@runhalo/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -252,6 +252,20 @@ function c(color, text) {
  * Format violations as human-readable text
  */
 function formatText(results, verbose = false, fileCount = 0, scoreResult) {
+    // Load confidence map for verbose mode
+    let confidenceMap = {};
+    if (verbose) {
+        try {
+            const rulesJsonPath = require.resolve('@runhalo/engine/rules/rules.json');
+            const rulesData = JSON.parse(fs.readFileSync(rulesJsonPath, 'utf-8'));
+            for (const rule of rulesData.rules || []) {
+                if (rule.id && rule.confidence) {
+                    confidenceMap[rule.id] = rule.confidence;
+                }
+            }
+        }
+        catch { /* ignore — confidence display is optional */ }
+    }
     let output = '';
     let totalViolations = 0;
     let criticalCount = 0;
@@ -298,15 +312,52 @@ function formatText(results, verbose = false, fileCount = 0, scoreResult) {
                 default:
                     severityTag = c(colors.dim, 'LOW');
             }
+            // Sprint 8: AST verdict badge
+            let astBadge = '';
+            if (violation.astVerdict === 'confirmed') {
+                astBadge = c(colors.red, ' [AST ✓]');
+            }
+            else if (violation.astVerdict === 'suppressed') {
+                astBadge = c(colors.dim, ' [AST suppressed]');
+            }
+            else if (violation.astVerdict === 'regex_only') {
+                astBadge = c(colors.dim, ' [regex]');
+            }
+            // Sprint 8: Confidence badge
+            let confidenceBadge = '';
+            if (violation.confidence !== undefined) {
+                const confVal = violation.confidence;
+                const confStr = confVal.toFixed(2);
+                if (confVal >= 0.7) {
+                    confidenceBadge = c(colors.red, ` [${confStr}]`);
+                }
+                else if (confVal >= 0.4) {
+                    confidenceBadge = c(colors.yellow, ` [${confStr}]`);
+                }
+                else {
+                    confidenceBadge = c(colors.dim, ` [${confStr}]`);
+                }
+            }
             // Always show line:column (developer-standard format)
             const location = c(colors.dim, `${violation.line}:${violation.column}`);
-            output += `  ${location}  ${severityTag}  ${c(colors.cyan, violation.ruleId)}\n`;
+            output += `  ${location}  ${severityTag}  ${c(colors.cyan, violation.ruleId)}${astBadge}${confidenceBadge}\n`;
             output += `  ${c(colors.dim, '│')} ${violation.message}\n`;
             if (verbose) {
                 output += `  ${c(colors.dim, '│')} ${c(colors.magenta, '💡')} ${violation.fixSuggestion}\n`;
                 if (violation.penalty) {
                     output += `  ${c(colors.dim, '│')} ${c(colors.red, '⚠')}  Penalty: ${violation.penalty}\n`;
                 }
+                if (violation.astReason) {
+                    output += `  ${c(colors.dim, '│')} ${c(colors.dim, '🔬')} AST: ${violation.astReason}\n`;
+                }
+                if (violation.confidenceReason) {
+                    output += `  ${c(colors.dim, '│')} ${c(colors.dim, '📊')} ${violation.confidenceReason}\n`;
+                }
+                const conf = confidenceMap[violation.ruleId];
+                if (conf) {
+                    const confColor = conf === 'high' ? colors.green : conf === 'medium' ? colors.yellow : colors.red;
+                    output += `  ${c(colors.dim, '│')} Rule confidence: ${c(confColor, conf)}\n`;
+                }
             }
             output += '\n';
         }
@@ -604,6 +655,10 @@ function escapeHtml(text) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
+// ==================== Module-level scan data for cross-function access ====================
+// Stores the last scan's results so the action handler can regenerate the PDF
+// with AI Review Board data after the review board runs.
+const _lastScanData = { results: [], scoreResult: null, fileCount: 0, projectPath: '' };
 // ==================== PDF Report Generator (P3-2) ====================
 // PDF color constants
 const PDF_COLORS = {
@@ -639,11 +694,7 @@ function severityColor(severity) {
         default: return PDF_COLORS.cyan;
     }
 }
-/**
- * Generate a government-procurement-grade PDF compliance report.
- * Uses PDFKit — pure JS, no browser dependencies, CI-safe.
- */
-function generatePdfReport(results, scoreResult, fileCount, projectPath, history) {
+function generatePdfReport(results, scoreResult, fileCount, projectPath, history, reviewData) {
     return new Promise((resolve, reject) => {
         const doc = new pdfkit_1.default({
             size: 'LETTER',
@@ -932,6 +983,117 @@ function generatePdfReport(results, scoreResult, fileCount, projectPath, history
             }
             addFooter();
         }
+        // ═══════════════ AI REVIEW BOARD (Sprint 9) ═══════════════
+        if (reviewData && reviewData.results.length > 0) {
+            doc.addPage();
+            doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('AI Review Board Assessment', 60, 60);
+            doc.moveTo(60, 88).lineTo(60 + pageWidth, 88).lineWidth(1).strokeColor(PDF_COLORS.border).stroke();
+            y = 100;
+            // Review Board summary box
+            doc.rect(60, y, pageWidth, 70).fill(PDF_COLORS.lightBg);
+            doc.fontSize(10).fillColor(PDF_COLORS.bodyText);
+            doc.text(`${reviewData.summary.total} violations reviewed by Halo AI Review Board`, 70, y + 8, { width: pageWidth - 20 });
+            y += 22;
+            const verdictLine = [
+                reviewData.summary.escalated > 0 ? `🔴 ${reviewData.summary.escalated} escalated` : '',
+                reviewData.summary.confirmed > 0 ? `🟡 ${reviewData.summary.confirmed} confirmed` : '',
+                reviewData.summary.downgraded > 0 ? `🟢 ${reviewData.summary.downgraded} downgraded` : '',
+                reviewData.summary.dismissed > 0 ? `✅ ${reviewData.summary.dismissed} dismissed` : '',
+            ].filter(Boolean).join('   ');
+            doc.fontSize(9).fillColor(PDF_COLORS.bodyText);
+            doc.text(verdictLine, 70, y, { width: pageWidth - 20 });
+            y += 16;
+            // Marshall summary
+            if (reviewData.marshall_summary) {
+                const ms = reviewData.marshall_summary;
+                doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                doc.text(`Marshall Intelligence: ${ms.enriched_count} violations enriched | Avg urgency: ${ms.avg_urgency} | ${ms.active_enforcement_count} in active enforcement areas`, 70, y, { width: pageWidth - 20 });
+            }
+            y += 40; // past the summary box
+            // Per-verdict sections
+            const verdictOrder = [
+                { key: 'escalated', label: 'ESCALATED — More Serious Than Initially Detected', color: PDF_COLORS.red, emoji: '🔴' },
+                { key: 'confirmed', label: 'CONFIRMED — Violations Validated by AI Review', color: PDF_COLORS.orange, emoji: '🟡' },
+                { key: 'downgraded', label: 'DOWNGRADED — Lower Risk Than Severity Suggests', color: PDF_COLORS.green, emoji: '🟢' },
+                { key: 'dismissed', label: 'DISMISSED — False Positives Cleared', color: PDF_COLORS.cyan, emoji: '✅' },
+            ];
+            for (const vType of verdictOrder) {
+                const items = reviewData.results.filter(r => r.verdict === vType.key);
+                if (items.length === 0)
+                    continue;
+                if (y > doc.page.height - 140) {
+                    addFooter();
+                    doc.addPage();
+                    y = 60;
+                }
+                doc.fontSize(12).fillColor(vType.color);
+                doc.text(`${vType.emoji} ${vType.label} (${items.length})`, 60, y);
+                y += 20;
+                // Show up to 10 per verdict type
+                const itemsToShow = items.slice(0, 10);
+                for (const item of itemsToShow) {
+                    if (y > doc.page.height - 100) {
+                        addFooter();
+                        doc.addPage();
+                        y = 60;
+                    }
+                    // Rule ID + verdict
+                    doc.fontSize(9).fillColor(PDF_COLORS.primary);
+                    doc.text(item.ruleId, 70, y);
+                    y += 14;
+                    // Clinical context
+                    if (item.clinicalContext) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.bodyText);
+                        const ctxHeight = doc.heightOfString(item.clinicalContext, { width: pageWidth - 30 });
+                        doc.text(item.clinicalContext, 80, y, { width: pageWidth - 30 });
+                        y += ctxHeight + 4;
+                    }
+                    // Age groups
+                    if (item.ageGroupImpact && item.ageGroupImpact.length > 0) {
+                        doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                        doc.text(`Ages most affected: ${item.ageGroupImpact.join(', ')}`, 80, y);
+                        y += 12;
+                    }
+                    // Regulatory context (Marshall enrichment)
+                    if (item.regulatoryContext) {
+                        const rc = item.regulatoryContext;
+                        const priorityLabel = rc.enforcement_priority === 'active' ? '🔴 ACTIVE'
+                            : rc.enforcement_priority === 'watching' ? '🟡 WATCHING' : '⚪ DORMANT';
+                        doc.fontSize(7).fillColor(PDF_COLORS.red);
+                        doc.text(`Regulatory: ${rc.regulation} | ${priorityLabel} | Penalty: ${rc.penalty_exposure} | Urgency: ${rc.urgency_score}`, 80, y, { width: pageWidth - 30 });
+                        y += 12;
+                        if (rc.recent_case) {
+                            doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                            doc.text(`Recent precedent: ${rc.recent_case}`, 80, y, { width: pageWidth - 30 });
+                            y += 12;
+                        }
+                    }
+                    // Remediation
+                    if (item.remediationGuidance) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.green);
+                        const remHeight = doc.heightOfString(`Fix: ${item.remediationGuidance}`, { width: pageWidth - 30 });
+                        doc.text(`Fix: ${item.remediationGuidance}`, 80, y, { width: pageWidth - 30 });
+                        y += remHeight + 4;
+                    }
+                    y += 8;
+                }
+                if (items.length > 10) {
+                    doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                    doc.text(`+ ${items.length - 10} more ${vType.key} violation(s). See full results on your Halo Dashboard.`, 80, y, { width: pageWidth - 30 });
+                    y += 16;
+                }
+                y += 10;
+            }
+            // Review Board footer note
+            if (y > doc.page.height - 80) {
+                addFooter();
+                doc.addPage();
+                y = 60;
+            }
+            doc.fontSize(7).fillColor(PDF_COLORS.lightText);
+            doc.text(`Reviewed by Halo AI Review Board (Richard + Marshall) in ${reviewData.latency_ms}ms. Cost: $${reviewData.cost.estimated_usd.toFixed(4)}. ${reviewData.summary.cache_hits} results served from cache.`, 60, y, { width: pageWidth });
+            addFooter();
+        }
         // ═══════════════ RECOMMENDATIONS ═══════════════
         doc.addPage();
         doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('Recommendations', 60, 60);
@@ -1017,6 +1179,122 @@ function loadHaloignore(startDir) {
     }
     return undefined;
 }
+/**
+ * Detect the project framework by scanning project files.
+ * Checks package.json, Gemfile, go.mod, Cargo.toml, manage.py, requirements.txt.
+ * Returns a framework identifier string or null if unknown.
+ */
+function detectProjectFramework(dir) {
+    // Check package.json for JS/TS frameworks
+    const pkgPath = path.join(dir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            const allDeps = {
+                ...(pkg.dependencies || {}),
+                ...(pkg.devDependencies || {}),
+            };
+            // Order matters: check specific frameworks before generic ones
+            if (allDeps['next'])
+                return 'nextjs';
+            if (allDeps['@angular/core'])
+                return 'angular';
+            if (allDeps['vue'])
+                return 'vue';
+            if (allDeps['svelte'])
+                return 'svelte';
+            if (allDeps['react'])
+                return 'react';
+        }
+        catch {
+            // Malformed package.json — continue detection
+        }
+    }
+    // Django: manage.py or requirements.txt with django
+    if (fs.existsSync(path.join(dir, 'manage.py')))
+        return 'django';
+    const reqPath = path.join(dir, 'requirements.txt');
+    if (fs.existsSync(reqPath)) {
+        try {
+            const reqs = fs.readFileSync(reqPath, 'utf-8').toLowerCase();
+            if (reqs.includes('django'))
+                return 'django';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Rails: Gemfile with rails
+    const gemfilePath = path.join(dir, 'Gemfile');
+    if (fs.existsSync(gemfilePath)) {
+        try {
+            const gemfile = fs.readFileSync(gemfilePath, 'utf-8').toLowerCase();
+            if (gemfile.includes('rails'))
+                return 'rails';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Go
+    if (fs.existsSync(path.join(dir, 'go.mod')))
+        return 'go';
+    // Rust
+    if (fs.existsSync(path.join(dir, 'Cargo.toml')))
+        return 'rust';
+    return null;
+}
+/**
+ * Get default .haloignore content based on detected framework.
+ */
+function getDefaultHaloignoreContent(framework) {
+    const lines = [
+        '# Halo ignore patterns',
+        '# Generated by: runhalo init',
+        '',
+        'node_modules/',
+        'dist/',
+        'build/',
+        'coverage/',
+        '*.min.js',
+        '*.bundle.js',
+    ];
+    // Add framework-specific ignores
+    switch (framework) {
+        case 'nextjs':
+            lines.push('.next/');
+            lines.push('.vercel/');
+            break;
+        case 'angular':
+            lines.push('.angular/');
+            break;
+        case 'vue':
+            lines.push('.nuxt/');
+            break;
+        case 'svelte':
+            lines.push('.svelte-kit/');
+            break;
+        case 'django':
+            lines.push('__pycache__/');
+            lines.push('*.pyc');
+            lines.push('.venv/');
+            lines.push('venv/');
+            break;
+        case 'rails':
+            lines.push('tmp/');
+            lines.push('log/');
+            lines.push('vendor/bundle/');
+            break;
+        case 'go':
+            lines.push('vendor/');
+            break;
+        case 'rust':
+            lines.push('target/');
+            break;
+    }
+    lines.push('');
+    return lines.join('\n');
+}
 /**
  * Create a Halo engine instance
  */
@@ -1035,7 +1313,9 @@ function scanFile(filePath, content) {
  * Scan a directory
  */
 async function scanDirectory(dirPath, config) {
+    // Create two engines: one for active violations, one with suppressions included
     const engine = new engine_1.HaloEngine(config);
+    const suppressionEngine = new engine_1.HaloEngine({ ...config, includeSuppressed: true });
     const results = [];
     const stats = fs.statSync(dirPath);
     if (stats.isDirectory()) {
@@ -1055,12 +1335,15 @@ async function scanDirectory(dirPath, config) {
             try {
                 const content = fs.readFileSync(filePath, 'utf-8');
                 const violations = engine.scanFile(filePath, content);
+                const allViolations = suppressionEngine.scanFile(filePath, content);
+                const suppressedViolations = allViolations.filter(v => v.suppressed);
                 results.push({
                     filePath,
                     violations,
+                    suppressedViolations,
                     scannedAt: new Date().toISOString(),
                     totalViolations: violations.length,
-                    suppressedCount: 0
+                    suppressedCount: suppressedViolations.length
                 });
             }
             catch (err) {
@@ -1071,12 +1354,15 @@ async function scanDirectory(dirPath, config) {
     else {
         const content = fs.readFileSync(dirPath, 'utf-8');
         const violations = engine.scanFile(dirPath, content);
+        const allViolations = suppressionEngine.scanFile(dirPath, content);
+        const suppressedViolations = allViolations.filter(v => v.suppressed);
         results.push({
             filePath: dirPath,
             violations,
+            suppressedViolations,
             scannedAt: new Date().toISOString(),
             totalViolations: violations.length,
-            suppressedCount: 0
+            suppressedCount: suppressedViolations.length
         });
     }
     return results;
@@ -1188,7 +1474,7 @@ function loadBaselineRules(packs) {
 }
 /**
  * Map CLI options to pack IDs.
- * --pack takes precedence. Legacy flags (--ethical-preview, --ai-audit, --sector-au-sbd) are mapped.
+ * --pack takes precedence. Legacy flags (--ethical-preview, --ai-audit, --sector-au-sbd, --sector-au-osa) are mapped.
  */
 function resolvePacks(options) {
     // Explicit --pack flag takes priority
@@ -1203,6 +1489,8 @@ function resolvePacks(options) {
         packs.push('ai-audit');
     if (options.sectorAuSbd)
         packs.push('au-sbd');
+    if (options.sectorAuOsa)
+        packs.push('au-osa');
     return packs;
 }
 /**
@@ -1297,6 +1585,108 @@ function saveHistory(entry) {
         // Silent failure — never block scan
     }
 }
+/**
+ * Send webhook notifications to Discord and/or Slack after a scan completes.
+ * Non-blocking — failures are logged but never affect the scan exit code.
+ */
+async function sendWebhookNotifications(rcConfig, lastEntry, verbose) {
+    const notifications = rcConfig?.notifications;
+    if (!notifications)
+        return;
+    const { discord_webhook, slack_webhook } = notifications;
+    if (!discord_webhook && !slack_webhook)
+        return;
+    const hasFailed = lastEntry.totalViolations > 0;
+    const filesScanned = String(lastEntry.filesScanned);
+    const violations = String(lastEntry.totalViolations);
+    const grade = lastEntry.grade || 'N/A';
+    const topRules = lastEntry.rulesTriggered.slice(0, 5).join(', ') || 'None';
+    const timestamp = new Date().toISOString();
+    // Discord webhook
+    if (discord_webhook) {
+        try {
+            const discordPayload = {
+                embeds: [{
+                        title: '\u{1F6E1}\uFE0F Halo Scan Complete',
+                        color: hasFailed ? 15158332 : 3066993,
+                        fields: [
+                            { name: 'Files Scanned', value: filesScanned, inline: true },
+                            { name: 'Violations', value: violations, inline: true },
+                            { name: 'Grade', value: grade, inline: true },
+                            { name: 'Top Rules', value: topRules, inline: false },
+                        ],
+                        footer: { text: 'Halo \u2014 runhalo.dev' },
+                        timestamp,
+                    }],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(discord_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(discordPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Discord'
+                    : `\u26A0\uFE0F  Discord webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Discord webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+    // Slack webhook
+    if (slack_webhook) {
+        try {
+            const slackPayload = {
+                blocks: [
+                    {
+                        type: 'header',
+                        text: { type: 'plain_text', text: '\u{1F6E1}\uFE0F Halo Scan Complete' },
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Files Scanned*\n${filesScanned}` },
+                            { type: 'mrkdwn', text: `*Violations*\n${violations}` },
+                            { type: 'mrkdwn', text: `*Grade*\n${grade}` },
+                        ],
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Top Rules*\n${topRules}` },
+                        ],
+                    },
+                ],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(slack_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(slackPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Slack'
+                    : `\u26A0\uFE0F  Slack webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Slack webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+}
 async function submitCliLead(email) {
     try {
         const res = await fetch(`${SUPABASE_URL}/rest/v1/halo_leads`, {
@@ -1609,6 +1999,9 @@ async function scan(paths, options) {
         severityFilter: options.severity.length > 0 ? options.severity : undefined,
         ignoreConfig,
         projectDomains: projectDomains.length > 0 ? [...new Set(projectDomains)] : undefined,
+        // Sprint 8: Framework and AST analysis (from .halorc.json via CLIOptions)
+        framework: options.framework,
+        astAnalysis: options.astAnalysis,
         // If we got rules from API/cache, use loadedRules. Otherwise fall through to legacy flags.
         ...(resolvedRules
             ? { loadedRules: resolvedRules }
@@ -1616,9 +2009,11 @@ async function scan(paths, options) {
                 ethical: options.ethicalPreview,
                 aiAudit: options.aiAudit,
                 sectorAuSbd: options.sectorAuSbd,
+                sectorAuOsa: options.sectorAuOsa,
             }),
     };
     const engine = new engine_1.HaloEngine(engineConfig);
+    const suppressionEngine = new engine_1.HaloEngine({ ...engineConfig, includeSuppressed: true });
     const results = [];
     let fileCount = 0;
     // Collect all files to scan
@@ -1689,6 +2084,9 @@ async function scan(paths, options) {
             'ethical': 'Ethical Design',
             'ai-audit': 'AI Audit',
             'au-sbd': 'AU Safety by Design',
+            'au-osa': 'AU Online Safety Act',
+            'caadca': 'California AADCA',
+            'eu-ai-act': 'EU AI Act (Children)',
         };
         const packLabel = packs.map(p => packNameMap[p] || p).join(' + ');
         console.error(c(colors.dim, `🔍 Scanning ${uniqueFiles.length} files (${packLabel})...`));
@@ -1711,14 +2109,24 @@ async function scan(paths, options) {
             if (content.substring(0, 512).includes('\0')) {
                 continue;
             }
-            const violations = engine.scanFile(filePath, content);
-            if (violations.length > 0) {
+            // Sprint 8: Use AST-enhanced scanning for JS/TS when framework or AST configured
+            const ext = path.extname(filePath).toLowerCase();
+            const isJSTS = ['.ts', '.tsx', '.js', '.jsx'].includes(ext);
+            const useAST = isJSTS && (options.framework || options.astAnalysis !== false);
+            const lang = ['.ts', '.tsx'].includes(ext) ? 'typescript' : 'javascript';
+            const violations = useAST
+                ? engine.scanFileWithAST(filePath, content, lang)
+                : engine.scanFile(filePath, content);
+            const allViolations = suppressionEngine.scanFile(filePath, content);
+            const suppressedViolations = allViolations.filter(v => v.suppressed);
+            if (violations.length > 0 || suppressedViolations.length > 0) {
                 results.push({
                     filePath,
                     violations,
+                    suppressedViolations,
                     scannedAt: new Date().toISOString(),
                     totalViolations: violations.length,
-                    suppressedCount: 0
+                    suppressedCount: suppressedViolations.length
                 });
             }
             fileCount++;
@@ -1731,6 +2139,7 @@ async function scan(paths, options) {
     }
     // Calculate compliance score
     const allViolations = results.flatMap(r => r.violations);
+    const totalSuppressedCount = results.reduce((sum, r) => sum + r.suppressedCount, 0);
     const scorer = new engine_1.ComplianceScoreEngine();
     const scoreResult = scorer.calculate(allViolations, fileCount);
     // Scan history: compute trend BEFORE saving (so we compare to previous, not current)
@@ -1742,6 +2151,7 @@ async function scan(paths, options) {
         score: scoreResult.score,
         grade: scoreResult.grade,
         totalViolations: scoreResult.totalViolations,
+        suppressedCount: totalSuppressedCount,
         bySeverity: scoreResult.bySeverity,
         filesScanned: fileCount,
         projectPath,
@@ -1763,7 +2173,14 @@ async function scan(paths, options) {
                 output += trendLine + '\n';
             }
     }
+    // Store scan data for potential PDF regeneration with AI Review Board data
+    _lastScanData.results = results;
+    _lastScanData.scoreResult = scoreResult;
+    _lastScanData.fileCount = fileCount;
+    _lastScanData.projectPath = projectPath;
     // Generate report if requested (HTML or PDF based on filename extension)
+    // Note: if --review-board is also set, the PDF will be regenerated with AI data
+    // in the action handler after the review board completes.
     if (options.report) {
         const reportFilename = typeof options.report === 'string'
             ? options.report
@@ -2046,10 +2463,14 @@ program
     .option('--ethical-preview', 'Enable experimental ethical design rules (Sprint 5 preview)')
     .option('--ai-audit', 'Enable AI-generated code audit rules (catch AI coding assistant mistakes)')
     .option('--sector-au-sbd', 'Enable Australia Safety by Design sector rules (eSafety Commissioner framework)')
-    .option('--pack <packs...>', 'Rule packs to scan against (e.g., coppa ethical ai-audit au-sbd)')
+    .option('--sector-au-osa', 'Enable Australia Online Safety Act rules (2021 as amended 2024, under-16 social media ban)')
+    .option('--pack <packs...>', 'Rule packs to scan against (e.g., coppa ethical ai-audit au-sbd au-osa)')
     .option('--offline', 'Skip API fetch, use cached or bundled rules only')
     .option('--report [filename]', 'Generate HTML compliance report (default: halo-report.html)')
     .option('--upload', 'Upload scan results to Halo Dashboard (requires Pro)')
+    .option('--watch', 'Watch for file changes and re-scan automatically')
+    .option('--review-board', 'Enable AI Review Board — clinical assessment of each violation (Pro/Enterprise)')
+    .option('--license-key <key>', 'License key for Pro/Enterprise features (or set HALO_LICENSE_KEY env var)')
     .option('--no-prompt', 'Skip first-run email prompt')
     .option('-v, --verbose', 'Verbose output')
     .action(async (paths, options) => {
@@ -2068,17 +2489,51 @@ program
         if (options.sectorAuSbd && !checkProFeature('AU Safety by Design Rules', '--sector-au-sbd')) {
             process.exit(0);
         }
+        if (options.sectorAuOsa && !checkProFeature('AU Online Safety Act Rules', '--sector-au-osa')) {
+            process.exit(0);
+        }
         if (options.upload && !checkProFeature('Dashboard Upload', '--upload')) {
             process.exit(0);
         }
+        if (options.reviewBoard && !checkProFeature('AI Review Board', '--review-board')) {
+            process.exit(0);
+        }
         // Scan limit check (soft — exit 0, not error)
         if (!checkScanLimit()) {
             process.exit(0);
         }
-        const exitCode = await scan(paths, {
+        // ==================== .halorc.json Config ====================
+        const projectRoot = path.resolve(paths[0] || '.');
+        let rcConfig;
+        for (const rcName of ['.halorc.json', '.halorc']) {
+            const rcPath = path.join(fs.existsSync(projectRoot) && fs.statSync(projectRoot).isDirectory()
+                ? projectRoot
+                : path.dirname(projectRoot), rcName);
+            if (fs.existsSync(rcPath)) {
+                try {
+                    rcConfig = JSON.parse(fs.readFileSync(rcPath, 'utf-8'));
+                    if (options.verbose) {
+                        console.error(`📋 Loaded ${rcName} configuration`);
+                    }
+                }
+                catch (e) {
+                    console.error(`⚠️  Failed to parse ${rcName}: ${e instanceof Error ? e.message : e}`);
+                }
+                break;
+            }
+        }
+        // Merge .halorc.json with CLI flags (CLI flags override)
+        const mergedPacks = (options.pack && options.pack.length > 0)
+            ? options.pack
+            : (rcConfig?.packs || []);
+        const mergedExclude = [
+            ...(options.exclude || []),
+            ...(rcConfig?.ignore || []),
+        ];
+        const scanOptions = {
             format: options.format || 'text',
             include: options.include || [],
-            exclude: options.exclude || [],
+            exclude: mergedExclude,
             rules: options.rules || [],
             severity: options.severity || [],
             output: options.output || '',
@@ -2086,10 +2541,288 @@ program
             ethicalPreview: options.ethicalPreview || false,
             aiAudit: options.aiAudit || false,
             sectorAuSbd: options.sectorAuSbd || false,
+            sectorAuOsa: options.sectorAuOsa || false,
             report: options.report || false,
-            pack: options.pack || [],
+            pack: mergedPacks,
             offline: options.offline || false,
-        });
+            // Sprint 8: Pass framework and AST config from .halorc.json to scan()
+            framework: rcConfig?.framework,
+            astAnalysis: rcConfig?.astAnalysis,
+            // Sprint 9: AI Review Board
+            reviewBoard: options.reviewBoard || rcConfig?.reviewBoard || false,
+            licenseKey: options.licenseKey || process.env.HALO_LICENSE_KEY || rcConfig?.licenseKey,
+        };
+        // ==================== Watch Mode ====================
+        if (options.watch) {
+            const scanRoot = path.resolve(paths[0] || '.');
+            // Load .haloignore for watch filtering
+            let watchIgnoreConfig;
+            try {
+                watchIgnoreConfig = loadHaloignore(fs.statSync(scanRoot).isDirectory() ? scanRoot : path.dirname(scanRoot));
+            }
+            catch {
+                // Ignore errors loading .haloignore
+            }
+            const scannableExts = new Set([
+                '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+                '.py', '.go', '.java', '.kt', '.kts',
+                '.swift', '.rb', '.php',
+                '.html', '.htm', '.vue', '.svelte',
+                '.xml', '.cs', '.cpp', '.h', '.hpp', '.qml', '.erb',
+            ]);
+            const isScannable = (filePath) => {
+                return scannableExts.has(path.extname(filePath).toLowerCase());
+            };
+            const isExcluded = (filePath) => {
+                const rel = path.relative(scanRoot, filePath);
+                // Common directory excludes
+                if (rel.includes('node_modules') || rel.includes('.git') ||
+                    rel.includes('dist/') || rel.includes('build/') ||
+                    rel.includes('coverage/') || rel.includes('.next/')) {
+                    return true;
+                }
+                // Respect .haloignore patterns
+                if (watchIgnoreConfig && (0, engine_1.shouldIgnoreFile)(rel, watchIgnoreConfig)) {
+                    return true;
+                }
+                return false;
+            };
+            // Count scannable files for status line
+            let watchableFileCount = 0;
+            const countFiles = (dir) => {
+                try {
+                    const entries = fs.readdirSync(dir, { withFileTypes: true });
+                    for (const entry of entries) {
+                        const fullPath = path.join(dir, entry.name);
+                        if (entry.isDirectory()) {
+                            if (!['node_modules', '.git', 'dist', 'build', 'coverage', '.next'].includes(entry.name)) {
+                                countFiles(fullPath);
+                            }
+                        }
+                        else if (isScannable(fullPath) && !isExcluded(fullPath)) {
+                            watchableFileCount++;
+                        }
+                    }
+                }
+                catch {
+                    // Skip unreadable directories
+                }
+            };
+            countFiles(scanRoot);
+            // Clear terminal and print header
+            const clearAndPrintHeader = () => {
+                process.stdout.write('\x1B[2J\x1B[0f'); // Clear terminal + move cursor to top
+                console.error('👁️  Halo Watch Mode');
+                console.error(`   Watching ${watchableFileCount} file(s) in ${path.basename(scanRoot)}/`);
+                if (watchIgnoreConfig)
+                    console.error('   📋 .haloignore loaded');
+                console.error('   Press Ctrl+C to stop.\n');
+            };
+            clearAndPrintHeader();
+            // Initial full scan
+            let lastViolationCount = 0;
+            let scanNumber = 0;
+            const runScan = async () => {
+                scanNumber++;
+                if (scanNumber > 1)
+                    clearAndPrintHeader();
+                const startTime = Date.now();
+                const exitCode = await scan(paths, { ...scanOptions, format: 'text', output: '' });
+                const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+                const history = loadHistory();
+                const lastEntry = history[history.length - 1];
+                const violationCount = lastEntry?.totalViolations || 0;
+                const delta = violationCount - lastViolationCount;
+                const deltaStr = delta > 0
+                    ? ` \x1B[31m↑ ${delta} new\x1B[0m`
+                    : delta < 0
+                        ? ` \x1B[32m↓ ${Math.abs(delta)} fixed\x1B[0m`
+                        : scanNumber > 1 ? ' \x1B[90m(no change)\x1B[0m' : '';
+                console.error(`\n⏱  Scan #${scanNumber} complete in ${elapsed}s — ${violationCount} violation(s)${deltaStr}`);
+                console.error(`   ${new Date().toLocaleTimeString()} — Watching for changes...\n`);
+                lastViolationCount = violationCount;
+                return exitCode;
+            };
+            await runScan();
+            // Debounce: collect changes for 500ms before re-scanning
+            let debounceTimer = null;
+            const changedFiles = new Set();
+            try {
+                const watcher = fs.watch(scanRoot, { recursive: true }, (eventType, filename) => {
+                    if (!filename)
+                        return;
+                    const fullPath = path.join(scanRoot, filename);
+                    // Only re-scan for scannable file changes, respect .haloignore
+                    if (!isScannable(fullPath) || isExcluded(fullPath))
+                        return;
+                    changedFiles.add(filename);
+                    // Debounce — wait 500ms after last change before re-scanning
+                    if (debounceTimer)
+                        clearTimeout(debounceTimer);
+                    debounceTimer = setTimeout(async () => {
+                        const files = Array.from(changedFiles);
+                        changedFiles.clear();
+                        console.error(`\n📝 Changed: ${files.join(', ')}`);
+                        await runScan();
+                    }, 500);
+                });
+                // Keep process alive until Ctrl+C
+                process.on('SIGINT', () => {
+                    watcher.close();
+                    console.error('\n\n👋 Watch mode stopped.');
+                    process.exit(0);
+                });
+                // Prevent Node from exiting
+                await new Promise(() => { }); // Block forever (until SIGINT)
+            }
+            catch (watchErr) {
+                console.error(`❌ Watch mode error: ${watchErr instanceof Error ? watchErr.message : watchErr}`);
+                console.error('   fs.watch with recursive option requires Node.js 18+ on macOS/Windows.');
+                process.exit(3);
+            }
+            return; // Never reached, but TypeScript needs it
+        }
+        // ==================== Standard Scan (non-watch) ====================
+        let exitCode = await scan(paths, scanOptions);
+        // Apply .halorc.json severity_threshold (overrides default exit code behavior)
+        if (rcConfig?.severity_threshold && exitCode > 0) {
+            const severityOrder = ['low', 'medium', 'high', 'critical'];
+            const thresholdIdx = severityOrder.indexOf(rcConfig.severity_threshold);
+            if (thresholdIdx >= 0) {
+                // Re-check: only fail if violations at or above threshold exist
+                const history = loadHistory();
+                const lastEntry = history[history.length - 1];
+                if (lastEntry?.bySeverity) {
+                    const hasAboveThreshold = severityOrder
+                        .slice(thresholdIdx)
+                        .some(sev => lastEntry.bySeverity[sev] > 0);
+                    if (!hasAboveThreshold) {
+                        exitCode = 0; // Below threshold — pass
+                        if (options.verbose) {
+                            console.error(`📋 .halorc.json severity_threshold: ${rcConfig.severity_threshold} — violations below threshold, passing`);
+                        }
+                    }
+                }
+            }
+        }
+        // ==================== AI Review Board (Sprint 9) ====================
+        let _reviewBoardResult;
+        if (scanOptions.reviewBoard) {
+            const licenseKey = scanOptions.licenseKey || loadConfig().license_key;
+            if (!licenseKey) {
+                console.error('⚠️  AI Review Board requires a license key. Run `halo activate <key>` or pass --license-key.');
+            }
+            else {
+                try {
+                    const history = loadHistory();
+                    const lastEntry = history[history.length - 1];
+                    if (lastEntry && lastEntry.rulesTriggered.length > 0) {
+                        console.error('\n🤖 Running AI Review Board...');
+                        const reviewUrl = 'https://wrfwcmyxxbafcdvxlmug.supabase.co/functions/v1/ai-review';
+                        // Build violations from scan results for review
+                        // We re-scan in JSON to get structured violations
+                        const jsonResults = await scan(paths, { ...scanOptions, format: 'json', output: '' });
+                        // Read the last JSON output from scan history
+                        const reviewHistory = loadHistory();
+                        const reviewEntry = reviewHistory[reviewHistory.length - 1];
+                        if (reviewEntry) {
+                            const reviewRes = await fetch(reviewUrl, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({
+                                    license_key: licenseKey,
+                                    violations: reviewEntry.violations || [],
+                                    repo_metadata: {
+                                        framework: scanOptions.framework,
+                                    },
+                                }),
+                            });
+                            if (reviewRes.ok) {
+                                const review = await reviewRes.json();
+                                _reviewBoardResult = review; // Store for PDF report
+                                // Display Review Board results
+                                console.error(`\n🛡️  Halo AI Review Board — ${review.summary.total} violations analyzed (${review.latency_ms}ms)\n`);
+                                const critical = review.results.filter(r => r.verdict === 'escalated');
+                                const confirmed = review.results.filter(r => r.verdict === 'confirmed');
+                                const downgraded = review.results.filter(r => r.verdict === 'downgraded');
+                                const dismissed = review.results.filter(r => r.verdict === 'dismissed');
+                                if (critical.length > 0) {
+                                    console.error(`🔴 ESCALATED (${critical.length}) — More serious than initially detected`);
+                                    for (const r of critical) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                        if (r.ageGroupImpact.length > 0)
+                                            console.error(`    Ages most affected: ${r.ageGroupImpact.join(', ')}`);
+                                        if (r.remediationGuidance)
+                                            console.error(`    Fix: ${r.remediationGuidance}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (confirmed.length > 0) {
+                                    console.error(`🟡 CONFIRMED (${confirmed.length}) — Violations validated by AI review`);
+                                    for (const r of confirmed) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (downgraded.length > 0) {
+                                    console.error(`🟢 DOWNGRADED (${downgraded.length}) — Lower risk than severity suggests`);
+                                    for (const r of downgraded) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (dismissed.length > 0) {
+                                    console.error(`✅ DISMISSED (${dismissed.length}) — False positives cleared by AI review`);
+                                    for (const r of dismissed) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                const cacheStr = review.summary.cache_hits > 0 ? ` (${review.summary.cache_hits} cached)` : '';
+                                console.error(`📊 Cost: $${review.cost.estimated_usd.toFixed(4)}${cacheStr}`);
+                                console.error(`🤖 Reviewed by: Halo AI Review Board (${review.latency_ms}ms)\n`);
+                            }
+                            else {
+                                const err = await reviewRes.json().catch(() => ({}));
+                                console.error(`⚠️  AI Review failed: ${err.error || reviewRes.statusText}`);
+                            }
+                        }
+                    }
+                }
+                catch (reviewErr) {
+                    console.error(`⚠️  AI Review failed: ${reviewErr instanceof Error ? reviewErr.message : reviewErr}`);
+                }
+            }
+        }
+        // ==================== Generate PDF Report with AI Review Board data ====================
+        // If both --review-board and --report *.pdf are set, regenerate the PDF with review data
+        if (options.report && _reviewBoardResult) {
+            const reportFilename = typeof options.report === 'string'
+                ? options.report
+                : 'halo-report.html';
+            if (reportFilename.endsWith('.pdf') && _lastScanData.results.length > 0) {
+                const projectHistory = loadHistory().filter(h => h.projectPath === _lastScanData.projectPath);
+                const historyForReport = projectHistory.slice(0, -1);
+                const pdfBuffer = await generatePdfReport(_lastScanData.results, _lastScanData.scoreResult, _lastScanData.fileCount, _lastScanData.projectPath, historyForReport, _reviewBoardResult);
+                fs.writeFileSync(reportFilename, pdfBuffer);
+                console.error(`📄 PDF report updated with AI Review Board assessment`);
+            }
+        }
+        // ==================== Webhook Notifications (Discord/Slack) ====================
+        if (rcConfig?.notifications) {
+            try {
+                const history = loadHistory();
+                const lastEntry = history[history.length - 1];
+                if (lastEntry) {
+                    await sendWebhookNotifications(rcConfig, lastEntry, options.verbose);
+                }
+            }
+            catch (notifyErr) {
+                if (options.verbose) {
+                    console.error(`\u26A0\uFE0F  Webhook notification error: ${notifyErr instanceof Error ? notifyErr.message : notifyErr}`);
+                }
+            }
+        }
         // Upload to Halo Dashboard (non-blocking — upload failure doesn't affect exit code)
         if (options.upload) {
             try {
@@ -2116,6 +2849,7 @@ program
                             grade: lastEntry.grade,
                             bySeverity: lastEntry.bySeverity,
                             rulesTriggered: lastEntry.rulesTriggered,
+                            suppressedCount: lastEntry.suppressedCount || 0,
                         };
                         const uploadUrl = 'https://wrfwcmyxxbafcdvxlmug.supabase.co/functions/v1/upload-scan';
                         const res = await fetch(uploadUrl, {
@@ -2336,78 +3070,142 @@ function getCopilotInstructionsContent() {
     return getIDERulesContent();
 }
 /**
- * Init command — generate IDE rules files and project configuration.
+ * Init command — detect framework, generate .halorc.json, .haloignore, and IDE rules files.
  */
 async function init(projectPath, options) {
     const resolvedPath = path.resolve(projectPath);
-    if (!options.ide) {
-        console.log('🔮 Halo init — project setup');
+    // --ide flag: generate AI coding assistant rules files (existing behavior)
+    if (options.ide) {
+        console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
+        const files = [
+            {
+                path: path.join(resolvedPath, '.cursor', 'rules'),
+                content: getCursorRulesContent(),
+                label: 'Cursor'
+            },
+            {
+                path: path.join(resolvedPath, '.windsurfrules'),
+                content: getWindsurfRulesContent(),
+                label: 'Windsurf'
+            },
+            {
+                path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
+                content: getCopilotInstructionsContent(),
+                label: 'GitHub Copilot'
+            }
+        ];
+        let created = 0;
+        let skipped = 0;
+        for (const file of files) {
+            const dir = path.dirname(file.path);
+            const relativePath = path.relative(resolvedPath, file.path);
+            if (fs.existsSync(file.path) && !options.force) {
+                console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
+                skipped++;
+                continue;
+            }
+            try {
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true });
+                }
+                fs.writeFileSync(file.path, file.content, 'utf-8');
+                console.log(`  ✅ ${relativePath} — ${file.label} rules`);
+                created++;
+            }
+            catch (err) {
+                console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            }
+        }
         console.log('');
-        console.log('Usage:');
-        console.log('  runhalo init --ide       Generate AI coding assistant rules files');
+        if (created > 0) {
+            console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+        }
+        if (skipped > 0) {
+            console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+        }
+        console.log('');
+        console.log('What happens next:');
+        console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
+        console.log('  • AI-generated code will follow COPPA compliance patterns');
+        console.log('  • Run "npx runhalo scan ." to verify compliance');
         console.log('');
-        console.log('Options:');
-        console.log('  --ide        Generate .cursor/rules, .windsurfrules, .github/copilot-instructions.md');
-        console.log('  --force      Overwrite existing rules files');
+        console.log('Full-stack compliance for the AI coding era:');
+        console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
+        console.log('  Local:     npx runhalo scan . catches violations on your machine');
+        console.log('  Proactive: AI rules files prevent violations before they\'re written');
         return 0;
     }
-    console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
-    const files = [
-        {
-            path: path.join(resolvedPath, '.cursor', 'rules'),
-            content: getCursorRulesContent(),
-            label: 'Cursor'
-        },
-        {
-            path: path.join(resolvedPath, '.windsurfrules'),
-            content: getWindsurfRulesContent(),
-            label: 'Windsurf'
-        },
-        {
-            path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
-            content: getCopilotInstructionsContent(),
-            label: 'GitHub Copilot'
+    // Default init: auto-detect framework, generate .halorc.json and .haloignore
+    console.log('🔮 Halo init — project setup\n');
+    // Step 1: Detect framework
+    const detectedFramework = detectProjectFramework(resolvedPath);
+    if (detectedFramework) {
+        console.log(`  🔍 Detected framework: ${c(colors.bold, detectedFramework)}`);
+    }
+    else {
+        console.log(`  🔍 Framework: ${c(colors.dim, 'not detected (generic config will be generated)')}`);
+    }
+    let configCreated = false;
+    let ignoreCreated = false;
+    // Step 2: Generate .halorc.json
+    const rcPath = path.join(resolvedPath, '.halorc.json');
+    if (fs.existsSync(rcPath) && !options.force) {
+        console.log(`  ⏭  .halorc.json (exists — use --force to overwrite)`);
+    }
+    else {
+        const rcConfig = {
+            packs: ['coppa', 'ethical'],
+            severity_threshold: 'medium',
+            ignore: ['**/test/**', '**/__tests__/**', '**/node_modules/**'],
+            astAnalysis: true,
+            notifications: {},
+        };
+        if (detectedFramework) {
+            rcConfig.framework = detectedFramework;
         }
-    ];
-    let created = 0;
-    let skipped = 0;
-    for (const file of files) {
-        const dir = path.dirname(file.path);
-        const relativePath = path.relative(resolvedPath, file.path);
-        if (fs.existsSync(file.path) && !options.force) {
-            console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
-            skipped++;
-            continue;
+        try {
+            fs.writeFileSync(rcPath, JSON.stringify(rcConfig, null, 2) + '\n', 'utf-8');
+            console.log(`  ✅ .halorc.json — project configuration`);
+            configCreated = true;
+        }
+        catch (err) {
+            console.error(`  ❌ .halorc.json — ${err instanceof Error ? err.message : err}`);
         }
+    }
+    // Step 3: Generate .haloignore
+    const ignorePath = path.join(resolvedPath, '.haloignore');
+    if (fs.existsSync(ignorePath) && !options.force) {
+        console.log(`  ⏭  .haloignore (exists — use --force to overwrite)`);
+    }
+    else {
         try {
-            if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true });
-            }
-            fs.writeFileSync(file.path, file.content, 'utf-8');
-            console.log(`  ✅ ${relativePath} — ${file.label} rules`);
-            created++;
+            const ignoreContent = getDefaultHaloignoreContent(detectedFramework);
+            fs.writeFileSync(ignorePath, ignoreContent, 'utf-8');
+            console.log(`  ✅ .haloignore — scan exclusion patterns`);
+            ignoreCreated = true;
         }
         catch (err) {
-            console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            console.error(`  ❌ .haloignore — ${err instanceof Error ? err.message : err}`);
         }
     }
+    // Step 4: Summary
     console.log('');
-    if (created > 0) {
-        console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+    if (configCreated || ignoreCreated) {
+        const parts = [];
+        if (configCreated)
+            parts.push('.halorc.json');
+        if (ignoreCreated)
+            parts.push('.haloignore');
+        console.log(`Created: ${parts.join(', ')}`);
     }
-    if (skipped > 0) {
-        console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+    else {
+        console.log('No files created (all exist — use --force to overwrite).');
     }
     console.log('');
-    console.log('What happens next:');
-    console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
-    console.log('  • AI-generated code will follow COPPA compliance patterns');
-    console.log('  • Run "npx runhalo scan ." to verify compliance');
+    console.log('Next steps:');
+    console.log(`  ${c(colors.bold, 'npx runhalo scan .')}         Scan your project for compliance issues`);
+    console.log(`  ${c(colors.bold, 'npx runhalo init --ide')}     Generate AI coding assistant rules files`);
     console.log('');
-    console.log('Full-stack compliance for the AI coding era:');
-    console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
-    console.log('  Local:     npx runhalo scan . catches violations on your machine');
-    console.log('  Proactive: AI rules files prevent violations before they\'re written');
     return 0;
 }
 program
@@ -2475,7 +3273,7 @@ program
         console.log('');
         console.log('Usage:');
         console.log('  npx runhalo scan . --pack coppa ethical');
-        console.log('  npx runhalo scan . --pack coppa ai-audit au-sbd');
+        console.log('  npx runhalo scan . --pack coppa ai-audit au-sbd au-osa');
         console.log('');
     }
     catch (error) {
@@ -2483,12 +3281,67 @@ program
         process.exit(1);
     }
 });
+program
+    .command('report')
+    .description('Report a false positive detection')
+    .argument('<rule-id>', 'Rule ID to report (e.g., coppa-auth-001)')
+    .option('-f, --file <path>', 'File path where false positive was detected')
+    .option('-l, --line <number>', 'Line number of the detection')
+    .option('-e, --email <email>', 'Your email for follow-up')
+    .option('--context <text>', 'Code context or explanation')
+    .action(async (ruleId, options) => {
+    try {
+        const config = loadConfig();
+        const licenseKey = config.license_key || null;
+        console.log('');
+        console.log(`${c(colors.bold, '📋 Reporting false positive for rule:')} ${ruleId}`);
+        const body = { rule_id: ruleId };
+        if (options.file)
+            body.file_path = options.file;
+        if (options.line)
+            body.line_number = parseInt(options.line, 10);
+        if (options.email)
+            body.reporter_email = options.email;
+        if (options.context)
+            body.code_context = options.context;
+        if (licenseKey)
+            body.reporter_license_key = licenseKey;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), RULES_FETCH_TIMEOUT_MS);
+        const res = await fetch(`${RULES_API_BASE}/report-fp`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({ error: 'Unknown error' }));
+            throw new Error(err.error || `HTTP ${res.status}`);
+        }
+        const data = await res.json();
+        console.log(`${c(colors.green, '✅ Report submitted')} — ID: ${data.id}`);
+        console.log(`   Status: ${data.status}`);
+        console.log('');
+        console.log(c(colors.dim, 'Our compliance team will review this report. Thank you!'));
+        console.log('');
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AbortError') {
+            console.error('❌ Request timed out. Please try again.');
+        }
+        else {
+            console.error('❌ Error:', error instanceof Error ? error.message : error);
+        }
+        process.exit(1);
+    }
+});
 program
     .command('init')
-    .description('Initialize Halo in your project (generate IDE rules files)')
+    .description('Initialize Halo in your project (detect framework, generate .halorc.json and .haloignore)')
     .argument('[path]', 'Project root path (default: current directory)', '.')
     .option('--ide', 'Generate AI coding assistant rules files', false)
-    .option('--force', 'Overwrite existing rules files', false)
+    .option('--force', 'Overwrite existing files', false)
     .action(async (projectPath, options) => {
     try {
         const exitCode = await init(projectPath, {