@whisperr/wizard 0.2.1 → 0.3.1

package/dist/index.js

@@ -6,12 +6,13 @@ import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/cli.ts
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 import * as p from "@clack/prompts";
 
 // src/core/config.ts
 var DEFAULT_API_BASE = "https://api.whisperr.net";
 var DEFAULT_MODEL = "claude-sonnet-5";
+var DEFAULT_PLANNER_MODEL = "claude-opus-4-8";
 var DEFAULT_EFFORT = "high";
 var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 function resolveEffort() {
@@ -29,6 +30,7 @@ function resolveConfig(flags = {}) {
     apiBaseUrl,
     llmBaseUrl,
     model: flags.model ?? process.env.WHISPERR_WIZARD_MODEL ?? DEFAULT_MODEL,
+    plannerModel: process.env.WHISPERR_WIZARD_PLANNER_MODEL ?? DEFAULT_PLANNER_MODEL,
     effort: resolveEffort(),
     // Cost is the real limiter (budgetUsd below). maxTurns is only a high safety
     // backstop against a stuck loop — it should NOT bind on a normal run. (It
@@ -36,7 +38,7 @@ function resolveConfig(flags = {}) {
     maxTurns: Number(process.env.WHISPERR_WIZARD_MAX_TURNS) || 200,
     // Hard ceiling on TOTAL spend across all phases. If hit, the run stops
     // cleanly and keeps whatever already landed. Real runs finish well under it.
-    budgetUsd: Number(process.env.WHISPERR_WIZARD_BUDGET_USD) || 10,
+    budgetUsd: Number(process.env.WHISPERR_WIZARD_BUDGET_USD) || 25,
     directAnthropicKey,
     offline
   };
@@ -1146,11 +1148,9 @@ function mockManifest(appId, config) {
 }
 
 // src/core/agent.ts
-import { query } from "@anthropic-ai/claude-agent-sdk";
-
-// src/core/opportunities.ts
-import { readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join3 } from "path";
+import {
+  query
+} from "@anthropic-ai/claude-agent-sdk";
 
 // src/core/git.ts
 import { spawn } from "child_process";
@@ -1277,41 +1277,58 @@ async function scanWiredEvents(repoPath, files, eventTypes) {
   const wired = /* @__PURE__ */ new Map();
   const patterns = eventTypes.map((e) => ({
     eventType: e,
-    re: new RegExp(
+    trackRe: new RegExp(
       `\\btrack\\s*\\(\\s*[\\s\\S]{0,160}?['"\`]${escapeRegExp(e)}['"\`]`
-    )
+    ),
+    literalRe: quotedLiteralRegExp(e)
   }));
+  const contents = [];
   for (const file of files) {
-    let content = "";
     try {
-      content = await readFile2(join2(repoPath, file), "utf8");
+      contents.push({ file, content: await readFile2(join2(repoPath, file), "utf8") });
     } catch {
       continue;
     }
-    for (const { eventType, re } of patterns) {
-      if (!wired.has(eventType) && re.test(content)) {
+  }
+  for (const { file, content } of contents) {
+    for (const { eventType, trackRe } of patterns) {
+      if (!wired.has(eventType) && trackRe.test(content)) {
+        wired.set(eventType, file);
+      }
+    }
+  }
+  for (const { file, content } of contents) {
+    for (const { eventType, literalRe } of patterns) {
+      if (!wired.has(eventType) && literalRe.test(content)) {
         wired.set(eventType, file);
       }
     }
   }
   return wired;
 }
+function quotedLiteralRegExp(eventType) {
+  const leftBoundary = /^\w/.test(eventType) ? "\\b" : "";
+  const rightBoundary = /\w$/.test(eventType) ? "\\b" : "";
+  return new RegExp(`(['"\`])${leftBoundary}${escapeRegExp(eventType)}${rightBoundary}\\1`);
+}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function run(cwd, args) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn("git", args, { cwd });
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (d) => stdout += d.toString());
     child.stderr.on("data", (d) => stderr += d.toString());
-    child.on("close", (code) => resolve2({ ok: code === 0, stdout, stderr }));
-    child.on("error", () => resolve2({ ok: false, stdout, stderr }));
+    child.on("close", (code) => resolve3({ ok: code === 0, stdout, stderr }));
+    child.on("error", () => resolve3({ ok: false, stdout, stderr }));
   });
 }
 
 // src/core/opportunities.ts
+import { readFile as readFile3, rm as rm2 } from "fs/promises";
+import { join as join3 } from "path";
 var OPPORTUNITIES_FILE = "whisperr-opportunities.json";
 function normalizeCode(value) {
   return value.trim().toLowerCase().replace(/[ \-./]/g, "_").replace(/[^a-z0-9_]/g, "").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
@@ -1342,9 +1359,10 @@ function sanitizeOpportunities(raw, manifest) {
   if (typeof raw !== "object" || raw === null) return out;
   const doc = raw;
   const knownEvents = new Set(manifest.events.map((e) => normalizeCode(e.eventType)));
-  const knownInterventions = new Set(
-    manifest.events.flatMap((e) => e.interventions ?? []).map((i) => normalizeCode(i.code))
-  );
+  const knownInterventions = /* @__PURE__ */ new Set([
+    ...manifest.events.flatMap((e) => e.interventions ?? []).map((i) => normalizeCode(i.code)),
+    ...(manifest.interventions ?? []).map((i) => normalizeCode(i.code))
+  ]);
   const seenEvents = /* @__PURE__ */ new Set();
   for (const entry of asArray(doc.events)) {
     const ev = coerceEvent(entry);
@@ -1710,15 +1728,344 @@ function coverageNote(coverage) {
   return "";
 }
 
+// src/core/toolPolicy.ts
+import { isAbsolute, relative, resolve } from "path";
+var SECRET_MATERIAL_DENIAL = "blocked: secret material - reference the variable name in .env.example instead of reading the real file";
+var WRITE_OUTSIDE_REPO_DENIAL = "blocked: writes must stay inside the target repository";
+var SENSITIVE_WRITE_DENIAL = "blocked: refusing to write CI/git configuration";
+var BASH_ALLOWLIST_DENIAL = "blocked: command is outside the Bash allowlist - use package install/add commands, mkdir, or git status/diff/log only";
+var CHAINED_COMMAND_DENIAL = "blocked: chained or substituted shell command - run one command at a time";
+var ENV_EXAMPLES = /* @__PURE__ */ new Set([".env.example", ".env.sample", ".env.template"]);
+var SECRET_DIRECTORIES = /* @__PURE__ */ new Set([".aws", ".ssh", ".gnupg"]);
+var SECRET_EXACT_FILES = /* @__PURE__ */ new Set([".netrc", ".npmrc", ".pypirc"]);
+var SENSITIVE_WRITE_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".circleci", ".buildkite"]);
+var SENSITIVE_WRITE_EXACT_FILES = /* @__PURE__ */ new Set([
+  ".gitlab-ci.yml",
+  "azure-pipelines.yml",
+  "bitbucket-pipelines.yml",
+  ".drone.yml",
+  "jenkinsfile"
+]);
+var SECRET_SUFFIXES = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".keystore",
+  ".tfvars"
+];
+var JS_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun"]);
+var PYTHON_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["pip", "pip3", "poetry", "uv"]);
+var RUBY_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["gem", "bundle"]);
+function evaluateToolUse(toolName, input, context) {
+  switch (toolName) {
+    case "Read":
+      return evaluateReadLike(readPathInputs(input), readPathInputs(input), context);
+    case "Grep":
+      return evaluateReadLike(grepGlobPathInputs(input), grepPathInputs(input), context);
+    case "Glob":
+      return evaluateReadLike(grepGlobPathInputs(input), grepGlobPathInputs(input), context);
+    case "Bash":
+      return evaluateBash(input);
+    case "Write":
+    case "Edit":
+      return evaluateWrite(input, context);
+    default:
+      return {
+        behavior: "deny",
+        message: `blocked: tool ${toolName} is not allowed by the wizard tool policy`
+      };
+  }
+}
+function isSecretPathLike(value) {
+  const parts = normalizePathLike(value).split("/").filter(Boolean);
+  for (const rawPart of parts) {
+    const part = stripOuterQuotes(rawPart.trim().toLowerCase());
+    if (!part || part === "." || part === "**") continue;
+    if (ENV_EXAMPLES.has(part)) continue;
+    if (SECRET_DIRECTORIES.has(part)) return true;
+    if (SECRET_EXACT_FILES.has(part)) return true;
+    if (part === ".env" || part === ".envrc" || part.startsWith(".env.") || part.startsWith(".env*")) {
+      return true;
+    }
+    if (part.startsWith("id_rsa") || part.startsWith("id_ecdsa") || part.startsWith("id_ed25519")) {
+      return true;
+    }
+    if (part.includes("credentials")) return true;
+    if (part.startsWith("secrets.")) return true;
+    if (SECRET_SUFFIXES.some((suffix) => part.endsWith(suffix))) return true;
+  }
+  return false;
+}
+function isPathInsideRepo(pathValue, repoPath) {
+  if (pathValue.includes("..")) return false;
+  const repoRoot = resolve(repoPath);
+  const candidate = isAbsolute(pathValue) ? resolve(pathValue) : resolve(repoRoot, pathValue);
+  const rel = relative(repoRoot, candidate);
+  return rel === "" || !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function evaluateReadLike(secretValues, repoPathValues, context) {
+  for (const value of secretValues) {
+    if (isSecretPathLike(value)) {
+      return { behavior: "deny", message: SECRET_MATERIAL_DENIAL };
+    }
+  }
+  for (const value of repoPathValues) {
+    if (!isPathInsideRepo(value, context.repoPath)) {
+      return {
+        behavior: "deny",
+        message: "blocked: reads must stay inside the target repository"
+      };
+    }
+  }
+  return { behavior: "allow" };
+}
+function evaluateWrite(input, context) {
+  const pathValue = firstString(input, ["file_path", "path"]);
+  if (!pathValue) {
+    return { behavior: "deny", message: "blocked: write target path is missing" };
+  }
+  if (!isPathInsideRepo(pathValue, context.repoPath)) {
+    return { behavior: "deny", message: WRITE_OUTSIDE_REPO_DENIAL };
+  }
+  if (isSensitiveWritePath(pathValue, context.repoPath)) {
+    return { behavior: "deny", message: SENSITIVE_WRITE_DENIAL };
+  }
+  return { behavior: "allow" };
+}
+function evaluateBash(input) {
+  const command = firstString(input, ["command"]);
+  if (!command) {
+    return { behavior: "deny", message: "blocked: Bash command is missing" };
+  }
+  const split = splitShellSegments(command);
+  if (split.hasCommandSubstitution) {
+    return { behavior: "deny", message: CHAINED_COMMAND_DENIAL };
+  }
+  const segmentDecisions = split.segments.map(evaluateBashSegment);
+  const denied = segmentDecisions.find((decision) => decision.behavior === "deny");
+  if (denied) {
+    return split.hadChain ? { behavior: "deny", message: CHAINED_COMMAND_DENIAL } : denied;
+  }
+  return { behavior: "allow" };
+}
+function evaluateBashSegment(segment) {
+  const tokens = tokenizeShellSegment(segment);
+  if (!tokens.length) return { behavior: "deny", message: BASH_ALLOWLIST_DENIAL };
+  const command = tokens[0]?.toLowerCase() ?? "";
+  const second = tokens[1]?.toLowerCase() ?? "";
+  const third = tokens[2]?.toLowerCase() ?? "";
+  if (JS_PACKAGE_MANAGERS.has(command)) {
+    if (second === "install" || second === "add" || second === "ci") {
+      return { behavior: "allow" };
+    }
+    if (second === "pkg" && (third === "get" || third === "set")) {
+      return { behavior: "allow" };
+    }
+  }
+  if (PYTHON_PACKAGE_MANAGERS.has(command)) {
+    if (second === "install" || second === "add") {
+      return { behavior: "allow" };
+    }
+    if (command === "uv" && second === "pip" && third === "install") {
+      return { behavior: "allow" };
+    }
+  }
+  if (command === "composer" && (second === "install" || second === "require")) {
+    return { behavior: "allow" };
+  }
+  if (command === "pod" && second === "install") {
+    return { behavior: "allow" };
+  }
+  if ((command === "flutter" || command === "dart") && second === "pub") {
+    return { behavior: "allow" };
+  }
+  if (RUBY_PACKAGE_MANAGERS.has(command) && (second === "install" || second === "add")) {
+    return { behavior: "allow" };
+  }
+  if (command === "go" && (second === "get" || second === "mod")) {
+    return { behavior: "allow" };
+  }
+  if (command === "mkdir") {
+    return { behavior: "allow" };
+  }
+  if (command === "git" && (second === "status" || second === "diff" || second === "log")) {
+    if (tokens.slice(2).some((token) => isSecretPathLike(token))) {
+      return { behavior: "deny", message: SECRET_MATERIAL_DENIAL };
+    }
+    return { behavior: "allow" };
+  }
+  return { behavior: "deny", message: BASH_ALLOWLIST_DENIAL };
+}
+function readPathInputs(input) {
+  return stringInputs(input, ["file_path", "path"]);
+}
+function grepGlobPathInputs(input) {
+  return stringInputs(input, ["file_path", "path", "pattern", "glob"]);
+}
+function grepPathInputs(input) {
+  return stringInputs(input, ["file_path", "path"]);
+}
+function stringInputs(input, keys) {
+  const values = [];
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) values.push(value.trim());
+  }
+  return values;
+}
+function firstString(input, keys) {
+  return stringInputs(input, keys)[0];
+}
+function normalizePathLike(value) {
+  return stripOuterQuotes(value.trim()).replace(/\\/g, "/");
+}
+function repoRelativePath(pathValue, repoPath) {
+  const repoRoot = resolve(repoPath);
+  const candidate = isAbsolute(pathValue) ? resolve(pathValue) : resolve(repoRoot, pathValue);
+  return normalizePathLike(relative(repoRoot, candidate));
+}
+function isSensitiveWritePath(pathValue, repoPath) {
+  const parts = repoRelativePath(pathValue, repoPath).split("/").map((part) => stripOuterQuotes(part.trim().toLowerCase())).filter(Boolean);
+  const [first, second] = parts;
+  if (!first) return false;
+  if (SENSITIVE_WRITE_DIRECTORIES.has(first)) return true;
+  if (first === ".github" && second === "workflows") return true;
+  return parts.length === 1 && SENSITIVE_WRITE_EXACT_FILES.has(first);
+}
+function stripOuterQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function splitShellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  let hadChain = false;
+  let hasCommandSubstitution = false;
+  const push = () => {
+    const segment = current.trim();
+    if (segment) segments.push(segment);
+    current = "";
+  };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    const next = command[i + 1];
+    if (ch === "`" || ch === "$" && next === "(") {
+      hasCommandSubstitution = true;
+    }
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "'") {
+      current += ch;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = void 0;
+      current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    const two = `${ch}${next ?? ""}`;
+    if (two === "&&" || two === "||") {
+      hadChain = true;
+      push();
+      i++;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "\n") {
+      hadChain = true;
+      push();
+      continue;
+    }
+    current += ch;
+  }
+  push();
+  return { segments, hadChain, hasCommandSubstitution };
+}
+function tokenizeShellSegment(segment) {
+  const tokens = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  const push = () => {
+    if (current) tokens.push(current);
+    current = "";
+  };
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = void 0;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      push();
+      continue;
+    }
+    current += ch;
+  }
+  push();
+  return tokens;
+}
+
 // src/core/agent.ts
 async function runIntegrationAgent(opts) {
-  const { repoPath, config, session, playbook, manifest, progress } = opts;
+  const { repoPath, config, session, playbook, manifest, progress, onPlanReady } = opts;
   applyModelAuthEnv(config, session);
   const systemPrompt9 = [BASE_WIZARD_PROMPT, playbook.systemPrompt].join("\n\n");
   const started = Date.now();
   let costUsd = 0;
   const summaries = [];
-  progress?.onPhase?.("Installing the SDK & wiring identify()");
+  let repoMap = "";
+  let eventOutcomes = [];
+  const phaseTimings = [];
+  const BUDGET_FLOOR = 0.25;
+  if (config.budgetUsd - costUsd > BUDGET_FLOOR) {
+    try {
+      const map = await runTimedPass("Mapping your codebase", {
+        prompt: renderRepoMapPrompt(repoPath),
+        systemPrompt: systemPrompt9,
+        repoPath,
+        model: config.plannerModel,
+        effort: "high",
+        maxTurns: 40,
+        budgetUsd: Math.min(config.budgetUsd - costUsd, config.budgetUsd * 0.15),
+        allowedTools: READ_ONLY_TOOLS,
+        progress
+      }, phaseTimings);
+      costUsd += map.costUsd;
+      repoMap = sliceRepoMap(map.summary);
+    } catch (err) {
+      debugNote(`repo map pass failed: ${err.message}`);
+      repoMap = "";
+    }
+  }
   const corePrompt = [
     `Integrate the Whisperr ${playbook.target.displayName} SDK \u2014 CORE SETUP ONLY.`,
     `Project root: ${repoPath}`,
@@ -1743,11 +2090,12 @@ async function runIntegrationAgent(opts) {
     "Do NOT instrument product events yet \u2014 that is a separate step. Do not run",
     "the analyzer or build; the human will review the diff.",
     "",
+    ...renderRepoMapSection(repoMap),
     "----- IDENTIFY -----",
     renderIdentifyBrief(manifest),
     "----- END -----"
   ].join("\n");
-  const core = await runPass({
+  const core = await runTimedPass("Installing the SDK & wiring identify()", {
     prompt: corePrompt,
     systemPrompt: systemPrompt9,
     repoPath,
@@ -1756,58 +2104,111 @@ async function runIntegrationAgent(opts) {
     maxTurns: 50,
     budgetUsd: config.budgetUsd - costUsd,
     progress
-  });
+  }, phaseTimings);
   costUsd += core.costUsd;
   if (core.summary) summaries.push(`Core setup:
 ${core.summary}`);
-  const BUDGET_FLOOR = 0.25;
   let eventsComplete = true;
   if (manifest.events.length > 0 && config.budgetUsd - costUsd <= BUDGET_FLOOR) {
     eventsComplete = false;
+    eventOutcomes = manifest.events.map((event) => ({
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "Spend limit reached during core setup."
+    }));
     summaries.push(
       "Events: skipped \u2014 the spend limit was reached during core setup. Re-run with a higher WHISPERR_WIZARD_BUDGET_USD to instrument events."
     );
   } else if (manifest.events.length > 0) {
-    progress?.onPhase?.("Instrumenting your events");
-    const eventsPrompt = [
-      `The Whisperr ${playbook.target.displayName} SDK is already installed and`,
-      "initialized, and identify() is wired. Now instrument the product events",
-      "below with track().",
-      "",
-      "Work in importance order. Place each event at the real call site where the",
-      "END USER performs the action (not an admin/staff path \u2014 see WHO COUNTS AS",
-      `"THE USER"), and attach the properties you can source from what's in scope`,
-      "there (see the property-capture rule). These events describe the same",
-      "person identify() did, so they live on the same end-user surface. Skip fast",
-      "when an event has no clear trigger here \u2014 spend steps placing, not exploring.",
-      "Stop once the events that clearly exist in this app are wired.",
-      "",
-      "----- EVENTS -----",
-      renderEventsBrief(manifest),
-      "----- END -----"
-    ].join("\n");
-    const events = await runPass({
-      prompt: eventsPrompt,
+    const planPass = await runTimedPass("Planning event placements", {
+      prompt: renderEventPlanPrompt(repoPath, playbook, manifest, repoMap),
       systemPrompt: systemPrompt9,
       repoPath,
-      model: config.model,
-      effort: config.effort,
-      maxTurns: config.maxTurns,
+      model: config.plannerModel,
+      effort: "high",
+      maxTurns: 40,
       budgetUsd: config.budgetUsd - costUsd,
+      allowedTools: READ_ONLY_TOOLS,
       progress
-    });
-    costUsd += events.costUsd;
-    eventsComplete = !events.maxedOut;
-    if (events.summary) summaries.push(`Events:
-${events.summary}`);
+    }, phaseTimings);
+    costUsd += planPass.costUsd;
+    const plan = parseEventPlan(planPass.summary);
+    if (!plan) {
+      debugNote("event plan parse failed; falling back to direct event wiring");
+      progress?.onActivity?.("Event plan was not parseable; falling back to direct wiring");
+      const direct = await runDirectEventsPass({
+        repoPath,
+        config,
+        systemPrompt: systemPrompt9,
+        playbook,
+        manifest,
+        repoMap,
+        budgetUsd: config.budgetUsd - costUsd,
+        progress,
+        phaseTimings
+      });
+      costUsd += direct.pass.costUsd;
+      eventsComplete = !direct.pass.maxedOut;
+      eventOutcomes = direct.eventOutcomes;
+      if (direct.pass.summary) summaries.push(`Events:
+${direct.pass.summary}`);
+    } else {
+      let scopedPlan = planForManifest(plan, manifest);
+      const reviewedPlan = await onPlanReady?.(scopedPlan);
+      if (reviewedPlan !== void 0 && reviewedPlan !== null) {
+        scopedPlan = planForManifest(reviewedPlan, manifest);
+      }
+      const placeEntries = scopedPlan.filter((entry) => entry.decision === "place");
+      const unsureEntries = scopedPlan.filter((entry) => entry.decision === "unsure");
+      let wire;
+      if (placeEntries.length && config.budgetUsd - costUsd > BUDGET_FLOOR) {
+        wire = await runTimedPass("Instrumenting planned events", {
+          prompt: renderEventWirePrompt(repoPath, playbook, repoMap, placeEntries),
+          systemPrompt: systemPrompt9,
+          repoPath,
+          model: config.model,
+          effort: "high",
+          maxTurns: config.maxTurns,
+          budgetUsd: config.budgetUsd - costUsd,
+          progress
+        }, phaseTimings);
+        costUsd += wire.costUsd;
+        if (wire.summary) summaries.push(`Events:
+${wire.summary}`);
+      } else if (!placeEntries.length) {
+        summaries.push("Events: no events had a confident placement in this surface.");
+      }
+      let wired = await scanManifestEvents(repoPath, manifest);
+      const missedPlaceEntries = placeEntries.filter((entry) => !wired.has(entry.event));
+      const followUpEntries = uniquePlanEntries([...missedPlaceEntries, ...unsureEntries]);
+      let followUp;
+      if (followUpEntries.length && config.budgetUsd - costUsd > BUDGET_FLOOR) {
+        followUp = await runTimedPass("Reconciling missed events", {
+          prompt: renderEventReconcilePrompt(repoPath, playbook, repoMap, followUpEntries),
+          systemPrompt: systemPrompt9,
+          repoPath,
+          model: config.plannerModel,
+          effort: "medium",
+          maxTurns: 15,
+          budgetUsd: config.budgetUsd - costUsd,
+          progress
+        }, phaseTimings);
+        costUsd += followUp.costUsd;
+        if (followUp.summary) summaries.push(`Event reconciliation:
+${followUp.summary}`);
+        wired = await scanManifestEvents(repoPath, manifest);
+      }
+      eventOutcomes = buildEventOutcomes(manifest, scopedPlan, wired);
+      eventsComplete = !planPass.maxedOut && !(wire?.maxedOut ?? false) && !(followUp?.maxedOut ?? false);
+    }
   }
   if (core.ok && config.budgetUsd - costUsd > BUDGET_FLOOR) {
-    progress?.onPhase?.("Reviewing & correcting placements");
     const reviewPrompt = [
       `You wired the Whisperr ${playbook.target.displayName} SDK into this repo.`,
       "Now AUDIT YOUR OWN WORK and fix mistakes before finishing.",
       `Project root: ${repoPath}`,
       "",
+      ...renderRepoMapSection(repoMap),
       "Run `git diff` and read the surrounding code to see exactly what you added.",
       "For every identify() and track() call, verify \u2014 and FIX in place:",
       "1. Subject \u2014 keys to the END USER, never an admin/staff/operator/seller.",
@@ -1830,30 +2231,40 @@ ${events.summary}`);
       "End with a one-line, plain-text note of what you corrected (or 'No",
       "corrections needed.'), plus one line on what you proposed, if anything."
     ].join("\n");
-    const review = await runPass({
+    const review = await runTimedPass("Reviewing & correcting placements", {
       prompt: reviewPrompt,
       systemPrompt: systemPrompt9,
       repoPath,
-      model: config.model,
-      effort: config.effort,
+      model: config.plannerModel,
+      effort: "medium",
       maxTurns: 40,
       budgetUsd: config.budgetUsd - costUsd,
       progress
-    });
+    }, phaseTimings);
     costUsd += review.costUsd;
     if (review.summary) summaries.push(`Review:
 ${review.summary}`);
+    if (manifest.events.length) {
+      eventOutcomes = refreshWiredOutcomes(
+        eventOutcomes,
+        manifest,
+        await scanManifestEvents(repoPath, manifest)
+      );
+    }
   }
   return {
     summary: summaries.join("\n\n"),
     costUsd,
     durationMs: Date.now() - started,
+    phaseTimings,
     coreOk: core.ok,
-    eventsComplete
+    eventsComplete,
+    eventOutcomes,
+    repoMap: repoMap || void 0
   };
 }
 async function runAdditionsInstrumentationPass(opts) {
-  const { repoPath, config, session, playbook, acceptedEvents, budgetUsd, progress } = opts;
+  const { repoPath, config, session, playbook, acceptedEvents, budgetUsd, repoMap, progress } = opts;
   if (!acceptedEvents.length || budgetUsd <= 0) {
     return { summary: "", costUsd: 0, ran: false };
   }
@@ -1882,6 +2293,7 @@ async function runAdditionsInstrumentationPass(opts) {
     "a clear trigger after all. The SDK is already installed and initialized.",
     `Project root: ${repoPath}`,
     "",
+    ...renderRepoMapSection(repoMap),
     "----- APPROVED NEW EVENTS -----",
     ...eventLines,
     "",
@@ -1899,16 +2311,382 @@ async function runAdditionsInstrumentationPass(opts) {
   });
   return { summary: pass.summary, costUsd: pass.costUsd, ran: true };
 }
+async function runRepairPass(opts) {
+  const {
+    repoPath,
+    config,
+    session,
+    playbook,
+    verifyCommand,
+    verifyOutput,
+    budgetUsd,
+    progress
+  } = opts;
+  if (budgetUsd <= 0) return { summary: "", costUsd: 0, ran: false };
+  applyModelAuthEnv(config, session);
+  const systemPrompt9 = [BASE_WIZARD_PROMPT, playbook.systemPrompt].join("\n\n");
+  progress?.onPhase?.("Repairing verifier failures");
+  const prompt = [
+    "The Whisperr integration was applied, but the verifier command failed.",
+    `Project root: ${repoPath}`,
+    "",
+    "Verifier command:",
+    verifyCommand,
+    "",
+    "Verifier output tail:",
+    tail(verifyOutput, 4e3) || "(no output)",
+    "",
+    "Fix ONLY what the verifier reports; do not refactor. Keep the existing",
+    "Whisperr placement intent unless a verifier error directly requires a small",
+    "syntax/import/type correction. Do not explore unrelated code."
+  ].join("\n");
+  const pass = await runPass({
+    prompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model: config.model,
+    effort: "high",
+    maxTurns: 20,
+    budgetUsd,
+    progress
+  });
+  return { summary: pass.summary, costUsd: pass.costUsd, ran: true };
+}
+var READ_ONLY_TOOLS = ["Read", "Glob", "Grep"];
+var FULL_TOOLS = ["Read", "Edit", "Write", "Bash", "Glob", "Grep"];
+function parseEventPlan(text) {
+  const parsed = parseFirstJsonArray(text);
+  if (!Array.isArray(parsed)) return null;
+  const entries = [];
+  for (const item of parsed) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+    const obj = item;
+    const event = typeof obj.event === "string" ? obj.event.trim() : "";
+    const decision = obj.decision;
+    if (!event || decision !== "place" && decision !== "skip" && decision !== "unsure") {
+      return null;
+    }
+    const entry = {
+      event,
+      decision,
+      reason: typeof obj.reason === "string" ? obj.reason.trim() : ""
+    };
+    if (typeof obj.file === "string" && obj.file.trim()) {
+      entry.file = obj.file.trim();
+    }
+    if (typeof obj.anchor === "string" && obj.anchor.trim()) {
+      entry.anchor = obj.anchor.trim();
+    }
+    if (Array.isArray(obj.properties)) {
+      entry.properties = obj.properties.filter((prop) => typeof prop === "string" && !!prop.trim()).map((prop) => prop.trim());
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+function parseFirstJsonArray(text) {
+  const start = text.indexOf("[");
+  if (start < 0) return null;
+  const json = sliceJsonArray(text, start);
+  if (!json) return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function sliceJsonArray(text, start) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "[") {
+      depth++;
+    } else if (ch === "]") {
+      depth--;
+      if (depth === 0) return text.slice(start, i + 1);
+    }
+  }
+  return null;
+}
+function renderRepoMapPrompt(repoPath) {
+  return [
+    "Map this repository for a Whisperr SDK integration. This is READ-ONLY.",
+    `Project root: ${repoPath}`,
+    "",
+    "Produce a concise structured repo map as final text with these exact sections:",
+    "- framework + entry points",
+    "- auth flows enumerated: END-USER vs admin/staff, with precise file paths",
+    "- billing/payment/webhook surfaces",
+    "- analytics/tracking wrapper if any",
+    "- state management",
+    "- directory guide: which dirs hold pages/controllers/services",
+    "",
+    "This map guides event placement. List file paths precisely. No prose beyond the map."
+  ].join("\n");
+}
+function sliceRepoMap(map) {
+  return map.trim().slice(0, 8e3);
+}
+function renderRepoMapSection(repoMap) {
+  const map = repoMap?.trim();
+  if (!map) return [];
+  return ["----- REPO MAP -----", map, "----- END REPO MAP -----", ""];
+}
+function renderEventPlanPrompt(repoPath, playbook, manifest, repoMap) {
+  return [
+    `Plan Whisperr ${playbook.target.displayName} event placements. This is READ-ONLY.`,
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "Use the repo map and the events brief to decide where each event belongs.",
+    "Return ONLY a JSON code block containing an array with this shape:",
+    '[{"event":"event_name","decision":"place|skip|unsure","file":"path","anchor":"function/route/handler","properties":["prop"],"reason":"short reason"}]',
+    "",
+    "Rules:",
+    "- decision=place only when there is a concrete end-user call site in this repo.",
+    "- decision=skip when the event clearly lives on another surface or does not exist here.",
+    "- decision=unsure when there is a plausible surface but the exact anchor is not proven.",
+    "- For place decisions, include file and anchor precisely.",
+    "- properties should list only properties likely available at that anchor.",
+    "- No prose beyond the JSON code block.",
+    "",
+    "----- EVENTS -----",
+    renderEventsBrief(manifest),
+    "----- END EVENTS -----"
+  ].join("\n");
+}
+function renderEventWirePrompt(repoPath, playbook, repoMap, entries) {
+  return [
+    `The Whisperr ${playbook.target.displayName} SDK is installed and initialized.`,
+    "Wire only the planned event placements below with track().",
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "For each: open the file, find the anchor, add track() with the listed",
+    "properties. If an anchor is genuinely absent, mark it unsure in your",
+    "summary and move on. Do not re-plan skipped or unsure events in this pass.",
+    "",
+    "----- EVENT WIRING PLAN -----",
+    ...renderPlanEntryLines(entries),
+    "----- END EVENT WIRING PLAN -----"
+  ].join("\n");
+}
+function renderEventReconcilePrompt(repoPath, playbook, repoMap, entries) {
+  return [
+    `One targeted follow-up for Whisperr ${playbook.target.displayName} events.`,
+    `Project root: ${repoPath}`,
+    "",
+    ...renderRepoMapSection(repoMap),
+    "The events below were either planned for placement but not detected in the",
+    "changed files, or were marked unsure. For each one, make one focused attempt",
+    "at the listed file/anchor. If the anchor is absent or still not clear, skip",
+    "it and say why in the summary. Do not search broadly or refactor.",
+    "",
+    "----- TARGET EVENTS -----",
+    ...renderPlanEntryLines(entries),
+    "----- END TARGET EVENTS -----"
+  ].join("\n");
+}
+function renderPlanEntryLines(entries) {
+  const lines = [];
+  for (const entry of entries) {
+    lines.push("");
+    lines.push(`- event: ${entry.event}`);
+    lines.push(`  decision: ${entry.decision}`);
+    if (entry.file) lines.push(`  file: ${entry.file}`);
+    if (entry.anchor) lines.push(`  anchor: ${entry.anchor}`);
+    if (entry.properties?.length) {
+      lines.push(`  properties: ${entry.properties.join(", ")}`);
+    }
+    if (entry.reason) lines.push(`  reason: ${entry.reason}`);
+  }
+  return lines;
+}
+async function runDirectEventsPass(opts) {
+  const {
+    repoPath,
+    config,
+    systemPrompt: systemPrompt9,
+    playbook,
+    manifest,
+    repoMap,
+    budgetUsd,
+    progress,
+    phaseTimings
+  } = opts;
+  const eventsPrompt = [
+    `The Whisperr ${playbook.target.displayName} SDK is already installed and`,
+    "initialized, and identify() is wired. Now instrument the product events",
+    "below with track().",
+    "",
+    ...renderRepoMapSection(repoMap),
+    "Work in importance order. Place each event at the real call site where the",
+    "END USER performs the action (not an admin/staff path \u2014 see WHO COUNTS AS",
+    `"THE USER"), and attach the properties you can source from what's in scope`,
+    "there (see the property-capture rule). These events describe the same",
+    "person identify() did, so they live on the same end-user surface. Skip fast",
+    "when an event has no clear trigger here \u2014 spend steps placing, not exploring.",
+    "Stop once the events that clearly exist in this app are wired.",
+    "",
+    "----- EVENTS -----",
+    renderEventsBrief(manifest),
+    "----- END -----"
+  ].join("\n");
+  const pass = await runTimedPass("Instrumenting your events", {
+    prompt: eventsPrompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model: config.model,
+    effort: config.effort,
+    maxTurns: config.maxTurns,
+    budgetUsd,
+    progress
+  }, phaseTimings);
+  const wired = await scanManifestEvents(repoPath, manifest);
+  return {
+    pass,
+    eventOutcomes: manifest.events.map(
+      (event) => wired.has(event.eventType) ? { event: event.eventType, outcome: "wired" } : {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: "No track() call was detected after the direct wiring pass."
+      }
+    )
+  };
+}
+function planForManifest(plan, manifest) {
+  const known = new Set(manifest.events.map((event) => event.eventType));
+  return uniquePlanEntries(plan.filter((entry) => known.has(entry.event)));
+}
+function uniquePlanEntries(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const entry of entries) {
+    if (seen.has(entry.event)) continue;
+    seen.add(entry.event);
+    unique.push(entry);
+  }
+  return unique;
+}
+async function scanManifestEvents(repoPath, manifest) {
+  return scanEvents(repoPath, manifest.events.map((event) => event.eventType));
+}
+async function scanEvents(repoPath, eventTypes) {
+  let files = [];
+  try {
+    files = await changedFiles(repoPath, { isRepo: true });
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  if (!files.length) return /* @__PURE__ */ new Map();
+  return scanWiredEvents(repoPath, files, eventTypes);
+}
+function buildEventOutcomes(manifest, plan, wired) {
+  const byEvent = new Map(plan.map((entry) => [entry.event, entry]));
+  return manifest.events.map((event) => {
+    if (wired.has(event.eventType)) {
+      return { event: event.eventType, outcome: "wired" };
+    }
+    const entry = byEvent.get(event.eventType);
+    if (entry?.decision === "skip") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: entry.reason || "Planner skipped this event for this surface."
+      };
+    }
+    if (entry?.decision === "unsure") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: entry.reason || "Planner could not confirm a concrete anchor."
+      };
+    }
+    if (entry?.decision === "place") {
+      return {
+        event: event.eventType,
+        outcome: "skipped",
+        reason: "No track() call was detected after wiring and one targeted follow-up."
+      };
+    }
+    return {
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "No placement decision was returned."
+    };
+  });
+}
+function refreshWiredOutcomes(current, manifest, wired) {
+  const byEvent = new Map(current.map((outcome) => [outcome.event, outcome]));
+  return manifest.events.map((event) => {
+    if (wired.has(event.eventType)) {
+      return { event: event.eventType, outcome: "wired" };
+    }
+    return byEvent.get(event.eventType) ?? {
+      event: event.eventType,
+      outcome: "skipped",
+      reason: "No track() call was detected."
+    };
+  });
+}
+function tail(s, max) {
+  const trimmed = s.trim();
+  return trimmed.length > max ? trimmed.slice(-max) : trimmed;
+}
+function debugNote(message) {
+  if (process.env.WHISPERR_WIZARD_DEBUG) {
+    console.error(`[whisperr-wizard] ${message}`);
+  }
+}
+async function runTimedPass(phase, opts, phaseTimings) {
+  opts.progress?.onPhase?.(phase);
+  const started = Date.now();
+  try {
+    return await runPass(opts);
+  } finally {
+    phaseTimings.push({ phase, ms: Date.now() - started });
+  }
+}
 function isLimitStop(err) {
   const msg = err?.message ?? "";
   return /max(imum)?[\s_-]*(turn|budget)|budget.*exceeded|number of turns/i.test(msg);
 }
 async function runPass(opts) {
-  const { prompt, systemPrompt: systemPrompt9, repoPath, model, effort, maxTurns, budgetUsd, progress } = opts;
+  const {
+    prompt,
+    systemPrompt: systemPrompt9,
+    repoPath,
+    model,
+    effort,
+    maxTurns,
+    budgetUsd,
+    allowedTools = FULL_TOOLS,
+    progress
+  } = opts;
   let summary = "";
   let costUsd = 0;
   let ok = false;
   let maxedOut = false;
+  let lastActivityLine = "";
+  const emitActivity = (line) => {
+    if (!line || line === lastActivityLine) return;
+    lastActivityLine = line;
+    progress?.onActivity?.(line);
+  };
   const response = query({
     prompt,
     options: {
@@ -1920,8 +2698,9 @@ async function runPass(opts) {
       // defaults so the behavior is pinned regardless of SDK version.
       thinking: { type: "adaptive" },
       effort,
-      allowedTools: ["Read", "Edit", "Write", "Bash", "Glob", "Grep"],
-      permissionMode: "bypassPermissions",
+      tools: [...allowedTools],
+      hooks: buildToolPolicyHooks(repoPath),
+      canUseTool: createToolPermissionCallback(repoPath),
       maxTurns,
       // Native SDK hard cost cap. Stops this pass with an `error_max_budget_usd`
       // result once spend exceeds the remaining budget — this, not maxTurns, is
@@ -1935,9 +2714,9 @@ async function runPass(opts) {
       if (message.type === "assistant") {
         for (const block of message.message?.content ?? []) {
           if (isTextBlock(block) && block.text?.trim()) {
-            progress?.onActivity?.(firstLine(block.text));
+            emitActivity(firstLine(block.text));
           } else if (isToolUseBlock(block)) {
-            progress?.onActivity?.(describeToolUse(block));
+            emitActivity(describeToolUse(block));
           }
         }
       } else if (message.type === "result") {
@@ -1957,6 +2736,48 @@ async function runPass(opts) {
   }
   return { summary, costUsd, ok, maxedOut };
 }
+function buildToolPolicyHooks(repoPath) {
+  return {
+    PreToolUse: [
+      {
+        hooks: [
+          async (input) => {
+            if (input.hook_event_name !== "PreToolUse") return { continue: true };
+            const decision = evaluateToolUse(input.tool_name, toolInputRecord(input.tool_input), {
+              repoPath
+            });
+            if (decision.behavior === "allow") {
+              return { continue: true };
+            }
+            return {
+              hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: decision.message
+              }
+            };
+          }
+        ]
+      }
+    ]
+  };
+}
+function createToolPermissionCallback(repoPath) {
+  return async (toolName, input, options) => {
+    const decision = evaluateToolUse(toolName, input, { repoPath });
+    return decision.behavior === "allow" ? { behavior: "allow", toolUseID: options.toolUseID } : {
+      behavior: "deny",
+      message: decision.message,
+      toolUseID: options.toolUseID
+    };
+  };
+}
+function toolInputRecord(input) {
+  if (input && typeof input === "object" && !Array.isArray(input)) {
+    return input;
+  }
+  return {};
+}
 function applyModelAuthEnv(config, session) {
   if (config.directAnthropicKey) {
     process.env.ANTHROPIC_API_KEY = config.directAnthropicKey;
@@ -2046,7 +2867,7 @@ function runVerifyCommand(repoPath, command, opts = {}) {
     return Promise.resolve({ ran: false, ok: true, output: "" });
   }
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2(command, { cwd: repoPath, shell: true, env: process.env });
     let out = "";
     const append = (d) => {
@@ -2057,36 +2878,42 @@ function runVerifyCommand(repoPath, command, opts = {}) {
     child.stderr?.on("data", append);
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve2({ ran: true, ok: false, command, output: tail(out), timedOut: true });
+      resolve3({ ran: true, ok: false, command, output: tail2(out), timedOut: true });
     }, timeoutMs);
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve2({
+      resolve3({
         ran: true,
         ok: code === 0,
         command,
         exitCode: code,
-        output: tail(out),
+        output: tail2(out),
         // 127 = "command not found": the verify tool isn't on PATH here.
         toolMissing: code === 127
       });
     });
     child.on("error", () => {
       clearTimeout(timer);
-      resolve2({ ran: true, ok: false, command, output: tail(out), toolMissing: true });
+      resolve3({ ran: true, ok: false, command, output: tail2(out), toolMissing: true });
     });
   });
 }
-function tail(s) {
+function tail2(s) {
   const t = s.trim();
   return t.length > MAX_OUTPUT ? `\u2026${t.slice(-MAX_OUTPUT)}` : t;
 }
 
 // src/core/report.ts
+function scrubSummary(text) {
+  return scrubTerminalControls(text).replace(/sk-ant-[A-Za-z0-9_-]+/g, "[redacted]").replace(/sk-[A-Za-z0-9]{16,}/g, "[redacted]").replace(/AKIA[0-9A-Z]{16}/g, "[redacted]").replace(/Bearer\s+[A-Za-z0-9._-]+/g, "[redacted]").replace(
+    /\b(ANTHROPIC_(?:AUTH_TOKEN|API_KEY))\s*=\s*["']?[^"'\s]+["']?/gi,
+    "$1=[redacted]"
+  );
+}
 async function postRunReport(config, session, report) {
-  if (config.offline) return;
+  if (config.offline) return { ok: true };
   try {
-    await fetch(`${config.apiBaseUrl}/wizard/report`, {
+    const res = await fetch(`${config.apiBaseUrl}/wizard/report`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2094,9 +2921,33 @@ async function postRunReport(config, session, report) {
       },
       body: JSON.stringify(report)
     });
-  } catch {
+    if (res.ok) return { ok: true };
+    return {
+      ok: false,
+      status: res.status,
+      detail: await responseDetail(res)
+    };
+  } catch (err) {
+    return { ok: false, detail: detailSlice(errorMessage(err)) };
+  }
+}
+async function responseDetail(res) {
+  try {
+    return detailSlice(await res.text());
+  } catch (err) {
+    return detailSlice(errorMessage(err));
   }
 }
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function detailSlice(detail) {
+  const sliced = detail.slice(0, 200).trim();
+  return sliced || void 0;
+}
+function scrubTerminalControls(value) {
+  return value.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, "").replace(/[\x00-\x1f\x7f]/g, " ").replace(/ {2,}/g, " ").trim();
+}
 
 // src/ui/banner.ts
 function banner() {
@@ -2115,7 +2966,7 @@ function banner() {
 
 // src/cli.ts
 async function run2(options) {
-  const repoPath = resolve(options.path ?? process.cwd());
+  const repoPath = resolve2(options.path ?? process.cwd());
   const config = resolveConfig(options);
   console.log(banner());
   p.intro(theme.signal("Let's wire Whisperr into your app."));
@@ -2193,51 +3044,103 @@ Flutter is live today; ${theme.bright(
     );
   }
   const spin = p.spinner();
+  const useIntegrationSpinner = Boolean(process.stdout.isTTY);
   let phaseLabel = "Integrating";
   let lastLine = "";
+  let lastActivityLine = "";
   const startedAt = Date.now();
-  spin.start(theme.bright(phaseLabel));
-  const tick = setInterval(() => {
+  const nextIntegrationMessage = createMessageDeduper();
+  const updateIntegrationMessage = () => {
     const secs = Math.round((Date.now() - startedAt) / 1e3);
-    spin.message(
-      theme.bright(phaseLabel) + theme.muted(` \xB7 ${secs}s`) + (lastLine ? theme.muted(` \u2014 ${lastLine}`) : "")
-    );
-  }, 1e3);
+    const message = theme.bright(phaseLabel) + theme.muted(` \xB7 ${secs}s`) + (lastLine ? theme.muted(` \u2014 ${lastLine}`) : "");
+    const next = nextIntegrationMessage(message);
+    if (next) spin.message(next);
+  };
+  if (useIntegrationSpinner) {
+    spin.start(theme.bright(phaseLabel));
+  } else {
+    p.log.step(theme.bright(phaseLabel));
+  }
+  const tick = useIntegrationSpinner ? setInterval(updateIntegrationMessage, 1e3) : void 0;
   const outcome = await runIntegrationAgent({
     repoPath,
     config,
     session,
     playbook: chosen.playbook,
     manifest,
+    ...process.stdout.isTTY && process.stdin.isTTY ? {
+      async onPlanReady(plan) {
+        if (useIntegrationSpinner) {
+          spin.stop(theme.success("Placement plan ready"));
+        }
+        p.note(renderPlacementPlan(plan), "Placement plan");
+        const placeEntries = plan.filter((entry) => entry.decision === "place");
+        let selectedEvents = placeEntries.map((entry) => entry.event);
+        if (placeEntries.length) {
+          const selection = await p.multiselect({
+            message: "Wire these events?",
+            options: placeEntries.map((entry) => ({
+              value: entry.event,
+              label: entry.event,
+              hint: `${entry.file ?? "unknown file"}@${entry.anchor ?? "unknown anchor"}`
+            })),
+            initialValues: selectedEvents,
+            required: false
+          });
+          selectedEvents = p.isCancel(selection) ? [] : selection;
+        }
+        if (useIntegrationSpinner) {
+          spin.start(theme.bright("Continuing integration"));
+        }
+        return filterEventPlan(plan, selectedEvents);
+      }
+    } : {},
     progress: {
       onPhase(label) {
         phaseLabel = label;
         lastLine = "";
+        lastActivityLine = "";
+        if (useIntegrationSpinner) {
+          updateIntegrationMessage();
+        } else {
+          p.log.step(theme.bright(label));
+        }
       },
       onActivity(line) {
+        if (line === lastActivityLine) return;
+        lastActivityLine = line;
         lastLine = line;
+        if (useIntegrationSpinner) updateIntegrationMessage();
       }
     }
   }).catch((err) => {
     p.log.error(err.message);
     return null;
   });
-  clearInterval(tick);
+  if (tick) clearInterval(tick);
   if (!outcome) {
-    spin.stop(theme.alert("Integration stopped"));
+    if (useIntegrationSpinner) {
+      spin.stop(theme.alert("Integration stopped"));
+    } else {
+      p.log.error(theme.alert("Integration stopped"));
+    }
     await maybeRevert(repoPath, checkpoint, "The run stopped before finishing.");
     return 1;
   }
   const stopLabel = !outcome.coreOk ? theme.warn("Stopped early \u2014 partial setup is in your working tree") : outcome.eventsComplete ? theme.success("Integration complete") : theme.success("Core integration done") + theme.muted(" \u2014 some events left as follow-ups");
-  spin.stop(stopLabel);
+  if (useIntegrationSpinner) {
+    spin.stop(stopLabel);
+  } else if (!outcome.coreOk) {
+    p.log.warn(stopLabel);
+  } else {
+    p.log.success(stopLabel);
+  }
   const opportunities = await collectOpportunities(repoPath, manifest, checkpoint);
-  const files = await changedFiles(repoPath, checkpoint);
+  let files = await changedFiles(repoPath, checkpoint);
   if (files.length) {
     p.note(files.map((f) => theme.muted("\u2022 ") + f).join("\n"), "Files changed");
   }
-  if (outcome.summary.trim()) {
-    p.log.message(outcome.summary.trim());
-  }
+  logAgentSummary(outcome.summary);
   if (!outcome.coreOk) {
     const reverted = await maybeRevert(
       repoPath,
@@ -2254,7 +3157,7 @@ Flutter is live today; ${theme.bright(
     const cmd = chosen.playbook.verifyCommand;
     const vspin = p.spinner();
     vspin.start(`Verifying the integration \u2014 ${theme.muted(cmd)}`);
-    const verdict = await runVerifyCommand(repoPath, cmd);
+    let verdict = await runVerifyCommand(repoPath, cmd);
     verified = verdictToVerified(verdict);
     if (verdict.toolMissing) {
       vspin.stop(
@@ -2267,18 +3170,71 @@ Flutter is live today; ${theme.bright(
     } else if (verdict.ok) {
       vspin.stop(theme.success("Verified \u2713") + theme.muted(` (${cmd})`));
     } else {
-      vspin.stop(theme.alert(`Verification failed \u2014 ${cmd}`));
-      if (verdict.output) {
-        p.note(verdict.output, theme.warn("Verifier output"));
+      const remainingBudgetUsd = config.budgetUsd - outcome.costUsd;
+      if (remainingBudgetUsd >= 0.5) {
+        vspin.stop(
+          theme.warn(`Verification failed \u2014 ${cmd}`) + theme.muted(" \u2014 attempting one repair pass")
+        );
+        const repairSpin = p.spinner();
+        repairSpin.start(`Repairing verifier failures \u2014 ${theme.muted(cmd)}`);
+        try {
+          const repair = await runRepairPass({
+            repoPath,
+            config,
+            session,
+            playbook: chosen.playbook,
+            verifyCommand: cmd,
+            verifyOutput: verdict.output.slice(-4e3),
+            budgetUsd: remainingBudgetUsd
+          });
+          outcome.costUsd += repair.costUsd;
+          if (repair.summary.trim()) {
+            outcome.summary = [outcome.summary, `Repair:
+${repair.summary}`].filter(Boolean).join("\n\n");
+            logAgentSummary(repair.summary);
+          }
+          repairSpin.stop(theme.success("Repair pass finished"));
+        } catch (err) {
+          repairSpin.stop(
+            theme.warn("Repair pass failed") + theme.muted(` \u2014 ${err.message}`)
+          );
+        }
+        files = await changedFiles(repoPath, checkpoint);
+        const reverifySpin = p.spinner();
+        reverifySpin.start(`Re-verifying the integration \u2014 ${theme.muted(cmd)}`);
+        verdict = await runVerifyCommand(repoPath, cmd);
+        verified = verdictToVerified(verdict);
+        if (verdict.toolMissing) {
+          reverifySpin.stop(
+            theme.warn("Couldn't verify automatically") + theme.muted(` \u2014 \`${cmd}\` isn't available here. Run it yourself before committing.`)
+          );
+        } else if (verdict.timedOut) {
+          reverifySpin.stop(
+            theme.warn(`Verification timed out \u2014 \`${cmd}\``) + theme.muted(" \u2014 run it yourself before committing.")
+          );
+        } else if (verdict.ok) {
+          reverifySpin.stop(theme.success("Verified \u2713") + theme.muted(` (${cmd})`));
+        } else {
+          reverifySpin.stop(theme.alert(`Verification still failed \u2014 ${cmd}`));
+        }
+      } else {
+        vspin.stop(
+          theme.alert(`Verification failed \u2014 ${cmd}`) + theme.muted(" \u2014 skipped repair because less than $0.50 budget remains")
+        );
       }
-      const reverted = await maybeRevert(
-        repoPath,
-        checkpoint,
-        "The integration didn't pass its build/lint check, so the edits may be broken."
-      );
-      if (reverted) {
-        p.outro(theme.muted("Reverted \u2014 nothing was left in your working tree."));
-        return 1;
+      if (!verdict.ok && !verdict.toolMissing && !verdict.timedOut) {
+        if (verdict.output) {
+          p.note(verdict.output, theme.warn("Verifier output"));
+        }
+        const reverted = await maybeRevert(
+          repoPath,
+          checkpoint,
+          "The integration didn't pass its build/lint check, so the edits may be broken."
+        );
+        if (reverted) {
+          p.outro(theme.muted("Reverted \u2014 nothing was left in your working tree."));
+          return 1;
+        }
       }
     }
   }
@@ -2291,7 +3247,8 @@ Flutter is live today; ${theme.bright(
     opportunities,
     fingerprint,
     checkpoint,
-    remainingBudgetUsd: config.budgetUsd - outcome.costUsd
+    remainingBudgetUsd: config.budgetUsd - outcome.costUsd,
+    repoMap: outcome.repoMap
   });
   if (instrumentationSnapshot && chosen.playbook.verifyCommand) {
     const cmd = chosen.playbook.verifyCommand;
@@ -2346,19 +3303,33 @@ Flutter is live today; ${theme.bright(
     status: wiredMap.has(eventType) ? "wired" : "skipped",
     file: wiredMap.get(eventType)
   }));
-  await postRunReport(config, session, {
+  const reportResult = await postRunReport(config, session, {
     target: chosen.playbook.target.id,
     repo_fingerprint: fingerprint,
     identify_wired: outcome.coreOk,
     verified,
     cost_usd: outcome.costUsd,
     duration_ms: outcome.durationMs,
-    summary: outcome.summary.slice(0, 4e3),
+    summary: scrubSummary(outcome.summary).slice(0, 4e3),
     events: reportEvents
   });
+  if (!reportResult.ok) {
+    p.log.warn(
+      theme.warn("Couldn't record this run's coverage on the server") + theme.muted(
+        ` (${formatReportFailure(reportResult)}) \u2014 future runs may re-propose events already wired here.`
+      )
+    );
+  }
+  const eventLines = renderEventOutcomeLines(outcome.eventOutcomes, wiredMap);
+  if (eventLines) {
+    p.note(eventLines, "Events");
+  }
+  const eventDenominator = manifest.universeSummary?.wireableHere ?? eventTypesToScan.length;
+  const eventStatsLabel = manifest.universeSummary ? "events wired here" : "events wired";
+  const timingDetails = outcome.phaseTimings.map(({ phase, ms }) => `${shortPhaseLabel(phase)} ${formatDuration(ms)}`).join(" \xB7 ");
   p.log.info(
     theme.muted(
-      `${wiredMap.size}/${eventTypesToScan.length} events wired \xB7 ${files.length} file${files.length === 1 ? "" : "s"} changed \xB7 ` + (verified === true ? "verified \xB7 " : verified === false ? "unverified \xB7 " : "") + `${Math.round(outcome.durationMs / 1e3)}s`
+      `${wiredMap.size}/${eventDenominator} ${eventStatsLabel} \xB7 ${files.length} file${files.length === 1 ? "" : "s"} changed \xB7 ` + (verified === true ? "verified \xB7 " : verified === false ? "unverified \xB7 " : "") + formatDuration(outcome.durationMs) + (timingDetails ? ` (${timingDetails})` : "")
     )
   );
   if (!config.offline) {
@@ -2432,10 +3403,9 @@ async function offerOpportunities(opts) {
         hint: i.description ?? i.rationale
       }))
     ],
-    initialValues: [
-      ...opportunities.events.map((e) => `e:${e.code}`),
-      ...opportunities.interventions.map((i) => `i:${i.code}`)
-    ],
+    // Opt-in per item: nothing is pre-selected, so adding to the universe is an
+    // explicit choice rather than an opt-out the user has to notice and undo.
+    initialValues: [],
     required: false
   });
   if (p.isCancel(selection) || selection.length === 0) {
@@ -2497,6 +3467,13 @@ async function offerOpportunities(opts) {
       theme.muted("Runtime policy update queued \u2014 the additions go live once it completes.")
     );
   }
+  if (result.policyRegen?.status === "draft") {
+    lines.push(
+      theme.muted(
+        "A review policy draft was queued \u2014 activate it in your dashboard once it finishes generating to take the additions live (your current live policy was left untouched)."
+      )
+    );
+  }
   p.note(lines.join("\n"), theme.signal("Universe updated"));
   if (result.policyRegen?.status === "failed") {
     p.log.warn(
@@ -2520,11 +3497,12 @@ async function offerOpportunities(opts) {
       session,
       playbook: opts.playbook,
       acceptedEvents,
-      budgetUsd: opts.remainingBudgetUsd
+      budgetUsd: opts.remainingBudgetUsd,
+      repoMap: opts.repoMap
     });
     if (pass.ran) {
       spin.stop(theme.success("New events instrumented"));
-      if (pass.summary.trim()) p.log.message(pass.summary.trim());
+      logAgentSummary(pass.summary);
     } else {
       spin.stop(
         theme.warn("Skipped instrumenting the new events") + theme.muted(
@@ -2627,15 +3605,98 @@ async function withSpinner(label, fn) {
     throw err;
   }
 }
+function createMessageDeduper() {
+  let last = "";
+  return (message) => {
+    if (message === last) return null;
+    last = message;
+    return message;
+  };
+}
+function formatDuration(ms) {
+  const safeMs = Math.max(0, ms);
+  const totalSeconds = Math.round(safeMs / 1e3);
+  if (safeMs < 6e4) return `${totalSeconds}s`;
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = String(totalSeconds % 60).padStart(2, "0");
+  return `${minutes}m${seconds}s`;
+}
+function filterEventPlan(plan, selectedEvents) {
+  const selected = new Set(selectedEvents);
+  return plan.map(
+    (entry) => entry.decision === "place" && !selected.has(entry.event) ? { ...entry, decision: "skip", reason: "Deselected in plan review." } : entry
+  );
+}
+function renderPlacementPlan(plan) {
+  return plan.map((entry) => {
+    if (entry.decision === "place") {
+      return theme.success("\u2713 ") + entry.event + theme.muted(
+        ` \u2014 ${entry.file ?? "unknown file"} @ ${entry.anchor ?? "unknown anchor"}`
+      );
+    }
+    const reason = entry.reason || "No reason provided.";
+    const line = `${entry.decision === "skip" ? "\u25CB" : "?"} ${entry.event} \u2014 ${reason}`;
+    return entry.decision === "skip" ? theme.muted(line) : theme.warn(line);
+  }).join("\n");
+}
+function renderEventOutcomeLines(outcomes, wiredMap) {
+  const maxLines = 40;
+  const visibleCount = outcomes.length > maxLines ? maxLines - 1 : outcomes.length;
+  const lines = outcomes.slice(0, visibleCount).map((outcome) => {
+    if (outcome.outcome === "wired") {
+      const file = wiredMap.get(outcome.event);
+      return theme.success("\u2713 ") + outcome.event + (file ? theme.muted(` \u2014 ${file}`) : "");
+    }
+    return theme.muted(
+      `\u25CB ${outcome.event} \u2014 ${outcome.reason || "No track() call was detected."}`
+    );
+  });
+  const remainder = outcomes.length - visibleCount;
+  if (remainder > 0) lines.push(theme.muted(`\u2026 ${remainder} more events`));
+  return lines.join("\n");
+}
+function logAgentSummary(summary) {
+  const cleaned = scrubSummary(summary).trim();
+  if (cleaned) p.log.message(cleaned);
+}
+function shortPhaseLabel(phase) {
+  switch (phase) {
+    case "Mapping your codebase":
+      return "map";
+    case "Installing the SDK & wiring identify()":
+      return "core";
+    case "Planning event placements":
+      return "plan";
+    case "Instrumenting planned events":
+    case "Instrumenting your events":
+      return "wire";
+    case "Reconciling missed events":
+      return "reconcile";
+    case "Reviewing & correcting placements":
+      return "review";
+    default:
+      return phase;
+  }
+}
 function summarizeManifest(m) {
   const events = [...m.events].sort((a, b) => (b.importance ?? 0) - (a.importance ?? 0)).map((e) => theme.muted("\u2022 ") + e.eventType);
   const channels = m.identify.channels?.length ? theme.muted(`channels: ${m.identify.channels.join(", ")}`) : "";
+  const firstLine2 = m.universeSummary ? theme.bright(`${m.universeSummary.total} events in your universe`) + theme.muted(
+    ` \u2014 ${m.universeSummary.wireableHere} wireable here \xB7 ${m.universeSummary.derived} computed by Whisperr from your raw events \xB7 ${m.universeSummary.otherSurface} live on other surfaces`
+  ) : theme.bright("identify()") + theme.muted(" + ") + theme.bright(`${m.events.length} events`);
   return [
-    theme.bright("identify()") + theme.muted(" + ") + theme.bright(`${m.events.length} events`),
+    firstLine2,
     ...events,
     channels
   ].filter(Boolean).join("\n");
 }
+function formatReportFailure(result) {
+  const detail = result.detail?.replace(/\s+/g, " ").trim();
+  if (result.status !== void 0) {
+    return `HTTP ${result.status}${detail ? `: ${detail}` : ""}`;
+  }
+  return detail || "request failed";
+}
 
 // src/index.ts
 var modulePath = fileURLToPath(import.meta.url);