veefore 1.0.0 → 1.2.0

package/dist/veefore.mjs

@@ -236,29 +236,29 @@ var ApiClient = class {
   setToken(token) {
     this.token = token;
   }
-  async get(path11, query = {}) {
+  async get(path12, query = {}) {
     const search = new URLSearchParams();
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) search.set(key, String(value));
     }
     const suffix = search.toString() === "" ? "" : `?${search.toString()}`;
-    return this.send("GET", `${path11}${suffix}`);
+    return this.send("GET", `${path12}${suffix}`);
   }
-  async post(path11, body) {
-    return this.send("POST", path11, body);
+  async post(path12, body) {
+    return this.send("POST", path12, body);
   }
-  async patch(path11, body) {
-    return this.send("PATCH", path11, body);
+  async patch(path12, body) {
+    return this.send("PATCH", path12, body);
   }
-  async delete(path11) {
-    return this.send("DELETE", path11);
+  async delete(path12) {
+    return this.send("DELETE", path12);
   }
   /** Raw request for endpoints that return a non-JSON body (exports). */
-  async raw(method, path11, body) {
-    return this.fetchWithTimeout(method, path11, body);
+  async raw(method, path12, body) {
+    return this.fetchWithTimeout(method, path12, body);
   }
-  async send(method, path11, body) {
-    const response = await this.fetchWithTimeout(method, path11, body);
+  async send(method, path12, body) {
+    const response = await this.fetchWithTimeout(method, path12, body);
     const text = await response.text();
     const parsed = parseJson(text);
     if (response.ok) {
@@ -266,14 +266,14 @@ var ApiClient = class {
       if (parsed && "data" in parsed) return parsed.data;
       throw new CliApiError(
         "UNEXPECTED_RESPONSE",
-        `The control plane returned an unexpected body for ${method} ${path11}.`,
+        `The control plane returned an unexpected body for ${method} ${path12}.`,
         response.status,
         response.headers.get("x-request-id")
       );
     }
     const error = new CliApiError(
       parsed?.error?.code ?? `HTTP_${response.status}`,
-      parsed?.error?.message ?? `${method} ${path11} failed with ${response.status} ${response.statusText}.`,
+      parsed?.error?.message ?? `${method} ${path12} failed with ${response.status} ${response.statusText}.`,
       response.status,
       parsed?.error?.request_id ?? response.headers.get("x-request-id"),
       parsed?.error?.details ?? {}
@@ -291,7 +291,7 @@ var ApiClient = class {
     }
     throw error;
   }
-  async fetchWithTimeout(method, path11, body) {
+  async fetchWithTimeout(method, path12, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = { accept: "application/json" };
@@ -300,7 +300,7 @@ var ApiClient = class {
     if (this.workspaceId) headers["x-veefore-workspace"] = this.workspaceId;
     if (this.environmentId) headers["x-veefore-environment"] = this.environmentId;
     try {
-      return await fetch(`${this.controlPlaneUrl}${path11}`, {
+      return await fetch(`${this.controlPlaneUrl}${path12}`, {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body),
@@ -566,6 +566,332 @@ function sleep(ms) {
 
 // src/terminal.ts
 import { createInterface } from "node:readline/promises";
+
+// src/tui.ts
+import { emitKeypressEvents } from "node:readline";
+
+// src/logo.ts
+var LOGO = [
+  "\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584    \u2584\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580",
+  " \u2588\u2588        \u2580\u2588    \u2588\u2580        \u2588\u2588",
+  "  \u2588\u2588   \u2588\u2588   \u2588\u2588  \u2588\u2588   \u2588\u2588   \u2588\u2588",
+  "   \u2588\u2588   \u2588\u2588     \u2588\u2588   \u2588\u2588   \u2588\u2588",
+  "    \u2588\u2588   \u2588\u2588   \u2588\u2588   \u2588\u2588   \u2588\u2588",
+  "    \u2580\u2588\u2584   \u2588\u2584 \u2584\u2588   \u2584\u2588   \u2584\u2588\u2580",
+  "     \u2580\u2588\u2584  \u2580\u2588\u2588\u2588\u2580  \u2584\u2588\u2580  \u2584\u2588\u2580",
+  "      \u2580\u2588\u2584  \u2580\u2588\u2580  \u2584\u2588\u2580  \u2584\u2588\u2580",
+  "       \u2580\u2588   \u2580   \u2588\u2580   \u2588\u2580",
+  "        \u2588\u2588     \u2588\u2588   \u2588\u2588",
+  "         \u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588"
+];
+
+// src/tui.ts
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true && process.env.TERM !== "dumb" && process.env.CI === void 0;
+}
+var COLOR = process.env.NO_COLOR === void 0 && process.stdout.isTTY === true;
+function colorDepth() {
+  const colorterm = (process.env.COLORTERM ?? "").toLowerCase();
+  if (colorterm === "truecolor" || colorterm === "24bit") return 24;
+  if (process.env.TERM_PROGRAM === "vscode" || process.env.TERM_PROGRAM === "iTerm.app") return 24;
+  if ((process.env.TERM ?? "").includes("256")) return 8;
+  return 4;
+}
+function paint(rgb, text) {
+  if (!COLOR) return text;
+  const depth = colorDepth();
+  if (depth === 24) return `\x1B[38;2;${rgb[0]};${rgb[1]};${rgb[2]}m${text}\x1B[0m`;
+  if (depth === 8) {
+    const level = (value) => Math.round(value / 255 * 5);
+    const code = 16 + 36 * level(rgb[0]) + 6 * level(rgb[1]) + level(rgb[2]);
+    return `\x1B[38;5;${code}m${text}\x1B[0m`;
+  }
+  return `\x1B[94m${text}\x1B[0m`;
+}
+var BRAND_TOP = [150, 172, 236];
+var BRAND_BOTTOM = [84, 108, 186];
+var BRAND = [118, 140, 214];
+var brand = (text) => paint(BRAND, text);
+function gradient(row, rows) {
+  const t = rows <= 1 ? 0 : row / (rows - 1);
+  const mix = (a, b) => Math.round(a + (b - a) * t);
+  return [
+    mix(BRAND_TOP[0], BRAND_BOTTOM[0]),
+    mix(BRAND_TOP[1], BRAND_BOTTOM[1]),
+    mix(BRAND_TOP[2], BRAND_BOTTOM[2])
+  ];
+}
+var ANSI = /\u001B\[[0-9;?]*[A-Za-z]/g;
+function visibleLength(text) {
+  return [...text.replace(ANSI, "")].length;
+}
+function columns() {
+  return process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
+}
+var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var STARS = [
+  [0, -3, "*"],
+  [3, -2, "\xB7"],
+  [7, -3, "*"],
+  [10, -1, "\xB7"],
+  [1, 33, "\xB7"],
+  [5, 34, "*"],
+  [9, 32, "\xB7"]
+];
+async function showWelcome(context, options = {}) {
+  if (!isInteractive()) return;
+  const width = Math.min(columns(), 100);
+  const logoWidth = Math.max(...LOGO.map((line) => [...line].length));
+  const indent = 5;
+  const gap = 6;
+  const panelWidth = Math.max(
+    24,
+    ...context.facts.map(([label, value]) => label.length + 2 + value.length)
+  );
+  const sideBySide = width >= indent + logoWidth + gap + panelWidth + 2;
+  const showLogo = width >= indent + logoWidth + 2;
+  const rule = style.grey("\xB7".repeat(Math.max(10, Math.min(width - 2, 72))));
+  const animate = (options.animate ?? true) && process.env.VEEFORE_NO_ANIMATION === void 0;
+  out();
+  out(` ${brand(style.bold("Welcome to Veefore"))} ${style.grey(`v${context.version}`)}`);
+  out(` ${rule}`);
+  out();
+  const panel = renderPanel(context.facts);
+  if (showLogo) {
+    for (let row = 0; row < LOGO.length; row += 1) {
+      const line = LOGO[row] ?? "";
+      const left = starsFor(row, indent, (column) => column < 0, -indent);
+      const right = starsFor(row, 0, (column) => column >= logoWidth, logoWidth);
+      const art = paint(gradient(row, LOGO.length), line.padEnd(logoWidth));
+      let text = `${left}${art}`;
+      if (sideBySide) {
+        const top = Math.max(0, Math.floor((LOGO.length - panel.length) / 2));
+        const side = panel[row - top];
+        text += side === void 0 ? right : `${" ".repeat(gap)}${side}`;
+      } else {
+        text += right;
+      }
+      out(text.replace(/\s+$/, ""));
+      if (animate) await sleep2(14);
+    }
+  }
+  if (!sideBySide) {
+    out();
+    for (const line of panel) out(fit(`   ${line}`, width - 1));
+  }
+  out();
+  out(` ${rule}`);
+}
+function starsFor(row, width, inBand, offset) {
+  const cells = Array.from({ length: Math.max(width, 6) }, () => " ");
+  for (const [starRow, column, glyph] of STARS) {
+    if (starRow !== row || !inBand(column)) continue;
+    const index = column - offset;
+    if (index >= 0 && index < cells.length) cells[index] = style.grey(glyph);
+  }
+  return width === 0 ? cells.join("").replace(/\s+$/, "") : cells.slice(0, width).join("");
+}
+function renderPanel(facts) {
+  const lines = [
+    style.bold("Veefore"),
+    style.grey("Identity, authority and policy"),
+    style.grey("for AI agents"),
+    ""
+  ];
+  const labelWidth = Math.max(0, ...facts.map(([label]) => label.length));
+  for (const [label, value] of facts) {
+    lines.push(`${style.grey(label.padEnd(labelWidth))}  ${value}`);
+  }
+  return lines;
+}
+function clearScreen() {
+  if (!isInteractive()) return;
+  process.stdout.write("\x1B[H\x1B[2J");
+}
+function compactHeader(context) {
+  const facts = Object.fromEntries(context.facts);
+  const parts = [
+    brand(style.bold("Veefore")),
+    style.grey(`v${context.version}`),
+    ...[facts.Folder, facts["Signed in"], facts.Veefore].filter((v) => Boolean(v))
+  ];
+  out();
+  out(fit(` ${parts.join(style.grey("  \xB7  "))}`, columns() - 1));
+  out(` ${style.grey("\xB7".repeat(Math.max(10, Math.min(columns() - 2, 72))))}`);
+}
+async function beginScreen(source, options = {}) {
+  if (!isInteractive()) return;
+  clearScreen();
+  if (options.compact) compactHeader(source());
+  else await showWelcome(source(), { animate: options.animate ?? false });
+}
+async function pressBack(label = "Back") {
+  if (!isInteractive()) return;
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  out();
+  stdout.write(`${brand("\u2190")} ${style.bold(label)} ${style.grey("\xB7 enter or esc")}`);
+  await new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+    const done = () => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      stdout.write("\r\x1B[K");
+      resolve();
+    };
+    const onKey = (input, key = {}) => {
+      if (key.name === "return" || key.name === "enter" || key.name === "escape" || key.name === "left" || key.name === "backspace" || input === "b" || key.ctrl && key.name === "c") {
+        done();
+      }
+    };
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("keypress", onKey);
+  });
+}
+var BACK = /* @__PURE__ */ Symbol("veefore.back");
+var MenuCancelled = class extends CliError {
+  constructor() {
+    super("Cancelled.", void 0, 130);
+    this.name = "MenuCancelled";
+  }
+};
+async function select(question, real, settings = {}) {
+  const options = settings.back ? [...real, { label: settings.backLabel ?? "Back", value: BACK, hint: "\u2190" }] : real;
+  const enabled = options.map((option, index) => option.disabled ? -1 : index).filter((i) => i >= 0);
+  if (enabled.length === 0) throw new CliError(`Nothing can be chosen for "${question}".`);
+  const choosable = enabled.filter((index) => options[index]?.value !== BACK);
+  const fallback = choosable.includes(settings.initial ?? -1) ? settings.initial : choosable[0] ?? enabled[0];
+  if (!isInteractive()) return options[fallback].value;
+  let cursor = fallback;
+  let rendered = 0;
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  const labelWidth = Math.max(...options.map((option) => [...option.label].length));
+  const draw = () => {
+    const width = columns();
+    const lines = [];
+    lines.push(`${brand("?")} ${style.bold(question)}`);
+    if (settings.help) lines.push(`  ${style.grey(settings.help)}`);
+    options.forEach((option, index) => {
+      const active = index === cursor;
+      const pointer = active ? brand("\u276F") : " ";
+      const number = index < 9 ? `${index + 1}.` : "  ";
+      const text = option.hint ? option.label.padEnd(labelWidth) : option.label;
+      const hint = option.hint ? `  ${style.grey(option.hint)}` : "";
+      const label = option.disabled ? style.grey(`${number} ${text}`) : active ? brand(`${number} ${text}`) : `${number} ${text}`;
+      lines.push(fit(`${pointer} ${label}${hint}`, width - 1));
+    });
+    lines.push(
+      style.grey(
+        settings.back ? "  \u2191\u2193 move \xB7 enter choose \xB7 \u2190 back \xB7 esc cancel" : "  \u2191\u2193 move \xB7 enter choose \xB7 esc cancel"
+      )
+    );
+    if (rendered > 0) stdout.write(`\x1B[${rendered}A\r\x1B[J`);
+    stdout.write(`${lines.join("\n")}
+`);
+    rendered = lines.length;
+  };
+  const move = (direction) => {
+    const position = enabled.indexOf(cursor);
+    const next = (position + direction + enabled.length) % enabled.length;
+    cursor = enabled[next];
+  };
+  return new Promise((resolve, reject) => {
+    const wasRaw = stdin.isRaw;
+    const restoreCursor = () => {
+      stdout.write("\x1B[?25h");
+    };
+    const finish = (result) => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      process.off("exit", restoreCursor);
+      if (rendered > 0) stdout.write(`\x1B[${rendered}A\r\x1B[J`);
+      restoreCursor();
+      if (result) {
+        if (!settings.quiet && result.value !== BACK) {
+          stdout.write(`${style.green("\u2713")} ${question} ${brand(result.label)}
+`);
+        }
+        resolve(result.value);
+      } else {
+        stdout.write(`${style.grey("\u2717")} ${question} ${style.grey("cancelled")}
+`);
+        reject(new MenuCancelled());
+      }
+    };
+    const choose = (index) => {
+      const option = options[index];
+      if (!option || option.disabled) return;
+      finish({ value: option.value, label: option.label });
+    };
+    const onKey = (input, key = {}) => {
+      if (key.ctrl && key.name === "c" || key.name === "escape") return finish(null);
+      if (key.name === "return" || key.name === "enter") return choose(cursor);
+      if (settings.back && (key.name === "left" || key.name === "backspace")) {
+        return finish({ value: BACK, label: settings.backLabel ?? "Back" });
+      }
+      if (key.name === "up" || key.name === "k") move(-1);
+      else if (key.name === "down" || key.name === "j" || key.name === "tab") move(1);
+      else if (input && /^[1-9]$/.test(input)) {
+        const index = Number(input) - 1;
+        if (options[index] && !options[index]?.disabled) return choose(index);
+        return;
+      } else if (input) {
+        const match = options.findIndex(
+          (option) => !option.disabled && option.key?.toLowerCase() === input.toLowerCase()
+        );
+        if (match >= 0) return choose(match);
+        return;
+      } else {
+        return;
+      }
+      draw();
+    };
+    process.once("exit", restoreCursor);
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdout.write("\x1B[?25l");
+    stdin.on("keypress", onKey);
+    draw();
+  });
+}
+async function selectYesNo(question, defaultYes = false) {
+  return select(
+    question,
+    [
+      { label: "Yes", value: true, key: "y" },
+      { label: "No", value: false, key: "n" }
+    ],
+    { initial: defaultYes ? 0 : 1 }
+  );
+}
+function fit(text, width) {
+  if (visibleLength(text) <= width) return text;
+  let shown = 0;
+  let result = "";
+  for (let index = 0; index < text.length; ) {
+    ANSI.lastIndex = index;
+    const escape = ANSI.exec(text);
+    if (escape && escape.index === index) {
+      result += escape[0];
+      index += escape[0].length;
+      continue;
+    }
+    if (shown >= width - 1) break;
+    const char = String.fromCodePoint(text.codePointAt(index));
+    result += char;
+    shown += 1;
+    index += char.length;
+  }
+  return `${result}\u2026\x1B[0m`;
+}
+
+// src/terminal.ts
 var COLOR_ENABLED = process.env.NO_COLOR === void 0 && process.env.TERM !== "dumb" && process.stdout.isTTY === true;
 function wrap(code, text) {
   return COLOR_ENABLED ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -599,12 +925,12 @@ function heading(text) {
   out(style.bold(text));
   out(style.grey("\u2500".repeat(Math.min(text.length, 72))));
 }
-function table(columns, rows) {
+function table(columns2, rows) {
   if (rows.length === 0) {
     out(style.grey("  (none)"));
     return;
   }
-  const widths = columns.map((column) => {
+  const widths = columns2.map((column) => {
     const longest = Math.max(
       column.header.length,
       ...rows.map((row) => (row[column.key] ?? "").length)
@@ -615,17 +941,17 @@ function table(columns, rows) {
     const parts = cells.map((cell, index) => {
       const width = widths[index] ?? cell.length;
       const text = cell.length > width ? `${cell.slice(0, Math.max(0, width - 1))}\u2026` : cell;
-      return columns[index]?.align === "right" ? text.padStart(width) : text.padEnd(width);
+      return columns2[index]?.align === "right" ? text.padStart(width) : text.padEnd(width);
     });
     out(`  ${decorate(parts.join("  "))}`);
   };
   renderRow(
-    columns.map((column) => column.header),
+    columns2.map((column) => column.header),
     style.grey
   );
   for (const row of rows) {
     renderRow(
-      columns.map((column) => row[column.key] ?? ""),
+      columns2.map((column) => row[column.key] ?? ""),
       (text) => text
     );
   }
@@ -696,6 +1022,14 @@ async function confirm(question, options = {}) {
     out(`${question} ${style.grey("[y/N]")} ${style.amber("y (--yes)")}`);
     return true;
   }
+  if (isInteractive()) {
+    try {
+      return await selectYesNo(question);
+    } catch (error) {
+      if (error instanceof MenuCancelled) return false;
+      throw error;
+    }
+  }
   if (!process.stdin.isTTY) {
     err(
       "This command requires confirmation but the terminal is not interactive. Re-run with --yes to confirm explicitly."
@@ -1405,11 +1739,11 @@ function renderRevokeConfirmation(agent, environment, preview) {
   out(`  ${style.red("This action is irreversible for this identity.")}`);
   out();
 }
-async function lifecycle(args, flags, path11, resultingStatus) {
+async function lifecycle(args, flags, path12, resultingStatus) {
   const context = await resolveContext(flags);
   const agentId = positional(args) ?? context.config.agentId;
   const agent = await context.api.get(`/v1/agents/${agentId}`);
-  const reasonRequired = path11 === "suspend";
+  const reasonRequired = path12 === "suspend";
   const reason = valueFor(args, "--reason");
   if (reasonRequired && (!reason || reason.trim().length < 10)) {
     throw new CliError(
@@ -1419,24 +1753,24 @@ async function lifecycle(args, flags, path11, resultingStatus) {
   }
   out();
   out(
-    `${symbol.info} ${path11} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
+    `${symbol.info} ${path12} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
   );
-  if (path11 !== "resume") {
+  if (path12 !== "resume") {
     const confirmed = await confirm("Continue?", { yes: flags.yes });
     if (!confirmed) {
       out(style.grey("Cancelled."));
       return 1;
     }
   }
-  const actionSpinner = spinner(`Applying ${path11}`);
+  const actionSpinner = spinner(`Applying ${path12}`);
   try {
     await withStepUp(
       context.api,
-      () => context.api.post(`/v1/agents/${agentId}/${path11}`, reason ? { reason } : {})
+      () => context.api.post(`/v1/agents/${agentId}/${path12}`, reason ? { reason } : {})
     );
     actionSpinner.succeed(`${agent.name} is ${resultingStatus}`);
   } catch (error) {
-    actionSpinner.fail(`Could not ${path11} the agent`);
+    actionSpinner.fail(`Could not ${path12} the agent`);
     throw error;
   }
   out();
@@ -2760,7 +3094,7 @@ function isLoosening(from, to) {
 
 // src/commands/init.ts
 import { readFileSync as readFileSync9 } from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/integrate.ts
 import { readFileSync as readFileSync8 } from "node:fs";
@@ -3556,32 +3890,30 @@ async function chooseMethod(items, options) {
     out(`    ${style.bold(item.key.padEnd(24))} ${style.grey(`${item.file}:${item.line}`)}`);
   }
   out();
-  out("How would you like to handle them?");
-  out(
-    `  ${style.bold("1")}  I will change them myself ${style.grey("(show me exactly what to change)")}`
-  );
-  out(
-    `  ${style.bold("2")}  Use AI with my own Anthropic or OpenAI key ${style.grey("(code goes only to that provider)")}`
-  );
-  out(
-    `  ${style.bold("3")}  Use Veefore AI ${style.grey(
-      options.hostedAvailable ? "(code is sent to Veefore, then to its model provider)" : "(not enabled on this deployment)"
-    )}`
-  );
-  out(`  ${style.bold("4")}  Skip for now`);
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    const answer = (await ask("Choice [1-4]:", "1")).trim();
-    if (answer === "1") return "manual";
-    if (answer === "2") return "own";
-    if (answer === "3") {
-      if (options.hostedAvailable) return "veefore";
-      out(style.amber("  Veefore AI is not enabled here. Choose 1, 2 or 4."));
-      continue;
-    }
-    if (answer === "4") return "skip";
-    out(style.amber("  Enter 1, 2, 3 or 4."));
+  try {
+    return await select("How would you like to handle them?", [
+      {
+        label: "I will change them myself",
+        hint: "show me exactly what to change",
+        value: "manual"
+      },
+      {
+        label: "Use AI with my own Anthropic or OpenAI key",
+        hint: "code goes only to that provider",
+        value: "own"
+      },
+      {
+        label: "Use Veefore AI",
+        hint: options.hostedAvailable ? "code is sent to Veefore, then to its model provider" : "not enabled on this deployment",
+        value: "veefore",
+        disabled: !options.hostedAvailable
+      },
+      { label: "Skip for now", value: "skip" }
+    ]);
+  } catch (error) {
+    if (error instanceof MenuCancelled) return "skip";
+    throw error;
   }
-  return "manual";
 }
 function printManualInstructions(items) {
   heading("Make these changes yourself");
@@ -3666,9 +3998,7 @@ function printDispatchInstructions(items, where) {
     out(`    ${style.cyan("import { guard } from '@veefore/sdk';")}`);
     out();
     out(`    ${style.grey("// before:  const result = await runTool(call);")}`);
-    out(
-      `    ${style.cyan("const result = await guard(call.name, (_args: typeof call.args) => runTool(call))(call.args);")}`
-    );
+    out(`    ${style.cyan("const result = await runTool(call);")}`);
   }
   out();
   out(
@@ -3793,16 +4123,21 @@ async function chooseModel(method, context) {
 async function pick(label, choices, preferred, interactive) {
   if (preferred && choices.includes(preferred)) return preferred;
   if (!interactive) return choices[0] ?? null;
-  const shown = choices.slice(0, 20);
+  const OTHER = "\0other";
   out();
-  out(`${label}:`);
-  shown.forEach(
-    (choice, index2) => out(`  ${style.bold(String(index2 + 1).padStart(2))}  ${choice}`)
-  );
-  const answer = (await ask(`Choice [1-${shown.length}]:`, "1")).trim();
-  const index = Number(answer) - 1;
-  if (Number.isInteger(index) && shown[index]) return shown[index];
-  return choices.includes(answer) ? answer : null;
+  let picked;
+  try {
+    picked = await select(label, [
+      ...choices.slice(0, 20).map((choice) => ({ label: choice, value: choice })),
+      ...choices.length > 20 ? [{ label: "Another\u2026", hint: `${choices.length - 20} more`, value: OTHER }] : []
+    ]);
+  } catch (error) {
+    if (error instanceof MenuCancelled) return null;
+    throw error;
+  }
+  if (picked !== OTHER) return picked;
+  const typed = (await ask(`${label} id:`)).trim();
+  return choices.includes(typed) ? typed : null;
 }
 async function runAssist(files, choice, context) {
   const accepted = [];
@@ -6551,120 +6886,570 @@ async function undoCommand(args, _flags) {
   return undoLatest(process.cwd(), { force: args.includes("--force") });
 }
 
-// src/setup.ts
-import { generateKeyPairSync } from "node:crypto";
-function buildPlan(scan, options = {}) {
-  return {
-    agentName: (options.agentName ?? scan.projectName ?? "my-agent").slice(0, 200),
-    tools: scan.tools.map(planTool),
-    agentHeldSecrets: scan.secrets.filter((s) => s.kind === "service").map((s) => s.name),
-    modelSecrets: scan.secrets.filter((s) => s.kind === "model").map((s) => s.name),
-    extraCapabilities: options.extraCapabilities ?? []
-  };
-}
-function planTool(tool) {
-  return {
-    key: tool.key,
-    name: tool.name,
-    description: tool.description ?? `Detected ${sourceLabel(tool.source)} tool.`,
-    // One capability per tool keeps authority explicit: granting the agent this
-    // tool grants nothing else. `tool.<key>` satisfies `resource.action`.
-    capability: `tool.${tool.key}`,
-    riskLevel: tool.riskLevel,
-    dangerous: tool.dangerous,
-    destinations: tool.hosts,
-    location: `${tool.location.file}:${tool.location.line}`,
-    money: tool.money ?? null
-  };
-}
-function printScan(scan) {
-  out(
-    `${symbol.pass} Scanned ${scan.filesScanned} file${scan.filesScanned === 1 ? "" : "s"}` + (scan.truncated ? style.amber(" (limit reached; findings may be incomplete)") : "") + style.grey(" \u2014 locally, nothing was uploaded")
-  );
-  if (scan.tools.length === 0) {
-    out(`${symbol.warn} No tools found, so there is nothing for Veefore to decide on yet.`);
-    out(style.grey("    Tools are found where they are declared for the model to call, not from"));
-    out(
-      style.grey(
-        scan.framework.language === "python" ? "    plain functions: @tool, @function_tool, @mcp.tool, Tool(name=\u2026), or a dict" : '    plain functions: tool({\u2026}), DynamicStructuredTool, { type: "function" },'
-      )
-    );
-    out(
-      style.grey(
-        scan.framework.language === "python" ? "    with name, description and an input schema." : "    server.tool(\u2026), or an object with name, description and parameters."
-      )
-    );
-    out(style.grey("    Register them in the console, or add them and run `veefore scan` again."));
-  } else {
-    out(`${symbol.pass} Found ${scan.tools.length} tool${scan.tools.length === 1 ? "" : "s"}:`);
-    for (const tool of scan.tools) {
-      const label = tool.riskLevel.padEnd(7);
-      const risk = tool.riskLevel === "HIGH" ? style.red(label) : tool.riskLevel === "MEDIUM" ? style.amber(label) : style.green(label);
-      out(
-        `    ${style.bold(tool.key.padEnd(24))} ${risk} ${style.grey(`${tool.location.file}:${tool.location.line}`)}`
-      );
-      if (tool.hosts.length > 0) out(style.grey(`      calls ${tool.hosts.join(", ")}`));
-    }
+// src/commands/logs.ts
+async function logsCommand(args, flags) {
+  const context = await resolveContext(flags);
+  const follow = args.includes("--follow") || args.includes("-f");
+  const limit = Number(valueFor(args, "--limit") ?? 25);
+  const decisionFilter = valueFor(args, "--decision");
+  const agentFilter = valueFor(args, "--agent") ?? (args.includes("--all") ? void 0 : context.config.agentId);
+  const initial = await fetchActions(context, {
+    limit,
+    decision: decisionFilter,
+    agentId: agentFilter
+  });
+  if (flags.json && !follow) {
+    printJson(initial);
+    return 0;
   }
-  const service = scan.secrets.filter((s) => s.kind === "service");
-  if (service.length > 0) {
-    out(
-      `${symbol.warn} Your code reads ${service.length} credential${service.length === 1 ? "" : "s"}: ${service.map((s) => s.name).join(", ")} ${style.grey("(names only; values were not read)")}`
-    );
+  heading(`Decisions \u2014 ${context.config.environmentName} (${context.config.environmentType})`);
+  renderActions(initial, flags.verbose);
+  if (!follow) {
+    out();
+    out(style.grey("  Use --follow to stream new decisions as they happen."));
+    out();
+    return 0;
   }
+  return streamActions(context, {
+    decision: decisionFilter,
+    agentId: agentFilter,
+    seen: new Set(initial.map((action) => action.id)),
+    verbose: flags.verbose,
+    json: flags.json
+  });
 }
-function printPlan2(plan, environment) {
+async function devCommand(args, flags) {
+  const context = await resolveContext(flags);
+  const environment = await context.api.get(`/v1/environments/${context.config.environmentId}`);
+  const gateway = await probeGateway(context.config.gatewayUrl);
+  const agent = await context.api.get(
+    `/v1/agents/${context.config.agentId}`
+  );
+  heading(`veefore dev \u2014 ${context.config.organizationName} \u203A ${environment.name}`);
   out();
-  out(style.bold("Veefore will set up"));
   out(
-    `  ${symbol.bullet} Agent ${style.bold(plan.agentName)} in ${environment.name} (${environment.type})`
+    `  ${gateway.reachable ? symbol.pass : symbol.fail} Gateway ${gateway.reachable ? style.green("connected") : style.red("unreachable")} ${style.grey(context.config.gatewayUrl)}`
   );
   out(
-    `    ${style.grey("with its own key pair, generated here. The private key never leaves this machine.")}`
+    `  ${agent.status === "ACTIVE" ? symbol.pass : symbol.warn} Agent ${style.bold(agent.name)} ${decisionStyle(agent.status)}`
   );
-  if (plan.tools.length > 0) {
-    out(
-      `  ${symbol.bullet} ${plan.tools.length} tool${plan.tools.length === 1 ? "" : "s"}, each with its own capability, authorized for this agent only`
-    );
-    const dangerous = plan.tools.filter((tool) => tool.dangerous).map((tool) => tool.key);
-    if (dangerous.length > 0) {
-      out(
-        `    ${style.grey(`flagged high impact (approval under the starter policy): ${dangerous.join(", ")}`)}`
-      );
-    }
-  }
   out(
-    `  ${symbol.bullet} A starter policy, in ${style.bold("OBSERVE")} mode: decisions are recorded, nothing is blocked yet`
+    `  ${environment.gatewayMode === "ENFORCE" ? symbol.pass : symbol.warn} Mode ${decisionStyle(environment.status === "PAUSED" ? "PAUSED" : environment.gatewayMode)}`
   );
-  if (plan.agentHeldSecrets.length > 0) {
+  if (!gateway.reachable) {
     out();
     out(
-      style.grey(
-        `  Your agent keeps holding ${plan.agentHeldSecrets.join(", ")} for now. Veefore will decide every call
-  and record it, but a call that skips the SDK is not stopped until those keys move into
-  the Veefore credential broker. Setup does not read or move any secret.`
-      )
+      `  ${symbol.fail} ${style.red("The gateway is not reachable, so no action can be permitted.")}`
     );
+    out(style.grey("    Start it with `npm run dev:gateway`, then re-run `veefore dev`."));
+    out();
+    return 1;
   }
-}
-async function applyPlan(api, plan, scope, report = (line) => out(line), options = {}) {
-  const capabilityKeys = [
-    .../* @__PURE__ */ new Set([...plan.tools.map((t) => t.capability), ...plan.extraCapabilities])
-  ];
-  for (const tool of plan.tools) {
-    await createIfAbsent(
-      () => api.post("/v1/capabilities", {
-        key: tool.capability,
-        name: `Use ${tool.name}`.slice(0, 200),
-        description: tool.description.slice(0, 1e3),
-        dangerous: tool.dangerous
-      })
+  if (environment.gatewayMode === "OBSERVE") {
+    out();
+    out(
+      `  ${symbol.info} ${style.cyan("OBSERVE mode:")} every decision is evaluated and recorded, but nothing is blocked.`
     );
+    out(style.grey("    This is the safe way to learn what your agent actually does."));
   }
-  const keys = generateKeyPairSync("ed25519");
-  const publicKey = keys.publicKey.export({ type: "spki", format: "der" }).toString(
-    "base64"
-  );
+  if (agent.isolated) {
+    out();
+    out(`  ${symbol.fail} ${style.red("This agent is isolated by an emergency control.")}`);
+  }
+  out();
+  out(style.grey("  Watching for decisions. Press Ctrl+C to stop."));
+  out();
+  const existing = await fetchActions(context, { limit: 5, agentId: context.config.agentId });
+  if (existing.length === 0) {
+    out(
+      `  ${symbol.info} No actions recorded yet. Call ${style.bold("agent.act({ tool: \u2026 })")} from your agent to see a decision here.`
+    );
+    out();
+  } else {
+    renderActions(existing, flags.verbose);
+  }
+  return streamActions(context, {
+    agentId: args.includes("--all") ? void 0 : context.config.agentId,
+    seen: new Set(existing.map((action) => action.id)),
+    verbose: true,
+    json: false,
+    coach: true
+  });
+}
+async function fetchActions(context, options) {
+  const response = await context.api.get("/v1/actions", {
+    limit: options.limit ?? 25,
+    decision: options.decision,
+    agent_id: options.agentId,
+    environment_id: context.config.environmentId
+  });
+  return [...response.data].reverse();
+}
+function renderActions(actions, verbose) {
+  if (actions.length === 0) {
+    out(style.grey("  (no decisions yet)"));
+    return;
+  }
+  if (!verbose) {
+    table(
+      [
+        { header: "WHEN", key: "when", width: 12 },
+        { header: "TOOL", key: "tool", width: 24 },
+        { header: "DECISION", key: "decision", width: 20 },
+        { header: "OUTCOME", key: "outcome", width: 24 },
+        { header: "MS", key: "latency", width: 6, align: "right" }
+      ],
+      actions.map((action) => ({
+        when: formatWhen(action.startedAt),
+        tool: action.toolKey ?? action.action,
+        decision: decisionStyle(effectiveDecision(action)),
+        outcome: decisionStyle(action.outcome),
+        latency: String(Math.round(action.latencyMs))
+      }))
+    );
+    return;
+  }
+  for (const action of actions) renderAction(action);
+}
+function effectiveDecision(action) {
+  return action.shadowDecision ?? action.decision ?? "UNKNOWN";
+}
+function renderAction(action, coach = false) {
+  const decision = effectiveDecision(action);
+  const icon = decision === "ALLOW" ? symbol.pass : decision === "BLOCK" ? symbol.fail : symbol.warn;
+  const amount = action.amount === null ? "" : style.grey(` ${formatAmount(action.amount, action.currency)}`);
+  out(
+    `${icon} ${style.grey(new Date(action.startedAt).toISOString().slice(11, 19))} ${style.bold(action.toolKey ?? action.action)}${amount} ${decisionStyle(decision)} ${style.grey(`(${action.outcome})`)}`
+  );
+  if (action.denyReason) out(`    ${action.denyReason}`);
+  const facts = [];
+  if (action.policyVersionNumber !== null) facts.push(`policy v${action.policyVersionNumber}`);
+  if (action.matchedRuleIds.length > 0)
+    facts.push(`${action.matchedRuleIds.length} rule(s) matched`);
+  if (action.riskLevel) facts.push(`risk ${action.riskLevel}`);
+  if (action.protocol !== "HTTP") facts.push(action.protocol);
+  if (action.gatewayMode !== "ENFORCE") facts.push(`mode ${action.gatewayMode}`);
+  facts.push(`${Math.round(action.latencyMs)}ms`);
+  out(`    ${style.grey(facts.join("  \xB7  "))}`);
+  if (coach) {
+    const hint = coachingFor(action);
+    if (hint) out(`    ${style.cyan("\u2192")} ${style.grey(hint)}`);
+  }
+}
+function coachingFor(action) {
+  const decision = effectiveDecision(action);
+  if (action.gatewayMode === "OBSERVE" && decision !== "ALLOW") {
+    return `In ENFORCE mode this would have been ${decision}. Simulate before switching.`;
+  }
+  switch (decision) {
+    case "BLOCK":
+      return action.matchedRuleIds.length > 0 ? "Blocked by a policy rule. Adjust the rule, or grant the capability if this is legitimate." : "Blocked before policy evaluation. Check the tool is registered and the agent is authorized for it.";
+    case "REQUIRE_APPROVAL":
+      return "Call actWithApproval() so your agent waits for the reviewer instead of failing.";
+    case "LIMIT":
+      return "The amount was capped by policy. Read limits.appliedAmount from the decision.";
+    case "MASK":
+      return "Some fields were masked before reaching the tool. Check limits.maskedFields.";
+    case "STEP_UP_AUTH":
+      return "A human must re-authenticate. Agents cannot satisfy step-up on their own.";
+    default:
+      return null;
+  }
+}
+function formatAmount(minorUnits, currency) {
+  const major = (minorUnits / 100).toLocaleString("en-IN", {
+    minimumFractionDigits: 2,
+    maximumFractionDigits: 2
+  });
+  return currency ? `${major} ${currency}` : major;
+}
+async function streamActions(context, options) {
+  let interval = 1e3;
+  let stopped = false;
+  const stop = () => {
+    stopped = true;
+  };
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+  let blocked = 0;
+  let approvals = 0;
+  let allowed = 0;
+  while (!stopped) {
+    let fresh = [];
+    try {
+      const recent = await fetchActions(context, {
+        limit: 50,
+        decision: options.decision,
+        agentId: options.agentId
+      });
+      fresh = recent.filter((action) => !options.seen.has(action.id));
+      for (const action of fresh) options.seen.add(action.id);
+    } catch (error) {
+      out(
+        `${symbol.warn} ${style.amber("Lost contact with the control plane;")} ${style.grey(error instanceof Error ? error.message : String(error))}`
+      );
+      interval = Math.min(interval * 2, 15e3);
+      await delay(interval);
+      continue;
+    }
+    for (const action of fresh) {
+      if (options.json) {
+        out(JSON.stringify(action));
+      } else {
+        renderAction(action, options.coach);
+      }
+      const decision = effectiveDecision(action);
+      if (decision === "BLOCK") blocked += 1;
+      else if (decision === "REQUIRE_APPROVAL") approvals += 1;
+      else allowed += 1;
+    }
+    interval = fresh.length > 0 ? 1e3 : Math.min(interval * 1.5, 5e3);
+    await delay(interval);
+  }
+  if (!options.json) {
+    out();
+    out(
+      `  ${style.green(`${allowed} allowed`)}  ${style.amber(`${approvals} needing approval`)}  ${style.red(`${blocked} blocked`)}`
+    );
+    out();
+  }
+  return 0;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/commands/test.ts
+async function testCommand(args, flags) {
+  const context = await resolveContext(flags);
+  const toolFilter = valueFor(args, "--tool");
+  heading(
+    `Enforcement test \u2014 ${context.config.environmentName} (${context.config.environmentType})`
+  );
+  const results = [];
+  const record = (check, passed, detail) => {
+    results.push({ check, passed, detail });
+    out(`${passed ? symbol.pass : symbol.fail} ${check} ${style.grey(detail)}`);
+  };
+  const gateway = await probeGateway(context.config.gatewayUrl);
+  record(
+    "Gateway reachable",
+    gateway.reachable,
+    gateway.reachable ? `${context.config.gatewayUrl} \u2014 posture ${gateway.posture ?? "unknown"}` : gateway.error ?? "unreachable"
+  );
+  const identities = await context.api.get(`/v1/agents/${context.config.agentId}/identities`).catch(() => []);
+  const activeIdentity = identities.find((identity) => identity.status === "ACTIVE");
+  record(
+    "Agent identity active",
+    Boolean(activeIdentity),
+    activeIdentity ? `generation ${activeIdentity.generation}, expires ${activeIdentity.expiresAt.slice(0, 10)}` : "no ACTIVE identity \u2014 the agent cannot authenticate"
+  );
+  const policies = await context.api.get("/v1/policies", { workspace_id: context.config.workspaceId });
+  const effective = policies.filter(
+    (policy) => policy.status === "ACTIVE" && policy.bindings.length > 0
+  );
+  record(
+    "Active, bound policy exists",
+    effective.length > 0,
+    effective.length > 0 ? effective.map((policy) => policy.name).join(", ") : "no active policy is bound to a scope, so no rule can match"
+  );
+  let caseTotal = 0;
+  let caseFailed = 0;
+  for (const policy of policies) {
+    const result = await context.api.post(`/v1/policies/${policy.id}/tests/run`, {}).catch(() => null);
+    if (!result) continue;
+    caseTotal += result.passed + result.failed;
+    caseFailed += result.failed;
+  }
+  record(
+    "Policy test cases",
+    caseFailed === 0,
+    caseTotal === 0 ? "no test cases recorded \u2014 add cases so rule changes are provable" : `${caseTotal - caseFailed}/${caseTotal} passing`
+  );
+  const tools = await resolveAuthorizedTools(context, toolFilter);
+  if (tools.length === 0) {
+    record(
+      "Authorized tools",
+      false,
+      "this agent is authorized for no tools, so it cannot do anything"
+    );
+  } else {
+    record("Authorized tools", true, tools.map((tool) => tool.key).join(", "));
+  }
+  heading("Decision probe (dry run \u2014 nothing is executed)");
+  const probes = [];
+  for (const tool of tools) {
+    const probeSpinner = spinner(`Evaluating ${tool.key}`);
+    try {
+      const outcome = await context.api.post("/v1/policies/simulate", {
+        agent_id: context.config.agentId,
+        tool: tool.key,
+        capability: tool.requiredCapability,
+        environment_id: context.config.environmentId,
+        parameters: {}
+      });
+      probeSpinner.succeed(`${tool.key} \u2192 ${outcome.decision}`);
+      probes.push({ tool, outcome });
+    } catch (error) {
+      probeSpinner.fail(`${tool.key} could not be evaluated`);
+      probes.push({
+        tool,
+        outcome: null,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  out();
+  table(
+    [
+      { header: "TOOL", key: "tool", width: 24 },
+      { header: "RISK", key: "risk", width: 18 },
+      { header: "DECISION", key: "decision", width: 20 },
+      { header: "MATCHED RULE", key: "rule", width: 32 }
+    ],
+    probes.map((probe) => ({
+      tool: probe.tool.dangerous ? `${probe.tool.key} ${style.red("(dangerous)")}` : probe.tool.key,
+      risk: decisionStyle(probe.tool.riskLevel),
+      decision: probe.outcome ? decisionStyle(probe.outcome.decision) : style.red("ERROR"),
+      rule: probe.outcome?.matchedRules[0]?.name ?? style.grey(probe.error ?? "default decision")
+    }))
+  );
+  const unguarded = probes.filter(
+    (probe) => probe.tool.dangerous && probe.outcome?.decision === "ALLOW" && probe.outcome.matchedRules.length === 0
+  );
+  out();
+  record(
+    "Dangerous tools are guarded",
+    unguarded.length === 0,
+    unguarded.length === 0 ? "every dangerous tool is either refused or matched by an explicit rule" : `${unguarded.map((probe) => probe.tool.key).join(", ")} allowed by the default decision with no rule`
+  );
+  const errored = probes.filter((probe) => probe.outcome === null);
+  record(
+    "All evaluations completed",
+    errored.length === 0,
+    errored.length === 0 ? `${probes.length} evaluated` : `${errored.length} failed to evaluate`
+  );
+  const impure = probes.filter((probe) => probe.outcome && probe.outcome.sideEffectFree !== true);
+  record(
+    "Simulation was side-effect free",
+    impure.length === 0,
+    impure.length === 0 ? "no action records were written" : "the server reported side effects"
+  );
+  const failed = results.filter((result) => !result.passed);
+  out();
+  out(
+    failed.length === 0 ? `  ${symbol.pass} ${style.green(`${results.length} check(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${failed.length} of ${results.length} check(s) failing.`)}`
+  );
+  if (failed.length > 0) {
+    out();
+    for (const failure of failed) out(`    ${symbol.fail} ${failure.check}: ${failure.detail}`);
+  }
+  out();
+  if (flags.json) printJson({ results, probes });
+  return failed.length > 0 ? 1 : 0;
+}
+async function resolveAuthorizedTools(context, filter) {
+  const tools = await context.api.get("/v1/tools", {
+    workspace_id: context.config.workspaceId,
+    agent_id: context.config.agentId,
+    limit: 100
+  });
+  const candidates = tools.items.filter(
+    (tool) => tool.status !== "DISABLED" && (tool.environmentId === null || tool.environmentId === context.config.environmentId)
+  );
+  if (!filter) return candidates;
+  const match = candidates.filter((tool) => tool.key === filter);
+  if (match.length === 0) {
+    throw new CliError(
+      `Tool "${filter}" is not available to this agent in ${context.config.environmentName}.`,
+      `Available: ${candidates.map((tool) => tool.key).join(", ") || "none"}`
+    );
+  }
+  return match;
+}
+
+// src/panel.ts
+import { homedir as homedir2 } from "node:os";
+import path10 from "node:path";
+
+// src/version.ts
+var CLI_VERSION = "1.2.0";
+
+// src/panel.ts
+function welcomeSource(flags = {}) {
+  return () => {
+    const project = readProjectConfig();
+    const controlPlaneUrl = project?.controlPlaneUrl ?? resolveControlPlaneUrl(flags.controlPlaneUrl);
+    const session = loadSession(controlPlaneUrl);
+    return {
+      version: CLI_VERSION,
+      facts: [
+        ["Folder", shorten(tilde(process.cwd()), 34)],
+        ["Signed in", session ? session.email : style.grey("not yet")],
+        [
+          "Project",
+          project ? `${project.agentName} \xB7 ${project.environmentName}` : style.grey("not set up here")
+        ],
+        ["Veefore", hostOf(controlPlaneUrl)]
+      ]
+    };
+  };
+}
+function tilde(dir) {
+  const home = homedir2();
+  return dir === home || dir.startsWith(`${home}${path10.sep}`) ? `~${dir.slice(home.length)}` : dir;
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function shorten(text, width) {
+  return text.length <= width ? text : `\u2026${text.slice(text.length - width + 1)}`;
+}
+
+// src/report.ts
+function reportError(error, flags) {
+  if (error instanceof CliError) {
+    err();
+    err(`${style.red("\u2717")} ${error.message}`);
+    if (error.hint) err(style.grey(`  ${error.hint}`));
+    err();
+    return error.exitCode;
+  }
+  if (error instanceof CliApiError) {
+    err();
+    reportApiError(error);
+    err();
+    return 1;
+  }
+  err();
+  err(`${style.red("\u2717")} ${error instanceof Error ? error.message : String(error)}`);
+  if (flags.verbose && error instanceof Error && error.stack) {
+    err(style.grey(error.stack));
+  } else {
+    err(style.grey("  Re-run with --verbose for the stack trace."));
+  }
+  err();
+  return 1;
+}
+
+// src/setup.ts
+import { generateKeyPairSync } from "node:crypto";
+function buildPlan(scan, options = {}) {
+  return {
+    agentName: (options.agentName ?? scan.projectName ?? "my-agent").slice(0, 200),
+    tools: scan.tools.map(planTool),
+    agentHeldSecrets: scan.secrets.filter((s) => s.kind === "service").map((s) => s.name),
+    modelSecrets: scan.secrets.filter((s) => s.kind === "model").map((s) => s.name),
+    extraCapabilities: options.extraCapabilities ?? []
+  };
+}
+function planTool(tool) {
+  return {
+    key: tool.key,
+    name: tool.name,
+    description: tool.description ?? `Detected ${sourceLabel(tool.source)} tool.`,
+    // One capability per tool keeps authority explicit: granting the agent this
+    // tool grants nothing else. `tool.<key>` satisfies `resource.action`.
+    capability: `tool.${tool.key}`,
+    riskLevel: tool.riskLevel,
+    dangerous: tool.dangerous,
+    destinations: tool.hosts,
+    location: `${tool.location.file}:${tool.location.line}`,
+    money: tool.money ?? null
+  };
+}
+function printScan(scan) {
+  out(
+    `${symbol.pass} Scanned ${scan.filesScanned} file${scan.filesScanned === 1 ? "" : "s"}` + (scan.truncated ? style.amber(" (limit reached; findings may be incomplete)") : "") + style.grey(" \u2014 locally, nothing was uploaded")
+  );
+  if (scan.tools.length === 0) {
+    out(`${symbol.warn} No tools found, so there is nothing for Veefore to decide on yet.`);
+    out(style.grey("    Tools are found where they are declared for the model to call, not from"));
+    out(
+      style.grey(
+        scan.framework.language === "python" ? "    plain functions: @tool, @function_tool, @mcp.tool, Tool(name=\u2026), or a dict" : '    plain functions: tool({\u2026}), DynamicStructuredTool, { type: "function" },'
+      )
+    );
+    out(
+      style.grey(
+        scan.framework.language === "python" ? "    with name, description and an input schema." : "    server.tool(\u2026), or an object with name, description and parameters."
+      )
+    );
+    out(style.grey("    Register them in the console, or add them and run `veefore scan` again."));
+  } else {
+    out(`${symbol.pass} Found ${scan.tools.length} tool${scan.tools.length === 1 ? "" : "s"}:`);
+    for (const tool of scan.tools) {
+      const label = tool.riskLevel.padEnd(7);
+      const risk = tool.riskLevel === "HIGH" ? style.red(label) : tool.riskLevel === "MEDIUM" ? style.amber(label) : style.green(label);
+      out(
+        `    ${style.bold(tool.key.padEnd(24))} ${risk} ${style.grey(`${tool.location.file}:${tool.location.line}`)}`
+      );
+      if (tool.hosts.length > 0) out(style.grey(`      calls ${tool.hosts.join(", ")}`));
+    }
+  }
+  const service = scan.secrets.filter((s) => s.kind === "service");
+  if (service.length > 0) {
+    out(
+      `${symbol.warn} Your code reads ${service.length} credential${service.length === 1 ? "" : "s"}: ${service.map((s) => s.name).join(", ")} ${style.grey("(names only; values were not read)")}`
+    );
+  }
+}
+function printPlan2(plan, environment) {
+  out();
+  out(style.bold("Veefore will set up"));
+  out(
+    `  ${symbol.bullet} Agent ${style.bold(plan.agentName)} in ${environment.name} (${environment.type})`
+  );
+  out(
+    `    ${style.grey("with its own key pair, generated here. The private key never leaves this machine.")}`
+  );
+  if (plan.tools.length > 0) {
+    out(
+      `  ${symbol.bullet} ${plan.tools.length} tool${plan.tools.length === 1 ? "" : "s"}, each with its own capability, authorized for this agent only`
+    );
+    const dangerous = plan.tools.filter((tool) => tool.dangerous).map((tool) => tool.key);
+    if (dangerous.length > 0) {
+      out(
+        `    ${style.grey(`flagged high impact (approval under the starter policy): ${dangerous.join(", ")}`)}`
+      );
+    }
+  }
+  out(
+    `  ${symbol.bullet} A starter policy, in ${style.bold("OBSERVE")} mode: decisions are recorded, nothing is blocked yet`
+  );
+  if (plan.agentHeldSecrets.length > 0) {
+    out();
+    out(
+      style.grey(
+        `  Your agent keeps holding ${plan.agentHeldSecrets.join(", ")} for now. Veefore will decide every call
+  and record it, but a call that skips the SDK is not stopped until those keys move into
+  the Veefore credential broker. Setup does not read or move any secret.`
+      )
+    );
+  }
+}
+async function applyPlan(api, plan, scope, report = (line) => out(line), options = {}) {
+  const capabilityKeys = [
+    .../* @__PURE__ */ new Set([...plan.tools.map((t) => t.capability), ...plan.extraCapabilities])
+  ];
+  for (const tool of plan.tools) {
+    await createIfAbsent(
+      () => api.post("/v1/capabilities", {
+        key: tool.capability,
+        name: `Use ${tool.name}`.slice(0, 200),
+        description: tool.description.slice(0, 1e3),
+        dangerous: tool.dangerous
+      })
+    );
+  }
+  const keys = generateKeyPairSync("ed25519");
+  const publicKey = keys.publicKey.export({ type: "spki", format: "der" }).toString(
+    "base64"
+  );
   const privateKey = keys.privateKey.export({ type: "pkcs8", format: "der" }).toString(
     "base64"
   );
@@ -6857,7 +7642,7 @@ var DEFAULT_GATEWAY = "http://localhost:4010";
 async function initCommand(args, flags) {
   const options = parseInitArgs(args);
   const existing = readProjectConfig();
-  if (existing && !options.force && process.stdin.isTTY && process.stdout.isTTY && !flags.json) {
+  if (existing && !options.force && isInteractive() && !flags.json) {
     return projectHome(existing, flags);
   }
   if (existing && !options.force) {
@@ -6898,20 +7683,34 @@ async function initCommand(args, flags) {
   }
   if (!session) throw new CliError("Sign-in did not produce a usable session.");
   const api = new ApiClient({ controlPlaneUrl, token: session.token });
-  const me = await api.get("/v1/auth/session");
-  const organization = await selectOrganization(api, me, options, flags);
-  const workspace = await selectWorkspace(api, me, options, flags);
-  const environment = await selectEnvironment(api, me, workspace.id, options, flags);
-  if (environment.type === "PRODUCTION" && !options.force) {
-    out();
-    out(
-      `${symbol.warn} ${style.amber("You selected a PRODUCTION environment.")} A new agent here starts in ${style.bold("OBSERVE")} mode and performs no enforcement until you switch it.`
-    );
-    const proceed2 = await confirm("Continue with the production environment?", { yes: flags.yes });
-    if (!proceed2) {
-      out(style.grey("Cancelled. Re-run and choose a development environment."));
-      return 1;
+  let me = await api.get("/v1/auth/session");
+  const STEPS = ["organization", "workspace", "environment"];
+  const asked = /* @__PURE__ */ new Map();
+  let organization;
+  let workspace;
+  let environment;
+  for (let at = 0; at < STEPS.length; ) {
+    const step = STEPS[at];
+    const answer = step === "organization" ? await selectOrganization(api, me, options, flags) : step === "workspace" ? await selectWorkspace(api, me, options, flags) : await selectEnvironment(api, me, workspace.id, options, flags);
+    if (answer === BACK) {
+      let previous = at - 1;
+      while (previous >= 0 && !asked.get(STEPS[previous])) previous -= 1;
+      if (previous < 0) {
+        throw new MenuCancelled();
+      }
+      at = previous;
+      continue;
+    }
+    asked.set(step, answer.asked);
+    if (step === "organization") {
+      organization = answer.value;
+      if (answer.asked) me = await api.get("/v1/auth/session");
+    } else if (step === "workspace") {
+      workspace = answer.value;
+    } else {
+      environment = answer.value;
     }
+    at += 1;
   }
   heading("Looking at your project");
   const scan = scanProject(process.cwd());
@@ -6920,15 +7719,41 @@ async function initCommand(args, flags) {
     agentName: options.agentName,
     extraCapabilities: options.capabilities
   });
-  if (!options.agentName && !flags.yes) {
-    plan.agentName = await ask(`Agent name ${style.grey(`[${plan.agentName}]`)}:`, plan.agentName);
-  }
-  printPlan2(plan, environment);
-  out();
-  const proceed = await confirm("Set this up?", { yes: flags.yes });
-  if (!proceed) {
-    out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
-    return 1;
+  for (; ; ) {
+    if (!options.agentName && !flags.yes) {
+      const name = await askAgentName(plan.agentName);
+      if (name === BACK) {
+        const again = await selectEnvironment(api, me, workspace.id, options, flags);
+        if (again !== BACK) environment = again.value;
+        continue;
+      }
+      plan.agentName = name;
+    }
+    printPlan2(plan, environment);
+    out();
+    const proceed = await confirm("Set this up?", { yes: flags.yes });
+    if (proceed) break;
+    if (flags.yes || options.agentName) {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    const next = await select(
+      "What would you like to do?",
+      [
+        { label: "Change the agent name", value: "name" },
+        { label: "Choose a different environment", value: "environment" },
+        { label: "Leave setup", value: "leave" }
+      ],
+      { initial: 0 }
+    );
+    if (next === "leave") {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    if (next === "environment") {
+      const again = await selectEnvironment(api, me, workspace.id, options, flags);
+      if (again !== BACK) environment = again.value;
+    }
   }
   heading("Setting up");
   let created;
@@ -7096,7 +7921,7 @@ async function initCommand(args, flags) {
 }
 function previousApprovalMode(dir = process.cwd()) {
   try {
-    const text = readFileSync9(path10.join(dir, ".env.local"), "utf8");
+    const text = readFileSync9(path11.join(dir, ".env.local"), "utf8");
     const value = /^\s*VEEFORE_APPROVAL_MODE\s*=\s*['"]?(\w+)/m.exec(text)?.[1]?.toLowerCase();
     return value === "wait" || value === "throw" ? value : null;
   } catch {
@@ -7142,35 +7967,28 @@ async function selectOrganization(api, me, options, flags) {
         `Available: ${organizations.map((org) => org.id).join(", ")}`
       );
     }
-    return match;
+    return { value: match, asked: false };
   }
   if (organizations.length === 1 || flags.yes) {
     const chosen2 = organizations[0];
     if (!chosen2) throw new CliError("Your account is not a member of any organization.");
     out(`${symbol.pass} Organization: ${style.bold(chosen2.name)}`);
-    return chosen2;
+    return { value: chosen2, asked: false };
   }
   out();
-  out(style.bold("Select an organization"));
-  table(
-    [
-      { header: "#", key: "index", align: "right" },
-      { header: "NAME", key: "name" },
-      { header: "ROLE", key: "role" },
-      { header: "ID", key: "id" }
-    ],
-    organizations.map((org, index) => ({
-      index: String(index + 1),
-      name: org.name,
-      role: org.roleKey,
-      id: org.id
-    }))
+  const chosen = await select(
+    "Which organization?",
+    organizations.map((org) => ({
+      label: org.name,
+      hint: `${org.roleKey} \xB7 ${org.id}`,
+      value: org
+    })),
+    { quiet: true, back: true, backLabel: "Back" }
   );
-  const chosen = organizations[await pickIndex(organizations.length)];
-  if (!chosen) throw new CliError("No organization selected.");
+  if (chosen === BACK) return BACK;
   await api.post("/v1/auth/scope", { organization_id: chosen.id });
   out(`${symbol.pass} Organization: ${style.bold(chosen.name)}`);
-  return chosen;
+  return { value: chosen, asked: true };
 }
 async function selectWorkspace(api, me, options, flags) {
   const workspaces = me.workspaces.length > 0 ? me.workspaces : await api.get("/v1/workspaces");
@@ -7183,31 +8001,26 @@ async function selectWorkspace(api, me, options, flags) {
   if (options.workspaceId) {
     const match = workspaces.find((workspace) => workspace.id === options.workspaceId);
     if (!match) throw new CliError(`Workspace ${options.workspaceId} was not found.`);
-    return match;
+    return { value: match, asked: false };
   }
   if (workspaces.length === 1 || flags.yes) {
     const chosen2 = workspaces[0];
     out(`${symbol.pass} Workspace: ${style.bold(chosen2.name)}`);
-    return chosen2;
+    return { value: chosen2, asked: false };
   }
   out();
-  out(style.bold("Select a workspace"));
-  table(
-    [
-      { header: "#", key: "index", align: "right" },
-      { header: "NAME", key: "name" },
-      { header: "ID", key: "id" }
-    ],
-    workspaces.map((workspace, index) => ({
-      index: String(index + 1),
-      name: workspace.name,
-      id: workspace.id
-    }))
+  const chosen = await select(
+    "Which workspace?",
+    workspaces.map((workspace) => ({
+      label: workspace.name,
+      hint: workspace.id,
+      value: workspace
+    })),
+    { quiet: true, back: true }
   );
-  const chosen = workspaces[await pickIndex(workspaces.length)];
-  if (!chosen) throw new CliError("No workspace selected.");
+  if (chosen === BACK) return BACK;
   out(`${symbol.pass} Workspace: ${style.bold(chosen.name)}`);
-  return chosen;
+  return { value: chosen, asked: true };
 }
 async function selectEnvironment(api, me, workspaceId, options, flags) {
   const all = me.environments.length > 0 ? me.environments : await api.get("/v1/environments", { workspace_id: workspaceId });
@@ -7221,35 +8034,61 @@ async function selectEnvironment(api, me, workspaceId, options, flags) {
   if (options.environmentId) {
     const match = environments.find((environment) => environment.id === options.environmentId);
     if (!match) throw new CliError(`Environment ${options.environmentId} was not found.`);
-    return match;
+    return { value: match, asked: false };
+  }
+  if (flags.yes) {
+    const chosen = environments.find((environment) => environment.type === "DEVELOPMENT") ?? environments[0];
+    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
+    return { value: chosen, asked: false };
+  }
+  const development = environments.findIndex((environment) => environment.type === "DEVELOPMENT");
+  for (; ; ) {
+    out();
+    const chosen = await select(
+      "Which environment?",
+      environments.map((environment) => ({
+        label: environment.name,
+        hint: `${environment.type} \xB7 ${environment.gatewayMode ?? "\u2014"} \xB7 ${environment.id}`,
+        value: environment
+      })),
+      { quiet: true, initial: development >= 0 ? development : 0, back: true }
+    );
+    if (chosen === BACK) return BACK;
+    if (chosen.type === "PRODUCTION" && !options.force) {
+      out();
+      out(
+        `${symbol.warn} ${style.amber("You selected a PRODUCTION environment.")} A new agent here starts in ${style.bold("OBSERVE")} mode and performs no enforcement until you switch it.`
+      );
+      if (!await confirm("Continue with the production environment?", { yes: flags.yes })) {
+        out(style.grey("  Choose another environment."));
+        continue;
+      }
+    }
+    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
+    return { value: chosen, asked: true };
   }
-  if (flags.yes) {
-    const chosen2 = environments.find((environment) => environment.type === "DEVELOPMENT") ?? environments[0];
-    out(`${symbol.pass} Environment: ${style.bold(chosen2.name)} (${chosen2.type})`);
-    return chosen2;
+}
+async function askAgentName(suggested) {
+  for (; ; ) {
+    out();
+    const choice = await select(
+      "Agent name",
+      [
+        { label: suggested, hint: "suggested", value: "keep" },
+        { label: "Type a different name\u2026", value: "type" }
+      ],
+      { quiet: true, back: true }
+    );
+    if (choice === BACK) return BACK;
+    if (choice === "keep") {
+      out(`${symbol.pass} Agent name: ${style.bold(suggested)}`);
+      return suggested;
+    }
+    const typed = (await ask(`Agent name ${style.grey(`[${suggested}]`)}:`, suggested)).trim();
+    if (typed === "") continue;
+    out(`${symbol.pass} Agent name: ${style.bold(typed)}`);
+    return typed;
   }
-  out();
-  out(style.bold("Select an environment"));
-  table(
-    [
-      { header: "#", key: "index", align: "right" },
-      { header: "NAME", key: "name" },
-      { header: "TYPE", key: "type" },
-      { header: "MODE", key: "mode" },
-      { header: "ID", key: "id" }
-    ],
-    environments.map((environment, index) => ({
-      index: String(index + 1),
-      name: environment.name,
-      type: environment.type,
-      mode: environment.gatewayMode ?? "\u2014",
-      id: environment.id
-    }))
-  );
-  const chosen = environments[await pickIndex(environments.length)];
-  if (!chosen) throw new CliError("No environment selected.");
-  out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
-  return chosen;
 }
 async function discoverAudience(gatewayUrl) {
   try {
@@ -7264,15 +8103,6 @@ async function discoverAudience(gatewayUrl) {
     return gatewayUrl;
   }
 }
-async function pickIndex(count) {
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    const answer = await ask(`Choice [1-${count}]:`, "1");
-    const index = Number(answer) - 1;
-    if (Number.isInteger(index) && index >= 0 && index < count) return index;
-    out(style.amber(`  Enter a number between 1 and ${count}.`));
-  }
-  throw new CliError("No valid selection was made.");
-}
 async function configureStarterPolicy(api, workspaceId, flags, options) {
   if (options.skipPolicy) {
     out(`${symbol.info} Skipped starter policy (--skip-policy).`);
@@ -7348,443 +8178,266 @@ async function validateConnection(api, gatewayUrl, agentId, environmentId) {
     checks.push({
       name: "Gateway reachable",
       status: "fail",
-      message: `${gatewayUrl} \u2014 ${error instanceof Error ? error.message : String(error)}. Start it with \`npm run dev:gateway\`.`
-    });
-  }
-  try {
-    const identities = await api.get(
-      `/v1/agents/${agentId}/identities`
-    );
-    const active = identities.find((identity) => identity.status === "ACTIVE");
-    checks.push({
-      name: "Agent identity active",
-      status: active ? "pass" : "fail",
-      message: active ? `expires ${active.expiresAt.slice(0, 10)}` : "no ACTIVE identity"
-    });
-  } catch (error) {
-    checks.push({
-      name: "Agent identity active",
-      status: "warn",
-      message: error instanceof Error ? error.message : String(error)
-    });
-  }
-  try {
-    const passport = await api.get(
-      `/v1/passports/${agentId}`
-    );
-    checks.push({
-      name: "Agent passport issued",
-      status: passport ? "pass" : "warn",
-      message: passport ? `version ${passport.version}` : "not issued yet"
-    });
-  } catch {
-    checks.push({ name: "Agent passport issued", status: "warn", message: "could not read" });
-  }
-  try {
-    const environment = await api.get(
-      `/v1/environments/${environmentId}`
-    );
-    checks.push({
-      name: "Enforcement mode",
-      status: "pass",
-      message: environment.gatewayMode === "ENFORCE" ? "ENFORCE \u2014 decisions are enforced" : `${environment.gatewayMode} \u2014 decisions are recorded but not enforced`
-    });
-  } catch {
-    checks.push({ name: "Enforcement mode", status: "warn", message: "could not read" });
-  }
-  return checks;
-}
-function parseInitArgs(args) {
-  const options = { force: false, skipPolicy: false, skipCode: false };
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    const next = () => {
-      const value = args[index + 1];
-      if (value === void 0 || value.startsWith("-")) {
-        throw new CliError(`Option ${String(arg)} requires a value.`);
-      }
-      index += 1;
-      return value;
-    };
-    switch (arg) {
-      case "--force":
-        options.force = true;
-        break;
-      case "--skip-policy":
-        options.skipPolicy = true;
-        break;
-      case "--skip-code":
-        options.skipCode = true;
-        break;
-      case "--new-agent":
-        options.newAgent = true;
-        break;
-      case "--control-plane":
-        options.controlPlaneUrl = next();
-        break;
-      case "--gateway":
-        options.gatewayUrl = next();
-        break;
-      case "--organization":
-        options.organizationId = next();
-        break;
-      case "--workspace":
-        options.workspaceId = next();
-        break;
-      case "--environment":
-        options.environmentId = next();
-        break;
-      case "--name":
-        options.agentName = next();
-        break;
-      case "--capability":
-        options.capabilities = [...options.capabilities ?? [], next()];
-        break;
-      case "--approval-mode": {
-        const value = next().toLowerCase();
-        if (value !== "wait" && value !== "throw") {
-          throw new CliError('--approval-mode must be "wait" or "throw".');
-        }
-        options.approvalMode = value;
-        break;
-      }
-      default:
-        if (arg?.startsWith("-")) {
-          throw new CliError(`Unknown option for \`veefore init\`: ${arg}`);
-        }
-    }
-  }
-  return options;
-}
-async function projectHome(existing, flags) {
-  const state = await agentState(existing);
-  out();
-  out(`${style.bold("Veefore")} ${style.grey(existing.controlPlaneUrl)}`);
-  details([
-    ["Agent", `${existing.agentName} (${existing.agentId})`],
-    ["Environment", `${existing.environmentName} (${existing.environmentType})`],
-    [
-      "Status",
-      state.kind === "ok" ? state.status : state.kind === "signed-out" ? "not signed in" : state.kind === "session-ended" ? "signed out" : state.kind === "missing" ? "agent not found" : "Veefore not reachable"
-    ]
-  ]);
-  if (state.kind === "session-ended") {
-    out(`${symbol.warn} ${state.message}`);
-  }
-  const choices = [];
-  const ended = state.kind === "missing" || state.kind === "ok" && ENDED_STATUSES.includes(state.status);
-  if (ended) {
-    out();
-    out(
-      `${symbol.warn} ${style.amber(
-        state.kind === "missing" ? "This agent no longer exists in Veefore." : `This agent was ${state.kind === "ok" ? state.status.toLowerCase() : "removed"} in Veefore.`
-      )} Every tool call wrapped in guard() is now refused.`
-    );
-    choices.push(
-      {
-        label: "Remove Veefore from this project (take guard() out of the code, disconnect)",
-        run: () => removeCommand([], flags, state)
-      },
-      {
-        label: "Set it up again with a new agent (the guarded code keeps working)",
-        run: () => initCommand(["--force"], flags)
-      }
-    );
-  } else {
-    if (state.kind === "signed-out" || state.kind === "session-ended") {
-      choices.push({
-        label: "Sign in",
-        run: async () => {
-          await login(existing.controlPlaneUrl);
-          return 0;
-        }
-      });
-    }
-    choices.push(
-      { label: "Check status", run: () => statusCommand([], flags) },
-      {
-        label: "Protect tools in the code (veefore integrate)",
-        run: () => integrateCommand([], flags)
-      },
-      { label: "Re-run setup for this project", run: () => initCommand(["--force"], flags) },
-      {
-        label: "Remove Veefore from this project",
-        run: () => removeCommand([], flags, state)
-      }
-    );
-    if (state.kind === "ok" || state.kind === "unreachable") {
-      choices.push({
-        label: "Sign out",
-        run: async () => {
-          await logout(existing.controlPlaneUrl);
-          return 0;
-        }
-      });
-    }
-  }
-  choices.push({ label: "Exit", run: async () => 0 });
-  out();
-  out("What would you like to do?");
-  choices.forEach((choice, index) => out(`  ${style.bold(String(index + 1))}  ${choice.label}`));
-  const answer = Number(
-    (await ask(`Choice [1-${choices.length}]:`, String(choices.length))).trim()
-  );
-  const picked = choices[answer - 1];
-  if (!picked) {
-    out(style.grey("Nothing changed."));
-    return 0;
-  }
-  return picked.run();
-}
-
-// src/commands/scan.ts
-async function scanCommand(_args, flags) {
-  const scan = scanProject(process.cwd());
-  if (flags.json) {
-    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
-    return 0;
-  }
-  heading("Veefore scan");
-  out(
-    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
-  );
-  printScan(scan);
-  out();
-  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
-  return 0;
-}
-
-// src/commands/logs.ts
-async function logsCommand(args, flags) {
-  const context = await resolveContext(flags);
-  const follow = args.includes("--follow") || args.includes("-f");
-  const limit = Number(valueFor(args, "--limit") ?? 25);
-  const decisionFilter = valueFor(args, "--decision");
-  const agentFilter = valueFor(args, "--agent") ?? (args.includes("--all") ? void 0 : context.config.agentId);
-  const initial = await fetchActions(context, {
-    limit,
-    decision: decisionFilter,
-    agentId: agentFilter
-  });
-  if (flags.json && !follow) {
-    printJson(initial);
-    return 0;
-  }
-  heading(`Decisions \u2014 ${context.config.environmentName} (${context.config.environmentType})`);
-  renderActions(initial, flags.verbose);
-  if (!follow) {
-    out();
-    out(style.grey("  Use --follow to stream new decisions as they happen."));
-    out();
-    return 0;
-  }
-  return streamActions(context, {
-    decision: decisionFilter,
-    agentId: agentFilter,
-    seen: new Set(initial.map((action) => action.id)),
-    verbose: flags.verbose,
-    json: flags.json
-  });
-}
-async function devCommand(args, flags) {
-  const context = await resolveContext(flags);
-  const environment = await context.api.get(`/v1/environments/${context.config.environmentId}`);
-  const gateway = await probeGateway(context.config.gatewayUrl);
-  const agent = await context.api.get(
-    `/v1/agents/${context.config.agentId}`
-  );
-  heading(`veefore dev \u2014 ${context.config.organizationName} \u203A ${environment.name}`);
-  out();
-  out(
-    `  ${gateway.reachable ? symbol.pass : symbol.fail} Gateway ${gateway.reachable ? style.green("connected") : style.red("unreachable")} ${style.grey(context.config.gatewayUrl)}`
-  );
-  out(
-    `  ${agent.status === "ACTIVE" ? symbol.pass : symbol.warn} Agent ${style.bold(agent.name)} ${decisionStyle(agent.status)}`
-  );
-  out(
-    `  ${environment.gatewayMode === "ENFORCE" ? symbol.pass : symbol.warn} Mode ${decisionStyle(environment.status === "PAUSED" ? "PAUSED" : environment.gatewayMode)}`
-  );
-  if (!gateway.reachable) {
-    out();
-    out(
-      `  ${symbol.fail} ${style.red("The gateway is not reachable, so no action can be permitted.")}`
-    );
-    out(style.grey("    Start it with `npm run dev:gateway`, then re-run `veefore dev`."));
-    out();
-    return 1;
+      message: `${gatewayUrl} \u2014 ${error instanceof Error ? error.message : String(error)}. Start it with \`npm run dev:gateway\`.`
+    });
   }
-  if (environment.gatewayMode === "OBSERVE") {
-    out();
-    out(
-      `  ${symbol.info} ${style.cyan("OBSERVE mode:")} every decision is evaluated and recorded, but nothing is blocked.`
+  try {
+    const identities = await api.get(
+      `/v1/agents/${agentId}/identities`
     );
-    out(style.grey("    This is the safe way to learn what your agent actually does."));
-  }
-  if (agent.isolated) {
-    out();
-    out(`  ${symbol.fail} ${style.red("This agent is isolated by an emergency control.")}`);
+    const active = identities.find((identity) => identity.status === "ACTIVE");
+    checks.push({
+      name: "Agent identity active",
+      status: active ? "pass" : "fail",
+      message: active ? `expires ${active.expiresAt.slice(0, 10)}` : "no ACTIVE identity"
+    });
+  } catch (error) {
+    checks.push({
+      name: "Agent identity active",
+      status: "warn",
+      message: error instanceof Error ? error.message : String(error)
+    });
   }
-  out();
-  out(style.grey("  Watching for decisions. Press Ctrl+C to stop."));
-  out();
-  const existing = await fetchActions(context, { limit: 5, agentId: context.config.agentId });
-  if (existing.length === 0) {
-    out(
-      `  ${symbol.info} No actions recorded yet. Call ${style.bold("agent.act({ tool: \u2026 })")} from your agent to see a decision here.`
+  try {
+    const passport = await api.get(
+      `/v1/passports/${agentId}`
     );
-    out();
-  } else {
-    renderActions(existing, flags.verbose);
-  }
-  return streamActions(context, {
-    agentId: args.includes("--all") ? void 0 : context.config.agentId,
-    seen: new Set(existing.map((action) => action.id)),
-    verbose: true,
-    json: false,
-    coach: true
-  });
-}
-async function fetchActions(context, options) {
-  const response = await context.api.get("/v1/actions", {
-    limit: options.limit ?? 25,
-    decision: options.decision,
-    agent_id: options.agentId,
-    environment_id: context.config.environmentId
-  });
-  return [...response.data].reverse();
-}
-function renderActions(actions, verbose) {
-  if (actions.length === 0) {
-    out(style.grey("  (no decisions yet)"));
-    return;
+    checks.push({
+      name: "Agent passport issued",
+      status: passport ? "pass" : "warn",
+      message: passport ? `version ${passport.version}` : "not issued yet"
+    });
+  } catch {
+    checks.push({ name: "Agent passport issued", status: "warn", message: "could not read" });
   }
-  if (!verbose) {
-    table(
-      [
-        { header: "WHEN", key: "when", width: 12 },
-        { header: "TOOL", key: "tool", width: 24 },
-        { header: "DECISION", key: "decision", width: 20 },
-        { header: "OUTCOME", key: "outcome", width: 24 },
-        { header: "MS", key: "latency", width: 6, align: "right" }
-      ],
-      actions.map((action) => ({
-        when: formatWhen(action.startedAt),
-        tool: action.toolKey ?? action.action,
-        decision: decisionStyle(effectiveDecision(action)),
-        outcome: decisionStyle(action.outcome),
-        latency: String(Math.round(action.latencyMs))
-      }))
+  try {
+    const environment = await api.get(
+      `/v1/environments/${environmentId}`
     );
-    return;
-  }
-  for (const action of actions) renderAction(action);
-}
-function effectiveDecision(action) {
-  return action.shadowDecision ?? action.decision ?? "UNKNOWN";
-}
-function renderAction(action, coach = false) {
-  const decision = effectiveDecision(action);
-  const icon = decision === "ALLOW" ? symbol.pass : decision === "BLOCK" ? symbol.fail : symbol.warn;
-  const amount = action.amount === null ? "" : style.grey(` ${formatAmount(action.amount, action.currency)}`);
-  out(
-    `${icon} ${style.grey(new Date(action.startedAt).toISOString().slice(11, 19))} ${style.bold(action.toolKey ?? action.action)}${amount} ${decisionStyle(decision)} ${style.grey(`(${action.outcome})`)}`
-  );
-  if (action.denyReason) out(`    ${action.denyReason}`);
-  const facts = [];
-  if (action.policyVersionNumber !== null) facts.push(`policy v${action.policyVersionNumber}`);
-  if (action.matchedRuleIds.length > 0)
-    facts.push(`${action.matchedRuleIds.length} rule(s) matched`);
-  if (action.riskLevel) facts.push(`risk ${action.riskLevel}`);
-  if (action.protocol !== "HTTP") facts.push(action.protocol);
-  if (action.gatewayMode !== "ENFORCE") facts.push(`mode ${action.gatewayMode}`);
-  facts.push(`${Math.round(action.latencyMs)}ms`);
-  out(`    ${style.grey(facts.join("  \xB7  "))}`);
-  if (coach) {
-    const hint = coachingFor(action);
-    if (hint) out(`    ${style.cyan("\u2192")} ${style.grey(hint)}`);
+    checks.push({
+      name: "Enforcement mode",
+      status: "pass",
+      message: environment.gatewayMode === "ENFORCE" ? "ENFORCE \u2014 decisions are enforced" : `${environment.gatewayMode} \u2014 decisions are recorded but not enforced`
+    });
+  } catch {
+    checks.push({ name: "Enforcement mode", status: "warn", message: "could not read" });
   }
+  return checks;
 }
-function coachingFor(action) {
-  const decision = effectiveDecision(action);
-  if (action.gatewayMode === "OBSERVE" && decision !== "ALLOW") {
-    return `In ENFORCE mode this would have been ${decision}. Simulate before switching.`;
-  }
-  switch (decision) {
-    case "BLOCK":
-      return action.matchedRuleIds.length > 0 ? "Blocked by a policy rule. Adjust the rule, or grant the capability if this is legitimate." : "Blocked before policy evaluation. Check the tool is registered and the agent is authorized for it.";
-    case "REQUIRE_APPROVAL":
-      return "Call actWithApproval() so your agent waits for the reviewer instead of failing.";
-    case "LIMIT":
-      return "The amount was capped by policy. Read limits.appliedAmount from the decision.";
-    case "MASK":
-      return "Some fields were masked before reaching the tool. Check limits.maskedFields.";
-    case "STEP_UP_AUTH":
-      return "A human must re-authenticate. Agents cannot satisfy step-up on their own.";
-    default:
-      return null;
+function parseInitArgs(args) {
+  const options = { force: false, skipPolicy: false, skipCode: false };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    const next = () => {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("-")) {
+        throw new CliError(`Option ${String(arg)} requires a value.`);
+      }
+      index += 1;
+      return value;
+    };
+    switch (arg) {
+      case "--force":
+        options.force = true;
+        break;
+      case "--skip-policy":
+        options.skipPolicy = true;
+        break;
+      case "--skip-code":
+        options.skipCode = true;
+        break;
+      case "--new-agent":
+        options.newAgent = true;
+        break;
+      case "--control-plane":
+        options.controlPlaneUrl = next();
+        break;
+      case "--gateway":
+        options.gatewayUrl = next();
+        break;
+      case "--organization":
+        options.organizationId = next();
+        break;
+      case "--workspace":
+        options.workspaceId = next();
+        break;
+      case "--environment":
+        options.environmentId = next();
+        break;
+      case "--name":
+        options.agentName = next();
+        break;
+      case "--capability":
+        options.capabilities = [...options.capabilities ?? [], next()];
+        break;
+      case "--approval-mode": {
+        const value = next().toLowerCase();
+        if (value !== "wait" && value !== "throw") {
+          throw new CliError('--approval-mode must be "wait" or "throw".');
+        }
+        options.approvalMode = value;
+        break;
+      }
+      default:
+        if (arg?.startsWith("-")) {
+          throw new CliError(`Unknown option for \`veefore init\`: ${arg}`);
+        }
+    }
   }
+  return options;
 }
-function formatAmount(minorUnits, currency) {
-  const major = (minorUnits / 100).toLocaleString("en-IN", {
-    minimumFractionDigits: 2,
-    maximumFractionDigits: 2
-  });
-  return currency ? `${major} ${currency}` : major;
-}
-async function streamActions(context, options) {
-  let interval = 1e3;
-  let stopped = false;
-  const stop = () => {
-    stopped = true;
-  };
-  process.once("SIGINT", stop);
-  process.once("SIGTERM", stop);
-  let blocked = 0;
-  let approvals = 0;
-  let allowed = 0;
-  while (!stopped) {
-    let fresh = [];
+async function projectHome(existing, flags) {
+  const source = welcomeSource(flags);
+  let last = 0;
+  for (let round = 0; ; round += 1) {
+    await beginScreen(source, { animate: round === 0 });
+    const state = await agentState(existing);
+    printProjectSummary(existing, state);
+    const choices = homeChoices(existing, state, flags);
+    choices.push({ label: "Exit", hint: "esc", run: async () => last, leaves: true });
+    out();
+    let picked;
     try {
-      const recent = await fetchActions(context, {
-        limit: 50,
-        decision: options.decision,
-        agentId: options.agentId
-      });
-      fresh = recent.filter((action) => !options.seen.has(action.id));
-      for (const action of fresh) options.seen.add(action.id);
-    } catch (error) {
-      out(
-        `${symbol.warn} ${style.amber("Lost contact with the control plane;")} ${style.grey(error instanceof Error ? error.message : String(error))}`
+      picked = await select(
+        "What would you like to do?",
+        choices.map((choice) => ({ label: choice.label, hint: choice.hint, value: choice }))
       );
-      interval = Math.min(interval * 2, 15e3);
-      await delay(interval);
-      continue;
+    } catch (error) {
+      if (error instanceof MenuCancelled) return last;
+      throw error;
     }
-    for (const action of fresh) {
-      if (options.json) {
-        out(JSON.stringify(action));
-      } else {
-        renderAction(action, options.coach);
+    if (picked.leaves) {
+      await beginScreen(source, { compact: true });
+      try {
+        return await picked.run();
+      } catch (error) {
+        return error instanceof MenuCancelled ? last : reportError(error, flags);
       }
-      const decision = effectiveDecision(action);
-      if (decision === "BLOCK") blocked += 1;
-      else if (decision === "REQUIRE_APPROVAL") approvals += 1;
-      else allowed += 1;
     }
-    interval = fresh.length > 0 ? 1e3 : Math.min(interval * 1.5, 5e3);
-    await delay(interval);
+    await beginScreen(source, { compact: true });
+    try {
+      last = await picked.run();
+    } catch (error) {
+      last = error instanceof MenuCancelled ? last : reportError(error, flags);
+    }
+    if (!isInteractive()) return last;
+    await pressBack("Back to menu");
+  }
+}
+function printProjectSummary(existing, state) {
+  out();
+  details([
+    ["Agent", `${existing.agentName} (${existing.agentId})`],
+    ["Environment", `${existing.environmentName} (${existing.environmentType})`],
+    [
+      "Status",
+      state.kind === "ok" ? decisionStyle(state.status) : state.kind === "signed-out" ? style.amber("not signed in") : state.kind === "session-ended" ? style.amber("signed out") : state.kind === "missing" ? style.red("agent not found") : style.amber("Veefore not reachable")
+    ]
+  ]);
+  if (state.kind === "session-ended") {
+    out(`${symbol.warn} ${state.message}`);
   }
-  if (!options.json) {
+}
+function homeChoices(existing, state, flags) {
+  const ended = state.kind === "missing" || state.kind === "ok" && ENDED_STATUSES.includes(state.status);
+  if (ended) {
     out();
     out(
-      `  ${style.green(`${allowed} allowed`)}  ${style.amber(`${approvals} needing approval`)}  ${style.red(`${blocked} blocked`)}`
+      `${symbol.warn} ${style.amber(
+        state.kind === "missing" ? "This agent no longer exists in Veefore." : `This agent was ${state.kind === "ok" ? state.status.toLowerCase() : "removed"} in Veefore.`
+      )} Every tool call wrapped in guard() is now refused.`
     );
-    out();
+    return [
+      {
+        label: "Remove Veefore from this project",
+        hint: "take guard() out of the code, disconnect",
+        run: () => removeCommand([], flags, state),
+        leaves: true
+      },
+      {
+        label: "Set it up again with a new agent",
+        hint: "the guarded code keeps working",
+        run: () => initCommand(["--force"], flags),
+        leaves: true
+      }
+    ];
   }
-  return 0;
+  const choices = [];
+  if (state.kind === "signed-out" || state.kind === "session-ended") {
+    choices.push({
+      label: "Sign in",
+      hint: "veefore login",
+      run: async () => {
+        await login(existing.controlPlaneUrl);
+        return 0;
+      }
+    });
+  }
+  choices.push(
+    { label: "Watch decisions live", hint: "veefore dev", run: () => devCommand([], flags) },
+    { label: "Check status", hint: "veefore status", run: () => statusCommand([], flags) },
+    {
+      label: "Protect tools in the code",
+      hint: "veefore integrate",
+      run: () => integrateCommand([], flags)
+    },
+    {
+      label: "Check every tool is guarded",
+      hint: "veefore integrate --check",
+      run: () => integrateCommand(["--check"], flags)
+    },
+    { label: "Test enforcement", hint: "veefore test", run: () => testCommand([], flags) },
+    {
+      label: "Audit the security posture",
+      hint: "veefore doctor",
+      run: () => doctorCommand([], flags)
+    },
+    { label: "Turn on enforcement", hint: "veefore deploy", run: () => deployCommand([], flags) },
+    {
+      label: "Re-run setup for this project",
+      hint: "veefore init --force",
+      run: () => initCommand(["--force"], flags),
+      leaves: true
+    },
+    {
+      label: "Remove Veefore from this project",
+      hint: "veefore remove",
+      run: () => removeCommand([], flags, state),
+      leaves: true
+    }
+  );
+  if (state.kind === "ok" || state.kind === "unreachable") {
+    choices.push({
+      label: "Sign out",
+      hint: "veefore logout",
+      run: async () => {
+        await logout(existing.controlPlaneUrl);
+        return 0;
+      }
+      // Deliberately not `leaves`: signing out comes back to this menu, so the
+      // panel and the status redraw as signed out and the next step on offer
+      // is Sign in. Leaving instead would quit on the one action whose result
+      // a person most wants to see confirmed.
+    });
+  }
+  return choices;
 }
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+
+// src/commands/scan.ts
+async function scanCommand(_args, flags) {
+  const scan = scanProject(process.cwd());
+  if (flags.json) {
+    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
+    return 0;
+  }
+  heading("Veefore scan");
+  out(
+    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
+  );
+  printScan(scan);
+  out();
+  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
+  return 0;
 }
 
 // src/commands/policies.ts
@@ -8172,155 +8825,6 @@ async function diffPolicy(args, flags) {
   return 0;
 }
 
-// src/commands/test.ts
-async function testCommand(args, flags) {
-  const context = await resolveContext(flags);
-  const toolFilter = valueFor(args, "--tool");
-  heading(
-    `Enforcement test \u2014 ${context.config.environmentName} (${context.config.environmentType})`
-  );
-  const results = [];
-  const record = (check, passed, detail) => {
-    results.push({ check, passed, detail });
-    out(`${passed ? symbol.pass : symbol.fail} ${check} ${style.grey(detail)}`);
-  };
-  const gateway = await probeGateway(context.config.gatewayUrl);
-  record(
-    "Gateway reachable",
-    gateway.reachable,
-    gateway.reachable ? `${context.config.gatewayUrl} \u2014 posture ${gateway.posture ?? "unknown"}` : gateway.error ?? "unreachable"
-  );
-  const identities = await context.api.get(`/v1/agents/${context.config.agentId}/identities`).catch(() => []);
-  const activeIdentity = identities.find((identity) => identity.status === "ACTIVE");
-  record(
-    "Agent identity active",
-    Boolean(activeIdentity),
-    activeIdentity ? `generation ${activeIdentity.generation}, expires ${activeIdentity.expiresAt.slice(0, 10)}` : "no ACTIVE identity \u2014 the agent cannot authenticate"
-  );
-  const policies = await context.api.get("/v1/policies", { workspace_id: context.config.workspaceId });
-  const effective = policies.filter(
-    (policy) => policy.status === "ACTIVE" && policy.bindings.length > 0
-  );
-  record(
-    "Active, bound policy exists",
-    effective.length > 0,
-    effective.length > 0 ? effective.map((policy) => policy.name).join(", ") : "no active policy is bound to a scope, so no rule can match"
-  );
-  let caseTotal = 0;
-  let caseFailed = 0;
-  for (const policy of policies) {
-    const result = await context.api.post(`/v1/policies/${policy.id}/tests/run`, {}).catch(() => null);
-    if (!result) continue;
-    caseTotal += result.passed + result.failed;
-    caseFailed += result.failed;
-  }
-  record(
-    "Policy test cases",
-    caseFailed === 0,
-    caseTotal === 0 ? "no test cases recorded \u2014 add cases so rule changes are provable" : `${caseTotal - caseFailed}/${caseTotal} passing`
-  );
-  const tools = await resolveAuthorizedTools(context, toolFilter);
-  if (tools.length === 0) {
-    record(
-      "Authorized tools",
-      false,
-      "this agent is authorized for no tools, so it cannot do anything"
-    );
-  } else {
-    record("Authorized tools", true, tools.map((tool) => tool.key).join(", "));
-  }
-  heading("Decision probe (dry run \u2014 nothing is executed)");
-  const probes = [];
-  for (const tool of tools) {
-    const probeSpinner = spinner(`Evaluating ${tool.key}`);
-    try {
-      const outcome = await context.api.post("/v1/policies/simulate", {
-        agent_id: context.config.agentId,
-        tool: tool.key,
-        capability: tool.requiredCapability,
-        environment_id: context.config.environmentId,
-        parameters: {}
-      });
-      probeSpinner.succeed(`${tool.key} \u2192 ${outcome.decision}`);
-      probes.push({ tool, outcome });
-    } catch (error) {
-      probeSpinner.fail(`${tool.key} could not be evaluated`);
-      probes.push({
-        tool,
-        outcome: null,
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  out();
-  table(
-    [
-      { header: "TOOL", key: "tool", width: 24 },
-      { header: "RISK", key: "risk", width: 18 },
-      { header: "DECISION", key: "decision", width: 20 },
-      { header: "MATCHED RULE", key: "rule", width: 32 }
-    ],
-    probes.map((probe) => ({
-      tool: probe.tool.dangerous ? `${probe.tool.key} ${style.red("(dangerous)")}` : probe.tool.key,
-      risk: decisionStyle(probe.tool.riskLevel),
-      decision: probe.outcome ? decisionStyle(probe.outcome.decision) : style.red("ERROR"),
-      rule: probe.outcome?.matchedRules[0]?.name ?? style.grey(probe.error ?? "default decision")
-    }))
-  );
-  const unguarded = probes.filter(
-    (probe) => probe.tool.dangerous && probe.outcome?.decision === "ALLOW" && probe.outcome.matchedRules.length === 0
-  );
-  out();
-  record(
-    "Dangerous tools are guarded",
-    unguarded.length === 0,
-    unguarded.length === 0 ? "every dangerous tool is either refused or matched by an explicit rule" : `${unguarded.map((probe) => probe.tool.key).join(", ")} allowed by the default decision with no rule`
-  );
-  const errored = probes.filter((probe) => probe.outcome === null);
-  record(
-    "All evaluations completed",
-    errored.length === 0,
-    errored.length === 0 ? `${probes.length} evaluated` : `${errored.length} failed to evaluate`
-  );
-  const impure = probes.filter((probe) => probe.outcome && probe.outcome.sideEffectFree !== true);
-  record(
-    "Simulation was side-effect free",
-    impure.length === 0,
-    impure.length === 0 ? "no action records were written" : "the server reported side effects"
-  );
-  const failed = results.filter((result) => !result.passed);
-  out();
-  out(
-    failed.length === 0 ? `  ${symbol.pass} ${style.green(`${results.length} check(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${failed.length} of ${results.length} check(s) failing.`)}`
-  );
-  if (failed.length > 0) {
-    out();
-    for (const failure of failed) out(`    ${symbol.fail} ${failure.check}: ${failure.detail}`);
-  }
-  out();
-  if (flags.json) printJson({ results, probes });
-  return failed.length > 0 ? 1 : 0;
-}
-async function resolveAuthorizedTools(context, filter) {
-  const tools = await context.api.get("/v1/tools", {
-    workspace_id: context.config.workspaceId,
-    agent_id: context.config.agentId,
-    limit: 100
-  });
-  const candidates = tools.items.filter(
-    (tool) => tool.status !== "DISABLED" && (tool.environmentId === null || tool.environmentId === context.config.environmentId)
-  );
-  if (!filter) return candidates;
-  const match = candidates.filter((tool) => tool.key === filter);
-  if (match.length === 0) {
-    throw new CliError(
-      `Tool "${filter}" is not available to this agent in ${context.config.environmentName}.`,
-      `Available: ${candidates.map((tool) => tool.key).join(", ") || "none"}`
-    );
-  }
-  return match;
-}
-
 // src/help.ts
 var COMMANDS = [
   {
@@ -8600,8 +9104,78 @@ function wrap2(text, width) {
   return lines;
 }
 
+// src/home.ts
+async function homeCommand(args, flags) {
+  const source = welcomeSource(flags);
+  let first = true;
+  for (; ; ) {
+    if (readProjectConfig()) return initCommand(args, flags);
+    await beginScreen(source, { animate: first });
+    first = false;
+    out();
+    out(style.bold("Let's get started."));
+    out();
+    let action;
+    try {
+      action = await select("What would you like to do?", [
+        { label: "Set up this project", hint: "recommended \xB7 veefore init", value: "setup" },
+        {
+          label: "Preview what setup would find",
+          hint: "veefore scan \xB7 changes nothing",
+          value: "scan"
+        },
+        { label: "Sign in", hint: "veefore login", value: "login" },
+        { label: "Show every command", hint: "veefore help", value: "help" },
+        { label: "Exit", hint: "esc", value: "exit" }
+      ]);
+    } catch (error) {
+      if (error instanceof MenuCancelled) return 0;
+      throw error;
+    }
+    if (action === "exit") return 0;
+    if (action === "setup") {
+      await runOnScreen(source, flags, () => initCommand(args, flags), {
+        // Setup done: "Continue", and the next pass opens the project home
+        // with the panel filled in. Otherwise "Back to menu", to read why and
+        // choose again.
+        label: () => readProjectConfig() ? "Continue" : "Back to menu"
+      });
+      continue;
+    }
+    const code = await runOnScreen(source, flags, async () => {
+      switch (action) {
+        case "scan":
+          return scanCommand([], flags);
+        case "login":
+          await login(resolveControlPlaneUrl(flags.controlPlaneUrl));
+          return 0;
+        case "help":
+          printRootHelp(source().version);
+          return 0;
+      }
+      return 0;
+    });
+    if (!isInteractive()) return code;
+  }
+}
+async function initWithWelcome(args, flags) {
+  await beginScreen(welcomeSource(flags), { animate: true });
+  return initCommand(args, flags);
+}
+async function runOnScreen(source, flags, run2, options = {}) {
+  await beginScreen(source, { compact: true });
+  let code = 0;
+  try {
+    code = await run2();
+  } catch (error) {
+    code = error instanceof MenuCancelled ? 0 : reportError(error, flags);
+  }
+  const label = options.label ?? "Back";
+  await pressBack(typeof label === "function" ? label() : label);
+  return code;
+}
+
 // src/index.ts
-var CLI_VERSION = "1.0.0";
 async function run(argv) {
   const { flags, rest } = parseGlobalFlags(argv);
   if (rest.includes("--version") || rest.includes("-V")) {
@@ -8610,9 +9184,9 @@ async function run(argv) {
   }
   const [command, ...args] = rest.filter((arg) => arg !== "--help" && arg !== "-h");
   const wantsHelp = rest.includes("--help") || rest.includes("-h");
-  if (command === void 0 && !wantsHelp && process.stdin.isTTY && process.stdout.isTTY) {
+  if (command === void 0 && !wantsHelp && isInteractive()) {
     try {
-      return await initCommand(args, flags);
+      return flags.json ? await initCommand(args, flags) : await homeCommand(args, flags);
     } catch (error) {
       return handleError(error, flags);
     }
@@ -8632,7 +9206,7 @@ async function run(argv) {
     switch (command) {
       case "init":
       case "setup":
-        return await initCommand(args, flags);
+        return flags.json || !isInteractive() ? await initCommand(args, flags) : await initWithWelcome(args, flags);
       case "scan":
         return await scanCommand(args, flags);
       case "integrate":
@@ -8690,28 +9264,8 @@ async function run(argv) {
   }
 }
 function handleError(error, flags) {
-  if (error instanceof CliError) {
-    err();
-    err(`${style.red("\u2717")} ${error.message}`);
-    if (error.hint) err(style.grey(`  ${error.hint}`));
-    err();
-    return error.exitCode;
-  }
-  if (error instanceof CliApiError) {
-    err();
-    reportApiError(error);
-    err();
-    return 1;
-  }
-  err();
-  err(`${style.red("\u2717")} ${error instanceof Error ? error.message : String(error)}`);
-  if (flags.verbose && error instanceof Error && error.stack) {
-    err(style.grey(error.stack));
-  } else {
-    err(style.grey("  Re-run with --verbose for the stack trace."));
-  }
-  err();
-  return 1;
+  if (error instanceof MenuCancelled) return error.exitCode;
+  return reportError(error, flags);
 }
 function parseGlobalFlags(argv) {
   const flags = { json: false, yes: false, verbose: false };