thuban 0.3.0

package/cli.js

@@ -0,0 +1,1902 @@
+#!/usr/bin/env node
+
+/**
+ * Thuban CLI
+ * 
+ * Code Health Engine — scan, map, fix.
+ * 
+ * Usage:
+ *   npx thuban scan [path]          Scan a codebase for issues
+ *   npx thuban deps [path]          Map dependencies and detect circular imports
+ *   npx thuban drift [path]         Detect drift from Mother Code annotations
+ *   npx thuban inject [path]        Inject Mother Code DNA into files
+ *   npx thuban health [path]        Run health check on codebase
+ *   npx thuban report [path]        Full scan + deps + drift combined report
+ *   npx thuban hallucinate [path]   Detect AI hallucinations and phantom imports
+ *   npx thuban watch [path]         Live sentinel — continuous file monitoring
+ *   npx thuban dashboard [path]     Generate visual HTML dashboard report
+ *   npx thuban diff [path]          Scan only git-changed files
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+// Import engine components
+const CodeScanner = require('./packages/scanner/code-scanner.js');
+const DependencyGraph = require('./packages/scanner/dependency-graph.js');
+const DriftDetector = require('./packages/scanner/drift-detector.js');
+const WidgetGenerator = require('./packages/scanner/widget-generator.js');
+const AlertManager = require('./packages/scanner/alert-manager.js');
+const TechDebtAnalyzer = require('./packages/scanner/tech-debt-analyzer.js');
+const HallucinationDetector = require('./packages/scanner/hallucination-detector.js');
+const HtmlReportGenerator = require('./packages/scanner/html-report.js');
+const FileWatcher = require('./packages/scanner/file-watcher.js');
+const LicenseManager = require('./packages/scanner/license-manager.js');
+const PreCommitGate = require('./packages/scanner/pre-commit-gate.js');
+const TechDebtCostCalculator = require('./packages/scanner/tech-debt-cost.js');
+const GhostCodeDetector = require('./packages/scanner/ghost-code-detector.js');
+const AIConfidenceScorer = require('./packages/scanner/ai-confidence-scorer.js');
+const CopyPasteDriftDetector = require('./packages/scanner/copy-paste-detector.js');
+const CodebasePassport = require('./packages/scanner/codebase-passport.js');
+const ExecutiveReport = require('./packages/scanner/executive-report.js');
+const BaselineManager = require('./packages/scanner/baseline-manager.js');
+
+// ─── Helpers ───────────────────────────────────────────────
+
+const COLORS = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  red: '\x1b[31m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[34m',
+  cyan: '\x1b[36m',
+  gray: '\x1b[90m',
+  white: '\x1b[37m',
+  bgRed: '\x1b[41m',
+  bgGreen: '\x1b[42m',
+  bgYellow: '\x1b[43m',
+};
+
+function c(color, text) {
+  return `${COLORS[color]}${text}${COLORS.reset}`;
+}
+
+function banner() {
+  console.log('');
+  console.log(c('cyan', '  ╔══════════════════════════════════════╗'));
+  console.log(c('cyan', '  ║') + c('bold', '        THUBAN Code Health Engine     ') + c('cyan', '║'));
+  console.log(c('cyan', '  ║') + c('gray', '     Scan · Map · Detect · Fix        ') + c('cyan', '║'));
+  console.log(c('cyan', '  ╚══════════════════════════════════════╝'));
+  console.log('');
+}
+
+function printHelp() {
+  banner();
+  const lm = new LicenseManager();
+  const status = lm.getStatus();
+  console.log(c('gray', `  License: ${status.tierName} tier`) + (status.licensed ? c('green', ' ✓') : ''));
+  console.log('');
+  console.log(c('bold', '  USAGE'));
+  console.log('');
+  console.log(`    ${c('cyan', 'thuban scan')} [path]         Scan for code issues`);
+  console.log(`    ${c('cyan', 'thuban deps')} [path]         Map dependencies`);
+  console.log(`    ${c('cyan', 'thuban drift')} [path]        Detect drift from annotations`);
+  console.log(`    ${c('cyan', 'thuban inject')} [path]       Inject Mother Code DNA`);
+  console.log(`    ${c('cyan', 'thuban health')} [path]       Codebase health check`);
+  console.log(`    ${c('cyan', 'thuban report')} [path]       Full combined report`);
+  console.log(`    ${c('cyan', 'thuban debt')} [path]         Tech debt analysis with scores`);
+  console.log(`    ${c('cyan', 'thuban fix')} [path]          Auto-fix all fixable tech debt`);
+  console.log(`    ${c('cyan', 'thuban hallucinate')} [path]  Detect AI hallucinations`);
+  console.log(`    ${c('cyan', 'thuban watch')} [path]        Live sentinel monitoring`);
+  console.log(`    ${c('cyan', 'thuban dashboard')} [path]    Generate HTML report`);
+  console.log(`    ${c('cyan', 'thuban diff')} [path]         Scan only git-changed files`);
+  console.log(`    ${c('cyan', 'thuban gate')}               Pre-commit hallucination blocker`);
+  console.log(`    ${c('cyan', 'thuban cost')} [path]         Tech debt cost calculator`);
+  console.log(`    ${c('cyan', 'thuban ghosts')} [path]       Find dead AI-pasted code`);
+  console.log(`    ${c('cyan', 'thuban ai-score')} [path]     AI confidence score per function`);
+  console.log(`    ${c('cyan', 'thuban clones')} [path]       Copy-paste drift detection`);
+  console.log(`    ${c('cyan', 'thuban passport')} [path]     Generate codebase identity file`);
+  console.log(`    ${c('cyan', 'thuban executive')} [path]    CTO-ready PDF report (print from browser)`);
+  console.log(`    ${c('cyan', 'thuban baseline')} [path]    Create/check baseline (only fail on NEW issues)`);
+  console.log('');
+  console.log(c('bold', '  LICENSE'));
+  console.log('');
+  console.log(`    ${c('cyan', 'thuban activate')} <key>     Activate a license key`);
+  console.log(`    ${c('cyan', 'thuban status')}             Show license and usage status`);
+  console.log(`    ${c('cyan', 'thuban upgrade')}            Get a license key`);
+  console.log('');
+  console.log(c('bold', '  OPTIONS'));
+  console.log('');
+  console.log(`    ${c('gray', '--json')}                   Output as JSON`);
+  console.log(`    ${c('gray', '--fix')}                    Apply fixes (default: dry-run preview)`);
+  console.log(`    ${c('gray', '--dry-run')}                Preview changes without applying`);
+  console.log(`    ${c('gray', '--unsafe')}                 Allow runtime-changing fixes`);
+  console.log(`    ${c('gray', '--commit')}                 Auto-commit each fix for easy rollback`);
+  console.log(`    ${c('gray', '--baseline')}               Only report NEW issues (vs baseline)`);
+  console.log(`    ${c('gray', '--baseline-create')}        Snapshot current issues as baseline`);
+  console.log(`    ${c('gray', '--verbose')}                Show detailed output`);
+  console.log(`    ${c('gray', '--ignore <pattern>')}       Ignore files matching pattern`);
+  console.log(`    ${c('gray', '--max-issues <n>')}         Limit issues shown (default: 50)`);
+  console.log('');
+  console.log(c('gray', '  https://thuban.dev'));
+  console.log('');
+}
+
+function parseArgs(args) {
+  const opts = {
+    command: null,
+    targetPath: process.cwd(),
+    json: false,
+    fix: false,
+    dryRun: false,
+    safe: true,
+    gitCommit: false,
+    verbose: false,
+    ignore: [],
+    maxIssues: 50,
+    licenseKey: null,
+    baseline: false,
+    baselineCreate: false,
+  };
+
+  const noPathCommands = ['activate', 'status', 'upgrade', 'help', 'version'];
+
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg === '--json') { opts.json = true; }
+    else if (arg === '--fix') { opts.fix = true; }
+    else if (arg === '--dry-run' || arg === '--dryrun') { opts.dryRun = true; }
+    else if (arg === '--unsafe') { opts.safe = false; }
+    else if (arg === '--git-commit' || arg === '--commit') { opts.gitCommit = true; }
+    else if (arg === '--baseline') { opts.baseline = true; }
+    else if (arg === '--baseline-create') { opts.baselineCreate = true; }
+    else if (arg === '--verbose') { opts.verbose = true; }
+    else if (arg === '--ignore' && args[i + 1]) { opts.ignore.push(args[++i]); }
+    else if (arg === '--max-issues' && args[i + 1]) { opts.maxIssues = parseInt(args[++i], 10); }
+    else if (arg === '--help' || arg === '-h') { opts.command = 'help'; }
+    else if (arg === '--version' || arg === '-v') { opts.command = 'version'; }
+    else if (!opts.command) { opts.command = arg; }
+    else if (opts.command === 'activate' && !opts.licenseKey) { opts.licenseKey = arg; }
+    else if (!noPathCommands.includes(opts.command)) { opts.targetPath = path.resolve(arg); }
+    i++;
+  }
+
+  return opts;
+}
+
+// ─── Collect files recursively ───────────────────────────────
+
+function collectFiles(dir, ignorePatterns = []) {
+  const defaultIgnore = ['node_modules', '.git', 'dist', 'build', '.next', '__pycache__', '.venv', 'venv', 'coverage', '.cache', '.turbo'];
+  const allIgnore = [...defaultIgnore, ...ignorePatterns];
+  const extensions = ['.js', '.ts', '.jsx', '.tsx', '.py', '.json', '.mjs', '.cjs'];
+  const MAX_FILE_SIZE = 1024 * 1024; // 1MB per file — skip anything larger
+  const MAX_FILES = 50000;           // Hard cap to prevent memory issues
+  const files = [];
+
+  function walk(currentDir) {
+    if (files.length >= MAX_FILES) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(currentDir, { withFileTypes: true });
+    } catch (e) {
+      return;
+    }
+    for (const entry of entries) {
+      if (files.length >= MAX_FILES) return;
+      if (allIgnore.some(p => entry.name === p || entry.name.match(p))) continue;
+      const fullPath = path.join(currentDir, entry.name);
+      if (entry.isDirectory()) {
+        walk(fullPath);
+      } else if (extensions.some(ext => entry.name.endsWith(ext))) {
+        try {
+          const stat = fs.statSync(fullPath);
+          if (stat.size <= MAX_FILE_SIZE) {
+            files.push(fullPath);
+          }
+        } catch (e) {
+          // Skip files we can't stat
+        }
+      }
+    }
+  }
+
+  walk(dir);
+  return files;
+}
+
+// ─── Commands ───────────────────────────────────────────────
+
+async function cmdScan(opts) {
+  const startTime = Date.now();
+  const targetPath = path.resolve(opts.targetPath);
+
+  // ─── License check ───────────────────────────────────────
+  const lm = new LicenseManager();
+  const tier = lm.getTierConfig();
+  const scanCheck = lm.canScan();
+
+  if (!scanCheck.allowed && !opts.json) {
+    console.log('');
+    console.log(c('red', '  ╔══════════════════════════════════════════════════╗'));
+    console.log(c('red', '  ║') + c('bold', '  Monthly scan limit reached                      ') + c('red', '║'));
+    console.log(c('red', '  ╚══════════════════════════════════════════════════╝'));
+    console.log('');
+    console.log(`  You've used ${c('bold', scanCheck.used + '/' + scanCheck.limit)} free scans this month.`);
+    console.log(`  Resets on ${c('cyan', scanCheck.resetsOn)}.`);
+    console.log('');
+    console.log(`  ${c('cyan', 'Upgrade to Pro')} for unlimited scans, full reports, and auto-fix:`);
+    console.log(`  ${c('bold', 'https://thuban.dev/pricing')}`);
+    console.log('');
+    console.log(`  Or activate a key: ${c('cyan', 'thuban activate <your-key>')}`);
+    console.log('');
+    process.exit(0);
+  }
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  SCANNING: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const allFiles = collectFiles(targetPath, opts.ignore);
+  const totalFileCount = allFiles.length;
+
+  // File limit gating
+  const files = tier.maxFiles < Infinity ? allFiles.slice(0, tier.maxFiles) : allFiles;
+  const isFileCapped = totalFileCount > tier.maxFiles;
+
+  if (!opts.json && isFileCapped) {
+    console.log(c('yellow', `  Free tier: scanning ${tier.maxFiles} of ${totalFileCount} files`));
+    console.log(c('gray', `  Upgrade to Pro to scan your entire codebase`));
+    console.log('');
+  } else if (!opts.json) {
+    console.log(c('gray', `  Found ${files.length} files to scan...`));
+    console.log('');
+  }
+
+  // Run all analyses in parallel for the gut-punch report
+  const scanner = new CodeScanner({
+    rootPath: targetPath,
+    ignorePatterns: ['node_modules/**', '.git/**', 'dist/**', ...opts.ignore],
+  });
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+
+  const [scanResults, hallResults] = await Promise.all([
+    scanner.scanFiles(files),
+    hallucinationDetector.scan(files),
+  ]);
+
+  const elapsed = Date.now() - startTime;
+
+  // Record this scan
+  lm.recordScan();
+
+  // ─── Collect all issues ──────────────────────────────────
+  const allIssues = [];
+  for (const [file, fileResults] of Object.entries(scanResults)) {
+    if (fileResults.issues) {
+      for (const issue of fileResults.issues) {
+        allIssues.push({ file: path.relative(targetPath, file), ...issue });
+      }
+    }
+  }
+
+  // Add hallucination results as issues
+  for (const item of hallResults.phantomAPIs) {
+    allIssues.push({
+      file: item.file, line: item.line, severity: 'critical',
+      category: 'hallucination', id: 'HALL_API',
+      message: `${item.name} — this API does not exist`,
+      suggestion: item.suggestion,
+      crash: true,
+    });
+  }
+  for (const item of hallResults.phantomImports) {
+    allIssues.push({
+      file: item.file, line: item.line, severity: 'critical',
+      category: 'hallucination', id: 'HALL_IMPORT',
+      message: `${item.module} — ${item.reason}`,
+      crash: true,
+    });
+  }
+  for (const item of hallResults.deprecatedAPIs) {
+    allIssues.push({
+      file: item.file, line: item.line, severity: 'high',
+      category: 'deprecated', id: 'DEPR_API',
+      message: `${item.name} — deprecated since ${item.since}`,
+      suggestion: item.suggestion,
+    });
+  }
+  for (const item of hallResults.aiSmells) {
+    allIssues.push({
+      file: item.file, line: item.line, severity: 'warning',
+      category: 'ai_smell', id: item.id,
+      message: item.message,
+    });
+  }
+
+  if (opts.json) {
+    console.log(JSON.stringify({
+      files: totalFileCount,
+      filesScanned: files.length,
+      elapsed_ms: elapsed,
+      tier: lm.getTier(),
+      issues: tier.showFullDetails ? allIssues : allIssues.slice(0, tier.teaserIssues),
+      totalIssues: allIssues.length,
+      gated: !tier.showFullDetails,
+    }, null, 2));
+    return;
+  }
+
+  // ─── Sort by severity ────────────────────────────────────
+  const severityOrder = { critical: 0, high: 1, error: 2, medium: 3, warning: 4, low: 5, info: 6 };
+  allIssues.sort((a, b) => (severityOrder[a.severity] || 99) - (severityOrder[b.severity] || 99));
+
+  const criticals = allIssues.filter(i => i.severity === 'critical');
+  const highs = allIssues.filter(i => i.severity === 'high' || i.severity === 'error');
+  const mediums = allIssues.filter(i => i.severity === 'medium' || i.severity === 'warning');
+  const lows = allIssues.filter(i => i.severity === 'low' || i.severity === 'info');
+  const hallucinations = allIssues.filter(i => i.category === 'hallucination');
+  const deprecated = allIssues.filter(i => i.category === 'deprecated');
+
+  // ─── Health score ────────────────────────────────────────
+  // Weight by category: hallucinations are critical, AI smells are minor
+  const aiSmellIssues = allIssues.filter(i => i.category === 'ai_smell');
+  const nonSmellMediums = mediums.filter(i => i.category !== 'ai_smell');
+  const score = Math.max(0, 100
+    - (criticals.length * 15)
+    - (highs.length * 5)
+    - (nonSmellMediums.length * 2)
+    - (aiSmellIssues.length * 0.5)
+    - (lows.length * 0.25)
+  );
+  const grade = score >= 90 ? 'A' : score >= 80 ? 'B' : score >= 70 ? 'C+' : score >= 60 ? 'C' : score >= 50 ? 'D+' : score >= 40 ? 'D' : 'F';
+  const scoreColor = score >= 80 ? 'green' : score >= 60 ? 'yellow' : 'red';
+
+  // ═══════════════════════════════════════════════════════════
+  // THE GUT-PUNCH OUTPUT
+  // ═══════════════════════════════════════════════════════════
+
+  console.log(c('cyan', '  ╔══════════════════════════════════════════════════════╗'));
+  console.log(c('cyan', '  ║') + c('bold', '  THUBAN SCAN                                        ') + c('cyan', '║'));
+  console.log(c('cyan', '  ╠══════════════════════════════════════════════════════╣'));
+  console.log(c('cyan', '  ║') + `  Files scanned:     ${c('bold', String(files.length).padEnd(6))}` + (isFileCapped ? c('yellow', ` of ${totalFileCount}`) : '              ') + c('cyan', '       ║'));
+  console.log(c('cyan', '  ║') + `  Health score:      ${c(scoreColor, (grade + ' (' + Math.round(score) + '/100)').padEnd(20))}` + c('cyan', '           ║'));
+  console.log(c('cyan', '  ║') + `  Scan time:         ${c('gray', (elapsed + 'ms').padEnd(20))}` + c('cyan', '           ║'));
+  console.log(c('cyan', '  ╚══════════════════════════════════════════════════════╝'));
+  console.log('');
+
+  // ─── CRITICAL: Hallucinated APIs (will crash) ────────────
+  if (hallucinations.length > 0) {
+    console.log(c('bgRed', ' CRITICAL ') + c('red', c('bold', ` ${hallucinations.length} Hallucinated API${hallucinations.length > 1 ? 's' : ''}`)) + c('red', ' (will crash at runtime)'));
+    console.log('');
+
+    const showCount = tier.showFullDetails ? hallucinations.length : Math.min(tier.teaserIssues, hallucinations.length);
+    for (let i = 0; i < showCount; i++) {
+      const item = hallucinations[i];
+      const lineRef = item.line ? `:${item.line}` : '';
+      console.log(`  ${c('cyan', item.file + lineRef)}`);
+      // Try to read the actual source line for maximum impact
+      try {
+        const fullPath = path.resolve(targetPath, item.file);
+        const lines = fs.readFileSync(fullPath, 'utf-8').split('\n');
+        if (item.line && lines[item.line - 1]) {
+          console.log(`    ${c('red', lines[item.line - 1].trim())}`);
+        }
+      } catch (e) { /* skip */ }
+      console.log(`    ${c('yellow', '^^^')} ${item.message}`);
+      if (item.suggestion) {
+        console.log(`    ${c('green', 'Fix:')} ${item.suggestion}`);
+      }
+      console.log('');
+    }
+
+    if (hallucinations.length > showCount) {
+      console.log(c('gray', `    ... ${hallucinations.length - showCount} more hallucinations hidden`));
+      console.log(c('cyan', `    Upgrade to Pro to see all: `) + c('bold', 'thuban upgrade'));
+      console.log('');
+    }
+  }
+
+  // ─── HIGH: Deprecated APIs ───────────────────────────────
+  if (deprecated.length > 0) {
+    console.log(c('red', c('bold', `  HIGH: ${deprecated.length} Deprecated API${deprecated.length > 1 ? 's' : ''}`)) + c('gray', ' (will break on Node upgrade)'));
+    console.log('');
+
+    const showCount = tier.showFullDetails ? deprecated.length : Math.min(tier.teaserIssues, deprecated.length);
+    for (let i = 0; i < showCount; i++) {
+      const item = deprecated[i];
+      const lineRef = item.line ? `:${item.line}` : '';
+      console.log(`  ${c('cyan', item.file + lineRef)}`);
+      console.log(`    ${c('yellow', item.message)}`);
+      if (item.suggestion) {
+        console.log(`    ${c('green', '→')} ${item.suggestion}`);
+      }
+      console.log('');
+    }
+
+    if (deprecated.length > showCount) {
+      console.log(c('gray', `    ... ${deprecated.length - showCount} more hidden`));
+      console.log('');
+    }
+  }
+
+  // ─── Security & quality issues ───────────────────────────
+  const securityIssues = allIssues.filter(i => i.category === 'security');
+  const qualityIssues = allIssues.filter(i => i.category === 'quality' || i.category === 'performance' || i.category === 'ai' || i.category === 'ai_smell');
+
+  if (securityIssues.length > 0) {
+    console.log(c('red', c('bold', `  SECURITY: ${securityIssues.length} issue${securityIssues.length > 1 ? 's' : ''}`)));
+    const showCount = tier.showFullDetails ? Math.min(securityIssues.length, 10) : Math.min(tier.teaserIssues, securityIssues.length);
+    for (let i = 0; i < showCount; i++) {
+      const item = securityIssues[i];
+      const lineRef = item.line ? `:${item.line}` : '';
+      console.log(`    ${c('red', '✗')} ${c('cyan', item.file + lineRef)} ${c('gray', item.message)}`);
+    }
+    if (securityIssues.length > showCount) {
+      console.log(c('gray', `    ... ${securityIssues.length - showCount} more hidden`));
+    }
+    console.log('');
+  }
+
+  if (qualityIssues.length > 0) {
+    console.log(c('yellow', c('bold', `  CODE QUALITY: ${qualityIssues.length} issue${qualityIssues.length > 1 ? 's' : ''}`)));
+    const showCount = tier.showFullDetails ? Math.min(qualityIssues.length, 10) : Math.min(3, qualityIssues.length);
+    for (const item of qualityIssues.slice(0, showCount)) {
+      const lineRef = item.line ? `:${item.line}` : '';
+      const sevColor = item.severity === 'high' || item.severity === 'error' ? 'red' : 'yellow';
+      console.log(`    ${c(sevColor, '!')} ${c('cyan', item.file + lineRef)} ${c('gray', item.message)}`);
+    }
+    if (qualityIssues.length > showCount) {
+      console.log(c('gray', `    ... ${qualityIssues.length - showCount} more`));
+    }
+    console.log('');
+  }
+
+  // ─── THE VERDICT ─────────────────────────────────────────
+  console.log(c('bold', '  ┌──────────────────────────────────────────────────────┐'));
+
+  if (score < 60) {
+    console.log(c('bold', '  │  ') + c('red', 'YOUR CODEBASE HAS A SERIOUS HEALTH PROBLEM      ') + c('bold', '  │'));
+  } else if (score < 80) {
+    console.log(c('bold', '  │  ') + c('yellow', 'YOUR CODEBASE NEEDS ATTENTION                   ') + c('bold', '  │'));
+  } else {
+    console.log(c('bold', '  │  ') + c('green', 'YOUR CODEBASE IS IN GOOD SHAPE                  ') + c('bold', '  │'));
+  }
+
+  console.log(c('bold', '  │') + `  Score: ${c(scoreColor, grade + ' (' + Math.round(score) + '/100)')}                                     ` + c('bold', '│'));
+  console.log(c('bold', '  └──────────────────────────────────────────────────────┘'));
+  console.log('');
+
+  // ─── Impact statement ────────────────────────────────────
+  if (criticals.length > 0) {
+    console.log(c('red', `  ${criticals.length} function${criticals.length > 1 ? 's' : ''} will crash in production.`));
+    const fixTime = criticals.length <= 3 ? '30 seconds' : criticals.length <= 10 ? '2 minutes' : '10 minutes';
+    console.log(c('gray', `  Estimated cleanup: ${fixTime} with Thuban auto-fix.`));
+    console.log(c('gray', `  Estimated cost if shipped: your weekend.`));
+    console.log('');
+  }
+
+  // ─── FREE TIER: Upgrade CTA ──────────────────────────────
+  if (!tier.showFullDetails) {
+    const hidden = allIssues.length - tier.teaserIssues;
+    if (hidden > 0) {
+      console.log(c('cyan', '  ╔══════════════════════════════════════════════════════╗'));
+      console.log(c('cyan', '  ║') + c('bold', `  ${hidden} more issues hidden                              `) + c('cyan', '║'));
+      console.log(c('cyan', '  ║') + c('gray', '  Upgrade to see every issue, fix them automatically,') + c('cyan', '║'));
+      console.log(c('cyan', '  ║') + c('gray', '  and get the full HTML dashboard report.            ') + c('cyan', '║'));
+      console.log(c('cyan', '  ╠══════════════════════════════════════════════════════╣'));
+      console.log(c('cyan', '  ║') + `  ${c('bold', 'thuban upgrade')}      Open pricing page               ` + c('cyan', '║'));
+      console.log(c('cyan', '  ║') + `  ${c('bold', 'thuban activate')} <key>  Activate a license key       ` + c('cyan', '║'));
+      console.log(c('cyan', '  ╚══════════════════════════════════════════════════════╝'));
+      console.log('');
+    }
+
+    // Show scan counter
+    const scanStatus = lm.canScan();
+    const remaining = scanStatus.remaining;
+    console.log(c('gray', `  Free scans remaining this month: ${remaining}/${scanStatus.limit}`));
+    console.log('');
+  } else {
+    // Pro/Team: show fix command
+    if (allIssues.length > 0) {
+      console.log(`  ${c('cyan', 'thuban fix . --fix')}     Auto-fix all fixable issues`);
+      console.log(`  ${c('cyan', 'thuban dashboard .')}    Generate full HTML report`);
+      console.log('');
+    }
+  }
+
+  if (isFileCapped) {
+    console.log(c('yellow', `  ⚠ ${totalFileCount - tier.maxFiles} files were not scanned (free tier limit: ${tier.maxFiles} files)`));
+    console.log(c('gray', `  Your actual score may be worse. Upgrade to scan everything.`));
+    console.log('');
+  }
+}
+
+async function cmdDeps(opts) {
+  const startTime = Date.now();
+  const targetPath = path.resolve(opts.targetPath);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  MAPPING DEPENDENCIES: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const graph = new DependencyGraph({ rootPath: targetPath });
+  await graph.build(files);
+  const elapsed = Date.now() - startTime;
+
+  const summary = graph.getModuleSummary();
+  const critical = graph.getMostCriticalFiles(10);
+  const orphans = graph.getOrphanFiles();
+  const circular = graph.circularDeps || [];
+
+  if (opts.json) {
+    console.log(JSON.stringify({ elapsed_ms: elapsed, summary, critical, orphans, circular, graph: graph.toJSON() }, null, 2));
+    return;
+  }
+
+  console.log(c('gray', `  Analysed ${files.length} files in ${elapsed}ms`));
+  console.log('');
+
+  console.log(c('bold', '  DEPENDENCY SUMMARY'));
+  console.log(`  Files:             ${summary.totalFiles || files.length}`);
+  console.log(`  Import links:      ${summary.totalImports || 0}`);
+  console.log(`  Circular deps:     ${circular.length > 0 ? c('red', circular.length) : c('green', '0')}`);
+  console.log(`  Orphan files:      ${orphans.length > 0 ? c('yellow', orphans.length) : c('green', '0')}`);
+  console.log('');
+
+  if (critical.length > 0) {
+    console.log(c('bold', '  MOST CRITICAL FILES') + c('gray', ' (most dependents)'));
+    for (const f of critical) {
+      const filePath = typeof f === 'string' ? f : (f.file || f.path || String(f));
+      const rel = path.relative(targetPath, filePath);
+      const deps = typeof f === 'object' ? (f.dependents || f.score || f.count || '?') : '?';
+      console.log(`    ${c('cyan', rel)} ${c('gray', '→ ' + deps + ' dependents')}`);
+    }
+    console.log('');
+  }
+
+  if (circular.length > 0) {
+    console.log(c('red', '  CIRCULAR DEPENDENCIES'));
+    for (const cycle of circular.slice(0, 5)) {
+      const cycleStr = Array.isArray(cycle) ? cycle.map(f => path.relative(targetPath, f)).join(' → ') : String(cycle);
+      console.log(`    ${c('yellow', '⟲')} ${cycleStr}`);
+    }
+    console.log('');
+  }
+
+  if (orphans.length > 0) {
+    console.log(c('yellow', '  ORPHAN FILES') + c('gray', ' (no imports, no exports consumed)'));
+    for (const orphan of orphans.slice(0, 10)) {
+      const orphanPath = typeof orphan === 'string' ? orphan : (orphan.file || orphan.path || String(orphan));
+      console.log(`    ${c('gray', '○')} ${path.relative(targetPath, orphanPath)}`);
+    }
+    if (orphans.length > 10) {
+      console.log(c('gray', `    ... and ${orphans.length - 10} more`));
+    }
+    console.log('');
+  }
+}
+
+async function cmdDrift(opts) {
+  const startTime = Date.now();
+  const targetPath = path.resolve(opts.targetPath);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  DETECTING DRIFT: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const detector = new DriftDetector({ rootPath: targetPath });
+
+  const results = [];
+  let withWidget = 0;
+  let withDrift = 0;
+
+  for (const file of files) {
+    try {
+      const result = await detector.analyzeFile(file);
+      if (result && result.hasWidget) {
+        withWidget++;
+        if (result.drifts && result.drifts.length > 0) {
+          withDrift++;
+          results.push({ file: path.relative(targetPath, file), ...result });
+        }
+      }
+    } catch (e) { /* skip unreadable files */ }
+  }
+
+  const elapsed = Date.now() - startTime;
+
+  if (opts.json) {
+    console.log(JSON.stringify({ elapsed_ms: elapsed, total: files.length, annotated: withWidget, drifted: withDrift, results }, null, 2));
+    return;
+  }
+
+  console.log(c('gray', `  Checked ${files.length} files in ${elapsed}ms`));
+  console.log('');
+  console.log(`  Files with Mother Code:   ${c('cyan', withWidget)}`);
+  console.log(`  Files without:            ${c('yellow', files.length - withWidget)}`);
+  console.log(`  Files with drift:         ${withDrift > 0 ? c('red', withDrift) : c('green', '0')}`);
+  console.log('');
+
+  if (results.length > 0) {
+    console.log(c('bold', '  DRIFT DETECTED'));
+    for (const r of results.slice(0, 20)) {
+      console.log(`  ${c('yellow', '⚠')} ${c('cyan', r.file)}`);
+      for (const d of r.drifts) {
+        console.log(`    ${c('gray', '→')} ${d.type}: ${d.message || d.detail || JSON.stringify(d)}`);
+      }
+    }
+    console.log('');
+  }
+
+  const coverage = files.length > 0 ? Math.round((withWidget / files.length) * 100) : 0;
+  const covColor = coverage >= 80 ? 'green' : coverage >= 40 ? 'yellow' : 'red';
+  console.log(`  Mother Code coverage: ${c(covColor, coverage + '%')}`);
+  console.log('');
+}
+
+async function cmdInject(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  INJECTING MOTHER CODE: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const files = collectFiles(targetPath, opts.ignore).filter(f => f.endsWith('.js') || f.endsWith('.ts'));
+  const graph = new DependencyGraph({ rootPath: targetPath });
+  await graph.build(files);
+
+  const generator = new WidgetGenerator({ rootPath: targetPath, dependencyGraph: graph });
+
+  let injected = 0;
+  let skipped = 0;
+  const previews = [];
+
+  for (const file of files) {
+    try {
+      const content = fs.readFileSync(file, 'utf-8');
+      // Check if already has a widget
+      if (content.includes('@purpose') && content.includes('@module')) {
+        skipped++;
+        continue;
+      }
+
+      const widget = generator.generateWidget(file, content);
+      if (!widget) { skipped++; continue; }
+
+      if (opts.fix) {
+        // Actually inject
+        const newContent = widget + '\n\n' + content;
+        fs.writeFileSync(file, newContent, 'utf-8');
+        injected++;
+        if (!opts.json) {
+          console.log(`  ${c('green', '✓')} ${path.relative(targetPath, file)}`);
+        }
+      } else {
+        previews.push({ file: path.relative(targetPath, file), widget });
+        injected++;
+      }
+    } catch (e) { skipped++; }
+  }
+
+  if (opts.json) {
+    console.log(JSON.stringify({ injected, skipped, dryRun: !opts.fix, previews }, null, 2));
+    return;
+  }
+
+  console.log('');
+  if (!opts.fix) {
+    console.log(c('yellow', `  DRY RUN — ${injected} files would be annotated. Use --fix to apply.`));
+    if (opts.verbose && previews.length > 0) {
+      console.log('');
+      for (const p of previews.slice(0, 5)) {
+        console.log(`  ${c('cyan', p.file)}:`);
+        console.log(c('gray', p.widget.split('\n').map(l => '    ' + l).join('\n')));
+        console.log('');
+      }
+    }
+  } else {
+    console.log(c('green', `  ✓ Injected Mother Code into ${injected} files`));
+  }
+  console.log(`  ${c('gray', `Skipped: ${skipped} (already annotated or non-JS/TS)`)}`);
+  console.log('');
+}
+
+async function cmdReport(opts) {
+  const startTime = Date.now();
+  const targetPath = path.resolve(opts.targetPath);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  FULL REPORT: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const files = collectFiles(targetPath, opts.ignore);
+
+  // Run all analyses in parallel
+  const scanner = new CodeScanner({ rootPath: targetPath });
+  const graph = new DependencyGraph({ rootPath: targetPath });
+  const detector = new DriftDetector({ rootPath: targetPath });
+
+  const [scanResults] = await Promise.all([
+    scanner.scanFiles(files),
+    graph.build(files),
+  ]);
+
+  // Drift check
+  let driftCount = 0;
+  let annotated = 0;
+  for (const file of files) {
+    try {
+      const result = await detector.analyzeFile(file);
+      if (result && result.hasWidget) {
+        annotated++;
+        if (result.drifts && result.drifts.length > 0) driftCount++;
+      }
+    } catch (e) { /* skip */ }
+  }
+
+  const elapsed = Date.now() - startTime;
+
+  // Count issues
+  let totalIssues = 0;
+  let criticalCount = 0;
+  let highCount = 0;
+  for (const [, r] of Object.entries(scanResults)) {
+    if (r.issues) {
+      totalIssues += r.issues.length;
+      criticalCount += r.issues.filter(i => i.severity === 'critical').length;
+      highCount += r.issues.filter(i => i.severity === 'high').length;
+    }
+  }
+
+  const orphans = graph.getOrphanFiles();
+  const circular = graph.circularDeps || [];
+  const coverage = files.length > 0 ? Math.round((annotated / files.length) * 100) : 0;
+
+  // Health score
+  const score = Math.max(0, Math.round(
+    100
+    - (criticalCount * 15)
+    - (highCount * 5)
+    - (circular.length * 10)
+    - (orphans.length * 1)
+    - ((100 - coverage) * 0.1)
+    - (driftCount * 3)
+  ));
+
+  if (opts.json) {
+    console.log(JSON.stringify({
+      elapsed_ms: elapsed,
+      files: files.length,
+      health_score: score,
+      issues: { total: totalIssues, critical: criticalCount, high: highCount },
+      dependencies: { circular: circular.length, orphans: orphans.length },
+      mother_code: { annotated, coverage_pct: coverage, drifted: driftCount },
+    }, null, 2));
+    return;
+  }
+
+  const scoreColor = score >= 80 ? 'green' : score >= 60 ? 'yellow' : 'red';
+
+  console.log(c('bold', '  ╔══════════════════════════════════════╗'));
+  console.log(c('bold', '  ║         THUBAN HEALTH REPORT         ║'));
+  console.log(c('bold', '  ╚══════════════════════════════════════╝'));
+  console.log('');
+  console.log(`  ${c('bold', 'Health Score:')}       ${c(scoreColor, score + '/100')}`);
+  console.log(`  ${c('bold', 'Files Scanned:')}      ${files.length}`);
+  console.log(`  ${c('bold', 'Time:')}               ${elapsed}ms`);
+  console.log('');
+  console.log(c('bold', '  ── Code Quality ──────────────────────'));
+  console.log(`  Total issues:      ${totalIssues}`);
+  console.log(`  Critical:          ${criticalCount > 0 ? c('red', criticalCount) : c('green', '0')}`);
+  console.log(`  High:              ${highCount > 0 ? c('red', highCount) : c('green', '0')}`);
+  console.log('');
+  console.log(c('bold', '  ── Dependencies ─────────────────────'));
+  console.log(`  Circular deps:     ${circular.length > 0 ? c('red', circular.length) : c('green', '0')}`);
+  console.log(`  Orphan files:      ${orphans.length > 0 ? c('yellow', orphans.length) : c('green', '0')}`);
+  console.log('');
+  console.log(c('bold', '  ── Mother Code ──────────────────────'));
+  console.log(`  Annotated files:   ${annotated}`);
+  console.log(`  Coverage:          ${c(coverage >= 80 ? 'green' : coverage >= 40 ? 'yellow' : 'red', coverage + '%')}`);
+  console.log(`  Drifted files:     ${driftCount > 0 ? c('yellow', driftCount) : c('green', '0')}`);
+  console.log('');
+
+  // Grade
+  const grade = score >= 90 ? 'A' : score >= 80 ? 'B' : score >= 70 ? 'C' : score >= 60 ? 'D' : 'F';
+  const gradeColor = score >= 80 ? 'green' : score >= 60 ? 'yellow' : 'red';
+  console.log(`  ${c('bold', 'Grade:')} ${c(gradeColor, grade)}`);
+  console.log('');
+
+  if (score < 80) {
+    console.log(c('bold', '  RECOMMENDATIONS:'));
+    if (criticalCount > 0) console.log(`  ${c('red', '→')} Fix ${criticalCount} critical issues immediately`);
+    if (circular.length > 0) console.log(`  ${c('yellow', '→')} Resolve ${circular.length} circular dependencies`);
+    if (coverage < 50) console.log(`  ${c('yellow', '→')} Run ${c('cyan', 'thuban inject --fix')} to improve Mother Code coverage`);
+    if (driftCount > 0) console.log(`  ${c('yellow', '→')} ${driftCount} files have drifted from their annotations`);
+    if (orphans.length > 5) console.log(`  ${c('gray', '→')} Consider removing ${orphans.length} orphan files`);
+    console.log('');
+  }
+}
+
+// ─── Tech Debt & Fix Commands ────────────────────────────
+
+async function cmdDebt(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const files = collectFiles(targetPath, opts.ignore);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  TECH DEBT ANALYSIS: ') + c('cyan', targetPath));
+    console.log(c('gray', `  Scanning ${files.length} files...`));
+    console.log('');
+  }
+
+  const analyzer = new TechDebtAnalyzer({ rootPath: targetPath });
+  const debt = await analyzer.analyze(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(analyzer.toJSON(debt), null, 2));
+  } else {
+    console.log(analyzer.formatReport(debt));
+  }
+}
+
+async function cmdFix(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const files = collectFiles(targetPath, opts.ignore);
+  const { execSync } = require('child_process');
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  AUTO-FIX TECH DEBT: ') + c('cyan', targetPath));
+    console.log('');
+  }
+
+  const analyzer = new TechDebtAnalyzer({ rootPath: targetPath });
+
+  // ─── DRY RUN is the default (Senate recommendation #1) ────
+  if (!opts.fix) {
+    const result = await analyzer.fix(files, { dryRun: true });
+
+    if (!opts.json) {
+      console.log(c('cyan', '  ╔══════════════════════════════════════════════════════╗'));
+      console.log(c('cyan', '  ║') + c('bold', '  DRY RUN — no files will be changed               ') + c('cyan', '║'));
+      console.log(c('cyan', '  ╚══════════════════════════════════════════════════════╝'));
+      console.log('');
+      console.log(`  Fixable items:    ${c('bold', result.totalFixable)}`);
+      console.log('');
+
+      const grouped = {};
+      const safeActions = ['inject_widget', 'regenerate_widget', 'remove_console_log', 'flag_for_removal'];
+      const unsafeActions = ['break_circular', 'extract_to_env', 'update_deprecated_api'];
+      let safeCount = 0;
+      let unsafeCount = 0;
+
+      for (const f of result.fixes) {
+        const action = f.fixAction || 'unknown';
+        if (!grouped[action]) grouped[action] = 0;
+        grouped[action]++;
+        if (unsafeActions.includes(action)) unsafeCount++;
+        else safeCount++;
+      }
+
+      console.log(c('green', c('bold', `  SAFE FIXES (${safeCount})`)) + c('gray', ' — no runtime behaviour change'));
+      for (const [action, count] of Object.entries(grouped).sort((a, b) => b[1] - a[1])) {
+        if (unsafeActions.includes(action)) continue;
+        const label = {
+          'inject_widget': 'Inject Mother Code DNA annotations',
+          'regenerate_widget': 'Update stale annotations',
+          'remove_console_log': 'Remove debug console.logs',
+          'flag_for_removal': 'Confirm orphan files for removal',
+        }[action] || action;
+        console.log(`    ${c('green', '→')} ${label}: ${c('bold', count)}`);
+      }
+      console.log('');
+
+      if (unsafeCount > 0) {
+        console.log(c('yellow', c('bold', `  UNSAFE FIXES (${unsafeCount})`)) + c('gray', ' — may change runtime behaviour'));
+        for (const [action, count] of Object.entries(grouped).sort((a, b) => b[1] - a[1])) {
+          if (!unsafeActions.includes(action)) continue;
+          const label = {
+            'break_circular': 'Restructure circular dependencies',
+            'extract_to_env': 'Extract hardcoded secrets to env vars',
+            'update_deprecated_api': 'Replace deprecated API calls',
+          }[action] || action;
+          console.log(`    ${c('yellow', '!')} ${label}: ${c('bold', count)}`);
+        }
+        console.log('');
+        console.log(c('gray', '  Unsafe fixes require --unsafe flag:'));
+        console.log(`    ${c('cyan', 'thuban fix [path] --fix --unsafe')}`);
+        console.log('');
+      }
+
+      console.log(c('bold', '  TO APPLY:'));
+      console.log(`    ${c('cyan', 'thuban fix [path] --fix')}              Apply safe fixes only`);
+      console.log(`    ${c('cyan', 'thuban fix [path] --fix --unsafe')}     Apply all fixes`);
+      console.log(`    ${c('cyan', 'thuban fix [path] --fix --commit')}     Each fix = separate git commit`);
+      console.log('');
+    } else {
+      console.log(JSON.stringify(result, null, 2));
+    }
+    return;
+  }
+
+  // ─── ACTUAL FIX MODE ──────────────────────────────────────
+  if (!opts.json) {
+    if (opts.safe) {
+      console.log(c('green', '  SAFE MODE') + c('gray', ' — only non-runtime-changing fixes will be applied'));
+    } else {
+      console.log(c('yellow', '  UNSAFE MODE') + c('gray', ' — all fixes including runtime changes'));
+    }
+    console.log('');
+  }
+
+  const result = await analyzer.fix(files, {
+    dryRun: false,
+    safeOnly: opts.safe,
+  });
+
+  // ─── GIT COMMIT MODE (Senate recommendation: each fix = revertable commit) ─
+  if (opts.gitCommit && result.fixed > 0) {
+    try {
+      execSync('git rev-parse --git-dir', { cwd: targetPath, stdio: 'pipe' });
+      execSync('git add -A', { cwd: targetPath, stdio: 'pipe' });
+      const commitMsg = `fix(thuban): auto-fix ${result.fixed} issues [safe=${opts.safe}]`;
+      execSync(`git commit -m "${commitMsg}"`, { cwd: targetPath, stdio: 'pipe' });
+      if (!opts.json) {
+        console.log(c('green', `  ✓ Changes committed: "${commitMsg}"`));
+        console.log(c('gray', '  Revert with: git revert HEAD'));
+        console.log('');
+      }
+    } catch (e) {
+      if (!opts.json) {
+        console.log(c('yellow', '  ⚠ Could not auto-commit: ' + (e.message || 'not a git repo')));
+        console.log('');
+      }
+    }
+  }
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(c('green', `  ✓ Fixed ${result.fixed} items`));
+    console.log(c('yellow', `  ⚠ Flagged ${result.flagged} items for manual review`));
+    if (result.failed > 0) console.log(c('red', `  ✗ Failed: ${result.failed}`));
+    if (result.skippedUnsafe > 0) {
+      console.log(c('gray', `  ○ Skipped ${result.skippedUnsafe} unsafe fixes (use --unsafe to apply)`));
+    }
+    console.log('');
+    console.log(c('gray', `  Run 'thuban report' to see updated scores`));
+    if (!opts.gitCommit) {
+      console.log(c('gray', `  Tip: use --commit to auto-commit fixes for easy rollback`));
+    }
+    console.log('');
+  }
+}
+
+// ─── Main ───────────────────────────────────────────────────
+
+async function cmdHallucinate(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const files = collectFiles(targetPath, opts.ignore);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  HALLUCINATION SCAN: ') + c('cyan', targetPath));
+    console.log(c('gray', `  Scanning ${files.length} files for AI hallucinations...`));
+    console.log('');
+  }
+
+  const detector = new HallucinationDetector({ rootPath: targetPath });
+  const results = await detector.scan(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(results, null, 2));
+  } else {
+    console.log(detector.formatReport(results));
+  }
+}
+
+async function cmdWatch(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+
+  const scanner = new CodeScanner({
+    rootPath: targetPath,
+    ignorePatterns: ['node_modules/**', '.git/**', 'dist/**', ...opts.ignore],
+  });
+
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+
+  // Create a quick scan function for the watcher
+  const quickScan = async (filePath) => {
+    const issues = [];
+
+    // Code scan
+    const scanIssues = await scanner.scanFile(filePath);
+    if (scanIssues) issues.push(...scanIssues);
+
+    // Hallucination check
+    const hallResults = await hallucinationDetector.scan([filePath]);
+    if (hallResults.phantomAPIs.length > 0) {
+      for (const api of hallResults.phantomAPIs) {
+        issues.push({ severity: 'high', message: `Phantom API: ${api.name} — ${api.suggestion}`, line: api.line });
+      }
+    }
+    if (hallResults.phantomImports.length > 0) {
+      for (const imp of hallResults.phantomImports) {
+        issues.push({ severity: 'critical', message: `Phantom import: ${imp.module} — ${imp.reason}`, line: imp.line });
+      }
+    }
+    if (hallResults.aiSmells.length > 0) {
+      for (const smell of hallResults.aiSmells) {
+        issues.push({ severity: 'warning', message: `AI smell: ${smell.message}`, line: smell.line });
+      }
+    }
+
+    return issues;
+  };
+
+  const watcher = new FileWatcher({
+    rootPath: targetPath,
+    ignorePatterns: ['node_modules', '.git', 'dist', '.next', '__pycache__', ...opts.ignore],
+  });
+
+  // Handle graceful shutdown
+  process.on('SIGINT', () => {
+    watcher.stop();
+    process.exit(0);
+  });
+
+  watcher.start(quickScan);
+}
+
+async function cmdDashboard(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const files = collectFiles(targetPath, opts.ignore);
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  GENERATING DASHBOARD: ') + c('cyan', targetPath));
+    console.log(c('gray', `  Scanning ${files.length} files...`));
+    console.log('');
+  }
+
+  // Run full analysis
+  const analyzer = new TechDebtAnalyzer({ rootPath: targetPath });
+  const debt = await analyzer.analyze(files);
+
+  // Get dependency data
+  const graph = new DependencyGraph({ rootPath: targetPath });
+  await graph.build(files);
+  const depData = {
+    circular: graph.circularDeps || [],
+    orphans: graph.getOrphanFiles() || [],
+    critical: graph.getMostCriticalFiles(5) || [],
+  };
+
+  // Run hallucination scan
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+  const hallResults = await hallucinationDetector.scan(files);
+
+  // Generate HTML report
+  const reportGen = new HtmlReportGenerator({
+    rootPath: targetPath,
+    outputDir: targetPath,
+  });
+
+  const projectName = path.basename(targetPath);
+  const outputPath = await reportGen.writeReport(debt, depData, {
+    projectName,
+    hallucinations: hallResults,
+  });
+
+  if (!opts.json) {
+    console.log(c('green', `  ✓ Dashboard generated:`));
+    console.log(`    ${c('cyan', outputPath)}`);
+    console.log('');
+    console.log(c('gray', `  Open in your browser to view the interactive report`));
+    console.log('');
+  } else {
+    console.log(JSON.stringify({ outputPath, scores: debt.scores, stats: debt.stats }, null, 2));
+  }
+}
+
+async function cmdDiff(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const { execSync } = require('child_process');
+
+  if (!opts.json) {
+    banner();
+    console.log(c('bold', '  DIFF SCAN: ') + c('cyan', targetPath));
+  }
+
+  // Get changed files from git
+  let changedFiles = [];
+  try {
+    // Files changed vs main/master branch
+    let baseBranch = 'main';
+    try {
+      execSync('git rev-parse --verify main', { cwd: targetPath, stdio: 'pipe' });
+    } catch {
+      try {
+        execSync('git rev-parse --verify master', { cwd: targetPath, stdio: 'pipe' });
+        baseBranch = 'master';
+      } catch {
+        // Fall back to HEAD~1
+        baseBranch = 'HEAD~1';
+      }
+    }
+
+    const diffOutput = execSync(`git diff --name-only ${baseBranch}...HEAD`, {
+      cwd: targetPath, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+
+    // Also get uncommitted changes
+    const statusOutput = execSync('git diff --name-only HEAD', {
+      cwd: targetPath, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+
+    const untrackedOutput = execSync('git ls-files --others --exclude-standard', {
+      cwd: targetPath, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+
+    const allChanged = new Set([
+      ...diffOutput.split('\n').filter(Boolean),
+      ...statusOutput.split('\n').filter(Boolean),
+      ...untrackedOutput.split('\n').filter(Boolean),
+    ]);
+
+    // Resolve to full paths and filter to JS/TS files
+    for (const relFile of allChanged) {
+      const fullPath = path.resolve(targetPath, relFile);
+      const ext = path.extname(relFile).toLowerCase();
+      if (['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.json'].includes(ext)) {
+        if (fs.existsSync(fullPath)) {
+          changedFiles.push(fullPath);
+        }
+      }
+    }
+  } catch (e) {
+    if (!opts.json) {
+      console.log(c('red', `  ✗ Not a git repository or git error: ${e.message}`));
+    }
+    process.exit(1);
+  }
+
+  if (changedFiles.length === 0) {
+    if (!opts.json) {
+      console.log(c('green', '  ✓ No changed files to scan'));
+    } else {
+      console.log(JSON.stringify({ changedFiles: 0, issues: 0 }));
+    }
+    return;
+  }
+
+  if (!opts.json) {
+    console.log(c('gray', `  Scanning ${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}...\n`));
+  }
+
+  // Run scans on changed files only
+  const scanner = new CodeScanner({ rootPath: targetPath });
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+
+  const scanResults = await scanner.scanFiles(changedFiles);
+  const hallResults = await hallucinationDetector.scan(changedFiles);
+
+  // Collect all issues
+  let totalIssues = 0;
+  const fileIssues = {};
+
+  for (const [file, result] of Object.entries(scanResults)) {
+    if (result.issues && result.issues.length > 0) {
+      const relFile = path.relative(targetPath, file);
+      fileIssues[relFile] = result.issues;
+      totalIssues += result.issues.length;
+    }
+  }
+
+  totalIssues += hallResults.stats.totalIssues;
+
+  if (opts.json) {
+    console.log(JSON.stringify({
+      changedFiles: changedFiles.length,
+      totalIssues,
+      codeIssues: fileIssues,
+      hallucinations: hallResults,
+    }, null, 2));
+  } else {
+    // Display results per file
+    for (const [relFile, issues] of Object.entries(fileIssues)) {
+      console.log(`  ${c('cyan', relFile)}`);
+      for (const issue of issues.slice(0, 5)) {
+        const sevColor = issue.severity === 'critical' || issue.severity === 'high' ? 'red' : issue.severity === 'warning' ? 'yellow' : 'gray';
+        console.log(`    ${c(sevColor, '✗')} ${c('gray', issue.message || issue.id || '')}`);
+      }
+      if (issues.length > 5) {
+        console.log(`    ${c('gray', `... and ${issues.length - 5} more`)}`);
+      }
+      console.log('');
+    }
+
+    // Hallucination results
+    if (hallResults.stats.totalIssues > 0) {
+      console.log(hallucinationDetector.formatReport(hallResults));
+    }
+
+    // Summary
+    const color = totalIssues === 0 ? 'green' : 'yellow';
+    console.log(`  ${c(color, `${changedFiles.length} files changed, ${totalIssues} new issues introduced`)}\n`);
+  }
+}
+
+// ─── License Commands ───────────────────────────────────────
+
+async function cmdActivate(opts) {
+  banner();
+  const lm = new LicenseManager();
+
+  const key = opts.licenseKey;
+
+  if (!key) {
+    console.log(c('red', '  Usage: thuban activate <license-key>'));
+    console.log('');
+    console.log(c('gray', '  Get a key at: ') + c('cyan', 'https://thuban.dev/pricing'));
+    console.log('');
+    return;
+  }
+
+  const result = lm.activate(key);
+
+  if (result.success) {
+    console.log(c('green', '  ╔══════════════════════════════════════╗'));
+    console.log(c('green', '  ║') + c('bold', '  License activated!                   ') + c('green', '║'));
+    console.log(c('green', '  ╚══════════════════════════════════════╝'));
+    console.log('');
+    console.log(`  Tier:     ${c('bold', result.tierName)}`);
+    console.log(`  Status:   ${c('green', 'Active')}`);
+    console.log('');
+    console.log(c('gray', '  All features unlocked. Run ') + c('cyan', 'thuban scan .') + c('gray', ' to get started.'));
+    console.log('');
+  } else {
+    console.log(c('red', '  Invalid license key.'));
+    console.log('');
+    console.log(c('gray', '  Check for typos or get a new key at: ') + c('cyan', 'https://thuban.dev/pricing'));
+    console.log('');
+  }
+}
+
+async function cmdStatus(opts) {
+  banner();
+  const lm = new LicenseManager();
+  const status = lm.getStatus();
+
+  console.log(c('bold', '  LICENSE STATUS'));
+  console.log('');
+  console.log(`  Tier:              ${c('bold', status.tierName)}${status.licensed ? c('green', ' (active)') : ''}`);
+  console.log(`  Machine ID:        ${c('gray', status.machineId)}`);
+  console.log(`  Scans this month:  ${c('bold', status.scansUsed)}${status.scansLimit < Infinity ? c('gray', ' / ' + status.scansLimit) : ''}`);
+  console.log(`  Lifetime scans:    ${c('gray', status.totalScans)}`);
+  console.log('');
+  console.log(c('bold', '  FEATURES'));
+  console.log(`  Full scan details: ${status.features.fullDetails ? c('green', 'Yes') : c('red', 'No')}`);
+  console.log(`  HTML dashboard:    ${status.features.dashboard ? c('green', 'Yes') : c('red', 'No')}`);
+  console.log(`  Auto-fix:          ${status.features.autoFix ? c('green', 'Yes') : c('red', 'No')}`);
+  console.log(`  CI Action:         ${status.features.ciAction ? c('green', 'Yes') : c('red', 'No')}`);
+  console.log('');
+
+  if (!status.licensed) {
+    console.log(c('cyan', '  Upgrade at: ') + c('bold', 'https://thuban.dev/pricing'));
+    console.log('');
+  }
+}
+
+function cmdUpgrade() {
+  banner();
+  console.log(c('bold', '  THUBAN PRICING'));
+  console.log('');
+  console.log(`  ${c('gray', 'FREE')}          ${c('bold', '£0/mo')}`);
+  console.log(`    3 scans/month, 100 files, summary only`);
+  console.log('');
+  console.log(`  ${c('cyan', 'PRO')}           ${c('bold', '£19/mo')}  ${c('gray', '(or £149/year — save 35%)')}`);
+  console.log(`    Unlimited scans, full details, auto-fix, HTML dashboard`);
+  console.log('');
+  console.log(`  ${c('cyan', 'TEAM')}          ${c('bold', '£99/mo')}`);
+  console.log(`    Everything in Pro + 5 seats, CI Action, team reports`);
+  console.log('');
+  console.log(`  ${c('cyan', 'ENTERPRISE')}    ${c('bold', '£299/mo')}`);
+  console.log(`    Everything in Team + unlimited seats, priority support, SLA`);
+  console.log('');
+  console.log(c('bold', '  Subscribe at: ') + c('cyan', 'https://thuban.dev/pricing'));
+  console.log('');
+
+  // Try to open the URL
+  try {
+    const { exec } = require('child_process');
+    const platform = process.platform;
+    const cmd = platform === 'win32' ? 'start' : platform === 'darwin' ? 'open' : 'xdg-open';
+    exec(`${cmd} https://thuban.dev/pricing`);
+  } catch (e) { /* non-fatal */ }
+}
+
+// ─── New Feature Commands ───────────────────────────────────
+
+async function cmdGate(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+
+  if (opts.fix) {
+    // --fix = install the hook
+    const result = PreCommitGate.install(targetPath);
+    banner();
+    if (result.success) {
+      console.log(c('green', '  ✓ Pre-commit gate installed!'));
+      console.log('');
+      console.log(c('gray', '  Every commit will now be checked for hallucinated APIs.'));
+      console.log(c('gray', '  Commits with phantom APIs will be blocked automatically.'));
+      console.log('');
+      console.log(`  To remove: ${c('cyan', 'thuban gate --uninstall')}`);
+    } else {
+      console.log(c('red', `  Error: ${result.error}`));
+    }
+    console.log('');
+    return;
+  }
+
+  if (process.argv.includes('--uninstall')) {
+    const result = PreCommitGate.uninstall(targetPath);
+    banner();
+    console.log(c('green', `  ✓ ${result.message}`));
+    console.log('');
+    return;
+  }
+
+  // Run the gate check (used by the pre-commit hook and manual runs)
+  const gate = new PreCommitGate({ rootPath: targetPath, strict: !process.argv.includes('--warn') });
+  const result = gate.run();
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  const isCi = process.argv.includes('--ci');
+
+  if (!isCi) banner();
+
+  if (result.files === 0) {
+    console.log(c('gray', '  No staged files to check.'));
+    console.log('');
+    console.log(`  Install the gate: ${c('cyan', 'thuban gate --fix')}`);
+    console.log('');
+    return;
+  }
+
+  if (result.passed) {
+    console.log(c('green', `  ✓ ${result.message}`));
+    console.log(c('gray', `    ${result.elapsed}ms`));
+    if (!isCi) console.log('');
+    process.exit(0);
+  } else {
+    console.log(c('red', `  ✗ ${result.message}`));
+    console.log('');
+    for (const issue of result.issues) {
+      console.log(`  ${c('red', issue.file)}:${issue.line}`);
+      console.log(`    ${c('yellow', issue.code)}`);
+      console.log(`    ${c('red', '^^^')} ${issue.message}`);
+      if (issue.fix) console.log(`    ${c('green', 'Fix:')} ${issue.fix}`);
+      console.log('');
+    }
+    process.exit(1);
+  }
+}
+
+async function cmdCost(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  SCANNING: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const scanner = new CodeScanner({
+    rootPath: targetPath,
+    ignorePatterns: ['node_modules/**', '.git/**', 'dist/**', ...opts.ignore],
+  });
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+
+  const [scanResults, hallResults] = await Promise.all([
+    scanner.scanFiles(files),
+    hallucinationDetector.scan(files),
+  ]);
+
+  // Collect all issues
+  const allIssues = [];
+  for (const [file, fileResults] of Object.entries(scanResults)) {
+    if (fileResults.issues) {
+      for (const issue of fileResults.issues) {
+        allIssues.push({ file: path.relative(targetPath, file), ...issue });
+      }
+    }
+  }
+  for (const item of hallResults.phantomAPIs) {
+    allIssues.push({ category: 'hallucination', severity: 'critical', message: item.name });
+  }
+  for (const item of hallResults.deprecatedAPIs) {
+    allIssues.push({ category: 'deprecated', severity: 'high', message: item.name });
+  }
+
+  const calculator = new TechDebtCostCalculator();
+  const result = calculator.calculate(allIssues, files.length);
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  console.log(calculator.formatCLI(result));
+}
+
+async function cmdGhosts(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  SCANNING FOR GHOST CODE: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const detector = new GhostCodeDetector({ rootPath: targetPath });
+  const result = detector.scan(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  if (result.ghosts.length === 0) {
+    console.log(c('green', '  No ghost code detected. Every function is referenced.'));
+    console.log('');
+    return;
+  }
+
+  console.log(c('yellow', c('bold', `  GHOST CODE: ${result.totalGhosts} function${result.totalGhosts > 1 ? 's' : ''} exist but are never called`)));
+  console.log('');
+
+  for (const ghost of result.ghosts.slice(0, opts.maxIssues)) {
+    const sevColor = ghost.severity === 'high' ? 'red' : 'yellow';
+    console.log(`  ${c(sevColor, '⊘')} ${c('cyan', ghost.file)}:${ghost.line}`);
+    console.log(`    ${c('bold', ghost.name + '()')} — ${ghost.wastedLines} lines, ${ghost.references} references`);
+    console.log('');
+  }
+
+  console.log(c('bold', '  ┌──────────────────────────────────────────────────────┐'));
+  console.log(c('bold', '  │') + `  Wasted code: ${c('red', result.totalWastedLines + ' lines')} (${result.wastedPercent}% of codebase)  ` + c('bold', '│'));
+  console.log(c('bold', '  └──────────────────────────────────────────────────────┘'));
+  console.log('');
+}
+
+async function cmdAIScore(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  AI CONFIDENCE SCORING: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const scorer = new AIConfidenceScorer({ rootPath: targetPath });
+  const result = scorer.scan(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  if (result.highConfidence.length === 0 && result.mediumConfidence.length === 0) {
+    console.log(c('green', '  No AI-generated code patterns detected.'));
+    console.log('');
+    return;
+  }
+
+  console.log(c('red', c('bold', `  HIGH CONFIDENCE AI-GENERATED (${result.highConfidence.length} functions)`)));
+  console.log('');
+
+  for (const fn of result.highConfidence.slice(0, 15)) {
+    console.log(`  ${c('red', fn.confidence + '%')} AI  ${c('cyan', fn.file)}:${fn.line}`);
+    console.log(`    ${c('bold', fn.name + '()')} — ${fn.lineCount} lines | Test coverage: ${fn.testCoverage}`);
+    for (const signal of fn.signals.slice(0, 2)) {
+      console.log(`    ${c('gray', '• ' + signal)}`);
+    }
+    console.log('');
+  }
+
+  if (result.mediumConfidence.length > 0) {
+    console.log(c('yellow', c('bold', `  POSSIBLE AI-GENERATED (${result.mediumConfidence.length} functions)`)));
+    console.log('');
+    for (const fn of result.mediumConfidence.slice(0, 10)) {
+      console.log(`  ${c('yellow', fn.confidence + '%')} AI  ${c('cyan', fn.file)}:${fn.line}  ${c('gray', fn.name + '()')}`);
+    }
+    console.log('');
+  }
+
+  console.log(c('bold', '  ┌──────────────────────────────────────────────────────┐'));
+  console.log(c('bold', '  │') + `  ${c('red', result.aiPercentage + '%')} of functions are likely AI-generated            ` + c('bold', '│'));
+  console.log(c('bold', '  │') + `  ${c('yellow', result.aiLikelyCount)} high confidence | ${result.aiPossibleCount} possible          ` + c('bold', '│'));
+  console.log(c('bold', '  └──────────────────────────────────────────────────────┘'));
+  console.log('');
+}
+
+async function cmdClones(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  COPY-PASTE DRIFT DETECTION: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const detector = new CopyPasteDriftDetector({ rootPath: targetPath });
+  const result = detector.scan(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  if (result.clusters.length === 0) {
+    console.log(c('green', '  No copy-paste drift detected.'));
+    console.log('');
+    return;
+  }
+
+  console.log(c('yellow', c('bold', `  COPY-PASTE CLUSTERS: ${result.totalClusters} found`)));
+  console.log('');
+
+  for (const cluster of result.clusters.slice(0, 10)) {
+    const sevColor = cluster.severity === 'high' ? 'red' : 'yellow';
+    console.log(`  ${c(sevColor, '◈')} ${c('bold', cluster.pattern + ' pattern')} — ${cluster.totalInstances} instances`);
+    for (const member of cluster.members) {
+      const sim = member.similarity < 100 ? c('gray', ` (${member.similarity}% similar)`) : '';
+      console.log(`    ${c('cyan', member.file)}:${member.line}  ${c('gray', member.name + '()')}${sim}`);
+    }
+    console.log(`    ${c('green', '→')} ${cluster.recommendation}`);
+    console.log('');
+  }
+
+  console.log(c('bold', `  Total duplicate lines: ${c('red', result.totalDuplicateLines)}`));
+  console.log(c('gray', `  ${result.recommendation}`));
+  console.log('');
+}
+
+async function cmdPassport(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  GENERATING CODEBASE PASSPORT: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+  const generator = new CodebasePassport({ rootPath: targetPath });
+  const passport = generator.generate(files);
+
+  if (opts.json) {
+    console.log(JSON.stringify(passport, null, 2));
+    return;
+  }
+
+  const outputPath = generator.save(passport);
+  const p = passport.project;
+  const o = passport.onboarding;
+
+  console.log(c('green', `  ✓ Passport generated: ${c('bold', path.relative(targetPath, outputPath))}`));
+  console.log('');
+  console.log(c('bold', '  PROJECT IDENTITY'));
+  console.log(`  Name:          ${c('cyan', p.name)}`);
+  console.log(`  Files:         ${c('bold', p.totalFiles)}`);
+  console.log(`  Lines:         ${c('bold', p.totalLines.toLocaleString())}`);
+  console.log(`  Architecture:  ${c('bold', p.architecture)}`);
+  console.log(`  Frameworks:    ${p.frameworks.join(', ') || 'vanilla'}`);
+  console.log('');
+  console.log(c('bold', '  LANGUAGES'));
+  for (const lang of p.languages.slice(0, 5)) {
+    const bar = '█'.repeat(Math.max(1, Math.round(lang.percentage / 5)));
+    console.log(`    ${lang.extension.padEnd(6)} ${c('cyan', bar)} ${lang.percentage}% (${lang.lines} lines)`);
+  }
+  console.log('');
+  console.log(c('bold', '  ONBOARDING'));
+  console.log(`  Read time:     ~${o.estimatedReadTimeMinutes} minutes`);
+  console.log(`  Start here:    ${o.startHere.slice(0, 3).join(', ')}`);
+  if (o.doNotTouch.length > 0) {
+    console.log(`  Do not touch:  ${c('red', o.doNotTouch.join(', '))}`);
+  }
+  console.log(`  Summary:       ${o.quickSummary}`);
+  console.log('');
+
+  if (passport.sacred.length > 0) {
+    console.log(c('bold', '  SACRED FILES (high impact if changed)'));
+    for (const s of passport.sacred.slice(0, 5)) {
+      console.log(`    ${c('red', '!')} ${c('cyan', s.file)} — imported by ${s.importedBy} files`);
+    }
+    console.log('');
+  }
+
+  console.log(c('gray', `  Full passport: ${outputPath}`));
+  console.log(c('gray', `  Share with new team members for instant onboarding.`));
+  console.log('');
+}
+
+async function cmdExecutive(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  banner();
+  console.log(c('bold', '  GENERATING EXECUTIVE REPORT: ') + c('cyan', targetPath));
+  console.log('');
+
+  const files = collectFiles(targetPath, opts.ignore);
+
+  console.log(c('gray', `  Scanning ${files.length} files...`));
+
+  const scanner = new CodeScanner({
+    rootPath: targetPath,
+    ignorePatterns: ['node_modules/**', '.git/**', 'dist/**', ...opts.ignore],
+  });
+  const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+  const ghostDetector = new GhostCodeDetector({ rootPath: targetPath });
+  const aiScorer = new AIConfidenceScorer({ rootPath: targetPath });
+  const cloneDetector = new CopyPasteDriftDetector({ rootPath: targetPath });
+
+  // Run all scans in parallel
+  const [scanResults, hallResults, ghostResults, aiScoreResults, cloneResults] = await Promise.all([
+    scanner.scanFiles(files),
+    hallucinationDetector.scan(files),
+    ghostDetector.scan(files),
+    aiScorer.scan(files),
+    cloneDetector.scan(files),
+  ]);
+
+  // Calculate total lines
+  let lineCount = 0;
+  for (const file of files) {
+    try {
+      const content = fs.readFileSync(file, 'utf-8');
+      lineCount += content.split('\n').length;
+    } catch { /* skip */ }
+  }
+
+  // Collect all issues for cost calculator
+  const allIssues = [];
+  for (const [file, fileResults] of Object.entries(scanResults)) {
+    if (fileResults.issues) {
+      for (const issue of fileResults.issues) {
+        allIssues.push({ file: path.relative(targetPath, file), ...issue });
+      }
+    }
+  }
+  for (const item of hallResults.phantomAPIs) {
+    allIssues.push({ category: 'hallucination', severity: 'critical', message: item.name });
+  }
+  for (const item of hallResults.deprecatedAPIs) {
+    allIssues.push({ category: 'deprecated', severity: 'high', message: item.name });
+  }
+
+  const costCalc = new TechDebtCostCalculator();
+  const debtCost = costCalc.calculate(allIssues, files.length);
+
+  // Generate report
+  const report = new ExecutiveReport({
+    rootPath: targetPath,
+    companyName: opts.companyName || undefined,
+  });
+
+  const html = report.generate({
+    scanResults,
+    hallResults,
+    debtCost,
+    ghostResults,
+    aiScoreResults,
+    cloneResults,
+    fileCount: files.length,
+    lineCount,
+  });
+
+  const outputPath = report.save(html, targetPath);
+
+  console.log(c('green', `  ✓ Executive report generated!`));
+  console.log('');
+  console.log(`  ${c('bold', 'Report:')} ${c('cyan', outputPath)}`);
+  console.log('');
+  console.log(c('gray', '  Open in browser → Ctrl+P → Save as PDF'));
+  console.log(c('gray', '  Or click the "Save as PDF" button in the report.'));
+  console.log('');
+
+  // Try to open in browser
+  try {
+    const { exec } = require('child_process');
+    const platform = process.platform;
+    const cmd = platform === 'win32' ? 'start' : platform === 'darwin' ? 'open' : 'xdg-open';
+    exec(`${cmd} "${outputPath}"`);
+    console.log(c('green', '  ✓ Opened in your default browser.'));
+    console.log('');
+  } catch (e) { /* non-fatal */ }
+}
+
+async function cmdBaseline(opts) {
+  const targetPath = path.resolve(opts.targetPath);
+  const baseline = new BaselineManager(targetPath);
+
+  banner();
+
+  if (opts.baselineCreate || !baseline.exists()) {
+    // Create baseline from current scan
+    console.log(c('bold', '  CREATING BASELINE: ') + c('cyan', targetPath));
+    console.log('');
+
+    const files = collectFiles(targetPath, opts.ignore);
+    const scanner = new CodeScanner({
+      rootPath: targetPath,
+      ignorePatterns: ['node_modules/**', '.git/**', 'dist/**', ...opts.ignore],
+    });
+    const hallucinationDetector = new HallucinationDetector({ rootPath: targetPath });
+
+    const [scanResults, hallResults] = await Promise.all([
+      scanner.scanFiles(files),
+      hallucinationDetector.scan(files),
+    ]);
+
+    const allIssues = [];
+    for (const [file, fileResults] of Object.entries(scanResults)) {
+      if (fileResults.issues) {
+        for (const issue of fileResults.issues) {
+          allIssues.push({ file: path.relative(targetPath, file), ...issue });
+        }
+      }
+    }
+    for (const item of hallResults.phantomAPIs) {
+      allIssues.push({ file: item.file, category: 'hallucination', severity: 'critical', id: item.id, message: item.name });
+    }
+    for (const item of hallResults.deprecatedAPIs) {
+      allIssues.push({ file: item.file, category: 'deprecated', severity: 'high', id: item.id, message: item.name });
+    }
+    for (const item of hallResults.aiSmells) {
+      allIssues.push({ file: item.file, category: 'ai_smell', severity: 'warning', id: item.id, message: item.message });
+    }
+
+    const result = baseline.create(allIssues);
+    console.log(c('green', `  ✓ Baseline created: ${c('bold', result.count)} known issues recorded`));
+    console.log(`    ${c('cyan', result.path)}`);
+    console.log('');
+    console.log(c('gray', '  Future scans with --baseline will only report NEW issues.'));
+    console.log(c('gray', '  Commit .thuban-baseline.json to share baseline with your team.'));
+    console.log('');
+  } else {
+    // Show baseline status
+    const existing = baseline.load();
+    console.log(c('bold', '  BASELINE STATUS'));
+    console.log('');
+    console.log(`  Created:        ${c('cyan', existing.created)}`);
+    console.log(`  Known issues:   ${c('bold', existing.issueCount)}`);
+    console.log('');
+    console.log(c('gray', '  Use --baseline-create to update the baseline'));
+    console.log(c('gray', '  Use --baseline with scan to only see new issues'));
+    console.log('');
+  }
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const opts = parseArgs(args);
+
+  if (!opts.command || opts.command === 'help') {
+    printHelp();
+    process.exit(0);
+  }
+
+  if (opts.command === 'version') {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
+    console.log(`thuban v${pkg.version}`);
+    process.exit(0);
+  }
+
+  // Verify target path exists
+  const noPathCommands2 = ['activate', 'status', 'upgrade'];
+
+  if (!noPathCommands2.includes(opts.command) && !fs.existsSync(opts.targetPath)) {
+    console.error(c('red', `  Error: Path not found: ${opts.targetPath}`));
+    process.exit(1);
+  }
+
+  try {
+    switch (opts.command) {
+      case 'scan':
+        await cmdScan(opts);
+        break;
+      case 'deps':
+        await cmdDeps(opts);
+        break;
+      case 'drift':
+        await cmdDrift(opts);
+        break;
+      case 'inject':
+        await cmdInject(opts);
+        break;
+      case 'health':
+        // Alias for report
+        await cmdReport(opts);
+        break;
+      case 'report':
+        await cmdReport(opts);
+        break;
+      case 'debt':
+        await cmdDebt(opts);
+        break;
+      case 'fix':
+        await cmdFix(opts);
+        break;
+      case 'hallucinate':
+      case 'hal':
+        await cmdHallucinate(opts);
+        break;
+      case 'watch':
+        await cmdWatch(opts);
+        break;
+      case 'dashboard':
+      case 'dash':
+        await cmdDashboard(opts);
+        break;
+      case 'diff':
+        await cmdDiff(opts);
+        break;
+      case 'activate':
+        await cmdActivate(opts);
+        break;
+      case 'status':
+        await cmdStatus(opts);
+        break;
+      case 'upgrade':
+        cmdUpgrade();
+        break;
+      case 'gate':
+        await cmdGate(opts);
+        break;
+      case 'cost':
+        await cmdCost(opts);
+        break;
+      case 'ghosts':
+        await cmdGhosts(opts);
+        break;
+      case 'ai-score':
+      case 'aiscore':
+        await cmdAIScore(opts);
+        break;
+      case 'clones':
+      case 'duplicates':
+        await cmdClones(opts);
+        break;
+      case 'passport':
+        await cmdPassport(opts);
+        break;
+      case 'executive':
+      case 'exec-report':
+      case 'pdf':
+        await cmdExecutive(opts);
+        break;
+      case 'baseline':
+        await cmdBaseline(opts);
+        break;
+      default:
+        console.error(c('red', `  Unknown command: ${opts.command}`));
+        console.error(c('gray', `  Run 'thuban --help' for usage`));
+        process.exit(1);
+    }
+  } catch (err) {
+    console.error(c('red', `  Error: ${err.message}`));
+    if (opts.verbose) console.error(err.stack);
+    process.exit(1);
+  }
+}
+
+main();