veefore 1.2.0 → 1.4.0

package/dist/veefore.mjs

@@ -236,29 +236,29 @@ var ApiClient = class {
   setToken(token) {
     this.token = token;
   }
-  async get(path12, query = {}) {
+  async get(path13, query = {}) {
     const search = new URLSearchParams();
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) search.set(key, String(value));
     }
     const suffix = search.toString() === "" ? "" : `?${search.toString()}`;
-    return this.send("GET", `${path12}${suffix}`);
+    return this.send("GET", `${path13}${suffix}`);
   }
-  async post(path12, body) {
-    return this.send("POST", path12, body);
+  async post(path13, body) {
+    return this.send("POST", path13, body);
   }
-  async patch(path12, body) {
-    return this.send("PATCH", path12, body);
+  async patch(path13, body) {
+    return this.send("PATCH", path13, body);
   }
-  async delete(path12) {
-    return this.send("DELETE", path12);
+  async delete(path13) {
+    return this.send("DELETE", path13);
   }
   /** Raw request for endpoints that return a non-JSON body (exports). */
-  async raw(method, path12, body) {
-    return this.fetchWithTimeout(method, path12, body);
+  async raw(method, path13, body) {
+    return this.fetchWithTimeout(method, path13, body);
   }
-  async send(method, path12, body) {
-    const response = await this.fetchWithTimeout(method, path12, body);
+  async send(method, path13, body) {
+    const response = await this.fetchWithTimeout(method, path13, body);
     const text = await response.text();
     const parsed = parseJson(text);
     if (response.ok) {
@@ -266,14 +266,14 @@ var ApiClient = class {
       if (parsed && "data" in parsed) return parsed.data;
       throw new CliApiError(
         "UNEXPECTED_RESPONSE",
-        `The control plane returned an unexpected body for ${method} ${path12}.`,
+        `The control plane returned an unexpected body for ${method} ${path13}.`,
         response.status,
         response.headers.get("x-request-id")
       );
     }
     const error = new CliApiError(
       parsed?.error?.code ?? `HTTP_${response.status}`,
-      parsed?.error?.message ?? `${method} ${path12} failed with ${response.status} ${response.statusText}.`,
+      parsed?.error?.message ?? `${method} ${path13} failed with ${response.status} ${response.statusText}.`,
       response.status,
       parsed?.error?.request_id ?? response.headers.get("x-request-id"),
       parsed?.error?.details ?? {}
@@ -291,7 +291,7 @@ var ApiClient = class {
     }
     throw error;
   }
-  async fetchWithTimeout(method, path12, body) {
+  async fetchWithTimeout(method, path13, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = { accept: "application/json" };
@@ -300,7 +300,7 @@ var ApiClient = class {
     if (this.workspaceId) headers["x-veefore-workspace"] = this.workspaceId;
     if (this.environmentId) headers["x-veefore-environment"] = this.environmentId;
     try {
-      return await fetch(`${this.controlPlaneUrl}${path12}`, {
+      return await fetch(`${this.controlPlaneUrl}${path13}`, {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body),
@@ -568,6 +568,8 @@ function sleep(ms) {
 import { createInterface } from "node:readline/promises";
 
 // src/tui.ts
+import { statSync } from "node:fs";
+import path2 from "node:path";
 import { emitKeypressEvents } from "node:readline";
 
 // src/logo.ts
@@ -584,6 +586,16 @@ var LOGO = [
   "        \u2588\u2588     \u2588\u2588   \u2588\u2588",
   "         \u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588"
 ];
+var LOGO_SMALL = [
+  "\u2580\u2588\u2580\u2580\u2580\u2580\u2580\u2580\u2588    \u2588\u2580\u2580\u2580\u2580\u2580\u2580\u2588\u2580",
+  " \u2580\u2584  \u2584\u2584 \u2580\u2588  \u2588\u2580 \u2584\u2584  \u2584\u2588",
+  "  \u2588\u2584  \u2588    \u2588\u2580  \u2588  \u2584\u2588",
+  "   \u2588\u2584  \u2588  \u2588\u2580  \u2588  \u2584\u2588",
+  "    \u2588  \u2580\u2588\u2584\u2580  \u2588\u2580  \u2588",
+  "     \u2588  \u2580\u2588  \u2588\u2580  \u2588",
+  "     \u2580\u2588    \u2584\u2580  \u2588\u2580",
+  "      \u2580\u2588\u2584\u2584\u2588\u2588  \u2588\u2580"
+];
 
 // src/tui.ts
 function isInteractive() {
@@ -612,8 +624,8 @@ var BRAND_TOP = [150, 172, 236];
 var BRAND_BOTTOM = [84, 108, 186];
 var BRAND = [118, 140, 214];
 var brand = (text) => paint(BRAND, text);
-function gradient(row, rows) {
-  const t = rows <= 1 ? 0 : row / (rows - 1);
+function gradient(row, rows2) {
+  const t = rows2 <= 1 ? 0 : row / (rows2 - 1);
   const mix = (a, b) => Math.round(a + (b - a) * t);
   return [
     mix(BRAND_TOP[0], BRAND_BOTTOM[0]),
@@ -628,6 +640,9 @@ function visibleLength(text) {
 function columns() {
   return process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
 }
+function rows() {
+  return process.stdout.rows && process.stdout.rows > 0 ? process.stdout.rows : 24;
+}
 var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var STARS = [
   [0, -3, "*"],
@@ -640,8 +655,20 @@ var STARS = [
 ];
 async function showWelcome(context, options = {}) {
   if (!isInteractive()) return;
+  const lines = welcomeLines(context, options.reserve ?? 0);
+  if ((options.animate ?? true) && process.env.VEEFORE_NO_ANIMATION === void 0) {
+    for (const line of lines) {
+      out(line);
+      await sleep2(14);
+    }
+    return;
+  }
+  for (const line of lines) out(line);
+}
+function welcomeLines(context, reserve) {
   const width = Math.min(columns(), 100);
-  const logoWidth = Math.max(...LOGO.map((line) => [...line].length));
+  const art = rows() >= LOGO.length + 6 + reserve ? LOGO : LOGO_SMALL;
+  const logoWidth = Math.max(...art.map((line) => [...line].length));
   const indent = 5;
   const gap = 6;
   const panelWidth = Math.max(
@@ -649,43 +676,45 @@ async function showWelcome(context, options = {}) {
     ...context.facts.map(([label, value]) => label.length + 2 + value.length)
   );
   const sideBySide = width >= indent + logoWidth + gap + panelWidth + 2;
-  const showLogo = width >= indent + logoWidth + 2;
-  const rule = style.grey("\xB7".repeat(Math.max(10, Math.min(width - 2, 72))));
-  const animate = (options.animate ?? true) && process.env.VEEFORE_NO_ANIMATION === void 0;
-  out();
-  out(` ${brand(style.bold("Welcome to Veefore"))} ${style.grey(`v${context.version}`)}`);
-  out(` ${rule}`);
-  out();
   const panel = renderPanel(context.facts);
+  const showLogo = width >= indent + logoWidth + 2 && (sideBySide || rows() >= art.length + 6 + panel.length + 2 + reserve);
+  const rule = style.grey("\xB7".repeat(Math.max(10, Math.min(width - 2, 72))));
+  const lines = [];
+  const add = (line = "") => void lines.push(line);
+  add();
+  add(` ${brand(style.bold("Welcome to Veefore"))} ${style.grey(`v${context.version}`)}`);
+  add(` ${rule}`);
+  add();
   if (showLogo) {
-    for (let row = 0; row < LOGO.length; row += 1) {
-      const line = LOGO[row] ?? "";
-      const left = starsFor(row, indent, (column) => column < 0, -indent);
-      const right = starsFor(row, 0, (column) => column >= logoWidth, logoWidth);
-      const art = paint(gradient(row, LOGO.length), line.padEnd(logoWidth));
-      let text = `${left}${art}`;
+    for (let row = 0; row < art.length; row += 1) {
+      const line = art[row] ?? "";
+      const left = starsFor(row, indent, (column) => column < 0, -indent, art.length);
+      const right = starsFor(row, 0, (column) => column >= logoWidth, logoWidth, art.length);
+      const painted = paint(gradient(row, art.length), line.padEnd(logoWidth));
+      let text = `${left}${painted}`;
       if (sideBySide) {
-        const top = Math.max(0, Math.floor((LOGO.length - panel.length) / 2));
+        const top = Math.max(0, Math.floor((art.length - panel.length) / 2));
         const side = panel[row - top];
         text += side === void 0 ? right : `${" ".repeat(gap)}${side}`;
       } else {
         text += right;
       }
-      out(text.replace(/\s+$/, ""));
-      if (animate) await sleep2(14);
+      add(text.replace(/\s+$/, ""));
     }
   }
   if (!sideBySide) {
-    out();
-    for (const line of panel) out(fit(`   ${line}`, width - 1));
+    add();
+    for (const line of panel) add(fit(`   ${line}`, width - 1));
   }
-  out();
-  out(` ${rule}`);
+  add();
+  add(` ${rule}`);
+  return lines;
 }
-function starsFor(row, width, inBand, offset) {
+function starsFor(row, width, inBand, offset, artRows) {
   const cells = Array.from({ length: Math.max(width, 6) }, () => " ");
   for (const [starRow, column, glyph] of STARS) {
-    if (starRow !== row || !inBand(column)) continue;
+    const scaled = Math.round(starRow * (artRows - 1) / (LOGO.length - 1));
+    if (scaled !== row || !inBand(column)) continue;
     const index = column - offset;
     if (index >= 0 && index < cells.length) cells[index] = style.grey(glyph);
   }
@@ -708,6 +737,41 @@ function clearScreen() {
   if (!isInteractive()) return;
   process.stdout.write("\x1B[H\x1B[2J");
 }
+var appDepth = 0;
+var restoreInstalled = false;
+function enterApp() {
+  if (!isInteractive()) return;
+  appDepth += 1;
+  if (appDepth > 1) return;
+  if (!restoreInstalled) {
+    restoreInstalled = true;
+    process.on("exit", () => {
+      if (appDepth > 0) process.stdout.write("\x1B[?25h\x1B[?1049l");
+    });
+  }
+  process.stdout.write("\x1B[?1049h\x1B[H\x1B[2J");
+}
+function leaveApp() {
+  if (!isInteractive() || appDepth === 0) return;
+  appDepth -= 1;
+  if (appDepth > 0) return;
+  process.stdout.write("\x1B[?25h\x1B[?1049l");
+}
+async function onOrdinaryScreen(body) {
+  const depth = appDepth;
+  if (depth > 0) {
+    appDepth = 0;
+    process.stdout.write("\x1B[?25h\x1B[?1049l");
+  }
+  try {
+    return await body();
+  } finally {
+    if (depth > 0) {
+      appDepth = depth;
+      process.stdout.write("\x1B[?1049h\x1B[H\x1B[2J");
+    }
+  }
+}
 function compactHeader(context) {
   const facts = Object.fromEntries(context.facts);
   const parts = [
@@ -722,11 +786,101 @@ function compactHeader(context) {
 async function beginScreen(source, options = {}) {
   if (!isInteractive()) return;
   clearScreen();
-  if (options.compact) compactHeader(source());
-  else await showWelcome(source(), { animate: options.animate ?? false });
+  const reserve = options.reserve ?? 0;
+  if (options.compact || rows() < LOGO_SMALL.length + 6 + reserve) compactHeader(source());
+  else await showWelcome(source(), { animate: options.animate ?? false, reserve });
+}
+function drawScreen(source, options = {}) {
+  if (!isInteractive()) return;
+  clearScreen();
+  const reserve = options.reserve ?? 0;
+  const context = source();
+  if (options.compact || rows() < LOGO_SMALL.length + 6 + reserve) compactHeader(context);
+  else for (const line of welcomeLines(context, reserve)) out(line);
+}
+async function showOutput(lines, options) {
+  if (!isInteractive()) {
+    for (const line of lines) process.stdout.write(`${line}
+`);
+    return;
+  }
+  const stdout = process.stdout;
+  const stdin = process.stdin;
+  const body = lines.length > 0 ? lines : [style.grey("  (no output)")];
+  let headerRows = 0;
+  const measure = () => {
+    let count = 0;
+    const original = stdout.write.bind(stdout);
+    stdout.write = ((chunk) => {
+      count += String(chunk).split("\n").length - 1;
+      return true;
+    });
+    try {
+      options.drawHeader();
+    } finally {
+      stdout.write = original;
+    }
+    headerRows = count;
+  };
+  measure();
+  let top = 0;
+  const viewport = () => Math.max(3, rows() - headerRows - 2);
+  const draw = () => {
+    const height = viewport();
+    const maxTop = Math.max(0, body.length - height);
+    top = Math.min(Math.max(0, top), maxTop);
+    clearScreen();
+    options.drawHeader();
+    for (const line of body.slice(top, top + height)) {
+      stdout.write(`${fit(line, columns() - 1)}
+`);
+    }
+    const hidden = body.length > height;
+    const position = hidden ? `${Math.min(top + height, body.length)}/${body.length}` : `${body.length} line${body.length === 1 ? "" : "s"}`;
+    const keys = hidden ? "\u2191\u2193 scroll \xB7 " : "";
+    stdout.write(
+      `${brand("\u2190")} ${style.bold(options.label ?? "Back")} ${style.grey(`\xB7 ${keys}enter or esc \xB7 ${position}`)}`
+    );
+  };
+  await new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+    const done = () => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      process.stdout.off("resize", onResize);
+      stdout.write("\r\x1B[K");
+      resolve();
+    };
+    const onResize = () => {
+      measure();
+      draw();
+    };
+    const onKey = (input, key = {}) => {
+      const height = viewport();
+      if (key.name === "return" || key.name === "enter" || key.name === "escape" || key.name === "left" || input === "b" || key.ctrl && key.name === "c") {
+        return done();
+      }
+      if (key.name === "down" || input === "j") top += 1;
+      else if (key.name === "up" || input === "k") top -= 1;
+      else if (key.name === "pagedown" || input === " ") top += height;
+      else if (key.name === "pageup") top -= height;
+      else if (input === "G") top = body.length;
+      else if (input === "g") top = 0;
+      else return;
+      draw();
+    };
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("keypress", onKey);
+    process.stdout.on("resize", onResize);
+    draw();
+  });
 }
 async function pressBack(label = "Back") {
   if (!isInteractive()) return;
+  flushCapture();
   const stdin = process.stdin;
   const stdout = process.stdout;
   out();
@@ -751,6 +905,29 @@ async function pressBack(label = "Back") {
     stdin.on("keypress", onKey);
   });
 }
+function watchFacts(onChange) {
+  const files = [
+    CREDENTIALS_FILE,
+    findProjectConfig() ?? path2.join(process.cwd(), PROJECT_CONFIG_FILE)
+  ];
+  const signature = () => files.map((file) => {
+    try {
+      const stats = statSync(file);
+      return `${stats.mtimeMs}:${stats.size}`;
+    } catch {
+      return "absent";
+    }
+  }).join("|");
+  let last = signature();
+  const timer = setInterval(() => {
+    const now = signature();
+    if (now === last) return;
+    last = now;
+    onChange();
+  }, 500);
+  timer.unref();
+  return () => clearInterval(timer);
+}
 var BACK = /* @__PURE__ */ Symbol("veefore.back");
 var MenuCancelled = class extends CliError {
   constructor() {
@@ -765,6 +942,7 @@ async function select(question, real, settings = {}) {
   const choosable = enabled.filter((index) => options[index]?.value !== BACK);
   const fallback = choosable.includes(settings.initial ?? -1) ? settings.initial : choosable[0] ?? enabled[0];
   if (!isInteractive()) return options[fallback].value;
+  flushCapture();
   let cursor = fallback;
   let rendered = 0;
   const stdin = process.stdin;
@@ -794,6 +972,13 @@ async function select(question, real, settings = {}) {
 `);
     rendered = lines.length;
   };
+  const repaint = () => {
+    if (!settings.redraw) return;
+    clearScreen();
+    settings.redraw();
+    rendered = 0;
+    draw();
+  };
   const move = (direction) => {
     const position = enabled.indexOf(cursor);
     const next = (position + direction + enabled.length) % enabled.length;
@@ -804,10 +989,12 @@ async function select(question, real, settings = {}) {
     const restoreCursor = () => {
       stdout.write("\x1B[?25h");
     };
+    const stopWatching = settings.redraw ? watchFacts(repaint) : void 0;
     const finish = (result) => {
       stdin.off("keypress", onKey);
       stdin.setRawMode(wasRaw);
       stdin.pause();
+      stopWatching?.();
       process.off("exit", restoreCursor);
       if (rendered > 0) stdout.write(`\x1B[${rendered}A\r\x1B[J`);
       restoreCursor();
@@ -912,11 +1099,38 @@ var symbol = {
   info: style.cyan("\u203A"),
   bullet: style.grey("\u2022")
 };
+var captured = null;
+function beginCapture() {
+  captured = [];
+}
+function endCapture() {
+  const lines = captured ?? [];
+  captured = null;
+  return lines;
+}
+function flushCapture() {
+  if (captured === null) return;
+  const lines = captured;
+  captured = null;
+  for (const line of lines) process.stdout.write(`${line}
+`);
+}
+function isCapturing() {
+  return captured !== null;
+}
 function out(line = "") {
+  if (captured !== null) {
+    captured.push(line);
+    return;
+  }
   process.stdout.write(`${line}
 `);
 }
 function err(line = "") {
+  if (captured !== null) {
+    captured.push(line);
+    return;
+  }
   process.stderr.write(`${line}
 `);
 }
@@ -925,15 +1139,15 @@ function heading(text) {
   out(style.bold(text));
   out(style.grey("\u2500".repeat(Math.min(text.length, 72))));
 }
-function table(columns2, rows) {
-  if (rows.length === 0) {
+function table(columns2, rows2) {
+  if (rows2.length === 0) {
     out(style.grey("  (none)"));
     return;
   }
   const widths = columns2.map((column) => {
     const longest = Math.max(
       column.header.length,
-      ...rows.map((row) => (row[column.key] ?? "").length)
+      ...rows2.map((row) => (row[column.key] ?? "").length)
     );
     return Math.min(column.width ?? longest, longest);
   });
@@ -949,7 +1163,7 @@ function table(columns2, rows) {
     columns2.map((column) => column.header),
     style.grey
   );
-  for (const row of rows) {
+  for (const row of rows2) {
     renderRow(
       columns2.map((column) => row[column.key] ?? ""),
       (text) => text
@@ -966,6 +1180,7 @@ function keyValue(label, value) {
   out(`  ${style.grey(`${label}:`)} ${value}`);
 }
 async function ask(question, fallback = "") {
+  flushCapture();
   if (!process.stdin.isTTY) return fallback;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
@@ -976,6 +1191,7 @@ async function ask(question, fallback = "") {
   }
 }
 async function askSecret(question) {
+  flushCapture();
   if (!process.stdin.isTTY) {
     throw new Error(
       "A secret is required but the terminal is not interactive. Provide it through the documented environment variable instead."
@@ -1018,6 +1234,7 @@ async function askSecret(question) {
   });
 }
 async function confirm(question, options = {}) {
+  flushCapture();
   if (options.yes) {
     out(`${question} ${style.grey("[y/N]")} ${style.amber("y (--yes)")}`);
     return true;
@@ -1040,6 +1257,12 @@ async function confirm(question, options = {}) {
   return ["y", "yes"].includes(answer.toLowerCase());
 }
 function spinner(label) {
+  if (isCapturing()) {
+    return {
+      succeed: (text) => out(`${symbol.pass} ${text ?? label}`),
+      fail: (text) => out(`${symbol.fail} ${text ?? label}`)
+    };
+  }
   if (!process.stdout.isTTY) {
     out(`${symbol.info} ${label}`);
     return {
@@ -1163,6 +1386,7 @@ async function resolveContext(flags) {
   };
 }
 async function login(controlPlaneUrl, options = {}) {
+  flushCapture();
   await assertControlPlane(controlPlaneUrl);
   const ciCredentials = Boolean(process.env.VEEFORE_EMAIL && process.env.VEEFORE_PASSWORD);
   if (options.method === "password" || options.method === void 0 && ciCredentials) {
@@ -1739,11 +1963,11 @@ function renderRevokeConfirmation(agent, environment, preview) {
   out(`  ${style.red("This action is irreversible for this identity.")}`);
   out();
 }
-async function lifecycle(args, flags, path12, resultingStatus) {
+async function lifecycle(args, flags, path13, resultingStatus) {
   const context = await resolveContext(flags);
   const agentId = positional(args) ?? context.config.agentId;
   const agent = await context.api.get(`/v1/agents/${agentId}`);
-  const reasonRequired = path12 === "suspend";
+  const reasonRequired = path13 === "suspend";
   const reason = valueFor(args, "--reason");
   if (reasonRequired && (!reason || reason.trim().length < 10)) {
     throw new CliError(
@@ -1753,24 +1977,24 @@ async function lifecycle(args, flags, path12, resultingStatus) {
   }
   out();
   out(
-    `${symbol.info} ${path12} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
+    `${symbol.info} ${path13} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
   );
-  if (path12 !== "resume") {
+  if (path13 !== "resume") {
     const confirmed = await confirm("Continue?", { yes: flags.yes });
     if (!confirmed) {
       out(style.grey("Cancelled."));
       return 1;
     }
   }
-  const actionSpinner = spinner(`Applying ${path12}`);
+  const actionSpinner = spinner(`Applying ${path13}`);
   try {
     await withStepUp(
       context.api,
-      () => context.api.post(`/v1/agents/${agentId}/${path12}`, reason ? { reason } : {})
+      () => context.api.post(`/v1/agents/${agentId}/${path13}`, reason ? { reason } : {})
     );
     actionSpinner.succeed(`${agent.name} is ${resultingStatus}`);
   } catch (error) {
-    actionSpinner.fail(`Could not ${path12} the agent`);
+    actionSpinner.fail(`Could not ${path13} the agent`);
     throw error;
   }
   out();
@@ -2074,13 +2298,13 @@ async function exportEvents(args, flags) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import path4 from "node:path";
 
 // src/project-checks.ts
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 var MIN_APPROVAL_WAIT_SDK = "1.1.0";
 function versionLessThan(a, b) {
   if (!a) return true;
@@ -2097,19 +2321,19 @@ function versionLessThan(a, b) {
 function installedSdks(root, options = {}) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
-  const top = path2.resolve(root);
+  const top = path3.resolve(root);
   const candidates = /* @__PURE__ */ new Set([top]);
   for (const dir of options.dirs ?? []) {
-    let current = path2.resolve(top, dir);
+    let current = path3.resolve(top, dir);
     while (current.startsWith(top)) {
       candidates.add(current);
-      const parent = path2.dirname(current);
+      const parent = path3.dirname(current);
       if (parent === current) break;
       current = parent;
     }
   }
   for (const dir of candidates) {
-    const manifest = path2.join(dir, "node_modules", "@veefore", "sdk", "package.json");
+    const manifest = path3.join(dir, "node_modules", "@veefore", "sdk", "package.json");
     if (!existsSync2(manifest)) continue;
     let real = manifest;
     try {
@@ -2126,7 +2350,7 @@ function installedSdks(root, options = {}) {
     }
     found.push({
       language: "js",
-      location: path2.relative(top, path2.dirname(manifest)) || ".",
+      location: path3.relative(top, path3.dirname(manifest)) || ".",
       version,
       waitsForApproval: !versionLessThan(version, MIN_APPROVAL_WAIT_SDK)
     });
@@ -2158,7 +2382,7 @@ function upgradeCommand(root, language) {
 }
 function configuredApprovalMode(root) {
   for (const name of [".env.local", ".env"]) {
-    const file = path2.join(root, name);
+    const file = path3.join(root, name);
     if (!existsSync2(file)) continue;
     const match = /^\s*(?:export\s+)?VEEFORE_APPROVAL_MODE\s*=\s*["']?(\w+)["']?/m.exec(
       readFileSync2(file, "utf8")
@@ -2168,7 +2392,7 @@ function configuredApprovalMode(root) {
   return null;
 }
 function sdkInstalled(root, language) {
-  if (language === "js") return existsSync2(path2.join(root, "node_modules", "@veefore", "sdk"));
+  if (language === "js") return existsSync2(path3.join(root, "node_modules", "@veefore", "sdk"));
   const python = projectPython(root);
   if (!python) return false;
   return spawnSync(python, ["-c", "import veefore"], { cwd: root, stdio: "ignore", timeout: 2e4 }).status === 0;
@@ -2177,18 +2401,18 @@ function typecheck(root, files) {
   const name = "TypeScript typecheck";
   const projects = files ? [
     ...new Set(
-      files.filter((file) => /\.(m|c)?tsx?$/.test(file)).map((file) => nearestUp(root, path2.dirname(path2.join(root, file)), "tsconfig.json")).filter((dir) => dir !== null)
+      files.filter((file) => /\.(m|c)?tsx?$/.test(file)).map((file) => nearestUp(root, path3.dirname(path3.join(root, file)), "tsconfig.json")).filter((dir) => dir !== null)
     )
-  ] : existsSync2(path2.join(root, "tsconfig.json")) ? [root] : [];
+  ] : existsSync2(path3.join(root, "tsconfig.json")) ? [root] : [];
   if (projects.length === 0) return { name, ran: false, ok: true, detail: "no tsconfig.json" };
   const binary = process.platform === "win32" ? "tsc.cmd" : "tsc";
   for (const project of projects) {
-    const bin = nearestUp(root, project, path2.join("node_modules", ".bin", binary));
+    const bin = nearestUp(root, project, path3.join("node_modules", ".bin", binary));
     if (!bin) {
       return { name, ran: false, ok: true, detail: "TypeScript is not installed in this project" };
     }
     const result = spawnSync(
-      path2.join(bin, "node_modules", ".bin", binary),
+      path3.join(bin, "node_modules", ".bin", binary),
       ["--noEmit", "-p", "."],
       {
         cwd: project,
@@ -2198,7 +2422,7 @@ function typecheck(root, files) {
     );
     if (result.status !== 0) {
       const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-      const where = path2.relative(root, project) || ".";
+      const where = path3.relative(root, project) || ".";
       return {
         name,
         ran: true,
@@ -2211,12 +2435,12 @@ ${output.split("\n").slice(0, 12).join("\n")}`
   return { name, ran: true, ok: true, detail: "" };
 }
 function nearestUp(root, start, entry) {
-  const top = path2.resolve(root);
-  let dir = path2.resolve(start);
+  const top = path3.resolve(root);
+  let dir = path3.resolve(start);
   for (; ; ) {
-    if (existsSync2(path2.join(dir, entry))) return dir;
+    if (existsSync2(path3.join(dir, entry))) return dir;
     if (dir === top) return null;
-    const parent = path2.dirname(dir);
+    const parent = path3.dirname(dir);
     if (parent === dir || !parent.startsWith(top)) return null;
     dir = parent;
   }
@@ -2270,20 +2494,20 @@ function pythonSyntax(root, files) {
 }
 function projectPython(root) {
   for (const candidate of [".venv/bin/python", "venv/bin/python", ".venv/Scripts/python.exe"]) {
-    if (existsSync2(path2.join(root, candidate))) return path2.join(root, candidate);
+    if (existsSync2(path3.join(root, candidate))) return path3.join(root, candidate);
   }
   const probe = spawnSync("python3", ["--version"], { stdio: "ignore" });
   return probe.status === 0 ? "python3" : null;
 }
 function installCommand(root, language) {
   if (language === "py") {
-    if (existsSync2(path2.join(root, "uv.lock"))) return "uv add veefore-py";
-    if (existsSync2(path2.join(root, "poetry.lock"))) return "poetry add veefore-py";
+    if (existsSync2(path3.join(root, "uv.lock"))) return "uv add veefore-py";
+    if (existsSync2(path3.join(root, "poetry.lock"))) return "poetry add veefore-py";
     return "pip install veefore-py";
   }
-  if (existsSync2(path2.join(root, "pnpm-lock.yaml"))) return "pnpm add @veefore/sdk";
-  if (existsSync2(path2.join(root, "yarn.lock"))) return "yarn add @veefore/sdk";
-  if (existsSync2(path2.join(root, "bun.lockb")) || existsSync2(path2.join(root, "bun.lock"))) {
+  if (existsSync2(path3.join(root, "pnpm-lock.yaml"))) return "pnpm add @veefore/sdk";
+  if (existsSync2(path3.join(root, "yarn.lock"))) return "yarn add @veefore/sdk";
+  if (existsSync2(path3.join(root, "bun.lockb")) || existsSync2(path3.join(root, "bun.lock"))) {
     return "bun add @veefore/sdk";
   }
   return "npm install @veefore/sdk";
@@ -2403,8 +2627,8 @@ async function checkTransportSecurity(config, add) {
 }
 function checkLocalSecrets(config, add) {
   const configFile = findProjectConfig();
-  const projectDir = configFile ? path3.dirname(configFile) : process.cwd();
-  const envFile = path3.join(projectDir, ".env.local");
+  const projectDir = configFile ? path4.dirname(configFile) : process.cwd();
+  const envFile = path4.join(projectDir, ".env.local");
   if (!existsSync3(envFile)) {
     add({
       check: "Local agent credentials",
@@ -2414,7 +2638,7 @@ function checkLocalSecrets(config, add) {
     });
     return;
   }
-  const mode = statSync(envFile).mode & 511;
+  const mode = statSync2(envFile).mode & 511;
   if ((mode & 63) !== 0) {
     add({
       check: "Local agent credentials",
@@ -2429,7 +2653,7 @@ function checkLocalSecrets(config, add) {
       message: `.env.local is mode ${mode.toString(8)} (owner only).`
     });
   }
-  const gitignore = path3.join(projectDir, ".gitignore");
+  const gitignore = path4.join(projectDir, ".gitignore");
   const ignored = existsSync3(gitignore) && readFileSync3(gitignore, "utf8").split(/\r?\n/).some((line) => line.trim() === ".env.local" || line.trim() === "*.local");
   add({
     check: "Secrets excluded from version control",
@@ -2757,8 +2981,8 @@ async function checkCredentialRotation(api, add) {
 }
 async function checkDependencies(add, dir) {
   const configFile = findProjectConfig();
-  const projectDir = dir ?? (configFile ? path3.dirname(configFile) : process.cwd());
-  const manifest = path3.join(projectDir, "package.json");
+  const projectDir = dir ?? (configFile ? path4.dirname(configFile) : process.cwd());
+  const manifest = path4.join(projectDir, "package.json");
   if (!existsSync3(manifest)) {
     add({
       check: "SDK dependency",
@@ -2800,9 +3024,9 @@ async function checkDependencies(add, dir) {
 }
 function checkApprovalWaiting(add, projectDir) {
   const configFile = findProjectConfig();
-  const dir = projectDir ?? (configFile ? path3.dirname(configFile) : process.cwd());
+  const dir = projectDir ?? (configFile ? path4.dirname(configFile) : process.cwd());
   const python = ["pyproject.toml", "requirements.txt", "setup.py"].some(
-    (name) => existsSync3(path3.join(dir, name))
+    (name) => existsSync3(path4.join(dir, name))
   );
   const sdks = installedSdks(dir, { python });
   const old = sdks.filter((sdk) => !sdk.waitsForApproval);
@@ -3094,11 +3318,11 @@ function isLoosening(from, to) {
 
 // src/commands/init.ts
 import { readFileSync as readFileSync9 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 
 // src/integrate.ts
 import { readFileSync as readFileSync8 } from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // ../types/src/permissions.ts
 var PERMISSIONS = [
@@ -4368,21 +4592,21 @@ import {
   readdirSync,
   renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import path4 from "node:path";
-var BACKUP_DIR = path4.join(".veefore", "backups");
+import path5 from "node:path";
+var BACKUP_DIR = path5.join(".veefore", "backups");
 function sha256(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function createBackup(root, changes) {
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const id = createdAt.replace(/[:.]/g, "-");
-  const dir = path4.join(root, BACKUP_DIR, id);
+  const dir = path5.join(root, BACKUP_DIR, id);
   for (const change of changes) {
-    const target = path4.join(dir, "files", change.file);
-    mkdirSync2(path4.dirname(target), { recursive: true });
+    const target = path5.join(dir, "files", change.file);
+    mkdirSync2(path5.dirname(target), { recursive: true });
     writeFileSync3(target, change.before, { mode: 384 });
   }
   const files = changes.map((change) => ({
@@ -4391,7 +4615,7 @@ function createBackup(root, changes) {
     afterSha256: sha256(change.after)
   }));
   writeFileSync3(
-    path4.join(dir, "manifest.json"),
+    path5.join(dir, "manifest.json"),
     `${JSON.stringify({ version: 1, createdAt, files }, null, 2)}
 `,
     { mode: 384 }
@@ -4399,28 +4623,28 @@ function createBackup(root, changes) {
   return { id, dir, createdAt, files };
 }
 function writeFilePreservingMode(file, content) {
-  const mode = existsSync4(file) ? statSync2(file).mode & 511 : 420;
+  const mode = existsSync4(file) ? statSync3(file).mode & 511 : 420;
   const temp = `${file}.veefore-tmp-${process.pid}`;
   writeFileSync3(temp, content, { mode });
   renameSync2(temp, file);
 }
 function latestBackup(root) {
-  const base2 = path4.join(root, BACKUP_DIR);
+  const base2 = path5.join(root, BACKUP_DIR);
   if (!existsSync4(base2)) return null;
-  const ids = readdirSync(base2).filter((entry) => existsSync4(path4.join(base2, entry, "manifest.json"))).sort();
+  const ids = readdirSync(base2).filter((entry) => existsSync4(path5.join(base2, entry, "manifest.json"))).sort();
   const id = ids[ids.length - 1];
   if (!id) return null;
-  const dir = path4.join(base2, id);
-  const manifest = JSON.parse(readFileSync4(path4.join(dir, "manifest.json"), "utf8"));
+  const dir = path5.join(base2, id);
+  const manifest = JSON.parse(readFileSync4(path5.join(dir, "manifest.json"), "utf8"));
   return { id, dir, createdAt: manifest.createdAt, files: manifest.files };
 }
 function restoreBackup(root, backup, options = {}) {
   const restored = [];
   const conflicts = [];
   for (const entry of backup.files) {
-    const target = path4.join(root, entry.file);
+    const target = path5.join(root, entry.file);
     const current = existsSync4(target) ? readFileSync4(target, "utf8") : null;
-    const original = readFileSync4(path4.join(backup.dir, "files", entry.file), "utf8");
+    const original = readFileSync4(path5.join(backup.dir, "files", entry.file), "utf8");
     if (current !== null && sha256(current) === entry.beforeSha256) {
       restored.push(entry.file);
       continue;
@@ -4440,15 +4664,15 @@ function restoreBackup(root, backup, options = {}) {
 
 // src/rewrite.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/scan.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
-import path6 from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import path7 from "node:path";
 
 // src/framework.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync2 } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 var SIGNATURES = [
   {
     key: "langchain",
@@ -4530,8 +4754,8 @@ function detectFramework(dir = process.cwd()) {
       };
     }
   }
-  if (nodeDeps.size > 0 || existsSync5(path5.join(dir, "package.json"))) {
-    const typescript = existsSync5(path5.join(dir, "tsconfig.json")) || nodeDeps.has("typescript");
+  if (nodeDeps.size > 0 || existsSync5(path6.join(dir, "package.json"))) {
+    const typescript = existsSync5(path6.join(dir, "tsconfig.json")) || nodeDeps.has("typescript");
     return {
       key: "custom",
       name: "Custom agent",
@@ -4553,7 +4777,7 @@ function normalize(name) {
   return name.toLowerCase().replace(/_/g, "-");
 }
 function readPackageJsonDependencies(dir) {
-  const file = path5.join(dir, "package.json");
+  const file = path6.join(dir, "package.json");
   if (!existsSync5(file)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync5(file, "utf8"));
@@ -4570,12 +4794,12 @@ function readPackageJsonDependencies(dir) {
 }
 function hasPythonProject(dir) {
   return ["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].some(
-    (file) => existsSync5(path5.join(dir, file))
+    (file) => existsSync5(path6.join(dir, file))
   );
 }
 function readPythonDependencies(dir) {
   const found = /* @__PURE__ */ new Set();
-  const requirements = path5.join(dir, "requirements.txt");
+  const requirements = path6.join(dir, "requirements.txt");
   if (existsSync5(requirements)) {
     for (const line of readFileSync5(requirements, "utf8").split(/\r?\n/)) {
       const trimmed = line.trim();
@@ -4584,7 +4808,7 @@ function readPythonDependencies(dir) {
       if (name) found.add(normalize(name));
     }
   }
-  const pyproject = path5.join(dir, "pyproject.toml");
+  const pyproject = path6.join(dir, "pyproject.toml");
   if (existsSync5(pyproject)) {
     const text = readFileSync5(pyproject, "utf8");
     for (const match of text.matchAll(
@@ -4616,7 +4840,7 @@ function findEntryPoints(dir = process.cwd(), limit = 5) {
     "app.py",
     "src/main.py"
   ];
-  const found = candidates.filter((file) => existsSync5(path5.join(dir, file)));
+  const found = candidates.filter((file) => existsSync5(path6.join(dir, file)));
   if (found.length > 0) return found.slice(0, limit);
   try {
     return readdirSync2(dir).filter((file) => /\.(ts|js|py)$/.test(file)).slice(0, limit);
@@ -4720,7 +4944,7 @@ function scanProject(root = process.cwd()) {
   for (const relative of files) {
     let text;
     try {
-      text = readFileSync6(path6.join(root, relative), "utf8");
+      text = readFileSync6(path7.join(root, relative), "utf8");
     } catch {
       continue;
     }
@@ -5219,10 +5443,10 @@ function walk(root, dir, out2) {
     if (entry.startsWith(".") && entry !== ".") {
       continue;
     }
-    const full = path6.join(dir, entry);
+    const full = path7.join(dir, entry);
     let stats;
     try {
-      stats = statSync3(full);
+      stats = statSync4(full);
     } catch {
       continue;
     }
@@ -5232,14 +5456,14 @@ function walk(root, dir, out2) {
       continue;
     }
     if (!stats.isFile() || stats.size > MAX_FILE_BYTES) continue;
-    if (!SOURCE_EXTENSIONS.has(path6.extname(entry))) continue;
+    if (!SOURCE_EXTENSIONS.has(path7.extname(entry))) continue;
     if (/\.(test|spec)\.[cm]?[jt]sx?$|^test_.*\.py$|_test\.py$|\.d\.ts$/.test(entry)) continue;
-    out2.push(path6.relative(root, full));
+    out2.push(path7.relative(root, full));
   }
   return false;
 }
 function readProjectName(root) {
-  const pkg = path6.join(root, "package.json");
+  const pkg = path7.join(root, "package.json");
   if (existsSync6(pkg)) {
     try {
       const name = JSON.parse(readFileSync6(pkg, "utf8")).name;
@@ -5247,12 +5471,12 @@ function readProjectName(root) {
     } catch {
     }
   }
-  const pyproject = path6.join(root, "pyproject.toml");
+  const pyproject = path7.join(root, "pyproject.toml");
   if (existsSync6(pyproject)) {
     const name = /^\s*name\s*=\s*["']([^"']+)["']/m.exec(readFileSync6(pyproject, "utf8"))?.[1];
     if (name) return name.trim();
   }
-  return path6.basename(root) || null;
+  return path7.basename(root) || null;
 }
 function stringField(body, field) {
   const match = new RegExp(`\\b${field}\\s*:\\s*(['"\`])([^]{1,300}?)\\1`).exec(body);
@@ -5307,7 +5531,7 @@ function planRewrite(root, files, toolKeys) {
   for (const file of files) {
     let before;
     try {
-      before = readFileSync7(path7.join(root, file), "utf8");
+      before = readFileSync7(path8.join(root, file), "utf8");
     } catch {
       continue;
     }
@@ -6297,13 +6521,13 @@ async function integrate(root, toolKeys, options) {
     toWrite.map((file) => file.file)
   ) : null;
   for (const file of toWrite) {
-    if (readFileSync8(path8.join(root, file.file), "utf8") !== file.before) {
+    if (readFileSync8(path9.join(root, file.file), "utf8") !== file.before) {
       out(`${symbol.fail} ${file.file} changed while setup was running. Nothing was written.`);
       return { status: "declined", plan, checks: [], backupId: null, manual };
     }
   }
   const backup = createBackup(root, toWrite);
-  for (const file of toWrite) writeFilePreservingMode(path8.join(root, file.file), file.after);
+  for (const file of toWrite) writeFilePreservingMode(path9.join(root, file.file), file.after);
   out(
     `${symbol.pass} Updated ${toWrite.length} file${toWrite.length === 1 ? "" : "s"} ${style.grey(`(backup ${backup.id})`)}`
   );
@@ -6374,7 +6598,7 @@ async function integrate(root, toolKeys, options) {
 function reportSdkReadiness(root, files) {
   const problems = [];
   if (files.length === 0) return problems;
-  const dirs = [...new Set(files.map((file) => path8.dirname(file)))];
+  const dirs = [...new Set(files.map((file) => path9.dirname(file)))];
   const python = files.some((file) => file.endsWith(".py"));
   const sdks = installedSdks(root, { dirs, python });
   for (const sdk of sdks) {
@@ -6451,7 +6675,7 @@ async function removeGuards(root, options) {
   const tsFiles = changed.filter((file) => /\.(m|c)?tsx?$/.test(file));
   const baseline = tsFiles.length > 0 ? typecheck(root, tsFiles) : null;
   const backup = createBackup(root, toWrite);
-  for (const entry of toWrite) writeFilePreservingMode(path8.join(root, entry.file), entry.after);
+  for (const entry of toWrite) writeFilePreservingMode(path9.join(root, entry.file), entry.after);
   const checks = [];
   const py = changed.filter((file) => file.endsWith(".py"));
   if (py.length > 0) checks.push(pythonSyntax(root, py));
@@ -6475,7 +6699,7 @@ function currentText(root, plan, file) {
   const entry = plan.files.find((candidate) => candidate.file === file);
   if (entry) return entry.after;
   try {
-    return readFileSync8(path8.join(root, file), "utf8");
+    return readFileSync8(path9.join(root, file), "utf8");
   } catch {
     return null;
   }
@@ -6500,7 +6724,7 @@ function applyDispatch(root, plan, file, after, line, items, via) {
 function readSources(root) {
   return listSourceFiles(root).flatMap((file) => {
     try {
-      return [{ file, text: readFileSync8(path8.join(root, file), "utf8") }];
+      return [{ file, text: readFileSync8(path9.join(root, file), "utf8") }];
     } catch {
       return [];
     }
@@ -6622,7 +6846,7 @@ function printPlan(plan) {
 
 // src/commands/remove.ts
 import { rmSync as rmSync3 } from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // src/discover.ts
 var LOCAL_CANDIDATE_PORTS = [4e3, 4400, 4100, 4200, 4300, 4500, 8e3, 8080, 3e3];
@@ -6736,7 +6960,7 @@ async function removeCommand(args, flags, known) {
   if (!file || !config) {
     throw new CliError("This project is not connected to Veefore.", "There is nothing to remove.");
   }
-  const root = path9.dirname(file);
+  const root = path10.dirname(file);
   const state = known ?? await agentState(config);
   heading("Remove Veefore from this project");
   details([
@@ -7270,10 +7494,10 @@ async function resolveAuthorizedTools(context, filter) {
 
 // src/panel.ts
 import { homedir as homedir2 } from "node:os";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/version.ts
-var CLI_VERSION = "1.2.0";
+var CLI_VERSION = "1.4.0";
 
 // src/panel.ts
 function welcomeSource(flags = {}) {
@@ -7297,7 +7521,7 @@ function welcomeSource(flags = {}) {
 }
 function tilde(dir) {
   const home = homedir2();
-  return dir === home || dir.startsWith(`${home}${path10.sep}`) ? `~${dir.slice(home.length)}` : dir;
+  return dir === home || dir.startsWith(`${home}${path11.sep}`) ? `~${dir.slice(home.length)}` : dir;
 }
 function hostOf(url) {
   try {
@@ -7637,317 +7861,738 @@ function sourceLabel(source) {
   }
 }
 
-// src/commands/init.ts
-var DEFAULT_GATEWAY = "http://localhost:4010";
-async function initCommand(args, flags) {
-  const options = parseInitArgs(args);
-  const existing = readProjectConfig();
-  if (existing && !options.force && isInteractive() && !flags.json) {
-    return projectHome(existing, flags);
-  }
-  if (existing && !options.force) {
-    out();
-    out(`${symbol.warn} This project is already connected to Veefore.`);
-    details([
-      ["Agent", `${existing.agentName} (${existing.agentId})`],
-      ["Environment", `${existing.environmentName} (${existing.environmentType})`],
-      ["Control plane", existing.controlPlaneUrl]
-    ]);
-    out();
-    out(style.grey("Re-run with --force to replace the configuration, or use `veefore status`."));
+// src/commands/scan.ts
+async function scanCommand(_args, flags) {
+  const scan = scanProject(process.cwd());
+  if (flags.json) {
+    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
     return 0;
   }
-  heading("Veefore init");
-  const framework = detectFramework();
+  heading("Veefore scan");
   out(
-    `${symbol.pass} Framework: ${style.bold(framework.name)} ${style.grey(`(${framework.language}, matched ${framework.evidence})`)}`
+    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
   );
-  if (framework.key === "unknown") {
-    out(
-      style.grey(
-        "  No manifest was found. Veefore will still work; the integration snippet defaults to TypeScript."
-      )
-    );
-  }
-  const found = await locateControlPlane(options.controlPlaneUrl ?? flags.controlPlaneUrl);
-  const controlPlaneUrl = found.controlPlaneUrl;
-  if (found.source !== "entered") {
-    out(
-      `${symbol.pass} Veefore: ${style.bold(controlPlaneUrl)} ${style.grey(`(${found.source})`)}`
-    );
-  }
-  let session = loadSession(controlPlaneUrl);
-  if (!session) {
-    await login(controlPlaneUrl);
-    session = loadSession(controlPlaneUrl);
-  }
-  if (!session) throw new CliError("Sign-in did not produce a usable session.");
-  const api = new ApiClient({ controlPlaneUrl, token: session.token });
-  let me = await api.get("/v1/auth/session");
-  const STEPS = ["organization", "workspace", "environment"];
-  const asked = /* @__PURE__ */ new Map();
-  let organization;
-  let workspace;
-  let environment;
-  for (let at = 0; at < STEPS.length; ) {
-    const step = STEPS[at];
-    const answer = step === "organization" ? await selectOrganization(api, me, options, flags) : step === "workspace" ? await selectWorkspace(api, me, options, flags) : await selectEnvironment(api, me, workspace.id, options, flags);
-    if (answer === BACK) {
-      let previous = at - 1;
-      while (previous >= 0 && !asked.get(STEPS[previous])) previous -= 1;
-      if (previous < 0) {
-        throw new MenuCancelled();
-      }
-      at = previous;
-      continue;
-    }
-    asked.set(step, answer.asked);
-    if (step === "organization") {
-      organization = answer.value;
-      if (answer.asked) me = await api.get("/v1/auth/session");
-    } else if (step === "workspace") {
-      workspace = answer.value;
-    } else {
-      environment = answer.value;
-    }
-    at += 1;
-  }
-  heading("Looking at your project");
-  const scan = scanProject(process.cwd());
   printScan(scan);
-  const plan = buildPlan(scan, {
-    agentName: options.agentName,
-    extraCapabilities: options.capabilities
-  });
-  for (; ; ) {
-    if (!options.agentName && !flags.yes) {
-      const name = await askAgentName(plan.agentName);
-      if (name === BACK) {
-        const again = await selectEnvironment(api, me, workspace.id, options, flags);
-        if (again !== BACK) environment = again.value;
-        continue;
-      }
-      plan.agentName = name;
-    }
-    printPlan2(plan, environment);
-    out();
-    const proceed = await confirm("Set this up?", { yes: flags.yes });
-    if (proceed) break;
-    if (flags.yes || options.agentName) {
-      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
-      return 1;
-    }
-    const next = await select(
-      "What would you like to do?",
+  out();
+  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
+  return 0;
+}
+
+// src/help.ts
+var COMMANDS = [
+  {
+    name: "init",
+    summary: "Set up this project with Veefore. Also runs as plain `veefore`.",
+    usage: "veefore init [options]",
+    description: "Connects to hosted Veefore, or to the self-hosted Veefore named with --control-plane (remembered afterwards), signs you in through the browser, scans the project locally (framework, tools, the hosts they call, the credentials they read \u2014 names only, never values), shows what it will set up and asks once. It then creates an agent with a key pair generated on this machine, registers each tool with its own capability and authorizes it for this agent, adds a starter policy in OBSERVE mode, writes veefore.config.json and .env.local, and validates the connection. The private key is written to .env.local only and is never sent, printed or recoverable.",
+    options: [
+      ["--force", "Replace an existing veefore.config.json."],
       [
-        { label: "Change the agent name", value: "name" },
-        { label: "Choose a different environment", value: "environment" },
-        { label: "Leave setup", value: "leave" }
+        "--new-agent",
+        "Create a separate agent even if one with this name exists. By default the existing agent is reused with a new key, so its delegations and limits keep applying."
       ],
-      { initial: 0 }
-    );
-    if (next === "leave") {
-      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
-      return 1;
-    }
-    if (next === "environment") {
-      const again = await selectEnvironment(api, me, workspace.id, options, flags);
-      if (again !== BACK) environment = again.value;
-    }
-  }
-  heading("Setting up");
-  let created;
-  try {
-    created = await applyPlan(
-      api,
-      plan,
-      {
-        workspaceId: workspace.id,
-        environmentId: environment.id,
-        framework: framework.key === "unknown" ? null : framework.key
-      },
-      void 0,
-      { newAgent: options.newAgent === true }
-    );
-  } catch (error) {
-    if (error instanceof CliApiError && error.code === "PERMISSION_DENIED") {
-      throw new CliError(
-        "Your role cannot set up agents in this workspace.",
-        'Ask an owner or admin for the "agent:create" and "tool:create" permissions.'
-      );
-    }
-    throw error;
-  }
-  let gatewayUrl = options.gatewayUrl ?? flags.gatewayUrl ?? process.env.VEEFORE_GATEWAY_URL;
-  if (!gatewayUrl) {
-    const published = (await controlPlaneInfo(controlPlaneUrl)).gatewayUrl;
-    if (published && await gatewayReachable(published)) {
-      gatewayUrl = published;
-      out(
-        `${symbol.pass} Gateway: ${style.bold(published)} ${style.grey("(published by the control plane)")}`
-      );
-    } else {
-      const suggestion = published ?? DEFAULT_GATEWAY;
-      out(
-        `${symbol.warn} ${published ? `The gateway at ${published} is not answering.` : "The control plane did not publish a gateway address."}`
-      );
-      gatewayUrl = await ask(`Gateway URL ${style.grey(`[${suggestion}]`)}:`, suggestion);
-    }
+      ["--control-plane <url>", "Self-hosted Veefore address. Needed once; remembered after."],
+      ["--gateway <url>", "Gateway base URL that agents will call."],
+      ["--organization <id>", "Skip the organization prompt."],
+      ["--workspace <id>", "Skip the workspace prompt."],
+      ["--environment <id>", "Skip the environment prompt."],
+      ["--name <name>", "Agent display name."],
+      ["--capability <key>", "Grant a capability. Repeatable."],
+      ["--skip-policy", "Do not create a starter policy."],
+      ["--skip-code", "Do not offer to change your code; run `veefore integrate` later."],
+      [
+        "--approval-mode <wait|throw>",
+        "When approval is required, guarded tools wait for the decision (default) or return at once."
+      ]
+    ],
+    examples: ["veefore init", "veefore init --name finance-agent --capability refund.create"]
+  },
+  {
+    name: "scan",
+    summary: "Preview what setup would find, without changing anything.",
+    usage: "veefore scan [--json]",
+    description: "Scans the project locally and lists its framework, tools, the external hosts each tool calls and the credentials the code reads. Reads source files only: .env files and other hidden files are never opened, and secret values are never read. Needs no sign-in.",
+    options: [["--json", "Machine-readable scan and the setup plan it implies."]]
+  },
+  {
+    name: "integrate",
+    summary: "Wrap your registered tools in guard() so Veefore decides every call.",
+    usage: "veefore integrate [--dry-run] [--check] [--assist=manual|own|veefore|off] [--yes]",
+    description: "Finds each tool registered for this agent in your code and wraps its function in guard() (TypeScript/JavaScript) or adds @guard above it (Python). Your function bodies are not edited. Shows a diff and asks before writing, backs up every file it changes, then runs your TypeScript compiler (--noEmit), node --check or a Python syntax check; if a check newly fails, every file is restored automatically. For tools it will not change on its own, you choose: make the change yourself from exact instructions, use AI with your own Anthropic or OpenAI key (code goes only to that provider), or use Veefore AI if enabled. Before anything is sent, secrets are replaced with placeholders and you see what goes where and must agree; an AI change is accepted only if it keeps every line of your code and adds nothing but the guard, and you still review the diff.",
+    options: [
+      ["--dry-run", "Show the diff and write nothing."],
+      ["--check", "Report which registered tools are guarded in the code. Exits 1 if any are not."],
+      ["--assist=<how>", "manual (default when not interactive), own, veefore, or off."],
+      ["--yes", "Apply without asking."]
+    ],
+    examples: [
+      "veefore integrate --dry-run",
+      "veefore integrate --assist=manual",
+      "ANTHROPIC_API_KEY=\u2026 veefore integrate --assist=own",
+      "veefore integrate --check"
+    ]
+  },
+  {
+    name: "undo",
+    summary: "Restore the files the last `veefore integrate` changed.",
+    usage: "veefore undo [--force]",
+    description: "Restores each file from the backup taken before the last rewrite. A file you edited afterwards is left alone and listed, unless --force is given.",
+    options: [["--force", "Restore files even if they were edited after the rewrite."]]
+  },
+  {
+    name: "remove",
+    summary: "Take Veefore out of this project: guard() from the code, then disconnect.",
+    usage: "veefore remove [--dry-run] [--keep-agent]",
+    description: "Offers to revoke the agent in Veefore if it is still active, removes every guard() this CLI added (showing the diff, asking once, backing up and rolling back if your checks fail), then deletes veefore.config.json and the Veefore block in .env.local, including the private key. Edits you made after setup are kept. `veefore` offers this automatically when the agent was revoked in the console.",
+    options: [
+      ["--dry-run", "Show what would change and write nothing."],
+      ["--keep-agent", "Do not offer to revoke the agent in Veefore."]
+    ],
+    examples: ["veefore remove --dry-run", "veefore remove"]
+  },
+  {
+    name: "dev",
+    summary: "Watch decisions live while you build.",
+    usage: "veefore dev [--all]",
+    description: "Confirms the gateway is reachable, reports the enforcement mode, then streams every decision for this agent with the next concrete step for each outcome.",
+    options: [["--all", "Stream decisions for every agent in the environment."]]
+  },
+  {
+    name: "doctor",
+    summary: "Audit the security posture of this setup.",
+    usage: "veefore doctor [--strict]",
+    description: "Checks authentication, MFA, TLS, local secret permissions, identity and passport validity, gateway health, dangerous tools, network restrictions, policy coverage, production data access, MCP transport and authorization, audit chain integrity, credential rotation, and SDK version alignment.",
+    options: [["--strict", "Exit non-zero on warnings as well as failures."]]
+  },
+  {
+    name: "status",
+    summary: "Show the current environment, mode and agent health.",
+    usage: "veefore status",
+    description: "Prints the active organization, workspace and environment, the enforcement mode, the agent lifecycle state, gateway health, and the last few decisions."
+  },
+  {
+    name: "test",
+    summary: "Verify enforcement works, without performing any action.",
+    usage: "veefore test [--tool <key>]",
+    description: "Runs a dry-run probe across every tool this agent is authorized for, checks that policy test cases pass, and fails if a dangerous tool is permitted only by the default decision. Suitable as a CI gate.",
+    options: [["--tool <key>", "Probe a single tool."]]
+  },
+  {
+    name: "agents",
+    summary: "Inspect and control the agent fleet.",
+    usage: "veefore agents <list|show|pause|resume|suspend|revoke|rotate-key> [agentId]",
+    description: "Lifecycle control. `revoke` is irreversible for the identity and shows the full blast radius before asking for confirmation. `rotate-key` issues a new key pair and invalidates every outstanding session for that agent.",
+    options: [
+      ["--all", "List across the whole organization, not just this environment."],
+      ["--status <status>", "Filter by lifecycle status."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."]
+    ],
+    examples: [
+      "veefore agents list",
+      'veefore agents revoke agt_01ABC --reason "Key suspected compromised"'
+    ]
+  },
+  {
+    name: "policies",
+    summary: "List, test and deploy policies.",
+    usage: "veefore policies <list|show|test|deploy|diff> [policyId]",
+    description: "`test` runs the recorded test cases. `deploy` activates a version and refuses to do so while any test case fails; it requires a reason and step-up authentication.",
+    options: [
+      ["--version <n>", "Version to deploy, for `deploy`."],
+      ["--from <n> --to <n>", "Versions to compare, for `diff`."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."]
+    ],
+    examples: [
+      "veefore policies list",
+      "veefore policies test",
+      "veefore policies deploy pol_01ABC"
+    ]
+  },
+  {
+    name: "logs",
+    summary: "Read or stream the decision log.",
+    usage: "veefore logs [--follow] [--decision <d>] [--limit <n>]",
+    description: "Every line is a server-side decision with the policy and rule that produced it.",
+    options: [
+      ["--follow, -f", "Stream new decisions as they happen."],
+      ["--decision <d>", "Filter by decision, e.g. BLOCK."],
+      ["--agent <id>", "Filter by agent."],
+      ["--all", "Include every agent in the environment."],
+      ["--limit <n>", "Number of recent decisions to show."]
+    ]
+  },
+  {
+    name: "audit",
+    summary: "Query, verify and export the audit trail.",
+    usage: "veefore audit <list|show|verify|export> [eventId]",
+    description: "`verify` re-checks the hash chain and exits non-zero if it is broken. `export` returns a JSON or CSV file together with a content hash an auditor can use to prove the file is unaltered.",
+    options: [
+      ["--severity <s>", "Filter by severity."],
+      ["--type <t>", "Filter by event type."],
+      ["--from <iso> --to <iso>", "Time range."],
+      ["--format <json|csv>", "Export format."],
+      ['--reason "<text>"', "Why this export is being taken. Recorded in the audit trail."],
+      ["--out <file>", "Write the export to a file (mode 0600)."]
+    ],
+    examples: [
+      "veefore audit verify",
+      'veefore audit export --format csv --reason "Quarterly SOC 2 evidence" --out audit.csv'
+    ]
+  },
+  {
+    name: "deploy",
+    summary: "Promote the environment to enforcement.",
+    usage: "veefore deploy [--mode ENFORCE|SIMULATE|OBSERVE]",
+    description: "Runs preflight checks, replays recent observed traffic to show exactly what starts being refused, then requires confirmation, a reason and step-up authentication. Reducing enforcement always requires a reason and is recorded as a CRITICAL audit event.",
+    options: [
+      ["--mode <mode>", "Target mode. Defaults to ENFORCE."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."],
+      ["--skip-preflight", "Incident use only. Recorded in the audit reason."]
+    ]
+  },
+  {
+    name: "login",
+    summary: "Sign in through your browser and store a session token.",
+    usage: "veefore login [--device] [--password] [--control-plane <url>]",
+    description: "Opens the console in your browser, where you sign in (or create an account) and approve this terminal. The terminal never sees your password. Over SSH, or with --device, it prints a link and a code to enter in any browser instead. Only the resulting session token is stored, in ~/.veefore/credentials.json at mode 0600, and the session can be revoked from your profile. In CI, set VEEFORE_EMAIL and VEEFORE_PASSWORD.",
+    options: [
+      ["--device", "Show a link and a code instead of opening a browser here."],
+      ["--password", "Type email and password in the terminal instead of using the browser."]
+    ]
+  },
+  {
+    name: "logout",
+    summary: "Sign out of Veefore on this machine.",
+    usage: "veefore logout [--all]",
+    description: 'Ends the session on the server and deletes the stored token. Signing out of the console with "Also sign out of the Veefore CLI" ticked does the same for every terminal you approved; the next command here then says you were signed out and asks you to sign in again.',
+    options: [["--all", "Sign out of every control plane this machine is signed in to."]]
   }
-  gatewayUrl = normalizeUrl(gatewayUrl);
-  const config = {
-    version: 1,
-    controlPlaneUrl,
-    gatewayUrl,
-    organizationId: organization.id,
-    organizationName: organization.name,
-    workspaceId: workspace.id,
-    workspaceName: workspace.name,
-    environmentId: environment.id,
-    environmentName: environment.name,
-    environmentType: environment.type,
-    agentId: created.agentId,
-    agentName: created.agentName,
-    keyId: created.keyId,
-    framework: framework.key === "unknown" ? null : framework.key,
-    declaredTools: created.tools.map((tool) => tool.key),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const configFile = writeProjectConfig(config);
+];
+var GLOBAL_OPTIONS = [
+  ["--json", "Machine-readable output."],
+  ["--yes, -y", "Assume yes for confirmations. Never skips step-up authentication."],
+  ["--verbose", "Expanded output."],
+  [
+    "--control-plane <url>",
+    "Use this Veefore instead of the one found automatically (hosted, or the last you signed in to)."
+  ],
+  ["--gateway <url>", "Override the configured gateway URL."],
+  ["--version, -V", "Print the CLI version."],
+  ["--help, -h", "Show help."]
+];
+function printRootHelp(version) {
+  out();
   out(
-    `${symbol.pass} Wrote ${style.bold("veefore.config.json")} ${style.grey("(safe to commit)")}`
+    `${style.bold("veefore")} ${style.grey(version)} \u2014 identity, authority and policy for AI agents`
   );
-  const audience = await discoverAudience(gatewayUrl);
-  ensureGitignore(process.cwd(), [".env.local", ".veefore/"]);
-  const approvalMode = options.approvalMode ?? previousApprovalMode() ?? "wait";
-  const envFile = writeLocalEnv({
-    VEEFORE_GATEWAY_URL: gatewayUrl,
-    VEEFORE_GATEWAY_AUDIENCE: audience,
-    VEEFORE_AGENT_ID: created.agentId,
-    VEEFORE_AGENT_KEY_ID: created.keyId,
-    VEEFORE_AGENT_PRIVATE_KEY: created.privateKey,
-    ...created.tools.length > 0 ? { VEEFORE_DECLARED_TOOLS: created.tools.map((tool) => tool.key).join(",") } : {},
-    // Written explicitly so the behaviour is visible and editable in one place.
-    VEEFORE_APPROVAL_MODE: approvalMode
-  });
-  if (audience !== gatewayUrl) {
-    out(
-      `${symbol.info} Gateway audience is ${style.bold(audience)} ${style.grey(
-        `(it reports this, rather than the ${gatewayUrl} you dialled)`
-      )}`
-    );
+  out();
+  out(style.bold("USAGE"));
+  out("  veefore <command> [options]");
+  out();
+  out(style.bold("COMMANDS"));
+  const width = Math.max(...COMMANDS.map((command) => command.name.length));
+  for (const command of COMMANDS) {
+    out(`  ${style.cyan(command.name.padEnd(width))}  ${command.summary}`);
   }
-  out(
-    `${symbol.pass} Wrote agent credentials to ${style.bold(".env.local")} ${style.grey("(mode 0600, gitignored)")}`
-  );
   out();
+  out(style.bold("GLOBAL OPTIONS"));
+  renderOptions(GLOBAL_OPTIONS);
+  out();
+  out(style.bold("GETTING STARTED"));
   out(
-    `  ${style.amber("The private key was generated here and written to that file only.")} Veefore`
+    `  ${style.grey("1.")} veefore          ${style.grey("sign in, scan, set up and protect this project")}`
   );
   out(
-    `  never received it and cannot recover it. Move it into your secret manager before deploying.`
+    `  ${style.grey("2.")} veefore dev      ${style.grey("watch what your agent actually does")}`
   );
-  out(`  ${style.grey(`Fingerprint: ${created.fingerprint}`)}`);
-  await configureStarterPolicy(api, workspace.id, flags, options);
-  let integrated = false;
-  if (created.tools.length > 0 && !options.skipCode) {
-    const outcome = await integrate(
-      process.cwd(),
-      created.tools.map((tool) => tool.key),
-      { yes: flags.yes, quiet: flags.json, api }
-    );
-    integrated = outcome.status === "applied" || outcome.status === "nothing-to-do";
-  }
-  heading("Validating the connection");
-  const checks = await validateConnection(api, gatewayUrl, created.agentId, environment.id);
-  for (const check of checks) {
-    const icon = check.status === "pass" ? symbol.pass : check.status === "warn" ? symbol.warn : symbol.fail;
-    out(`${icon} ${check.name}${check.message ? style.grey(` \u2014 ${check.message}`) : ""}`);
+  out(`  ${style.grey("3.")} veefore doctor   ${style.grey("check the security posture")}`);
+  out(`  ${style.grey("4.")} veefore deploy   ${style.grey("turn enforcement on")}`);
+  out();
+  out(style.grey("  Run `veefore <command> --help` for detail on any command."));
+  out();
+}
+function printCommandHelp(name) {
+  const command = COMMANDS.find((entry) => entry.name === name);
+  if (!command) return false;
+  out();
+  out(`${style.bold(`veefore ${command.name}`)} \u2014 ${command.summary}`);
+  out();
+  out(style.bold("USAGE"));
+  out(`  ${command.usage}`);
+  out();
+  out(style.bold("DESCRIPTION"));
+  for (const line of wrap2(command.description, 76)) out(`  ${line}`);
+  if (command.options && command.options.length > 0) {
+    out();
+    out(style.bold("OPTIONS"));
+    renderOptions(command.options);
   }
-  const failed = checks.filter((check) => check.status === "fail");
-  if (!integrated) {
-    heading("Protect each tool");
+  if (command.examples && command.examples.length > 0) {
     out();
-    for (const line of integrationSnippet(framework).split("\n")) {
-      out(`  ${style.cyan(line)}`);
+    out(style.bold("EXAMPLES"));
+    for (const example of command.examples) out(`  ${style.grey("$")} ${example}`);
+  }
+  out();
+  return true;
+}
+function renderOptions(options) {
+  const width = Math.max(...options.map(([flag]) => flag.length));
+  for (const [flag, description] of options) {
+    out(`  ${style.cyan(flag.padEnd(width))}  ${description}`);
+  }
+}
+function wrap2(text, width) {
+  const words2 = text.split(/\s+/);
+  const lines = [];
+  let current = "";
+  for (const word of words2) {
+    if (current.length + word.length + 1 > width) {
+      lines.push(current);
+      current = word;
+    } else {
+      current = current === "" ? word : `${current} ${word}`;
     }
-    const entryPoints = findEntryPoints();
-    if (entryPoints.length > 0) {
+  }
+  if (current !== "") lines.push(current);
+  return lines;
+}
+
+// src/home.ts
+async function homeCommand(args, flags) {
+  enterApp();
+  try {
+    return await homeLoop(args, flags);
+  } finally {
+    leaveApp();
+  }
+}
+async function homeLoop(args, flags) {
+  const source = welcomeSource(flags);
+  let first = true;
+  for (; ; ) {
+    if (readProjectConfig()) return initCommand(args, flags);
+    const body = () => {
+      drawScreen(source, { reserve: 11 });
       out();
-      out(
-        style.grey(
-          `  Likely entry point${entryPoints.length > 1 ? "s" : ""}: ${entryPoints.join(", ")}`
-        )
+      out(style.bold("Let's get started."));
+      out();
+    };
+    await beginScreen(source, { animate: first, reserve: 11 });
+    first = false;
+    out();
+    out(style.bold("Let's get started."));
+    out();
+    let action;
+    try {
+      action = await select(
+        "What would you like to do?",
+        [
+          { label: "Set up this project", hint: "recommended \xB7 veefore init", value: "setup" },
+          {
+            label: "Preview what setup would find",
+            hint: "veefore scan \xB7 changes nothing",
+            value: "scan"
+          },
+          { label: "Sign in", hint: "veefore login", value: "login" },
+          { label: "Show every command", hint: "veefore help", value: "help" },
+          { label: "Exit", hint: "esc", value: "exit" }
+        ],
+        { redraw: body }
       );
+    } catch (error) {
+      if (error instanceof MenuCancelled) return 0;
+      throw error;
     }
-    if (created.tools.length > 0) {
-      out(style.grey("  Or let Veefore wrap your tools for you: `veefore integrate`."));
+    if (action === "exit") return 0;
+    if (action === "setup") {
+      await runOnScreen(source, flags, () => initCommand(args, flags), {
+        // Setup done: "Continue", and the next pass opens the project home
+        // with the panel filled in. Otherwise "Back to menu", to read why and
+        // choose again.
+        label: () => readProjectConfig() ? "Continue" : "Back to menu"
+      });
+      continue;
     }
+    const code = await runOnScreen(source, flags, async () => {
+      switch (action) {
+        case "scan":
+          return scanCommand([], flags);
+        case "login":
+          await login(resolveControlPlaneUrl(flags.controlPlaneUrl));
+          return 0;
+        case "help":
+          printRootHelp(source().version);
+          return 0;
+      }
+      return 0;
+    });
+    if (!isInteractive()) return code;
   }
-  heading("When a human must approve");
-  for (const line of approvalModeExplanation(approvalMode)) out(line);
-  heading("Next");
-  out(`  ${symbol.bullet} ${style.bold("veefore dev")}     watch decisions live while you build`);
-  out(
-    `  ${symbol.bullet} ${style.bold("veefore doctor")}  check the security posture of this setup`
-  );
-  out(`  ${symbol.bullet} ${style.bold("veefore status")}  see the current mode and agent health`);
-  out();
+}
+async function initWithWelcome(args, flags) {
+  await beginScreen(welcomeSource(flags), { animate: true });
+  return initCommand(args, flags);
+}
+async function runOnScreen(source, flags, run2, options = {}) {
+  const header = () => {
+    out();
+    compactHeader(source());
+  };
+  if (options.live) {
+    clearScreen();
+    header();
+    let code2 = 0;
+    try {
+      code2 = await run2();
+    } catch (error) {
+      code2 = error instanceof MenuCancelled ? 0 : reportError(error, flags);
+    }
+    const label2 = options.label ?? "Back";
+    await pressBack(typeof label2 === "function" ? label2() : label2);
+    return code2;
+  }
+  beginCapture();
+  let code = 0;
+  try {
+    code = await run2();
+  } catch (error) {
+    code = error instanceof MenuCancelled ? 0 : reportError(error, flags);
+  }
+  const lines = endCapture();
+  const label = options.label ?? "Back";
+  await showOutput(lines, {
+    drawHeader: header,
+    label: typeof label === "function" ? label() : label
+  });
+  return code;
+}
+
+// src/commands/init.ts
+var DEFAULT_GATEWAY = "http://localhost:4010";
+async function initCommand(args, flags) {
+  const options = parseInitArgs(args);
+  const existing = readProjectConfig();
+  if (existing && !options.force && isInteractive() && !flags.json) {
+    return projectHome(existing, flags);
+  }
+  if (existing && !options.force) {
+    out();
+    out(`${symbol.warn} This project is already connected to Veefore.`);
+    details([
+      ["Agent", `${existing.agentName} (${existing.agentId})`],
+      ["Environment", `${existing.environmentName} (${existing.environmentType})`],
+      ["Control plane", existing.controlPlaneUrl]
+    ]);
+    out();
+    out(style.grey("Re-run with --force to replace the configuration, or use `veefore status`."));
+    return 0;
+  }
+  heading("Veefore init");
+  const framework = detectFramework();
   out(
-    style.grey(
-      `  This environment is in ${environment.gatewayMode ?? "OBSERVE"} mode. Nothing is blocked yet.`
-    )
+    `${symbol.pass} Framework: ${style.bold(framework.name)} ${style.grey(`(${framework.language}, matched ${framework.evidence})`)}`
   );
-  out(style.grey("  Review the recommended policy, simulate it, then switch to ENFORCE."));
-  out();
-  if (flags.json) {
+  if (framework.key === "unknown") {
     out(
-      JSON.stringify(
-        {
-          config_file: configFile,
-          env_file: envFile,
-          agent_id: created.agentId,
-          key_id: created.keyId,
-          fingerprint: created.fingerprint,
-          tools: created.tools,
-          checks
-        },
-        null,
-        2
+      style.grey(
+        "  No manifest was found. Veefore will still work; the integration snippet defaults to TypeScript."
       )
     );
   }
-  return failed.length > 0 ? 1 : 0;
-}
-function previousApprovalMode(dir = process.cwd()) {
+  const found = await locateControlPlane(options.controlPlaneUrl ?? flags.controlPlaneUrl);
+  const controlPlaneUrl = found.controlPlaneUrl;
+  if (found.source !== "entered") {
+    out(
+      `${symbol.pass} Veefore: ${style.bold(controlPlaneUrl)} ${style.grey(`(${found.source})`)}`
+    );
+  }
+  let session = loadSession(controlPlaneUrl);
+  if (!session) {
+    await login(controlPlaneUrl);
+    session = loadSession(controlPlaneUrl);
+  }
+  if (!session) throw new CliError("Sign-in did not produce a usable session.");
+  const api = new ApiClient({ controlPlaneUrl, token: session.token });
+  let me = await api.get("/v1/auth/session");
+  const STEPS = ["organization", "workspace", "environment"];
+  const asked = /* @__PURE__ */ new Map();
+  let organization;
+  let workspace;
+  let environment;
+  const source = welcomeSource(flags);
+  const decided = [];
+  enterApp();
   try {
-    const text = readFileSync9(path11.join(dir, ".env.local"), "utf8");
-    const value = /^\s*VEEFORE_APPROVAL_MODE\s*=\s*['"]?(\w+)/m.exec(text)?.[1]?.toLowerCase();
-    return value === "wait" || value === "throw" ? value : null;
-  } catch {
-    return null;
+    for (let at = 0; at < STEPS.length; ) {
+      const step = STEPS[at];
+      decided.length = at;
+      await stepScreen(source, decided, at + 1, STEPS.length);
+      const answer = step === "organization" ? await selectOrganization(api, me, options, flags) : step === "workspace" ? await selectWorkspace(api, me, options, flags) : await selectEnvironment(api, me, workspace.id, options, flags);
+      if (answer === BACK) {
+        let previous = at - 1;
+        while (previous >= 0 && !asked.get(STEPS[previous])) previous -= 1;
+        if (previous < 0) {
+          throw new MenuCancelled();
+        }
+        at = previous;
+        continue;
+      }
+      asked.set(step, answer.asked);
+      if (step === "organization") {
+        organization = answer.value;
+        decided[at] = ["Organization", organization.name];
+        if (answer.asked) me = await api.get("/v1/auth/session");
+      } else if (step === "workspace") {
+        workspace = answer.value;
+        decided[at] = ["Workspace", workspace.name];
+      } else {
+        environment = answer.value;
+        decided[at] = ["Environment", `${environment.name} (${environment.type})`];
+      }
+      at += 1;
+    }
+  } finally {
+    leaveApp();
   }
-}
-function approvalModeExplanation(mode) {
-  if (mode === "wait") {
-    return [
-      `  Guarded tools ${style.bold("wait")} for the reviewer's decision, then:`,
-      `    ${symbol.bullet} approved: the tool runs once and returns its real result`,
-      `    ${symbol.bullet} denied, cancelled or expired: it fails with that reason, and nothing runs`,
-      style.grey(
-        "  The agent process must stay running while it waits (up to the approval's expiry)."
-      ),
-      style.grey(
-        "  For chat agents that should hand the question back instead, set VEEFORE_APPROVAL_MODE=throw"
-      ),
-      style.grey("  in .env.local, or pass { waitForApproval: false } to a single guard().")
-    ];
+  for (const [label, value] of decided) {
+    out(`${symbol.pass} ${label}: ${style.bold(value)}`);
   }
-  return [
-    `  Guarded tools ${style.bold("return immediately")} with "approval required" (VeeforeApprovalRequiredError),`,
-    "  carrying the approval id. Your agent must resubmit the same call after a reviewer approves,",
-    "  or the action never happens.",
-    style.grey("  To wait for the decision instead, set VEEFORE_APPROVAL_MODE=wait in .env.local.")
+  heading("Looking at your project");
+  const scan = scanProject(process.cwd());
+  printScan(scan);
+  const plan = buildPlan(scan, {
+    agentName: options.agentName,
+    extraCapabilities: options.capabilities
+  });
+  for (; ; ) {
+    if (!options.agentName && !flags.yes) {
+      const name = await askAgentName(plan.agentName);
+      if (name === BACK) {
+        const again = await selectEnvironment(api, me, workspace.id, options, flags);
+        if (again !== BACK) environment = again.value;
+        continue;
+      }
+      plan.agentName = name;
+    }
+    printPlan2(plan, environment);
+    out();
+    const proceed = await confirm("Set this up?", { yes: flags.yes });
+    if (proceed) break;
+    if (flags.yes || options.agentName) {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    const next = await select(
+      "What would you like to do?",
+      [
+        { label: "Change the agent name", value: "name" },
+        { label: "Choose a different environment", value: "environment" },
+        { label: "Leave setup", value: "leave" }
+      ],
+      { initial: 0 }
+    );
+    if (next === "leave") {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    if (next === "environment") {
+      const again = await selectEnvironment(api, me, workspace.id, options, flags);
+      if (again !== BACK) environment = again.value;
+    }
+  }
+  heading("Setting up");
+  let created;
+  try {
+    created = await applyPlan(
+      api,
+      plan,
+      {
+        workspaceId: workspace.id,
+        environmentId: environment.id,
+        framework: framework.key === "unknown" ? null : framework.key
+      },
+      void 0,
+      { newAgent: options.newAgent === true }
+    );
+  } catch (error) {
+    if (error instanceof CliApiError && error.code === "PERMISSION_DENIED") {
+      throw new CliError(
+        "Your role cannot set up agents in this workspace.",
+        'Ask an owner or admin for the "agent:create" and "tool:create" permissions.'
+      );
+    }
+    throw error;
+  }
+  let gatewayUrl = options.gatewayUrl ?? flags.gatewayUrl ?? process.env.VEEFORE_GATEWAY_URL;
+  if (!gatewayUrl) {
+    const published = (await controlPlaneInfo(controlPlaneUrl)).gatewayUrl;
+    if (published && await gatewayReachable(published)) {
+      gatewayUrl = published;
+      out(
+        `${symbol.pass} Gateway: ${style.bold(published)} ${style.grey("(published by the control plane)")}`
+      );
+    } else {
+      const suggestion = published ?? DEFAULT_GATEWAY;
+      out(
+        `${symbol.warn} ${published ? `The gateway at ${published} is not answering.` : "The control plane did not publish a gateway address."}`
+      );
+      gatewayUrl = await ask(`Gateway URL ${style.grey(`[${suggestion}]`)}:`, suggestion);
+    }
+  }
+  gatewayUrl = normalizeUrl(gatewayUrl);
+  const config = {
+    version: 1,
+    controlPlaneUrl,
+    gatewayUrl,
+    organizationId: organization.id,
+    organizationName: organization.name,
+    workspaceId: workspace.id,
+    workspaceName: workspace.name,
+    environmentId: environment.id,
+    environmentName: environment.name,
+    environmentType: environment.type,
+    agentId: created.agentId,
+    agentName: created.agentName,
+    keyId: created.keyId,
+    framework: framework.key === "unknown" ? null : framework.key,
+    declaredTools: created.tools.map((tool) => tool.key),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const configFile = writeProjectConfig(config);
+  out(
+    `${symbol.pass} Wrote ${style.bold("veefore.config.json")} ${style.grey("(safe to commit)")}`
+  );
+  const audience = await discoverAudience(gatewayUrl);
+  ensureGitignore(process.cwd(), [".env.local", ".veefore/"]);
+  const approvalMode = options.approvalMode ?? previousApprovalMode() ?? "wait";
+  const envFile = writeLocalEnv({
+    VEEFORE_GATEWAY_URL: gatewayUrl,
+    VEEFORE_GATEWAY_AUDIENCE: audience,
+    VEEFORE_AGENT_ID: created.agentId,
+    VEEFORE_AGENT_KEY_ID: created.keyId,
+    VEEFORE_AGENT_PRIVATE_KEY: created.privateKey,
+    ...created.tools.length > 0 ? { VEEFORE_DECLARED_TOOLS: created.tools.map((tool) => tool.key).join(",") } : {},
+    // Written explicitly so the behaviour is visible and editable in one place.
+    VEEFORE_APPROVAL_MODE: approvalMode
+  });
+  if (audience !== gatewayUrl) {
+    out(
+      `${symbol.info} Gateway audience is ${style.bold(audience)} ${style.grey(
+        `(it reports this, rather than the ${gatewayUrl} you dialled)`
+      )}`
+    );
+  }
+  out(
+    `${symbol.pass} Wrote agent credentials to ${style.bold(".env.local")} ${style.grey("(mode 0600, gitignored)")}`
+  );
+  out();
+  out(
+    `  ${style.amber("The private key was generated here and written to that file only.")} Veefore`
+  );
+  out(
+    `  never received it and cannot recover it. Move it into your secret manager before deploying.`
+  );
+  out(`  ${style.grey(`Fingerprint: ${created.fingerprint}`)}`);
+  await configureStarterPolicy(api, workspace.id, flags, options);
+  let integrated = false;
+  if (created.tools.length > 0 && !options.skipCode) {
+    const outcome = await integrate(
+      process.cwd(),
+      created.tools.map((tool) => tool.key),
+      { yes: flags.yes, quiet: flags.json, api }
+    );
+    integrated = outcome.status === "applied" || outcome.status === "nothing-to-do";
+  }
+  heading("Validating the connection");
+  const checks = await validateConnection(api, gatewayUrl, created.agentId, environment.id);
+  for (const check of checks) {
+    const icon = check.status === "pass" ? symbol.pass : check.status === "warn" ? symbol.warn : symbol.fail;
+    out(`${icon} ${check.name}${check.message ? style.grey(` \u2014 ${check.message}`) : ""}`);
+  }
+  const failed = checks.filter((check) => check.status === "fail");
+  if (!integrated) {
+    heading("Protect each tool");
+    out();
+    for (const line of integrationSnippet(framework).split("\n")) {
+      out(`  ${style.cyan(line)}`);
+    }
+    const entryPoints = findEntryPoints();
+    if (entryPoints.length > 0) {
+      out();
+      out(
+        style.grey(
+          `  Likely entry point${entryPoints.length > 1 ? "s" : ""}: ${entryPoints.join(", ")}`
+        )
+      );
+    }
+    if (created.tools.length > 0) {
+      out(style.grey("  Or let Veefore wrap your tools for you: `veefore integrate`."));
+    }
+  }
+  heading("When a human must approve");
+  for (const line of approvalModeExplanation(approvalMode)) out(line);
+  heading("Next");
+  out(`  ${symbol.bullet} ${style.bold("veefore dev")}     watch decisions live while you build`);
+  out(
+    `  ${symbol.bullet} ${style.bold("veefore doctor")}  check the security posture of this setup`
+  );
+  out(`  ${symbol.bullet} ${style.bold("veefore status")}  see the current mode and agent health`);
+  out();
+  out(
+    style.grey(
+      `  This environment is in ${environment.gatewayMode ?? "OBSERVE"} mode. Nothing is blocked yet.`
+    )
+  );
+  out(style.grey("  Review the recommended policy, simulate it, then switch to ENFORCE."));
+  out();
+  if (flags.json) {
+    out(
+      JSON.stringify(
+        {
+          config_file: configFile,
+          env_file: envFile,
+          agent_id: created.agentId,
+          key_id: created.keyId,
+          fingerprint: created.fingerprint,
+          tools: created.tools,
+          checks
+        },
+        null,
+        2
+      )
+    );
+  }
+  return failed.length > 0 ? 1 : 0;
+}
+function previousApprovalMode(dir = process.cwd()) {
+  try {
+    const text = readFileSync9(path12.join(dir, ".env.local"), "utf8");
+    const value = /^\s*VEEFORE_APPROVAL_MODE\s*=\s*['"]?(\w+)/m.exec(text)?.[1]?.toLowerCase();
+    return value === "wait" || value === "throw" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function approvalModeExplanation(mode) {
+  if (mode === "wait") {
+    return [
+      `  Guarded tools ${style.bold("wait")} for the reviewer's decision, then:`,
+      `    ${symbol.bullet} approved: the tool runs once and returns its real result`,
+      `    ${symbol.bullet} denied, cancelled or expired: it fails with that reason, and nothing runs`,
+      style.grey(
+        "  The agent process must stay running while it waits (up to the approval's expiry)."
+      ),
+      style.grey(
+        "  For chat agents that should hand the question back instead, set VEEFORE_APPROVAL_MODE=throw"
+      ),
+      style.grey("  in .env.local, or pass { waitForApproval: false } to a single guard().")
+    ];
+  }
+  return [
+    `  Guarded tools ${style.bold("return immediately")} with "approval required" (VeeforeApprovalRequiredError),`,
+    "  carrying the approval id. Your agent must resubmit the same call after a reviewer approves,",
+    "  or the action never happens.",
+    style.grey("  To wait for the decision instead, set VEEFORE_APPROVAL_MODE=wait in .env.local.")
   ];
 }
 async function selectOrganization(api, me, options, flags) {
@@ -7972,7 +8617,6 @@ async function selectOrganization(api, me, options, flags) {
   if (organizations.length === 1 || flags.yes) {
     const chosen2 = organizations[0];
     if (!chosen2) throw new CliError("Your account is not a member of any organization.");
-    out(`${symbol.pass} Organization: ${style.bold(chosen2.name)}`);
     return { value: chosen2, asked: false };
   }
   out();
@@ -7987,7 +8631,6 @@ async function selectOrganization(api, me, options, flags) {
   );
   if (chosen === BACK) return BACK;
   await api.post("/v1/auth/scope", { organization_id: chosen.id });
-  out(`${symbol.pass} Organization: ${style.bold(chosen.name)}`);
   return { value: chosen, asked: true };
 }
 async function selectWorkspace(api, me, options, flags) {
@@ -8005,7 +8648,6 @@ async function selectWorkspace(api, me, options, flags) {
   }
   if (workspaces.length === 1 || flags.yes) {
     const chosen2 = workspaces[0];
-    out(`${symbol.pass} Workspace: ${style.bold(chosen2.name)}`);
     return { value: chosen2, asked: false };
   }
   out();
@@ -8019,7 +8661,6 @@ async function selectWorkspace(api, me, options, flags) {
     { quiet: true, back: true }
   );
   if (chosen === BACK) return BACK;
-  out(`${symbol.pass} Workspace: ${style.bold(chosen.name)}`);
   return { value: chosen, asked: true };
 }
 async function selectEnvironment(api, me, workspaceId, options, flags) {
@@ -8038,7 +8679,6 @@ async function selectEnvironment(api, me, workspaceId, options, flags) {
   }
   if (flags.yes) {
     const chosen = environments.find((environment) => environment.type === "DEVELOPMENT") ?? environments[0];
-    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
     return { value: chosen, asked: false };
   }
   const development = environments.findIndex((environment) => environment.type === "DEVELOPMENT");
@@ -8064,10 +8704,21 @@ async function selectEnvironment(api, me, workspaceId, options, flags) {
         continue;
       }
     }
-    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
     return { value: chosen, asked: true };
   }
 }
+async function stepScreen(source, decided, step, total) {
+  await beginScreen(source, { compact: true });
+  out();
+  out(` ${style.bold("Set up this project")}  ${style.grey(`step ${step} of ${total}`)}`);
+  if (decided.length > 0) {
+    out();
+    const width = Math.max(...decided.map(([label]) => label.length));
+    for (const [label, value] of decided) {
+      out(`   ${symbol.pass} ${style.grey(label.padEnd(width))}  ${value}`);
+    }
+  }
+}
 async function askAgentName(suggested) {
   for (; ; ) {
     out();
@@ -8287,10 +8938,18 @@ function parseInitArgs(args) {
   return options;
 }
 async function projectHome(existing, flags) {
+  enterApp();
+  try {
+    return await projectHomeLoop(existing, flags);
+  } finally {
+    leaveApp();
+  }
+}
+async function projectHomeLoop(existing, flags) {
   const source = welcomeSource(flags);
   let last = 0;
   for (let round = 0; ; round += 1) {
-    await beginScreen(source, { animate: round === 0 });
+    await beginScreen(source, { animate: round === 0, reserve: 18 });
     const state = await agentState(existing);
     printProjectSummary(existing, state);
     const choices = homeChoices(existing, state, flags);
@@ -8300,28 +8959,37 @@ async function projectHome(existing, flags) {
     try {
       picked = await select(
         "What would you like to do?",
-        choices.map((choice) => ({ label: choice.label, hint: choice.hint, value: choice }))
+        choices.map((choice) => ({ label: choice.label, hint: choice.hint, value: choice })),
+        {
+          // Repainted as soon as a sign-in, sign-out or project change is
+          // noticed, so the panel and the status never sit stale.
+          redraw: () => {
+            drawScreen(source, { reserve: 18 });
+            printProjectSummary(existing, state);
+            out();
+          }
+        }
       );
     } catch (error) {
       if (error instanceof MenuCancelled) return last;
       throw error;
     }
     if (picked.leaves) {
-      await beginScreen(source, { compact: true });
-      try {
-        return await picked.run();
-      } catch (error) {
-        return error instanceof MenuCancelled ? last : reportError(error, flags);
-      }
-    }
-    await beginScreen(source, { compact: true });
-    try {
-      last = await picked.run();
-    } catch (error) {
-      last = error instanceof MenuCancelled ? last : reportError(error, flags);
+      return onOrdinaryScreen(async () => {
+        clearScreen();
+        compactHeader(source());
+        try {
+          return await picked.run();
+        } catch (error) {
+          return error instanceof MenuCancelled ? last : reportError(error, flags);
+        }
+      });
     }
+    last = await runOnScreen(source, flags, () => picked.run(), {
+      label: "Back to menu",
+      live: picked.live
+    });
     if (!isInteractive()) return last;
-    await pressBack("Back to menu");
   }
 }
 function printProjectSummary(existing, state) {
@@ -8374,7 +9042,12 @@ function homeChoices(existing, state, flags) {
     });
   }
   choices.push(
-    { label: "Watch decisions live", hint: "veefore dev", run: () => devCommand([], flags) },
+    {
+      label: "Watch decisions live",
+      hint: "veefore dev",
+      run: () => devCommand([], flags),
+      live: true
+    },
     { label: "Check status", hint: "veefore status", run: () => statusCommand([], flags) },
     {
       label: "Protect tools in the code",
@@ -8423,23 +9096,6 @@ function homeChoices(existing, state, flags) {
   return choices;
 }
 
-// src/commands/scan.ts
-async function scanCommand(_args, flags) {
-  const scan = scanProject(process.cwd());
-  if (flags.json) {
-    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
-    return 0;
-  }
-  heading("Veefore scan");
-  out(
-    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
-  );
-  printScan(scan);
-  out();
-  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
-  return 0;
-}
-
 // src/commands/policies.ts
 function caseCount(result) {
   return result.passed + result.failed;
@@ -8648,531 +9304,181 @@ function renderTestReports(reports) {
         `    ${symbol.fail} ${testCase.name}: expected ${decisionStyle(testCase.expected)}, got ${decisionStyle(testCase.actual)}`
       );
       if (testCase.reason) out(`      ${style.grey(testCase.reason)}`);
-    }
-  }
-  out();
-  out(
-    totalFailed === 0 ? `  ${symbol.pass} ${style.green(`All ${totalCases} test case(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${totalFailed} failure(s) across ${totalCases} test case(s).`)}`
-  );
-  if (withoutTests > 0) {
-    out(
-      `  ${symbol.warn} ${style.amber(`${withoutTests} policy/policies have no test cases.`)} Add cases so activation can be proven safe.`
-    );
-  }
-  out();
-}
-async function deployPolicy(args, flags) {
-  const context = await resolveContext(flags);
-  const policyId = positional(args);
-  if (!policyId) {
-    throw new CliError(
-      "A policy id is required.",
-      'Usage: veefore policies deploy <policyId> [--version <n>] [--reason "\u2026"]'
-    );
-  }
-  const policy = await context.api.get(`/v1/policies/${policyId}`);
-  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
-  const requested = valueFor(args, "--version");
-  const target = requested ? versions.find((version) => String(version.versionNumber) === requested) : versions.find((version) => version.status === "DRAFT") ?? versions.find((version) => version.status === "TESTED");
-  if (!target) {
-    throw new CliError(
-      requested ? `Version ${requested} was not found for this policy.` : "There is no draft version to deploy.",
-      "Edit the policy in the console to create a new draft, then deploy it."
-    );
-  }
-  if (target.versionNumber === policy.activeVersion?.versionNumber) {
-    out(`${symbol.info} Version ${target.versionNumber} is already active. Nothing to do.`);
-    return 0;
-  }
-  heading(`Deploy ${policy.name} v${target.versionNumber}`);
-  details([
-    ["Environment", `${context.config.environmentName} (${context.config.environmentType})`],
-    ["Policy", `${policy.name} (${policy.id})`],
-    [
-      "Currently active",
-      policy.activeVersion === null ? style.grey("none \u2014 this will be the first active version") : `v${policy.activeVersion.versionNumber}`
-    ],
-    ["Deploying", `v${target.versionNumber}`],
-    ["Bindings", String(policy.bindings.length)]
-  ]);
-  if (policy.bindings.length === 0) {
-    out();
-    out(
-      `  ${symbol.warn} ${style.amber("This policy is not bound to any scope.")} Activating it will not change any decision until you bind it.`
-    );
-  }
-  if (policy.activeVersion !== null) {
-    const diff = await context.api.get(`/v1/policies/${policyId}/diff`, {
-      from: policy.activeVersion.versionNumber,
-      to: target.versionNumber
-    }).catch(() => null);
-    if (diff) {
-      heading("Changes");
-      for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
-      for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
-      for (const rule of diff.changed) {
-        out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
-      }
-      if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
-        out(style.grey("  No rule changes."));
-      }
-      if (diff.riskAssessment) {
-        out();
-        out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
-      }
-    }
-  }
-  heading("Tests");
-  const testSpinner = spinner("Running recorded test cases");
-  let testResult = null;
-  try {
-    testResult = await context.api.post(`/v1/policies/${policyId}/tests/run`, {
-      version_id: target.id
-    });
-    testSpinner.succeed(`${testResult.passed}/${caseCount(testResult)} test case(s) passing`);
-  } catch (error) {
-    testSpinner.fail("Could not run the test cases");
-    throw error;
-  }
-  if (testResult.failed > 0) {
-    out();
-    for (const failure of testResult.results.filter((entry) => !entry.passed)) {
-      out(
-        `  ${symbol.fail} ${failure.name}: expected ${decisionStyle(failure.expected)}, got ${decisionStyle(failure.actual)}`
-      );
-    }
-    out();
-    throw new CliError(
-      `${testResult.failed} test case(s) fail. This version will not be deployed.`,
-      "Fix the rules or the expectations, then deploy again. Use --force only if you accept the risk and the server permits it."
-    );
-  }
-  if (caseCount(testResult) === 0) {
-    out();
-    out(
-      `  ${symbol.warn} ${style.amber("This policy has no test cases.")} There is no evidence the new rules behave as intended.`
-    );
-    const proceed = await confirm("Deploy anyway?", { yes: flags.yes });
-    if (!proceed) {
-      out(style.grey("Cancelled. Add test cases first."));
-      return 1;
-    }
-  }
-  const reason = valueFor(args, "--reason") ?? await ask("Reason for this change (recorded in the audit trail, min 10 characters):");
-  if (reason.trim().length < 10) {
-    throw new CliError("A reason of at least 10 characters is required.");
-  }
-  if (context.config.environmentType === "PRODUCTION") {
-    out();
-    out(`  ${symbol.warn} ${style.amber("This affects a PRODUCTION environment.")}`);
-  }
-  const confirmed = await confirm(`Activate v${target.versionNumber}?`, { yes: flags.yes });
-  if (!confirmed) {
-    out(style.grey("Cancelled. No change was made."));
-    return 1;
-  }
-  const deploySpinner = spinner(`Activating v${target.versionNumber}`);
-  try {
-    await withStepUp(
-      context.api,
-      () => context.api.post(`/v1/policies/${policyId}/activate`, {
-        version_id: target.id,
-        reason
-      })
-    );
-    deploySpinner.succeed(`${policy.name} v${target.versionNumber} is ACTIVE`);
-  } catch (error) {
-    deploySpinner.fail("Activation failed");
-    throw error;
-  }
-  out();
-  out(`  ${symbol.pass} The previous version is marked SUPERSEDED and can be rolled back.`);
-  out(`  ${symbol.pass} The change and its diff are recorded in the audit trail.`);
-  out(style.grey("  Roll back with: veefore policies deploy <policyId> --version <previous>"));
-  out();
-  return 0;
-}
-async function diffPolicy(args, flags) {
-  const context = await resolveContext(flags);
-  const policyId = positional(args);
-  if (!policyId) {
-    throw new CliError(
-      "A policy id is required.",
-      "Usage: veefore policies diff <policyId> --from <n> --to <n>"
-    );
-  }
-  const from = valueFor(args, "--from");
-  const to = valueFor(args, "--to");
-  const diff = await context.api.get(`/v1/policies/${policyId}/diff`, { from, to });
-  if (flags.json) {
-    printJson(diff);
-    return 0;
-  }
-  heading(`Policy diff v${diff.from} \u2192 v${diff.to}`);
-  for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
-  for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
-  for (const rule of diff.changed) {
-    out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
-  }
-  if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
-    out(style.grey("  No differences."));
-  }
-  if (diff.riskAssessment) {
-    out();
-    out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
-  }
-  out();
-  return 0;
-}
-
-// src/help.ts
-var COMMANDS = [
-  {
-    name: "init",
-    summary: "Set up this project with Veefore. Also runs as plain `veefore`.",
-    usage: "veefore init [options]",
-    description: "Connects to hosted Veefore, or to the self-hosted Veefore named with --control-plane (remembered afterwards), signs you in through the browser, scans the project locally (framework, tools, the hosts they call, the credentials they read \u2014 names only, never values), shows what it will set up and asks once. It then creates an agent with a key pair generated on this machine, registers each tool with its own capability and authorizes it for this agent, adds a starter policy in OBSERVE mode, writes veefore.config.json and .env.local, and validates the connection. The private key is written to .env.local only and is never sent, printed or recoverable.",
-    options: [
-      ["--force", "Replace an existing veefore.config.json."],
-      [
-        "--new-agent",
-        "Create a separate agent even if one with this name exists. By default the existing agent is reused with a new key, so its delegations and limits keep applying."
-      ],
-      ["--control-plane <url>", "Self-hosted Veefore address. Needed once; remembered after."],
-      ["--gateway <url>", "Gateway base URL that agents will call."],
-      ["--organization <id>", "Skip the organization prompt."],
-      ["--workspace <id>", "Skip the workspace prompt."],
-      ["--environment <id>", "Skip the environment prompt."],
-      ["--name <name>", "Agent display name."],
-      ["--capability <key>", "Grant a capability. Repeatable."],
-      ["--skip-policy", "Do not create a starter policy."],
-      ["--skip-code", "Do not offer to change your code; run `veefore integrate` later."],
-      [
-        "--approval-mode <wait|throw>",
-        "When approval is required, guarded tools wait for the decision (default) or return at once."
-      ]
-    ],
-    examples: ["veefore init", "veefore init --name finance-agent --capability refund.create"]
-  },
-  {
-    name: "scan",
-    summary: "Preview what setup would find, without changing anything.",
-    usage: "veefore scan [--json]",
-    description: "Scans the project locally and lists its framework, tools, the external hosts each tool calls and the credentials the code reads. Reads source files only: .env files and other hidden files are never opened, and secret values are never read. Needs no sign-in.",
-    options: [["--json", "Machine-readable scan and the setup plan it implies."]]
-  },
-  {
-    name: "integrate",
-    summary: "Wrap your registered tools in guard() so Veefore decides every call.",
-    usage: "veefore integrate [--dry-run] [--check] [--assist=manual|own|veefore|off] [--yes]",
-    description: "Finds each tool registered for this agent in your code and wraps its function in guard() (TypeScript/JavaScript) or adds @guard above it (Python). Your function bodies are not edited. Shows a diff and asks before writing, backs up every file it changes, then runs your TypeScript compiler (--noEmit), node --check or a Python syntax check; if a check newly fails, every file is restored automatically. For tools it will not change on its own, you choose: make the change yourself from exact instructions, use AI with your own Anthropic or OpenAI key (code goes only to that provider), or use Veefore AI if enabled. Before anything is sent, secrets are replaced with placeholders and you see what goes where and must agree; an AI change is accepted only if it keeps every line of your code and adds nothing but the guard, and you still review the diff.",
-    options: [
-      ["--dry-run", "Show the diff and write nothing."],
-      ["--check", "Report which registered tools are guarded in the code. Exits 1 if any are not."],
-      ["--assist=<how>", "manual (default when not interactive), own, veefore, or off."],
-      ["--yes", "Apply without asking."]
-    ],
-    examples: [
-      "veefore integrate --dry-run",
-      "veefore integrate --assist=manual",
-      "ANTHROPIC_API_KEY=\u2026 veefore integrate --assist=own",
-      "veefore integrate --check"
-    ]
-  },
-  {
-    name: "undo",
-    summary: "Restore the files the last `veefore integrate` changed.",
-    usage: "veefore undo [--force]",
-    description: "Restores each file from the backup taken before the last rewrite. A file you edited afterwards is left alone and listed, unless --force is given.",
-    options: [["--force", "Restore files even if they were edited after the rewrite."]]
-  },
-  {
-    name: "remove",
-    summary: "Take Veefore out of this project: guard() from the code, then disconnect.",
-    usage: "veefore remove [--dry-run] [--keep-agent]",
-    description: "Offers to revoke the agent in Veefore if it is still active, removes every guard() this CLI added (showing the diff, asking once, backing up and rolling back if your checks fail), then deletes veefore.config.json and the Veefore block in .env.local, including the private key. Edits you made after setup are kept. `veefore` offers this automatically when the agent was revoked in the console.",
-    options: [
-      ["--dry-run", "Show what would change and write nothing."],
-      ["--keep-agent", "Do not offer to revoke the agent in Veefore."]
-    ],
-    examples: ["veefore remove --dry-run", "veefore remove"]
-  },
-  {
-    name: "dev",
-    summary: "Watch decisions live while you build.",
-    usage: "veefore dev [--all]",
-    description: "Confirms the gateway is reachable, reports the enforcement mode, then streams every decision for this agent with the next concrete step for each outcome.",
-    options: [["--all", "Stream decisions for every agent in the environment."]]
-  },
-  {
-    name: "doctor",
-    summary: "Audit the security posture of this setup.",
-    usage: "veefore doctor [--strict]",
-    description: "Checks authentication, MFA, TLS, local secret permissions, identity and passport validity, gateway health, dangerous tools, network restrictions, policy coverage, production data access, MCP transport and authorization, audit chain integrity, credential rotation, and SDK version alignment.",
-    options: [["--strict", "Exit non-zero on warnings as well as failures."]]
-  },
-  {
-    name: "status",
-    summary: "Show the current environment, mode and agent health.",
-    usage: "veefore status",
-    description: "Prints the active organization, workspace and environment, the enforcement mode, the agent lifecycle state, gateway health, and the last few decisions."
-  },
-  {
-    name: "test",
-    summary: "Verify enforcement works, without performing any action.",
-    usage: "veefore test [--tool <key>]",
-    description: "Runs a dry-run probe across every tool this agent is authorized for, checks that policy test cases pass, and fails if a dangerous tool is permitted only by the default decision. Suitable as a CI gate.",
-    options: [["--tool <key>", "Probe a single tool."]]
-  },
-  {
-    name: "agents",
-    summary: "Inspect and control the agent fleet.",
-    usage: "veefore agents <list|show|pause|resume|suspend|revoke|rotate-key> [agentId]",
-    description: "Lifecycle control. `revoke` is irreversible for the identity and shows the full blast radius before asking for confirmation. `rotate-key` issues a new key pair and invalidates every outstanding session for that agent.",
-    options: [
-      ["--all", "List across the whole organization, not just this environment."],
-      ["--status <status>", "Filter by lifecycle status."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."]
-    ],
-    examples: [
-      "veefore agents list",
-      'veefore agents revoke agt_01ABC --reason "Key suspected compromised"'
-    ]
-  },
-  {
-    name: "policies",
-    summary: "List, test and deploy policies.",
-    usage: "veefore policies <list|show|test|deploy|diff> [policyId]",
-    description: "`test` runs the recorded test cases. `deploy` activates a version and refuses to do so while any test case fails; it requires a reason and step-up authentication.",
-    options: [
-      ["--version <n>", "Version to deploy, for `deploy`."],
-      ["--from <n> --to <n>", "Versions to compare, for `diff`."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."]
-    ],
-    examples: [
-      "veefore policies list",
-      "veefore policies test",
-      "veefore policies deploy pol_01ABC"
-    ]
-  },
-  {
-    name: "logs",
-    summary: "Read or stream the decision log.",
-    usage: "veefore logs [--follow] [--decision <d>] [--limit <n>]",
-    description: "Every line is a server-side decision with the policy and rule that produced it.",
-    options: [
-      ["--follow, -f", "Stream new decisions as they happen."],
-      ["--decision <d>", "Filter by decision, e.g. BLOCK."],
-      ["--agent <id>", "Filter by agent."],
-      ["--all", "Include every agent in the environment."],
-      ["--limit <n>", "Number of recent decisions to show."]
-    ]
-  },
-  {
-    name: "audit",
-    summary: "Query, verify and export the audit trail.",
-    usage: "veefore audit <list|show|verify|export> [eventId]",
-    description: "`verify` re-checks the hash chain and exits non-zero if it is broken. `export` returns a JSON or CSV file together with a content hash an auditor can use to prove the file is unaltered.",
-    options: [
-      ["--severity <s>", "Filter by severity."],
-      ["--type <t>", "Filter by event type."],
-      ["--from <iso> --to <iso>", "Time range."],
-      ["--format <json|csv>", "Export format."],
-      ['--reason "<text>"', "Why this export is being taken. Recorded in the audit trail."],
-      ["--out <file>", "Write the export to a file (mode 0600)."]
-    ],
-    examples: [
-      "veefore audit verify",
-      'veefore audit export --format csv --reason "Quarterly SOC 2 evidence" --out audit.csv'
-    ]
-  },
-  {
-    name: "deploy",
-    summary: "Promote the environment to enforcement.",
-    usage: "veefore deploy [--mode ENFORCE|SIMULATE|OBSERVE]",
-    description: "Runs preflight checks, replays recent observed traffic to show exactly what starts being refused, then requires confirmation, a reason and step-up authentication. Reducing enforcement always requires a reason and is recorded as a CRITICAL audit event.",
-    options: [
-      ["--mode <mode>", "Target mode. Defaults to ENFORCE."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."],
-      ["--skip-preflight", "Incident use only. Recorded in the audit reason."]
-    ]
-  },
-  {
-    name: "login",
-    summary: "Sign in through your browser and store a session token.",
-    usage: "veefore login [--device] [--password] [--control-plane <url>]",
-    description: "Opens the console in your browser, where you sign in (or create an account) and approve this terminal. The terminal never sees your password. Over SSH, or with --device, it prints a link and a code to enter in any browser instead. Only the resulting session token is stored, in ~/.veefore/credentials.json at mode 0600, and the session can be revoked from your profile. In CI, set VEEFORE_EMAIL and VEEFORE_PASSWORD.",
-    options: [
-      ["--device", "Show a link and a code instead of opening a browser here."],
-      ["--password", "Type email and password in the terminal instead of using the browser."]
-    ]
-  },
-  {
-    name: "logout",
-    summary: "Sign out of Veefore on this machine.",
-    usage: "veefore logout [--all]",
-    description: 'Ends the session on the server and deletes the stored token. Signing out of the console with "Also sign out of the Veefore CLI" ticked does the same for every terminal you approved; the next command here then says you were signed out and asks you to sign in again.',
-    options: [["--all", "Sign out of every control plane this machine is signed in to."]]
-  }
-];
-var GLOBAL_OPTIONS = [
-  ["--json", "Machine-readable output."],
-  ["--yes, -y", "Assume yes for confirmations. Never skips step-up authentication."],
-  ["--verbose", "Expanded output."],
-  [
-    "--control-plane <url>",
-    "Use this Veefore instead of the one found automatically (hosted, or the last you signed in to)."
-  ],
-  ["--gateway <url>", "Override the configured gateway URL."],
-  ["--version, -V", "Print the CLI version."],
-  ["--help, -h", "Show help."]
-];
-function printRootHelp(version) {
-  out();
-  out(
-    `${style.bold("veefore")} ${style.grey(version)} \u2014 identity, authority and policy for AI agents`
-  );
-  out();
-  out(style.bold("USAGE"));
-  out("  veefore <command> [options]");
-  out();
-  out(style.bold("COMMANDS"));
-  const width = Math.max(...COMMANDS.map((command) => command.name.length));
-  for (const command of COMMANDS) {
-    out(`  ${style.cyan(command.name.padEnd(width))}  ${command.summary}`);
-  }
-  out();
-  out(style.bold("GLOBAL OPTIONS"));
-  renderOptions(GLOBAL_OPTIONS);
-  out();
-  out(style.bold("GETTING STARTED"));
-  out(
-    `  ${style.grey("1.")} veefore          ${style.grey("sign in, scan, set up and protect this project")}`
-  );
+    }
+  }
+  out();
   out(
-    `  ${style.grey("2.")} veefore dev      ${style.grey("watch what your agent actually does")}`
+    totalFailed === 0 ? `  ${symbol.pass} ${style.green(`All ${totalCases} test case(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${totalFailed} failure(s) across ${totalCases} test case(s).`)}`
   );
-  out(`  ${style.grey("3.")} veefore doctor   ${style.grey("check the security posture")}`);
-  out(`  ${style.grey("4.")} veefore deploy   ${style.grey("turn enforcement on")}`);
-  out();
-  out(style.grey("  Run `veefore <command> --help` for detail on any command."));
+  if (withoutTests > 0) {
+    out(
+      `  ${symbol.warn} ${style.amber(`${withoutTests} policy/policies have no test cases.`)} Add cases so activation can be proven safe.`
+    );
+  }
   out();
 }
-function printCommandHelp(name) {
-  const command = COMMANDS.find((entry) => entry.name === name);
-  if (!command) return false;
-  out();
-  out(`${style.bold(`veefore ${command.name}`)} \u2014 ${command.summary}`);
-  out();
-  out(style.bold("USAGE"));
-  out(`  ${command.usage}`);
-  out();
-  out(style.bold("DESCRIPTION"));
-  for (const line of wrap2(command.description, 76)) out(`  ${line}`);
-  if (command.options && command.options.length > 0) {
-    out();
-    out(style.bold("OPTIONS"));
-    renderOptions(command.options);
+async function deployPolicy(args, flags) {
+  const context = await resolveContext(flags);
+  const policyId = positional(args);
+  if (!policyId) {
+    throw new CliError(
+      "A policy id is required.",
+      'Usage: veefore policies deploy <policyId> [--version <n>] [--reason "\u2026"]'
+    );
   }
-  if (command.examples && command.examples.length > 0) {
-    out();
-    out(style.bold("EXAMPLES"));
-    for (const example of command.examples) out(`  ${style.grey("$")} ${example}`);
+  const policy = await context.api.get(`/v1/policies/${policyId}`);
+  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
+  const requested = valueFor(args, "--version");
+  const target = requested ? versions.find((version) => String(version.versionNumber) === requested) : versions.find((version) => version.status === "DRAFT") ?? versions.find((version) => version.status === "TESTED");
+  if (!target) {
+    throw new CliError(
+      requested ? `Version ${requested} was not found for this policy.` : "There is no draft version to deploy.",
+      "Edit the policy in the console to create a new draft, then deploy it."
+    );
   }
-  out();
-  return true;
-}
-function renderOptions(options) {
-  const width = Math.max(...options.map(([flag]) => flag.length));
-  for (const [flag, description] of options) {
-    out(`  ${style.cyan(flag.padEnd(width))}  ${description}`);
+  if (target.versionNumber === policy.activeVersion?.versionNumber) {
+    out(`${symbol.info} Version ${target.versionNumber} is already active. Nothing to do.`);
+    return 0;
   }
-}
-function wrap2(text, width) {
-  const words2 = text.split(/\s+/);
-  const lines = [];
-  let current = "";
-  for (const word of words2) {
-    if (current.length + word.length + 1 > width) {
-      lines.push(current);
-      current = word;
-    } else {
-      current = current === "" ? word : `${current} ${word}`;
+  heading(`Deploy ${policy.name} v${target.versionNumber}`);
+  details([
+    ["Environment", `${context.config.environmentName} (${context.config.environmentType})`],
+    ["Policy", `${policy.name} (${policy.id})`],
+    [
+      "Currently active",
+      policy.activeVersion === null ? style.grey("none \u2014 this will be the first active version") : `v${policy.activeVersion.versionNumber}`
+    ],
+    ["Deploying", `v${target.versionNumber}`],
+    ["Bindings", String(policy.bindings.length)]
+  ]);
+  if (policy.bindings.length === 0) {
+    out();
+    out(
+      `  ${symbol.warn} ${style.amber("This policy is not bound to any scope.")} Activating it will not change any decision until you bind it.`
+    );
+  }
+  if (policy.activeVersion !== null) {
+    const diff = await context.api.get(`/v1/policies/${policyId}/diff`, {
+      from: policy.activeVersion.versionNumber,
+      to: target.versionNumber
+    }).catch(() => null);
+    if (diff) {
+      heading("Changes");
+      for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
+      for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
+      for (const rule of diff.changed) {
+        out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
+      }
+      if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
+        out(style.grey("  No rule changes."));
+      }
+      if (diff.riskAssessment) {
+        out();
+        out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
+      }
     }
   }
-  if (current !== "") lines.push(current);
-  return lines;
-}
-
-// src/home.ts
-async function homeCommand(args, flags) {
-  const source = welcomeSource(flags);
-  let first = true;
-  for (; ; ) {
-    if (readProjectConfig()) return initCommand(args, flags);
-    await beginScreen(source, { animate: first });
-    first = false;
-    out();
-    out(style.bold("Let's get started."));
+  heading("Tests");
+  const testSpinner = spinner("Running recorded test cases");
+  let testResult = null;
+  try {
+    testResult = await context.api.post(`/v1/policies/${policyId}/tests/run`, {
+      version_id: target.id
+    });
+    testSpinner.succeed(`${testResult.passed}/${caseCount(testResult)} test case(s) passing`);
+  } catch (error) {
+    testSpinner.fail("Could not run the test cases");
+    throw error;
+  }
+  if (testResult.failed > 0) {
     out();
-    let action;
-    try {
-      action = await select("What would you like to do?", [
-        { label: "Set up this project", hint: "recommended \xB7 veefore init", value: "setup" },
-        {
-          label: "Preview what setup would find",
-          hint: "veefore scan \xB7 changes nothing",
-          value: "scan"
-        },
-        { label: "Sign in", hint: "veefore login", value: "login" },
-        { label: "Show every command", hint: "veefore help", value: "help" },
-        { label: "Exit", hint: "esc", value: "exit" }
-      ]);
-    } catch (error) {
-      if (error instanceof MenuCancelled) return 0;
-      throw error;
+    for (const failure of testResult.results.filter((entry) => !entry.passed)) {
+      out(
+        `  ${symbol.fail} ${failure.name}: expected ${decisionStyle(failure.expected)}, got ${decisionStyle(failure.actual)}`
+      );
     }
-    if (action === "exit") return 0;
-    if (action === "setup") {
-      await runOnScreen(source, flags, () => initCommand(args, flags), {
-        // Setup done: "Continue", and the next pass opens the project home
-        // with the panel filled in. Otherwise "Back to menu", to read why and
-        // choose again.
-        label: () => readProjectConfig() ? "Continue" : "Back to menu"
-      });
-      continue;
+    out();
+    throw new CliError(
+      `${testResult.failed} test case(s) fail. This version will not be deployed.`,
+      "Fix the rules or the expectations, then deploy again. Use --force only if you accept the risk and the server permits it."
+    );
+  }
+  if (caseCount(testResult) === 0) {
+    out();
+    out(
+      `  ${symbol.warn} ${style.amber("This policy has no test cases.")} There is no evidence the new rules behave as intended.`
+    );
+    const proceed = await confirm("Deploy anyway?", { yes: flags.yes });
+    if (!proceed) {
+      out(style.grey("Cancelled. Add test cases first."));
+      return 1;
     }
-    const code = await runOnScreen(source, flags, async () => {
-      switch (action) {
-        case "scan":
-          return scanCommand([], flags);
-        case "login":
-          await login(resolveControlPlaneUrl(flags.controlPlaneUrl));
-          return 0;
-        case "help":
-          printRootHelp(source().version);
-          return 0;
-      }
-      return 0;
-    });
-    if (!isInteractive()) return code;
   }
-}
-async function initWithWelcome(args, flags) {
-  await beginScreen(welcomeSource(flags), { animate: true });
-  return initCommand(args, flags);
-}
-async function runOnScreen(source, flags, run2, options = {}) {
-  await beginScreen(source, { compact: true });
-  let code = 0;
+  const reason = valueFor(args, "--reason") ?? await ask("Reason for this change (recorded in the audit trail, min 10 characters):");
+  if (reason.trim().length < 10) {
+    throw new CliError("A reason of at least 10 characters is required.");
+  }
+  if (context.config.environmentType === "PRODUCTION") {
+    out();
+    out(`  ${symbol.warn} ${style.amber("This affects a PRODUCTION environment.")}`);
+  }
+  const confirmed = await confirm(`Activate v${target.versionNumber}?`, { yes: flags.yes });
+  if (!confirmed) {
+    out(style.grey("Cancelled. No change was made."));
+    return 1;
+  }
+  const deploySpinner = spinner(`Activating v${target.versionNumber}`);
   try {
-    code = await run2();
+    await withStepUp(
+      context.api,
+      () => context.api.post(`/v1/policies/${policyId}/activate`, {
+        version_id: target.id,
+        reason
+      })
+    );
+    deploySpinner.succeed(`${policy.name} v${target.versionNumber} is ACTIVE`);
   } catch (error) {
-    code = error instanceof MenuCancelled ? 0 : reportError(error, flags);
+    deploySpinner.fail("Activation failed");
+    throw error;
   }
-  const label = options.label ?? "Back";
-  await pressBack(typeof label === "function" ? label() : label);
-  return code;
+  out();
+  out(`  ${symbol.pass} The previous version is marked SUPERSEDED and can be rolled back.`);
+  out(`  ${symbol.pass} The change and its diff are recorded in the audit trail.`);
+  out(style.grey("  Roll back with: veefore policies deploy <policyId> --version <previous>"));
+  out();
+  return 0;
+}
+async function diffPolicy(args, flags) {
+  const context = await resolveContext(flags);
+  const policyId = positional(args);
+  if (!policyId) {
+    throw new CliError(
+      "A policy id is required.",
+      "Usage: veefore policies diff <policyId> --from <n> --to <n>"
+    );
+  }
+  const from = valueFor(args, "--from");
+  const to = valueFor(args, "--to");
+  const diff = await context.api.get(`/v1/policies/${policyId}/diff`, { from, to });
+  if (flags.json) {
+    printJson(diff);
+    return 0;
+  }
+  heading(`Policy diff v${diff.from} \u2192 v${diff.to}`);
+  for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
+  for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
+  for (const rule of diff.changed) {
+    out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
+  }
+  if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
+    out(style.grey("  No differences."));
+  }
+  if (diff.riskAssessment) {
+    out();
+    out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
+  }
+  out();
+  return 0;
 }
 
 // src/index.ts