-      console.log(chalk18.dim("\n  No audit entries yet. Run pretense start and make some requests.\n"));
+      console.log(chalk20.dim("\n  No audit entries yet. Run pretense start and make some requests.\n"));
       return;
     }
-    console.log(chalk18.cyan(`
+    console.log(chalk20.cyan(`
   Pretense Mutation Audit \u2014 last ${rows.length} entries
 `));
     console.log(
-      chalk18.dim(
+      chalk20.dim(
         "  " + "TIME".padEnd(10) + "ACTION".padEnd(12) + "PROVIDER".padEnd(14) + "MUTATED".padEnd(10) + "BLOCKED".padEnd(10) + "PII".padEnd(8) + "MS"
       )
     );
-    console.log(chalk18.dim("  " + "\u2500".repeat(72)));
+    console.log(chalk20.dim("  " + "\u2500".repeat(72)));
     for (const row of rows) {
       const time = new Date(row.timestamp).toTimeString().slice(0, 8);
-      const actionColor = row.action === "blocked" ? chalk18.red : row.action === "mutated" ? chalk18.green : row.action === "redacted" ? chalk18.yellow : row.action === "error" ? chalk18.red : chalk18.dim;
+      const actionColor = row.action === "blocked" ? chalk20.red : row.action === "mutated" ? chalk20.green : row.action === "redacted" ? chalk20.yellow : row.action === "error" ? chalk20.red : chalk20.dim;
       console.log(
-        "  " + chalk18.dim(time.padEnd(10)) + actionColor(row.action.padEnd(12)) + chalk18.dim(row.provider.padEnd(14)) + chalk18.green(String(row.mutationsApplied).padEnd(10)) + (row.secretsBlocked > 0 ? chalk18.red(String(row.secretsBlocked).padEnd(10)) : chalk18.dim("0".padEnd(10))) + chalk18.dim(String(row.piiRedacted).padEnd(8)) + chalk18.dim(String(row.scanDurationMs).slice(0, 5))
+        "  " + chalk20.dim(time.padEnd(10)) + actionColor(row.action.padEnd(12)) + chalk20.dim(row.provider.padEnd(14)) + chalk20.green(String(row.mutationsApplied).padEnd(10)) + (row.secretsBlocked > 0 ? chalk20.red(String(row.secretsBlocked).padEnd(10)) : chalk20.dim("0".padEnd(10))) + chalk20.dim(String(row.piiRedacted).padEnd(8)) + chalk20.dim(String(row.scanDurationMs).slice(0, 5))
       );
     }
     console.log();
@@ -21761,10 +22220,10 @@ function auditCommand() {
 
 // src/commands/credits.ts
 init_esm_shims();
-import { Command as Command20 } from "commander";
-import chalk19 from "chalk";
-import { join as join24 } from "path";
-import { homedir as homedir11 } from "os";
+import { Command as Command21 } from "commander";
+import chalk21 from "chalk";
+import { join as join25 } from "path";
+import { homedir as homedir12 } from "os";
 function remaining(used, limit) {
   if (limit === null) return null;
   return Math.max(0, limit - used);
@@ -21773,16 +22232,16 @@ function fmt(n) {
   return n === null ? "unlimited" : n.toLocaleString("en-US");
 }
 function bar(used, limit, width = 24) {
-  if (limit === null) return chalk19.green("\u2588".repeat(width));
+  if (limit === null) return chalk21.green("\u2588".repeat(width));
   const pct = limit <= 0 ? 1 : Math.min(1, used / limit);
   const filled = Math.min(width, Math.round(pct * width));
   const s = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
-  if (pct >= 1) return chalk19.red(s);
-  if (pct >= 0.8) return chalk19.yellow(s);
-  return chalk19.green(s);
+  if (pct >= 1) return chalk21.red(s);
+  if (pct >= 0.8) return chalk21.yellow(s);
+  return chalk21.green(s);
 }
 function creditsCommand() {
-  return new Command20("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join24(homedir11(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command21("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join25(homedir12(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);
@@ -21795,7 +22254,7 @@ function creditsCommand() {
       periodEnd: null
     };
     if (!collected && !opts.json) {
-      console.log(chalk19.dim("\n  No usage recorded yet \u2014 showing your full allowance.\n"));
+      console.log(chalk21.dim("\n  No usage recorded yet \u2014 showing your full allowance.\n"));
     }
     const mutationLimit = tier ? PLAN_CONFIGS[tier].mutationsPerPeriod : null;
     const scanLimit = tier ? PLAN_CONFIGS[tier].scansPerPeriod : null;
@@ -21827,12 +22286,12 @@ function creditsCommand() {
       );
       return;
     }
-    console.log(chalk19.cyan("\n  Pretense Credits"));
-    console.log(chalk19.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetCadenceLabel()}
+    console.log(chalk21.cyan("\n  Pretense Credits"));
+    console.log(chalk21.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetCadenceLabel()}
 `));
     if (!tier) {
       for (const line of unverifiedNote(resolution.detail)) {
-        console.log(chalk19.yellow(`  ${line}`));
+        console.log(chalk21.yellow(`  ${line}`));
       }
       console.log();
       console.log("  " + "Mutations used".padEnd(20) + m.mutationsApplied.toLocaleString("en-US"));
@@ -21841,18 +22300,18 @@ function creditsCommand() {
       return;
     }
     console.log(
-      "  " + "Mutations".padEnd(14) + bar(m.mutationsApplied, mutationLimit) + "  " + chalk19.bold(fmt(mutationsLeft)) + chalk19.dim(` left of ${fmt(mutationLimit)}`)
+      "  " + "Mutations".padEnd(14) + bar(m.mutationsApplied, mutationLimit) + "  " + chalk21.bold(fmt(mutationsLeft)) + chalk21.dim(` left of ${fmt(mutationLimit)}`)
     );
     console.log(
-      "  " + "Requests".padEnd(14) + bar(m.totalScans, scanLimit) + "  " + chalk19.bold(fmt(scansLeft)) + chalk19.dim(` left of ${fmt(scanLimit)}`)
+      "  " + "Requests".padEnd(14) + bar(m.totalScans, scanLimit) + "  " + chalk21.bold(fmt(scansLeft)) + chalk21.dim(` left of ${fmt(scanLimit)}`)
     );
     if (tier !== "enterprise" && mutationLimit !== null && mutationsLeft === 0) {
       console.log(
-        chalk19.red("\n  Mutation budget exhausted for this period.") + chalk19.dim(" Run ") + chalk19.cyan("pretense upgrade") + chalk19.dim(" to compare plans.")
+        chalk21.red("\n  Mutation budget exhausted for this period.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );
     } else if (tier !== "enterprise" && mutationLimit !== null && m.mutationsApplied >= mutationLimit * 0.8) {
       console.log(
-        chalk19.yellow("\n  Running low.") + chalk19.dim(" Run ") + chalk19.cyan("pretense upgrade") + chalk19.dim(" to compare plans.")
+        chalk21.yellow("\n  Running low.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );
     }
     console.log();
@@ -21861,21 +22320,24 @@ function creditsCommand() {
 
 // src/commands/upgrade.ts
 init_esm_shims();
-import { Command as Command21 } from "commander";
-import chalk20 from "chalk";
+import { Command as Command22 } from "commander";
+import chalk22 from "chalk";
 var PRICING_URL = "https://pretense.ai/pricing";
 var TIERS = ["free", "pro", "enterprise"];
 function quota(n) {
   return n === null ? "unlimited" : n.toLocaleString();
 }
 function seats(n) {
-  return n === null ? "unlimited" : String(n);
+  return n === null ? "up to 100" : String(n);
+}
+function comingSoonOrDash(enabled) {
+  return enabled ? "coming soon" : "\u2014";
 }
 function yesNo(b) {
   return b ? "yes" : "\u2014";
 }
 function upgradeCommand() {
-  return new Command21("upgrade").description("Compare Pretense plans and upgrade").option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command22("upgrade").description("Compare Pretense plans and upgrade").option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const current = resolution.tier;
     if (opts.json) {
@@ -21903,40 +22365,41 @@ function upgradeCommand() {
       );
       return;
     }
-    console.log(chalk20.cyan("\n  Pretense Plans\n"));
+    console.log(chalk22.cyan("\n  Pretense Plans\n"));
     const col = 16;
     const header = "  " + "".padEnd(18) + TIERS.map((t) => tierName(t).padEnd(col)).join("");
-    console.log(chalk20.bold(header));
-    console.log("  " + chalk20.dim("\u2500".repeat(18 + col * TIERS.length)));
+    console.log(chalk22.bold(header));
+    console.log("  " + chalk22.dim("\u2500".repeat(18 + col * TIERS.length)));
     const rows = [
       ["Price", (t) => priceLabel(t)],
       ["Mutations/7d", (t) => quota(PLAN_CONFIGS[t].mutationsPerPeriod)],
       ["Requests/7d", (t) => quota(PLAN_CONFIGS[t].scansPerPeriod)],
       ["Seats", (t) => seats(PLAN_CONFIGS[t].maxSeats)],
-      ["SSO", (t) => yesNo(PLAN_CONFIGS[t].ssoEnabled)],
+      ["SSO", (t) => comingSoonOrDash(PLAN_CONFIGS[t].ssoEnabled)],
+      // On-prem IS truthful — Docker + Helm ship — so it stays yes/—.
       ["On-prem", (t) => yesNo(PLAN_CONFIGS[t].onPremEnabled)]
     ];
     for (const [label, cell] of rows) {
       console.log("  " + label.padEnd(18) + TIERS.map((t) => cell(t).padEnd(col)).join(""));
     }
-    console.log("  " + chalk20.dim("\u2500".repeat(18 + col * TIERS.length)));
+    console.log("  " + chalk22.dim("\u2500".repeat(18 + col * TIERS.length)));
     if (current) {
-      console.log(chalk20.dim(`
+      console.log(chalk22.dim(`
   Current plan: ${tierName(current)}`));
       if (current === "enterprise") {
-        console.log(chalk20.green("  You are on the highest tier \u2014 nothing to upgrade.\n"));
+        console.log(chalk22.green("  You are on the highest tier \u2014 nothing to upgrade.\n"));
         return;
       }
     } else {
       console.log(
-        chalk20.yellow(
+        chalk22.yellow(
           `
   Could not confirm your current plan: ${resolution.detail ?? "unknown reason"}.`
         )
       );
     }
     const from = current ?? "unknown";
-    console.log(chalk20.bold(`
+    console.log(chalk22.bold(`
   \u2192 ${PRICING_URL}?ref=cli_upgrade&from=${from}
 `));
   });
@@ -21969,35 +22432,36 @@ function findClosestCommand(input, knownCommands) {
   }
   return bestDist <= 3 ? best : null;
 }
-var program = new Command22();
-program.name("pretense").enablePositionalOptions().description(chalk21.bold("AI firewall") + " \u2014 mutates proprietary code before LLM API calls").version(PRETENSE_VERSION, "-v, --version").addHelpText("after", `
-${chalk21.bold("Quick start:")}
-  ${chalk21.cyan("pretense run claude")} ${chalk21.dim('"build X"')}     Run an AI tool through the proxy (zero setup)
-  ${chalk21.cyan("pretense mutate")} ${chalk21.dim("<file>")}           Mutate secrets in place (reverse with the same path)
-  ${chalk21.cyan("pretense scan")} ${chalk21.dim("<file|dir>")}        Scan for secrets and PII
+var program = new Command23();
+program.name("pretense").enablePositionalOptions().description(chalk23.bold("AI firewall") + " \u2014 mutates proprietary code before LLM API calls").version(PRETENSE_VERSION, "-v, --version").addHelpText("after", `
+${chalk23.bold("Quick start:")}
+  ${chalk23.cyan("pretense run claude")} ${chalk23.dim('"build X"')}     Run an AI tool through the proxy (zero setup)
+  ${chalk23.cyan("pretense mutate")} ${chalk23.dim("<file>")}           Mutate secrets in place (reverse with the same path)
+  ${chalk23.cyan("pretense scan")} ${chalk23.dim("<file|dir>")}        Scan for secrets and PII
 
-${chalk21.dim("All commands:")}
-  ${chalk21.cyan("pretense init")}                   Scan codebase and build protection profile
-  ${chalk21.cyan("pretense run <tool>")}             Run an AI tool through the proxy, no manual export
-  ${chalk21.cyan("pretense start")}                  Start proxy on localhost:9339
-  ${chalk21.cyan("pretense stop")}                   Stop the running proxy
-  ${chalk21.cyan("pretense scan src/api.ts")}        Scan file for secrets
-  ${chalk21.cyan("pretense scan ci")}                CI-optimized scan (exit 0=clean, 2=findings)
-  ${chalk21.cyan("pretense status")}                 Show protection status
-  ${chalk21.cyan("pretense review")}                 Preview mutations that would be applied
-  ${chalk21.cyan("pretense review --json")}          Output review as JSON
-  ${chalk21.cyan("pretense mutate <file>")}          Mutate secrets in place + auto-write reversal map
-  ${chalk21.cyan("pretense reverse <file>")}         Restore a mutated file (auto-finds its map)
-  ${chalk21.cyan("pretense policy list")}            List the 5 compliance presets
-  ${chalk21.cyan("pretense audit")}                  Show mutation audit log
-  ${chalk21.cyan("pretense usage")}                  Plan usage vs limits
-  ${chalk21.cyan("pretense credits")}                Remaining mutation budget (alias: tokens)
-  ${chalk21.cyan("pretense upgrade")}                Compare plans / upgrade
-  ${chalk21.cyan("pretense auth login")}             Authenticate with Pretense
-  ${chalk21.cyan("pretense install")}                Install git hooks
-  ${chalk21.cyan("pretense logs --limit 20")}        Show recent audit entries
+${chalk23.dim("All commands:")}
+  ${chalk23.cyan("pretense init")}                   Scan codebase and build protection profile
+  ${chalk23.cyan("pretense run <tool>")}             Run an AI tool through the proxy, no manual export
+  ${chalk23.cyan("pretense start")}                  Start proxy on localhost:9339
+  ${chalk23.cyan("pretense stop")}                   Stop the running proxy
+  ${chalk23.cyan("pretense scan src/api.ts")}        Scan file for secrets
+  ${chalk23.cyan("pretense scan ci")}                CI-optimized scan (exit 0=clean, 2=findings)
+  ${chalk23.cyan("pretense status")}                 Show protection status
+  ${chalk23.cyan("pretense doctor")}                 Diagnose why the proxy isn't catching traffic
+  ${chalk23.cyan("pretense review")}                 Preview mutations that would be applied
+  ${chalk23.cyan("pretense review --json")}          Output review as JSON
+  ${chalk23.cyan("pretense mutate <file>")}          Mutate secrets in place + auto-write reversal map
+  ${chalk23.cyan("pretense reverse <file>")}         Restore a mutated file (auto-finds its map)
+  ${chalk23.cyan("pretense policy list")}            List the 5 compliance presets
+  ${chalk23.cyan("pretense audit")}                  Show mutation audit log
+  ${chalk23.cyan("pretense usage")}                  Plan usage vs limits
+  ${chalk23.cyan("pretense credits")}                Remaining mutation budget (alias: tokens)
+  ${chalk23.cyan("pretense upgrade")}                Compare plans / upgrade
+  ${chalk23.cyan("pretense auth login")}             Authenticate with Pretense
+  ${chalk23.cyan("pretense install")}                Install git hooks
+  ${chalk23.cyan("pretense logs --limit 20")}        Show recent audit entries
 
-${chalk21.dim("Run")} ${chalk21.cyan("pretense <command> --help")} ${chalk21.dim("for command-specific help.")}
+${chalk23.dim("Run")} ${chalk23.cyan("pretense <command> --help")} ${chalk23.dim("for command-specific help.")}
 `);
 var KNOWN_COMMANDS = [
   "init",
@@ -22025,7 +22489,8 @@ var KNOWN_COMMANDS = [
   "logout",
   "credits",
   "tokens",
-  "upgrade"
+  "upgrade",
+  "doctor"
 ];
 program.command("version").description("Print Pretense CLI version").action(() => {
   console.log(`@pretense/cli v${program.version()}`);
@@ -22058,16 +22523,17 @@ program.addCommand(policyCommand());
 program.addCommand(auditCommand());
 program.addCommand(creditsCommand());
 program.addCommand(upgradeCommand());
+program.addCommand(doctorCommand());
 program.on("command:*", (operands) => {
   const unknown = operands[0] ?? "";
   const suggestion = findClosestCommand(unknown, KNOWN_COMMANDS);
-  console.error(chalk21.red(`
+  console.error(chalk23.red(`
   x Unknown command: "${unknown}"`));
   if (suggestion) {
-    console.error(chalk21.yellow(`  Did you mean: ${chalk21.bold(`pretense ${suggestion}`)}`));
+    console.error(chalk23.yellow(`  Did you mean: ${chalk23.bold(`pretense ${suggestion}`)}`));
   }
-  console.error(chalk21.dim(`
-  Run ${chalk21.cyan("pretense --help")} to see all available commands.
+  console.error(chalk23.dim(`
+  Run ${chalk23.cyan("pretense --help")} to see all available commands.
 `));
   process.exit(1);
 });