@vibecheckai/cli 3.5.0 → 3.5.1

package/bin/runners/runGuard.js

@@ -1,487 +1,73 @@
 /**
- * vibecheck guard - Agent Firewall System
+ * vibecheck guard - Unified trust boundary enforcement
  * 
- * ═══════════════════════════════════════════════════════════════════════════════
- * Monitors and blocks AI agent actions based on policy
- * ═══════════════════════════════════════════════════════════════════════════════
+ * Combines: validate + claim-verifier + prompt-firewall
  * 
- * Modes:
- * - observe (FREE): Logs violations but doesn't block
- * - enforce (PRO): Blocks AI writes that violate policy
- * 
- * What It Guards Against:
- * - Forbidden paths (secrets, .env, config files)
- * - Scope violations (writing outside allowed directories)
- * - Dangerous commands (rm -rf, curl | bash)
- * - Hallucination patterns (fake APIs, placeholder data)
- * - Policy violations (custom rules)
+ * Usage:
+ *   vibecheck guard                    # Run all checks
+ *   vibecheck guard --claims           # Verify AI claims against truthpack
+ *   vibecheck guard --prompts          # Check for prompt injection
+ *   vibecheck guard --hallucinations   # Detect AI hallucination patterns
  */
 
 const path = require("path");
 const fs = require("fs");
-const { parseGlobalFlags, shouldSuppressOutput, isJsonMode } = require("./lib/global-flags");
-const { EXIT } = require("./lib/exit-codes");
-const { tierHasFeature, getCurrentTier } = require("./lib/entitlements-v2");
-const {
-  ansi,
-  sym,
-  renderMinimalHeader,
-  renderSectionHeader,
-  renderVerdict,
-  renderSuccess,
-  renderError,
-  renderWarning,
-  renderInfo,
-  renderFooter,
-  Spinner,
-  getTierFromKey,
-} = require("./lib/unified-cli-output");
-
-// Unified Output System
-const { output } = require("./lib/output/index.js");
-
-// Import firewall components
-const {
-  loadFirewallConfig,
-  PathValidator,
-  CommandValidator,
-  ContentValidator,
-  createFirewall,
-  initFirewallConfig,
-} = require("./lib/firewall");
-
-// Import underlying implementations for legacy support
-let runValidate, runPromptFirewall;
-try {
-  runValidate = require("./runValidate").runValidate;
-} catch {
-  runValidate = null;
-}
-try {
-  runPromptFirewall = require("./runPromptFirewall").runPromptFirewall;
-} catch {
-  runPromptFirewall = null;
-}
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// HELP OUTPUT
-// ═══════════════════════════════════════════════════════════════════════════════
+// Import underlying implementations
+const { runValidate } = require("./runValidate");
+const { runPromptFirewall } = require("./runPromptFirewall");
+
+// ANSI colors
+const c = {
+  reset: "\x1b[0m",
+  dim: "\x1b[2m",
+  bold: "\x1b[1m",
+  cyan: "\x1b[36m",
+  green: "\x1b[32m",
+  yellow: "\x1b[33m",
+  red: "\x1b[31m",
+  magenta: "\x1b[35m",
+};
 
 function printHelp() {
   console.log(`
-  ${ansi.bold}USAGE${ansi.reset}
-    ${ansi.cyan}vibecheck guard${ansi.reset} [options]
-
-  ${ansi.dim}Aliases: ai-guard, firewall, validate${ansi.reset}
-
-  Agent Firewall - Monitor and block AI agent actions based on policy.
-  Protects against unauthorized file writes, dangerous commands, and
-  hallucination patterns.
-
-  ${ansi.bold}MODES${ansi.reset}
-    ${ansi.cyan}--mode observe${ansi.reset}    Log violations but don't block ${ansi.green}(FREE)${ansi.reset}
-    ${ansi.cyan}--mode enforce${ansi.reset}    Block AI writes that violate policy ${ansi.yellow}(PRO)${ansi.reset}
-
-  ${ansi.bold}ACTIONS${ansi.reset}
-    ${ansi.cyan}--action write${ansi.reset}    Validate file write operation
-    ${ansi.cyan}--action delete${ansi.reset}   Validate file delete operation
-    ${ansi.cyan}--action execute${ansi.reset}  Validate command execution
-
-  ${ansi.bold}OPTIONS${ansi.reset}
-    ${ansi.cyan}--path <path>${ansi.reset}     File path to validate
-    ${ansi.cyan}--content <str>${ansi.reset}   Content to validate (or use stdin)
-    ${ansi.cyan}--command <cmd>${ansi.reset}   Shell command to validate
-    ${ansi.cyan}--config <path>${ansi.reset}   Path to firewall config (default: .vibecheck/firewall.json)
-
-  ${ansi.bold}LEGACY CHECK MODES${ansi.reset}
-    ${ansi.cyan}--claims${ansi.reset}           Verify AI claims against truthpack
-    ${ansi.cyan}--prompts${ansi.reset}          Check code for prompt injection
-    ${ansi.cyan}--hallucinations${ansi.reset}   Detect AI hallucination patterns
-    ${ansi.dim}(default: run all checks)${ansi.reset}
-
-  ${ansi.bold}OTHER OPTIONS${ansi.reset}
-    ${ansi.cyan}--init${ansi.reset}             Initialize firewall configuration
-    ${ansi.cyan}--strict${ansi.reset}           Fail on warnings (default: fail on errors only)
-    ${ansi.cyan}--json${ansi.reset}             Output as JSON (CI integration)
-    ${ansi.cyan}--quiet, -q${ansi.reset}        Suppress non-essential output
-    ${ansi.cyan}--help, -h${ansi.reset}         Show this help
-
-  ${ansi.bold}EXAMPLES${ansi.reset}
-    ${ansi.dim}# Initialize firewall configuration${ansi.reset}
-    vibecheck guard --init
-
-    ${ansi.dim}# Check if path is allowed (observe mode)${ansi.reset}
-    vibecheck guard --mode observe --action write --path .env
-
-    ${ansi.dim}# Block write to sensitive file (enforce mode, PRO)${ansi.reset}
-    vibecheck guard --mode enforce --action write --path .env
-
-    ${ansi.dim}# Validate command before execution${ansi.reset}
-    vibecheck guard --action execute --command "rm -rf /"
-
-    ${ansi.dim}# Validate content for hallucinations${ansi.reset}
-    echo "fetch('https://example.com/api')" | vibecheck guard --action write --path api.js
-
-    ${ansi.dim}# CI pipeline (strict, JSON output)${ansi.reset}
-    vibecheck guard --strict --json
-
-  ${ansi.bold}EXIT CODES${ansi.reset}
-    0  Action allowed / checks passed
-    1  Warnings found (non-blocking)
-    2  Action blocked / errors found
-    3  Pro feature required
-
-  ${ansi.bold}CONFIGURATION${ansi.reset}
-    Configure via ${ansi.cyan}.vibecheck/firewall.json${ansi.reset}:
-    {
-      "mode": "observe",
-      "paths": {
-        "forbidden": [".env", "secrets/**"],
-        "allowed": ["src/**", "lib/**"]
-      },
-      "commands": {
-        "blocked": ["rm -rf /", "curl | bash"]
-      }
-    }
-
-  ${ansi.dim}────────────────────────────────────────────────────────────────────${ansi.reset}
-  ${ansi.dim}Documentation: https://docs.vibecheckai.dev/cli/guard${ansi.reset}
+${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}
+  ${c.bold}vibecheck guard${c.reset} - Trust boundary enforcement for AI outputs
+${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}
+
+${c.green}USAGE${c.reset}
+  vibecheck guard [options]
+
+${c.yellow}OPTIONS${c.reset}
+  --claims           Verify AI claims against truthpack (route_exists, auth_enforced, etc.)
+  --prompts          Check code for prompt injection vulnerabilities
+  --hallucinations   Detect AI hallucination patterns in generated code
+  --file <path>      Check specific file(s)
+  --json             Output JSON for CI integration
+  --strict           Fail on warnings (default: fail on errors only)
+
+${c.magenta}EXAMPLES${c.reset}
+  vibecheck guard                           # Run all checks
+  vibecheck guard --claims --file api.ts    # Verify claims in specific file
+  vibecheck guard --prompts                 # Prompt injection scan
+  vibecheck guard --json                    # CI-friendly output
+
+${c.dim}This command unifies trust boundary checks for AI-generated code.${c.reset}
 `);
 }
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// MAIN GUARD FUNCTION - New Firewall Mode
-// ═══════════════════════════════════════════════════════════════════════════════
-
-/**
- * Run the firewall validation
- * @param {object} options - Validation options
- * @returns {object} Validation result
- */
-async function runFirewallCheck(options) {
-  const { mode = "observe", action, path: filePath, content, command, configPath } = options;
-  
-  // Enforce mode requires PRO
-  if (mode === "enforce") {
-    const tier = await getCurrentTier();
-    if (!tierHasFeature(tier, "firewall.enforce")) {
-      return {
-        allowed: true,
-        reason: "free-tier-passthrough",
-        message: "Enforce mode requires VibeCheck Pro. Running in observe mode.",
-        tier,
-      };
-    }
-  }
-  
-  // Load configuration
-  const config = loadFirewallConfig(configPath || ".vibecheck/firewall.json");
-  
-  // Create validators
-  const pathValidator = new PathValidator(config);
-  const commandValidator = new CommandValidator(config);
-  const contentValidator = new ContentValidator(config);
-  
-  const violations = [];
-  const warnings = [];
-  
-  // Validate path
-  if (filePath && (action === "write" || action === "delete" || !action)) {
-    const pathResult = pathValidator.validate({ action: action || "write", path: filePath });
-    if (!pathResult.valid) {
-      violations.push({
-        type: "path",
-        ...pathResult,
-      });
-    }
-  }
-  
-  // Validate command
-  if (command && (action === "execute" || !action)) {
-    const cmdResult = commandValidator.validate({ command });
-    if (!cmdResult.valid) {
-      violations.push({
-        type: "command",
-        ...cmdResult,
-      });
-    } else if (cmdResult.requiresConfirmation) {
-      warnings.push({
-        type: "command",
-        ...cmdResult,
-      });
-    }
-  }
-  
-  // Validate content
-  if (content && (action === "write" || !action)) {
-    const contentResult = contentValidator.validate({ content, path: filePath });
-    if (!contentResult.valid) {
-      violations.push({
-        type: "content",
-        ...contentResult,
-      });
-    } else if (contentResult.hasWarnings) {
-      warnings.push(...contentResult.warnings.map(w => ({
-        type: "content",
-        ...w,
-      })));
-    }
-  }
-  
-  const hasViolations = violations.length > 0;
-  
-  // Determine if action is allowed based on mode
-  let allowed;
-  if (mode === "enforce") {
-    allowed = !hasViolations;
-  } else {
-    // Observe mode: always allow, but log violations
-    allowed = true;
-  }
-  
-  return {
-    allowed,
-    mode,
-    violations,
-    warnings,
-    violationCount: violations.length,
-    warningCount: warnings.length,
-  };
-}
-
-// ═══════════════════════════════════════════════════════════════════════════════
-// MAIN ENTRY POINT
-// ═══════════════════════════════════════════════════════════════════════════════
-
 async function runGuard(args = []) {
-  const { flags: globalFlags } = parseGlobalFlags(args);
-  const quiet = shouldSuppressOutput(globalFlags);
-  const json = isJsonMode(globalFlags) || args.includes("--json");
-  const startTime = Date.now();
-  
   // Parse arguments
-  if (globalFlags.help || args.includes("--help") || args.includes("-h")) {
+  if (args.includes("--help") || args.includes("-h")) {
     printHelp();
-    return EXIT.SUCCESS;
-  }
-  
-  // Check for --init flag
-  if (args.includes("--init")) {
-    try {
-      const configPath = initFirewallConfig(process.cwd());
-      if (!quiet && !json) {
-        renderSuccess(`Firewall configuration created at ${configPath}`);
-        renderInfo("Edit .vibecheck/firewall.json to customize rules");
-      }
-      if (json) {
-        console.log(JSON.stringify({ success: true, configPath }));
-      }
-      return EXIT.SUCCESS;
-    } catch (error) {
-      if (json) {
-        console.log(JSON.stringify({ success: false, error: error.message }));
-      } else {
-        renderError(`Failed to initialize firewall: ${error.message}`);
-      }
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
-  
-  // Detect if using new firewall mode (--action, --path, --content, --command)
-  const hasAction = args.includes("--action");
-  const hasPath = args.includes("--path");
-  const hasContent = args.includes("--content");
-  const hasCommand = args.includes("--command");
-  const hasMode = args.includes("--mode");
-  
-  const isFirewallMode = hasAction || hasPath || hasContent || hasCommand || hasMode;
-  
-  if (isFirewallMode) {
-    // New firewall validation mode
-    return await runFirewallValidation(args, { quiet, json, startTime });
-  } else {
-    // Legacy guard mode (claims, prompts, hallucinations)
-    return await runLegacyGuard(args, { quiet, json, startTime, globalFlags });
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════════
-// FIREWALL VALIDATION MODE
-// ═══════════════════════════════════════════════════════════════════════════════
-
-async function runFirewallValidation(args, { quiet, json, startTime }) {
-  // Parse firewall-specific options
-  const modeIndex = args.indexOf("--mode");
-  const mode = modeIndex !== -1 ? args[modeIndex + 1] : "observe";
-  
-  const actionIndex = args.indexOf("--action");
-  const action = actionIndex !== -1 ? args[actionIndex + 1] : null;
-  
-  const pathIndex = args.indexOf("--path");
-  const filePath = pathIndex !== -1 ? args[pathIndex + 1] : null;
-  
-  const contentIndex = args.indexOf("--content");
-  let content = contentIndex !== -1 ? args[contentIndex + 1] : null;
-  
-  const commandIndex = args.indexOf("--command");
-  const command = commandIndex !== -1 ? args[commandIndex + 1] : null;
-  
-  const configIndex = args.indexOf("--config");
-  const configPath = configIndex !== -1 ? args[configIndex + 1] : null;
-  
-  // Read content from stdin if not provided
-  if (!content && !process.stdin.isTTY) {
-    content = await readStdin();
-  }
-  
-  // Validate mode
-  if (mode && !["observe", "enforce"].includes(mode)) {
-    if (json) {
-      console.log(JSON.stringify({ success: false, error: `Invalid mode: ${mode}` }));
-    } else {
-      renderError(`Invalid mode: ${mode}. Must be 'observe' or 'enforce'`);
-    }
-    return EXIT.USER_ERROR;
+    return 0;
   }
-  
-  // Validate action
-  if (action && !["write", "delete", "execute"].includes(action)) {
-    if (json) {
-      console.log(JSON.stringify({ success: false, error: `Invalid action: ${action}` }));
-    } else {
-      renderError(`Invalid action: ${action}. Must be 'write', 'delete', or 'execute'`);
-    }
-    return EXIT.USER_ERROR;
-  }
-  
-  try {
-    if (!quiet && !json) {
-      renderMinimalHeader("guard", "starter");
-      renderSectionHeader(`Agent Firewall (${mode} mode)`, sym.shield);
-    }
-    
-    // Run firewall check
-    const result = await runFirewallCheck({
-      mode,
-      action,
-      path: filePath,
-      content,
-      command,
-      configPath,
-    });
-    
-    const duration = Date.now() - startTime;
-    
-    // Output results
-    if (json) {
-      console.log(JSON.stringify({
-        ...result,
-        duration,
-        success: result.allowed,
-      }, null, 2));
-    } else if (!quiet) {
-      // Display violations
-      for (const violation of result.violations) {
-        console.log();
-        renderError(`${sym.cross} ${violation.rule}: ${violation.message}`);
-        if (violation.details) {
-          console.log(`   ${ansi.dim}Path: ${violation.details.path || violation.details.command || "N/A"}${ansi.reset}`);
-          if (violation.details.suggestion) {
-            console.log(`   ${ansi.cyan}Suggestion: ${violation.details.suggestion}${ansi.reset}`);
-          }
-        }
-      }
-      
-      // Display warnings
-      for (const warning of result.warnings) {
-        console.log();
-        renderWarning(`${sym.warn} ${warning.rule || warning.type}: ${warning.message}`);
-      }
-      
-      console.log();
-      
-      if (result.allowed) {
-        if (result.violations.length > 0 && mode === "observe") {
-          renderVerdict("WARN", {
-            warnings: result.violationCount,
-            duration,
-            message: `${result.violationCount} violation(s) logged (observe mode - not blocking)`,
-          });
-        } else {
-          renderVerdict("PASS", {
-            warnings: result.warningCount,
-            duration,
-          });
-        }
-      } else {
-        renderVerdict("BLOCK", {
-          critical: result.violationCount,
-          duration,
-          message: `Action blocked: ${result.violations[0]?.message}`,
-        });
-      }
-      
-      renderFooter({
-        nextSteps: result.allowed ? [
-          { cmd: "vibecheck scan", desc: "run full code analysis" },
-        ] : [
-          { cmd: "vibecheck guard --mode observe", desc: "run in observe mode" },
-          { cmd: "Edit .vibecheck/firewall.json", desc: "customize firewall rules" },
-        ],
-        docsUrl: "https://docs.vibecheckai.dev/cli/guard",
-      });
-    }
-    
-    // Return appropriate exit code
-    if (!result.allowed) {
-      return EXIT.BLOCKING;
-    }
-    if (result.violationCount > 0 || result.warningCount > 0) {
-      return EXIT.WARNINGS;
-    }
-    return EXIT.SUCCESS;
-    
-  } catch (error) {
-    if (json) {
-      console.log(JSON.stringify({ success: false, error: error.message }));
-    } else {
-      renderError(`Firewall check failed: ${error.message}`);
-    }
-    return EXIT.INTERNAL_ERROR;
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════════
-// LEGACY GUARD MODE (Claims, Prompts, Hallucinations)
-// ═══════════════════════════════════════════════════════════════════════════════
 
-async function runLegacyGuard(args, { quiet, json, startTime, globalFlags }) {
   const runClaims = args.includes("--claims") || (!args.includes("--prompts") && !args.includes("--hallucinations"));
   const runPrompts = args.includes("--prompts") || (!args.includes("--claims") && !args.includes("--hallucinations"));
   const runHallucinations = args.includes("--hallucinations") || (!args.includes("--claims") && !args.includes("--prompts"));
+  const jsonOutput = args.includes("--json");
   const strict = args.includes("--strict");
-  
-  // Validate --file if provided
-  const fileIndex = args.indexOf("--file");
-  if (fileIndex !== -1) {
-    const filePath = args[fileIndex + 1];
-    if (!filePath || filePath.startsWith("--")) {
-      if (json) {
-        console.log(JSON.stringify({ success: false, error: "--file requires a path argument" }));
-      } else {
-        renderError("--file requires a path argument");
-      }
-      return EXIT.USER_ERROR;
-    }
-    if (!fs.existsSync(filePath)) {
-      if (json) {
-        console.log(JSON.stringify({ success: false, error: `File not found: ${filePath}` }));
-      } else {
-        renderError(`File not found: ${filePath}`);
-      }
-      return EXIT.NOT_FOUND;
-    }
-  }
 
   const results = {
     claims: null,
@@ -492,164 +78,91 @@ async function runLegacyGuard(args, { quiet, json, startTime, globalFlags }) {
     warnings: 0,
   };
 
-  try {
-    if (!quiet && !json) {
-      renderMinimalHeader("guard", "starter");
-      renderSectionHeader("Trust Boundary Checks", sym.shield);
-    }
+  console.log(`
+${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}
+  ${c.bold}🛡️  VIBECHECK GUARD${c.reset} - Trust Boundary Enforcement
+${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}
+`);
 
-    // Run claims verification
-    if (runClaims) {
-      const spinner = !quiet && !json ? new Spinner("Verifying AI claims against truthpack").start() : null;
-      
-      if (!runValidate) {
-        results.claims = { skipped: true, reason: "Validator module not available" };
-        spinner?.warn("Claims check skipped: module not available");
-      } else {
-        try {
-          const validateArgs = args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a));
-          const exitCode = await runValidate(validateArgs);
-          results.claims = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
-          if (exitCode !== 0) {
-            results.errors++;
-            results.verdict = "FAIL";
-            spinner?.fail("Claim verification failed");
-          } else {
-            spinner?.succeed("Claims verified");
-          }
-        } catch (e) {
-          results.claims = { error: e.message };
-          spinner?.warn(`Claims check failed: ${e.message}`);
-        }
+  // Run claims verification (validates AI claims against truthpack)
+  if (runClaims) {
+    console.log(`${c.dim}▸ Verifying AI claims against truthpack...${c.reset}`);
+    try {
+      const validateArgs = args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a));
+      const exitCode = await runValidate(validateArgs);
+      results.claims = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
+      if (exitCode !== 0) {
+        results.errors++;
+        results.verdict = "FAIL";
       }
+      console.log(exitCode === 0 
+        ? `  ${c.green}✓${c.reset} Claims verified` 
+        : `  ${c.red}✗${c.reset} Claim verification failed`);
+    } catch (e) {
+      results.claims = { error: e.message };
+      console.log(`  ${c.yellow}⚠${c.reset} Claims check skipped: ${e.message}`);
     }
+  }
 
-    // Run prompt injection detection
-    if (runPrompts) {
-      const spinner = !quiet && !json ? new Spinner("Scanning for prompt injection vulnerabilities").start() : null;
-      
-      if (!runPromptFirewall) {
-        results.prompts = { skipped: true, reason: "Firewall module not available" };
-        spinner?.warn("Prompt check skipped: module not available");
-      } else {
-        try {
-          const firewallArgs = args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a));
-          const exitCode = await runPromptFirewall(firewallArgs);
-          results.prompts = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
-          if (exitCode !== 0) {
-            results.warnings++;
-            if (strict) results.verdict = "FAIL";
-            spinner?.warn("Prompt injection risks detected");
-          } else {
-            spinner?.succeed("No prompt injection risks");
-          }
-        } catch (e) {
-          results.prompts = { error: e.message };
-          spinner?.warn(`Prompt check failed: ${e.message}`);
-        }
+  // Run prompt injection detection
+  if (runPrompts) {
+    console.log(`${c.dim}▸ Scanning for prompt injection vulnerabilities...${c.reset}`);
+    try {
+      const firewallArgs = args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a));
+      const exitCode = await runPromptFirewall(firewallArgs);
+      results.prompts = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
+      if (exitCode !== 0) {
+        results.warnings++;
+        if (strict) results.verdict = "FAIL";
       }
+      console.log(exitCode === 0 
+        ? `  ${c.green}✓${c.reset} No prompt injection risks` 
+        : `  ${c.yellow}⚠${c.reset} Prompt injection risks detected`);
+    } catch (e) {
+      results.prompts = { error: e.message };
+      console.log(`  ${c.yellow}⚠${c.reset} Prompt check skipped: ${e.message}`);
     }
+  }
 
-    // Run hallucination detection
-    if (runHallucinations) {
-      const spinner = !quiet && !json ? new Spinner("Detecting hallucination patterns").start() : null;
-      
-      if (!runValidate) {
-        results.hallucinations = { skipped: true, reason: "Validator module not available" };
-        spinner?.warn("Hallucination check skipped: module not available");
-      } else {
-        try {
-          const validateArgs = ["--hallucinations", ...args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a))];
-          const exitCode = await runValidate(validateArgs);
-          results.hallucinations = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
-          if (exitCode !== 0) {
-            results.warnings++;
-            if (strict) results.verdict = "FAIL";
-            spinner?.warn("Potential hallucinations detected");
-          } else {
-            spinner?.succeed("No hallucination patterns");
-          }
-        } catch (e) {
-          results.hallucinations = { error: e.message };
-          spinner?.warn(`Hallucination check failed: ${e.message}`);
-        }
+  // Run hallucination detection
+  if (runHallucinations) {
+    console.log(`${c.dim}▸ Detecting hallucination patterns...${c.reset}`);
+    // Use validate with hallucination focus
+    try {
+      const validateArgs = ["--hallucinations", ...args.filter(a => !["--claims", "--prompts", "--hallucinations"].includes(a))];
+      const exitCode = await runValidate(validateArgs);
+      results.hallucinations = { exitCode, status: exitCode === 0 ? "pass" : "fail" };
+      if (exitCode !== 0) {
+        results.warnings++;
+        if (strict) results.verdict = "FAIL";
       }
+      console.log(exitCode === 0 
+        ? `  ${c.green}✓${c.reset} No hallucination patterns` 
+        : `  ${c.yellow}⚠${c.reset} Potential hallucinations detected`);
+    } catch (e) {
+      results.hallucinations = { error: e.message };
+      console.log(`  ${c.yellow}⚠${c.reset} Hallucination check skipped: ${e.message}`);
     }
+  }
 
-    // Summary
-    const duration = Date.now() - startTime;
-    
-    if (!quiet && !json) {
-      renderVerdict(results.verdict === "PASS" ? "PASS" : "FAIL", {
-        warnings: results.warnings,
-        critical: results.errors,
-        duration,
-      });
-      
-      renderFooter({
-        nextSteps: results.verdict === "PASS" ? [
-          { cmd: "vibecheck scan", desc: "run full code analysis" },
-          { cmd: "vibecheck ship", desc: "get ship verdict" },
-        ] : [
-          { cmd: "vibecheck fix --plan-only", desc: "view fix recommendations" },
-        ],
-        docsUrl: "https://docs.vibecheckai.dev/cli/guard",
-      });
-    }
+  // Summary
+  console.log(`
+${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}`);
+  
+  if (results.verdict === "PASS") {
+    console.log(`  ${c.green}${c.bold}✓ GUARD PASS${c.reset} - All trust boundaries intact`);
+  } else {
+    console.log(`  ${c.red}${c.bold}✗ GUARD FAIL${c.reset} - Trust boundary violations detected`);
+  }
 
-    if (json) {
-      console.log(JSON.stringify({ ...results, duration }, null, 2));
-    }
+  console.log(`${c.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c.reset}
+`);
 
-    // Return appropriate exit code
-    if (results.verdict === "PASS") {
-      return EXIT.SUCCESS;
-    } else if (results.errors > 0) {
-      return EXIT.BLOCKING;
-    } else {
-      return EXIT.WARNINGS;
-    }
-  } catch (error) {
-    if (json) {
-      console.log(JSON.stringify({ success: false, error: error.message }));
-    } else {
-      renderError(`Guard check failed: ${error.message}`);
-    }
-    return EXIT.INTERNAL_ERROR;
+  if (jsonOutput) {
+    console.log(JSON.stringify(results, null, 2));
   }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════════
-// UTILITY FUNCTIONS
-// ═══════════════════════════════════════════════════════════════════════════════
 
-/**
- * Read content from stdin
- * @returns {Promise<string>} Stdin content
- */
-function readStdin() {
-  return new Promise((resolve) => {
-    let data = "";
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("readable", () => {
-      let chunk;
-      while ((chunk = process.stdin.read()) !== null) {
-        data += chunk;
-      }
-    });
-    process.stdin.on("end", () => {
-      resolve(data);
-    });
-    // Timeout after 100ms if no data
-    setTimeout(() => resolve(data), 100);
-  });
+  return results.verdict === "PASS" ? 0 : (results.errors > 0 ? 2 : 1);
 }
 
-// ═══════════════════════════════════════════════════════════════════════════════
-// EXPORTS
-// ═══════════════════════════════════════════════════════════════════════════════
-
-module.exports = { 
-  runGuard,
-  runFirewallCheck,
-};
+module.exports = { runGuard };