failproofai 1.0.10 → 1.0.11-beta.1

package/bin/failproofai.mjs

@@ -120,9 +120,16 @@ async function exitAfterFlush(code) {
 const hookIdx = args.indexOf("--hook");
 if (hookIdx >= 0) {
   if (!args[hookIdx + 1]) {
-    console.error("Error: Missing event type after --hook");
-    console.error("Usage: failproofai --hook <event> [--cli <claude|codex|copilot|cursor|opencode|pi|hermes|openclaw|factory|devin|antigravity|goose>]");
-    process.exit(1);
+    // The notice shape, written out by hand and never coloured: importing the
+    // kit here — the first module this file imports — moves `tui.ts` ahead of
+    // the builtin policies in the bundle, so its top-level `ctx` renames their
+    // `ctx` parameters and changes the audit cache key (`engineVersion`) for
+    // every user. It also keeps the hook path an agent spawns per tool call
+    // loading nothing new. Written, not `console.error`, which Bun paints red.
+    process.stderr.write(
+      "✕ Missing event type after --hook.\n  Run  failproofai help hook  for the events and agent ids.\n",
+    );
+    await exitAfterFlush(1);
   }
   const eventType = args[hookIdx + 1];
   const cliIdx = args.indexOf("--cli");
@@ -305,8 +312,8 @@ if (hookIdx >= 0) {
  * had all three. The words are still each screen's own — this owns the shape,
  * so a screen cannot drift out of the family without editing the family.
  *
- * Capped at 80 columns by `helpOptsFor`, so help reads the same in a maximised
- * window as in a tmux pane, and narrows on a terminal smaller than that.
+ * Drawn by `screenKit().helpPage` at the terminal's width; descriptions are
+ * prose and may be shortened on a terminal, never in a pipe.
  */
 /**
  * Lines a module ALREADY laid out with the kit — `harness`, `publish`,
@@ -334,46 +341,119 @@ async function printLines(lines, ok = true) {
  * flatten the structure they were expressing.
  */
 async function printReport(command, lines, opts = {}) {
-  const { title, wrap, stack, printBlock, optsFor, INDENT, brandAnsi, ANSI_RESET } =
-    await import("../src/hooks/tui");
+  const { printBlock, optsFor, screenKit, paint: palette } = await import("../src/hooks/tui");
+  const { reportBody } = await import("../src/hooks/report-body");
   const ok = opts.ok !== false;
   const stream = ok ? process.stdout : process.stderr;
   const o = optsFor(stream);
+  const kit = screenKit(o);
+  const c = palette(o.color);
   // `\`like this\`` becomes pink, and loses the backticks. These messages name
   // the command to run next more often than not, and pink is what you type
-  // everywhere else on the CLI now — the help screens, the bullets, the next
-  // steps. Applied AFTER wrapping, because an escape sequence has no width and
-  // colouring first would make every wrap measure the wrong length.
-  const paint = (line) =>
-    o.color && (line.match(/`/g) || []).length % 2 === 0
-      ? line.replace(/`([^`]+)`/g, `${brandAnsi("pink")}$1${ANSI_RESET}`)
-      : line;
-  const body = [];
-  for (const line of lines) {
-    if (line.trim() === "") body.push("");
-    else if (line.startsWith(" ")) body.push(paint(`${INDENT}${line}`));
-    else {
-      for (const w of wrap(line, Math.max(20, o.cols - INDENT.length * 2))) {
-        body.push(paint(`${INDENT}${w}`));
-      }
-    }
-  }
-  printBlock(stream, stack(title(`failproofai ${command}`, opts.meta, o), body));
+  // everywhere. Applied AFTER wrapping, because an escape sequence has no
+  // width and colouring first would make every wrap measure the wrong length.
+  //
+  // A line that opens on a state glyph gets that glyph in its role colour, the
+  // way a notice draws it: `update` reports a daemon that needs root that way.
+  const glyphRoles = { "✓": c.guide, "▲": c.warn, "✕": c.err };
+  const paint = (line) => {
+    const typed =
+      (line.match(/`/g) || []).length % 2 === 0 ? line.replace(/`([^`]+)`/g, (_, cmd) => c.pink(cmd)) : line;
+    const lead = /^(\s*)([✓▲✕]) /.exec(typed);
+    return lead ? `${lead[1]}${glyphRoles[lead[2]](lead[2])}${typed.slice(lead[1].length + 1)}` : typed;
+  };
+  // The 2026-10 shape: the header names the command, top-level lines start at
+  // column 0, and lines a module indented on purpose keep their indent. A
+  // failed run opens with ✕, so it reads as the failure it is — unless its
+  // lines already mark their own state; see report-body.ts.
+  const name = command.charAt(0).toUpperCase() + command.slice(1);
+  const body = reportBody(lines, { ok, width: o.cols - 2 }).map(paint);
+  printBlock(stream, [kit.header(opts.meta ? `${name}  ·  ${opts.meta}` : name), "", ...body]);
 }
 
 async function printHelp(spec) {
-  const { helpScreen, helpOptsFor, printBlock } = await import("../src/hooks/tui");
-  printBlock(process.stdout, helpScreen({ version, ...spec }, helpOptsFor(process.stdout)));
+  const { screenKit, optsFor, printBlock } = await import("../src/hooks/tui");
+  // Descriptions are prose and may be shortened to fit a terminal; nothing is
+  // ever cut in a pipe, and a command, flag or path is never cut anywhere.
+  const kit = screenKit({ ...optsFor(process.stdout), fit: !!process.stdout.isTTY });
+  printBlock(process.stdout, kit.helpPage(spec));
 }
 
 async function runCli() {
+  // One page for `policies --help` and `policies add|remove|show --help`: it
+  // carries every flag of every policies lane, so `help policies add` lands on
+  // the right page with no routing of its own. Defined here, inside runCli,
+  // so the bundle gains no top-level name.
+  const POLICIES_HELP = {
+    name: "policies",
+    usage: [
+      ["failproofai policies [--list]", "List every policy and whether it is on"],
+      ["failproofai policies add [name | owner/repo]", "Turn one on, install a pack, or pick from a list"],
+      ["failproofai policies remove [name | pack-id]", "Turn one off, uninstall a pack, or pick from a list"],
+      ["failproofai policies show <owner/repo>", "See what a pack holds"],
+      ["failproofai policies --install [names...]", "Install hooks and turn on any policies named"],
+      ["failproofai policies --uninstall [names...]", "Turn named policies off; with none, remove hooks"],
+    ],
+    options: [
+      ["-i, -u", "Short for --install and --uninstall"],
+      ["--policy, --only <a,b>", "Install only these policies from a pack"],
+      ["--category <x,y>", "Install only these categories from a pack"],
+      ["--all", "List every policy; with a pack, install all of it"],
+      ["--cli <agent...>", "Apply to these agents only"],
+      ["", "claude, codex, copilot, cursor, opencode, pi,"],
+      ["", "hermes, openclaw, factory, devin, antigravity, goose"],
+      ["--scope <scope>", "user, project, local (default user); all when removing"],
+      ["--beta", "Include beta policies"],
+      ["-c, --custom <file>", "With --install, add a custom policy file (repeatable)"],
+      ["", "--uninstall -c removes every custom policy file"],
+      ["--releases", "With show: list its releases, and which one is here"],
+    ],
+    examples: [
+      "failproofai policies add FailproofAI/policies",
+      "failproofai policies add FailproofAI/policies --category git",
+      "failproofai policies remove block-sudo",
+    ],
+  };
+  // `--cli` in the three policies lanes: one or more space-separated agents,
+  // optionally repeated, read until the next flag or the first word that is
+  // not an agent, since a policy name may follow the list. One wording for
+  // every mistake, built from INTEGRATION_TYPES: the message this replaced
+  // named eight of the twelve agents, and said "Missing" for a typo too.
+  async function readCliFlag(list) {
+    const { INTEGRATION_TYPES } = await import("../src/hooks/types");
+    const agents = new Set(INTEGRATION_TYPES);
+    const cliFlagValues = [];
+    const cliConsumedIdxs = new Set();
+    for (let idx = 0; idx < list.length; idx++) {
+      if (list[idx] !== "--cli") continue;
+      let consumed = 0;
+      for (let j = idx + 1; j < list.length && !list[j].startsWith("-") && agents.has(list[j]); j++) {
+        cliFlagValues.push(list[j]);
+        cliConsumedIdxs.add(j);
+        consumed++;
+      }
+      if (consumed > 0) continue;
+      const half = Math.ceil(INTEGRATION_TYPES.length / 2);
+      const everyAgent =
+        `Use any of: ${INTEGRATION_TYPES.slice(0, half).join(", ")},\n` +
+        `            ${INTEGRATION_TYPES.slice(half).join(", ")}`;
+      const given = list[idx + 1];
+      if (given === undefined || given.startsWith("-")) {
+        throw new CliError(`Missing agent name after --cli.\n${everyAgent}`);
+      }
+      const { nearestName } = await import("../src/hooks/did-you-mean");
+      const near = nearestName(given, INTEGRATION_TYPES);
+      throw new CliError(`Not an agent: ${given}${near ? ` (did you mean ${near}?)` : "."}\n${everyAgent}`);
+    }
+    return { cliFlagValues, cliConsumedIdxs };
+  }
   // --help / -h  (only when not inside a subcommand that handles its own --help)
   // `update` and `migrate` were missing here, so `failproofai update --help`
   // exited 1 with "Unexpected argument" — both commands had no reachable help
   // at all, only the paragraph in the top-level dump that this rewrite moved.
   // `help` and `publish` are new. `policy` and `pack` are canonicalized to
   // `policies` above and never reach this list.
-  const SUBCOMMANDS = ["policies", "audit", "config", "uninstall", "backfill", "flush", "harness", "jev", "publish", "update", "migrate", "help"];
+  const SUBCOMMANDS = ["policies", "audit", "config", "uninstall", "backfill", "flush", "harness", "otel", "jev", "publish", "update", "migrate", "help"];
   // ── help ─────────────────────────────────────────────────────────────────
   //
   // The index and the reference manual used to be the same document: 152 lines,
@@ -393,33 +473,12 @@ async function runCli() {
     // machine-facing flag would only take space from the human-facing commands.
     if (helpTopic === "hook") {
       await printHelp({
-        command: "--hook",
-        tagline: "the entry point your agent CLI spawns, once per tool call",
-        sections: [
-          {
-            label: "usage",
-            entries: [["failproofai --hook <event> [--cli <name>]"]],
-            after: [
-              "You do not run this; `failproofai config` writes it into each CLI's",
-              "hook configuration for you.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--hook <event>", "PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop, SessionStart, SessionEnd, PreCompact, Notification, PermissionRequest"],
-              ["--cli <name>", "claude, codex, copilot, cursor, opencode, pi, hermes, openclaw, factory, devin, antigravity, goose. Defaults to claude. It selects which payload shape to expect: each CLI names its events and tool arguments differently, and failproofai canonicalizes them."],
-            ],
-          },
-          {
-            label: "how it answers",
-            lines: [
-              "It reads the event as JSON on stdin and answers on stdout, in whatever",
-              "shape that CLI honours. Exit codes and response shapes differ per CLI by",
-              "necessity — see docs.befailproof.ai. Denials are reported to the agent,",
-              "never to you.",
-            ],
-          },
+        name: "hook",
+        usage: [["failproofai --hook <event> [--cli <agent>]", "Called by your agents on every tool call"]],
+        options: [
+          ["--hook <event>", "PreToolUse, PostToolUse, UserPromptSubmit, Stop and more"],
+          ["--cli <agent>", "claude (default), codex, copilot, cursor, opencode, pi,"],
+          ["", "hermes, openclaw, factory, devin, antigravity, goose"],
         ],
       });
       process.exit(0);
@@ -435,8 +494,8 @@ async function runCli() {
           : helpTopic;
     if (!SUBCOMMANDS.includes(canonical)) {
       throw new CliError(
-        `No help for: ${helpTopic}\n` +
-        `Run \`failproofai help\` to see every command.`,
+        `There is no help for '${helpTopic}'.\n` +
+        "Run  `failproofai help`  to see every command.",
       );
     }
     // `policies add|remove|show` has its own help, distinct from the listing's.
@@ -449,56 +508,69 @@ async function runCli() {
   ) {
     const extraArgs = args.filter((a) => a !== "--help" && a !== "-h" && a !== "help");
     if (extraArgs.length > 0) {
-      throw new CliError(`Unexpected argument: ${extraArgs[0]}\nRun \`failproofai help\` for usage.`);
-    }
-    // The index is DATA, not a template literal: one renderer draws it and the
-    // eleven `<command> --help` screens, so a row added here cannot end up in a
-    // different dialect from the screen it points at. Colour is decoration and
-    // never meaning — the column position already says which half is a command,
-    // so this reads identically under NO_COLOR, piped to a file, or on a
-    // terminal that has never heard of 24-bit.
-    await printHelp({
-      tagline: "guardrails for the coding agents on this machine",
-      sections: [
-        {
-          label: "get it running",
-          entries: [
-            ["config", "Set this machine up: agents, daemon, cloud"],
-            ["config --token <key>", "Set up and connect to Cloud, no questions asked"],
-            ["update", "Finish an npm upgrade: migrate home, match the daemon"],
-          ],
-        },
-        {
-          label: "choose what it enforces",
-          entries: [
-            ["policies", "Every policy on this machine, and whether it is on"],
-            ["policies add", "Turn one on, or install a pack: <owner>/<repo>"],
-            ["policies remove", "Turn one off, or uninstall a whole pack"],
-            ["publish", "Ship your own policies as a pack anyone can install"],
-            ["jev setup", "Let Jev judge calls with your own key, above regex"],
-          ],
-        },
-        {
-          label: "see what it caught",
-          entries: [
-            ["(no args)", "Open the policy dashboard on localhost:8020"],
-            ["audit", "Scan your agents' history, then open the audit view"],
-            ["config --status", "Cloud connection, daemon version, pause state"],
-          ],
-        },
-        // Named, not described. Everything here is real and reachable through
-        // `help <command>`; none of it is what anyone types on the first day,
-        // and a full row each is what made this screen read as a manual.
-        {
-          label: "less often",
-          lines: ["policies show, harness, flush, backfill, migrate, uninstall, config --pause"],
-        },
-      ],
-      footer: [
-        "failproofai <command> [options]     failproofai help <command> for detail",
-        "docs.befailproof.ai   discord.befailproof.ai   -h this screen   -v version",
-      ],
-    });
+      throw new CliError(`Unexpected argument: ${extraArgs[0]}.\nRun  \`failproofai help\`  for usage.`);
+    }
+    // The index and every `<command> --help` page are built from the same kit,
+    // so a row added here cannot end up in a different dialect from the page it
+    // points at. Colour is decoration and never meaning: the column already says
+    // which half is a command, so this reads the same under NO_COLOR, piped to a
+    // file, or on a terminal that has never heard of 24-bit.
+    {
+      // The index, in the design's shape: what to do first, then every command by
+      // what it is for. Composed here from the kit rather than a builder in tui.ts,
+      // so the bundle gains no top-level name (see the audit-cache note there).
+      const { screenKit, optsFor, printBlock } = await import("../src/hooks/tui");
+      const kit = screenKit({ ...optsFor(process.stdout), fit: !!process.stdout.isTTY });
+      // The command sits in the SECOND column here, so these rows never go
+      // through rows()' description slot, which is the one shortened to fit.
+      const steps = [
+        ["Set up this machine", "failproofai config"],
+        ["Turn on policies", "failproofai policies add FailproofAI/policies"],
+        ["See what your agents did", "failproofai"],
+      ];
+      const section = (heading, entries) => [
+        "",
+        kit.head(heading),
+        ...kit.rows(entries.map(([name, description]) => [name === "(no args)" ? name : kit.cmd(name), description]), 12),
+      ];
+      await printBlock(process.stdout, [
+        kit.header("Guardrails for coding agents on this machine"),
+        "",
+        kit.head("Get started"),
+        ...steps.map(([label, command], i) => `  ${i + 1}  ${label.padEnd(27)}  ${kit.cmd(command)}`),
+        ...section("Set up", [
+          ["config", "Connect to cloud or use open source, and pick agents to trace"],
+          ["update", "Finish an npm upgrade: migrate this machine and match the daemon"],
+          ["uninstall", "Remove hooks and the daemon from this machine"],
+        ]),
+        ...section("Enforce", [
+          ["policies", "List policies, turn them on or off, install packs"],
+          ["publish", "Ship your own policies as a pack anyone can install"],
+          ["jev", "Have Jev judge tool calls on top of the regex policies"],
+        ]),
+        ...section("Observe", [
+          ["(no args)", "Open the policy dashboard on localhost:8020"],
+          ["audit", "Scan your agents' history for risky and wasteful patterns"],
+          ["otel", "Opt in to OpenTelemetry from agents and apps"],
+        ]),
+        ...section("Less often", [
+          ["harness", "Collect sessions from extra locations per agent"],
+          ["flush", "Send queued events to cloud now"],
+          ["backfill", "Re-send history the collector already read"],
+          ["migrate", "Bring ~/.failproofai up to this version's layout"],
+        ]),
+        "",
+        kit.head("Examples"),
+        ...kit.rows([
+          [kit.cmd("failproofai config --status"), "Check the daemon, cloud and pauses"],
+          [kit.cmd("failproofai policies add block-sudo"), "Turn on one policy"],
+          [kit.cmd("failproofai policies show acme/guards"), "Preview a pack before installing it"],
+        ]),
+        "",
+        `Run ${kit.cmd("failproofai help <command>")} for its options, ${kit.cmd("failproofai -v")} for the version.`,
+        "docs.befailproof.ai  ·  discord.befailproof.ai",
+      ]);
+    }
     process.exit(0);
   }
 
@@ -507,7 +579,7 @@ async function runCli() {
   if ((args.includes("--version") || args.includes("-v")) && !SUBCOMMANDS.includes(args[0])) {
     const extraArgs = args.filter((a) => a !== "--version" && a !== "-v");
     if (extraArgs.length > 0) {
-      throw new CliError(`Unexpected argument: ${extraArgs[0]}\nRun \`failproofai --help\` for usage.`);
+      throw new CliError(`Unexpected argument: ${extraArgs[0]}.\nRun  \`failproofai help\`  for usage.`);
     }
     console.log(version);
     process.exit(0);
@@ -582,8 +654,9 @@ async function runCli() {
       // entry point can see this ordering.
       const { checkLayoutForCli } = await import("../src/hooks/fp-reset");
       const check = await checkLayoutForCli();
-      for (const line of check.lines) console.error(line);
-      if (check.fatal) process.exit(1);
+      // Written rather than `console.error`, which Bun paints red on a terminal.
+      if (check.lines.length > 0) process.stderr.write(`${check.lines.join("\n")}\n`);
+      if (check.fatal) await exitAfterFlush(1);
       // `check.didReset` is deliberately not read. It used to force the wizard
       // below; see the note at `shouldOfferFirstRun` for why a migrated machine
       // no longer needs setup re-run, and `didReset` in `fp-reset.ts` for what
@@ -613,6 +686,9 @@ async function runCli() {
     // never block a command on reporting
   }
 
+  // True once the setup wizard has run in this process. It opens with the
+  // logomark, so the dashboard launch at the end must not draw a second one.
+  let setupWizardRan = false;
   const { shouldOfferFirstRun } = await import("../src/hooks/first-run-gate");
   // `|| layoutWasReset` stood here, with `force: layoutWasReset` below, because a
   // migration used to delete the home's policy config while leaving the agent
@@ -632,7 +708,7 @@ async function runCli() {
       const { maybeFirstRunConfigure } = await import("../src/hooks/configure-wizard");
       // `audit` runs its own scan immediately after this returns; firing the
       // post-setup audit too would scan the whole history twice in a row.
-      await maybeFirstRunConfigure({}, { postSetupAudit: args[0] !== "audit" });
+      setupWizardRan = await maybeFirstRunConfigure({}, { postSetupAudit: args[0] !== "audit" });
     } catch {
       // Onboarding is never allowed to block the command the user actually typed.
     }
@@ -649,33 +725,15 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "flush",
-        tagline: "deliver what is already spooled, now",
-        sections: [
-          { label: "usage", entries: [["failproofai flush [--wait] [--timeout <secs>]"]] },
-          {
-            label: "why",
-            lines: [
-              "The collector is unhurried on purpose: a batch is swept once it is older",
-              "than two minutes, at most 64 per pass, on a 60-second cadence. That pacing",
-              "keeps a backlog from stampeding the server, and it is exactly wrong when",
-              "you are standing at a dashboard waiting to see your own events — \"not",
-              "delivered yet\" and \"not working\" look identical from there.",
-              "",
-              "This asks the daemon to make a pass right now, with no minimum age and no",
-              "per-pass cap. It re-sends nothing: only batches already spooled and not",
-              "yet delivered. For history the collector has already read past, use",
-              "`failproofai backfill`.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--wait", "Block until the spool drains, or --timeout elapses."],
-              ["--timeout <secs>", "How long --wait waits. Default: 60."],
-            ],
-          },
+        name: "flush",
+        usage: [["failproofai flush [options]", "Send queued events to cloud now"]],
+        options: [
+          // The queue on THIS machine: a batch set aside after repeated failures
+          // leaves it empty without having been delivered.
+          ["--wait", "Wait until the queue is empty"],
+          ["--timeout <secs>", "How long --wait waits (default 60)"],
         ],
+        optionsCol: 20,
       });
       process.exit(0);
     }
@@ -685,19 +743,21 @@ async function runCli() {
       (a, i) => a.startsWith("-") && !KNOWN.has(a) && subArgs[i - 1] !== "--timeout",
     );
     if (unknown) {
-      throw new CliError(`Unexpected argument: ${unknown}\nRun \`failproofai flush --help\` for usage.`);
+      throw new CliError(`Unexpected argument: ${unknown}.\nRun  \`failproofai flush --help\`  for usage.`);
     }
 
     let timeoutSecs;
     const tIdx = subArgs.indexOf("--timeout");
     if (tIdx >= 0) {
       const raw = subArgs[tIdx + 1];
-      if (!raw || raw.startsWith("-")) throw new CliError("Missing value after --timeout.");
+      if (!raw || raw.startsWith("-")) {
+        throw new CliError("Missing value after --timeout.\nFor example:  `failproofai flush --wait --timeout 60`");
+      }
       const n = Number(raw);
       // Rejected rather than coerced: NaN would silently become "wait forever
       // or not at all" depending on the comparison, and neither is what was asked.
       if (!Number.isFinite(n) || n <= 0) {
-        throw new CliError(`Could not read --timeout ${raw}. Give a number of seconds.`);
+        throw new CliError(`Could not read --timeout ${raw}.\nGive a number of seconds, for example  \`--timeout 60\``);
       }
       timeoutSecs = n;
     }
@@ -720,45 +780,38 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "backfill",
-        tagline: "re-send history the collector has already read past",
-        sections: [
-          { label: "usage", entries: [["failproofai backfill [--since <when>] [--dry-run]"]] },
-          {
-            label: "why",
-            lines: [
-              "The collector never re-reads a file it has a cursor for, which is right",
-              "until the dashboard's data is cleared, a machine is re-enrolled, or",
-              "cursors advanced before there was anywhere to send. Then the history",
-              "exists on disk and nowhere else, with no way to ask for it again.",
-              "",
-              "Re-sending is safe: redaction is deterministic, so a re-sent event hashes",
-              "identically to its first send and collapses into the row already there.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--since <when>", "How far back: `30d`, `6m`, `YYYY-MM-DD`. Default 30 days."],
-              ["--dry-run", "Report what would be re-read and change nothing."],
-            ],
-          },
-          {
-            label: "note",
-            lines: [
-              "Which streams are sent follows [collector] in ~/.failproofai/config.toml —",
-              "a backfill never sends something your config says you do not want.",
-            ],
-          },
+        name: "backfill",
+        usage: [["failproofai backfill [options]", "Re-send history the collector already read"]],
+        options: [
+          ["--since <when>", "How far back: 30d, 6m, 1y or YYYY-MM-DD (default 30d)"],
+          ["--agents <a,b>", "Only these traced agents (default: every traced agent)"],
+          ["--dry-run", "Show what would be sent, send nothing"],
         ],
+        examples: ["failproofai backfill --since 6m", "failproofai backfill --agents claude,codex --dry-run"],
+        optionsCol: 20,
       });
       process.exit(0);
     }
 
-    const KNOWN = new Set(["--since", "--dry-run"]);
-    const unknown = subArgs.find((a, i) => a.startsWith("-") && !KNOWN.has(a) && subArgs[i - 1] !== "--since");
+    const KNOWN = new Set(["--since", "--dry-run", "--agents"]);
+    const TAKES_VALUE = new Set(["--since", "--agents"]);
+    // Every word is checked, not only the ones that start with "-": a bare
+    // `backfill 6m` used to be ignored, and ran the default 30 days instead of
+    // the six months that were typed.
+    const unknown = subArgs.find((a, i) => !KNOWN.has(a) && !TAKES_VALUE.has(subArgs[i - 1]));
     if (unknown) {
-      throw new CliError(`Unexpected argument: ${unknown}\nRun \`failproofai backfill --help\` for usage.`);
+      const looksLikeWindow = /^\d+[dmy]$/.test(unknown) || !Number.isNaN(Date.parse(unknown));
+      throw new CliError(
+        `Unexpected argument: ${unknown}.\n` +
+          (looksLikeWindow ? `Did you mean  \`failproofai backfill --since ${unknown}\`?` : "See its options:  `failproofai backfill --help`"),
+      );
+    }
+    let agents;
+    const agentsIdx = subArgs.indexOf("--agents");
+    if (agentsIdx >= 0) {
+      const raw = subArgs[agentsIdx + 1];
+      if (!raw || raw.startsWith("-")) throw new CliError("Missing value after --agents.");
+      agents = raw.split(",").map((a) => a.trim()).filter(Boolean);
     }
 
     let sinceMs;
@@ -785,9 +838,23 @@ async function runCli() {
 
     lastSubcommand = "backfill";
     const { runBackfillCommand } = await import("../src/hooks/backfill-cli");
-    const result = runBackfillCommand({ sinceMs, dryRun: subArgs.includes("--dry-run") });
-    await printReport("backfill", result.lines, { ok: result.exitCode === 0 });
-    await track("cli_backfill", { ok: result.exitCode === 0, dry_run: subArgs.includes("--dry-run"), explicit_since: sinceIdx >= 0 });
+    const { optsFor } = await import("../src/hooks/tui");
+    const result = await runBackfillCommand({
+      sinceMs,
+      since: sinceIdx >= 0 ? subArgs[sinceIdx + 1] : undefined,
+      dryRun: subArgs.includes("--dry-run"),
+      agents,
+      // Drawn for stdout. A refusal goes to stderr, and printBlock drops the
+      // colour there when stderr cannot show it.
+      render: optsFor(process.stdout),
+    });
+    await printLines(result.lines, result.exitCode === 0);
+    await track("cli_backfill", {
+      ok: result.exitCode === 0,
+      dry_run: subArgs.includes("--dry-run"),
+      explicit_since: sinceIdx >= 0,
+      agents_named: agents ? agents.length : 0,
+    });
     lastSubcommand = null;
     await exitAfterFlush(result.exitCode);
     return;
@@ -808,84 +875,71 @@ async function runCli() {
   // could reach it to notice. The pack lane is entered from
   // `policies add|remove|show` below, which is the only door it has.
 
+  if (args[0] === "otel") {
+    const subArgs = args.slice(1);
+    if (!subArgs.length || subArgs.includes("--help") || subArgs.includes("-h")) {
+      const verb = ["status", "enable", "disable", "env"].includes(subArgs[0]) ? subArgs[0] : null;
+      const usages = {
+        status: "failproofai otel status",
+        enable: "failproofai otel enable <agent|all> [--local] [--no-content] [--yes]",
+        disable: "failproofai otel disable <agent|all>",
+        env: "failproofai otel env [--service <name>] [--local]",
+      };
+      const options = {
+        enable: [
+          ["--local", "Use the loopback OTLP relay. Automatic for Gemini CLI and Copilot."],
+          ["--no-content", "Do not capture prompt text or tool details."],
+          ["--yes", "Accept switching this agent from transcript upload to OTEL."],
+        ],
+        env: [
+          ["--service <name>", "Service name for env (default: my-agent)."],
+          ["--local", "Use the loopback OTLP relay."],
+        ],
+        status: [],
+        disable: [],
+      };
+      const acceptedOptions = verb ? options[verb] : [...options.enable, options.env[0]];
+      await printHelp({
+        name: verb ? `otel ${verb}` : "otel",
+        usage: (verb ? [usages[verb]] : Object.values(usages)).map(usage => [
+          usage,
+          verb === "enable" || verb === "disable" || !verb ? "Agents: claude, codex, gemini, copilot, all" : "",
+        ]),
+        options: acceptedOptions,
+        examples: verb === "status" ? ["failproofai otel status"] :
+          verb === "disable" ? ["failproofai otel disable all"] :
+          verb === "env" ? ["failproofai otel env --service my-agent --local"] :
+          ["failproofai otel enable claude", "failproofai otel enable codex --local --no-content", "failproofai otel disable all"],
+      });
+      process.exit(0);
+    }
+    lastSubcommand = "otel";
+    const { runOtelCommand } = await import("../src/hooks/otel-cli");
+    const { otelReportLines } = await import("../src/hooks/otel-output");
+    const result = await runOtelCommand(subArgs, { onEvent: track });
+    // env is shell input and must not be wrapped in a styled report.
+    if (subArgs[0] === "env" && result.exitCode === 0) console.log(result.lines.join("\n"));
+    else await printReport(`otel ${subArgs[0]}`, otelReportLines(subArgs[0], result), { ok: result.exitCode === 0 });
+    lastSubcommand = null;
+    await exitAfterFlush(result.exitCode);
+    return;
+  }
+
   if (args[0] === "harness") {
     const subArgs = args.slice(1);
     if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "harness",
-        tagline: "capture sessions from more than one location per agent CLI",
-        sections: [
-          {
-            label: "usage",
-            entries: [
-              ["failproofai harness list [<harness>]"],
-              ["failproofai harness add-path <harness> [<label>=]<path>"],
-              ["failproofai harness remove-path <harness> <path|label>"],
-            ],
-          },
-          {
-            label: "why",
-            lines: [
-              "Each agent CLI is watched wherever its own installer put it —",
-              "~/.claude/projects, ~/.hermes/state.db, and so on. That misses every",
-              "other arrangement: a second profile, a mounted team share, a container's",
-              "home beside the host's, an agent an operator moved. Those hold real",
-              "sessions and nothing collects them.",
-            ],
-          },
-          {
-            label: "the label",
-            lines: [
-              "An entry is `<path>` or `<label>=<path>`. The label namespaces agent ids",
-              "as <label>-<agentId>, and it matters: two locations holding the same",
-              "project derive the SAME id (it comes from the cwd inside the transcript,",
-              "identical in both copies), so without a label they merge into one agent",
-              "whose sessions interleave from two machines' worth of history. Omit it",
-              "and one is derived from the folder name.",
-            ],
-          },
-          {
-            label: "harnesses",
-            lines: [
-              "claude, codex, copilot, openclaw, pi, factory, antigravity, cursor,",
-              "goose, opencode, devin, hermes",
-              "",
-              "`claude` covers subagent transcripts too — they live under the same root.",
-            ],
-          },
-          {
-            label: "notes",
-            lines: [
-              "• Session collection must be on for any of this to be read; extra paths",
-              "  live under \"collector\" in ~/.failproofai/config.json like the defaults.",
-              "• A path overlapping one already captured is REFUSED by the daemon at",
-              "  startup rather than collected twice under two ids. It says so in the",
-              "  journal.",
-              "• Two entries sharing a LABEL are refused too: they would share one",
-              "  cursor directory, whose whole map is written at once, so each would",
-              "  clobber the other's watermark and re-read from zero after a restart.",
-              "• Takes effect within seconds — the daemon re-reads config.json on an",
-              "  interval and cycles its collector. No restart, no sudo.",
-            ],
-          },
-          {
-            label: "examples",
-            lines: [
-              "failproofai harness add-path claude work=/srv/team/.claude/projects",
-              "failproofai harness add-path hermes prod=/srv/hermes-prod/state.db",
-              "failproofai harness add-path codex /mnt/other-home/.codex/sessions",
-              "failproofai harness list",
-              "failproofai harness remove-path claude work",
-              "",
-              "One home per person — label them, or both derive the same folder-name",
-              "label and the second is refused:",
-              "failproofai harness add-path openclaw user1=/srv/.openclaw-user1",
-              "failproofai harness add-path openclaw user2=/srv/.openclaw-user2",
-              "",
-              "Containers: FAILPROOFAI_<HARNESS>_EXTRA_PATHS replaces the file's entries.",
-              "FAILPROOFAI_OPENCLAW_EXTRA_PATHS=\"user1=/srv/.a,user2=/srv/.b\"",
-            ],
-          },
+        name: "harness",
+        usage: [
+          ["failproofai harness list [agent]", "Show extra capture paths"],
+          ["failproofai harness add-path <agent> [label=]<path>", "Also capture from here"],
+          ["failproofai harness remove-path <agent> <path | label>", "Stop capturing from here"],
+        ],
+        // For hermes, goose, opencode and devin the extra path is a database file.
+        examples: [
+          "failproofai harness add-path claude work=/srv/team/.claude/projects",
+          "failproofai harness add-path hermes prod=/srv/hermes-prod/state.db",
+          "failproofai harness remove-path claude work",
         ],
       });
       process.exit(0);
@@ -919,102 +973,35 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "jev",
-        tagline: "judge tool calls with Jev — FailproofAI Cloud or your own endpoint — above a hard regex floor",
-        sections: [
-          {
-            label: "usage",
-            entries: [
-              ["failproofai jev --url <url> --key-stdin [options]"],
-              ["failproofai jev setup --provider <kind> --key-stdin [options]"],
-              ["failproofai jev setup --provider failproofai [--mode <m>]"],
-              ["failproofai jev status [--json]"],
-              ["failproofai jev test [--json]"],
-              ["failproofai jev models [--provider <kind>] [--url <base>] [--json]"],
-              ["failproofai jev remove"],
-            ],
-          },
-          {
-            label: "why",
-            lines: [
-              "Regex policies cannot tell `rm -rf build/` asked for from `rm -rf ~`",
-              "slipped in. Jev, TypeSafe's classifier, reads the call against what",
-              "you asked for. With a config it judges each call in parallel with",
-              "the regex policies: a hard policy's deny always stands, a reviewable",
-              "one's may be cleared, and any Jev failure falls back to regex. With",
-              "no config nothing changes — the regex policies run exactly as before.",
-            ],
-          },
-          {
-            label: "providers",
-            entries: [
-              ["typesafe", "api.typesafe.ai, model jev-1.13.0"],
-              ["openrouter", "openrouter.ai, model typesafe/jev-1.13, zero-retention routing"],
-              ["vercel", "Vercel AI Gateway, model typesafe-ai/jev"],
-              ["cloudflare", "Workers AI, model typesafe/jev; needs --account-id"],
-              ["custom", "any TypeSafe-compatible endpoint; needs --base-url"],
-              ["failproofai", "FailproofAI Cloud, on your org's plan; no key or URL of your own"],
-            ],
-            after: [
-              "--url reads the provider off the host, so it needs no --provider;",
-              "any other host is custom, with that URL as its base. It is a BASE:",
-              "/systemone is appended to it, and a URL that already names an",
-              "endpoint (/models, /chat/completions, /systemone, …) is refused",
-              "with the base it implies. `failproofai jev models` says which",
-              "model ids a base serves, and setup refuses one it does not.",
-              "",
-              "FailproofAI Cloud needs no setup here: `failproofai config --token",
-              "<key>` with a key that carries jev:evaluate (the \"machine\" preset)",
-              "turns it on in observe mode when there is no jev.json yet — except",
-              "with --no-transcripts, which only stores the key; then",
-              "`failproofai jev setup --provider failproofai` switches it on. Its",
-              "key stays in credentials.json; no --url ever selects it.",
-            ],
-          },
-          {
-            label: "setup options",
-            entries: [
-              ["--url <url>", "The endpoint. Picks the provider from its host."],
-              ["--token <token>", "The key, on the command line — history and `ps` see it."],
-              ["--provider <kind>", "Required the first time, or to switch providers."],
-              ["--key-stdin", "Read the key from stdin; on a terminal, a masked prompt."],
-              ["--key-from-env", "Store no key; read FAILPROOFAI_JEV_API_KEY per session."],
-              ["--account-id <id>", "Cloudflare account id (32 hex characters)."],
-              ["--base-url <url>", "Override the API base; `default` clears it."],
-              ["--model <id>", "Override the model id; `default` clears it."],
-              ["--mode <m>", "enforce (default), observe (log Jev, enforce regex), or off."],
-              ["--timeout-ms <n>", "Per-call budget before falling back. Default 3000."],
-            ],
-          },
-          {
-            label: "notes",
-            lines: [
-              "• Global only: ~/.failproofai/jev.json, written 0600. A copy anyone",
-              "  else can read — or one in a directory anyone else can WRITE, who",
-              "  could replace it — is refused; a repository can never set it.",
-              "• Re-running setup for the same provider keeps the key, so",
-              "  `failproofai jev setup --mode observe` just switches the mode.",
-              "• The daemon does not see your shell's environment: keep the key in",
-              "  the file on a machine set up with `failproofai config`.",
-              "• --token is the fast path, not the safe one: your shell history keeps",
-              "  it and the process list shows it. Prefer --key-stdin.",
-            ],
-          },
-          {
-            label: "examples",
-            lines: [
-              "failproofai jev --url https://api.typesafe.ai/v1 --key-stdin < ~/typesafe.key",
-              "failproofai jev --url https://openrouter.ai/api/v1 --token <token>",
-              "failproofai jev setup --provider typesafe --key-stdin < ~/typesafe.key",
-              "failproofai jev setup --provider cloudflare --account-id <id> --key-stdin",
-              "failproofai config --token <key>          (FailproofAI Cloud, observe mode)",
-              "failproofai jev setup --mode enforce      (switch the configured route's mode)",
-              "failproofai jev setup --mode off          (keep the config, stop asking Jev)",
-              "failproofai jev test",
-              "failproofai jev status",
-              "failproofai jev models",
-            ],
-          },
+        name: "jev",
+        // One row per subcommand: the design's `status | test | models | remove`
+        // runs as a shell pipeline if pasted, and the four take different flags.
+        usage: [
+          ["failproofai jev setup --provider <kind> --key-stdin", "Turn Jev on"],
+          ["failproofai jev --url <url> --key-stdin", "Turn Jev on from a URL"],
+          ["failproofai jev setup --provider failproofai", "Use FailproofAI Cloud"],
+          ["failproofai jev status [--json]", "Show config and activity"],
+          ["failproofai jev test [--json]", "Send one live request"],
+          ["failproofai jev models [--provider <kind>] [--url <base>] [--json]"],
+          ["failproofai jev remove", "Delete the config"],
+        ],
+        options: [
+          ["--provider <kind>", "typesafe openrouter vercel cloudflare custom failproofai"],
+          ["--key-stdin", "Read the API key from stdin, or a prompt on a terminal"],
+          ["--key-from-env", "Store no key; read it from FAILPROOFAI_JEV_API_KEY"],
+          ["--token <token>", "The API key on the command line; prefer --key-stdin"],
+          ["--url <url>", "The API base URL; picks the provider from its host"],
+          ["--base-url <url>", "Override the API base; default clears it"],
+          ["--mode <m>", "enforce, observe (log Jev, enforce regex) or off"],
+          ["--model <id>", "Override the model id; default clears it"],
+          ["--account-id <id>", "Cloudflare account id, 32 hex characters"],
+          ["--timeout-ms <n>", "Time per call before falling back to regex (default 3000)"],
+          ["--json", "Print JSON (status, test and models)"],
+        ],
+        examples: [
+          "failproofai jev setup --provider typesafe --key-stdin < key.txt",
+          "failproofai jev setup --mode observe",
+          "failproofai jev test",
         ],
       });
       process.exit(0);
@@ -1050,36 +1037,10 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "migrate",
-        tagline: "bring ~/.failproofai up to the layout this version speaks",
-        sections: [
-          { label: "usage", entries: [["failproofai migrate [--dry-run]"]] },
-          {
-            label: "why",
-            lines: [
-              "npm cannot update an installed package on its own, so a machine can sit",
-              "on an old version for months and then jump several layouts at once. This",
-              "runs the steps for that jump in order, keyed on the LAYOUT recorded in",
-              "~/.failproofai/VERSION rather than on the npm version — so skipping",
-              "thirty releases with no layout change runs nothing at all.",
-              "",
-              "It normally happens by itself, on the first command after an upgrade.",
-              "This is for running it deliberately, and for seeing what it would do",
-              "first.",
-              "",
-              "Your settings, cloud enrolment, policy selection, your own policy files,",
-              "decision history and undelivered events are carried across, not removed.",
-              "The irreplaceable files are copied to migrations/backup-layout<n>/ before",
-              "anything runs, and every step is recorded in migrations/applied.json.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--dry-run", "Print the steps and the files it would save. Change nothing."],
-            ],
-          },
-        ],
+        name: "migrate",
+        usage: [["failproofai migrate", "Bring ~/.failproofai up to this version's layout"]],
+        options: [["--dry-run", "Show the steps, change nothing"]],
+        optionsCol: 20,
       });
       process.exit(0);
     }
@@ -1088,7 +1049,7 @@ async function runCli() {
     const unknown = subArgs.find((a) => a.startsWith("-") && !KNOWN.has(a));
     if (unknown) {
       throw new CliError(
-        `Unexpected argument: ${unknown}\nRun \`failproofai migrate --help\` for usage.`,
+        `Unexpected argument: ${unknown}.\nRun  \`failproofai migrate --help\`  for usage.`,
       );
     }
 
@@ -1136,11 +1097,13 @@ async function runCli() {
       (step) => `  ${step.ok ? "migrated" : "FAILED  "} layout ${step.from} → ${step.to}`,
     );
     if (run.backedUp.length > 0) report.push("", `Saved first: ${run.backedUp.join(", ")}`);
+    // The failing step is marked where it is: the backup line comes first, and
+    // left to printReport's guess it took the ✕ with the error indented under it.
     if (run.failed) {
       report.push(
         "",
-        `Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
-        `The home is still marked layout ${from} and will be retried.`,
+        `✕ Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
+        `  The home is still marked layout ${from} and will be retried.`,
       );
     }
     await printReport("migrate", report, {
@@ -1162,36 +1125,10 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "update",
-        tagline: "finish an upgrade: migrate the home, match the daemon",
-        sections: [
-          {
-            label: "usage",
-            entries: [["npm install -g failproofai@latest && failproofai update [--no-daemon]"]],
-          },
-          {
-            label: "why",
-            lines: [
-              "npm replaces the CLI and nothing else. The daemon binary lives at",
-              "~/.failproofai/bin/failproofaid-<version> and stays exactly where it was,",
-              "so after an npm upgrade the two halves are different versions — and",
-              "failproofaid refuses to start against a layout it does not speak, which",
-              "is the loud version of that problem rather than the silent one.",
-              "",
-              "This does the rest of the upgrade: runs any pending layout migrations,",
-              "puts the matching daemon binary in place, and restarts the service.",
-              "Hermes profiles already using failproofai are moved to the linked",
-              "native plugin (legacy shell hooks never checked Hermes cron jobs).",
-              "Exits non-zero when any half could not be brought current.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--no-daemon", "Migrate the home only. Leaves a version-skewed daemon in place, so prefer letting it run."],
-            ],
-          },
-        ],
+        name: "update",
+        usage: [["npm i -g failproofai@latest && failproofai update"]],
+        options: [["--no-daemon", "Migrate everything but leave the daemon as is"]],
+        optionsCol: 20,
       });
       process.exit(0);
     }
@@ -1200,7 +1137,7 @@ async function runCli() {
     const unknown = subArgs.find((a) => a.startsWith("-") && !KNOWN.has(a));
     if (unknown) {
       throw new CliError(
-        `Unexpected argument: ${unknown}\nRun \`failproofai update --help\` for usage.`,
+        `Unexpected argument: ${unknown}.\nRun  \`failproofai update --help\`  for usage.`,
       );
     }
 
@@ -1242,11 +1179,14 @@ async function runCli() {
         report.push(`  ${step.ok ? "migrated" : "FAILED  "} layout ${step.from} → ${step.to}`);
       }
       if (run.backedUp.length > 0) report.push("", `Saved first: ${run.backedUp.join(", ")}`);
+      // Each failing half marks its own line (the daemon's lines arrive with
+      // their ✕ already): the report opens on whatever ran first, often a
+      // success, and printReport's guess would put the ✕ there.
       if (run.failed) {
         report.push(
           "",
-          `Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
-          `The home is still marked layout ${state.found} and will be retried.`,
+          `✕ Step ${run.failed.from} → ${run.failed.to} did not finish: ${run.failed.error}`,
+          `  The home is still marked layout ${state.found} and will be retried.`,
         );
       }
     } else {
@@ -1285,19 +1225,22 @@ async function runCli() {
       const hermesResult = await runHermesUpdateMigration({
         daemonSupportsPolicyEvaluation: () => svc.probeDaemonPolicyEvaluation(),
       });
-      if (hermesResult.lines.length > 0) report.push("", ...hermesResult.lines);
+      if (hermesResult.lines.length > 0) {
+        // Its lines open on a "Hermes:" heading over one row per profile; on a
+        // failure the heading carries the ✕ and the rows say which profile.
+        const [heading, ...rest] = hermesResult.lines;
+        report.push("", hermesResult.ok ? heading : `✕ ${heading}`, ...rest);
+      }
       hermesOk = hermesResult.ok;
       hermesMigrated = hermesResult.profiles.filter((p) => p.status === "migrated").length;
     } catch (err) {
-      report.push("", `Hermes migration failed: ${err instanceof Error ? err.message : String(err)}`);
+      report.push("", `✕ Hermes migration failed: ${err instanceof Error ? err.message : String(err)}`);
       hermesOk = false;
     }
 
     const updateOk = daemonOk && !migrationFailed && hermesOk;
-    await printReport("update", report, {
-      ok: updateOk,
-      meta: `v${version}`,
-    });
+    // No `v${version}` meta: the header already names the version.
+    await printReport("update", report, { ok: updateOk });
     await track("cli_update", {
       ok: updateOk,
       migrations: migrationsRan,
@@ -1314,39 +1257,15 @@ async function runCli() {
     const subArgs = args.slice(1);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "uninstall",
-        tagline: "remove failproofai from this machine",
-        sections: [
-          { label: "usage", entries: [["failproofai uninstall [--purge] [--dry-run] [--yes]"]] },
-          {
-            label: "what it removes",
-            lines: [
-              "• failproofai hook entries from every agent CLI that has them",
-              "• the failproofaid daemon service — ASKED on a plain uninstall (kept",
-              "  unless you say yes); always removed with --purge, which prompts for",
-              "  your password rather than printing commands to paste",
-              "• the \"require the daemon\" flag — cleared FIRST, so a partial uninstall",
-              "  can never leave this machine denying every tool call",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--purge", "Also delete ~/.failproofai — settings, credentials, audit history and the downloaded daemon binary. Off by default so a reinstall keeps your history."],
-              ["--dry-run", "Print what would be removed and change nothing."],
-              ["--yes, -y", "Skip the confirmation prompt. Required when there is no TTY."],
-            ],
-          },
-          {
-            label: "why this exists",
-            lines: [
-              "npm runs no uninstall script, so `npm rm -g failproofai` removes the",
-              "package and leaves the hook entries and the service behind. Run this",
-              "first, then:",
-              "    npm rm -g failproofai",
-            ],
-          },
+        name: "uninstall",
+        usage: [["failproofai uninstall [options]"]],
+        options: [
+          ["--purge", "Also delete ~/.failproofai: settings, keys and history"],
+          ["--dry-run", "Show what would be removed, change nothing"],
+          ["--yes, -y", "Skip confirmation, remove the daemon; needed without a TTY"],
         ],
+        examples: ["failproofai uninstall && npm rm -g failproofai"],
+        optionsCol: 20,
       });
       process.exit(0);
     }
@@ -1355,79 +1274,47 @@ async function runCli() {
     const unknown = subArgs.find((a) => !KNOWN.has(a));
     if (unknown) {
       throw new CliError(
-        `Unexpected argument: ${unknown}\nRun \`failproofai uninstall --help\` for usage.`,
+        `Unexpected argument: ${unknown}.\nRun  \`failproofai uninstall --help\`  for usage.`,
       );
     }
 
     lastSubcommand = "uninstall_command";
     const { runUninstallCommand } = await import("../src/hooks/uninstall-cli");
+    const { screenKit, optsFor, printBlock, stack } = await import("../src/hooks/tui");
     const purge = subArgs.includes("--purge");
     const dryRun = subArgs.includes("--dry-run");
     const yes = subArgs.includes("--yes") || subArgs.includes("-y");
+    const render = optsFor(process.stdout);
+    const kit = screenKit(render);
 
-    // Set only when the prompt actually rendered the plan, which is the one
-    // case where printing it again would duplicate it.
+    // Set only when the question was actually asked, which is the one case
+    // where the plan is already on screen and printing it again would
+    // duplicate it.
     let planWasShown = false;
     const result = await runUninstallCommand({
       purge,
       dryRun,
       yes,
       cwd: process.cwd(),
-      // Only offered when a person can actually answer. Without a TTY the
-      // command requires --yes rather than assuming consent — see the module.
+      render,
+      // ONE question (D17): the plan says exactly what goes, and `y` removes all
+      // of it, the daemon service included — the same thing `--yes` does. Only
+      // offered when a person can actually answer: without a TTY the command
+      // requires --yes rather than assuming consent — see the module.
       confirm: process.stdin.isTTY
         ? async (planLines) => {
             planWasShown = true;
-            const { selectOne } = await import("../src/hooks/tui");
-            // "No" first, so the default landing position on Enter is the
-            // non-destructive one.
-            const answer = await selectOne({
-              message: purge
-                ? "Remove failproofai and DELETE ~/.failproofai?"
-                : "Remove failproofai from this machine?",
-              body: planLines,
-              choices: [
-                { label: "No, cancel", value: false },
-                { label: purge ? "Yes, remove and purge" : "Yes, remove it", value: true },
-              ],
-            });
-            return answer === true;
+            process.stdout.write(["", kit.header("Uninstall"), "", ...planLines].join("\n") + "\n");
+            return kit.confirm({ stdin: process.stdin, stdout: process.stdout });
           }
         : undefined,
-      // Only on a plain uninstall: `--purge` removes the service unconditionally
-      // because it deletes the binary the service points at. Absent without a TTY,
-      // which the module reads as "keep it".
-      confirmDaemon:
-        process.stdin.isTTY && !purge
-          ? async () => {
-              const { selectOne } = await import("../src/hooks/tui");
-              const answer = await selectOne({
-                message: "Remove the failproofaid background service too?",
-                body: [
-                  "It runs as a system service and needs sudo to remove, so you",
-                  "will be asked for your password.",
-                  "",
-                  "Keeping it is fine if you plan to reinstall — the hooks are",
-                  "already gone either way, so nothing is being enforced.",
-                ],
-                choices: [
-                  { label: "Yes, remove the service", value: true },
-                  { label: "No, leave it installed", value: false },
-                ],
-              });
-              return answer === true;
-            }
-          : undefined,
     });
 
-    // The prompt already rendered the plan as its body; re-printing it would
-    // show the same block twice. `planLines` is reported by the command rather
-    // than guessed from the text — see UninstallResult.
-    const skip = planWasShown ? result.planLines : 0;
-    await printReport("uninstall", result.lines.slice(skip), {
-      ok: result.exitCode === 0,
-      meta: subArgs.includes("--purge") ? "purge" : subArgs.includes("--dry-run") ? "dry run" : undefined,
-    });
+    // The question already printed the header and the plan; the outcome goes
+    // under it. `planLines` is reported by the command rather than guessed from
+    // the text — see UninstallResult.
+    const outcome = planWasShown ? result.lines.slice(result.planLines) : [kit.header("Uninstall"), "", ...result.lines];
+    printBlock(result.exitCode === 0 ? process.stdout : process.stderr, stack(outcome));
     // NOT after a purge. `track` resolves the instance id, and `getInstanceId()`
     // lazily WRITES ~/.failproofai/state/telemetry-id — which re-created the
     // whole directory seconds after the purge deleted it, leaving a machine the
@@ -1460,171 +1347,30 @@ async function runCli() {
     // made the one documented command the only one that did nothing.
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       await printHelp({
-        command: "publish",
-        tagline: "ship your policies as a pack anyone can install",
-        sections: [
-          {
-            label: "two commands, from nothing",
-            entries: [
-              ["failproofai publish --init", "write a policy to start from"],
-              ["failproofai publish", "ship it"],
-            ],
-            after: [
-              "Write your policies in a git repo, run publish, answer one question,",
-              "done. It asks WHERE only when nothing tells it — no remote to read —",
-              "and works the rest out: which files hold policies, what version is",
-              "next, who you are. Every flag below overrides something it would",
-              "otherwise decide. None is required, and on a pipe or in CI the flags",
-              "are all there is: nothing prompts where nobody can answer.",
-            ],
-          },
-          {
-            label: "what --init does",
-            lines: [
-              "Asks what the pack is called, writes <name>.mjs, and stops. No network,",
-              "no git, nothing published. The file is not a template with blanks — it",
-              "is one policy that already blocks git push --force, so the first thing",
-              "you do is edit something that works. It refuses rather than overwriting",
-              "a file that exists.",
-              "",
-              "Then try it on THIS machine, before anyone else can see it:",
-              "",
-              "    failproofai policies -i -c ./<name>.mjs",
-              "",
-              "That enforces the file right now — any path, any filename. Ask your",
-              "agent to do the thing you blocked and watch it get refused. Nothing is",
-              "published and nobody else is affected.",
-            ],
-          },
-          {
-            label: "what publish does",
-            lines: [
-              "In order, stopping before it touches GitHub if anything is wrong:",
-              "",
-              "1  Finds the policy file here by CONTENT — one that imports failproofai",
-              "   and calls customPolicies.add — not by filename, so it finds",
-              "   guards.mjs and ignores an unrelated policies.mjs. Not recursive:",
-              "   publishing a fixture is worse than being asked. Two candidates and",
-              "   it lists them.",
-              "2  Reads the repo from git remote get-url origin, in the FILE's",
-              "   directory rather than yours, and decides the version (see below).",
-              "3  Finds your credential: GITHUB_TOKEN, GH_TOKEN, or gh auth login.",
-              "   Needs release-write and nothing else. Never printed.",
-              "4  Creates the repository if it does not exist — public, see below.",
-              "5  Builds the three assets, validating with the LOADER's own rules: the",
-              "   code that decides what may install on a stranger's machine. A pack",
-              "   that could never install fails here, where you can fix it.",
-              "6  Creates or reuses the release and uploads, replacing assets of the",
-              "   same name — the install URL is built from fixed names, so a stale",
-              "   copy is what somebody would fetch.",
-            ],
-          },
-          {
-            label: "how the version is decided",
-            lines: [
-              "The commit you are publishing from — its short sha, twelve",
-              "characters: a1b2c3d4e5f6. Nothing to pick, nothing to count, and it",
-              "names exactly where the bytes came from. Publish the same source",
-              "twice and you get the same version, because there is nothing to",
-              "increment.",
-              "",
-              "Twelve rather than git's seven: seven collides in a repository with",
-              "enough objects, and a version that stops being unique means two",
-              "artifacts claiming one name. The full sha is recorded beside it.",
-              "",
-              "Read from the tree in front of you, never from the repository's",
-              "releases, so a fresh clone and an air-gapped machine compute the",
-              "same answer and neither has to ask GitHub what happened before.",
-              "",
-              "It REFUSES rather than guessing, in two cases, because the version",
-              "claims to name a commit and must not be minted where that is false:",
-              "",
-              "  no git checkout        there is no commit to name",
-              "  uncommitted changes    those bytes are not in that commit",
-              "",
-              "--version overrides both, and a tag on HEAD wins over the sha —",
-              "someone who tagged v1.2.0 has SAID what this release is.",
-              "",
-              "A sha does not order. `policies show <owner>/<repo> --releases` is",
-              "where you see which came first, newest at the top.",
-            ],
-          },
-          {
-            label: "what a release records",
-            lines: [
-              "The commit you published from, when you are in a git checkout, in the",
-              "manifest and in the release notes. Provenance, not verification —",
-              "the artifact digest is still the only thing that decides whether the",
-              "bytes are the ones that were published. It answers the question a",
-              "digest cannot: which source produced them.",
-              "",
-              "Which is also how anyone installs that exact release:",
-              "",
-              "    failproofai policies add <owner>/<repo>@a1b2c3d",
-              "",
-              "and read the whole history with:",
-              "",
-              "    failproofai policies show <owner>/<repo> --releases",
-            ],
-          },
-          {
-            // This screen said "an existing private one still publishes, and
-            // warns" for as long as that was true. It is REFUSED now — exit 1,
-            // nothing created or uploaded — and `--allow-private` was named
-            // nowhere in this help, so the one documented behaviour pointed a
-            // publisher at a command that exits 1 and gave them no way through.
-            label: "the repo must be public",
-            lines: [
-              "Installs are anonymous HTTPS with no credential to offer, so a private",
-              "repository publishes to nobody. A repo created here is public for that",
-              "reason; an existing private one is REFUSED, before anything is built,",
-              "created or uploaded. --allow-private publishes to one anyway, for",
-              "somebody who will hand the three assets over another way — it still",
-              "says plainly that no `policies add` can reach them.",
-              "",
-              "Only the release matters. Installs read releases/download/<tag>/<asset>",
-              "and never touch your git tree — pushing the source is for humans.",
-            ],
-          },
-          {
-            label: "your policy files",
-            lines: [
-              "Write as many as you like — one per category reads well. Every file",
-              "here that registers policies is bundled into the single artifact a pack",
-              "has to be: only the entry is digest-pinned, and a pack importing",
-              "siblings could not honestly claim to be verified. Bundling needs bun;",
-              "without it, name one self-contained file.",
-              "",
-              "Each policy may carry category and defaultEnabled alongside the usual",
-              "fields. category is what --category selects on; defaultEnabled is what",
-              "a bare `policies add` switches on, and it defaults to false.",
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["--init [file]", "Write a starter policy and stop."],
-              ["--repo <owner>/<repo>", "Where to release it, created if missing."],
-              ["--version <version>", "Name the version, instead of the commit it was built from."],
-              ["--id <publisher/name>", "The pack's id. Defaults to --repo."],
-              ["--tag <tag>", "Release tag. Defaults to the version; v prefix ok."],
-              ["--notes <text>", "Release notes."],
-              ["--out <dir>", "Where to write the assets. Default: dist-pack."],
-              ["--effect <effect>", "enforce or observe. observe records and blocks nothing. Default: enforce."],
-              ["--dry-run", "Build the assets, publish nothing. No credential."],
-              ["--allow-private", "Publish to an already-private repo anyway. Nobody can install it."],
-            ],
-          },
-          {
-            label: "examples",
-            lines: [
-              "failproofai publish --init",
-              "failproofai publish",
-              "failproofai publish --dry-run",
-              "failproofai publish ./guards.mjs --repo me/guards --version 2.0.0",
-            ],
-          },
+        name: "publish",
+        usage: [
+          ["failproofai publish --init [file]", "Write a starter policy file"],
+          ["failproofai publish [file]", "Build and release it on GitHub"],
         ],
+        options: [
+          ["--repo <owner/repo>", "Where to release, created if missing (default: origin)"],
+          ["--version <v>", "Name the version (default: HEAD's tag, else short sha)"],
+          ["--id <publisher/name>", "The pack id (default: the repo)"],
+          ["--tag <tag>", "Release tag (default: the version, v prefix ok)"],
+          ["--notes <text>", "Release notes (default: policy counts and the commit)"],
+          ["--out <dir>", "Where to write the assets (default: dist-pack)"],
+          ["--effect <e>", "enforce (default), or observe: record without blocking"],
+          ["--min-cli-version <v>", "Oldest failproofai version that may install it"],
+          ["--dry-run", "Build the assets and publish nothing"],
+          ["--allow-private", "Publish to a private repo anyway; installs will fail"],
+          ["--entry <file>", "The policy file, same as [file]"],
+        ],
+        examples: [
+          "failproofai publish --init guards",
+          "failproofai policies -i -c ./guards.mjs",
+          "failproofai publish --repo me/guards",
+        ],
+        optionsCol: 24,
       });
       process.exit(0);
     }
@@ -1659,81 +1405,7 @@ async function runCli() {
     const subArgs = args.slice(1);
 
     if (subArgs.length === 0 || subArgs.includes("--help") || subArgs.includes("-h")) {
-      await printHelp({
-        command: "policies add|remove|show",
-        tagline: "choose what your agents may do",
-        sections: [
-          {
-            label: "usage",
-            // Without the `failproofai policies` prefix, which the heading two
-            // lines up already carries: repeating it costs 21 of the 80 columns
-            // on every row and pushes each description into a second line. The
-            // examples below are the copy-pasteable spelling.
-            entries: [
-              ["add", "Pick from what is installed here"],
-              ["add <name>", "Turn one policy on"],
-              ["add <owner>/<repo>", "Install someone's pack"],
-              ["remove <name>", "Turn one policy off"],
-              ["remove <pack-id>", "Uninstall a pack"],
-              ["show <owner>/<repo>", "What a pack contains, before you take it"],
-              ["show <owner>/<repo> --releases", "Every version it has published, and which one is here"],
-            ],
-          },
-          {
-            label: "a name or a source",
-            lines: [
-              "Anything with a slash is a pack source; anything without is a policy",
-              "name. Policy names cannot contain a slash, so there is nothing to guess.",
-              "",
-              "  block-sudo                               a policy",
-              "  FailproofAI/policies                     our pack, like any other",
-              "  acme/deploy-guard                        newest release, pinned",
-              "  acme/deploy-guard@a1b2c3d4e5f6           that release",
-              "  acme/deploy-guard@a1b2c3d                the release built from",
-              "                                           that commit",
-              "  github:acme/deploy-guard@a1b2c3d4e5f6    same, explicit",
-              "  https://github.com/acme/x/releases/tag/v2   the URL you copied",
-            ],
-          },
-          {
-            label: "choosing part of a pack",
-            entries: [
-              ["--policy a,b", "exactly these (comma-separated or repeated)"],
-              ["--category x,y", "whole categories (failproofai policies show <source>)"],
-              ["--all", "everything it contains"],
-            ],
-          },
-          {
-            label: "options (policy names only)",
-            entries: [
-              ["--cli <agent>...", "Agent CLI(s) to apply to; space-separated or repeated. Omit to detect installed CLIs and prompt."],
-              ["--scope user|project|local", "Config scope. Default: user."],
-              ["--beta", "Allow beta policies"],
-            ],
-          },
-          {
-            label: "examples",
-            lines: [
-              "failproofai policies add",
-              "failproofai policies add block-sudo",
-              "failproofai policies add sanitize-api-keys --scope project",
-              "failproofai policies add FailproofAI/policies --category sanitize,git",
-              "failproofai policies add acme/deploy-guard --policy block-prod-deploy",
-              "failproofai policies show acme/deploy-guard",
-              "failproofai policies remove block-sudo",
-            ],
-          },
-        ],
-        footer: [
-          "With no flags you get the pack's own defaults and are shown the rest.",
-          "Re-adding at a newer version keeps what you chose.",
-          "Agents: claude, codex, copilot, cursor, opencode, pi, hermes, openclaw,",
-          "factory, devin, antigravity, goose.",
-          "Publishing your own: failproofai publish --help",
-          "Offline: FAILPROOFAI_NO_DOWNLOAD=1 refuses to fetch; packs already",
-          "installed keep enforcing. FAILPROOFAI_PACK_BASE_URL points it at a mirror.",
-        ],
-      });
+      await printHelp(POLICIES_HELP);
       process.exit(0);
     }
 
@@ -1785,8 +1457,8 @@ async function runCli() {
     if (action === "show" || looksLikeSource) {
       if (action === "show" && !firstPositional) {
         throw new CliError(
-          "Usage: failproofai policies show <owner>/<repo>\n" +
-          "Run `failproofai policies` to see what is already installed here.",
+          "Name the pack to show, as <owner>/<repo>.\n" +
+          "To see what is installed here, run  `failproofai policies`",
         );
       }
       // One lane, one implementation. `show` is the pack lane's remote preview,
@@ -1809,44 +1481,22 @@ async function runCli() {
       return;
     }
 
-    if (action !== "add" && action !== "remove") {
-      throw new CliError(
-        `Unknown policies subcommand: ${action}\n` +
-        `Run \`failproofai policies --help\` for usage.`,
-      );
-    }
-
+    // `show` left above, so only add and remove reach here. A branch for any
+    // other word stood here, unreachable: this lane is entered for those three.
+    const validScopes = action === "remove"
+      ? ["user", "project", "local", "all"]
+      : ["user", "project", "local"];
     const scopeIdx = rest.indexOf("--scope");
     const scope = scopeIdx >= 0 ? rest[scopeIdx + 1] : "user";
     if (scopeIdx >= 0 && (!scope || scope.startsWith("-"))) {
-      throw new CliError("Missing value for --scope. Valid values: user, project, local");
+      throw new CliError(`Missing value for --scope.\nUse one of: ${validScopes.join(", ")}`);
     }
-    const validScopes = action === "remove"
-      ? ["user", "project", "local", "all"]
-      : ["user", "project", "local"];
     if (scopeIdx >= 0 && !validScopes.includes(scope)) {
-      throw new CliError(`Invalid scope: ${scope}. Valid values: ${validScopes.join(", ")}`);
+      throw new CliError(`Invalid scope: ${scope}.\nUse one of: ${validScopes.join(", ")}`);
     }
 
     // --cli accepts one or more space-separated values, optionally repeated.
-    const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
-    const cliFlagValues = [];
-    const cliConsumedIdxs = new Set();
-    const cliFlagIdxs = rest.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
-    for (const idx of cliFlagIdxs) {
-      let consumed = 0;
-      for (let j = idx + 1; j < rest.length; j++) {
-        const v = rest[j];
-        if (v.startsWith("-")) break;
-        if (!VALID_CLIS.has(v)) break;
-        cliFlagValues.push(v);
-        cliConsumedIdxs.add(j);
-        consumed++;
-      }
-      if (consumed === 0) {
-        throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi hermes openclaw (or any subset)");
-      }
-    }
+    const { cliFlagValues, cliConsumedIdxs } = await readCliFlag(rest);
 
     const includeBeta = rest.includes("--beta");
 
@@ -1854,7 +1504,17 @@ async function runCli() {
     const knownFlags = new Set(["--scope", "--cli", "--beta"]);
     const unknownFlag = rest.find((a) => a.startsWith("-") && !knownFlags.has(a));
     if (unknownFlag) {
-      throw new CliError(`Unknown flag: ${unknownFlag}\nRun \`failproofai policy --help\` for usage.`);
+      // -c is on the shared help page, for --install and --uninstall; pointing
+      // back at that page answered the question with itself.
+      const custom = unknownFlag === "-c" || unknownFlag === "--custom";
+      throw new CliError(
+        `Unknown flag: ${unknownFlag}.\n` +
+          (custom
+            ? action === "add"
+              ? "Add a custom policy file with  `failproofai policies --install -c <file>`"
+              : "Remove custom policy files with  `failproofai policies --uninstall -c`"
+            : `Run  \`failproofai policies ${action} --help\`  for usage.`),
+      );
     }
 
     // Positional policy names = anything not consumed by --scope / --cli.
@@ -1879,8 +1539,8 @@ async function runCli() {
     }
     if (positional.length > 1) {
       throw new CliError(
-        `\`policy ${action}\` takes exactly one policy name (got ${positional.length}).\n` +
-        `For multiple policies use \`failproofai policies --${action === "add" ? "install" : "uninstall"} ${positional.join(" ")}\`.`,
+        `policies ${action} takes one policy name, not ${positional.length}.\n` +
+        `For several, run  \`failproofai policies --${action === "add" ? "install" : "uninstall"} ${positional.join(" ")}\``,
       );
     }
     const policyName = positional[0];
@@ -1892,6 +1552,9 @@ async function runCli() {
     );
 
     lastPolicyAction = action;
+    // `syncAgentSelection` on both: an agent hooked here is traced, and one
+    // unhooked at user scope (`policies remove all`) is not, so the next
+    // `failproofai config` neither undoes nor resurrects what this ran.
     if (action === "add") {
       const { installHooks } = await import("../src/hooks/manager");
       await installHooks(
@@ -1903,6 +1566,7 @@ async function runCli() {
         undefined,
         false,
         cli,
+        { syncAgentSelection: true },
       );
       await track("cli_policy_add_success", {
         scope,
@@ -1923,7 +1587,7 @@ async function runCli() {
         [policyName],
         scope,
         undefined,
-        { betaOnly: false, removeCustomHooks: false, cli },
+        { betaOnly: false, removeCustomHooks: false, cli, syncAgentSelection: true },
       );
       await track("cli_policy_remove_success", {
         scope,
@@ -1945,63 +1609,7 @@ async function runCli() {
     const isHelp      = subArgs.includes("--help")       || subArgs.includes("-h");
 
     if (isHelp) {
-      await printHelp({
-        command: "policies",
-        tagline: "manage the policies your agents run under",
-        sections: [
-          {
-            label: "usage",
-            entries: [
-              ["(bare)", "List every policy here and whether it is on"],
-              ["add [what]", "Turn one on, take a pack, or pick from a list"],
-              ["remove <what>", "Turn one off, or uninstall a pack"],
-              ["show <owner>/<repo>", "What a pack holds, before you take it"],
-              ["--install, -i", "Wire policies into your agent CLIs"],
-              ["--uninstall, -u", "Unwire them, or strip the hooks"],
-            ],
-          },
-          {
-            label: "options",
-            entries: [
-              ["[names...]", "Policy names. Omit for the interactive picker."],
-              ["--cli <agent>...", "Agent CLI(s); space-separated or repeated. Omit to detect what is installed and prompt."],
-              ["--scope <scope>", "user, project or local. Default: user. --uninstall also takes all."],
-              ["--beta", "Include beta policies. On --uninstall, only those."],
-              ["--custom, -c <path>", "Custom policy file; repeat for several. Bare on --uninstall, clears every explicit path."],
-            ],
-          },
-          {
-            // Enumerated ONCE. It used to be spelled out in full four times on
-            // this screen — twice in the --cli lines, twice more as examples
-            // differing only in which agent they named.
-            label: "agents",
-            lines: [
-              "claude, codex, copilot, cursor, opencode, pi, hermes, openclaw,",
-              "factory, devin, antigravity, goose",
-              "",
-              "Codex, Copilot, Cursor, OpenCode and Pi take user or project scope only.",
-            ],
-          },
-          {
-            label: "examples",
-            lines: [
-              "failproofai policies",
-              "failproofai policies --install",
-              "failproofai policies --install block-sudo sanitize-api-keys",
-              "failproofai policies --install --cli codex --scope project",
-              "failproofai policies --install --cli claude codex copilot cursor",
-              "failproofai policies -i -c ./my-policies.js",
-              "failproofai policies --uninstall block-sudo",
-              "failproofai policies -u",
-              "failproofai policies add FailproofAI/policies --category git,database",
-            ],
-          },
-        ],
-        footer: [
-          "policy, pack and p are all spellings of policies.",
-          "add, remove and show in full:  failproofai policies add --help",
-        ],
-      });
+      await printHelp(POLICIES_HELP);
       process.exit(0);
     }
 
@@ -2013,10 +1621,10 @@ async function runCli() {
       const scopeIdx = subArgs.indexOf("--scope");
       const scope = scopeIdx >= 0 ? subArgs[scopeIdx + 1] : "user";
       if (scopeIdx >= 0 && (!scope || scope.startsWith("-"))) {
-        throw new CliError("Missing value for --scope. Valid values: user, project, local");
+        throw new CliError("Missing value for --scope.\nUse one of: user, project, local");
       }
       if (scopeIdx >= 0 && !["user", "project", "local"].includes(scope)) {
-        throw new CliError(`Invalid scope: ${scope}. Valid values: user, project, local`);
+        throw new CliError(`Invalid scope: ${scope}.\nUse one of: user, project, local`);
       }
 
       const customIdxs = subArgs
@@ -2024,33 +1632,16 @@ async function runCli() {
         .filter((index) => index >= 0);
       const customPoliciesPaths = customIdxs.map((index) => subArgs[index + 1]);
       if (customPoliciesPaths.some((path) => !path || path.startsWith("-"))) {
-        throw new CliError("Missing path after --custom/-c\nUsage: --custom <path>  (e.g. --custom ./my-policies.js)");
+        throw new CliError("Missing path after --custom/-c.\nFor example:  `failproofai policies -i -c ./my-policies.js`");
       }
 
       // --cli accepts one or more space-separated values, optionally repeated:
       //   --cli claude codex copilot
       //   --cli claude --cli codex
-      // Values are consumed greedily until the next flag or end of argv.
-      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
-      const cliFlagValues = [];
-      const cliConsumedIdxs = new Set();
-      const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
-      for (const idx of cliFlagIdxs) {
-        let consumed = 0;
-        for (let j = idx + 1; j < subArgs.length; j++) {
-          const v = subArgs[j];
-          if (v.startsWith("-")) break;
-          // Stop at the first non-CLI token so a policy name following --cli
-          // (e.g. `--cli claude block-sudo`) is not mis-consumed as a CLI.
-          if (!VALID_CLIS.has(v)) break;
-          cliFlagValues.push(v);
-          cliConsumedIdxs.add(j);
-          consumed++;
-        }
-        if (consumed === 0) {
-          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi hermes openclaw (or any subset)");
-        }
-      }
+      // Values are consumed greedily until the next flag, or the first word that
+      // is not an agent so a policy name following --cli (e.g. `--cli claude
+      // block-sudo`) is not mis-consumed as one.
+      const { cliFlagValues, cliConsumedIdxs } = await readCliFlag(subArgs);
 
       const includeBeta = subArgs.includes("--beta");
 
@@ -2064,7 +1655,7 @@ async function runCli() {
       const flags = new Set(["--install", "-i", "--scope", "--beta", "--custom", "-c", "--cli"]);
       const unknownInstallFlag = subArgs.find((a) => a.startsWith("-") && !flags.has(a));
       if (unknownInstallFlag) {
-        throw new CliError(`Unknown flag: ${unknownInstallFlag}\nRun \`failproofai policies --help\` for usage.`);
+        throw new CliError(`Unknown flag: ${unknownInstallFlag}.\nRun  \`failproofai policies --help\`  for usage.`);
       }
 
       const explicitPolicyNames = subArgs.filter(
@@ -2084,6 +1675,8 @@ async function runCli() {
         "install",
       );
 
+      // An agent hooked here is traced from now on, so the next
+      // `failproofai config` keeps these hooks instead of taking them out.
       await installHooks(
         policyNames,
         scope,
@@ -2093,6 +1686,7 @@ async function runCli() {
         customPoliciesPaths.length > 0 ? customPoliciesPaths : undefined,
         false,
         cli,
+        { syncAgentSelection: true },
       );
       await track("cli_install_success", {
         scope,
@@ -2113,33 +1707,14 @@ async function runCli() {
       const scopeIdx = subArgs.indexOf("--scope");
       const scope = scopeIdx >= 0 ? subArgs[scopeIdx + 1] : "user";
       if (scopeIdx >= 0 && (!scope || scope.startsWith("-"))) {
-        throw new CliError("Missing value for --scope. Valid values: user, project, local, all");
+        throw new CliError("Missing value for --scope.\nUse one of: user, project, local, all");
       }
       if (scopeIdx >= 0 && !["user", "project", "local", "all"].includes(scope)) {
-        throw new CliError(`Invalid scope: ${scope}. Valid values: user, project, local, all`);
+        throw new CliError(`Invalid scope: ${scope}.\nUse one of: user, project, local, all`);
       }
 
       // --cli accepts one or more space-separated values; same parser as install.
-      const VALID_CLIS = new Set(["claude", "codex", "copilot", "cursor", "opencode", "pi", "hermes", "openclaw", "factory", "devin", "antigravity", "goose"]);
-      const cliFlagValues = [];
-      const cliConsumedIdxs = new Set();
-      const cliFlagIdxs = subArgs.map((a, i) => (a === "--cli" ? i : -1)).filter((i) => i >= 0);
-      for (const idx of cliFlagIdxs) {
-        let consumed = 0;
-        for (let j = idx + 1; j < subArgs.length; j++) {
-          const v = subArgs[j];
-          if (v.startsWith("-")) break;
-          // Stop at the first non-CLI token so a policy name following --cli
-          // (e.g. `--cli claude block-sudo`) is not mis-consumed as a CLI.
-          if (!VALID_CLIS.has(v)) break;
-          cliFlagValues.push(v);
-          cliConsumedIdxs.add(j);
-          consumed++;
-        }
-        if (consumed === 0) {
-          throw new CliError("Missing value(s) for --cli. Usage: --cli claude codex copilot cursor opencode pi hermes openclaw (or any subset)");
-        }
-      }
+      const { cliFlagValues, cliConsumedIdxs } = await readCliFlag(subArgs);
 
       const betaOnly = subArgs.includes("--beta");
       const removeCustomHooks = subArgs.includes("--custom") || subArgs.includes("-c");
@@ -2150,7 +1725,7 @@ async function runCli() {
       const flags = new Set(["--uninstall", "-u", "--scope", "--beta", "--custom", "-c", "--cli"]);
       const unknownUninstallFlag = subArgs.find((a) => a.startsWith("-") && !flags.has(a));
       if (unknownUninstallFlag) {
-        throw new CliError(`Unknown flag: ${unknownUninstallFlag}\nRun \`failproofai policies --help\` for usage.`);
+        throw new CliError(`Unknown flag: ${unknownUninstallFlag}.\nRun  \`failproofai policies --help\`  for usage.`);
       }
 
       const policyNames = subArgs.filter(
@@ -2162,11 +1737,13 @@ async function runCli() {
         "uninstall",
       );
 
+      // Hooks taken out at user scope or every scope stop the agent being
+      // traced; a project- or local-only removal leaves the selection alone.
       await removeHooks(
         policyNames.length > 0 ? policyNames : undefined,
         scope,
         undefined,
-        { betaOnly, removeCustomHooks, cli },
+        { betaOnly, removeCustomHooks, cli, syncAgentSelection: true },
       );
       await track("cli_uninstall_success", {
         scope,
@@ -2181,26 +1758,27 @@ async function runCli() {
 
     // Default: list policies
     // Accept --list as a no-op alias (common intuition), reject all other unknown flags
-    // and unexpected positional args (e.g. "hi").
-    const knownListFlags = new Set(["--install", "-i", "--uninstall", "-u", "--help", "-h", "--list"]);
+    // and unexpected positional args (e.g. "hi"). --all lists every policy instead of
+    // folding the off ones into one line per category.
+    const knownListFlags = new Set(["--install", "-i", "--uninstall", "-u", "--help", "-h", "--list", "--all"]);
     const unknownListArg = subArgs.find((a) => a.startsWith("-") && !knownListFlags.has(a));
     if (unknownListArg) {
       throw new CliError(
-        `Unknown flag: ${unknownListArg}\n` +
-        `Run \`failproofai policies --help\` for usage.`
+        `Unknown flag: ${unknownListArg}.\n` +
+        "Run  `failproofai policies --help`  for usage."
       );
     }
     const positionalArgs = subArgs.filter((a) => !a.startsWith("-"));
     if (positionalArgs.length > 0) {
       throw new CliError(
-        `Unexpected argument: ${positionalArgs[0]}\n` +
-        `Run \`failproofai policies --help\` for usage.`
+        `Unexpected argument: ${positionalArgs[0]}.\n` +
+        "Run  `failproofai policies --help`  for usage."
       );
     }
 
     lastSubcommand = "list";
     const { listHooks } = await import("../src/hooks/manager");
-    await listHooks();
+    await listHooks(undefined, { all: subArgs.includes("--all") });
     await track("cli_list_invoked", {});
     process.exit(0);
   }
@@ -2224,103 +1802,72 @@ async function runCli() {
   if (args[0] === "config") {
     if (args.includes("--help") || args.includes("-h")) {
       await printHelp({
-        command: "config",
-        tagline: "set this machine up",
-        sections: [
-          {
-            label: "usage",
-            entries: [
-              ["(bare)", "Guided setup: agents, daemon, cloud"],
-              ["--token <key>", "Set up and connect to Cloud, asking nothing"],
-              ["--status", "Connection, daemon version and pause state"],
-              ["--pause [<time>]", "Pause enforcement for one session"],
-              ["--resume [--all]", "End a pause early"],
-              ["--disconnect", "Stop pulling policy and sending activity"],
-              ["configure, setup", "Aliases for config"],
-            ],
-          },
-          {
-            label: "what it does",
-            lines: [
-              "Installs the failproofaid service (needs root once), wires hooks into",
-              "every agent CLI it supports, and optionally connects this machine to",
-              "Cloud. It chooses NO policies — take some with:",
-              "",
-              "    failproofai policies add <owner>/<repo>",
-            ],
-          },
-          {
-            label: "with no terminal (CI, containers, an agent driving it)",
-            lines: [
-              "It just runs. There is nothing to confirm when nobody is watching, so it",
-              "applies rather than asking — no flag needed.",
-              "",
-              "Exit 1 if anything it was asked to do did not happen — including a key",
-              "the server refused, and a machine that could not reach root. sudo is",
-              "never prompted for here; it either works without a password, or you are",
-              "told the exact commands to run.",
-            ],
-          },
-          {
-            label: "failproof cloud",
-            entries: [
-              ["--token <key>", "The API key. Passing one IS the request to connect."],
-              ["--url <url>", "Somewhere other than app.befailproof.ai"],
-              ["--machine-id <id>", "Defaults to a stable per-machine key"],
-              ["--machine-label <n>", "Dashboard name. Alone, renames a connected machine."],
-              ["--no-transcripts", "Decisions only, no session transcripts"],
-              ["--connect <url>", "Enrol only, on a machine already set up"],
-              ["--disconnect", "Stop pulling policy and sending activity"],
-            ],
-          },
-          {
-            label: "what connecting means",
-            lines: [
-              "The key can come from FAILPROOFAI_CLOUD_TOKEN instead of the command",
-              "line, and the url from FAILPROOFAI_CLOUD_URL — the same variable the",
-              "daemon reads. Prefer the environment: an argument is readable from `ps`",
-              "by every user on the box, and lands in shell history and CI logs.",
-              "",
-              "One connection, two capabilities: this machine PULLS centrally-managed",
-              "policies and SENDS what its hooks decided. Both are checked against the",
-              "server before anything is written, and reported separately — a key",
-              "carrying policies:pull but not events:add connects for policy and says",
-              "exactly why the dashboard is empty.",
-              "",
-              "Connecting sends BOTH policy decisions and full session transcripts. A",
-              "transcript carries prompts, file contents and whatever was pasted into a",
-              "terminal — that is the point of connecting, and it is stated here rather",
-              "than buried behind a flag nobody finds. Use --no-transcripts for",
-              "decisions only.",
-              "",
-              "Tokens are stored owner-only in ~/.failproofai/, never in the service",
-              "unit — that file is world-readable. Connecting needs no sudo.",
-            ],
-          },
-          {
-            label: "pausing enforcement (one session, always time-boxed)",
-            entries: [
-              ["--pause", "This directory's newest agent session, for 30m"],
-              ["--pause 10m", "A given time (max 8h; s/m/h, bare = minutes)"],
-              ["--resume", "End the pause early"],
-              ["--resume --all", "End every active pause"],
-              ["--session <id>", "Target a specific session"],
-              ["--status", "What is paused, and when it lifts"],
-            ],
-            after: [
-              "A pause suspends builtin, custom and convention policies for that",
-              "session only, and always expires on its own. Cloud-managed policies",
-              "keep enforcing.",
-            ],
-          },
+        name: "config",
+        usage: [["failproofai config [options]"]],
+        options: [
+          ["--token <key>", "Connect with this key; prefer FAILPROOFAI_CLOUD_TOKEN"],
+          ["--oss", "Use open source; leaves any connection as it is"],
+          ["--agents <a,b>", "Trace these agents, or all, without asking"],
+          ["--status", "Show the cloud connection, daemon version and pauses"],
+          ["--pause [time]", "Pause enforcement for a session (default 30m, max 8h)"],
+          ["--resume [--all]", "End a pause early, or every pause with --all"],
+          ["--session <id>", "Session to pause or resume (default: newest one here)"],
+          ["--connect <url>", "Connect to cloud only (for a machine already set up)"],
+          ["--disconnect", "Stop pulling policies and sending activity"],
+          ["--no-transcripts", "Send policy decisions only, not session transcripts"],
+          ["--url <url>", "Use a self-hosted cloud (or FAILPROOFAI_CLOUD_URL)"],
+          ["--machine-label <name>", "Rename this machine; with --token, set up under it"],
+          ["--machine-id <id>", "Machine id for --connect (default: a stable id)"],
+        ],
+        // The key never goes on the command line: config itself warns that argv
+        // lands in shell history and the process list.
+        examples: [
+          "read -rs FAILPROOFAI_CLOUD_TOKEN && export FAILPROOFAI_CLOUD_TOKEN",
+          "failproofai config",
+          "failproofai config --pause 1h",
         ],
-        footer: ["Prefer flags?  failproofai policies --help"],
+        optionsCol: 22,
       });
       process.exit(0);
       process.exit(0);
     }
     lastSubcommand = "config";
 
+    // Every option config takes. A typo used to fall through to the full setup
+    // run with the option ignored, so `--agent claude` asked every question.
+    //
+    // `--send-transcripts` is retired, not unknown: it was the transcript
+    // opt-in until transcripts became the default (#653), and provisioning
+    // scripts written then still pass it. Accepted, and does nothing.
+    const CONFIG_FLAGS = new Set([
+      "--token", "--oss", "--agents", "--status", "--pause", "--resume", "--all", "--session",
+      "--connect", "--disconnect", "--no-transcripts", "--url", "--machine-label", "--machine-id",
+      "--send-transcripts",
+    ]);
+    const CONFIG_VALUE_FLAGS = new Set([
+      "--token", "--agents", "--pause", "--session", "--connect", "--url", "--machine-label", "--machine-id",
+    ]);
+    const configRest = args.slice(1);
+    const strayConfig = configRest.find(
+      (a, i) => !CONFIG_FLAGS.has(a) && !(CONFIG_VALUE_FLAGS.has(configRest[i - 1]) && !a.startsWith("-")),
+    );
+    if (strayConfig) {
+      const asFlag = `--${strayConfig.replace(/^-+/, "")}`;
+      throw new CliError(
+        `Unexpected argument: ${strayConfig}.\n` +
+          (CONFIG_FLAGS.has(asFlag) && asFlag !== strayConfig
+            ? `Did you mean  \`failproofai config ${asFlag}\`?`
+            : "See its options:  `failproofai config --help`"),
+      );
+    }
+
+    if (args.includes("--send-transcripts") && args.includes("--no-transcripts")) {
+      throw new CliError(
+        "--send-transcripts and --no-transcripts cannot be combined.\n" +
+          "Transcripts are sent by default; --no-transcripts alone turns them off.",
+      );
+    }
+
     // --pause / --resume / --status are non-interactive session actions that
     // share `config`'s surface but not the wizard. They write session state,
     // never the config file — a pause that reached policies-config.json would
@@ -2336,14 +1883,33 @@ async function runCli() {
     // keeps its old meaning (the name to enrol under); on its own it changes the
     // name of a machine that is already connected, which previously required
     // re-running enrolment with the url and token again just to fix a display name.
+    //
+    // Alongside a setup option (--token, --oss, --agents) it is the name to set up
+    // under: `config --token K --machine-label L` used to run as a rename, so
+    // setup never ran and the key was ignored. Setup applies it when it connects;
+    // otherwise it is refused up front or applied as a rename afterwards (below).
     const wantsRename =
-      connectIdx < 0 && !wantsDisconnect && args.includes("--machine-label");
+      connectIdx < 0 &&
+      !wantsDisconnect &&
+      args.includes("--machine-label") &&
+      !["--token", "--oss", "--agents"].some((flag) => args.includes(flag));
     // A key given as --token is in shell history whatever became of the run.
     const warnTokenOnArgv = async () => {
       if (!args.includes("--token")) return;
       const { CONFIG_TOKEN_HISTORY_WARNING } = await import("../src/hooks/cloud-enrollment-cli");
-      process.stderr.write(`\n${CONFIG_TOKEN_HISTORY_WARNING.join("\n")}\n`);
+      const { screenKit, colorsEnabled } = await import("../src/hooks/tui");
+      const kit = screenKit({ color: colorsEnabled(process.stderr) });
+      process.stderr.write(`\n${kit.notice("caution", CONFIG_TOKEN_HISTORY_WARNING.join("\n")).join("\n")}\n`);
     };
+    // The fix for a flag given no value. Never "put the key after --token": the
+    // whole point of the variable is that a key on argv lands in shell history.
+    const missingValue = (flag) =>
+      new CliError(
+        `Missing value after ${flag}.\n` +
+          (flag === "--token"
+            ? "Or leave --token out and set FAILPROOFAI_CLOUD_TOKEN."
+            : "Run  `failproofai config --help`  for what it takes."),
+      );
     if (connectIdx >= 0 || wantsDisconnect || wantsRename) {
       if (connectIdx >= 0 && wantsDisconnect) {
         throw new CliError("--connect and --disconnect cannot be combined.");
@@ -2352,7 +1918,7 @@ async function runCli() {
         const i = args.indexOf(flag);
         if (i < 0) return undefined;
         const v = args[i + 1];
-        if (!v || v.startsWith("-")) throw new CliError(`Missing value after ${flag}.`);
+        if (!v || v.startsWith("-")) throw missingValue(flag);
         return v;
       };
       let result;
@@ -2382,7 +1948,11 @@ async function runCli() {
           sessions: !args.includes("--no-transcripts"),
         });
       }
-      await printLines(result.lines, result.exitCode === 0);
+      // Through the shared presenter: a header naming what ran, and a failure
+      // opening with ✕ and its fix under it, like every other action result.
+      await printReport(wantsRename ? "rename" : wantsDisconnect ? "disconnect" : "connect", result.lines, {
+        ok: result.exitCode === 0,
+      });
       await warnTokenOnArgv();
       await track("cli_cloud_enrollment", {
         action: wantsRename ? "rename" : wantsDisconnect ? "disconnect" : "connect",
@@ -2398,11 +1968,22 @@ async function runCli() {
     if (pauseIdx >= 0 || wantsResume || wantsStatus) {
       const chosen = [pauseIdx >= 0 && "--pause", wantsResume && "--resume", wantsStatus && "--status"].filter(Boolean);
       if (chosen.length > 1) {
-        throw new CliError(`${chosen.join(" and ")} cannot be combined.`);
+        throw new CliError(`${chosen.join(" and ")} cannot be combined.\nRun them one at a time.`);
+      }
+      // `--status` answers "what is this machine's state?": the daemon, the
+      // dashboard and any pauses, the cloud connection and whether data
+      // arrives, and what enforcement is doing — one screen, one column.
+      if (wantsStatus) {
+        const { runStatusCommand } = await import("../src/hooks/config-status");
+        const status = await runStatusCommand({ cwd: process.cwd() });
+        await printLines(status.lines);
+        await track("cli_pause_invoked", { action: "status", ok: true, affected: status.paused });
+        await exitAfterFlush(0);
+        return;
       }
       const sessionIdx = args.indexOf("--session");
       if (sessionIdx >= 0 && !args[sessionIdx + 1]) {
-        throw new CliError("Missing session id after --session.");
+        throw new CliError("Missing session id after --session.\nOr leave --session out to use the newest session here.");
       }
       // A bare `--pause` takes the default duration, so only treat the next
       // token as a duration when it isn't another flag.
@@ -2411,55 +1992,15 @@ async function runCli() {
 
       const { runPauseCommand } = await import("../src/hooks/session-pause-cli");
       const result = runPauseCommand({
-        action: pauseIdx >= 0 ? "pause" : wantsResume ? "resume" : "status",
+        action: pauseIdx >= 0 ? "pause" : "resume",
         duration,
         sessionId: sessionIdx >= 0 ? args[sessionIdx + 1] : undefined,
         all: args.includes("--all"),
         cwd: process.cwd(),
       });
-      // `--status` answers "what is this machine's state?", which is both
-      // halves: whether enforcement is paused AND whether cloud is connected.
-      if (wantsStatus) {
-        const { connectionStatusReport, versionStatusLines } = await import(
-          "../src/hooks/cloud-enrollment-cli"
-        );
-        const { optsFor, printBlock, rows, stack, title, warning } = await import(
-          "../src/hooks/tui"
-        );
-        const opts = optsFor(process.stdout);
-        const report = connectionStatusReport();
-        const { hermesProfileStatusRows } = await import("../src/hooks/integrations");
-        const hermesRows = hermesProfileStatusRows();
-        // The version line was written to be "the only place a user can find out
-        // which daemon they are running" and then never called from anywhere. It
-        // is the right thing for the heading to carry, and it retires a heading
-        // that would otherwise have said the word "status" back to someone who
-        // just typed it.
-        printBlock(
-          process.stdout,
-          stack(
-            title("failproofai config", versionStatusLines()[0], opts),
-            // ONE rows() call over both blocks, so the connection facts and the
-            // enforcement state share a label column. Rendered separately they
-            // computed one column each and the window read as two commands'
-            // output stacked up.
-            //
-            // Always printed, including where reports can never work: "why am I
-            // not getting them?" is the question --status exists to answer, and
-            // an omitted line answers it with silence.
-            rows([...report.rows, ...hermesRows, ...(result.rows ?? [])], opts),
-            report.warnings.length > 0 ? warning(report.warnings, opts) : null,
-            // The trailer is not rows — it is the note and the resume command.
-            // Rendering only `rows` dropped the one line that tells a paused
-            // user how to get unpaused.
-            result.rows ? (result.trailer ?? null) : result.lines,
-          ),
-        );
-      } else {
-        await printLines(result.lines, result.exitCode === 0);
-      }
+      await printLines(result.lines, result.exitCode === 0);
       await track("cli_pause_invoked", {
-        action: pauseIdx >= 0 ? "pause" : wantsResume ? "resume" : "status",
+        action: pauseIdx >= 0 ? "pause" : "resume",
         ok: result.exitCode === 0,
         affected: result.affected,
       });
@@ -2480,20 +2021,66 @@ async function runCli() {
       const i = args.indexOf(flag);
       if (i < 0) return undefined;
       const v = args[i + 1];
-      if (!v || v.startsWith("-")) throw new CliError(`Missing value after ${flag}.`);
+      if (!v || v.startsWith("-")) throw missingValue(flag);
       return v;
     };
+    // --oss skips the connect step and leaves any connection as it is (Tab's
+    // meaning, decision D4); --disconnect is what removes one. It overrides a
+    // key in the environment, and only an explicit --token contradicts it.
+    const oss = args.includes("--oss");
+    if (oss && args.includes("--token")) {
+      throw new CliError("--oss and --token cannot be combined: one uses open source, the other connects.");
+    }
+    // --agents: any of the twelve, or `all`, validated here so a typo is an
+    // error rather than an agent silently left untraced.
+    let agents;
+    if (args.includes("--agents")) {
+      const raw = valueFor("--agents");
+      const { INTEGRATION_TYPES } = await import("../src/hooks/types");
+      const ids = raw === "all" ? [...INTEGRATION_TYPES] : raw.split(",").map((a) => a.trim()).filter(Boolean);
+      const unknown = ids.filter((id) => !INTEGRATION_TYPES.includes(id));
+      if (ids.length === 0 || unknown.length > 0) {
+        throw new CliError(`Not an agent: ${unknown.join(", ") || raw}.\nAgents: ${INTEGRATION_TYPES.join(", ")}, or all`);
+      }
+      agents = ids;
+    }
+    // `--machine-label` here is the name to connect under. When this run cannot
+    // connect at all it is refused now, before anything is written; on a
+    // machine that stays connected as it was, it is applied after setup.
+    const machineLabel = valueFor("--machine-label");
+    if (machineLabel !== undefined) {
+      const { machineLabelRefusal } = await import("../src/hooks/cloud-enrollment-cli");
+      const refusal = machineLabelRefusal({
+        oss,
+        keyGiven: !oss && Boolean(valueFor("--token") ?? process.env.FAILPROOFAI_CLOUD_TOKEN),
+        interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+      });
+      if (refusal) throw new CliError(refusal);
+    }
     const { runConfigureWizard } = await import("../src/hooks/configure-wizard");
     const result = await runConfigureWizard(
       {},
       {
-        token: valueFor("--token") ?? process.env.FAILPROOFAI_CLOUD_TOKEN,
+        token: oss ? undefined : (valueFor("--token") ?? process.env.FAILPROOFAI_CLOUD_TOKEN),
         url: valueFor("--url") ?? process.env.FAILPROOFAI_CLOUD_URL,
         machineId: valueFor("--machine-id"),
-        machineLabel: valueFor("--machine-label"),
+        machineLabel,
         noTranscripts: args.includes("--no-transcripts"),
+        oss,
+        agents,
       },
     );
+    // Setup names the machine only when it connects; when it left a
+    // connection as it was, the label is the rename the flag asked for.
+    let labelExit = 0;
+    if (result.applied && machineLabel !== undefined) {
+      const { applyMachineLabelAfterSetup } = await import("../src/hooks/cloud-enrollment-cli");
+      const renamed = await applyMachineLabelAfterSetup(machineLabel);
+      if (renamed) {
+        await printReport("rename", renamed.lines, { ok: renamed.exitCode === 0 });
+        labelExit = renamed.exitCode;
+      }
+    }
     await warnTokenOnArgv();
     await track("cli_configure_invoked", {
       applied: result.applied,
@@ -2505,74 +2092,50 @@ async function runCli() {
       scopes: result.scopes ?? [],
       cli_count: result.clis?.length ?? 0,
       abort: result.abort ?? null,
+      oss,
+      agents_named: agents ? agents.length : 0,
     });
     // `abort` is the field `WizardAbort` exists to expose, and exiting 0
     // regardless discarded it: a fleet script could not tell "the user pressed
     // Esc" from "this machine could not install the required daemon and is
     // unconfigured". Cancelling is not a failure; the other two are.
-    await exitAfterFlush(!result.applied && result.abort && result.abort !== "cancelled" ? 1 : 0);
+    await exitAfterFlush(!result.applied && result.abort && result.abort !== "cancelled" ? 1 : labelExit);
     return;
   }
 
-  // Shared by both "unknown thing" guards below, so a mistyped SUBCOMMAND gets
-  // the same nearest-match treatment a mistyped flag already got.
-  function levenshtein(a, b) {
-    const m = a.length, n = b.length;
-    const dp = Array.from({ length: m + 1 }, (_, i) =>
-      Array.from({ length: n + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0))
-    );
-    for (let i = 1; i <= m; i++)
-      for (let j = 1; j <= n; j++)
-        dp[i][j] = a[i - 1] === b[j - 1]
-          ? dp[i - 1][j - 1]
-          : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
-    return dp[m][n];
-  }
-
-  // Unknown flag guard — must appear after all known-flag branches
+  // Unknown flag guard — must appear after all known-flag branches.
+  //
+  // Both guards below suggest a whole command, runnable as printed, or nothing
+  // at all. The nearest-spelling guess they replaced always answered, so
+  // `status` got `flush`, `install` got `uninstall` and `-i` got `audit`; see
+  // did-you-mean.ts for the table of words people type and the cut-off.
   const knownFlags = ["--version", "-v", "--help", "-h", "--hook"];
   const unknownFlag = args.find(a => a.startsWith("-") && !knownFlags.includes(a));
 
   if (unknownFlag) {
-    const primary = ["--version", "--help", "--hook", "policies", "policy", "audit"];
-    const closest = primary.reduce((best, flag) => {
-      const dist = levenshtein(unknownFlag, flag);
-      return dist < best.dist ? { flag, dist } : best;
-    }, { flag: primary[0], dist: Infinity });
-
+    const { suggestFlag } = await import("../src/hooks/did-you-mean");
+    const suggestion = suggestFlag(unknownFlag);
     throw new CliError(
-      `Unknown flag: ${unknownFlag}\n` +
-      `Did you mean: ${closest.flag}?\n` +
-      `Run \`failproofai --help\` for usage details.`
+      `Unknown flag: ${unknownFlag}.\n` +
+      (suggestion ? `Did you mean  \`${suggestion}\`?` : "Run  `failproofai help`  for usage.")
     );
   }
 
   // Unknown subcommand guard (non-flag args that aren't a known subcommand)
   const unknownSubcommand = args.find(a => !a.startsWith("-") && !SUBCOMMANDS.includes(a));
   if (unknownSubcommand) {
-    // Nearest match rather than a hardcoded "policies", which was wrong for
-    // every input that was not a typo of it. `auth` made that concrete: it was
-    // a real subcommand until this release, so an old script or plain muscle
-    // memory lands here, and answering "did you mean policies?" sends someone
-    // to the one command that has nothing to do with what they typed.
-    const nearest = SUBCOMMANDS.reduce(
-      (best, name) => {
-        const dist = levenshtein(unknownSubcommand, name);
-        return dist < best.dist ? { name, dist } : best;
-      },
-      { name: SUBCOMMANDS[0], dist: Infinity },
-    );
+    const { suggestCommand } = await import("../src/hooks/did-you-mean");
+    const suggestion = suggestCommand(unknownSubcommand, SUBCOMMANDS);
     throw new CliError(
-      `Unknown command: ${unknownSubcommand}\n` +
-      `Did you mean: failproofai ${nearest.name}?\n` +
-      `Run \`failproofai --help\` for usage details.`
+      `There is no command called '${unknownSubcommand}'.\n` +
+      (suggestion ? `Did you mean  \`${suggestion}\`?` : "Run  `failproofai help`  to see every command.")
     );
   }
 
   // Dashboard launch — always production mode. Runs on every bare `failproofai`
   // (first-run onboarding, if any, already ran above).
   const { launch } = await import("../scripts/launch");
-  launch("start");
+  launch("start", { logo: !setupWizardRan });
 }
 
 // ── Import CliError for use in the guard above ────────────────────────────────
@@ -2600,8 +2163,19 @@ try {
         exit_code: err.exitCode,
       });
     }
-    console.error(`Error: ${err.message}`);
-    process.exit(err.exitCode);
+    // `✕ <what went wrong>`, then each fix on its own line, indented two, with
+    // the command in pink (see `notice` in tui.ts). The exit code is the error's.
+    // Written rather than `console.error`, which Bun paints red on a terminal —
+    // a colour from outside the palette — and drained before exiting.
+    let failureText = `✕ ${err.message}`;
+    try {
+      const { screenKit, colorsEnabled } = await import("../src/hooks/tui");
+      failureText = screenKit({ color: colorsEnabled(process.stderr) }).notice("fail", err.message).join("\n");
+    } catch {
+      // The plain glyph is still the right shape; the kit is decoration.
+    }
+    process.stderr.write(`${failureText}\n`);
+    await exitAfterFlush(err.exitCode);
   }
   // Unexpected internal error — show message only, no stack trace
   const msg = err instanceof Error ? err.message : String(err);
@@ -2619,6 +2193,8 @@ try {
       error_type: err instanceof Error ? err.name : "unknown",
     });
   }
-  console.error(`Unexpected error: ${msg}`);
-  process.exit(2);
+  // Plain, never through the kit: this is the path for an install so broken
+  // that anything could be the next thing to fail.
+  process.stderr.write(`✕ Unexpected error: ${msg}\n`);
+  await exitAfterFlush(2);
 }