fuzzi-cli 0.1.3 → 0.1.5

package/dist/index.js

@@ -16,18 +16,26 @@ var init_brand = __esm({
     BRAND = {
       accent: "#4FC3A1",
       accentDim: "#3A9A7E",
-      text: "#FAFAFA",
-      textSecondary: "#8C8C8C",
-      bg: "#0A0A0A",
-      border: "#2A2A2A"
+      bg: "#0A0C10",
+      surface: "#12151B",
+      surfaceHover: "#181C24",
+      borderSubtle: "#232832",
+      borderStrong: "#313846",
+      textPrimary: "#E8EAED",
+      textSecondary: "#9AA3B2",
+      textTertiary: "#5C6470",
+      success: "#22C55E",
+      warning: "#F59E0B",
+      danger: "#EF4444",
+      critical: "#A855F7"
     };
     RISK_COLORS = {
-      LOW: "#22C55E",
-      MEDIUM: "#F59E0B",
-      HIGH: "#EF4444",
-      CRITICAL: "#A855F7"
+      LOW: BRAND.success,
+      MEDIUM: BRAND.warning,
+      HIGH: BRAND.danger,
+      CRITICAL: BRAND.critical
     };
-    VERSION = "0.1.3";
+    VERSION = "0.1.5";
     APP_ORIGIN = "https://fuzzi-ten.vercel.app";
     DEFAULT_API_URL = `${APP_ORIGIN}/api`;
     SETTINGS_API_KEYS_URL = `${APP_ORIGIN}/settings/api-keys`;
@@ -189,9 +197,6 @@ function shouldLog(level) {
 function stamp() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
-function isDebugMode() {
-  return currentLevel() === "debug";
-}
 var LEVELS, log;
 var init_logger = __esm({
   "src/lib/logger.ts"() {
@@ -214,10 +219,40 @@ var init_logger = __esm({
   }
 });
 
+// src/lib/api-utils.ts
+function errorText(value) {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value.map(errorText).filter(Boolean).join("; ");
+  if (typeof value === "object") {
+    const o = value;
+    if (typeof o.detail === "string") return o.detail;
+    if (Array.isArray(o.detail)) return o.detail.map(errorText).join("; ");
+    if (typeof o.message === "string") return o.message;
+    if (typeof o.error === "string") return o.error;
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return String(value);
+    }
+  }
+  return String(value);
+}
+function asList(data) {
+  if (!data) return [];
+  if (Array.isArray(data)) return data;
+  return data.results ?? data.data ?? [];
+}
+var init_api_utils = __esm({
+  "src/lib/api-utils.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/api-client.ts
 function mapErrorMessage(status, body) {
-  const code = body.code?.toLowerCase();
-  const msg = body.error || body.message || "";
+  const code = typeof body.code === "string" ? body.code.toLowerCase() : "";
+  const msg = errorText(body.error ?? body.message ?? body.detail);
   if (status === 401) {
     if (code === "key_revoked" || msg.toLowerCase().includes("revoked")) {
       return "API key has been revoked. Please log in again.";
@@ -225,7 +260,7 @@ function mapErrorMessage(status, body) {
     if (code === "key_expired" || msg.toLowerCase().includes("expired")) {
       return `API key has expired. Generate a new one at ${SETTINGS_API_KEYS_URL}`;
     }
-    return `Invalid API key. Generate a new one at ${SETTINGS_API_KEYS_URL}`;
+    return msg || `Invalid API key. Generate a new one at ${SETTINGS_API_KEYS_URL}`;
   }
   if (status === 403 && (code === "ssrf" || msg.toLowerCase().includes("private ip"))) {
     return "This URL is not allowed (private IP address detected). Please scan a public-facing URL.";
@@ -257,6 +292,7 @@ var init_api_client = __esm({
     init_credentials();
     init_logger();
     init_brand();
+    init_api_utils();
     ApiError = class extends Error {
       constructor(message, status, code, body, exitCode) {
         super(message);
@@ -329,7 +365,7 @@ var init_api_client = __esm({
             message = `Rate limit exceeded. Retry after ${seconds} seconds.`;
           }
           if (res.status >= 500) {
-            message = `Scan failed: ${errBody.error || errBody.message || res.statusText}`;
+            message = `Request failed: ${errorText(errBody.error ?? errBody.message ?? errBody.detail) || res.statusText}`;
           }
           throw new ApiError(message, res.status, errBody.code, data, 2);
         }
@@ -395,7 +431,7 @@ function getCapabilities() {
   const colorterm = process.env.COLORTERM ?? "";
   const trueColor = colorterm.includes("truecolor") || colorterm.includes("24bit") || term.includes("truecolor") || !!process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0";
   cached = {
-    width: Math.max(60, Math.min(cols, 120)),
+    width: Math.max(60, cols),
     trueColor,
     interactive: stdout.isTTY === true
   };
@@ -434,18 +470,18 @@ function scoreBold(n) {
   return chalk.bold(String(n));
 }
 function error(text) {
-  return color("#EF4444", chalk.red)(text);
+  return color(BRAND.danger, chalk.red)(text);
 }
 function success(text) {
-  return color("#22C55E", chalk.green)(text);
+  return color(BRAND.success, chalk.green)(text);
 }
 function warn(text) {
-  return color("#F59E0B", chalk.yellow)(text);
+  return color(BRAND.warning, chalk.yellow)(text);
 }
-function info(text) {
-  return color(BRAND.accent, chalk.cyan)(text);
+function cmd(text) {
+  return accent(text);
 }
-var accent, accentBold, muted, bold, dim, italic;
+var accent, accentBold, primary, primaryBold, muted, dimText, border, bold, dim, italic;
 var init_theme = __esm({
   "src/terminal/theme.ts"() {
     "use strict";
@@ -453,7 +489,11 @@ var init_theme = __esm({
     init_capabilities();
     accent = color(BRAND.accent, chalk.cyan);
     accentBold = accent.bold;
+    primary = color(BRAND.textPrimary, chalk.white);
+    primaryBold = primary.bold;
     muted = color(BRAND.textSecondary, chalk.gray);
+    dimText = color(BRAND.textTertiary, chalk.dim);
+    border = color(BRAND.borderSubtle, chalk.gray);
     bold = chalk.bold;
     dim = chalk.dim;
     italic = chalk.italic;
@@ -544,33 +584,6 @@ function panel(content, opts = {}) {
     width
   });
 }
-function centerInColumn(text, colWidth) {
-  return text.split("\n").map((line) => {
-    const plain = line.replace(/\x1b\[[0-9;]*m/g, "");
-    const pad = Math.max(0, Math.floor((colWidth - plain.length) / 2));
-    return " ".repeat(pad) + line;
-  }).join("\n");
-}
-function splitHomePanel(opts) {
-  const total = contentWidth();
-  const leftW = Math.max(28, Math.floor(total * (opts.leftRatio ?? 0.34)));
-  const rightW = total - leftW - 3;
-  const leftLines = opts.left.split("\n");
-  const rightTop = opts.rightTop.split("\n");
-  const rightDiv = dim("\u2500".repeat(Math.max(10, rightW)));
-  const rightBottom = opts.rightBottom.split("\n");
-  const rightLines = [...rightTop, "", rightDiv, "", ...rightBottom];
-  const rows = Math.max(leftLines.length, rightLines.length);
-  const sep = dim("\u2502");
-  const body = [""];
-  for (let i = 0; i < rows; i++) {
-    const l = padEndVisible(leftLines[i] ?? "", leftW);
-    const r = rightLines[i] ?? "";
-    body.push(`${l} ${sep} ${r}`);
-  }
-  body.push("");
-  return panel(body.join("\n"), { title: opts.title, marginBottom: 0, borderStyle: "classic" });
-}
 function columns(left, right, leftWidth) {
   const total = contentWidth();
   const split = leftWidth ?? Math.floor(total * 0.48);
@@ -589,9 +602,6 @@ function divider(char = "\u2500", width) {
   const w = width ?? contentWidth();
   return dim(char.repeat(Math.max(20, w)));
 }
-function statusBar(parts) {
-  return dim(parts.filter(Boolean).join("  \xB7  "));
-}
 function keyValue(rows, indent = 2) {
   const pad = " ".repeat(indent);
   const maxKey = Math.max(...rows.map(([k]) => k.length), 4);
@@ -719,103 +729,96 @@ init_logger();
 import { randomBytes } from "crypto";
 import { createServer } from "http";
 import { exec } from "child_process";
-var TIMEOUT_MS = 5 * 60 * 1e3;
-function generateState() {
-  return randomBytes(24).toString("base64url");
-}
 function openBrowser(url) {
   const platform = process.platform;
-  const cmd = platform === "darwin" ? `open ${JSON.stringify(url)}` : platform === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`;
-  exec(cmd, (err) => {
+  const cmd2 = platform === "darwin" ? `open ${JSON.stringify(url)}` : platform === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`;
+  exec(cmd2, (err) => {
     if (err) log.warn("could not open browser automatically", err.message);
   });
 }
 function apiOrigin(apiUrl) {
   return apiUrl.replace(/\/api\/?$/, "") || APP_ORIGIN;
 }
-async function runBrowserLogin() {
+async function openCliAuthPage() {
   const config = await loadConfig();
-  const state = generateState();
-  const handoffToken = await new Promise((resolve, reject) => {
-    const server = createServer((req, res) => {
-      try {
-        const addr = server.address();
-        const port = typeof addr === "object" && addr ? addr.port : 0;
-        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-        if (url.pathname !== "/callback") {
-          res.writeHead(404);
-          res.end();
-          return;
-        }
-        const token = url.searchParams.get("token");
-        const returnedState = url.searchParams.get("state");
-        if (!token || returnedState !== state) {
-          res.writeHead(400);
-          res.end("Invalid callback");
-          reject(new ApiError("Invalid sign-in callback.", 400, "invalid_callback", void 0, 2));
-          return;
+  const url = `${apiOrigin(config.api_url)}/cli-auth`;
+  openBrowser(url);
+  log.debug("opened cli auth page", url);
+  return url;
+}
+
+// src/commands/auth.ts
+init_brand();
+
+// src/terminal/interactive.ts
+init_theme();
+import { select, search } from "@inquirer/prompts";
+var pauseHook = null;
+var resumeHook = null;
+function setReadlineHooks(pause, resume) {
+  pauseHook = pause;
+  resumeHook = resume;
+}
+async function runInteractive(fn) {
+  return withReadlinePaused(fn);
+}
+async function withReadlinePaused(fn) {
+  pauseHook?.();
+  try {
+    return await fn();
+  } finally {
+    resumeHook?.();
+  }
+}
+async function pickFromList(message, items) {
+  if (!items.length) return null;
+  try {
+    return await withReadlinePaused(() => select({ message, choices: items }));
+  } catch {
+    return null;
+  }
+}
+async function searchPalette(message, choices) {
+  try {
+    return await withReadlinePaused(
+      () => search({
+        message,
+        source: async (input5) => {
+          if (!input5) return choices;
+          const q = input5.toLowerCase();
+          return choices.filter(
+            (c) => c.value.toLowerCase().includes(q) || String(c.description ?? "").toLowerCase().includes(q)
+          );
         }
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:48px">
-          <h1>Signed in to Fuzzi CLI</h1><p>Return to your terminal.</p>
-          <script>setTimeout(()=>window.close(),1200)</script></body></html>`);
-        server.close();
-        resolve(token);
-      } catch (e) {
-        server.close();
-        reject(e);
-      }
-    });
-    const timer = setTimeout(() => {
-      server.close();
-      reject(new ApiError("Sign-in timed out after 5 minutes.", 408, "auth_timeout", void 0, 2));
-    }, TIMEOUT_MS);
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      const loginUrl = `${apiOrigin(config.api_url)}/cli-auth?state=${encodeURIComponent(state)}&callback_port=${port}`;
-      openBrowser(loginUrl);
-      log.debug("browser auth", loginUrl);
-    });
-    server.on("error", (e) => {
-      clearTimeout(timer);
-      reject(e);
-    });
-  });
-  const client = new FuzziApiClient(config.api_url);
-  const handoff = await client.post("/cli/handoff", {
-    handoff_token: handoffToken,
-    state
-  });
-  if (!handoff.api_key) {
-    throw new ApiError("Sign-in failed: no API key returned.", 500, "handoff_failed", void 0, 2);
+      })
+    );
+  } catch {
+    return null;
   }
-  client.setToken(handoff.api_key);
-  const profile = await client.get("/me");
-  await saveCredentials({
-    api_key: handoff.api_key,
-    auth_method: "api_key",
-    key_prefix: handoff.prefix || profile.key_prefix || maskApiKey(handoff.api_key),
-    key_expires_at: handoff.expires_at || profile.key_expires_at || void 0,
-    email: profile.email,
-    full_name: profile.full_name || void 0,
-    saved_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  const name = profile.full_name || profile.email;
-  return { message: `Signed in as ${name}`, profile };
+}
+function formatChoice(name, description) {
+  return `${accent(name)}${muted(" \u2014 " + description)}`;
 }
 
 // src/commands/auth.ts
-init_brand();
+async function runAssistedBrowserLogin() {
+  await openCliAuthPage();
+  console.log("");
+  console.log(accent("  Browser opened \u2014 authorize Fuzzi CLI on the web page."));
+  console.log(muted("  Copy the API key shown, then paste it below."));
+  console.log("");
+  const msg = await runApiKeyLogin({ interactive: true });
+  const client = await getAuthenticatedClient();
+  const profile = await client.get("/me");
+  return { message: msg, profile };
+}
 async function runAuthLogin(opts = {}) {
-  if (opts.browser || opts.interactive !== false && !opts.apiKey && !opts.apiKeyOnly) {
-    try {
-      const result = await runBrowserLogin();
-      return success(result.message);
-    } catch (e) {
-      if (opts.browser) throw e;
-      if (opts.apiKeyOnly) throw e;
-    }
+  if (opts.apiKeyOnly || opts.apiKey) {
+    return runApiKeyLogin(opts);
+  }
+  if (opts.browser || opts.interactive !== false) {
+    const result = await runAssistedBrowserLogin();
+    return result.message;
   }
   return runApiKeyLogin(opts);
 }
@@ -833,15 +836,17 @@ async function runApiKeyLogin(opts = {}) {
         2
       );
     }
-    apiKey = await password({
-      message: "Paste your API key (fz_live_...):",
-      mask: "\u2022",
-      validate: (v) => {
-        if (!v.trim()) return "API key is required";
-        if (!isValidApiKeyFormat(v)) return "Key must start with fz_live_";
-        return true;
-      }
-    });
+    apiKey = await runInteractive(
+      () => password({
+        message: "Paste your API key (fz_live_...):",
+        mask: "\u2022",
+        validate: (v) => {
+          if (!v.trim()) return "API key is required";
+          if (!isValidApiKeyFormat(v)) return "Key must start with fz_live_";
+          return true;
+        }
+      })
+    );
   }
   apiKey = apiKey.trim();
   if (!isValidApiKeyFormat(apiKey)) {
@@ -1167,6 +1172,17 @@ function createProgress(label, stream = false) {
     }
   };
 }
+async function withSpinner(label, fn) {
+  const p = createProgress(label);
+  try {
+    const result = await fn();
+    p.stop();
+    return result;
+  } catch (e) {
+    p.fail();
+    throw e;
+  }
+}
 
 // src/commands/scan.ts
 init_strings();
@@ -1266,6 +1282,7 @@ async function runScanCommand(client, opts) {
 }
 
 // src/commands/scans.ts
+init_api_utils();
 async function runScansListCommand(client, format = "table", filters) {
   const params = new URLSearchParams({ page: "1", page_size: String(filters?.limit || 20) });
   if (filters?.status) params.set("status", filters.status);
@@ -1273,7 +1290,7 @@ async function runScansListCommand(client, format = "table", filters) {
   const data = await client.get(
     `/scans?${params.toString()}`
   );
-  return renderScansList(data.results || [], format);
+  return renderScansList(asList(data), format);
 }
 async function runScanGetCommand(client, scanId, format = "table") {
   const detail = await client.get(`/scan/${scanId}`);
@@ -1480,33 +1497,7 @@ function buildProgram() {
 
 // src/shell/prompt-loop.ts
 import * as readline from "readline/promises";
-import { stdin as input3, stdout as output } from "process";
-
-// src/shell/home-screen.ts
-import { homedir as homedir3 } from "os";
-
-// src/shell/ascii-mark.ts
-function renderFuzziMark() {
-  return [
-    "      \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-    "    \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-    "    \u2588\u2588          \u2588\u2588",
-    "    \u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588",
-    "    \u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588",
-    "    \u2588\u2588   \u2588\u2588\u2588\u2588   \u2588\u2588",
-    "    \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-    "      \u2588\u2588      \u2588\u2588",
-    "      \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-    "        \u2588\u2588  \u2588\u2588",
-    "        \u2588\u2588  \u2588\u2588"
-  ].join("\n");
-}
-
-// src/shell/home-screen.ts
-init_brand();
-init_theme();
-init_layout();
-init_width();
+import { stdin as input3, stdout as output, cwd as cwd3 } from "process";
 
 // src/lib/assets.ts
 import { readFile as readFile4 } from "fs/promises";
@@ -1533,130 +1524,265 @@ async function readAsset(name) {
 }
 
 // src/shell/home-screen.ts
-async function fetchHomeData(profile, cwd4) {
+init_api_client();
+
+// src/shell/ascii-mark.ts
+function renderFuzziMark() {
+  return [
+    "      \u2554\u2550\u2550\u2550\u2550\u2557",
+    "      \u2551 \u25C6  \u2551",
+    "      \u255A\u2550\u2566\u2550\u2550\u255D",
+    "       \u2554\u2550\u2569\u2550\u2557",
+    "       \u2551 \u25C6 \u2551",
+    "       \u255A\u2550\u2550\u2550\u255D"
+  ].join("\n");
+}
+
+// src/shell/home-screen.ts
+init_brand();
+init_theme();
+init_width();
+
+// src/components/Panel.ts
+init_theme();
+init_strings();
+init_width();
+function visibleLen(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+function padCell(content, width) {
+  const inner = width - 2;
+  return " " + padEndVisible(content, inner) + " ";
+}
+function topBanner(title, width = contentWidth()) {
+  const inner = ` ${title} `;
+  const dashes = Math.max(0, width - 2 - visibleLen(inner));
+  const left = Math.floor(dashes / 2);
+  const right = dashes - left;
+  return [
+    border(`\u250F${"\u2501".repeat(left)}${inner}${"\u2501".repeat(right)}\u2513`),
+    border(`\u2517${"\u2501".repeat(width - 2)}\u251B`)
+  ].join("\n");
+}
+function titleSegment(title, width) {
+  const prefix = `\u2500 ${title} `;
+  const dashes = Math.max(0, width - visibleLen(prefix));
+  return prefix + "\u2500".repeat(dashes);
+}
+function tripleColumnPanel(cols, totalWidth = contentWidth()) {
+  const sep = 1;
+  const inner = totalWidth - 2;
+  const ratios = [0.44, 0.28, 0.28];
+  const raw = ratios.map((r) => Math.floor(inner * r));
+  const used = raw.reduce((a, b) => a + b, 0) + 2 * sep;
+  raw[0] += inner - used;
+  const widths = raw;
+  const top = border("\u250C") + titleSegment(cols[0].title, widths[0]) + border("\u252C") + titleSegment(cols[1].title, widths[1]) + border("\u252C") + titleSegment(cols[2].title, widths[2]) + border("\u2510");
+  const maxRows = Math.max(...cols.map((c) => c.lines.length), 1);
+  const body = [top];
+  for (let i = 0; i < maxRows; i++) {
+    const cells = cols.map((c, idx) => padCell(c.lines[i] ?? "", widths[idx]));
+    body.push(
+      border("\u2502") + cells[0] + border("\u2502") + cells[1] + border("\u2502") + cells[2] + border("\u2502")
+    );
+  }
+  const bottom = border("\u2514") + border("\u2500".repeat(widths[0])) + border("\u2534") + border("\u2500".repeat(widths[1])) + border("\u2534") + border("\u2500".repeat(widths[2])) + border("\u2518");
+  body.push(bottom);
+  return body.join("\n");
+}
+function stackedPanels(cols, width = contentWidth()) {
+  return cols.map((col) => singlePanel(col.title, col.lines, width)).join("\n\n");
+}
+function singlePanel(title, lines, width = contentWidth()) {
+  const inner = width - 2;
+  const prefix = `\u2500 ${title} `;
+  const dashes = Math.max(0, inner - visibleLen(prefix));
+  const top = border(`\u250C${prefix}${"\u2500".repeat(dashes)}\u2510`);
+  const bottom = border(`\u2514${"\u2500".repeat(inner)}\u2518`);
+  const body = lines.map((l) => border("\u2502") + padCell(l, inner + 2) + border("\u2502"));
+  return [top, ...body, bottom].join("\n");
+}
+function tipPanel(text, width = contentWidth()) {
+  const inner = width - 2;
+  const prefix = "\u2500 Tip ";
+  const dashes = Math.max(0, inner - visibleLen(prefix));
+  const top = border(`\u250C${prefix}${"\u2500".repeat(dashes)}\u2510`);
+  const bottom = border(`\u2514${"\u2500".repeat(inner)}\u2518`);
+  return [top, border("\u2502") + padCell(text, inner + 2) + border("\u2502"), bottom].join("\n");
+}
+function besideMark(mark, text, markCol = 18, gap = 3) {
+  const rows = Math.max(mark.length, text.length);
+  const out = [];
+  for (let i = 0; i < rows; i++) {
+    const m = padEndVisible(mark[i] ?? "", markCol);
+    const t = text[i] ?? "";
+    out.push(m + " ".repeat(gap) + t);
+  }
+  return out;
+}
+function popularCommand(command, desc, cmdWidth = 14) {
+  return padEndVisible(cmd(command), cmdWidth) + muted(desc);
+}
+
+// src/shell/home-screen.ts
+function daysUntil2(dateStr) {
+  const diff = new Date(dateStr).getTime() - Date.now();
+  return Math.max(0, Math.ceil(diff / (1e3 * 60 * 60 * 24)));
+}
+function formatKeyExpiry(dateStr) {
+  if (!dateStr) return null;
+  const days = daysUntil2(dateStr);
+  return `Key expires: ${days} days remaining`;
+}
+function formatKeyExpiryDate(dateStr) {
+  if (!dateStr) return null;
+  return `(${dateStr.slice(0, 10)})`;
+}
+async function fetchHomeData(profile) {
   let changelog = [];
   try {
     changelog = JSON.parse(await readAsset("changelog.json"));
   } catch {
     changelog = [];
   }
-  return { profile, cwd: cwd4, changelog };
-}
-function isHomeDir(dir) {
-  return dir === homedir3() || dir === homedir3().replace(/\/$/, "");
+  let stats = null;
+  if (profile) {
+    try {
+      const client = await getAuthenticatedClient();
+      const rateRaw = await runRateLimitStatus(client);
+      let rateHour = null;
+      if (rateRaw) {
+        const m = rateRaw.match(/(\d+)\/(\d+)/);
+        if (m) {
+          const remaining = Number(m[1]);
+          const limit2 = Number(m[2]);
+          const used2 = limit2 - remaining;
+          rateHour = `${used2}/${limit2} scans this hour`;
+        } else {
+          rateHour = rateRaw;
+        }
+      }
+      const used = profile.scans_used_this_month ?? profile.total_scans;
+      const limit = profile.monthly_scan_limit;
+      const usageMonth = used != null && limit != null ? `${used}/${limit} scans this month` : used != null ? `${used} scans total` : null;
+      stats = { rateHour, usageMonth };
+    } catch {
+      stats = null;
+    }
+  }
+  return { profile, changelog, stats };
 }
-function renderLeftColumn(data) {
-  const colW = Math.max(28, Math.floor(contentWidth() * 0.34));
-  const name = data.profile?.full_name || data.profile?.email?.split("@")[0] || "there";
-  const org = data.profile?.organization?.trim();
-  const mark = centerInColumn(accent(renderFuzziMark()), colW);
-  const lines = [];
+function renderAccountColumn(data) {
+  const mark = accent(renderFuzziMark()).split("\n");
   if (data.profile) {
-    lines.push(
-      accentBold(`Welcome back ${name}!`),
-      "",
-      mark,
-      "",
-      [accent("\u25CF Connected"), muted("\xB7"), info("API Key auth"), org ? muted("\xB7 " + org) : ""].filter(Boolean).join(" "),
-      muted(data.profile.email),
-      data.profile.role ? muted(`Role: ${data.profile.role}`) : "",
-      "",
-      muted(data.cwd),
-      "",
-      accent("/scan") + muted(" <url>   scan a target"),
-      accent("/scans") + muted("        browse history"),
-      accent("/status") + muted("       account info"),
-      accent("/keys") + muted("         manage keys"),
-      accent("/palette") + muted("      find commands")
-    );
-  } else {
-    lines.push(
-      accentBold("Welcome to Fuzzi!"),
+    const p = data.profile;
+    const name = p.full_name || p.email.split("@")[0];
+    const keyExpiry = formatKeyExpiry(p.key_expires_at ?? void 0);
+    const keyDate = formatKeyExpiryDate(p.key_expires_at ?? void 0);
+    const textBlock2 = [
+      primaryBold(`Welcome back, ${name}!`),
+      primary(p.email),
       "",
-      mark,
-      "",
-      muted("Not connected"),
-      info("Press Enter to sign in"),
-      "",
-      muted(data.cwd),
-      "",
-      accent("/auth") + muted("      browser sign-in"),
-      accent("/auth-key") + muted("  paste API key"),
-      accent("/scan") + muted(" <url>  after login"),
-      accent("/help") + muted("       all commands")
-    );
+      muted(`Organization: ${p.organization || "\u2014"}`),
+      muted(`Role: ${p.role}`)
+    ];
+    const beside = besideMark(mark, textBlock2, 14, 4);
+    const lines = ["", ...beside, ""];
+    lines.push(success("\u25CF Connected"));
+    lines.push(muted("Status: Ready"));
+    if (data.stats?.rateHour) lines.push(muted(`Rate limit: ${data.stats.rateHour}`));
+    if (data.stats?.usageMonth) lines.push(muted(`Usage: ${data.stats.usageMonth}`));
+    if (keyExpiry) {
+      lines.push("");
+      lines.push(muted(keyExpiry));
+      if (keyDate) lines.push(muted(keyDate));
+    }
+    return lines;
   }
-  return lines.filter((l) => l !== "").join("\n");
+  const textBlock = [
+    primaryBold("Welcome to Fuzzi!"),
+    muted("Not connected"),
+    "",
+    muted("Press Enter to sign in"),
+    muted("or run /auth-key")
+  ];
+  return ["", ...besideMark(mark, textBlock, 14, 4), ""];
 }
-function renderTipsColumn(data) {
+function renderQuickStartColumn(data) {
   const lines = [
-    accentBold("Tips for getting started"),
     "",
-    `Run ${accent("/scan")}${muted(" <url>")} to scan a site for security risks`,
-    `Run ${accent("/palette")} to search every available command`,
-    `Run ${accent("/help")} for the full command reference`,
-    ""
+    muted("Type ") + cmd("/help") + muted(" for all"),
+    muted("commands."),
+    "",
+    primaryBold("Popular commands:"),
+    "",
+    popularCommand("/scan", "Start a security scan", 12),
+    popularCommand("/scans", "Browse recent scans", 12),
+    popularCommand("/status", "Show account info", 12)
   ];
-  if (!data.profile) {
-    lines.push(
-      muted("Note: You launched without credentials."),
-      muted("Press Enter at the prompt to open your browser,"),
-      muted("or use /auth-key to paste an API key."),
-      ""
-    );
-  } else if (isHomeDir(data.cwd)) {
+  if (data.profile) {
     lines.push(
-      muted("Note: You launched fuzzi in your home directory."),
-      muted("cd into a project folder first for better context,"),
-      muted("or pass URLs directly: /scan https://example.com"),
-      ""
+      popularCommand("/keys", "Manage API keys", 12),
+      popularCommand("/config", "CLI settings", 12)
     );
   } else {
     lines.push(
-      muted("Note: Add a .fuzzirc in this directory to set default"),
-      muted("scan URL, environment, and output format for the team."),
-      ""
+      popularCommand("/auth", "Browser sign-in", 12),
+      popularCommand("/auth-key", "Paste API key", 12)
     );
   }
-  lines.push(
-    muted("CI usage: "),
-    muted("fuzzi scan <url> --fail-on critical --format json")
-  );
-  return lines.join("\n");
+  return lines;
 }
 function renderWhatsNewColumn(data) {
-  const latest = data.changelog[0];
-  const lines = [accentBold("What's new"), ""];
-  if (latest) {
-    for (const h of latest.highlights.slice(0, 4)) {
-      lines.push(muted(h));
-    }
-    lines.push("");
-    lines.push(italic(muted("/changelog for more")));
-  } else {
-    lines.push(muted("Stay tuned for updates."));
+  const lines = [""];
+  const highlights = data.changelog[0]?.highlights ?? [
+    "Confidence gating added",
+    "Netflix-style false positives fixed",
+    "CLI shell interface"
+  ];
+  for (const h of highlights.slice(0, 4)) {
+    const text = h.replace(/^✓\s*/, "");
+    lines.push(success("\u2713 ") + primary(text));
   }
-  return lines.join("\n");
+  lines.push("");
+  lines.push(muted("Run ") + cmd("/changelog") + muted(" for more details."));
+  return lines;
+}
+function renderTip(data) {
+  if (data.profile) {
+    return muted("Tip: Run ") + cmd("/scan <url>") + muted(" to scan a target, or ") + cmd("/palette") + muted(" to find commands.");
+  }
+  return muted("Not logged in? Run ") + cmd("/auth-key") + muted(" to paste an API key from settings, or press Enter to sign in via browser.");
 }
 function renderHomeScreen(data) {
-  return splitHomePanel({
-    title: `Fuzzi CLI v${VERSION}`,
-    left: renderLeftColumn(data),
-    rightTop: renderTipsColumn(data),
-    rightBottom: renderWhatsNewColumn(data),
-    leftRatio: 0.36
-  });
+  const width = contentWidth();
+  const cols = [
+    { title: "Account", lines: renderAccountColumn(data) },
+    { title: "Quick Start", lines: renderQuickStartColumn(data) },
+    { title: "What's New", lines: renderWhatsNewColumn(data) }
+  ];
+  const main2 = terminalWidth() >= 100 ? tripleColumnPanel(cols, width) : stackedPanels(cols, width);
+  return [topBanner(`Fuzzi CLI v${VERSION}`, width), "", main2, "", tipPanel(renderTip(data), width)].join(
+    "\n"
+  );
 }
 function renderChangelog(entries) {
   if (!entries.length) return muted("No changelog entries.");
   return entries.map((e) => {
     const lines = [
       accentBold(`v${e.version}`) + muted(` \u2014 ${e.date}`),
-      ...e.highlights.map((h) => muted(`  \xB7 ${h}`))
+      ...e.highlights.map((h) => success("\u2713 ") + primary(h.replace(/^✓\s*/, "")))
     ];
     return lines.join("\n");
   }).join("\n\n");
 }
+function renderAuthGateScreen() {
+  return renderHomeScreen({
+    profile: null,
+    changelog: [],
+    stats: null
+  });
+}
 
 // src/shell/slash-commands.ts
 init_api_client();
@@ -1676,47 +1802,17 @@ function emptyState(title, hint, action) {
 
 // src/commands/keys.ts
 init_brand();
-
-// src/terminal/interactive.ts
-init_theme();
-import { select, search } from "@inquirer/prompts";
-async function pickFromList(message, items) {
-  if (!items.length) return null;
-  try {
-    return await select({ message, choices: items });
-  } catch {
-    return null;
-  }
-}
-async function searchPalette(message, choices) {
-  try {
-    return await search({
-      message,
-      source: async (input5) => {
-        if (!input5) return choices;
-        const q = input5.toLowerCase();
-        return choices.filter((c) => c.value.includes(q) || c.description?.includes(q));
-      }
-    });
-  } catch {
-    return null;
-  }
-}
-function formatChoice(name, description) {
-  return `${accent(name)}${muted(" \u2014 " + description)}`;
-}
-
-// src/commands/keys.ts
+init_api_utils();
 async function runKeysListCommand(client) {
   const data = await client.get("/keys");
-  const keys = data.results || [];
+  const keys = asList(data);
   if (!keys.length) {
     return emptyState("No API keys", `Create one at ${SETTINGS_API_KEYS_URL}`, "[n] new key in this view");
   }
   const rows = keys.map((k) => [
     k.name,
     k.prefix,
-    k.scopes?.join(", ") || muted("\u2014"),
+    k.scopes && Array.isArray(k.scopes) ? k.scopes.join(", ") : muted("\u2014"),
     k.revoked ? muted("Revoked") : k.active ? success("Active") : muted("Inactive"),
     k.last_used_at ? new Date(k.last_used_at).toLocaleDateString() : muted("Never")
   ]);
@@ -1728,13 +1824,16 @@ async function runKeyRevoke(client, keyId) {
 }
 async function pickKeyForRevoke(client) {
   const data = await client.get("/keys");
-  const active = (data.results || []).filter((k) => !k.revoked && k.active);
+  const active = asList(data).filter((k) => !k.revoked && k.active);
   return pickFromList(
     "Select a key to revoke",
     active.map((k) => ({ name: `${k.name} (${k.prefix})`, value: k.id }))
   );
 }
 
+// src/shell/slash-commands.ts
+init_api_utils();
+
 // src/shell/help-screen.ts
 init_layout();
 init_theme();
@@ -1759,9 +1858,9 @@ var SLASH_COMMANDS = [
   { name: "/exit", description: "Exit the shell", aliases: ["/quit"] }
 ];
 function findCommand(input5) {
-  const cmd = input5.trim().split(/\s/)[0].toLowerCase();
+  const cmd2 = input5.trim().split(/\s/)[0].toLowerCase();
   return SLASH_COMMANDS.find(
-    (c) => c.name === cmd || c.aliases?.some((a) => a === cmd)
+    (c) => c.name === cmd2 || c.aliases?.some((a) => a === cmd2)
   );
 }
 
@@ -1876,13 +1975,142 @@ function normalizeScanUrl(url) {
   if (!/^https?:\/\//i.test(u)) return `https://${u}`;
   return u;
 }
+var SPINNER_LABELS = {
+  "/scan": "Scanning target...",
+  "/status": "Loading account status...",
+  "/scans": "Loading scans...",
+  "/keys": "Loading API keys...",
+  "/config": "Updating configuration...",
+  "/compare": "Comparing scans...",
+  "/whatif": "Running simulation...",
+  "/report": "Fetching report...",
+  "/auth": "Signing in...",
+  "/auth-key": "Validating API key...",
+  "/login": "Signing in...",
+  "/changelog": "Loading changelog...",
+  "/history": "Loading history...",
+  "/palette": "Opening command palette...",
+  "/commands": "Opening command palette..."
+};
+function spinnerLabel(cmd2) {
+  return SPINNER_LABELS[cmd2.toLowerCase()] ?? null;
+}
+async function executeSlashCommand(cmd2, arg, ctx) {
+  switch (cmd2.toLowerCase()) {
+    case "/help":
+      ctx.sink.write(renderHelpScreen());
+      break;
+    case "/palette":
+    case "/commands": {
+      const picked = await openCommandPalette();
+      if (picked) return dispatchSlashCommand(picked, ctx);
+      break;
+    }
+    case "/clear":
+      return { redraw: true };
+    case "/history": {
+      const hist = await loadHistory();
+      ctx.sink.write(renderHistoryScreen(hist));
+      break;
+    }
+    case "/scan": {
+      if (!arg) {
+        ctx.sink.write(error("Usage: /scan <url>"));
+        break;
+      }
+      const client = await getAuthenticatedClient();
+      const progress = createStreamProgress(ctx.sink);
+      const result = await runScanCommand(client, {
+        url: normalizeScanUrl(arg),
+        wait: true,
+        onProgress: progress.update,
+        streamProgress: true
+      });
+      progress.stop();
+      ctx.sink.write(result.output);
+      break;
+    }
+    case "/status": {
+      const client = await getAuthenticatedClient();
+      const status = await runStatusCommand(client);
+      const rate = await runRateLimitStatus(client);
+      ctx.sink.write(rate ? `${status}
+
+${muted("Rate limit")}  ${rate}` : status);
+      break;
+    }
+    case "/scans":
+      await runScansInteractive(ctx);
+      break;
+    case "/keys":
+      await runKeysInteractive(ctx);
+      break;
+    case "/config": {
+      if (!arg.includes("=")) {
+        ctx.sink.write(error("Usage: /config key=value"));
+        break;
+      }
+      const [k, ...vParts] = arg.split("=");
+      ctx.sink.write(await runConfigSet(k.trim(), vParts.join("=").trim()));
+      break;
+    }
+    case "/changelog": {
+      const raw = await readAsset("changelog.json");
+      ctx.sink.write(renderChangelog(JSON.parse(raw)));
+      break;
+    }
+    case "/compare": {
+      const [a, b] = arg.split(/\s+/);
+      if (!a || !b) {
+        ctx.sink.write(error("Usage: /compare <scan-a> <scan-b>"));
+        break;
+      }
+      const { runCompareCommand: runCompareCommand2 } = await Promise.resolve().then(() => (init_compare(), compare_exports));
+      ctx.sink.write(await runCompareCommand2(a, b, "table"));
+      break;
+    }
+    case "/whatif": {
+      if (!arg) {
+        ctx.sink.write(error("Usage: /whatif <scan-id>"));
+        break;
+      }
+      const { runWhatIfCommand: runWhatIfCommand2 } = await Promise.resolve().then(() => (init_whatif(), whatif_exports));
+      ctx.sink.write(await runWhatIfCommand2(arg, {}, "table"));
+      break;
+    }
+    case "/report": {
+      if (!arg) {
+        ctx.sink.write(error("Usage: /report <scan-id>"));
+        break;
+      }
+      const { runReportCommand: runReportCommand2 } = await Promise.resolve().then(() => (init_report(), report_exports));
+      const client = await getAuthenticatedClient();
+      ctx.sink.write(await runReportCommand2(client, arg, "json"));
+      break;
+    }
+    case "/login":
+    case "/auth": {
+      const result = await runAssistedBrowserLogin();
+      ctx.sink.write(result.message);
+      return { profile: result.profile, redraw: true };
+    }
+    case "/auth-key": {
+      ctx.sink.write(await runApiKeyLogin({ interactive: true }));
+      const client = await getAuthenticatedClient();
+      return { profile: await client.get("/me"), redraw: true };
+    }
+    default:
+      ctx.sink.write(errorBox(`Unknown command: ${cmd2}`, "Type /help"));
+  }
+  return {};
+}
 async function dispatchSlashCommand(line, ctx) {
   const trimmed = line.trim();
   if (!trimmed) return {};
   if (trimmed === "/exit" || trimmed === "/quit") return { exit: true };
-  const [cmd, ...rest] = trimmed.split(/\s+/);
+  const [cmd2, ...rest] = trimmed.split(/\s+/);
   const arg = rest.join(" ").trim();
-  if (!cmd.startsWith("/")) {
+  if (!cmd2.startsWith("/")) {
     ctx.sink.write(
       errorBox(
         `Not a shell command: ${trimmed}`,
@@ -1892,117 +2120,16 @@ ${accent("/help")} lists everything`
     );
     return {};
   }
-  if (!findCommand(cmd) && cmd.startsWith("/")) {
-    ctx.sink.write(errorBox(`Unknown command: ${cmd}`, "Type /help or /palette"));
+  if (!findCommand(cmd2) && cmd2.startsWith("/")) {
+    ctx.sink.write(errorBox(`Unknown command: ${cmd2}`, "Type /help or /palette"));
     return {};
   }
   try {
-    switch (cmd.toLowerCase()) {
-      case "/help":
-        ctx.sink.write(renderHelpScreen());
-        break;
-      case "/palette":
-      case "/commands": {
-        const picked = await openCommandPalette();
-        if (picked) return dispatchSlashCommand(picked, ctx);
-        break;
-      }
-      case "/clear":
-        return { redraw: true };
-      case "/history": {
-        const hist = await loadHistory();
-        ctx.sink.write(renderHistoryScreen(hist));
-        break;
-      }
-      case "/scan": {
-        if (!arg) {
-          ctx.sink.write(error("Usage: /scan <url>"));
-          break;
-        }
-        const client = await getAuthenticatedClient();
-        const progress = createStreamProgress(ctx.sink);
-        const result = await runScanCommand(client, {
-          url: normalizeScanUrl(arg),
-          wait: true,
-          onProgress: progress.update,
-          streamProgress: true
-        });
-        progress.stop();
-        ctx.sink.write(result.output);
-        break;
-      }
-      case "/status": {
-        const client = await getAuthenticatedClient();
-        const status = await runStatusCommand(client);
-        const rate = await runRateLimitStatus(client);
-        ctx.sink.write(rate ? `${status}
-
-${muted("Rate limit")}  ${rate}` : status);
-        break;
-      }
-      case "/scans":
-        await runScansInteractive(ctx);
-        break;
-      case "/keys":
-        await runKeysInteractive(ctx);
-        break;
-      case "/config": {
-        if (!arg.includes("=")) {
-          ctx.sink.write(error("Usage: /config key=value"));
-          break;
-        }
-        const [k, ...vParts] = arg.split("=");
-        ctx.sink.write(await runConfigSet(k.trim(), vParts.join("=").trim()));
-        break;
-      }
-      case "/changelog": {
-        const raw = await readAsset("changelog.json");
-        ctx.sink.write(renderChangelog(JSON.parse(raw)));
-        break;
-      }
-      case "/compare": {
-        const [a, b] = arg.split(/\s+/);
-        if (!a || !b) {
-          ctx.sink.write(error("Usage: /compare <scan-a> <scan-b>"));
-          break;
-        }
-        const { runCompareCommand: runCompareCommand2 } = await Promise.resolve().then(() => (init_compare(), compare_exports));
-        ctx.sink.write(await runCompareCommand2(a, b, "table"));
-        break;
-      }
-      case "/whatif": {
-        if (!arg) {
-          ctx.sink.write(error("Usage: /whatif <scan-id>"));
-          break;
-        }
-        const { runWhatIfCommand: runWhatIfCommand2 } = await Promise.resolve().then(() => (init_whatif(), whatif_exports));
-        ctx.sink.write(await runWhatIfCommand2(arg, {}, "table"));
-        break;
-      }
-      case "/report": {
-        if (!arg) {
-          ctx.sink.write(error("Usage: /report <scan-id>"));
-          break;
-        }
-        const { runReportCommand: runReportCommand2 } = await Promise.resolve().then(() => (init_report(), report_exports));
-        const client = await getAuthenticatedClient();
-        ctx.sink.write(await runReportCommand2(client, arg, "json"));
-        break;
-      }
-      case "/login":
-      case "/auth": {
-        ctx.sink.write(await runAuthLogin({ interactive: true, browser: true }));
-        const client = await getAuthenticatedClient();
-        return { profile: await client.get("/me"), redraw: true };
-      }
-      case "/auth-key": {
-        ctx.sink.write(await runApiKeyLogin({ interactive: true }));
-        const client = await getAuthenticatedClient();
-        return { profile: await client.get("/me"), redraw: true };
-      }
-      default:
-        ctx.sink.write(errorBox(`Unknown command: ${cmd}`, "Type /help"));
+    const label = spinnerLabel(cmd2);
+    if (label) {
+      return await withSpinner(label, () => executeSlashCommand(cmd2, arg, ctx));
     }
+    return await executeSlashCommand(cmd2, arg, ctx);
   } catch (e) {
     ctx.sink.error(formatApiError(e));
   }
@@ -2027,7 +2154,7 @@ async function runScansInteractive(ctx) {
   while (true) {
     const list = await runScansListCommand(client, "table", { limit: 20 });
     const data = await client.get("/scans?page=1&page_size=20");
-    const scans = data.results || [];
+    const scans = asList(data);
     if (!scans.length) {
       ctx.sink.write(emptyState("No scans yet", "Run /scan <url> to create your first scan", "/scan https://example.com"));
       return;
@@ -2044,10 +2171,12 @@ async function runScansInteractive(ctx) {
     if (!scanId) return;
     const detail = await client.get(`/scan/${scanId}`);
     ctx.sink.write(renderScanResult(detail, "table"));
-    const cont = await input2({
-      message: muted("Enter = back to list  \xB7  q = exit"),
-      default: ""
-    }).catch(() => "q");
+    const cont = await runInteractive(
+      () => input2({
+        message: muted("Enter = back to list  \xB7  q = exit"),
+        default: ""
+      })
+    ).catch(() => "q");
     if (cont.toLowerCase() === "q") return;
   }
 }
@@ -2055,14 +2184,16 @@ async function runKeysInteractive(ctx) {
   const client = await getAuthenticatedClient();
   ctx.sink.write(await runKeysListCommand(client));
   ctx.sink.write(muted("\nActions: [r] revoke  [n] new key  [Enter] back"));
-  const action = await input2({ message: "Action", default: "" }).catch(() => "");
+  const action = await runInteractive(() => input2({ message: "Action", default: "" })).catch(() => "");
   if (action.toLowerCase() === "r") {
     const keyId = await pickKeyForRevoke(client);
     if (!keyId) return;
-    const ok = await confirm2({ message: "Revoke this API key?", default: false }).catch(() => false);
+    const ok = await runInteractive(
+      () => confirm2({ message: "Revoke this API key?", default: false })
+    ).catch(() => false);
     if (ok) ctx.sink.write(successBox(await runKeyRevoke(client, keyId)));
   } else if (action.toLowerCase() === "n") {
-    const name = await promptNewKeyName();
+    const name = await runInteractive(() => promptNewKeyName());
     const created = await client.post("/keys", { name });
     ctx.sink.write(success(`Created: ${created.name} (${created.prefix})`));
     ctx.sink.write(accent("Save this key \u2014 it won't be shown again:"));
@@ -2072,7 +2203,6 @@ async function runKeysInteractive(ctx) {
 
 // src/shell/prompt-loop.ts
 init_theme();
-import { cwd as cwd3 } from "process";
 
 // src/shell/completer.ts
 function buildCompleter(commands, history) {
@@ -2090,8 +2220,6 @@ function buildCompleter(commands, history) {
 
 // src/shell/prompt-loop.ts
 init_capabilities();
-init_layout();
-init_logger();
 async function runPromptLoop(initialProfile) {
   let profile = initialProfile;
   const workDir = cwd3();
@@ -2100,13 +2228,8 @@ async function runPromptLoop(initialProfile) {
     if (getCapabilities().interactive) {
       process.stdout.write("\x1B[2J\x1B[H");
     }
-    const data = await fetchHomeData(profile, workDir);
+    const data = await fetchHomeData(profile);
     console.log(renderHomeScreen(data));
-    console.log(statusBar([
-      profile ? muted(profile.email) : muted("guest"),
-      dim(workDir),
-      isDebugMode() ? muted("debug") : null
-    ].filter(Boolean)));
     console.log("");
   };
   await refresh();
@@ -2122,7 +2245,14 @@ async function runPromptLoop(initialProfile) {
     rl.close();
     process.exit(0);
   });
-  const prompt = () => process.stdout.write(accent("\u203A "));
+  setReadlineHooks(
+    () => rl.pause(),
+    () => {
+      process.stdout.write("\n");
+      rl.resume();
+    }
+  );
+  const prompt = () => process.stdout.write(accent("> "));
   prompt();
   for await (const line of rl) {
     await appendHistory(line);
@@ -2151,73 +2281,48 @@ async function runPromptLoop(initialProfile) {
 }
 
 // src/shell/auth-gate.ts
-init_layout();
-init_theme();
-init_width();
 import * as readline2 from "readline";
 import { stdin as input4, stdout as output2 } from "process";
+init_theme();
 
 // src/cli/profile.ts
 init_credentials();
 init_api_client();
 init_logger();
+function profileFromCredentials(creds) {
+  return {
+    id: "local",
+    email: creds.email || "user@local",
+    full_name: creds.full_name || null,
+    role: "analyst",
+    organization: "\u2014",
+    key_expires_at: creds.key_expires_at ?? null,
+    key_prefix: creds.key_prefix ?? null
+  };
+}
 async function tryGetProfile() {
+  const creds = await loadCredentials();
+  if (!creds?.api_key) return null;
   try {
-    const creds = await loadCredentials();
-    if (!creds?.api_key) return null;
-    const client = await getAuthenticatedClient();
-    return await client.get("/me");
+    const client = await FuzziApiClient.create();
+    const profile = await client.get("/me");
+    return profile;
   } catch (e) {
-    log.debug("profile bootstrap failed", e);
-    return null;
+    if (e instanceof ApiError && e.status === 401) {
+      log.debug("stored credentials invalid, clearing");
+      await clearCredentials();
+      return null;
+    }
+    log.debug("profile bootstrap failed, using cached credentials", e);
+    return profileFromCredentials(creds);
   }
 }
 
 // src/shell/auth-gate.ts
-init_brand();
-function renderAuthGate() {
-  const colW = Math.max(28, Math.floor(contentWidth() * 0.36));
-  const mark = centerInColumn(accent(renderFuzziMark()), colW);
-  const left = [
-    accentBold("Welcome to Fuzzi!"),
-    "",
-    mark,
-    "",
-    muted("Not connected"),
-    info("Sign in to run scans"),
-    "",
-    accent("/auth-key") + muted("  paste API key"),
-    accent("/help") + muted("       commands")
-  ].join("\n");
-  const rightTop = [
-    accentBold("Sign in to continue"),
-    "",
-    info("Press Enter to open your browser"),
-    muted("and authorize the CLI."),
-    "",
-    muted("A local server receives the callback"),
-    muted(`from ${APP_HOST} automatically.`)
-  ].join("\n");
-  const rightBottom = [
-    accentBold("Other options"),
-    "",
-    muted("Paste an API key with /auth-key"),
-    muted("from Settings \u2192 API Keys on the web."),
-    "",
-    italic(muted(SETTINGS_API_KEYS_URL))
-  ].join("\n");
-  return splitHomePanel({
-    title: `Fuzzi CLI v${VERSION}`,
-    left,
-    rightTop,
-    rightBottom,
-    leftRatio: 0.36
-  });
-}
 function waitForEnter() {
   return new Promise((resolve) => {
     const rl = readline2.createInterface({ input: input4, output: output2, terminal: true });
-    output2.write(accent("\n  \u203A Press Enter to open browser... "));
+    output2.write(accent("\n> Press Enter to open browser... "));
     rl.once("line", () => {
       rl.close();
       resolve();
@@ -2228,18 +2333,15 @@ async function runAuthGate() {
   const existing = await tryGetProfile();
   if (existing) return existing;
   if (!output2.isTTY) return null;
-  console.log(renderAuthGate());
+  console.log(renderAuthGateScreen());
   await waitForEnter();
-  const progress = createProgress("Opening browser...");
   try {
-    const result = await runBrowserLogin();
-    progress.succeed("Signed in");
-    console.log(accent(result.message));
+    const result = await runAssistedBrowserLogin();
+    console.log(result.message);
     return result.profile;
   } catch (e) {
-    progress.fail("Sign-in failed");
     console.log(muted(formatApiError(e)));
-    console.log(muted("Use /auth-key to paste an API key, or /auth to retry."));
+    console.log(muted("Run /auth-key to paste your API key manually."));
     return null;
   }
 }