@whisperr/wizard 0.2.0 → 0.3.0

package/dist/index.js

@@ -2,16 +2,17 @@
 
 // src/index.ts
 import { readFileSync, realpathSync } from "fs";
-import { dirname, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/cli.ts
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 import * as p from "@clack/prompts";
 
 // src/core/config.ts
 var DEFAULT_API_BASE = "https://api.whisperr.net";
 var DEFAULT_MODEL = "claude-sonnet-5";
+var DEFAULT_PLANNER_MODEL = "claude-opus-4-8";
 var DEFAULT_EFFORT = "high";
 var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 function resolveEffort() {
@@ -29,6 +30,7 @@ function resolveConfig(flags = {}) {
     apiBaseUrl,
     llmBaseUrl,
     model: flags.model ?? process.env.WHISPERR_WIZARD_MODEL ?? DEFAULT_MODEL,
+    plannerModel: process.env.WHISPERR_WIZARD_PLANNER_MODEL ?? DEFAULT_PLANNER_MODEL,
     effort: resolveEffort(),
     // Cost is the real limiter (budgetUsd below). maxTurns is only a high safety
     // backstop against a stuck loop — it should NOT bind on a normal run. (It
@@ -36,7 +38,7 @@ function resolveConfig(flags = {}) {
     maxTurns: Number(process.env.WHISPERR_WIZARD_MAX_TURNS) || 200,
     // Hard ceiling on TOTAL spend across all phases. If hit, the run stops
     // cleanly and keeps whatever already landed. Real runs finish well under it.
-    budgetUsd: Number(process.env.WHISPERR_WIZARD_BUDGET_USD) || 10,
+    budgetUsd: Number(process.env.WHISPERR_WIZARD_BUDGET_USD) || 25,
     directAnthropicKey,
     offline
   };
@@ -1148,6 +1150,355 @@ function mockManifest(appId, config) {
 // src/core/agent.ts
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
+// src/core/git.ts
+import { spawn } from "child_process";
+import { createHash } from "crypto";
+import { mkdir, readFile as readFile2, rm, writeFile } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+async function takeCheckpoint(repoPath) {
+  const isRepo = (await run(repoPath, ["rev-parse", "--is-inside-work-tree"])).ok;
+  if (!isRepo) return { isRepo: false };
+  const branch = (await run(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim();
+  const head = await run(repoPath, ["rev-parse", "HEAD"]);
+  return {
+    isRepo: true,
+    baseRef: head.ok ? head.stdout.trim() : void 0,
+    branch: branch || void 0
+  };
+}
+async function changedFiles(repoPath, checkpoint) {
+  if (!checkpoint.isRepo) return [];
+  const tracked = await run(repoPath, ["diff", "--name-only"]);
+  const untracked = await run(repoPath, [
+    "ls-files",
+    "--others",
+    "--exclude-standard"
+  ]);
+  const set = /* @__PURE__ */ new Set();
+  for (const f of `${tracked.stdout}
+${untracked.stdout}`.split("\n")) {
+    if (f.trim()) set.add(f.trim());
+  }
+  return [...set];
+}
+function revertHint(checkpoint) {
+  if (!checkpoint.isRepo || !checkpoint.baseRef) return void 0;
+  return `git restore . && git clean -fd   (back to ${checkpoint.baseRef.slice(0, 7)})`;
+}
+async function wasTrackedAtCheckpoint(repoPath, checkpoint, file) {
+  if (!checkpoint.isRepo) return false;
+  if (checkpoint.baseRef) {
+    const res2 = await run(repoPath, [
+      "ls-tree",
+      "--name-only",
+      checkpoint.baseRef,
+      "--",
+      file
+    ]);
+    return res2.ok && res2.stdout.trim() !== "";
+  }
+  const res = await run(repoPath, ["ls-files", "--", file]);
+  return res.ok && res.stdout.trim() !== "";
+}
+async function isWorkingTreeClean(repoPath) {
+  const status = await run(repoPath, ["status", "--porcelain"]);
+  return status.ok && status.stdout.trim() === "";
+}
+async function revertToCheckpoint(repoPath, checkpoint) {
+  if (!checkpoint.isRepo) return false;
+  if (checkpoint.baseRef) {
+    const reset = await run(repoPath, ["reset", "--hard", checkpoint.baseRef]);
+    const clean2 = await run(repoPath, ["clean", "-fd"]);
+    return reset.ok && clean2.ok;
+  }
+  const restore = await run(repoPath, ["restore", "."]);
+  const clean = await run(repoPath, ["clean", "-fd"]);
+  return restore.ok && clean.ok;
+}
+async function snapshotChanges(repoPath, checkpoint) {
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of await changedFiles(repoPath, checkpoint)) {
+    try {
+      snapshot.set(file, await readFile2(join2(repoPath, file)));
+    } catch {
+      snapshot.set(file, null);
+    }
+  }
+  return snapshot;
+}
+function snapshotsEqual(a, b) {
+  if (a.size !== b.size) return false;
+  for (const [file, content] of a) {
+    const other = b.get(file);
+    if (other === void 0) return false;
+    if (content === null || other === null) {
+      if (content !== other) return false;
+    } else if (!content.equals(other)) {
+      return false;
+    }
+  }
+  return true;
+}
+async function restoreToSnapshot(repoPath, checkpoint, snapshot) {
+  try {
+    const current = await changedFiles(repoPath, checkpoint);
+    for (const file of /* @__PURE__ */ new Set([...current, ...snapshot.keys()])) {
+      const recorded = snapshot.get(file);
+      const path = join2(repoPath, file);
+      if (recorded === void 0) {
+        if (checkpoint.baseRef) {
+          const co = await run(repoPath, ["checkout", checkpoint.baseRef, "--", file]);
+          if (co.ok) continue;
+        }
+        await rm(path, { force: true });
+      } else if (recorded === null) {
+        await rm(path, { force: true });
+      } else {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, recorded);
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function repoFingerprint(repoPath) {
+  const remote = await run(repoPath, ["remote", "get-url", "origin"]);
+  const seed = remote.ok && remote.stdout.trim() ? normalizeRemote(remote.stdout.trim()) : `dir:${basename(repoPath)}`;
+  return createHash("sha256").update(seed).digest("hex").slice(0, 16);
+}
+function normalizeRemote(url) {
+  return url.replace(/^git@([^:]+):/, "$1/").replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
+}
+async function scanWiredEvents(repoPath, files, eventTypes) {
+  const wired = /* @__PURE__ */ new Map();
+  const patterns = eventTypes.map((e) => ({
+    eventType: e,
+    trackRe: new RegExp(
+      `\\btrack\\s*\\(\\s*[\\s\\S]{0,160}?['"\`]${escapeRegExp(e)}['"\`]`
+    ),
+    literalRe: quotedLiteralRegExp(e)
+  }));
+  const contents = [];
+  for (const file of files) {
+    try {
+      contents.push({ file, content: await readFile2(join2(repoPath, file), "utf8") });
+    } catch {
+      continue;
+    }
+  }
+  for (const { file, content } of contents) {
+    for (const { eventType, trackRe } of patterns) {
+      if (!wired.has(eventType) && trackRe.test(content)) {
+        wired.set(eventType, file);
+      }
+    }
+  }
+  for (const { file, content } of contents) {
+    for (const { eventType, literalRe } of patterns) {
+      if (!wired.has(eventType) && literalRe.test(content)) {
+        wired.set(eventType, file);
+      }
+    }
+  }
+  return wired;
+}
+function quotedLiteralRegExp(eventType) {
+  const leftBoundary = /^\w/.test(eventType) ? "\\b" : "";
+  const rightBoundary = /\w$/.test(eventType) ? "\\b" : "";
+  return new RegExp(`(['"\`])${leftBoundary}${escapeRegExp(eventType)}${rightBoundary}\\1`);
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function run(cwd, args) {
+  return new Promise((resolve3) => {
+    const child = spawn("git", args, { cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("close", (code) => resolve3({ ok: code === 0, stdout, stderr }));
+    child.on("error", () => resolve3({ ok: false, stdout, stderr }));
+  });
+}
+
+// src/core/opportunities.ts
+import { readFile as readFile3, rm as rm2 } from "fs/promises";
+import { join as join3 } from "path";
+var OPPORTUNITIES_FILE = "whisperr-opportunities.json";
+function normalizeCode(value) {
+  return value.trim().toLowerCase().replace(/[ \-./]/g, "_").replace(/[^a-z0-9_]/g, "").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+}
+async function collectOpportunities(repoPath, manifest, checkpoint) {
+  const path = join3(repoPath, OPPORTUNITIES_FILE);
+  if (await wasTrackedAtCheckpoint(repoPath, checkpoint, OPPORTUNITIES_FILE)) {
+    return { events: [], interventions: [] };
+  }
+  let rawText;
+  try {
+    rawText = await readFile3(path, "utf8");
+  } catch {
+    return { events: [], interventions: [] };
+  }
+  await rm2(path, { force: true }).catch(() => {
+  });
+  let raw;
+  try {
+    raw = JSON.parse(rawText);
+  } catch {
+    return { events: [], interventions: [] };
+  }
+  return sanitizeOpportunities(raw, manifest);
+}
+function sanitizeOpportunities(raw, manifest) {
+  const out = { events: [], interventions: [] };
+  if (typeof raw !== "object" || raw === null) return out;
+  const doc = raw;
+  const knownEvents = new Set(manifest.events.map((e) => normalizeCode(e.eventType)));
+  const knownInterventions = /* @__PURE__ */ new Set([
+    ...manifest.events.flatMap((e) => e.interventions ?? []).map((i) => normalizeCode(i.code)),
+    ...(manifest.interventions ?? []).map((i) => normalizeCode(i.code))
+  ]);
+  const seenEvents = /* @__PURE__ */ new Set();
+  for (const entry of asArray(doc.events)) {
+    const ev = coerceEvent(entry);
+    if (!ev) continue;
+    if (knownEvents.has(ev.code) || seenEvents.has(ev.code)) continue;
+    seenEvents.add(ev.code);
+    out.events.push(ev);
+  }
+  const seenInterventions = /* @__PURE__ */ new Set();
+  for (const entry of asArray(doc.interventions)) {
+    const iv = coerceIntervention(entry);
+    if (!iv) continue;
+    if (knownInterventions.has(iv.code) || seenInterventions.has(iv.code)) continue;
+    seenInterventions.add(iv.code);
+    out.interventions.push(iv);
+  }
+  return out;
+}
+var SUBMIT_TIMEOUT_MS = 3e4;
+async function submitAdditions(config, session, target9, repoFingerprint2, opportunities) {
+  const res = await fetch(`${config.apiBaseUrl}/wizard/universe/additions`, {
+    method: "POST",
+    signal: AbortSignal.timeout(SUBMIT_TIMEOUT_MS),
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${session.token}`
+    },
+    body: JSON.stringify({
+      target: target9,
+      repoFingerprint: repoFingerprint2,
+      events: opportunities.events,
+      interventions: opportunities.interventions
+    })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(
+      `Submitting universe additions failed (${res.status})${body ? `: ${body.slice(0, 300)}` : ""}`
+    );
+  }
+  return await res.json();
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asString(value) {
+  if (typeof value !== "string") return void 0;
+  const cleaned = value.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, "").replace(/[\x00-\x1f\x7f]/g, " ").replace(/ {2,}/g, " ").trim();
+  return cleaned ? cleaned : void 0;
+}
+function asConfidence(value) {
+  if (typeof value !== "number" || Number.isNaN(value)) return void 0;
+  return Math.min(1, Math.max(0, value));
+}
+function asWeight(value) {
+  if (typeof value !== "number" || Number.isNaN(value)) return void 0;
+  if (value < 0 || value > 1) return void 0;
+  return value;
+}
+function coerceEvent(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const e = entry;
+  const code = normalizeCode(asString(e.code) ?? "");
+  if (!code) return null;
+  const properties = [];
+  for (const prop of asArray(e.properties)) {
+    if (typeof prop === "string") {
+      if (prop.trim()) properties.push({ name: prop.trim() });
+      continue;
+    }
+    if (typeof prop !== "object" || prop === null) continue;
+    const pr = prop;
+    const name = asString(pr.name);
+    if (!name) continue;
+    const desc = asString(pr.description);
+    properties.push({
+      name,
+      ...desc ? { description: desc } : {},
+      ...pr.required === true ? { required: true } : {}
+    });
+  }
+  const links = [];
+  for (const link of asArray(e.links)) {
+    if (typeof link !== "object" || link === null) continue;
+    const l = link;
+    const interventionCode = normalizeCode(asString(l.interventionCode) ?? "");
+    if (!interventionCode) continue;
+    const weight = asWeight(l.weight);
+    links.push({ interventionCode, ...weight !== void 0 ? { weight } : {} });
+  }
+  const side = normalizeSide(asString(e.side));
+  return {
+    code,
+    label: asString(e.label),
+    description: asString(e.description),
+    ...side ? { side } : {},
+    rationale: asString(e.rationale),
+    confidence: asConfidence(e.confidence),
+    ...properties.length ? { properties } : {},
+    ...links.length ? { links } : {}
+  };
+}
+function coerceIntervention(entry) {
+  if (typeof entry !== "object" || entry === null) return null;
+  const i = entry;
+  const code = normalizeCode(asString(i.code) ?? "");
+  if (!code) return null;
+  const links = [];
+  for (const link of asArray(i.links)) {
+    if (typeof link !== "object" || link === null) continue;
+    const l = link;
+    const eventCode = normalizeCode(asString(l.eventCode) ?? "");
+    if (!eventCode) continue;
+    const weight = asWeight(l.weight);
+    links.push({ eventCode, ...weight !== void 0 ? { weight } : {} });
+  }
+  return {
+    code,
+    label: asString(i.label),
+    description: asString(i.description),
+    rationale: asString(i.rationale),
+    confidence: asConfidence(i.confidence),
+    ...links.length ? { links } : {}
+  };
+}
+function normalizeSide(value) {
+  switch (value?.toLowerCase()) {
+    case "frontend":
+      return "frontend";
+    case "backend":
+      return "backend";
+    case "either":
+      return "either";
+    default:
+      return void 0;
+  }
+}
+
 // src/core/playbooks/shared-prompt.ts
 var BASE_WIZARD_PROMPT = `
 You are the Whisperr Wizard \u2014 an expert integration agent running INSIDE a
@@ -1324,6 +1675,46 @@ function renderEventsBrief(m) {
   }
   return lines.join("\n");
 }
+function renderOpportunitiesBrief(m, opportunitiesFile) {
+  const eventCodes = m.events.map((e) => e.eventType);
+  const interventionCodes = [
+    ...new Set(m.events.flatMap((e) => e.interventions ?? []).map((i) => i.code))
+  ];
+  return [
+    "UNIVERSE OPPORTUNITIES (do this LAST, after your corrections):",
+    "While auditing you read this app's real lifecycle. If you found churn-",
+    "relevant moments the plan does NOT cover \u2014 e.g. a recurring-payment or",
+    "cancellation path with no event, a support/refund flow worth a retention",
+    "play \u2014 record them as PROPOSALS. Do NOT add track() calls for them.",
+    `Write a single JSON file at the repo root named ${opportunitiesFile}:`,
+    "",
+    "{",
+    '  "events": [{',
+    '    "code": "snake_case_event", "label": "...", "description": "...",',
+    '    "side": "frontend|backend|either", "rationale": "what in the code shows this",',
+    '    "confidence": 0.0-1.0,',
+    '    "properties": [{"name": "...", "description": "...", "required": false}],',
+    '    "links": [{"interventionCode": "existing_or_proposed", "weight": 0.0-1.0}]',
+    "  }],",
+    '  "interventions": [{',
+    '    "code": "snake_case_strategy", "label": "...", "description": "...",',
+    '    "rationale": "...", "confidence": 0.0-1.0,',
+    '    "links": [{"eventCode": "existing_or_proposed", "weight": 0.0-1.0}]',
+    "  }]",
+    "}",
+    "",
+    "Rules:",
+    `- The plan already covers these events: ${eventCodes.join(", ") || "(none)"}.`,
+    `  And these interventions: ${interventionCodes.join(", ") || "(none)"}.`,
+    "  Propose ONLY what is genuinely missing \u2014 never re-propose or rename these.",
+    "- Every proposal needs concrete code evidence in its rationale (file/flow),",
+    "  not speculation. 0-3 events and 0-2 interventions is the normal range;",
+    "  an empty file or no file at all is a perfectly good outcome.",
+    "- Link each proposed event to the intervention(s) it should feed (existing",
+    "  codes or ones you propose in the same file).",
+    "- This file is metadata for the wizard, not app code \u2014 write it and move on."
+  ].join("\n");
+}
 function coverageNote(coverage) {
   if (!coverage?.length) return "";
   const here = coverage.find((c) => c.sameSurface && c.status === "wired");
@@ -1335,15 +1726,319 @@ function coverageNote(coverage) {
   return "";
 }
 
+// src/core/toolPolicy.ts
+import { isAbsolute, relative, resolve } from "path";
+var SECRET_MATERIAL_DENIAL = "blocked: secret material - reference the variable name in .env.example instead of reading the real file";
+var WRITE_OUTSIDE_REPO_DENIAL = "blocked: writes must stay inside the target repository";
+var BASH_ALLOWLIST_DENIAL = "blocked: command is outside the Bash allowlist - use package install/add commands, mkdir, or git status/diff/log only";
+var CHAINED_COMMAND_DENIAL = "blocked: chained or substituted shell command - run one command at a time";
+var ENV_EXAMPLES = /* @__PURE__ */ new Set([".env.example", ".env.sample", ".env.template"]);
+var SECRET_DIRECTORIES = /* @__PURE__ */ new Set([".aws", ".ssh", ".gnupg"]);
+var SECRET_EXACT_FILES = /* @__PURE__ */ new Set([".netrc", ".npmrc", ".pypirc"]);
+var SECRET_SUFFIXES = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".keystore",
+  ".tfvars"
+];
+var JS_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun"]);
+var PYTHON_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["pip", "pip3", "poetry", "uv"]);
+var RUBY_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["gem", "bundle"]);
+function evaluateToolUse(toolName, input, context) {
+  switch (toolName) {
+    case "Read":
+      return evaluateReadLike(readPathInputs(input), readPathInputs(input), context);
+    case "Grep":
+      return evaluateReadLike(grepGlobPathInputs(input), grepPathInputs(input), context);
+    case "Glob":
+      return evaluateReadLike(grepGlobPathInputs(input), grepGlobPathInputs(input), context);
+    case "Bash":
+      return evaluateBash(input);
+    case "Write":
+    case "Edit":
+      return evaluateWrite(input, context);
+    default:
+      return {
+        behavior: "deny",
+        message: `blocked: tool ${toolName} is not allowed by the wizard tool policy`
+      };
+  }
+}
+function isSecretPathLike(value) {
+  const parts = normalizePathLike(value).split("/").filter(Boolean);
+  for (const rawPart of parts) {
+    const part = stripOuterQuotes(rawPart.trim().toLowerCase());
+    if (!part || part === "." || part === "**") continue;
+    if (ENV_EXAMPLES.has(part)) continue;
+    if (SECRET_DIRECTORIES.has(part)) return true;
+    if (SECRET_EXACT_FILES.has(part)) return true;
+    if (part === ".env" || part === ".envrc" || part.startsWith(".env.") || part.startsWith(".env*")) {
+      return true;
+    }
+    if (part.startsWith("id_rsa") || part.startsWith("id_ecdsa") || part.startsWith("id_ed25519")) {
+      return true;
+    }
+    if (part.includes("credentials")) return true;
+    if (part.startsWith("secrets.")) return true;
+    if (SECRET_SUFFIXES.some((suffix) => part.endsWith(suffix))) return true;
+  }
+  return false;
+}
+function isPathInsideRepo(pathValue, repoPath) {
+  if (pathValue.includes("..")) return false;
+  const repoRoot = resolve(repoPath);
+  const candidate = isAbsolute(pathValue) ? resolve(pathValue) : resolve(repoRoot, pathValue);
+  const rel = relative(repoRoot, candidate);
+  return rel === "" || !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function evaluateReadLike(secretValues, repoPathValues, context) {
+  for (const value of secretValues) {
+    if (isSecretPathLike(value)) {
+      return { behavior: "deny", message: SECRET_MATERIAL_DENIAL };
+    }
+  }
+  for (const value of repoPathValues) {
+    if (!isPathInsideRepo(value, context.repoPath)) {
+      return {
+        behavior: "deny",
+        message: "blocked: reads must stay inside the target repository"
+      };
+    }
+  }
+  return { behavior: "allow" };
+}
+function evaluateWrite(input, context) {
+  const pathValue = firstString(input, ["file_path", "path"]);
+  if (!pathValue) {
+    return { behavior: "deny", message: "blocked: write target path is missing" };
+  }
+  if (!isPathInsideRepo(pathValue, context.repoPath)) {
+    return { behavior: "deny", message: WRITE_OUTSIDE_REPO_DENIAL };
+  }
+  return { behavior: "allow" };
+}
+function evaluateBash(input) {
+  const command = firstString(input, ["command"]);
+  if (!command) {
+    return { behavior: "deny", message: "blocked: Bash command is missing" };
+  }
+  const split = splitShellSegments(command);
+  if (split.hasCommandSubstitution) {
+    return { behavior: "deny", message: CHAINED_COMMAND_DENIAL };
+  }
+  const segmentDecisions = split.segments.map(evaluateBashSegment);
+  const denied = segmentDecisions.find((decision) => decision.behavior === "deny");
+  if (denied) {
+    return split.hadChain ? { behavior: "deny", message: CHAINED_COMMAND_DENIAL } : denied;
+  }
+  return { behavior: "allow" };
+}
+function evaluateBashSegment(segment) {
+  const tokens = tokenizeShellSegment(segment);
+  if (!tokens.length) return { behavior: "deny", message: BASH_ALLOWLIST_DENIAL };
+  const command = tokens[0]?.toLowerCase() ?? "";
+  const second = tokens[1]?.toLowerCase() ?? "";
+  const third = tokens[2]?.toLowerCase() ?? "";
+  if (JS_PACKAGE_MANAGERS.has(command)) {
+    if (second === "install" || second === "add" || second === "ci") {
+      return { behavior: "allow" };
+    }
+    if (second === "pkg" && (third === "get" || third === "set")) {
+      return { behavior: "allow" };
+    }
+  }
+  if (PYTHON_PACKAGE_MANAGERS.has(command)) {
+    if (second === "install" || second === "add") {
+      return { behavior: "allow" };
+    }
+    if (command === "uv" && second === "pip" && third === "install") {
+      return { behavior: "allow" };
+    }
+  }
+  if (command === "composer" && (second === "install" || second === "require")) {
+    return { behavior: "allow" };
+  }
+  if (command === "pod" && second === "install") {
+    return { behavior: "allow" };
+  }
+  if ((command === "flutter" || command === "dart") && second === "pub") {
+    return { behavior: "allow" };
+  }
+  if (RUBY_PACKAGE_MANAGERS.has(command) && (second === "install" || second === "add")) {
+    return { behavior: "allow" };
+  }
+  if (command === "go" && (second === "get" || second === "mod")) {
+    return { behavior: "allow" };
+  }
+  if (command === "mkdir") {
+    return { behavior: "allow" };
+  }
+  if (command === "git" && (second === "status" || second === "diff" || second === "log")) {
+    if (tokens.slice(2).some((token) => isSecretPathLike(token))) {
+      return { behavior: "deny", message: SECRET_MATERIAL_DENIAL };
+    }
+    return { behavior: "allow" };
+  }
+  return { behavior: "deny", message: BASH_ALLOWLIST_DENIAL };
+}
+function readPathInputs(input) {
+  return stringInputs(input, ["file_path", "path"]);
+}
+function grepGlobPathInputs(input) {
+  return stringInputs(input, ["file_path", "path", "pattern", "glob"]);
+}
+function grepPathInputs(input) {
+  return stringInputs(input, ["file_path", "path"]);
+}
+function stringInputs(input, keys) {
+  const values = [];
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) values.push(value.trim());
+  }
+  return values;
+}
+function firstString(input, keys) {
+  return stringInputs(input, keys)[0];
+}
+function normalizePathLike(value) {
+  return stripOuterQuotes(value.trim()).replace(/\\/g, "/");
+}
+function stripOuterQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function splitShellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  let hadChain = false;
+  let hasCommandSubstitution = false;
+  const push = () => {
+    const segment = current.trim();
+    if (segment) segments.push(segment);
+    current = "";
+  };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    const next = command[i + 1];
+    if (ch === "`" || ch === "$" && next === "(") {
+      hasCommandSubstitution = true;
+    }
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "'") {
+      current += ch;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = void 0;
+      current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    const two = `${ch}${next ?? ""}`;
+    if (two === "&&" || two === "||") {
+      hadChain = true;
+      push();
+      i++;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "\n") {
+      hadChain = true;
+      push();
+      continue;
+    }
+    current += ch;
+  }
+  push();
+  return { segments, hadChain, hasCommandSubstitution };
+}
+function tokenizeShellSegment(segment) {
+  const tokens = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  const push = () => {
+    if (current) tokens.push(current);
+    current = "";
+  };
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = void 0;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      push();
+      continue;
+    }
+    current += ch;
+  }
+  push();
+  return tokens;
+}
+
 // src/core/agent.ts
 async function runIntegrationAgent(opts) {
-  const { repoPath, config, session, playbook, manifest, progress } = opts;
+  const { repoPath, config, session, playbook, manifest, progress, onPlanReady } = opts;
   applyModelAuthEnv(config, session);
   const systemPrompt9 = [BASE_WIZARD_PROMPT, playbook.systemPrompt].join("\n\n");
   const started = Date.now();
   let costUsd = 0;
   const summaries = [];
-  progress?.onPhase?.("Installing the SDK & wiring identify()");
+  let repoMap = "";
+  let eventOutcomes = [];
+  const phaseTimings = [];
+  const BUDGET_FLOOR = 0.25;
+  if (config.budgetUsd - costUsd > BUDGET_FLOOR) {
+    try {
+      const map = await runTimedPass("Mapping your codebase", {
+        prompt: renderRepoMapPrompt(repoPath),
+        systemPrompt: systemPrompt9,
+        repoPath,
+        model: config.plannerModel,
+        effort: "high",
+        maxTurns: 40,
+        budgetUsd: Math.min(config.budgetUsd - costUsd, config.budgetUsd * 0.15),
+        allowedTools: READ_ONLY_TOOLS,
+        progress
+      }, phaseTimings);
+      costUsd += map.costUsd;
+      repoMap = sliceRepoMap(map.summary);
+    } catch (err) {
+      debugNote(`repo map pass failed: ${err.message}`);
+      repoMap = "";
+    }
+  }
   const corePrompt = [
     `Integrate the Whisperr ${playbook.target.displayName} SDK \u2014 CORE SETUP ONLY.`,
     `Project root: ${repoPath}`,
@@ -1368,11 +2063,12 @@ async function runIntegrationAgent(opts) {
     "Do NOT instrument product events yet \u2014 that is a separate step. Do not run",
     "the analyzer or build; the human will review the diff.",
     "",
+    ...renderRepoMapSection(repoMap),
     "----- IDENTIFY -----",
     renderIdentifyBrief(manifest),
     "----- END -----"
   ].join("\n");
-  const core = await runPass({
+  const core = await runTimedPass("Installing the SDK & wiring identify()", {
     prompt: corePrompt,
     systemPrompt: systemPrompt9,
     repoPath,
@@ -1381,58 +2077,111 @@ async function runIntegrationAgent(opts) {
     maxTurns: 50,
     budgetUsd: config.budgetUsd - costUsd,
     progress
-  });
+  }, phaseTimings);
   costUsd += core.costUsd;
   if (core.summary) summaries.push(`Core setup:
 ${core.summary}`);
-  const BUDGET_FLOOR = 0.25;
   let eventsComplete = true;
   if (manifest.events.length > 0 && config.budgetUsd - costUsd <= BUDGET_FLOOR) {
     eventsComplete = false;
+    eventOutcomes = manifest.events.map((event) => ({
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "Spend limit reached during core setup."
+    }));
     summaries.push(
       "Events: skipped \u2014 the spend limit was reached during core setup. Re-run with a higher WHISPERR_WIZARD_BUDGET_USD to instrument events."
     );
   } else if (manifest.events.length > 0) {
-    progress?.onPhase?.("Instrumenting your events");
-    const eventsPrompt = [
-      `The Whisperr ${playbook.target.displayName} SDK is already installed and`,
-      "initialized, and identify() is wired. Now instrument the product events",
-      "below with track().",
-      "",
-      "Work in importance order. Place each event at the real call site where the",
-      "END USER performs the action (not an admin/staff path \u2014 see WHO COUNTS AS",
-      `"THE USER"), and attach the properties you can source from what's in scope`,
-      "there (see the property-capture rule). These events describe the same",
-      "person identify() did, so they live on the same end-user surface. Skip fast",
-      "when an event has no clear trigger here \u2014 spend steps placing, not exploring.",
-      "Stop once the events that clearly exist in this app are wired.",
-      "",
-      "----- EVENTS -----",
-      renderEventsBrief(manifest),
-      "----- END -----"
-    ].join("\n");
-    const events = await runPass({
-      prompt: eventsPrompt,
+    const planPass = await runTimedPass("Planning event placements", {
+      prompt: renderEventPlanPrompt(repoPath, playbook, manifest, repoMap),
       systemPrompt: systemPrompt9,
       repoPath,
-      model: config.model,
-      effort: config.effort,
-      maxTurns: config.maxTurns,
+      model: config.plannerModel,
+      effort: "high",
+      maxTurns: 40,
       budgetUsd: config.budgetUsd - costUsd,
+      allowedTools: READ_ONLY_TOOLS,
       progress
-    });
-    costUsd += events.costUsd;
-    eventsComplete = !events.maxedOut;
-    if (events.summary) summaries.push(`Events:
-${events.summary}`);
+    }, phaseTimings);
+    costUsd += planPass.costUsd;
+    const plan = parseEventPlan(planPass.summary);
+    if (!plan) {
+      debugNote("event plan parse failed; falling back to direct event wiring");
+      progress?.onActivity?.("Event plan was not parseable; falling back to direct wiring");
+      const direct = await runDirectEventsPass({
+        repoPath,
+        config,
+        systemPrompt: systemPrompt9,
+        playbook,
+        manifest,
+        repoMap,
+        budgetUsd: config.budgetUsd - costUsd,
+        progress,
+        phaseTimings
+      });
+      costUsd += direct.pass.costUsd;
+      eventsComplete = !direct.pass.maxedOut;
+      eventOutcomes = direct.eventOutcomes;
+      if (direct.pass.summary) summaries.push(`Events:
+${direct.pass.summary}`);
+    } else {
+      let scopedPlan = planForManifest(plan, manifest);
+      const reviewedPlan = await onPlanReady?.(scopedPlan);
+      if (reviewedPlan !== void 0 && reviewedPlan !== null) {
+        scopedPlan = planForManifest(reviewedPlan, manifest);
+      }
+      const placeEntries = scopedPlan.filter((entry) => entry.decision === "place");
+      const unsureEntries = scopedPlan.filter((entry) => entry.decision === "unsure");
+      let wire;
+      if (placeEntries.length && config.budgetUsd - costUsd > BUDGET_FLOOR) {
+        wire = await runTimedPass("Instrumenting planned events", {
+          prompt: renderEventWirePrompt(repoPath, playbook, repoMap, placeEntries),
+          systemPrompt: systemPrompt9,
+          repoPath,
+          model: config.model,
+          effort: "high",
+          maxTurns: config.maxTurns,
+          budgetUsd: config.budgetUsd - costUsd,
+          progress
+        }, phaseTimings);
+        costUsd += wire.costUsd;
+        if (wire.summary) summaries.push(`Events:
+${wire.summary}`);
+      } else if (!placeEntries.length) {
+        summaries.push("Events: no events had a confident placement in this surface.");
+      }
+      let wired = await scanManifestEvents(repoPath, manifest);
+      const missedPlaceEntries = placeEntries.filter((entry) => !wired.has(entry.event));
+      const followUpEntries = uniquePlanEntries([...missedPlaceEntries, ...unsureEntries]);
+      let followUp;
+      if (followUpEntries.length && config.budgetUsd - costUsd > BUDGET_FLOOR) {
+        followUp = await runTimedPass("Reconciling missed events", {
+          prompt: renderEventReconcilePrompt(repoPath, playbook, repoMap, followUpEntries),
+          systemPrompt: systemPrompt9,
+          repoPath,
+          model: config.plannerModel,
+          effort: "medium",
+          maxTurns: 15,
+          budgetUsd: config.budgetUsd - costUsd,
+          progress
+        }, phaseTimings);
+        costUsd += followUp.costUsd;
+        if (followUp.summary) summaries.push(`Event reconciliation:
+${followUp.summary}`);
+        wired = await scanManifestEvents(repoPath, manifest);
+      }
+      eventOutcomes = buildEventOutcomes(manifest, scopedPlan, wired);
+      eventsComplete = !planPass.maxedOut && !(wire?.maxedOut ?? false) && !(followUp?.maxedOut ?? false);
+    }
   }
   if (core.ok && config.budgetUsd - costUsd > BUDGET_FLOOR) {
-    progress?.onPhase?.("Reviewing & correcting placements");
     const reviewPrompt = [
       `You wired the Whisperr ${playbook.target.displayName} SDK into this repo.`,
       "Now AUDIT YOUR OWN WORK and fix mistakes before finishing.",
       `Project root: ${repoPath}`,
       "",
+      ...renderRepoMapSection(repoMap),
       "Run `git diff` and read the surrounding code to see exactly what you added.",
       "For every identify() and track() call, verify \u2014 and FIX in place:",
       "1. Subject \u2014 keys to the END USER, never an admin/staff/operator/seller.",
@@ -1448,41 +2197,469 @@ ${events.summary}`);
       "4. Coverage \u2014 every gateway/callback path that should emit an event does;",
       "   no recurring or secondary path left as a dead zone.",
       "Change ONLY what is genuinely wrong or incomplete \u2014 do not churn correct",
-      "calls or re-explore the whole repo. Be surgical. End with a one-line,",
-      "plain-text note of what you corrected, or 'No corrections needed.'."
+      "calls or re-explore the whole repo. Be surgical.",
+      "",
+      renderOpportunitiesBrief(manifest, OPPORTUNITIES_FILE),
+      "",
+      "End with a one-line, plain-text note of what you corrected (or 'No",
+      "corrections needed.'), plus one line on what you proposed, if anything."
     ].join("\n");
-    const review = await runPass({
+    const review = await runTimedPass("Reviewing & correcting placements", {
       prompt: reviewPrompt,
       systemPrompt: systemPrompt9,
       repoPath,
-      model: config.model,
-      effort: config.effort,
+      model: config.plannerModel,
+      effort: "medium",
       maxTurns: 40,
       budgetUsd: config.budgetUsd - costUsd,
       progress
-    });
+    }, phaseTimings);
     costUsd += review.costUsd;
     if (review.summary) summaries.push(`Review:
 ${review.summary}`);
+    if (manifest.events.length) {
+      eventOutcomes = refreshWiredOutcomes(
+        eventOutcomes,
+        manifest,
+        await scanManifestEvents(repoPath, manifest)
+      );
+    }
   }
   return {
-    summary: summaries.join("\n\n"),
-    costUsd,
-    durationMs: Date.now() - started,
-    coreOk: core.ok,
-    eventsComplete
+    summary: summaries.join("\n\n"),
+    costUsd,
+    durationMs: Date.now() - started,
+    phaseTimings,
+    coreOk: core.ok,
+    eventsComplete,
+    eventOutcomes,
+    repoMap: repoMap || void 0
+  };
+}
+async function runAdditionsInstrumentationPass(opts) {
+  const { repoPath, config, session, playbook, acceptedEvents, budgetUsd, repoMap, progress } = opts;
+  if (!acceptedEvents.length || budgetUsd <= 0) {
+    return { summary: "", costUsd: 0, ran: false };
+  }
+  applyModelAuthEnv(config, session);
+  const systemPrompt9 = [BASE_WIZARD_PROMPT, playbook.systemPrompt].join("\n\n");
+  const eventLines = [];
+  for (const e of acceptedEvents) {
+    eventLines.push("");
+    eventLines.push(`\u25A0 ${e.code}${e.label ? `  (${e.label})` : ""}`);
+    if (e.description) eventLines.push(`  ${e.description}`);
+    if (e.rationale) eventLines.push(`  where: ${e.rationale}`);
+    if (e.properties?.length) {
+      eventLines.push("  properties to capture if available:");
+      for (const prop of e.properties) {
+        eventLines.push(`    \xB7 ${prop.name}${prop.required ? " (required)" : ""}${prop.description ? ` \u2014 ${prop.description}` : ""}`);
+      }
+    }
+  }
+  progress?.onPhase?.("Instrumenting the newly added events");
+  const prompt = [
+    "You proposed these events as universe opportunities while reviewing this",
+    "repo, and the user just APPROVED adding them to the plan. Instrument them",
+    "now with track(), exactly like the plan's other events: place each at the",
+    "real call site (your own rationale tells you where you saw it), attach the",
+    "properties available in scope, and skip anything that turns out not to have",
+    "a clear trigger after all. The SDK is already installed and initialized.",
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "----- APPROVED NEW EVENTS -----",
+    ...eventLines,
+    "",
+    "----- END -----"
+  ].join("\n");
+  const pass = await runPass({
+    prompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model: config.model,
+    effort: config.effort,
+    maxTurns: 25,
+    budgetUsd,
+    progress
+  });
+  return { summary: pass.summary, costUsd: pass.costUsd, ran: true };
+}
+async function runRepairPass(opts) {
+  const {
+    repoPath,
+    config,
+    session,
+    playbook,
+    verifyCommand,
+    verifyOutput,
+    budgetUsd,
+    progress
+  } = opts;
+  if (budgetUsd <= 0) return { summary: "", costUsd: 0, ran: false };
+  applyModelAuthEnv(config, session);
+  const systemPrompt9 = [BASE_WIZARD_PROMPT, playbook.systemPrompt].join("\n\n");
+  progress?.onPhase?.("Repairing verifier failures");
+  const prompt = [
+    "The Whisperr integration was applied, but the verifier command failed.",
+    `Project root: ${repoPath}`,
+    "",
+    "Verifier command:",
+    verifyCommand,
+    "",
+    "Verifier output tail:",
+    tail(verifyOutput, 4e3) || "(no output)",
+    "",
+    "Fix ONLY what the verifier reports; do not refactor. Keep the existing",
+    "Whisperr placement intent unless a verifier error directly requires a small",
+    "syntax/import/type correction. Do not explore unrelated code."
+  ].join("\n");
+  const pass = await runPass({
+    prompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model: config.model,
+    effort: "high",
+    maxTurns: 20,
+    budgetUsd,
+    progress
+  });
+  return { summary: pass.summary, costUsd: pass.costUsd, ran: true };
+}
+var READ_ONLY_TOOLS = ["Read", "Glob", "Grep"];
+var FULL_TOOLS = ["Read", "Edit", "Write", "Bash", "Glob", "Grep"];
+function parseEventPlan(text) {
+  const parsed = parseFirstJsonArray(text);
+  if (!Array.isArray(parsed)) return null;
+  const entries = [];
+  for (const item of parsed) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+    const obj = item;
+    const event = typeof obj.event === "string" ? obj.event.trim() : "";
+    const decision = obj.decision;
+    if (!event || decision !== "place" && decision !== "skip" && decision !== "unsure") {
+      return null;
+    }
+    const entry = {
+      event,
+      decision,
+      reason: typeof obj.reason === "string" ? obj.reason.trim() : ""
+    };
+    if (typeof obj.file === "string" && obj.file.trim()) {
+      entry.file = obj.file.trim();
+    }
+    if (typeof obj.anchor === "string" && obj.anchor.trim()) {
+      entry.anchor = obj.anchor.trim();
+    }
+    if (Array.isArray(obj.properties)) {
+      entry.properties = obj.properties.filter((prop) => typeof prop === "string" && !!prop.trim()).map((prop) => prop.trim());
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+function parseFirstJsonArray(text) {
+  const start = text.indexOf("[");
+  if (start < 0) return null;
+  const json = sliceJsonArray(text, start);
+  if (!json) return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function sliceJsonArray(text, start) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "[") {
+      depth++;
+    } else if (ch === "]") {
+      depth--;
+      if (depth === 0) return text.slice(start, i + 1);
+    }
+  }
+  return null;
+}
+function renderRepoMapPrompt(repoPath) {
+  return [
+    "Map this repository for a Whisperr SDK integration. This is READ-ONLY.",
+    `Project root: ${repoPath}`,
+    "",
+    "Produce a concise structured repo map as final text with these exact sections:",
+    "- framework + entry points",
+    "- auth flows enumerated: END-USER vs admin/staff, with precise file paths",
+    "- billing/payment/webhook surfaces",
+    "- analytics/tracking wrapper if any",
+    "- state management",
+    "- directory guide: which dirs hold pages/controllers/services",
+    "",
+    "This map guides event placement. List file paths precisely. No prose beyond the map."
+  ].join("\n");
+}
+function sliceRepoMap(map) {
+  return map.trim().slice(0, 8e3);
+}
+function renderRepoMapSection(repoMap) {
+  const map = repoMap?.trim();
+  if (!map) return [];
+  return ["----- REPO MAP -----", map, "----- END REPO MAP -----", ""];
+}
+function renderEventPlanPrompt(repoPath, playbook, manifest, repoMap) {
+  return [
+    `Plan Whisperr ${playbook.target.displayName} event placements. This is READ-ONLY.`,
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "Use the repo map and the events brief to decide where each event belongs.",
+    "Return ONLY a JSON code block containing an array with this shape:",
+    '[{"event":"event_name","decision":"place|skip|unsure","file":"path","anchor":"function/route/handler","properties":["prop"],"reason":"short reason"}]',
+    "",
+    "Rules:",
+    "- decision=place only when there is a concrete end-user call site in this repo.",
+    "- decision=skip when the event clearly lives on another surface or does not exist here.",
+    "- decision=unsure when there is a plausible surface but the exact anchor is not proven.",
+    "- For place decisions, include file and anchor precisely.",
+    "- properties should list only properties likely available at that anchor.",
+    "- No prose beyond the JSON code block.",
+    "",
+    "----- EVENTS -----",
+    renderEventsBrief(manifest),
+    "----- END EVENTS -----"
+  ].join("\n");
+}
+function renderEventWirePrompt(repoPath, playbook, repoMap, entries) {
+  return [
+    `The Whisperr ${playbook.target.displayName} SDK is installed and initialized.`,
+    "Wire only the planned event placements below with track().",
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "For each: open the file, find the anchor, add track() with the listed",
+    "properties. If an anchor is genuinely absent, mark it unsure in your",
+    "summary and move on. Do not re-plan skipped or unsure events in this pass.",
+    "",
+    "----- EVENT WIRING PLAN -----",
+    ...renderPlanEntryLines(entries),
+    "----- END EVENT WIRING PLAN -----"
+  ].join("\n");
+}
+function renderEventReconcilePrompt(repoPath, playbook, repoMap, entries) {
+  return [
+    `One targeted follow-up for Whisperr ${playbook.target.displayName} events.`,
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "The events below were either planned for placement but not detected in the",
+    "changed files, or were marked unsure. For each one, make one focused attempt",
+    "at the listed file/anchor. If the anchor is absent or still not clear, skip",
+    "it and say why in the summary. Do not search broadly or refactor.",
+    "",
+    "----- TARGET EVENTS -----",
+    ...renderPlanEntryLines(entries),
+    "----- END TARGET EVENTS -----"
+  ].join("\n");
+}
+function renderPlanEntryLines(entries) {
+  const lines = [];
+  for (const entry of entries) {
+    lines.push("");
+    lines.push(`- event: ${entry.event}`);
+    lines.push(`  decision: ${entry.decision}`);
+    if (entry.file) lines.push(`  file: ${entry.file}`);
+    if (entry.anchor) lines.push(`  anchor: ${entry.anchor}`);
+    if (entry.properties?.length) {
+      lines.push(`  properties: ${entry.properties.join(", ")}`);
+    }
+    if (entry.reason) lines.push(`  reason: ${entry.reason}`);
+  }
+  return lines;
+}
+async function runDirectEventsPass(opts) {
+  const {
+    repoPath,
+    config,
+    systemPrompt: systemPrompt9,
+    playbook,
+    manifest,
+    repoMap,
+    budgetUsd,
+    progress,
+    phaseTimings
+  } = opts;
+  const eventsPrompt = [
+    `The Whisperr ${playbook.target.displayName} SDK is already installed and`,
+    "initialized, and identify() is wired. Now instrument the product events",
+    "below with track().",
+    "",
+    ...renderRepoMapSection(repoMap),
+    "Work in importance order. Place each event at the real call site where the",
+    "END USER performs the action (not an admin/staff path \u2014 see WHO COUNTS AS",
+    `"THE USER"), and attach the properties you can source from what's in scope`,
+    "there (see the property-capture rule). These events describe the same",
+    "person identify() did, so they live on the same end-user surface. Skip fast",
+    "when an event has no clear trigger here \u2014 spend steps placing, not exploring.",
+    "Stop once the events that clearly exist in this app are wired.",
+    "",
+    "----- EVENTS -----",
+    renderEventsBrief(manifest),
+    "----- END -----"
+  ].join("\n");
+  const pass = await runTimedPass("Instrumenting your events", {
+    prompt: eventsPrompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model: config.model,
+    effort: config.effort,
+    maxTurns: config.maxTurns,
+    budgetUsd,
+    progress
+  }, phaseTimings);
+  const wired = await scanManifestEvents(repoPath, manifest);
+  return {
+    pass,
+    eventOutcomes: manifest.events.map(
+      (event) => wired.has(event.eventType) ? { event: event.eventType, outcome: "wired" } : {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: "No track() call was detected after the direct wiring pass."
+      }
+    )
   };
 }
+function planForManifest(plan, manifest) {
+  const known = new Set(manifest.events.map((event) => event.eventType));
+  return uniquePlanEntries(plan.filter((entry) => known.has(entry.event)));
+}
+function uniquePlanEntries(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const entry of entries) {
+    if (seen.has(entry.event)) continue;
+    seen.add(entry.event);
+    unique.push(entry);
+  }
+  return unique;
+}
+async function scanManifestEvents(repoPath, manifest) {
+  return scanEvents(repoPath, manifest.events.map((event) => event.eventType));
+}
+async function scanEvents(repoPath, eventTypes) {
+  let files = [];
+  try {
+    files = await changedFiles(repoPath, { isRepo: true });
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  if (!files.length) return /* @__PURE__ */ new Map();
+  return scanWiredEvents(repoPath, files, eventTypes);
+}
+function buildEventOutcomes(manifest, plan, wired) {
+  const byEvent = new Map(plan.map((entry) => [entry.event, entry]));
+  return manifest.events.map((event) => {
+    if (wired.has(event.eventType)) {
+      return { event: event.eventType, outcome: "wired" };
+    }
+    const entry = byEvent.get(event.eventType);
+    if (entry?.decision === "skip") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: entry.reason || "Planner skipped this event for this surface."
+      };
+    }
+    if (entry?.decision === "unsure") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: entry.reason || "Planner could not confirm a concrete anchor."
+      };
+    }
+    if (entry?.decision === "place") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: "No track() call was detected after wiring and one targeted follow-up."
+      };
+    }
+    return {
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "No placement decision was returned."
+    };
+  });
+}
+function refreshWiredOutcomes(current, manifest, wired) {
+  const byEvent = new Map(current.map((outcome) => [outcome.event, outcome]));
+  return manifest.events.map((event) => {
+    if (wired.has(event.eventType)) {
+      return { event: event.eventType, outcome: "wired" };
+    }
+    return byEvent.get(event.eventType) ?? {
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "No track() call was detected."
+    };
+  });
+}
+function tail(s, max) {
+  const trimmed = s.trim();
+  return trimmed.length > max ? trimmed.slice(-max) : trimmed;
+}
+function debugNote(message) {
+  if (process.env.WHISPERR_WIZARD_DEBUG) {
+    console.error(`[whisperr-wizard] ${message}`);
+  }
+}
+async function runTimedPass(phase, opts, phaseTimings) {
+  opts.progress?.onPhase?.(phase);
+  const started = Date.now();
+  try {
+    return await runPass(opts);
+  } finally {
+    phaseTimings.push({ phase, ms: Date.now() - started });
+  }
+}
 function isLimitStop(err) {
   const msg = err?.message ?? "";
   return /max(imum)?[\s_-]*(turn|budget)|budget.*exceeded|number of turns/i.test(msg);
 }
 async function runPass(opts) {
-  const { prompt, systemPrompt: systemPrompt9, repoPath, model, effort, maxTurns, budgetUsd, progress } = opts;
+  const {
+    prompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model,
+    effort,
+    maxTurns,
+    budgetUsd,
+    allowedTools = FULL_TOOLS,
+    progress
+  } = opts;
   let summary = "";
   let costUsd = 0;
   let ok = false;
   let maxedOut = false;
+  let lastActivityLine = "";
+  const emitActivity = (line) => {
+    if (!line || line === lastActivityLine) return;
+    lastActivityLine = line;
+    progress?.onActivity?.(line);
+  };
   const response = query({
     prompt,
     options: {
@@ -1494,8 +2671,8 @@ async function runPass(opts) {
       // defaults so the behavior is pinned regardless of SDK version.
       thinking: { type: "adaptive" },
       effort,
-      allowedTools: ["Read", "Edit", "Write", "Bash", "Glob", "Grep"],
-      permissionMode: "bypassPermissions",
+      tools: [...allowedTools],
+      canUseTool: createToolPermissionCallback(repoPath),
       maxTurns,
       // Native SDK hard cost cap. Stops this pass with an `error_max_budget_usd`
       // result once spend exceeds the remaining budget — this, not maxTurns, is
@@ -1509,9 +2686,9 @@ async function runPass(opts) {
       if (message.type === "assistant") {
         for (const block of message.message?.content ?? []) {
           if (isTextBlock(block) && block.text?.trim()) {
-            progress?.onActivity?.(firstLine(block.text));
+            emitActivity(firstLine(block.text));
           } else if (isToolUseBlock(block)) {
-            progress?.onActivity?.(describeToolUse(block));
+            emitActivity(describeToolUse(block));
           }
         }
       } else if (message.type === "result") {
@@ -1531,6 +2708,16 @@ async function runPass(opts) {
   }
   return { summary, costUsd, ok, maxedOut };
 }
+function createToolPermissionCallback(repoPath) {
+  return async (toolName, input, options) => {
+    const decision = evaluateToolUse(toolName, input, { repoPath });
+    return decision.behavior === "allow" ? { behavior: "allow", toolUseID: options.toolUseID } : {
+      behavior: "deny",
+      message: decision.message,
+      toolUseID: options.toolUseID
+    };
+  };
+}
 function applyModelAuthEnv(config, session) {
   if (config.directAnthropicKey) {
     process.env.ANTHROPIC_API_KEY = config.directAnthropicKey;
@@ -1582,102 +2769,6 @@ function short(s, max = 60) {
   return s.length > max ? `${s.slice(0, max - 1)}\u2026` : s;
 }
 
-// src/core/git.ts
-import { spawn } from "child_process";
-import { createHash } from "crypto";
-import { readFile as readFile2 } from "fs/promises";
-import { basename, join as join2 } from "path";
-async function takeCheckpoint(repoPath) {
-  const isRepo = (await run(repoPath, ["rev-parse", "--is-inside-work-tree"])).ok;
-  if (!isRepo) return { isRepo: false };
-  const branch = (await run(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim();
-  const head = await run(repoPath, ["rev-parse", "HEAD"]);
-  return {
-    isRepo: true,
-    baseRef: head.ok ? head.stdout.trim() : void 0,
-    branch: branch || void 0
-  };
-}
-async function changedFiles(repoPath, checkpoint) {
-  if (!checkpoint.isRepo) return [];
-  const tracked = await run(repoPath, ["diff", "--name-only"]);
-  const untracked = await run(repoPath, [
-    "ls-files",
-    "--others",
-    "--exclude-standard"
-  ]);
-  const set = /* @__PURE__ */ new Set();
-  for (const f of `${tracked.stdout}
-${untracked.stdout}`.split("\n")) {
-    if (f.trim()) set.add(f.trim());
-  }
-  return [...set];
-}
-function revertHint(checkpoint) {
-  if (!checkpoint.isRepo || !checkpoint.baseRef) return void 0;
-  return `git restore . && git clean -fd   (back to ${checkpoint.baseRef.slice(0, 7)})`;
-}
-async function isWorkingTreeClean(repoPath) {
-  const status = await run(repoPath, ["status", "--porcelain"]);
-  return status.ok && status.stdout.trim() === "";
-}
-async function revertToCheckpoint(repoPath, checkpoint) {
-  if (!checkpoint.isRepo) return false;
-  if (checkpoint.baseRef) {
-    const reset = await run(repoPath, ["reset", "--hard", checkpoint.baseRef]);
-    const clean2 = await run(repoPath, ["clean", "-fd"]);
-    return reset.ok && clean2.ok;
-  }
-  const restore = await run(repoPath, ["restore", "."]);
-  const clean = await run(repoPath, ["clean", "-fd"]);
-  return restore.ok && clean.ok;
-}
-async function repoFingerprint(repoPath) {
-  const remote = await run(repoPath, ["remote", "get-url", "origin"]);
-  const seed = remote.ok && remote.stdout.trim() ? normalizeRemote(remote.stdout.trim()) : `dir:${basename(repoPath)}`;
-  return createHash("sha256").update(seed).digest("hex").slice(0, 16);
-}
-function normalizeRemote(url) {
-  return url.replace(/^git@([^:]+):/, "$1/").replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
-}
-async function scanWiredEvents(repoPath, files, eventTypes) {
-  const wired = /* @__PURE__ */ new Map();
-  const patterns = eventTypes.map((e) => ({
-    eventType: e,
-    re: new RegExp(
-      `\\btrack\\s*\\(\\s*[\\s\\S]{0,160}?['"\`]${escapeRegExp(e)}['"\`]`
-    )
-  }));
-  for (const file of files) {
-    let content = "";
-    try {
-      content = await readFile2(join2(repoPath, file), "utf8");
-    } catch {
-      continue;
-    }
-    for (const { eventType, re } of patterns) {
-      if (!wired.has(eventType) && re.test(content)) {
-        wired.set(eventType, file);
-      }
-    }
-  }
-  return wired;
-}
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function run(cwd, args) {
-  return new Promise((resolve2) => {
-    const child = spawn("git", args, { cwd });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (d) => stdout += d.toString());
-    child.stderr.on("data", (d) => stderr += d.toString());
-    child.on("close", (code) => resolve2({ ok: code === 0, stdout, stderr }));
-    child.on("error", () => resolve2({ ok: false, stdout, stderr }));
-  });
-}
-
 // src/core/verify.ts
 async function pollFirstEvent(config, session, opts = {}) {
   if (config.offline) return { received: false };
@@ -1705,6 +2796,10 @@ async function pollFirstEvent(config, session, opts = {}) {
 
 // src/core/postflight.ts
 import { spawn as spawn2 } from "child_process";
+function verdictToVerified(verdict) {
+  if (verdict.toolMissing || verdict.timedOut) return null;
+  return verdict.ok;
+}
 var MAX_OUTPUT = 4e3;
 var DEFAULT_TIMEOUT_MS = 18e4;
 function runVerifyCommand(repoPath, command, opts = {}) {
@@ -1712,7 +2807,7 @@ function runVerifyCommand(repoPath, command, opts = {}) {
     return Promise.resolve({ ran: false, ok: true, output: "" });
   }
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2(command, { cwd: repoPath, shell: true, env: process.env });
     let out = "";
     const append = (d) => {
@@ -1723,36 +2818,36 @@ function runVerifyCommand(repoPath, command, opts = {}) {
     child.stderr?.on("data", append);
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve2({ ran: true, ok: false, command, output: tail(out), timedOut: true });
+      resolve3({ ran: true, ok: false, command, output: tail2(out), timedOut: true });
     }, timeoutMs);
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve2({
+      resolve3({
         ran: true,
         ok: code === 0,
         command,
         exitCode: code,
-        output: tail(out),
+        output: tail2(out),
         // 127 = "command not found": the verify tool isn't on PATH here.
         toolMissing: code === 127
       });
     });
     child.on("error", () => {
       clearTimeout(timer);
-      resolve2({ ran: true, ok: false, command, output: tail(out), toolMissing: true });
+      resolve3({ ran: true, ok: false, command, output: tail2(out), toolMissing: true });
     });
   });
 }
-function tail(s) {
+function tail2(s) {
   const t = s.trim();
   return t.length > MAX_OUTPUT ? `\u2026${t.slice(-MAX_OUTPUT)}` : t;
 }
 
 // src/core/report.ts
 async function postRunReport(config, session, report) {
-  if (config.offline) return;
+  if (config.offline) return { ok: true };
   try {
-    await fetch(`${config.apiBaseUrl}/wizard/report`, {
+    const res = await fetch(`${config.apiBaseUrl}/wizard/report`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -1760,9 +2855,30 @@ async function postRunReport(config, session, report) {
       },
       body: JSON.stringify(report)
     });
-  } catch {
+    if (res.ok) return { ok: true };
+    return {
+      ok: false,
+      status: res.status,
+      detail: await responseDetail(res)
+    };
+  } catch (err) {
+    return { ok: false, detail: detailSlice(errorMessage(err)) };
+  }
+}
+async function responseDetail(res) {
+  try {
+    return detailSlice(await res.text());
+  } catch (err) {
+    return detailSlice(errorMessage(err));
   }
 }
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function detailSlice(detail) {
+  const sliced = detail.slice(0, 200).trim();
+  return sliced || void 0;
+}
 
 // src/ui/banner.ts
 function banner() {
@@ -1781,7 +2897,7 @@ function banner() {
 
 // src/cli.ts
 async function run2(options) {
-  const repoPath = resolve(options.path ?? process.cwd());
+  const repoPath = resolve2(options.path ?? process.cwd());
   const config = resolveConfig(options);
   console.log(banner());
   p.intro(theme.signal("Let's wire Whisperr into your app."));
@@ -1859,44 +2975,99 @@ Flutter is live today; ${theme.bright(
     );
   }
   const spin = p.spinner();
+  const useIntegrationSpinner = Boolean(process.stdout.isTTY);
   let phaseLabel = "Integrating";
   let lastLine = "";
+  let lastActivityLine = "";
   const startedAt = Date.now();
-  spin.start(theme.bright(phaseLabel));
-  const tick = setInterval(() => {
+  const nextIntegrationMessage = createMessageDeduper();
+  const updateIntegrationMessage = () => {
     const secs = Math.round((Date.now() - startedAt) / 1e3);
-    spin.message(
-      theme.bright(phaseLabel) + theme.muted(` \xB7 ${secs}s`) + (lastLine ? theme.muted(` \u2014 ${lastLine}`) : "")
-    );
-  }, 1e3);
+    const message = theme.bright(phaseLabel) + theme.muted(` \xB7 ${secs}s`) + (lastLine ? theme.muted(` \u2014 ${lastLine}`) : "");
+    const next = nextIntegrationMessage(message);
+    if (next) spin.message(next);
+  };
+  if (useIntegrationSpinner) {
+    spin.start(theme.bright(phaseLabel));
+  } else {
+    p.log.step(theme.bright(phaseLabel));
+  }
+  const tick = useIntegrationSpinner ? setInterval(updateIntegrationMessage, 1e3) : void 0;
   const outcome = await runIntegrationAgent({
     repoPath,
     config,
     session,
     playbook: chosen.playbook,
     manifest,
+    ...process.stdout.isTTY && process.stdin.isTTY ? {
+      async onPlanReady(plan) {
+        if (useIntegrationSpinner) {
+          spin.stop(theme.success("Placement plan ready"));
+        }
+        p.note(renderPlacementPlan(plan), "Placement plan");
+        const placeEntries = plan.filter((entry) => entry.decision === "place");
+        let selectedEvents = placeEntries.map((entry) => entry.event);
+        if (placeEntries.length) {
+          const selection = await p.multiselect({
+            message: "Wire these events?",
+            options: placeEntries.map((entry) => ({
+              value: entry.event,
+              label: entry.event,
+              hint: `${entry.file ?? "unknown file"}@${entry.anchor ?? "unknown anchor"}`
+            })),
+            initialValues: selectedEvents,
+            required: false
+          });
+          selectedEvents = p.isCancel(selection) ? [] : selection;
+        }
+        if (useIntegrationSpinner) {
+          spin.start(theme.bright("Continuing integration"));
+        }
+        return filterEventPlan(plan, selectedEvents);
+      }
+    } : {},
     progress: {
       onPhase(label) {
         phaseLabel = label;
         lastLine = "";
+        lastActivityLine = "";
+        if (useIntegrationSpinner) {
+          updateIntegrationMessage();
+        } else {
+          p.log.step(theme.bright(label));
+        }
       },
       onActivity(line) {
+        if (line === lastActivityLine) return;
+        lastActivityLine = line;
         lastLine = line;
+        if (useIntegrationSpinner) updateIntegrationMessage();
       }
     }
   }).catch((err) => {
     p.log.error(err.message);
     return null;
   });
-  clearInterval(tick);
+  if (tick) clearInterval(tick);
   if (!outcome) {
-    spin.stop(theme.alert("Integration stopped"));
+    if (useIntegrationSpinner) {
+      spin.stop(theme.alert("Integration stopped"));
+    } else {
+      p.log.error(theme.alert("Integration stopped"));
+    }
     await maybeRevert(repoPath, checkpoint, "The run stopped before finishing.");
     return 1;
   }
   const stopLabel = !outcome.coreOk ? theme.warn("Stopped early \u2014 partial setup is in your working tree") : outcome.eventsComplete ? theme.success("Integration complete") : theme.success("Core integration done") + theme.muted(" \u2014 some events left as follow-ups");
-  spin.stop(stopLabel);
-  const files = await changedFiles(repoPath, checkpoint);
+  if (useIntegrationSpinner) {
+    spin.stop(stopLabel);
+  } else if (!outcome.coreOk) {
+    p.log.warn(stopLabel);
+  } else {
+    p.log.success(stopLabel);
+  }
+  const opportunities = await collectOpportunities(repoPath, manifest, checkpoint);
+  let files = await changedFiles(repoPath, checkpoint);
   if (files.length) {
     p.note(files.map((f) => theme.muted("\u2022 ") + f).join("\n"), "Files changed");
   }
@@ -1919,7 +3090,8 @@ Flutter is live today; ${theme.bright(
     const cmd = chosen.playbook.verifyCommand;
     const vspin = p.spinner();
     vspin.start(`Verifying the integration \u2014 ${theme.muted(cmd)}`);
-    const verdict = await runVerifyCommand(repoPath, cmd);
+    let verdict = await runVerifyCommand(repoPath, cmd);
+    verified = verdictToVerified(verdict);
     if (verdict.toolMissing) {
       vspin.stop(
         theme.warn("Couldn't verify automatically") + theme.muted(` \u2014 \`${cmd}\` isn't available here. Run it yourself before committing.`)
@@ -1929,36 +3101,142 @@ Flutter is live today; ${theme.bright(
         theme.warn(`Verification timed out \u2014 \`${cmd}\``) + theme.muted(" \u2014 run it yourself before committing.")
       );
     } else if (verdict.ok) {
-      verified = true;
       vspin.stop(theme.success("Verified \u2713") + theme.muted(` (${cmd})`));
     } else {
-      verified = false;
-      vspin.stop(theme.alert(`Verification failed \u2014 ${cmd}`));
+      const remainingBudgetUsd = config.budgetUsd - outcome.costUsd;
+      if (remainingBudgetUsd >= 0.5) {
+        vspin.stop(
+          theme.warn(`Verification failed \u2014 ${cmd}`) + theme.muted(" \u2014 attempting one repair pass")
+        );
+        const repairSpin = p.spinner();
+        repairSpin.start(`Repairing verifier failures \u2014 ${theme.muted(cmd)}`);
+        try {
+          const repair = await runRepairPass({
+            repoPath,
+            config,
+            session,
+            playbook: chosen.playbook,
+            verifyCommand: cmd,
+            verifyOutput: verdict.output.slice(-4e3),
+            budgetUsd: remainingBudgetUsd
+          });
+          outcome.costUsd += repair.costUsd;
+          if (repair.summary.trim()) {
+            outcome.summary = [outcome.summary, `Repair:
+${repair.summary}`].filter(Boolean).join("\n\n");
+            p.log.message(repair.summary.trim());
+          }
+          repairSpin.stop(theme.success("Repair pass finished"));
+        } catch (err) {
+          repairSpin.stop(
+            theme.warn("Repair pass failed") + theme.muted(` \u2014 ${err.message}`)
+          );
+        }
+        files = await changedFiles(repoPath, checkpoint);
+        const reverifySpin = p.spinner();
+        reverifySpin.start(`Re-verifying the integration \u2014 ${theme.muted(cmd)}`);
+        verdict = await runVerifyCommand(repoPath, cmd);
+        verified = verdictToVerified(verdict);
+        if (verdict.toolMissing) {
+          reverifySpin.stop(
+            theme.warn("Couldn't verify automatically") + theme.muted(` \u2014 \`${cmd}\` isn't available here. Run it yourself before committing.`)
+          );
+        } else if (verdict.timedOut) {
+          reverifySpin.stop(
+            theme.warn(`Verification timed out \u2014 \`${cmd}\``) + theme.muted(" \u2014 run it yourself before committing.")
+          );
+        } else if (verdict.ok) {
+          reverifySpin.stop(theme.success("Verified \u2713") + theme.muted(` (${cmd})`));
+        } else {
+          reverifySpin.stop(theme.alert(`Verification still failed \u2014 ${cmd}`));
+        }
+      } else {
+        vspin.stop(
+          theme.alert(`Verification failed \u2014 ${cmd}`) + theme.muted(" \u2014 skipped repair because less than $0.50 budget remains")
+        );
+      }
+      if (!verdict.ok && !verdict.toolMissing && !verdict.timedOut) {
+        if (verdict.output) {
+          p.note(verdict.output, theme.warn("Verifier output"));
+        }
+        const reverted = await maybeRevert(
+          repoPath,
+          checkpoint,
+          "The integration didn't pass its build/lint check, so the edits may be broken."
+        );
+        if (reverted) {
+          p.outro(theme.muted("Reverted \u2014 nothing was left in your working tree."));
+          return 1;
+        }
+      }
+    }
+  }
+  const { acceptedEvents, instrumentationSnapshot } = await offerOpportunities({
+    repoPath,
+    config,
+    session,
+    playbook: chosen.playbook,
+    manifest,
+    opportunities,
+    fingerprint,
+    checkpoint,
+    remainingBudgetUsd: config.budgetUsd - outcome.costUsd,
+    repoMap: outcome.repoMap
+  });
+  if (instrumentationSnapshot && chosen.playbook.verifyCommand) {
+    const cmd = chosen.playbook.verifyCommand;
+    const preInstrumentationVerified = verified;
+    const vspin = p.spinner();
+    vspin.start(`Re-verifying after instrumenting the new events \u2014 ${theme.muted(cmd)}`);
+    const verdict = await runVerifyCommand(repoPath, cmd);
+    verified = verdictToVerified(verdict);
+    if (verdict.toolMissing) {
+      vspin.stop(
+        theme.warn("Couldn't re-verify automatically") + theme.muted(` \u2014 \`${cmd}\` isn't available here. Run it yourself before committing.`)
+      );
+    } else if (verdict.timedOut) {
+      vspin.stop(
+        theme.warn(`Re-verification timed out \u2014 \`${cmd}\``) + theme.muted(" \u2014 run it yourself before committing.")
+      );
+    } else if (verdict.ok) {
+      vspin.stop(theme.success("Verified \u2713") + theme.muted(` (${cmd})`));
+    } else {
+      vspin.stop(theme.alert(`Verification failed after instrumenting the new events \u2014 ${cmd}`));
       if (verdict.output) {
         p.note(verdict.output, theme.warn("Verifier output"));
       }
-      const reverted = await maybeRevert(
-        repoPath,
-        checkpoint,
-        "The integration didn't pass its build/lint check, so the edits may be broken."
-      );
-      if (reverted) {
-        p.outro(theme.muted("Reverted \u2014 nothing was left in your working tree."));
-        return 1;
+      const doRevert = await p.confirm({
+        message: "Instrumenting the new events didn't pass the build/lint check. Revert just those edits? (The events stay in your universe \u2014 wire them on a future run.)",
+        initialValue: true
+      });
+      if (!p.isCancel(doRevert) && doRevert) {
+        if (await restoreToSnapshot(repoPath, checkpoint, instrumentationSnapshot)) {
+          verified = preInstrumentationVerified;
+          p.log.success(theme.success("Reverted the instrumentation edits."));
+        } else {
+          p.log.warn(
+            theme.warn("Couldn't revert automatically \u2014 undo manually: ") + (revertHint(checkpoint) ?? "git reset --hard")
+          );
+        }
+      } else {
+        p.log.info(
+          theme.muted("Left in your working tree \u2014 fix the verifier errors before committing.")
+        );
       }
     }
   }
-  const wiredMap = await scanWiredEvents(
-    repoPath,
-    files,
-    manifest.events.map((e) => e.eventType)
-  );
-  const reportEvents = manifest.events.map((e) => ({
-    event_type: e.eventType,
-    status: wiredMap.has(e.eventType) ? "wired" : "skipped",
-    file: wiredMap.get(e.eventType)
+  const filesForScan = acceptedEvents.length ? await changedFiles(repoPath, checkpoint) : files;
+  const eventTypesToScan = [
+    ...manifest.events.map((e) => e.eventType),
+    ...acceptedEvents.map((e) => e.code)
+  ];
+  const wiredMap = await scanWiredEvents(repoPath, filesForScan, eventTypesToScan);
+  const reportEvents = eventTypesToScan.map((eventType) => ({
+    event_type: eventType,
+    status: wiredMap.has(eventType) ? "wired" : "skipped",
+    file: wiredMap.get(eventType)
   }));
-  await postRunReport(config, session, {
+  const reportResult = await postRunReport(config, session, {
     target: chosen.playbook.target.id,
     repo_fingerprint: fingerprint,
     identify_wired: outcome.coreOk,
@@ -1968,9 +3246,23 @@ Flutter is live today; ${theme.bright(
     summary: outcome.summary.slice(0, 4e3),
     events: reportEvents
   });
+  if (!reportResult.ok) {
+    p.log.warn(
+      theme.warn("Couldn't record this run's coverage on the server") + theme.muted(
+        ` (${formatReportFailure(reportResult)}) \u2014 future runs may re-propose events already wired here.`
+      )
+    );
+  }
+  const eventLines = renderEventOutcomeLines(outcome.eventOutcomes, wiredMap);
+  if (eventLines) {
+    p.note(eventLines, "Events");
+  }
+  const eventDenominator = manifest.universeSummary?.wireableHere ?? eventTypesToScan.length;
+  const eventStatsLabel = manifest.universeSummary ? "events wired here" : "events wired";
+  const timingDetails = outcome.phaseTimings.map(({ phase, ms }) => `${shortPhaseLabel(phase)} ${formatDuration(ms)}`).join(" \xB7 ");
   p.log.info(
     theme.muted(
-      `${wiredMap.size}/${manifest.events.length} events wired \xB7 ${files.length} file${files.length === 1 ? "" : "s"} changed \xB7 ` + (verified === true ? "verified \xB7 " : verified === false ? "unverified \xB7 " : "") + `${Math.round(outcome.durationMs / 1e3)}s`
+      `${wiredMap.size}/${eventDenominator} ${eventStatsLabel} \xB7 ${files.length} file${files.length === 1 ? "" : "s"} changed \xB7 ` + (verified === true ? "verified \xB7 " : verified === false ? "unverified \xB7 " : "") + formatDuration(outcome.durationMs) + (timingDetails ? ` (${timingDetails})` : "")
     )
   );
   if (!config.offline) {
@@ -2005,6 +3297,160 @@ Flutter is live today; ${theme.bright(
   p.outro(theme.signal("\u2301 ") + theme.bright("Whisperr is wired in."));
   return 0;
 }
+var NO_ADDITIONS = { acceptedEvents: [], instrumentationSnapshot: null };
+async function offerOpportunities(opts) {
+  const { opportunities, manifest, config, session } = opts;
+  const total = opportunities.events.length + opportunities.interventions.length;
+  if (total === 0) return NO_ADDITIONS;
+  const describe = (kind, code, why) => `${theme.muted(`${kind}: `)}${theme.bright(code)}${why ? theme.muted(` \u2014 ${why}`) : ""}`;
+  p.note(
+    [
+      ...opportunities.events.map((e) => describe("event", e.code, e.rationale ?? e.description)),
+      ...opportunities.interventions.map(
+        (i) => describe("intervention", i.code, i.rationale ?? i.description)
+      )
+    ].join("\n"),
+    theme.signal("Opportunities found beyond your onboarding plan")
+  );
+  if (config.offline) {
+    p.log.info(theme.muted("Offline mode \u2014 proposals shown only, nothing submitted."));
+    return NO_ADDITIONS;
+  }
+  if (!process.stdout.isTTY || !process.stdin.isTTY) {
+    p.log.info(
+      theme.muted("Non-interactive run \u2014 proposals were not submitted. Re-run interactively to add them.")
+    );
+    return NO_ADDITIONS;
+  }
+  const selection = await p.multiselect({
+    message: "Add these to your Whisperr universe? (new interventions start paused)",
+    options: [
+      ...opportunities.events.map((e) => ({
+        value: `e:${e.code}`,
+        label: `event \xB7 ${e.code}`,
+        hint: e.description ?? e.rationale
+      })),
+      ...opportunities.interventions.map((i) => ({
+        value: `i:${i.code}`,
+        label: `intervention \xB7 ${i.code}`,
+        hint: i.description ?? i.rationale
+      }))
+    ],
+    // Opt-in per item: nothing is pre-selected, so adding to the universe is an
+    // explicit choice rather than an opt-out the user has to notice and undo.
+    initialValues: [],
+    required: false
+  });
+  if (p.isCancel(selection) || selection.length === 0) {
+    p.log.info(theme.muted("Skipped \u2014 your universe is unchanged."));
+    return NO_ADDITIONS;
+  }
+  const chosenSet = new Set(selection);
+  const knownInterventionCodes = new Set(
+    manifest.events.flatMap((e) => e.interventions ?? []).map((i) => i.code)
+  );
+  const knownEventCodes = new Set(manifest.events.map((e) => e.eventType));
+  const pickedEvents = opportunities.events.filter((e) => chosenSet.has(`e:${e.code}`));
+  const pickedInterventions = opportunities.interventions.filter(
+    (i) => chosenSet.has(`i:${i.code}`)
+  );
+  const pickedInterventionCodes = new Set(pickedInterventions.map((i) => i.code));
+  const pickedEventCodes = new Set(pickedEvents.map((e) => e.code));
+  const submitted = {
+    events: pickedEvents.map((e) => ({
+      ...e,
+      links: e.links?.filter(
+        (l) => knownInterventionCodes.has(l.interventionCode) || pickedInterventionCodes.has(l.interventionCode)
+      )
+    })),
+    interventions: pickedInterventions.map((i) => ({
+      ...i,
+      links: i.links?.filter(
+        (l) => knownEventCodes.has(l.eventCode) || pickedEventCodes.has(l.eventCode)
+      )
+    }))
+  };
+  let result;
+  try {
+    result = await withSpinner(
+      "Adding to your universe",
+      () => submitAdditions(config, session, opts.playbook.target.id, opts.fingerprint, submitted)
+    );
+  } catch (err) {
+    p.log.warn(
+      theme.warn("Couldn't add the proposals") + theme.muted(` \u2014 ${err.message}. Your universe is unchanged.`)
+    );
+    return NO_ADDITIONS;
+  }
+  const lines = result.outcomes.map((o) => {
+    const mark = o.status === "applied" ? theme.success("\u2713") : o.status === "duplicate" ? theme.muted("=") : theme.warn("\u2717");
+    const detail = o.status === "duplicate" ? theme.muted(` (already in your universe${o.duplicateOf && o.duplicateOf !== o.code ? ` as ${o.duplicateOf}` : ""})`) : o.status === "invalid" && o.reason ? theme.muted(` (${o.reason})`) : "";
+    return `${mark} ${o.kind} ${theme.bright(o.code)}${detail}`;
+  });
+  lines.push(
+    theme.muted(
+      `${result.applied} added \xB7 ${result.duplicates} already present \xB7 ${result.invalid} rejected`
+    )
+  );
+  if (submitted.interventions.length) {
+    lines.push(theme.muted("New interventions start paused \u2014 activate them in your dashboard."));
+  }
+  if (result.policyRegen?.status === "pending") {
+    lines.push(
+      theme.muted("Runtime policy update queued \u2014 the additions go live once it completes.")
+    );
+  }
+  if (result.policyRegen?.status === "draft") {
+    lines.push(
+      theme.muted(
+        "A review policy draft was queued \u2014 activate it in your dashboard once it finishes generating to take the additions live (your current live policy was left untouched)."
+      )
+    );
+  }
+  p.note(lines.join("\n"), theme.signal("Universe updated"));
+  if (result.policyRegen?.status === "failed") {
+    p.log.warn(
+      theme.warn("Live runtime NOT updated") + theme.muted(
+        " \u2014 the additions were recorded, but the runtime policy wasn't regenerated" + (result.policyRegen.reason ? `: ${result.policyRegen.reason}` : "") + ". They won't drive live decisions until the policy regenerates."
+      )
+    );
+  }
+  const appliedEventCodes = new Set(
+    result.outcomes.filter((o) => o.kind === "event" && o.status === "applied").map((o) => o.code)
+  );
+  const acceptedEvents = pickedEvents.filter((e) => appliedEventCodes.has(e.code));
+  if (!acceptedEvents.length) return NO_ADDITIONS;
+  const prePass = await snapshotChanges(opts.repoPath, opts.checkpoint);
+  const spin = p.spinner();
+  spin.start(theme.bright("Instrumenting the newly added events"));
+  try {
+    const pass = await runAdditionsInstrumentationPass({
+      repoPath: opts.repoPath,
+      config,
+      session,
+      playbook: opts.playbook,
+      acceptedEvents,
+      budgetUsd: opts.remainingBudgetUsd,
+      repoMap: opts.repoMap
+    });
+    if (pass.ran) {
+      spin.stop(theme.success("New events instrumented"));
+      if (pass.summary.trim()) p.log.message(pass.summary.trim());
+    } else {
+      spin.stop(
+        theme.warn("Skipped instrumenting the new events") + theme.muted(
+          " \u2014 the spend limit was reached. They're in your universe; wire them on a future run."
+        )
+      );
+    }
+  } catch (err) {
+    spin.stop(
+      theme.warn("Couldn't instrument the new events") + theme.muted(` \u2014 ${err.message}. They're in your universe; wire them on a future run.`)
+    );
+  }
+  const edited = !snapshotsEqual(prePass, await snapshotChanges(opts.repoPath, opts.checkpoint));
+  return { acceptedEvents, instrumentationSnapshot: edited ? prePass : null };
+}
 async function maybeRevert(repoPath, checkpoint, reason) {
   if (!checkpoint.isRepo) return false;
   const files = await changedFiles(repoPath, checkpoint);
@@ -2092,20 +3538,99 @@ async function withSpinner(label, fn) {
     throw err;
   }
 }
+function createMessageDeduper() {
+  let last = "";
+  return (message) => {
+    if (message === last) return null;
+    last = message;
+    return message;
+  };
+}
+function formatDuration(ms) {
+  const safeMs = Math.max(0, ms);
+  const totalSeconds = Math.round(safeMs / 1e3);
+  if (safeMs < 6e4) return `${totalSeconds}s`;
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = String(totalSeconds % 60).padStart(2, "0");
+  return `${minutes}m${seconds}s`;
+}
+function filterEventPlan(plan, selectedEvents) {
+  const selected = new Set(selectedEvents);
+  return plan.map(
+    (entry) => entry.decision === "place" && !selected.has(entry.event) ? { ...entry, decision: "skip", reason: "Deselected in plan review." } : entry
+  );
+}
+function renderPlacementPlan(plan) {
+  return plan.map((entry) => {
+    if (entry.decision === "place") {
+      return theme.success("\u2713 ") + entry.event + theme.muted(
+        ` \u2014 ${entry.file ?? "unknown file"} @ ${entry.anchor ?? "unknown anchor"}`
+      );
+    }
+    const reason = entry.reason || "No reason provided.";
+    const line = `${entry.decision === "skip" ? "\u25CB" : "?"} ${entry.event} \u2014 ${reason}`;
+    return entry.decision === "skip" ? theme.muted(line) : theme.warn(line);
+  }).join("\n");
+}
+function renderEventOutcomeLines(outcomes, wiredMap) {
+  const maxLines = 40;
+  const visibleCount = outcomes.length > maxLines ? maxLines - 1 : outcomes.length;
+  const lines = outcomes.slice(0, visibleCount).map((outcome) => {
+    if (outcome.outcome === "wired") {
+      const file = wiredMap.get(outcome.event);
+      return theme.success("\u2713 ") + outcome.event + (file ? theme.muted(` \u2014 ${file}`) : "");
+    }
+    return theme.muted(
+      `\u25CB ${outcome.event} \u2014 ${outcome.reason || "No track() call was detected."}`
+    );
+  });
+  const remainder = outcomes.length - visibleCount;
+  if (remainder > 0) lines.push(theme.muted(`\u2026 ${remainder} more events`));
+  return lines.join("\n");
+}
+function shortPhaseLabel(phase) {
+  switch (phase) {
+    case "Mapping your codebase":
+      return "map";
+    case "Installing the SDK & wiring identify()":
+      return "core";
+    case "Planning event placements":
+      return "plan";
+    case "Instrumenting planned events":
+    case "Instrumenting your events":
+      return "wire";
+    case "Reconciling missed events":
+      return "reconcile";
+    case "Reviewing & correcting placements":
+      return "review";
+    default:
+      return phase;
+  }
+}
 function summarizeManifest(m) {
   const events = [...m.events].sort((a, b) => (b.importance ?? 0) - (a.importance ?? 0)).map((e) => theme.muted("\u2022 ") + e.eventType);
   const channels = m.identify.channels?.length ? theme.muted(`channels: ${m.identify.channels.join(", ")}`) : "";
+  const firstLine2 = m.universeSummary ? theme.bright(`${m.universeSummary.total} events in your universe`) + theme.muted(
+    ` \u2014 ${m.universeSummary.wireableHere} wireable here \xB7 ${m.universeSummary.derived} computed by Whisperr from your raw events \xB7 ${m.universeSummary.otherSurface} live on other surfaces`
+  ) : theme.bright("identify()") + theme.muted(" + ") + theme.bright(`${m.events.length} events`);
   return [
-    theme.bright("identify()") + theme.muted(" + ") + theme.bright(`${m.events.length} events`),
+    firstLine2,
     ...events,
     channels
   ].filter(Boolean).join("\n");
 }
+function formatReportFailure(result) {
+  const detail = result.detail?.replace(/\s+/g, " ").trim();
+  if (result.status !== void 0) {
+    return `HTTP ${result.status}${detail ? `: ${detail}` : ""}`;
+  }
+  return detail || "request failed";
+}
 
 // src/index.ts
 var modulePath = fileURLToPath(import.meta.url);
 function packageVersion() {
-  const packagePath = join3(dirname(modulePath), "..", "package.json");
+  const packagePath = join4(dirname2(modulePath), "..", "package.json");
   const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
   return pkg.version ?? "0.0.0";
 }