veefore 1.2.0 → 1.4.1

package/dist/veefore.mjs

@@ -236,29 +236,29 @@ var ApiClient = class {
   setToken(token) {
     this.token = token;
   }
-  async get(path12, query = {}) {
+  async get(path13, query = {}) {
     const search = new URLSearchParams();
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) search.set(key, String(value));
     }
     const suffix = search.toString() === "" ? "" : `?${search.toString()}`;
-    return this.send("GET", `${path12}${suffix}`);
+    return this.send("GET", `${path13}${suffix}`);
   }
-  async post(path12, body) {
-    return this.send("POST", path12, body);
+  async post(path13, body) {
+    return this.send("POST", path13, body);
   }
-  async patch(path12, body) {
-    return this.send("PATCH", path12, body);
+  async patch(path13, body) {
+    return this.send("PATCH", path13, body);
   }
-  async delete(path12) {
-    return this.send("DELETE", path12);
+  async delete(path13) {
+    return this.send("DELETE", path13);
   }
   /** Raw request for endpoints that return a non-JSON body (exports). */
-  async raw(method, path12, body) {
-    return this.fetchWithTimeout(method, path12, body);
+  async raw(method, path13, body) {
+    return this.fetchWithTimeout(method, path13, body);
   }
-  async send(method, path12, body) {
-    const response = await this.fetchWithTimeout(method, path12, body);
+  async send(method, path13, body) {
+    const response = await this.fetchWithTimeout(method, path13, body);
     const text = await response.text();
     const parsed = parseJson(text);
     if (response.ok) {
@@ -266,14 +266,14 @@ var ApiClient = class {
       if (parsed && "data" in parsed) return parsed.data;
       throw new CliApiError(
         "UNEXPECTED_RESPONSE",
-        `The control plane returned an unexpected body for ${method} ${path12}.`,
+        `The control plane returned an unexpected body for ${method} ${path13}.`,
         response.status,
         response.headers.get("x-request-id")
       );
     }
     const error = new CliApiError(
       parsed?.error?.code ?? `HTTP_${response.status}`,
-      parsed?.error?.message ?? `${method} ${path12} failed with ${response.status} ${response.statusText}.`,
+      parsed?.error?.message ?? `${method} ${path13} failed with ${response.status} ${response.statusText}.`,
       response.status,
       parsed?.error?.request_id ?? response.headers.get("x-request-id"),
       parsed?.error?.details ?? {}
@@ -291,7 +291,7 @@ var ApiClient = class {
     }
     throw error;
   }
-  async fetchWithTimeout(method, path12, body) {
+  async fetchWithTimeout(method, path13, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = { accept: "application/json" };
@@ -300,7 +300,7 @@ var ApiClient = class {
     if (this.workspaceId) headers["x-veefore-workspace"] = this.workspaceId;
     if (this.environmentId) headers["x-veefore-environment"] = this.environmentId;
     try {
-      return await fetch(`${this.controlPlaneUrl}${path12}`, {
+      return await fetch(`${this.controlPlaneUrl}${path13}`, {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body),
@@ -568,6 +568,8 @@ function sleep(ms) {
 import { createInterface } from "node:readline/promises";
 
 // src/tui.ts
+import { statSync } from "node:fs";
+import path2 from "node:path";
 import { emitKeypressEvents } from "node:readline";
 
 // src/logo.ts
@@ -612,8 +614,8 @@ var BRAND_TOP = [150, 172, 236];
 var BRAND_BOTTOM = [84, 108, 186];
 var BRAND = [118, 140, 214];
 var brand = (text) => paint(BRAND, text);
-function gradient(row, rows) {
-  const t = rows <= 1 ? 0 : row / (rows - 1);
+function gradient(row, rows2) {
+  const t = rows2 <= 1 ? 0 : row / (rows2 - 1);
   const mix = (a, b) => Math.round(a + (b - a) * t);
   return [
     mix(BRAND_TOP[0], BRAND_BOTTOM[0]),
@@ -628,6 +630,9 @@ function visibleLength(text) {
 function columns() {
   return process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
 }
+function rows() {
+  return process.stdout.rows && process.stdout.rows > 0 ? process.stdout.rows : 24;
+}
 var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var STARS = [
   [0, -3, "*"],
@@ -640,8 +645,20 @@ var STARS = [
 ];
 async function showWelcome(context, options = {}) {
   if (!isInteractive()) return;
+  const lines = welcomeLines(context);
+  if ((options.animate ?? true) && process.env.VEEFORE_NO_ANIMATION === void 0) {
+    for (const line of lines) {
+      out(line);
+      await sleep2(14);
+    }
+    return;
+  }
+  for (const line of lines) out(line);
+}
+function welcomeLines(context) {
   const width = Math.min(columns(), 100);
-  const logoWidth = Math.max(...LOGO.map((line) => [...line].length));
+  const art = LOGO;
+  const logoWidth = Math.max(...art.map((line) => [...line].length));
   const indent = 5;
   const gap = 6;
   const panelWidth = Math.max(
@@ -649,43 +666,45 @@ async function showWelcome(context, options = {}) {
     ...context.facts.map(([label, value]) => label.length + 2 + value.length)
   );
   const sideBySide = width >= indent + logoWidth + gap + panelWidth + 2;
+  const panel = renderPanel(context.facts);
   const showLogo = width >= indent + logoWidth + 2;
   const rule = style.grey("\xB7".repeat(Math.max(10, Math.min(width - 2, 72))));
-  const animate = (options.animate ?? true) && process.env.VEEFORE_NO_ANIMATION === void 0;
-  out();
-  out(` ${brand(style.bold("Welcome to Veefore"))} ${style.grey(`v${context.version}`)}`);
-  out(` ${rule}`);
-  out();
-  const panel = renderPanel(context.facts);
+  const lines = [];
+  const add = (line = "") => void lines.push(line);
+  add();
+  add(` ${brand(style.bold("Welcome to Veefore"))} ${style.grey(`v${context.version}`)}`);
+  add(` ${rule}`);
+  add();
   if (showLogo) {
-    for (let row = 0; row < LOGO.length; row += 1) {
-      const line = LOGO[row] ?? "";
-      const left = starsFor(row, indent, (column) => column < 0, -indent);
-      const right = starsFor(row, 0, (column) => column >= logoWidth, logoWidth);
-      const art = paint(gradient(row, LOGO.length), line.padEnd(logoWidth));
-      let text = `${left}${art}`;
+    for (let row = 0; row < art.length; row += 1) {
+      const line = art[row] ?? "";
+      const left = starsFor(row, indent, (column) => column < 0, -indent, art.length);
+      const right = starsFor(row, 0, (column) => column >= logoWidth, logoWidth, art.length);
+      const painted = paint(gradient(row, art.length), line.padEnd(logoWidth));
+      let text = `${left}${painted}`;
       if (sideBySide) {
-        const top = Math.max(0, Math.floor((LOGO.length - panel.length) / 2));
+        const top = Math.max(0, Math.floor((art.length - panel.length) / 2));
         const side = panel[row - top];
         text += side === void 0 ? right : `${" ".repeat(gap)}${side}`;
       } else {
         text += right;
       }
-      out(text.replace(/\s+$/, ""));
-      if (animate) await sleep2(14);
+      add(text.replace(/\s+$/, ""));
     }
   }
   if (!sideBySide) {
-    out();
-    for (const line of panel) out(fit(`   ${line}`, width - 1));
+    add();
+    for (const line of panel) add(fit(`   ${line}`, width - 1));
   }
-  out();
-  out(` ${rule}`);
+  add();
+  add(` ${rule}`);
+  return lines;
 }
-function starsFor(row, width, inBand, offset) {
+function starsFor(row, width, inBand, offset, artRows) {
   const cells = Array.from({ length: Math.max(width, 6) }, () => " ");
   for (const [starRow, column, glyph] of STARS) {
-    if (starRow !== row || !inBand(column)) continue;
+    const scaled = Math.round(starRow * (artRows - 1) / (LOGO.length - 1));
+    if (scaled !== row || !inBand(column)) continue;
     const index = column - offset;
     if (index >= 0 && index < cells.length) cells[index] = style.grey(glyph);
   }
@@ -706,27 +725,139 @@ function renderPanel(facts) {
 }
 function clearScreen() {
   if (!isInteractive()) return;
-  process.stdout.write("\x1B[H\x1B[2J");
-}
-function compactHeader(context) {
-  const facts = Object.fromEntries(context.facts);
-  const parts = [
-    brand(style.bold("Veefore")),
-    style.grey(`v${context.version}`),
-    ...[facts.Folder, facts["Signed in"], facts.Veefore].filter((v) => Boolean(v))
-  ];
-  out();
-  out(fit(` ${parts.join(style.grey("  \xB7  "))}`, columns() - 1));
-  out(` ${style.grey("\xB7".repeat(Math.max(10, Math.min(columns() - 2, 72))))}`);
+  process.stdout.write("\x1B[H\x1B[J");
+}
+var appDepth = 0;
+var restoreInstalled = false;
+function enterApp() {
+  if (!isInteractive()) return;
+  appDepth += 1;
+  if (appDepth > 1) return;
+  if (!restoreInstalled) {
+    restoreInstalled = true;
+    process.on("exit", () => {
+      if (appDepth > 0) process.stdout.write("\x1B[?25h\x1B[?1049l");
+    });
+  }
+  process.stdout.write("\x1B[?1049h\x1B[?25l\x1B[H\x1B[J");
+}
+function leaveApp() {
+  if (!isInteractive() || appDepth === 0) return;
+  appDepth -= 1;
+  if (appDepth > 0) return;
+  process.stdout.write("\x1B[?25h\x1B[?1049l");
+}
+function inApp() {
+  return appDepth > 0;
+}
+async function onOrdinaryScreen(body) {
+  const depth = appDepth;
+  if (depth > 0) {
+    appDepth = 0;
+    process.stdout.write("\x1B[?25h\x1B[?1049l");
+  }
+  try {
+    return await body();
+  } finally {
+    if (depth > 0) {
+      appDepth = depth;
+      process.stdout.write("\x1B[?1049h\x1B[H\x1B[J");
+    }
+  }
 }
 async function beginScreen(source, options = {}) {
   if (!isInteractive()) return;
   clearScreen();
-  if (options.compact) compactHeader(source());
-  else await showWelcome(source(), { animate: options.animate ?? false });
+  await showWelcome(source(), { animate: options.animate ?? false });
+}
+function drawScreen(source) {
+  if (!isInteractive()) return;
+  clearScreen();
+  for (const line of welcomeLines(source())) out(line);
+}
+async function showOutput(lines, options) {
+  if (!isInteractive()) {
+    for (const line of lines) process.stdout.write(`${line}
+`);
+    return;
+  }
+  const stdout = process.stdout;
+  const stdin = process.stdin;
+  const body = lines.length > 0 ? lines : [style.grey("  (no output)")];
+  let headerRows = 0;
+  const measure = () => {
+    let count = 0;
+    const original = stdout.write.bind(stdout);
+    stdout.write = ((chunk) => {
+      count += String(chunk).split("\n").length - 1;
+      return true;
+    });
+    try {
+      options.drawHeader();
+    } finally {
+      stdout.write = original;
+    }
+    headerRows = count;
+  };
+  measure();
+  let top = 0;
+  const viewport = () => Math.max(3, rows() - headerRows - 2);
+  const draw = () => {
+    const height = viewport();
+    const maxTop = Math.max(0, body.length - height);
+    top = Math.min(Math.max(0, top), maxTop);
+    clearScreen();
+    options.drawHeader();
+    for (const line of body.slice(top, top + height)) {
+      stdout.write(`${fit(line, columns() - 1)}
+`);
+    }
+    const hidden = body.length > height;
+    const position = hidden ? `${Math.min(top + height, body.length)}/${body.length}` : `${body.length} line${body.length === 1 ? "" : "s"}`;
+    const keys = hidden ? "\u2191\u2193 scroll \xB7 " : "";
+    stdout.write(
+      `${brand("\u2190")} ${style.bold(options.label ?? "Back")} ${style.grey(`\xB7 ${keys}enter or esc \xB7 ${position}`)}`
+    );
+  };
+  await new Promise((resolve) => {
+    const wasRaw = stdin.isRaw;
+    const done = () => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      process.stdout.off("resize", onResize);
+      stdout.write("\r\x1B[K");
+      resolve();
+    };
+    const onResize = () => {
+      measure();
+      draw();
+    };
+    const onKey = (input, key = {}) => {
+      const height = viewport();
+      if (key.name === "return" || key.name === "enter" || key.name === "escape" || key.name === "left" || input === "b" || key.ctrl && key.name === "c") {
+        return done();
+      }
+      if (key.name === "down" || input === "j") top += 1;
+      else if (key.name === "up" || input === "k") top -= 1;
+      else if (key.name === "pagedown" || input === " ") top += height;
+      else if (key.name === "pageup") top -= height;
+      else if (input === "G") top = body.length;
+      else if (input === "g") top = 0;
+      else return;
+      draw();
+    };
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("keypress", onKey);
+    process.stdout.on("resize", onResize);
+    draw();
+  });
 }
 async function pressBack(label = "Back") {
   if (!isInteractive()) return;
+  flushCapture();
   const stdin = process.stdin;
   const stdout = process.stdout;
   out();
@@ -751,6 +882,29 @@ async function pressBack(label = "Back") {
     stdin.on("keypress", onKey);
   });
 }
+function watchFacts(onChange) {
+  const files = [
+    CREDENTIALS_FILE,
+    findProjectConfig() ?? path2.join(process.cwd(), PROJECT_CONFIG_FILE)
+  ];
+  const signature = () => files.map((file) => {
+    try {
+      const stats = statSync(file);
+      return `${stats.mtimeMs}:${stats.size}`;
+    } catch {
+      return "absent";
+    }
+  }).join("|");
+  let last = signature();
+  const timer = setInterval(() => {
+    const now = signature();
+    if (now === last) return;
+    last = now;
+    onChange();
+  }, 500);
+  timer.unref();
+  return () => clearInterval(timer);
+}
 var BACK = /* @__PURE__ */ Symbol("veefore.back");
 var MenuCancelled = class extends CliError {
   constructor() {
@@ -765,6 +919,7 @@ async function select(question, real, settings = {}) {
   const choosable = enabled.filter((index) => options[index]?.value !== BACK);
   const fallback = choosable.includes(settings.initial ?? -1) ? settings.initial : choosable[0] ?? enabled[0];
   if (!isInteractive()) return options[fallback].value;
+  flushCapture();
   let cursor = fallback;
   let rendered = 0;
   const stdin = process.stdin;
@@ -794,6 +949,13 @@ async function select(question, real, settings = {}) {
 `);
     rendered = lines.length;
   };
+  const repaint = () => {
+    if (!settings.redraw) return;
+    clearScreen();
+    settings.redraw();
+    rendered = 0;
+    draw();
+  };
   const move = (direction) => {
     const position = enabled.indexOf(cursor);
     const next = (position + direction + enabled.length) % enabled.length;
@@ -802,12 +964,19 @@ async function select(question, real, settings = {}) {
   return new Promise((resolve, reject) => {
     const wasRaw = stdin.isRaw;
     const restoreCursor = () => {
-      stdout.write("\x1B[?25h");
+      if (!inApp()) stdout.write("\x1B[?25h");
+    };
+    const stopWatching = settings.redraw ? watchFacts(repaint) : void 0;
+    const onResize = () => {
+      if (settings.redraw) repaint();
+      else draw();
     };
     const finish = (result) => {
       stdin.off("keypress", onKey);
       stdin.setRawMode(wasRaw);
       stdin.pause();
+      stopWatching?.();
+      process.stdout.off("resize", onResize);
       process.off("exit", restoreCursor);
       if (rendered > 0) stdout.write(`\x1B[${rendered}A\r\x1B[J`);
       restoreCursor();
@@ -857,6 +1026,7 @@ async function select(question, real, settings = {}) {
     stdin.resume();
     stdout.write("\x1B[?25l");
     stdin.on("keypress", onKey);
+    process.stdout.on("resize", onResize);
     draw();
   });
 }
@@ -912,11 +1082,38 @@ var symbol = {
   info: style.cyan("\u203A"),
   bullet: style.grey("\u2022")
 };
+var captured = null;
+function beginCapture() {
+  captured = [];
+}
+function endCapture() {
+  const lines = captured ?? [];
+  captured = null;
+  return lines;
+}
+function flushCapture() {
+  if (captured === null) return;
+  const lines = captured;
+  captured = null;
+  for (const line of lines) process.stdout.write(`${line}
+`);
+}
+function isCapturing() {
+  return captured !== null;
+}
 function out(line = "") {
+  if (captured !== null) {
+    captured.push(line);
+    return;
+  }
   process.stdout.write(`${line}
 `);
 }
 function err(line = "") {
+  if (captured !== null) {
+    captured.push(line);
+    return;
+  }
   process.stderr.write(`${line}
 `);
 }
@@ -925,15 +1122,15 @@ function heading(text) {
   out(style.bold(text));
   out(style.grey("\u2500".repeat(Math.min(text.length, 72))));
 }
-function table(columns2, rows) {
-  if (rows.length === 0) {
+function table(columns2, rows2) {
+  if (rows2.length === 0) {
     out(style.grey("  (none)"));
     return;
   }
   const widths = columns2.map((column) => {
     const longest = Math.max(
       column.header.length,
-      ...rows.map((row) => (row[column.key] ?? "").length)
+      ...rows2.map((row) => (row[column.key] ?? "").length)
     );
     return Math.min(column.width ?? longest, longest);
   });
@@ -949,7 +1146,7 @@ function table(columns2, rows) {
     columns2.map((column) => column.header),
     style.grey
   );
-  for (const row of rows) {
+  for (const row of rows2) {
     renderRow(
       columns2.map((column) => row[column.key] ?? ""),
       (text) => text
@@ -966,6 +1163,7 @@ function keyValue(label, value) {
   out(`  ${style.grey(`${label}:`)} ${value}`);
 }
 async function ask(question, fallback = "") {
+  flushCapture();
   if (!process.stdin.isTTY) return fallback;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
@@ -976,6 +1174,7 @@ async function ask(question, fallback = "") {
   }
 }
 async function askSecret(question) {
+  flushCapture();
   if (!process.stdin.isTTY) {
     throw new Error(
       "A secret is required but the terminal is not interactive. Provide it through the documented environment variable instead."
@@ -1018,6 +1217,7 @@ async function askSecret(question) {
   });
 }
 async function confirm(question, options = {}) {
+  flushCapture();
   if (options.yes) {
     out(`${question} ${style.grey("[y/N]")} ${style.amber("y (--yes)")}`);
     return true;
@@ -1040,6 +1240,12 @@ async function confirm(question, options = {}) {
   return ["y", "yes"].includes(answer.toLowerCase());
 }
 function spinner(label) {
+  if (isCapturing()) {
+    return {
+      succeed: (text) => out(`${symbol.pass} ${text ?? label}`),
+      fail: (text) => out(`${symbol.fail} ${text ?? label}`)
+    };
+  }
   if (!process.stdout.isTTY) {
     out(`${symbol.info} ${label}`);
     return {
@@ -1163,6 +1369,7 @@ async function resolveContext(flags) {
   };
 }
 async function login(controlPlaneUrl, options = {}) {
+  flushCapture();
   await assertControlPlane(controlPlaneUrl);
   const ciCredentials = Boolean(process.env.VEEFORE_EMAIL && process.env.VEEFORE_PASSWORD);
   if (options.method === "password" || options.method === void 0 && ciCredentials) {
@@ -1739,11 +1946,11 @@ function renderRevokeConfirmation(agent, environment, preview) {
   out(`  ${style.red("This action is irreversible for this identity.")}`);
   out();
 }
-async function lifecycle(args, flags, path12, resultingStatus) {
+async function lifecycle(args, flags, path13, resultingStatus) {
   const context = await resolveContext(flags);
   const agentId = positional(args) ?? context.config.agentId;
   const agent = await context.api.get(`/v1/agents/${agentId}`);
-  const reasonRequired = path12 === "suspend";
+  const reasonRequired = path13 === "suspend";
   const reason = valueFor(args, "--reason");
   if (reasonRequired && (!reason || reason.trim().length < 10)) {
     throw new CliError(
@@ -1753,24 +1960,24 @@ async function lifecycle(args, flags, path12, resultingStatus) {
   }
   out();
   out(
-    `${symbol.info} ${path12} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
+    `${symbol.info} ${path13} ${style.bold(agent.name)} ${style.grey(`(${agent.status} \u2192 ${resultingStatus})`)}`
   );
-  if (path12 !== "resume") {
+  if (path13 !== "resume") {
     const confirmed = await confirm("Continue?", { yes: flags.yes });
     if (!confirmed) {
       out(style.grey("Cancelled."));
       return 1;
     }
   }
-  const actionSpinner = spinner(`Applying ${path12}`);
+  const actionSpinner = spinner(`Applying ${path13}`);
   try {
     await withStepUp(
       context.api,
-      () => context.api.post(`/v1/agents/${agentId}/${path12}`, reason ? { reason } : {})
+      () => context.api.post(`/v1/agents/${agentId}/${path13}`, reason ? { reason } : {})
     );
     actionSpinner.succeed(`${agent.name} is ${resultingStatus}`);
   } catch (error) {
-    actionSpinner.fail(`Could not ${path12} the agent`);
+    actionSpinner.fail(`Could not ${path13} the agent`);
     throw error;
   }
   out();
@@ -2074,13 +2281,13 @@ async function exportEvents(args, flags) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
+import path4 from "node:path";
 
 // src/project-checks.ts
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 var MIN_APPROVAL_WAIT_SDK = "1.1.0";
 function versionLessThan(a, b) {
   if (!a) return true;
@@ -2097,19 +2304,19 @@ function versionLessThan(a, b) {
 function installedSdks(root, options = {}) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
-  const top = path2.resolve(root);
+  const top = path3.resolve(root);
   const candidates = /* @__PURE__ */ new Set([top]);
   for (const dir of options.dirs ?? []) {
-    let current = path2.resolve(top, dir);
+    let current = path3.resolve(top, dir);
     while (current.startsWith(top)) {
       candidates.add(current);
-      const parent = path2.dirname(current);
+      const parent = path3.dirname(current);
       if (parent === current) break;
       current = parent;
     }
   }
   for (const dir of candidates) {
-    const manifest = path2.join(dir, "node_modules", "@veefore", "sdk", "package.json");
+    const manifest = path3.join(dir, "node_modules", "@veefore", "sdk", "package.json");
     if (!existsSync2(manifest)) continue;
     let real = manifest;
     try {
@@ -2126,7 +2333,7 @@ function installedSdks(root, options = {}) {
     }
     found.push({
       language: "js",
-      location: path2.relative(top, path2.dirname(manifest)) || ".",
+      location: path3.relative(top, path3.dirname(manifest)) || ".",
       version,
       waitsForApproval: !versionLessThan(version, MIN_APPROVAL_WAIT_SDK)
     });
@@ -2158,7 +2365,7 @@ function upgradeCommand(root, language) {
 }
 function configuredApprovalMode(root) {
   for (const name of [".env.local", ".env"]) {
-    const file = path2.join(root, name);
+    const file = path3.join(root, name);
     if (!existsSync2(file)) continue;
     const match = /^\s*(?:export\s+)?VEEFORE_APPROVAL_MODE\s*=\s*["']?(\w+)["']?/m.exec(
       readFileSync2(file, "utf8")
@@ -2168,7 +2375,7 @@ function configuredApprovalMode(root) {
   return null;
 }
 function sdkInstalled(root, language) {
-  if (language === "js") return existsSync2(path2.join(root, "node_modules", "@veefore", "sdk"));
+  if (language === "js") return existsSync2(path3.join(root, "node_modules", "@veefore", "sdk"));
   const python = projectPython(root);
   if (!python) return false;
   return spawnSync(python, ["-c", "import veefore"], { cwd: root, stdio: "ignore", timeout: 2e4 }).status === 0;
@@ -2177,18 +2384,18 @@ function typecheck(root, files) {
   const name = "TypeScript typecheck";
   const projects = files ? [
     ...new Set(
-      files.filter((file) => /\.(m|c)?tsx?$/.test(file)).map((file) => nearestUp(root, path2.dirname(path2.join(root, file)), "tsconfig.json")).filter((dir) => dir !== null)
+      files.filter((file) => /\.(m|c)?tsx?$/.test(file)).map((file) => nearestUp(root, path3.dirname(path3.join(root, file)), "tsconfig.json")).filter((dir) => dir !== null)
     )
-  ] : existsSync2(path2.join(root, "tsconfig.json")) ? [root] : [];
+  ] : existsSync2(path3.join(root, "tsconfig.json")) ? [root] : [];
   if (projects.length === 0) return { name, ran: false, ok: true, detail: "no tsconfig.json" };
   const binary = process.platform === "win32" ? "tsc.cmd" : "tsc";
   for (const project of projects) {
-    const bin = nearestUp(root, project, path2.join("node_modules", ".bin", binary));
+    const bin = nearestUp(root, project, path3.join("node_modules", ".bin", binary));
     if (!bin) {
       return { name, ran: false, ok: true, detail: "TypeScript is not installed in this project" };
     }
     const result = spawnSync(
-      path2.join(bin, "node_modules", ".bin", binary),
+      path3.join(bin, "node_modules", ".bin", binary),
       ["--noEmit", "-p", "."],
       {
         cwd: project,
@@ -2198,7 +2405,7 @@ function typecheck(root, files) {
     );
     if (result.status !== 0) {
       const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
-      const where = path2.relative(root, project) || ".";
+      const where = path3.relative(root, project) || ".";
       return {
         name,
         ran: true,
@@ -2211,12 +2418,12 @@ ${output.split("\n").slice(0, 12).join("\n")}`
   return { name, ran: true, ok: true, detail: "" };
 }
 function nearestUp(root, start, entry) {
-  const top = path2.resolve(root);
-  let dir = path2.resolve(start);
+  const top = path3.resolve(root);
+  let dir = path3.resolve(start);
   for (; ; ) {
-    if (existsSync2(path2.join(dir, entry))) return dir;
+    if (existsSync2(path3.join(dir, entry))) return dir;
     if (dir === top) return null;
-    const parent = path2.dirname(dir);
+    const parent = path3.dirname(dir);
     if (parent === dir || !parent.startsWith(top)) return null;
     dir = parent;
   }
@@ -2270,20 +2477,20 @@ function pythonSyntax(root, files) {
 }
 function projectPython(root) {
   for (const candidate of [".venv/bin/python", "venv/bin/python", ".venv/Scripts/python.exe"]) {
-    if (existsSync2(path2.join(root, candidate))) return path2.join(root, candidate);
+    if (existsSync2(path3.join(root, candidate))) return path3.join(root, candidate);
   }
   const probe = spawnSync("python3", ["--version"], { stdio: "ignore" });
   return probe.status === 0 ? "python3" : null;
 }
 function installCommand(root, language) {
   if (language === "py") {
-    if (existsSync2(path2.join(root, "uv.lock"))) return "uv add veefore-py";
-    if (existsSync2(path2.join(root, "poetry.lock"))) return "poetry add veefore-py";
+    if (existsSync2(path3.join(root, "uv.lock"))) return "uv add veefore-py";
+    if (existsSync2(path3.join(root, "poetry.lock"))) return "poetry add veefore-py";
     return "pip install veefore-py";
   }
-  if (existsSync2(path2.join(root, "pnpm-lock.yaml"))) return "pnpm add @veefore/sdk";
-  if (existsSync2(path2.join(root, "yarn.lock"))) return "yarn add @veefore/sdk";
-  if (existsSync2(path2.join(root, "bun.lockb")) || existsSync2(path2.join(root, "bun.lock"))) {
+  if (existsSync2(path3.join(root, "pnpm-lock.yaml"))) return "pnpm add @veefore/sdk";
+  if (existsSync2(path3.join(root, "yarn.lock"))) return "yarn add @veefore/sdk";
+  if (existsSync2(path3.join(root, "bun.lockb")) || existsSync2(path3.join(root, "bun.lock"))) {
     return "bun add @veefore/sdk";
   }
   return "npm install @veefore/sdk";
@@ -2403,8 +2610,8 @@ async function checkTransportSecurity(config, add) {
 }
 function checkLocalSecrets(config, add) {
   const configFile = findProjectConfig();
-  const projectDir = configFile ? path3.dirname(configFile) : process.cwd();
-  const envFile = path3.join(projectDir, ".env.local");
+  const projectDir = configFile ? path4.dirname(configFile) : process.cwd();
+  const envFile = path4.join(projectDir, ".env.local");
   if (!existsSync3(envFile)) {
     add({
       check: "Local agent credentials",
@@ -2414,7 +2621,7 @@ function checkLocalSecrets(config, add) {
     });
     return;
   }
-  const mode = statSync(envFile).mode & 511;
+  const mode = statSync2(envFile).mode & 511;
   if ((mode & 63) !== 0) {
     add({
       check: "Local agent credentials",
@@ -2429,7 +2636,7 @@ function checkLocalSecrets(config, add) {
       message: `.env.local is mode ${mode.toString(8)} (owner only).`
     });
   }
-  const gitignore = path3.join(projectDir, ".gitignore");
+  const gitignore = path4.join(projectDir, ".gitignore");
   const ignored = existsSync3(gitignore) && readFileSync3(gitignore, "utf8").split(/\r?\n/).some((line) => line.trim() === ".env.local" || line.trim() === "*.local");
   add({
     check: "Secrets excluded from version control",
@@ -2757,8 +2964,8 @@ async function checkCredentialRotation(api, add) {
 }
 async function checkDependencies(add, dir) {
   const configFile = findProjectConfig();
-  const projectDir = dir ?? (configFile ? path3.dirname(configFile) : process.cwd());
-  const manifest = path3.join(projectDir, "package.json");
+  const projectDir = dir ?? (configFile ? path4.dirname(configFile) : process.cwd());
+  const manifest = path4.join(projectDir, "package.json");
   if (!existsSync3(manifest)) {
     add({
       check: "SDK dependency",
@@ -2800,9 +3007,9 @@ async function checkDependencies(add, dir) {
 }
 function checkApprovalWaiting(add, projectDir) {
   const configFile = findProjectConfig();
-  const dir = projectDir ?? (configFile ? path3.dirname(configFile) : process.cwd());
+  const dir = projectDir ?? (configFile ? path4.dirname(configFile) : process.cwd());
   const python = ["pyproject.toml", "requirements.txt", "setup.py"].some(
-    (name) => existsSync3(path3.join(dir, name))
+    (name) => existsSync3(path4.join(dir, name))
   );
   const sdks = installedSdks(dir, { python });
   const old = sdks.filter((sdk) => !sdk.waitsForApproval);
@@ -3094,11 +3301,11 @@ function isLoosening(from, to) {
 
 // src/commands/init.ts
 import { readFileSync as readFileSync9 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 
 // src/integrate.ts
 import { readFileSync as readFileSync8 } from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // ../types/src/permissions.ts
 var PERMISSIONS = [
@@ -3435,6 +3642,11 @@ var EVENT_TYPES = [
   "user.profile_updated",
   "onboarding.completed",
   "session.revoked",
+  // Sign-in is served from its own origin, so a session cannot be carried
+  // across to the console by cookie; it is re-issued there from a one-time
+  // code. Recorded at both ends, so the trail shows one session ending and
+  // its replacement beginning rather than an unexplained gap.
+  "session.handed_over",
   "cli.authorization_approved",
   "cli.authorization_denied",
   "cli.session_issued",
@@ -4368,21 +4580,21 @@ import {
   readdirSync,
   renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import path4 from "node:path";
-var BACKUP_DIR = path4.join(".veefore", "backups");
+import path5 from "node:path";
+var BACKUP_DIR = path5.join(".veefore", "backups");
 function sha256(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function createBackup(root, changes) {
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const id = createdAt.replace(/[:.]/g, "-");
-  const dir = path4.join(root, BACKUP_DIR, id);
+  const dir = path5.join(root, BACKUP_DIR, id);
   for (const change of changes) {
-    const target = path4.join(dir, "files", change.file);
-    mkdirSync2(path4.dirname(target), { recursive: true });
+    const target = path5.join(dir, "files", change.file);
+    mkdirSync2(path5.dirname(target), { recursive: true });
     writeFileSync3(target, change.before, { mode: 384 });
   }
   const files = changes.map((change) => ({
@@ -4391,7 +4603,7 @@ function createBackup(root, changes) {
     afterSha256: sha256(change.after)
   }));
   writeFileSync3(
-    path4.join(dir, "manifest.json"),
+    path5.join(dir, "manifest.json"),
     `${JSON.stringify({ version: 1, createdAt, files }, null, 2)}
 `,
     { mode: 384 }
@@ -4399,28 +4611,28 @@ function createBackup(root, changes) {
   return { id, dir, createdAt, files };
 }
 function writeFilePreservingMode(file, content) {
-  const mode = existsSync4(file) ? statSync2(file).mode & 511 : 420;
+  const mode = existsSync4(file) ? statSync3(file).mode & 511 : 420;
   const temp = `${file}.veefore-tmp-${process.pid}`;
   writeFileSync3(temp, content, { mode });
   renameSync2(temp, file);
 }
 function latestBackup(root) {
-  const base2 = path4.join(root, BACKUP_DIR);
+  const base2 = path5.join(root, BACKUP_DIR);
   if (!existsSync4(base2)) return null;
-  const ids = readdirSync(base2).filter((entry) => existsSync4(path4.join(base2, entry, "manifest.json"))).sort();
+  const ids = readdirSync(base2).filter((entry) => existsSync4(path5.join(base2, entry, "manifest.json"))).sort();
   const id = ids[ids.length - 1];
   if (!id) return null;
-  const dir = path4.join(base2, id);
-  const manifest = JSON.parse(readFileSync4(path4.join(dir, "manifest.json"), "utf8"));
+  const dir = path5.join(base2, id);
+  const manifest = JSON.parse(readFileSync4(path5.join(dir, "manifest.json"), "utf8"));
   return { id, dir, createdAt: manifest.createdAt, files: manifest.files };
 }
 function restoreBackup(root, backup, options = {}) {
   const restored = [];
   const conflicts = [];
   for (const entry of backup.files) {
-    const target = path4.join(root, entry.file);
+    const target = path5.join(root, entry.file);
     const current = existsSync4(target) ? readFileSync4(target, "utf8") : null;
-    const original = readFileSync4(path4.join(backup.dir, "files", entry.file), "utf8");
+    const original = readFileSync4(path5.join(backup.dir, "files", entry.file), "utf8");
     if (current !== null && sha256(current) === entry.beforeSha256) {
       restored.push(entry.file);
       continue;
@@ -4440,15 +4652,15 @@ function restoreBackup(root, backup, options = {}) {
 
 // src/rewrite.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/scan.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
-import path6 from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import path7 from "node:path";
 
 // src/framework.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync2 } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 var SIGNATURES = [
   {
     key: "langchain",
@@ -4530,8 +4742,8 @@ function detectFramework(dir = process.cwd()) {
       };
     }
   }
-  if (nodeDeps.size > 0 || existsSync5(path5.join(dir, "package.json"))) {
-    const typescript = existsSync5(path5.join(dir, "tsconfig.json")) || nodeDeps.has("typescript");
+  if (nodeDeps.size > 0 || existsSync5(path6.join(dir, "package.json"))) {
+    const typescript = existsSync5(path6.join(dir, "tsconfig.json")) || nodeDeps.has("typescript");
     return {
       key: "custom",
       name: "Custom agent",
@@ -4553,7 +4765,7 @@ function normalize(name) {
   return name.toLowerCase().replace(/_/g, "-");
 }
 function readPackageJsonDependencies(dir) {
-  const file = path5.join(dir, "package.json");
+  const file = path6.join(dir, "package.json");
   if (!existsSync5(file)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync5(file, "utf8"));
@@ -4570,12 +4782,12 @@ function readPackageJsonDependencies(dir) {
 }
 function hasPythonProject(dir) {
   return ["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].some(
-    (file) => existsSync5(path5.join(dir, file))
+    (file) => existsSync5(path6.join(dir, file))
   );
 }
 function readPythonDependencies(dir) {
   const found = /* @__PURE__ */ new Set();
-  const requirements = path5.join(dir, "requirements.txt");
+  const requirements = path6.join(dir, "requirements.txt");
   if (existsSync5(requirements)) {
     for (const line of readFileSync5(requirements, "utf8").split(/\r?\n/)) {
       const trimmed = line.trim();
@@ -4584,7 +4796,7 @@ function readPythonDependencies(dir) {
       if (name) found.add(normalize(name));
     }
   }
-  const pyproject = path5.join(dir, "pyproject.toml");
+  const pyproject = path6.join(dir, "pyproject.toml");
   if (existsSync5(pyproject)) {
     const text = readFileSync5(pyproject, "utf8");
     for (const match of text.matchAll(
@@ -4616,7 +4828,7 @@ function findEntryPoints(dir = process.cwd(), limit = 5) {
     "app.py",
     "src/main.py"
   ];
-  const found = candidates.filter((file) => existsSync5(path5.join(dir, file)));
+  const found = candidates.filter((file) => existsSync5(path6.join(dir, file)));
   if (found.length > 0) return found.slice(0, limit);
   try {
     return readdirSync2(dir).filter((file) => /\.(ts|js|py)$/.test(file)).slice(0, limit);
@@ -4720,7 +4932,7 @@ function scanProject(root = process.cwd()) {
   for (const relative of files) {
     let text;
     try {
-      text = readFileSync6(path6.join(root, relative), "utf8");
+      text = readFileSync6(path7.join(root, relative), "utf8");
     } catch {
       continue;
     }
@@ -5219,10 +5431,10 @@ function walk(root, dir, out2) {
     if (entry.startsWith(".") && entry !== ".") {
       continue;
     }
-    const full = path6.join(dir, entry);
+    const full = path7.join(dir, entry);
     let stats;
     try {
-      stats = statSync3(full);
+      stats = statSync4(full);
     } catch {
       continue;
     }
@@ -5232,14 +5444,14 @@ function walk(root, dir, out2) {
       continue;
     }
     if (!stats.isFile() || stats.size > MAX_FILE_BYTES) continue;
-    if (!SOURCE_EXTENSIONS.has(path6.extname(entry))) continue;
+    if (!SOURCE_EXTENSIONS.has(path7.extname(entry))) continue;
     if (/\.(test|spec)\.[cm]?[jt]sx?$|^test_.*\.py$|_test\.py$|\.d\.ts$/.test(entry)) continue;
-    out2.push(path6.relative(root, full));
+    out2.push(path7.relative(root, full));
   }
   return false;
 }
 function readProjectName(root) {
-  const pkg = path6.join(root, "package.json");
+  const pkg = path7.join(root, "package.json");
   if (existsSync6(pkg)) {
     try {
       const name = JSON.parse(readFileSync6(pkg, "utf8")).name;
@@ -5247,12 +5459,12 @@ function readProjectName(root) {
     } catch {
     }
   }
-  const pyproject = path6.join(root, "pyproject.toml");
+  const pyproject = path7.join(root, "pyproject.toml");
   if (existsSync6(pyproject)) {
     const name = /^\s*name\s*=\s*["']([^"']+)["']/m.exec(readFileSync6(pyproject, "utf8"))?.[1];
     if (name) return name.trim();
   }
-  return path6.basename(root) || null;
+  return path7.basename(root) || null;
 }
 function stringField(body, field) {
   const match = new RegExp(`\\b${field}\\s*:\\s*(['"\`])([^]{1,300}?)\\1`).exec(body);
@@ -5307,7 +5519,7 @@ function planRewrite(root, files, toolKeys) {
   for (const file of files) {
     let before;
     try {
-      before = readFileSync7(path7.join(root, file), "utf8");
+      before = readFileSync7(path8.join(root, file), "utf8");
     } catch {
       continue;
     }
@@ -6297,13 +6509,13 @@ async function integrate(root, toolKeys, options) {
     toWrite.map((file) => file.file)
   ) : null;
   for (const file of toWrite) {
-    if (readFileSync8(path8.join(root, file.file), "utf8") !== file.before) {
+    if (readFileSync8(path9.join(root, file.file), "utf8") !== file.before) {
       out(`${symbol.fail} ${file.file} changed while setup was running. Nothing was written.`);
       return { status: "declined", plan, checks: [], backupId: null, manual };
     }
   }
   const backup = createBackup(root, toWrite);
-  for (const file of toWrite) writeFilePreservingMode(path8.join(root, file.file), file.after);
+  for (const file of toWrite) writeFilePreservingMode(path9.join(root, file.file), file.after);
   out(
     `${symbol.pass} Updated ${toWrite.length} file${toWrite.length === 1 ? "" : "s"} ${style.grey(`(backup ${backup.id})`)}`
   );
@@ -6374,7 +6586,7 @@ async function integrate(root, toolKeys, options) {
 function reportSdkReadiness(root, files) {
   const problems = [];
   if (files.length === 0) return problems;
-  const dirs = [...new Set(files.map((file) => path8.dirname(file)))];
+  const dirs = [...new Set(files.map((file) => path9.dirname(file)))];
   const python = files.some((file) => file.endsWith(".py"));
   const sdks = installedSdks(root, { dirs, python });
   for (const sdk of sdks) {
@@ -6451,7 +6663,7 @@ async function removeGuards(root, options) {
   const tsFiles = changed.filter((file) => /\.(m|c)?tsx?$/.test(file));
   const baseline = tsFiles.length > 0 ? typecheck(root, tsFiles) : null;
   const backup = createBackup(root, toWrite);
-  for (const entry of toWrite) writeFilePreservingMode(path8.join(root, entry.file), entry.after);
+  for (const entry of toWrite) writeFilePreservingMode(path9.join(root, entry.file), entry.after);
   const checks = [];
   const py = changed.filter((file) => file.endsWith(".py"));
   if (py.length > 0) checks.push(pythonSyntax(root, py));
@@ -6475,7 +6687,7 @@ function currentText(root, plan, file) {
   const entry = plan.files.find((candidate) => candidate.file === file);
   if (entry) return entry.after;
   try {
-    return readFileSync8(path8.join(root, file), "utf8");
+    return readFileSync8(path9.join(root, file), "utf8");
   } catch {
     return null;
   }
@@ -6500,7 +6712,7 @@ function applyDispatch(root, plan, file, after, line, items, via) {
 function readSources(root) {
   return listSourceFiles(root).flatMap((file) => {
     try {
-      return [{ file, text: readFileSync8(path8.join(root, file), "utf8") }];
+      return [{ file, text: readFileSync8(path9.join(root, file), "utf8") }];
     } catch {
       return [];
     }
@@ -6622,7 +6834,7 @@ function printPlan(plan) {
 
 // src/commands/remove.ts
 import { rmSync as rmSync3 } from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // src/discover.ts
 var LOCAL_CANDIDATE_PORTS = [4e3, 4400, 4100, 4200, 4300, 4500, 8e3, 8080, 3e3];
@@ -6736,7 +6948,7 @@ async function removeCommand(args, flags, known) {
   if (!file || !config) {
     throw new CliError("This project is not connected to Veefore.", "There is nothing to remove.");
   }
-  const root = path9.dirname(file);
+  const root = path10.dirname(file);
   const state = known ?? await agentState(config);
   heading("Remove Veefore from this project");
   details([
@@ -7270,10 +7482,10 @@ async function resolveAuthorizedTools(context, filter) {
 
 // src/panel.ts
 import { homedir as homedir2 } from "node:os";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/version.ts
-var CLI_VERSION = "1.2.0";
+var CLI_VERSION = "1.4.1";
 
 // src/panel.ts
 function welcomeSource(flags = {}) {
@@ -7297,7 +7509,7 @@ function welcomeSource(flags = {}) {
 }
 function tilde(dir) {
   const home = homedir2();
-  return dir === home || dir.startsWith(`${home}${path10.sep}`) ? `~${dir.slice(home.length)}` : dir;
+  return dir === home || dir.startsWith(`${home}${path11.sep}`) ? `~${dir.slice(home.length)}` : dir;
 }
 function hostOf(url) {
   try {
@@ -7637,1542 +7849,1640 @@ function sourceLabel(source) {
   }
 }
 
-// src/commands/init.ts
-var DEFAULT_GATEWAY = "http://localhost:4010";
-async function initCommand(args, flags) {
-  const options = parseInitArgs(args);
-  const existing = readProjectConfig();
-  if (existing && !options.force && isInteractive() && !flags.json) {
-    return projectHome(existing, flags);
-  }
-  if (existing && !options.force) {
-    out();
-    out(`${symbol.warn} This project is already connected to Veefore.`);
-    details([
-      ["Agent", `${existing.agentName} (${existing.agentId})`],
-      ["Environment", `${existing.environmentName} (${existing.environmentType})`],
-      ["Control plane", existing.controlPlaneUrl]
-    ]);
-    out();
-    out(style.grey("Re-run with --force to replace the configuration, or use `veefore status`."));
+// src/commands/scan.ts
+async function scanCommand(_args, flags) {
+  const scan = scanProject(process.cwd());
+  if (flags.json) {
+    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
     return 0;
   }
-  heading("Veefore init");
-  const framework = detectFramework();
+  heading("Veefore scan");
   out(
-    `${symbol.pass} Framework: ${style.bold(framework.name)} ${style.grey(`(${framework.language}, matched ${framework.evidence})`)}`
+    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
   );
-  if (framework.key === "unknown") {
-    out(
-      style.grey(
-        "  No manifest was found. Veefore will still work; the integration snippet defaults to TypeScript."
-      )
-    );
-  }
-  const found = await locateControlPlane(options.controlPlaneUrl ?? flags.controlPlaneUrl);
-  const controlPlaneUrl = found.controlPlaneUrl;
-  if (found.source !== "entered") {
-    out(
-      `${symbol.pass} Veefore: ${style.bold(controlPlaneUrl)} ${style.grey(`(${found.source})`)}`
-    );
-  }
-  let session = loadSession(controlPlaneUrl);
-  if (!session) {
-    await login(controlPlaneUrl);
-    session = loadSession(controlPlaneUrl);
-  }
-  if (!session) throw new CliError("Sign-in did not produce a usable session.");
-  const api = new ApiClient({ controlPlaneUrl, token: session.token });
-  let me = await api.get("/v1/auth/session");
-  const STEPS = ["organization", "workspace", "environment"];
-  const asked = /* @__PURE__ */ new Map();
-  let organization;
-  let workspace;
-  let environment;
-  for (let at = 0; at < STEPS.length; ) {
-    const step = STEPS[at];
-    const answer = step === "organization" ? await selectOrganization(api, me, options, flags) : step === "workspace" ? await selectWorkspace(api, me, options, flags) : await selectEnvironment(api, me, workspace.id, options, flags);
-    if (answer === BACK) {
-      let previous = at - 1;
-      while (previous >= 0 && !asked.get(STEPS[previous])) previous -= 1;
-      if (previous < 0) {
-        throw new MenuCancelled();
-      }
-      at = previous;
-      continue;
-    }
-    asked.set(step, answer.asked);
-    if (step === "organization") {
-      organization = answer.value;
-      if (answer.asked) me = await api.get("/v1/auth/session");
-    } else if (step === "workspace") {
-      workspace = answer.value;
-    } else {
-      environment = answer.value;
-    }
-    at += 1;
-  }
-  heading("Looking at your project");
-  const scan = scanProject(process.cwd());
   printScan(scan);
-  const plan = buildPlan(scan, {
-    agentName: options.agentName,
-    extraCapabilities: options.capabilities
-  });
-  for (; ; ) {
-    if (!options.agentName && !flags.yes) {
-      const name = await askAgentName(plan.agentName);
-      if (name === BACK) {
-        const again = await selectEnvironment(api, me, workspace.id, options, flags);
-        if (again !== BACK) environment = again.value;
-        continue;
-      }
-      plan.agentName = name;
-    }
-    printPlan2(plan, environment);
-    out();
-    const proceed = await confirm("Set this up?", { yes: flags.yes });
-    if (proceed) break;
-    if (flags.yes || options.agentName) {
-      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
-      return 1;
-    }
-    const next = await select(
-      "What would you like to do?",
+  out();
+  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
+  return 0;
+}
+
+// src/help.ts
+var COMMANDS = [
+  {
+    name: "init",
+    summary: "Set up this project with Veefore. Also runs as plain `veefore`.",
+    usage: "veefore init [options]",
+    description: "Connects to hosted Veefore, or to the self-hosted Veefore named with --control-plane (remembered afterwards), signs you in through the browser, scans the project locally (framework, tools, the hosts they call, the credentials they read \u2014 names only, never values), shows what it will set up and asks once. It then creates an agent with a key pair generated on this machine, registers each tool with its own capability and authorizes it for this agent, adds a starter policy in OBSERVE mode, writes veefore.config.json and .env.local, and validates the connection. The private key is written to .env.local only and is never sent, printed or recoverable.",
+    options: [
+      ["--force", "Replace an existing veefore.config.json."],
       [
-        { label: "Change the agent name", value: "name" },
-        { label: "Choose a different environment", value: "environment" },
-        { label: "Leave setup", value: "leave" }
+        "--new-agent",
+        "Create a separate agent even if one with this name exists. By default the existing agent is reused with a new key, so its delegations and limits keep applying."
       ],
-      { initial: 0 }
-    );
-    if (next === "leave") {
-      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
-      return 1;
-    }
-    if (next === "environment") {
-      const again = await selectEnvironment(api, me, workspace.id, options, flags);
-      if (again !== BACK) environment = again.value;
-    }
-  }
-  heading("Setting up");
-  let created;
-  try {
-    created = await applyPlan(
-      api,
-      plan,
-      {
-        workspaceId: workspace.id,
-        environmentId: environment.id,
-        framework: framework.key === "unknown" ? null : framework.key
-      },
-      void 0,
-      { newAgent: options.newAgent === true }
-    );
-  } catch (error) {
-    if (error instanceof CliApiError && error.code === "PERMISSION_DENIED") {
-      throw new CliError(
-        "Your role cannot set up agents in this workspace.",
-        'Ask an owner or admin for the "agent:create" and "tool:create" permissions.'
-      );
-    }
-    throw error;
-  }
-  let gatewayUrl = options.gatewayUrl ?? flags.gatewayUrl ?? process.env.VEEFORE_GATEWAY_URL;
-  if (!gatewayUrl) {
-    const published = (await controlPlaneInfo(controlPlaneUrl)).gatewayUrl;
-    if (published && await gatewayReachable(published)) {
-      gatewayUrl = published;
-      out(
-        `${symbol.pass} Gateway: ${style.bold(published)} ${style.grey("(published by the control plane)")}`
-      );
-    } else {
-      const suggestion = published ?? DEFAULT_GATEWAY;
-      out(
-        `${symbol.warn} ${published ? `The gateway at ${published} is not answering.` : "The control plane did not publish a gateway address."}`
-      );
-      gatewayUrl = await ask(`Gateway URL ${style.grey(`[${suggestion}]`)}:`, suggestion);
-    }
+      ["--control-plane <url>", "Self-hosted Veefore address. Needed once; remembered after."],
+      ["--gateway <url>", "Gateway base URL that agents will call."],
+      ["--organization <id>", "Skip the organization prompt."],
+      ["--workspace <id>", "Skip the workspace prompt."],
+      ["--environment <id>", "Skip the environment prompt."],
+      ["--name <name>", "Agent display name."],
+      ["--capability <key>", "Grant a capability. Repeatable."],
+      ["--skip-policy", "Do not create a starter policy."],
+      ["--skip-code", "Do not offer to change your code; run `veefore integrate` later."],
+      [
+        "--approval-mode <wait|throw>",
+        "When approval is required, guarded tools wait for the decision (default) or return at once."
+      ]
+    ],
+    examples: ["veefore init", "veefore init --name finance-agent --capability refund.create"]
+  },
+  {
+    name: "scan",
+    summary: "Preview what setup would find, without changing anything.",
+    usage: "veefore scan [--json]",
+    description: "Scans the project locally and lists its framework, tools, the external hosts each tool calls and the credentials the code reads. Reads source files only: .env files and other hidden files are never opened, and secret values are never read. Needs no sign-in.",
+    options: [["--json", "Machine-readable scan and the setup plan it implies."]]
+  },
+  {
+    name: "integrate",
+    summary: "Wrap your registered tools in guard() so Veefore decides every call.",
+    usage: "veefore integrate [--dry-run] [--check] [--assist=manual|own|veefore|off] [--yes]",
+    description: "Finds each tool registered for this agent in your code and wraps its function in guard() (TypeScript/JavaScript) or adds @guard above it (Python). Your function bodies are not edited. Shows a diff and asks before writing, backs up every file it changes, then runs your TypeScript compiler (--noEmit), node --check or a Python syntax check; if a check newly fails, every file is restored automatically. For tools it will not change on its own, you choose: make the change yourself from exact instructions, use AI with your own Anthropic or OpenAI key (code goes only to that provider), or use Veefore AI if enabled. Before anything is sent, secrets are replaced with placeholders and you see what goes where and must agree; an AI change is accepted only if it keeps every line of your code and adds nothing but the guard, and you still review the diff.",
+    options: [
+      ["--dry-run", "Show the diff and write nothing."],
+      ["--check", "Report which registered tools are guarded in the code. Exits 1 if any are not."],
+      ["--assist=<how>", "manual (default when not interactive), own, veefore, or off."],
+      ["--yes", "Apply without asking."]
+    ],
+    examples: [
+      "veefore integrate --dry-run",
+      "veefore integrate --assist=manual",
+      "ANTHROPIC_API_KEY=\u2026 veefore integrate --assist=own",
+      "veefore integrate --check"
+    ]
+  },
+  {
+    name: "undo",
+    summary: "Restore the files the last `veefore integrate` changed.",
+    usage: "veefore undo [--force]",
+    description: "Restores each file from the backup taken before the last rewrite. A file you edited afterwards is left alone and listed, unless --force is given.",
+    options: [["--force", "Restore files even if they were edited after the rewrite."]]
+  },
+  {
+    name: "remove",
+    summary: "Take Veefore out of this project: guard() from the code, then disconnect.",
+    usage: "veefore remove [--dry-run] [--keep-agent]",
+    description: "Offers to revoke the agent in Veefore if it is still active, removes every guard() this CLI added (showing the diff, asking once, backing up and rolling back if your checks fail), then deletes veefore.config.json and the Veefore block in .env.local, including the private key. Edits you made after setup are kept. `veefore` offers this automatically when the agent was revoked in the console.",
+    options: [
+      ["--dry-run", "Show what would change and write nothing."],
+      ["--keep-agent", "Do not offer to revoke the agent in Veefore."]
+    ],
+    examples: ["veefore remove --dry-run", "veefore remove"]
+  },
+  {
+    name: "dev",
+    summary: "Watch decisions live while you build.",
+    usage: "veefore dev [--all]",
+    description: "Confirms the gateway is reachable, reports the enforcement mode, then streams every decision for this agent with the next concrete step for each outcome.",
+    options: [["--all", "Stream decisions for every agent in the environment."]]
+  },
+  {
+    name: "doctor",
+    summary: "Audit the security posture of this setup.",
+    usage: "veefore doctor [--strict]",
+    description: "Checks authentication, MFA, TLS, local secret permissions, identity and passport validity, gateway health, dangerous tools, network restrictions, policy coverage, production data access, MCP transport and authorization, audit chain integrity, credential rotation, and SDK version alignment.",
+    options: [["--strict", "Exit non-zero on warnings as well as failures."]]
+  },
+  {
+    name: "status",
+    summary: "Show the current environment, mode and agent health.",
+    usage: "veefore status",
+    description: "Prints the active organization, workspace and environment, the enforcement mode, the agent lifecycle state, gateway health, and the last few decisions."
+  },
+  {
+    name: "test",
+    summary: "Verify enforcement works, without performing any action.",
+    usage: "veefore test [--tool <key>]",
+    description: "Runs a dry-run probe across every tool this agent is authorized for, checks that policy test cases pass, and fails if a dangerous tool is permitted only by the default decision. Suitable as a CI gate.",
+    options: [["--tool <key>", "Probe a single tool."]]
+  },
+  {
+    name: "agents",
+    summary: "Inspect and control the agent fleet.",
+    usage: "veefore agents <list|show|pause|resume|suspend|revoke|rotate-key> [agentId]",
+    description: "Lifecycle control. `revoke` is irreversible for the identity and shows the full blast radius before asking for confirmation. `rotate-key` issues a new key pair and invalidates every outstanding session for that agent.",
+    options: [
+      ["--all", "List across the whole organization, not just this environment."],
+      ["--status <status>", "Filter by lifecycle status."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."]
+    ],
+    examples: [
+      "veefore agents list",
+      'veefore agents revoke agt_01ABC --reason "Key suspected compromised"'
+    ]
+  },
+  {
+    name: "policies",
+    summary: "List, test and deploy policies.",
+    usage: "veefore policies <list|show|test|deploy|diff> [policyId]",
+    description: "`test` runs the recorded test cases. `deploy` activates a version and refuses to do so while any test case fails; it requires a reason and step-up authentication.",
+    options: [
+      ["--version <n>", "Version to deploy, for `deploy`."],
+      ["--from <n> --to <n>", "Versions to compare, for `diff`."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."]
+    ],
+    examples: [
+      "veefore policies list",
+      "veefore policies test",
+      "veefore policies deploy pol_01ABC"
+    ]
+  },
+  {
+    name: "logs",
+    summary: "Read or stream the decision log.",
+    usage: "veefore logs [--follow] [--decision <d>] [--limit <n>]",
+    description: "Every line is a server-side decision with the policy and rule that produced it.",
+    options: [
+      ["--follow, -f", "Stream new decisions as they happen."],
+      ["--decision <d>", "Filter by decision, e.g. BLOCK."],
+      ["--agent <id>", "Filter by agent."],
+      ["--all", "Include every agent in the environment."],
+      ["--limit <n>", "Number of recent decisions to show."]
+    ]
+  },
+  {
+    name: "audit",
+    summary: "Query, verify and export the audit trail.",
+    usage: "veefore audit <list|show|verify|export> [eventId]",
+    description: "`verify` re-checks the hash chain and exits non-zero if it is broken. `export` returns a JSON or CSV file together with a content hash an auditor can use to prove the file is unaltered.",
+    options: [
+      ["--severity <s>", "Filter by severity."],
+      ["--type <t>", "Filter by event type."],
+      ["--from <iso> --to <iso>", "Time range."],
+      ["--format <json|csv>", "Export format."],
+      ['--reason "<text>"', "Why this export is being taken. Recorded in the audit trail."],
+      ["--out <file>", "Write the export to a file (mode 0600)."]
+    ],
+    examples: [
+      "veefore audit verify",
+      'veefore audit export --format csv --reason "Quarterly SOC 2 evidence" --out audit.csv'
+    ]
+  },
+  {
+    name: "deploy",
+    summary: "Promote the environment to enforcement.",
+    usage: "veefore deploy [--mode ENFORCE|SIMULATE|OBSERVE]",
+    description: "Runs preflight checks, replays recent observed traffic to show exactly what starts being refused, then requires confirmation, a reason and step-up authentication. Reducing enforcement always requires a reason and is recorded as a CRITICAL audit event.",
+    options: [
+      ["--mode <mode>", "Target mode. Defaults to ENFORCE."],
+      ['--reason "<text>"', "Reason recorded in the audit trail."],
+      ["--skip-preflight", "Incident use only. Recorded in the audit reason."]
+    ]
+  },
+  {
+    name: "login",
+    summary: "Sign in through your browser and store a session token.",
+    usage: "veefore login [--device] [--password] [--control-plane <url>]",
+    description: "Opens the console in your browser, where you sign in (or create an account) and approve this terminal. The terminal never sees your password. Over SSH, or with --device, it prints a link and a code to enter in any browser instead. Only the resulting session token is stored, in ~/.veefore/credentials.json at mode 0600, and the session can be revoked from your profile. In CI, set VEEFORE_EMAIL and VEEFORE_PASSWORD.",
+    options: [
+      ["--device", "Show a link and a code instead of opening a browser here."],
+      ["--password", "Type email and password in the terminal instead of using the browser."]
+    ]
+  },
+  {
+    name: "logout",
+    summary: "Sign out of Veefore on this machine.",
+    usage: "veefore logout [--all]",
+    description: 'Ends the session on the server and deletes the stored token. Signing out of the console with "Also sign out of the Veefore CLI" ticked does the same for every terminal you approved; the next command here then says you were signed out and asks you to sign in again.',
+    options: [["--all", "Sign out of every control plane this machine is signed in to."]]
   }
-  gatewayUrl = normalizeUrl(gatewayUrl);
-  const config = {
-    version: 1,
-    controlPlaneUrl,
-    gatewayUrl,
-    organizationId: organization.id,
-    organizationName: organization.name,
-    workspaceId: workspace.id,
-    workspaceName: workspace.name,
-    environmentId: environment.id,
-    environmentName: environment.name,
-    environmentType: environment.type,
-    agentId: created.agentId,
-    agentName: created.agentName,
-    keyId: created.keyId,
-    framework: framework.key === "unknown" ? null : framework.key,
-    declaredTools: created.tools.map((tool) => tool.key),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const configFile = writeProjectConfig(config);
+];
+var GLOBAL_OPTIONS = [
+  ["--json", "Machine-readable output."],
+  ["--yes, -y", "Assume yes for confirmations. Never skips step-up authentication."],
+  ["--verbose", "Expanded output."],
+  [
+    "--control-plane <url>",
+    "Use this Veefore instead of the one found automatically (hosted, or the last you signed in to)."
+  ],
+  ["--gateway <url>", "Override the configured gateway URL."],
+  ["--version, -V", "Print the CLI version."],
+  ["--help, -h", "Show help."]
+];
+function printRootHelp(version) {
+  out();
   out(
-    `${symbol.pass} Wrote ${style.bold("veefore.config.json")} ${style.grey("(safe to commit)")}`
+    `${style.bold("veefore")} ${style.grey(version)} \u2014 identity, authority and policy for AI agents`
   );
-  const audience = await discoverAudience(gatewayUrl);
-  ensureGitignore(process.cwd(), [".env.local", ".veefore/"]);
-  const approvalMode = options.approvalMode ?? previousApprovalMode() ?? "wait";
-  const envFile = writeLocalEnv({
-    VEEFORE_GATEWAY_URL: gatewayUrl,
-    VEEFORE_GATEWAY_AUDIENCE: audience,
-    VEEFORE_AGENT_ID: created.agentId,
-    VEEFORE_AGENT_KEY_ID: created.keyId,
-    VEEFORE_AGENT_PRIVATE_KEY: created.privateKey,
-    ...created.tools.length > 0 ? { VEEFORE_DECLARED_TOOLS: created.tools.map((tool) => tool.key).join(",") } : {},
-    // Written explicitly so the behaviour is visible and editable in one place.
-    VEEFORE_APPROVAL_MODE: approvalMode
-  });
-  if (audience !== gatewayUrl) {
-    out(
-      `${symbol.info} Gateway audience is ${style.bold(audience)} ${style.grey(
-        `(it reports this, rather than the ${gatewayUrl} you dialled)`
-      )}`
-    );
+  out();
+  out(style.bold("USAGE"));
+  out("  veefore <command> [options]");
+  out();
+  out(style.bold("COMMANDS"));
+  const width = Math.max(...COMMANDS.map((command) => command.name.length));
+  for (const command of COMMANDS) {
+    out(`  ${style.cyan(command.name.padEnd(width))}  ${command.summary}`);
   }
-  out(
-    `${symbol.pass} Wrote agent credentials to ${style.bold(".env.local")} ${style.grey("(mode 0600, gitignored)")}`
-  );
   out();
+  out(style.bold("GLOBAL OPTIONS"));
+  renderOptions(GLOBAL_OPTIONS);
+  out();
+  out(style.bold("GETTING STARTED"));
   out(
-    `  ${style.amber("The private key was generated here and written to that file only.")} Veefore`
+    `  ${style.grey("1.")} veefore          ${style.grey("sign in, scan, set up and protect this project")}`
   );
   out(
-    `  never received it and cannot recover it. Move it into your secret manager before deploying.`
+    `  ${style.grey("2.")} veefore dev      ${style.grey("watch what your agent actually does")}`
   );
-  out(`  ${style.grey(`Fingerprint: ${created.fingerprint}`)}`);
-  await configureStarterPolicy(api, workspace.id, flags, options);
-  let integrated = false;
-  if (created.tools.length > 0 && !options.skipCode) {
-    const outcome = await integrate(
-      process.cwd(),
-      created.tools.map((tool) => tool.key),
-      { yes: flags.yes, quiet: flags.json, api }
-    );
-    integrated = outcome.status === "applied" || outcome.status === "nothing-to-do";
-  }
-  heading("Validating the connection");
-  const checks = await validateConnection(api, gatewayUrl, created.agentId, environment.id);
-  for (const check of checks) {
-    const icon = check.status === "pass" ? symbol.pass : check.status === "warn" ? symbol.warn : symbol.fail;
-    out(`${icon} ${check.name}${check.message ? style.grey(` \u2014 ${check.message}`) : ""}`);
+  out(`  ${style.grey("3.")} veefore doctor   ${style.grey("check the security posture")}`);
+  out(`  ${style.grey("4.")} veefore deploy   ${style.grey("turn enforcement on")}`);
+  out();
+  out(style.grey("  Run `veefore <command> --help` for detail on any command."));
+  out();
+}
+function printCommandHelp(name) {
+  const command = COMMANDS.find((entry) => entry.name === name);
+  if (!command) return false;
+  out();
+  out(`${style.bold(`veefore ${command.name}`)} \u2014 ${command.summary}`);
+  out();
+  out(style.bold("USAGE"));
+  out(`  ${command.usage}`);
+  out();
+  out(style.bold("DESCRIPTION"));
+  for (const line of wrap2(command.description, 76)) out(`  ${line}`);
+  if (command.options && command.options.length > 0) {
+    out();
+    out(style.bold("OPTIONS"));
+    renderOptions(command.options);
   }
-  const failed = checks.filter((check) => check.status === "fail");
-  if (!integrated) {
-    heading("Protect each tool");
+  if (command.examples && command.examples.length > 0) {
     out();
-    for (const line of integrationSnippet(framework).split("\n")) {
-      out(`  ${style.cyan(line)}`);
-    }
-    const entryPoints = findEntryPoints();
-    if (entryPoints.length > 0) {
-      out();
-      out(
-        style.grey(
-          `  Likely entry point${entryPoints.length > 1 ? "s" : ""}: ${entryPoints.join(", ")}`
-        )
-      );
-    }
-    if (created.tools.length > 0) {
-      out(style.grey("  Or let Veefore wrap your tools for you: `veefore integrate`."));
+    out(style.bold("EXAMPLES"));
+    for (const example of command.examples) out(`  ${style.grey("$")} ${example}`);
+  }
+  out();
+  return true;
+}
+function renderOptions(options) {
+  const width = Math.max(...options.map(([flag]) => flag.length));
+  for (const [flag, description] of options) {
+    out(`  ${style.cyan(flag.padEnd(width))}  ${description}`);
+  }
+}
+function wrap2(text, width) {
+  const words2 = text.split(/\s+/);
+  const lines = [];
+  let current = "";
+  for (const word of words2) {
+    if (current.length + word.length + 1 > width) {
+      lines.push(current);
+      current = word;
+    } else {
+      current = current === "" ? word : `${current} ${word}`;
     }
   }
-  heading("When a human must approve");
-  for (const line of approvalModeExplanation(approvalMode)) out(line);
-  heading("Next");
-  out(`  ${symbol.bullet} ${style.bold("veefore dev")}     watch decisions live while you build`);
-  out(
-    `  ${symbol.bullet} ${style.bold("veefore doctor")}  check the security posture of this setup`
-  );
-  out(`  ${symbol.bullet} ${style.bold("veefore status")}  see the current mode and agent health`);
+  if (current !== "") lines.push(current);
+  return lines;
+}
+
+// src/home.ts
+async function homeCommand(args, flags) {
+  enterApp();
+  try {
+    return await homeLoop(args, flags);
+  } finally {
+    leaveApp();
+    printFarewell();
+  }
+}
+var farewellPrinted = false;
+function printFarewell() {
+  if (!isInteractive() || inApp() || farewellPrinted) return;
+  const project = readProjectConfig();
+  if (!project) return;
+  farewellPrinted = true;
   out();
   out(
-    style.grey(
-      `  This environment is in ${environment.gatewayMode ?? "OBSERVE"} mode. Nothing is blocked yet.`
-    )
+    `${brand(style.bold("Veefore"))} ${style.grey("\xB7")} ${style.bold(project.agentName)} ${style.grey(`\xB7 ${project.environmentName} \xB7 ${project.controlPlaneUrl}`)}`
   );
-  out(style.grey("  Review the recommended policy, simulate it, then switch to ENFORCE."));
+  out(style.grey("  veefore dev      watch decisions live"));
+  out(style.grey("  veefore doctor   check the security posture"));
+  out(style.grey("  veefore          open this again"));
   out();
-  if (flags.json) {
-    out(
-      JSON.stringify(
-        {
-          config_file: configFile,
-          env_file: envFile,
-          agent_id: created.agentId,
-          key_id: created.keyId,
-          fingerprint: created.fingerprint,
-          tools: created.tools,
-          checks
-        },
-        null,
-        2
-      )
-    );
-  }
-  return failed.length > 0 ? 1 : 0;
 }
-function previousApprovalMode(dir = process.cwd()) {
-  try {
-    const text = readFileSync9(path11.join(dir, ".env.local"), "utf8");
-    const value = /^\s*VEEFORE_APPROVAL_MODE\s*=\s*['"]?(\w+)/m.exec(text)?.[1]?.toLowerCase();
-    return value === "wait" || value === "throw" ? value : null;
-  } catch {
-    return null;
+async function homeLoop(args, flags) {
+  const source = welcomeSource(flags);
+  let first = true;
+  for (; ; ) {
+    if (readProjectConfig()) return initCommand(args, flags);
+    const body = () => {
+      drawScreen(source);
+      out();
+      out(style.bold("Let's get started."));
+      out();
+    };
+    await beginScreen(source, { animate: first });
+    first = false;
+    out();
+    out(style.bold("Let's get started."));
+    out();
+    let action;
+    try {
+      action = await select(
+        "What would you like to do?",
+        [
+          { label: "Set up this project", hint: "recommended \xB7 veefore init", value: "setup" },
+          {
+            label: "Preview what setup would find",
+            hint: "veefore scan \xB7 changes nothing",
+            value: "scan"
+          },
+          { label: "Sign in", hint: "veefore login", value: "login" },
+          { label: "Show every command", hint: "veefore help", value: "help" },
+          { label: "Exit", hint: "esc", value: "exit" }
+        ],
+        { redraw: body }
+      );
+    } catch (error) {
+      if (error instanceof MenuCancelled) return 0;
+      throw error;
+    }
+    if (action === "exit") return 0;
+    if (action === "setup") {
+      await runOnScreen(source, flags, () => initCommand(args, flags), {
+        // Setup done: "Continue", and the next pass opens the project home
+        // with the panel filled in. Otherwise "Back to menu", to read why and
+        // choose again.
+        label: () => readProjectConfig() ? "Continue" : "Back to menu",
+        // Setup asks questions and draws its own screens as it goes, so it has
+        // to reach the terminal as it runs. Collecting it would hold those
+        // screens back and then print them all at once.
+        live: true
+      });
+      continue;
+    }
+    const code = await runOnScreen(source, flags, async () => {
+      switch (action) {
+        case "scan":
+          return scanCommand([], flags);
+        case "login":
+          await login(resolveControlPlaneUrl(flags.controlPlaneUrl));
+          return 0;
+        case "help":
+          printRootHelp(source().version);
+          return 0;
+      }
+      return 0;
+    });
+    if (!isInteractive()) return code;
   }
 }
-function approvalModeExplanation(mode) {
-  if (mode === "wait") {
-    return [
-      `  Guarded tools ${style.bold("wait")} for the reviewer's decision, then:`,
-      `    ${symbol.bullet} approved: the tool runs once and returns its real result`,
-      `    ${symbol.bullet} denied, cancelled or expired: it fails with that reason, and nothing runs`,
-      style.grey(
-        "  The agent process must stay running while it waits (up to the approval's expiry)."
-      ),
-      style.grey(
-        "  For chat agents that should hand the question back instead, set VEEFORE_APPROVAL_MODE=throw"
-      ),
-      style.grey("  in .env.local, or pass { waitForApproval: false } to a single guard().")
-    ];
-  }
-  return [
-    `  Guarded tools ${style.bold("return immediately")} with "approval required" (VeeforeApprovalRequiredError),`,
-    "  carrying the approval id. Your agent must resubmit the same call after a reviewer approves,",
-    "  or the action never happens.",
-    style.grey("  To wait for the decision instead, set VEEFORE_APPROVAL_MODE=wait in .env.local.")
-  ];
+async function initWithWelcome(args, flags) {
+  await beginScreen(welcomeSource(flags), { animate: true });
+  return initCommand(args, flags);
 }
-async function selectOrganization(api, me, options, flags) {
-  const organizations = me.organizations.length > 0 ? me.organizations : [
-    {
-      id: me.organization.id,
-      name: me.organization.name,
-      slug: me.organization.slug,
-      roleKey: me.roleKey
-    }
-  ];
-  if (options.organizationId) {
-    const match = organizations.find((org) => org.id === options.organizationId);
-    if (!match) {
-      throw new CliError(
-        `You are not a member of organization ${options.organizationId}.`,
-        `Available: ${organizations.map((org) => org.id).join(", ")}`
-      );
+async function runOnScreen(source, flags, run2, options = {}) {
+  const header = () => drawScreen(source);
+  if (options.live) {
+    header();
+    let code2 = 0;
+    try {
+      code2 = await run2();
+    } catch (error) {
+      code2 = error instanceof MenuCancelled ? 0 : reportError(error, flags);
     }
-    return { value: match, asked: false };
+    const label2 = options.label ?? "Back";
+    await pressBack(typeof label2 === "function" ? label2() : label2);
+    return code2;
   }
-  if (organizations.length === 1 || flags.yes) {
-    const chosen2 = organizations[0];
-    if (!chosen2) throw new CliError("Your account is not a member of any organization.");
-    out(`${symbol.pass} Organization: ${style.bold(chosen2.name)}`);
-    return { value: chosen2, asked: false };
+  beginCapture();
+  let code = 0;
+  try {
+    code = await run2();
+  } catch (error) {
+    code = error instanceof MenuCancelled ? 0 : reportError(error, flags);
   }
-  out();
-  const chosen = await select(
-    "Which organization?",
-    organizations.map((org) => ({
-      label: org.name,
-      hint: `${org.roleKey} \xB7 ${org.id}`,
-      value: org
-    })),
-    { quiet: true, back: true, backLabel: "Back" }
-  );
-  if (chosen === BACK) return BACK;
-  await api.post("/v1/auth/scope", { organization_id: chosen.id });
-  out(`${symbol.pass} Organization: ${style.bold(chosen.name)}`);
-  return { value: chosen, asked: true };
+  const lines = endCapture();
+  const label = options.label ?? "Back";
+  await showOutput(lines, {
+    drawHeader: header,
+    label: typeof label === "function" ? label() : label
+  });
+  return code;
 }
-async function selectWorkspace(api, me, options, flags) {
-  const workspaces = me.workspaces.length > 0 ? me.workspaces : await api.get("/v1/workspaces");
-  if (workspaces.length === 0) {
-    throw new CliError(
-      "This organization has no workspaces.",
-      "Create one in the console, or ask an admin to."
-    );
+
+// src/commands/init.ts
+var DEFAULT_GATEWAY = "http://localhost:4010";
+async function initCommand(args, flags) {
+  const options = parseInitArgs(args);
+  const existing = readProjectConfig();
+  if (existing && !options.force && isInteractive() && !flags.json) {
+    return projectHome(existing, flags);
   }
-  if (options.workspaceId) {
-    const match = workspaces.find((workspace) => workspace.id === options.workspaceId);
-    if (!match) throw new CliError(`Workspace ${options.workspaceId} was not found.`);
-    return { value: match, asked: false };
-  }
-  if (workspaces.length === 1 || flags.yes) {
-    const chosen2 = workspaces[0];
-    out(`${symbol.pass} Workspace: ${style.bold(chosen2.name)}`);
-    return { value: chosen2, asked: false };
+  if (existing && !options.force) {
+    out();
+    out(`${symbol.warn} This project is already connected to Veefore.`);
+    details([
+      ["Agent", `${existing.agentName} (${existing.agentId})`],
+      ["Environment", `${existing.environmentName} (${existing.environmentType})`],
+      ["Control plane", existing.controlPlaneUrl]
+    ]);
+    out();
+    out(style.grey("Re-run with --force to replace the configuration, or use `veefore status`."));
+    return 0;
   }
-  out();
-  const chosen = await select(
-    "Which workspace?",
-    workspaces.map((workspace) => ({
-      label: workspace.name,
-      hint: workspace.id,
-      value: workspace
-    })),
-    { quiet: true, back: true }
+  heading("Veefore init");
+  const framework = detectFramework();
+  out(
+    `${symbol.pass} Framework: ${style.bold(framework.name)} ${style.grey(`(${framework.language}, matched ${framework.evidence})`)}`
   );
-  if (chosen === BACK) return BACK;
-  out(`${symbol.pass} Workspace: ${style.bold(chosen.name)}`);
-  return { value: chosen, asked: true };
-}
-async function selectEnvironment(api, me, workspaceId, options, flags) {
-  const all = me.environments.length > 0 ? me.environments : await api.get("/v1/environments", { workspace_id: workspaceId });
-  const environments = all.filter((environment) => environment.workspaceId === workspaceId);
-  if (environments.length === 0) {
-    throw new CliError(
-      "That workspace has no environments.",
-      "Create one in the console, or ask an admin to."
+  if (framework.key === "unknown") {
+    out(
+      style.grey(
+        "  No manifest was found. Veefore will still work; the integration snippet defaults to TypeScript."
+      )
     );
   }
-  if (options.environmentId) {
-    const match = environments.find((environment) => environment.id === options.environmentId);
-    if (!match) throw new CliError(`Environment ${options.environmentId} was not found.`);
-    return { value: match, asked: false };
+  const found = await locateControlPlane(options.controlPlaneUrl ?? flags.controlPlaneUrl);
+  const controlPlaneUrl = found.controlPlaneUrl;
+  if (found.source !== "entered") {
+    out(
+      `${symbol.pass} Veefore: ${style.bold(controlPlaneUrl)} ${style.grey(`(${found.source})`)}`
+    );
   }
-  if (flags.yes) {
-    const chosen = environments.find((environment) => environment.type === "DEVELOPMENT") ?? environments[0];
-    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
-    return { value: chosen, asked: false };
+  let session = loadSession(controlPlaneUrl);
+  if (!session) {
+    await login(controlPlaneUrl);
+    session = loadSession(controlPlaneUrl);
   }
-  const development = environments.findIndex((environment) => environment.type === "DEVELOPMENT");
-  for (; ; ) {
-    out();
-    const chosen = await select(
-      "Which environment?",
-      environments.map((environment) => ({
-        label: environment.name,
-        hint: `${environment.type} \xB7 ${environment.gatewayMode ?? "\u2014"} \xB7 ${environment.id}`,
-        value: environment
-      })),
-      { quiet: true, initial: development >= 0 ? development : 0, back: true }
-    );
-    if (chosen === BACK) return BACK;
-    if (chosen.type === "PRODUCTION" && !options.force) {
-      out();
-      out(
-        `${symbol.warn} ${style.amber("You selected a PRODUCTION environment.")} A new agent here starts in ${style.bold("OBSERVE")} mode and performs no enforcement until you switch it.`
-      );
-      if (!await confirm("Continue with the production environment?", { yes: flags.yes })) {
-        out(style.grey("  Choose another environment."));
+  if (!session) throw new CliError("Sign-in did not produce a usable session.");
+  const api = new ApiClient({ controlPlaneUrl, token: session.token });
+  let me = await api.get("/v1/auth/session");
+  const STEPS = ["organization", "workspace", "environment"];
+  const asked = /* @__PURE__ */ new Map();
+  let organization;
+  let workspace;
+  let environment;
+  const source = welcomeSource(flags);
+  const decided = [];
+  enterApp();
+  try {
+    for (let at = 0; at < STEPS.length; ) {
+      const step = STEPS[at];
+      decided.length = at;
+      await stepScreen(source, decided, at + 1, STEPS.length);
+      const answer = step === "organization" ? await selectOrganization(api, me, options, flags) : step === "workspace" ? await selectWorkspace(api, me, options, flags) : await selectEnvironment(api, me, workspace.id, options, flags);
+      if (answer === BACK) {
+        let previous = at - 1;
+        while (previous >= 0 && !asked.get(STEPS[previous])) previous -= 1;
+        if (previous < 0) {
+          throw new MenuCancelled();
+        }
+        at = previous;
         continue;
       }
+      asked.set(step, answer.asked);
+      if (step === "organization") {
+        organization = answer.value;
+        decided[at] = ["Organization", organization.name];
+        if (answer.asked) me = await api.get("/v1/auth/session");
+      } else if (step === "workspace") {
+        workspace = answer.value;
+        decided[at] = ["Workspace", workspace.name];
+      } else {
+        environment = answer.value;
+        decided[at] = ["Environment", `${environment.name} (${environment.type})`];
+      }
+      at += 1;
     }
-    out(`${symbol.pass} Environment: ${style.bold(chosen.name)} (${chosen.type})`);
-    return { value: chosen, asked: true };
+  } finally {
+    leaveApp();
   }
-}
-async function askAgentName(suggested) {
+  for (const [label, value] of decided) {
+    out(`${symbol.pass} ${label}: ${style.bold(value)}`);
+  }
+  heading("Looking at your project");
+  const scan = scanProject(process.cwd());
+  printScan(scan);
+  const plan = buildPlan(scan, {
+    agentName: options.agentName,
+    extraCapabilities: options.capabilities
+  });
   for (; ; ) {
+    if (!options.agentName && !flags.yes) {
+      const name = await askAgentName(plan.agentName);
+      if (name === BACK) {
+        const again = await selectEnvironment(api, me, workspace.id, options, flags);
+        if (again !== BACK) environment = again.value;
+        continue;
+      }
+      plan.agentName = name;
+    }
+    printPlan2(plan, environment);
     out();
-    const choice = await select(
-      "Agent name",
+    const proceed = await confirm("Set this up?", { yes: flags.yes });
+    if (proceed) break;
+    if (flags.yes || options.agentName) {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    const next = await select(
+      "What would you like to do?",
       [
-        { label: suggested, hint: "suggested", value: "keep" },
-        { label: "Type a different name\u2026", value: "type" }
+        { label: "Change the agent name", value: "name" },
+        { label: "Choose a different environment", value: "environment" },
+        { label: "Leave setup", value: "leave" }
       ],
-      { quiet: true, back: true }
+      { initial: 0 }
     );
-    if (choice === BACK) return BACK;
-    if (choice === "keep") {
-      out(`${symbol.pass} Agent name: ${style.bold(suggested)}`);
-      return suggested;
+    if (next === "leave") {
+      out(style.grey("Nothing was created. Run `veefore init` again when you are ready."));
+      return 1;
+    }
+    if (next === "environment") {
+      const again = await selectEnvironment(api, me, workspace.id, options, flags);
+      if (again !== BACK) environment = again.value;
     }
-    const typed = (await ask(`Agent name ${style.grey(`[${suggested}]`)}:`, suggested)).trim();
-    if (typed === "") continue;
-    out(`${symbol.pass} Agent name: ${style.bold(typed)}`);
-    return typed;
-  }
-}
-async function discoverAudience(gatewayUrl) {
-  try {
-    const response = await fetch(`${gatewayUrl}/.well-known/veefore-platform-key`, {
-      headers: { accept: "application/json" }
-    });
-    if (!response.ok) return gatewayUrl;
-    const body = await response.json();
-    const audience = body.data?.audience;
-    return typeof audience === "string" && audience !== "" ? audience : gatewayUrl;
-  } catch {
-    return gatewayUrl;
-  }
-}
-async function configureStarterPolicy(api, workspaceId, flags, options) {
-  if (options.skipPolicy) {
-    out(`${symbol.info} Skipped starter policy (--skip-policy).`);
-    return;
-  }
-  const existing = await api.get(
-    "/v1/policies",
-    { workspace_id: workspaceId }
-  );
-  const count = Array.isArray(existing) ? existing.length : existing.items?.length ?? 0;
-  if (count > 0) {
-    out(`${symbol.pass} Workspace already has ${count} policy/policies. Leaving them alone.`);
-    return;
-  }
-  const create = flags.yes ? true : await confirm("Create a starter policy with safe defaults?", { yes: flags.yes });
-  if (!create) {
-    out(style.grey("  Skipped. Create one later from a template in the console."));
-    return;
   }
-  const policySpinner = spinner("Creating starter policy from the safe-defaults template");
+  heading("Setting up");
+  let created;
   try {
-    const result = await api.post("/v1/policies", {
-      workspace_id: workspaceId,
-      name: "Starter \u2014 safe defaults",
-      template_key: "starter-observe-safe-defaults"
-    });
-    await api.post(`/v1/policies/${result.policy.id}/bindings`, {
-      scope: "WORKSPACE",
-      scope_id: workspaceId
-    });
-    policySpinner.succeed(
-      `Starter policy created as ${style.bold("DRAFT")} and bound to the workspace`
-    );
-    keyValue("Policy", `${result.policy.name} (${result.policy.id})`);
-    out(
-      style.grey(
-        "  Review it, run `veefore policies test`, then `veefore policies deploy` when you are ready."
-      )
+    created = await applyPlan(
+      api,
+      plan,
+      {
+        workspaceId: workspace.id,
+        environmentId: environment.id,
+        framework: framework.key === "unknown" ? null : framework.key
+      },
+      void 0,
+      { newAgent: options.newAgent === true }
     );
   } catch (error) {
-    policySpinner.fail("Could not create the starter policy");
-    if (error instanceof CliApiError) {
-      out(style.grey(`  ${error.message}`));
-      out(style.grey("  You can create one from a template in the console instead."));
-      return;
+    if (error instanceof CliApiError && error.code === "PERMISSION_DENIED") {
+      throw new CliError(
+        "Your role cannot set up agents in this workspace.",
+        'Ask an owner or admin for the "agent:create" and "tool:create" permissions.'
+      );
     }
     throw error;
   }
-}
-async function validateConnection(api, gatewayUrl, agentId, environmentId) {
-  const checks = [];
-  try {
-    await api.get("/v1/auth/session");
-    checks.push({ name: "Control plane reachable", status: "pass", message: api.controlPlaneUrl });
-  } catch (error) {
-    checks.push({
-      name: "Control plane reachable",
-      status: "fail",
-      message: error instanceof Error ? error.message : String(error)
-    });
+  let gatewayUrl = options.gatewayUrl ?? flags.gatewayUrl ?? process.env.VEEFORE_GATEWAY_URL;
+  if (!gatewayUrl) {
+    const published = (await controlPlaneInfo(controlPlaneUrl)).gatewayUrl;
+    if (published && await gatewayReachable(published)) {
+      gatewayUrl = published;
+      out(
+        `${symbol.pass} Gateway: ${style.bold(published)} ${style.grey("(published by the control plane)")}`
+      );
+    } else {
+      const suggestion = published ?? DEFAULT_GATEWAY;
+      out(
+        `${symbol.warn} ${published ? `The gateway at ${published} is not answering.` : "The control plane did not publish a gateway address."}`
+      );
+      gatewayUrl = await ask(`Gateway URL ${style.grey(`[${suggestion}]`)}:`, suggestion);
+    }
   }
-  try {
-    const response = await fetch(`${gatewayUrl}/health`, {
-      signal: AbortSignal.timeout(5e3)
-    });
-    const body = await response.json();
-    checks.push({
-      name: "Gateway reachable",
-      status: response.ok ? "pass" : "fail",
-      message: `${gatewayUrl} \u2014 ${body.status ?? response.status} (${body.enforcement_posture ?? "unknown posture"})`
-    });
-  } catch (error) {
-    checks.push({
-      name: "Gateway reachable",
-      status: "fail",
-      message: `${gatewayUrl} \u2014 ${error instanceof Error ? error.message : String(error)}. Start it with \`npm run dev:gateway\`.`
-    });
-  }
-  try {
-    const identities = await api.get(
-      `/v1/agents/${agentId}/identities`
-    );
-    const active = identities.find((identity) => identity.status === "ACTIVE");
-    checks.push({
-      name: "Agent identity active",
-      status: active ? "pass" : "fail",
-      message: active ? `expires ${active.expiresAt.slice(0, 10)}` : "no ACTIVE identity"
-    });
-  } catch (error) {
-    checks.push({
-      name: "Agent identity active",
-      status: "warn",
-      message: error instanceof Error ? error.message : String(error)
-    });
-  }
-  try {
-    const passport = await api.get(
-      `/v1/passports/${agentId}`
+  gatewayUrl = normalizeUrl(gatewayUrl);
+  const config = {
+    version: 1,
+    controlPlaneUrl,
+    gatewayUrl,
+    organizationId: organization.id,
+    organizationName: organization.name,
+    workspaceId: workspace.id,
+    workspaceName: workspace.name,
+    environmentId: environment.id,
+    environmentName: environment.name,
+    environmentType: environment.type,
+    agentId: created.agentId,
+    agentName: created.agentName,
+    keyId: created.keyId,
+    framework: framework.key === "unknown" ? null : framework.key,
+    declaredTools: created.tools.map((tool) => tool.key),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const configFile = writeProjectConfig(config);
+  out(
+    `${symbol.pass} Wrote ${style.bold("veefore.config.json")} ${style.grey("(safe to commit)")}`
+  );
+  const audience = await discoverAudience(gatewayUrl);
+  ensureGitignore(process.cwd(), [".env.local", ".veefore/"]);
+  const approvalMode = options.approvalMode ?? previousApprovalMode() ?? "wait";
+  const envFile = writeLocalEnv({
+    VEEFORE_GATEWAY_URL: gatewayUrl,
+    VEEFORE_GATEWAY_AUDIENCE: audience,
+    VEEFORE_AGENT_ID: created.agentId,
+    VEEFORE_AGENT_KEY_ID: created.keyId,
+    VEEFORE_AGENT_PRIVATE_KEY: created.privateKey,
+    ...created.tools.length > 0 ? { VEEFORE_DECLARED_TOOLS: created.tools.map((tool) => tool.key).join(",") } : {},
+    // Written explicitly so the behaviour is visible and editable in one place.
+    VEEFORE_APPROVAL_MODE: approvalMode
+  });
+  if (audience !== gatewayUrl) {
+    out(
+      `${symbol.info} Gateway audience is ${style.bold(audience)} ${style.grey(
+        `(it reports this, rather than the ${gatewayUrl} you dialled)`
+      )}`
     );
-    checks.push({
-      name: "Agent passport issued",
-      status: passport ? "pass" : "warn",
-      message: passport ? `version ${passport.version}` : "not issued yet"
-    });
-  } catch {
-    checks.push({ name: "Agent passport issued", status: "warn", message: "could not read" });
   }
-  try {
-    const environment = await api.get(
-      `/v1/environments/${environmentId}`
+  out(
+    `${symbol.pass} Wrote agent credentials to ${style.bold(".env.local")} ${style.grey("(mode 0600, gitignored)")}`
+  );
+  out();
+  out(
+    `  ${style.amber("The private key was generated here and written to that file only.")} Veefore`
+  );
+  out(
+    `  never received it and cannot recover it. Move it into your secret manager before deploying.`
+  );
+  out(`  ${style.grey(`Fingerprint: ${created.fingerprint}`)}`);
+  await configureStarterPolicy(api, workspace.id, flags, options);
+  let integrated = false;
+  if (created.tools.length > 0 && !options.skipCode) {
+    const outcome = await integrate(
+      process.cwd(),
+      created.tools.map((tool) => tool.key),
+      { yes: flags.yes, quiet: flags.json, api }
     );
-    checks.push({
-      name: "Enforcement mode",
-      status: "pass",
-      message: environment.gatewayMode === "ENFORCE" ? "ENFORCE \u2014 decisions are enforced" : `${environment.gatewayMode} \u2014 decisions are recorded but not enforced`
-    });
-  } catch {
-    checks.push({ name: "Enforcement mode", status: "warn", message: "could not read" });
+    integrated = outcome.status === "applied" || outcome.status === "nothing-to-do";
   }
-  return checks;
-}
-function parseInitArgs(args) {
-  const options = { force: false, skipPolicy: false, skipCode: false };
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    const next = () => {
-      const value = args[index + 1];
-      if (value === void 0 || value.startsWith("-")) {
-        throw new CliError(`Option ${String(arg)} requires a value.`);
-      }
-      index += 1;
-      return value;
-    };
-    switch (arg) {
-      case "--force":
-        options.force = true;
-        break;
-      case "--skip-policy":
-        options.skipPolicy = true;
-        break;
-      case "--skip-code":
-        options.skipCode = true;
-        break;
-      case "--new-agent":
-        options.newAgent = true;
-        break;
-      case "--control-plane":
-        options.controlPlaneUrl = next();
-        break;
-      case "--gateway":
-        options.gatewayUrl = next();
-        break;
-      case "--organization":
-        options.organizationId = next();
-        break;
-      case "--workspace":
-        options.workspaceId = next();
-        break;
-      case "--environment":
-        options.environmentId = next();
-        break;
-      case "--name":
-        options.agentName = next();
-        break;
-      case "--capability":
-        options.capabilities = [...options.capabilities ?? [], next()];
-        break;
-      case "--approval-mode": {
-        const value = next().toLowerCase();
-        if (value !== "wait" && value !== "throw") {
-          throw new CliError('--approval-mode must be "wait" or "throw".');
-        }
-        options.approvalMode = value;
-        break;
-      }
-      default:
-        if (arg?.startsWith("-")) {
-          throw new CliError(`Unknown option for \`veefore init\`: ${arg}`);
-        }
-    }
+  heading("Validating the connection");
+  const checks = await validateConnection(api, gatewayUrl, created.agentId, environment.id);
+  for (const check of checks) {
+    const icon = check.status === "pass" ? symbol.pass : check.status === "warn" ? symbol.warn : symbol.fail;
+    out(`${icon} ${check.name}${check.message ? style.grey(` \u2014 ${check.message}`) : ""}`);
   }
-  return options;
-}
-async function projectHome(existing, flags) {
-  const source = welcomeSource(flags);
-  let last = 0;
-  for (let round = 0; ; round += 1) {
-    await beginScreen(source, { animate: round === 0 });
-    const state = await agentState(existing);
-    printProjectSummary(existing, state);
-    const choices = homeChoices(existing, state, flags);
-    choices.push({ label: "Exit", hint: "esc", run: async () => last, leaves: true });
+  const failed = checks.filter((check) => check.status === "fail");
+  if (!integrated) {
+    heading("Protect each tool");
     out();
-    let picked;
-    try {
-      picked = await select(
-        "What would you like to do?",
-        choices.map((choice) => ({ label: choice.label, hint: choice.hint, value: choice }))
-      );
-    } catch (error) {
-      if (error instanceof MenuCancelled) return last;
-      throw error;
+    for (const line of integrationSnippet(framework).split("\n")) {
+      out(`  ${style.cyan(line)}`);
     }
-    if (picked.leaves) {
-      await beginScreen(source, { compact: true });
-      try {
-        return await picked.run();
-      } catch (error) {
-        return error instanceof MenuCancelled ? last : reportError(error, flags);
-      }
+    const entryPoints = findEntryPoints();
+    if (entryPoints.length > 0) {
+      out();
+      out(
+        style.grey(
+          `  Likely entry point${entryPoints.length > 1 ? "s" : ""}: ${entryPoints.join(", ")}`
+        )
+      );
     }
-    await beginScreen(source, { compact: true });
-    try {
-      last = await picked.run();
-    } catch (error) {
-      last = error instanceof MenuCancelled ? last : reportError(error, flags);
+    if (created.tools.length > 0) {
+      out(style.grey("  Or let Veefore wrap your tools for you: `veefore integrate`."));
     }
-    if (!isInteractive()) return last;
-    await pressBack("Back to menu");
   }
-}
-function printProjectSummary(existing, state) {
+  heading("When a human must approve");
+  for (const line of approvalModeExplanation(approvalMode)) out(line);
+  heading("Next");
+  out(`  ${symbol.bullet} ${style.bold("veefore dev")}     watch decisions live while you build`);
+  out(
+    `  ${symbol.bullet} ${style.bold("veefore doctor")}  check the security posture of this setup`
+  );
+  out(`  ${symbol.bullet} ${style.bold("veefore status")}  see the current mode and agent health`);
   out();
-  details([
-    ["Agent", `${existing.agentName} (${existing.agentId})`],
-    ["Environment", `${existing.environmentName} (${existing.environmentType})`],
-    [
-      "Status",
-      state.kind === "ok" ? decisionStyle(state.status) : state.kind === "signed-out" ? style.amber("not signed in") : state.kind === "session-ended" ? style.amber("signed out") : state.kind === "missing" ? style.red("agent not found") : style.amber("Veefore not reachable")
-    ]
-  ]);
-  if (state.kind === "session-ended") {
-    out(`${symbol.warn} ${state.message}`);
-  }
-}
-function homeChoices(existing, state, flags) {
-  const ended = state.kind === "missing" || state.kind === "ok" && ENDED_STATUSES.includes(state.status);
-  if (ended) {
-    out();
+  out(
+    style.grey(
+      `  This environment is in ${environment.gatewayMode ?? "OBSERVE"} mode. Nothing is blocked yet.`
+    )
+  );
+  out(style.grey("  Review the recommended policy, simulate it, then switch to ENFORCE."));
+  out();
+  if (flags.json) {
     out(
-      `${symbol.warn} ${style.amber(
-        state.kind === "missing" ? "This agent no longer exists in Veefore." : `This agent was ${state.kind === "ok" ? state.status.toLowerCase() : "removed"} in Veefore.`
-      )} Every tool call wrapped in guard() is now refused.`
-    );
-    return [
-      {
-        label: "Remove Veefore from this project",
-        hint: "take guard() out of the code, disconnect",
-        run: () => removeCommand([], flags, state),
-        leaves: true
-      },
-      {
-        label: "Set it up again with a new agent",
-        hint: "the guarded code keeps working",
-        run: () => initCommand(["--force"], flags),
-        leaves: true
-      }
-    ];
-  }
-  const choices = [];
-  if (state.kind === "signed-out" || state.kind === "session-ended") {
-    choices.push({
-      label: "Sign in",
-      hint: "veefore login",
-      run: async () => {
-        await login(existing.controlPlaneUrl);
-        return 0;
-      }
-    });
-  }
-  choices.push(
-    { label: "Watch decisions live", hint: "veefore dev", run: () => devCommand([], flags) },
-    { label: "Check status", hint: "veefore status", run: () => statusCommand([], flags) },
-    {
-      label: "Protect tools in the code",
-      hint: "veefore integrate",
-      run: () => integrateCommand([], flags)
-    },
-    {
-      label: "Check every tool is guarded",
-      hint: "veefore integrate --check",
-      run: () => integrateCommand(["--check"], flags)
-    },
-    { label: "Test enforcement", hint: "veefore test", run: () => testCommand([], flags) },
-    {
-      label: "Audit the security posture",
-      hint: "veefore doctor",
-      run: () => doctorCommand([], flags)
-    },
-    { label: "Turn on enforcement", hint: "veefore deploy", run: () => deployCommand([], flags) },
-    {
-      label: "Re-run setup for this project",
-      hint: "veefore init --force",
-      run: () => initCommand(["--force"], flags),
-      leaves: true
-    },
-    {
-      label: "Remove Veefore from this project",
-      hint: "veefore remove",
-      run: () => removeCommand([], flags, state),
-      leaves: true
-    }
-  );
-  if (state.kind === "ok" || state.kind === "unreachable") {
-    choices.push({
-      label: "Sign out",
-      hint: "veefore logout",
-      run: async () => {
-        await logout(existing.controlPlaneUrl);
-        return 0;
-      }
-      // Deliberately not `leaves`: signing out comes back to this menu, so the
-      // panel and the status redraw as signed out and the next step on offer
-      // is Sign in. Leaving instead would quit on the one action whose result
-      // a person most wants to see confirmed.
-    });
+      JSON.stringify(
+        {
+          config_file: configFile,
+          env_file: envFile,
+          agent_id: created.agentId,
+          key_id: created.keyId,
+          fingerprint: created.fingerprint,
+          tools: created.tools,
+          checks
+        },
+        null,
+        2
+      )
+    );
   }
-  return choices;
+  return failed.length > 0 ? 1 : 0;
 }
-
-// src/commands/scan.ts
-async function scanCommand(_args, flags) {
-  const scan = scanProject(process.cwd());
-  if (flags.json) {
-    out(JSON.stringify({ scan, plan: buildPlan(scan) }, null, 2));
-    return 0;
+function previousApprovalMode(dir = process.cwd()) {
+  try {
+    const text = readFileSync9(path12.join(dir, ".env.local"), "utf8");
+    const value = /^\s*VEEFORE_APPROVAL_MODE\s*=\s*['"]?(\w+)/m.exec(text)?.[1]?.toLowerCase();
+    return value === "wait" || value === "throw" ? value : null;
+  } catch {
+    return null;
   }
-  heading("Veefore scan");
-  out(
-    `${symbol.pass} Framework: ${style.bold(scan.framework.name)} ${style.grey(`(${scan.framework.language}, ${scan.framework.evidence})`)}`
-  );
-  printScan(scan);
-  out();
-  out(style.grey("Nothing was changed. Run `veefore` to set this project up."));
-  return 0;
 }
-
-// src/commands/policies.ts
-function caseCount(result) {
-  return result.passed + result.failed;
+function approvalModeExplanation(mode) {
+  if (mode === "wait") {
+    return [
+      `  Guarded tools ${style.bold("wait")} for the reviewer's decision, then:`,
+      `    ${symbol.bullet} approved: the tool runs once and returns its real result`,
+      `    ${symbol.bullet} denied, cancelled or expired: it fails with that reason, and nothing runs`,
+      style.grey(
+        "  The agent process must stay running while it waits (up to the approval's expiry)."
+      ),
+      style.grey(
+        "  For chat agents that should hand the question back instead, set VEEFORE_APPROVAL_MODE=throw"
+      ),
+      style.grey("  in .env.local, or pass { waitForApproval: false } to a single guard().")
+    ];
+  }
+  return [
+    `  Guarded tools ${style.bold("return immediately")} with "approval required" (VeeforeApprovalRequiredError),`,
+    "  carrying the approval id. Your agent must resubmit the same call after a reviewer approves,",
+    "  or the action never happens.",
+    style.grey("  To wait for the decision instead, set VEEFORE_APPROVAL_MODE=wait in .env.local.")
+  ];
 }
-async function policiesCommand(args, flags) {
-  const [subcommand, ...rest] = args;
-  switch (subcommand) {
-    case void 0:
-    case "list":
-      return listPolicies(rest, flags);
-    case "show":
-      return showPolicy(rest, flags);
-    case "test":
-      return testPolicies(rest, flags);
-    case "deploy":
-      return deployPolicy(rest, flags);
-    case "diff":
-      return diffPolicy(rest, flags);
-    default:
+async function selectOrganization(api, me, options, flags) {
+  const organizations = me.organizations.length > 0 ? me.organizations : [
+    {
+      id: me.organization.id,
+      name: me.organization.name,
+      slug: me.organization.slug,
+      roleKey: me.roleKey
+    }
+  ];
+  if (options.organizationId) {
+    const match = organizations.find((org) => org.id === options.organizationId);
+    if (!match) {
       throw new CliError(
-        `Unknown subcommand \`veefore policies ${subcommand}\`.`,
-        "Available: list, show, test, deploy, diff."
+        `You are not a member of organization ${options.organizationId}.`,
+        `Available: ${organizations.map((org) => org.id).join(", ")}`
       );
+    }
+    return { value: match, asked: false };
   }
-}
-async function listPolicies(args, flags) {
-  const context = await resolveContext(flags);
-  const policies = await context.api.get("/v1/policies", {
-    workspace_id: args.includes("--all") ? void 0 : context.config.workspaceId,
-    status: valueFor(args, "--status")
-  });
-  if (flags.json) {
-    printJson({ items: policies });
-    return 0;
+  if (organizations.length === 1 || flags.yes) {
+    const chosen2 = organizations[0];
+    if (!chosen2) throw new CliError("Your account is not a member of any organization.");
+    return { value: chosen2, asked: false };
   }
-  heading(`Policies in ${context.config.workspaceName}`);
-  table(
-    [
-      { header: "NAME", key: "name", width: 30 },
-      { header: "KEY", key: "key", width: 24 },
-      { header: "STATUS", key: "status", width: 18 },
-      { header: "ACTIVE v", key: "active", width: 10, align: "right" },
-      { header: "LATEST v", key: "latest", width: 10, align: "right" },
-      { header: "BINDINGS", key: "bindings", width: 9, align: "right" },
-      { header: "24H", key: "evaluations", width: 7, align: "right" }
-    ],
-    policies.map((policy) => ({
-      name: policy.name,
-      key: policy.key,
-      status: decisionStyle(policy.status),
-      active: policy.activeVersion ? String(policy.activeVersion.versionNumber) : "\u2014",
-      latest: policy.latestVersion ? String(policy.latestVersion.versionNumber) : "\u2014",
-      bindings: String(policy.bindings.length),
-      evaluations: String(policy.evaluations24h)
-    }))
-  );
-  const unbound = policies.filter(
-    (policy) => policy.status === "ACTIVE" && policy.bindings.length === 0
-  );
-  const drafts = policies.filter((policy) => policy.status === "DRAFT");
   out();
-  if (unbound.length > 0) {
-    out(
-      `  ${symbol.warn} ${style.amber(`${unbound.length} active policy/policies are not bound to any scope, so they evaluate nothing.`)}`
+  const chosen = await select(
+    "Which organization?",
+    organizations.map((org) => ({
+      label: org.name,
+      hint: `${org.roleKey} \xB7 ${org.id}`,
+      value: org
+    })),
+    { quiet: true, back: true, backLabel: "Back" }
+  );
+  if (chosen === BACK) return BACK;
+  await api.post("/v1/auth/scope", { organization_id: chosen.id });
+  return { value: chosen, asked: true };
+}
+async function selectWorkspace(api, me, options, flags) {
+  const workspaces = me.workspaces.length > 0 ? me.workspaces : await api.get("/v1/workspaces");
+  if (workspaces.length === 0) {
+    throw new CliError(
+      "This organization has no workspaces.",
+      "Create one in the console, or ask an admin to."
     );
   }
-  if (drafts.length > 0) {
-    out(
-      `  ${symbol.info} ${drafts.length} draft(s). Run ${style.bold("veefore policies deploy <policyId>")} once the tests pass.`
-    );
+  if (options.workspaceId) {
+    const match = workspaces.find((workspace) => workspace.id === options.workspaceId);
+    if (!match) throw new CliError(`Workspace ${options.workspaceId} was not found.`);
+    return { value: match, asked: false };
   }
-  if (policies.length === 0) {
-    out(`  ${symbol.warn} No policies exist. Nothing is being evaluated against rules.`);
+  if (workspaces.length === 1 || flags.yes) {
+    const chosen2 = workspaces[0];
+    return { value: chosen2, asked: false };
   }
   out();
-  return 0;
-}
-async function showPolicy(args, flags) {
-  const context = await resolveContext(flags);
-  const policyId = positional(args);
-  if (!policyId)
-    throw new CliError("A policy id is required. Usage: veefore policies show <policyId>");
-  const policy = await context.api.get(
-    `/v1/policies/${policyId}`
+  const chosen = await select(
+    "Which workspace?",
+    workspaces.map((workspace) => ({
+      label: workspace.name,
+      hint: workspace.id,
+      value: workspace
+    })),
+    { quiet: true, back: true }
   );
-  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
-  if (flags.json) {
-    printJson({ policy, versions });
-    return 0;
-  }
-  heading(policy.name);
-  details([
-    ["ID", policy.id],
-    ["Key", policy.key],
-    ["Status", decisionStyle(policy.status)],
-    ["Priority", String(policy.priority)],
-    [
-      "Active version",
-      policy.activeVersion ? `v${policy.activeVersion.versionNumber}` : style.grey("none")
-    ],
-    ["Bound agents", String(policy.boundAgentCount)],
-    ["Evaluations (24h)", `${policy.evaluations24h} ${style.grey(`${policy.blocks24h} blocked`)}`],
-    ["Owner", policy.ownerEmail ?? style.grey("unknown")],
-    ["Description", policy.description || style.grey("none")]
-  ]);
-  if (policy.plainEnglish && policy.plainEnglish.length > 0) {
-    heading("In plain English");
-    for (const line of policy.plainEnglish) out(`  ${symbol.bullet} ${line}`);
-  }
-  if (policy.bindings.length > 0) {
-    heading("Bindings");
-    table(
-      [
-        { header: "SCOPE", key: "scope", width: 14 },
-        { header: "TARGET", key: "target", width: 34 },
-        { header: "ENABLED", key: "enabled", width: 8 }
-      ],
-      policy.bindings.map((binding) => ({
-        scope: binding.scope,
-        target: binding.scopeId,
-        enabled: binding.enabled ? style.green("yes") : style.red("no")
-      }))
-    );
-  }
-  heading("Versions");
-  table(
-    [
-      { header: "v", key: "version", width: 4, align: "right" },
-      { header: "STATUS", key: "status", width: 20 },
-      { header: "CREATED", key: "created", width: 20 },
-      { header: "SUMMARY", key: "summary", width: 40 }
-    ],
-    versions.map((version) => ({
-      version: String(version.versionNumber),
-      status: decisionStyle(version.status),
-      created: version.createdAt.slice(0, 16).replace("T", " "),
-      summary: version.changeSummary ?? ""
-    }))
-  );
-  out();
-  return 0;
+  if (chosen === BACK) return BACK;
+  return { value: chosen, asked: true };
 }
-async function testPolicies(args, flags) {
-  const context = await resolveContext(flags);
-  const explicit = positional(args);
-  const targets = explicit ? [await context.api.get(`/v1/policies/${explicit}`)] : await context.api.get("/v1/policies", {
-    workspace_id: context.config.workspaceId
-  });
-  if (targets.length === 0) {
-    out(`${symbol.warn} No policies to test.`);
-    return 0;
+async function selectEnvironment(api, me, workspaceId, options, flags) {
+  const all = me.environments.length > 0 ? me.environments : await api.get("/v1/environments", { workspace_id: workspaceId });
+  const environments = all.filter((environment) => environment.workspaceId === workspaceId);
+  if (environments.length === 0) {
+    throw new CliError(
+      "That workspace has no environments.",
+      "Create one in the console, or ask an admin to."
+    );
   }
-  const reports = [];
-  for (const policy of targets) {
-    try {
-      const result = await context.api.post(
-        `/v1/policies/${policy.id}/tests/run`,
-        {}
-      );
-      reports.push({ policy, result });
-    } catch (error) {
-      reports.push({
-        policy,
-        result: null,
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
+  if (options.environmentId) {
+    const match = environments.find((environment) => environment.id === options.environmentId);
+    if (!match) throw new CliError(`Environment ${options.environmentId} was not found.`);
+    return { value: match, asked: false };
   }
-  if (flags.json) {
-    printJson(reports);
-  } else {
-    renderTestReports(reports);
+  if (flags.yes) {
+    const chosen = environments.find((environment) => environment.type === "DEVELOPMENT") ?? environments[0];
+    return { value: chosen, asked: false };
   }
-  const failed = reports.filter(
-    (report) => report.error !== void 0 || (report.result?.failed ?? 0) > 0
-  );
-  return failed.length > 0 ? 1 : 0;
-}
-function renderTestReports(reports) {
-  heading("Policy tests");
-  let totalCases = 0;
-  let totalFailed = 0;
-  let withoutTests = 0;
-  for (const report of reports) {
-    if (report.error) {
-      out(`${symbol.fail} ${style.bold(report.policy.name)} ${style.grey(report.error)}`);
-      totalFailed += 1;
-      continue;
-    }
-    const result = report.result;
-    if (!result || caseCount(result) === 0) {
-      withoutTests += 1;
-      out(
-        `${symbol.warn} ${style.bold(report.policy.name)} ${style.amber("no test cases recorded")}`
-      );
-      continue;
-    }
-    totalCases += caseCount(result);
-    totalFailed += result.failed;
-    const icon = result.failed === 0 ? symbol.pass : symbol.fail;
-    out(
-      `${icon} ${style.bold(report.policy.name)} ${style.grey(`${result.passed}/${caseCount(result)} passing`)}`
+  const development = environments.findIndex((environment) => environment.type === "DEVELOPMENT");
+  for (; ; ) {
+    out();
+    const chosen = await select(
+      "Which environment?",
+      environments.map((environment) => ({
+        label: environment.name,
+        hint: `${environment.type} \xB7 ${environment.gatewayMode ?? "\u2014"} \xB7 ${environment.id}`,
+        value: environment
+      })),
+      { quiet: true, initial: development >= 0 ? development : 0, back: true }
     );
-    for (const testCase of result.results.filter((entry) => !entry.passed)) {
+    if (chosen === BACK) return BACK;
+    if (chosen.type === "PRODUCTION" && !options.force) {
+      out();
       out(
-        `    ${symbol.fail} ${testCase.name}: expected ${decisionStyle(testCase.expected)}, got ${decisionStyle(testCase.actual)}`
+        `${symbol.warn} ${style.amber("You selected a PRODUCTION environment.")} A new agent here starts in ${style.bold("OBSERVE")} mode and performs no enforcement until you switch it.`
       );
-      if (testCase.reason) out(`      ${style.grey(testCase.reason)}`);
+      if (!await confirm("Continue with the production environment?", { yes: flags.yes })) {
+        out(style.grey("  Choose another environment."));
+        continue;
+      }
     }
+    return { value: chosen, asked: true };
   }
+}
+async function stepScreen(source, decided, step, total) {
+  await beginScreen(source);
   out();
-  out(
-    totalFailed === 0 ? `  ${symbol.pass} ${style.green(`All ${totalCases} test case(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${totalFailed} failure(s) across ${totalCases} test case(s).`)}`
-  );
-  if (withoutTests > 0) {
-    out(
-      `  ${symbol.warn} ${style.amber(`${withoutTests} policy/policies have no test cases.`)} Add cases so activation can be proven safe.`
-    );
+  out(` ${style.bold("Set up this project")}  ${style.grey(`step ${step} of ${total}`)}`);
+  if (decided.length > 0) {
+    out();
+    const width = Math.max(...decided.map(([label]) => label.length));
+    for (const [label, value] of decided) {
+      out(`   ${symbol.pass} ${style.grey(label.padEnd(width))}  ${value}`);
+    }
   }
-  out();
 }
-async function deployPolicy(args, flags) {
-  const context = await resolveContext(flags);
-  const policyId = positional(args);
-  if (!policyId) {
-    throw new CliError(
-      "A policy id is required.",
-      'Usage: veefore policies deploy <policyId> [--version <n>] [--reason "\u2026"]'
-    );
-  }
-  const policy = await context.api.get(`/v1/policies/${policyId}`);
-  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
-  const requested = valueFor(args, "--version");
-  const target = requested ? versions.find((version) => String(version.versionNumber) === requested) : versions.find((version) => version.status === "DRAFT") ?? versions.find((version) => version.status === "TESTED");
-  if (!target) {
-    throw new CliError(
-      requested ? `Version ${requested} was not found for this policy.` : "There is no draft version to deploy.",
-      "Edit the policy in the console to create a new draft, then deploy it."
-    );
-  }
-  if (target.versionNumber === policy.activeVersion?.versionNumber) {
-    out(`${symbol.info} Version ${target.versionNumber} is already active. Nothing to do.`);
-    return 0;
-  }
-  heading(`Deploy ${policy.name} v${target.versionNumber}`);
-  details([
-    ["Environment", `${context.config.environmentName} (${context.config.environmentType})`],
-    ["Policy", `${policy.name} (${policy.id})`],
-    [
-      "Currently active",
-      policy.activeVersion === null ? style.grey("none \u2014 this will be the first active version") : `v${policy.activeVersion.versionNumber}`
-    ],
-    ["Deploying", `v${target.versionNumber}`],
-    ["Bindings", String(policy.bindings.length)]
-  ]);
-  if (policy.bindings.length === 0) {
+async function askAgentName(suggested) {
+  for (; ; ) {
     out();
-    out(
-      `  ${symbol.warn} ${style.amber("This policy is not bound to any scope.")} Activating it will not change any decision until you bind it.`
+    const choice = await select(
+      "Agent name",
+      [
+        { label: suggested, hint: "suggested", value: "keep" },
+        { label: "Type a different name\u2026", value: "type" }
+      ],
+      { quiet: true, back: true }
     );
-  }
-  if (policy.activeVersion !== null) {
-    const diff = await context.api.get(`/v1/policies/${policyId}/diff`, {
-      from: policy.activeVersion.versionNumber,
-      to: target.versionNumber
-    }).catch(() => null);
-    if (diff) {
-      heading("Changes");
-      for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
-      for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
-      for (const rule of diff.changed) {
-        out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
-      }
-      if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
-        out(style.grey("  No rule changes."));
-      }
-      if (diff.riskAssessment) {
-        out();
-        out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
-      }
+    if (choice === BACK) return BACK;
+    if (choice === "keep") {
+      out(`${symbol.pass} Agent name: ${style.bold(suggested)}`);
+      return suggested;
     }
+    const typed = (await ask(`Agent name ${style.grey(`[${suggested}]`)}:`, suggested)).trim();
+    if (typed === "") continue;
+    out(`${symbol.pass} Agent name: ${style.bold(typed)}`);
+    return typed;
   }
-  heading("Tests");
-  const testSpinner = spinner("Running recorded test cases");
-  let testResult = null;
+}
+async function discoverAudience(gatewayUrl) {
   try {
-    testResult = await context.api.post(`/v1/policies/${policyId}/tests/run`, {
-      version_id: target.id
+    const response = await fetch(`${gatewayUrl}/.well-known/veefore-platform-key`, {
+      headers: { accept: "application/json" }
     });
-    testSpinner.succeed(`${testResult.passed}/${caseCount(testResult)} test case(s) passing`);
-  } catch (error) {
-    testSpinner.fail("Could not run the test cases");
-    throw error;
+    if (!response.ok) return gatewayUrl;
+    const body = await response.json();
+    const audience = body.data?.audience;
+    return typeof audience === "string" && audience !== "" ? audience : gatewayUrl;
+  } catch {
+    return gatewayUrl;
   }
-  if (testResult.failed > 0) {
-    out();
-    for (const failure of testResult.results.filter((entry) => !entry.passed)) {
-      out(
-        `  ${symbol.fail} ${failure.name}: expected ${decisionStyle(failure.expected)}, got ${decisionStyle(failure.actual)}`
-      );
-    }
-    out();
-    throw new CliError(
-      `${testResult.failed} test case(s) fail. This version will not be deployed.`,
-      "Fix the rules or the expectations, then deploy again. Use --force only if you accept the risk and the server permits it."
-    );
+}
+async function configureStarterPolicy(api, workspaceId, flags, options) {
+  if (options.skipPolicy) {
+    out(`${symbol.info} Skipped starter policy (--skip-policy).`);
+    return;
   }
-  if (caseCount(testResult) === 0) {
-    out();
+  const existing = await api.get(
+    "/v1/policies",
+    { workspace_id: workspaceId }
+  );
+  const count = Array.isArray(existing) ? existing.length : existing.items?.length ?? 0;
+  if (count > 0) {
+    out(`${symbol.pass} Workspace already has ${count} policy/policies. Leaving them alone.`);
+    return;
+  }
+  const create = flags.yes ? true : await confirm("Create a starter policy with safe defaults?", { yes: flags.yes });
+  if (!create) {
+    out(style.grey("  Skipped. Create one later from a template in the console."));
+    return;
+  }
+  const policySpinner = spinner("Creating starter policy from the safe-defaults template");
+  try {
+    const result = await api.post("/v1/policies", {
+      workspace_id: workspaceId,
+      name: "Starter \u2014 safe defaults",
+      template_key: "starter-observe-safe-defaults"
+    });
+    await api.post(`/v1/policies/${result.policy.id}/bindings`, {
+      scope: "WORKSPACE",
+      scope_id: workspaceId
+    });
+    policySpinner.succeed(
+      `Starter policy created as ${style.bold("DRAFT")} and bound to the workspace`
+    );
+    keyValue("Policy", `${result.policy.name} (${result.policy.id})`);
     out(
-      `  ${symbol.warn} ${style.amber("This policy has no test cases.")} There is no evidence the new rules behave as intended.`
+      style.grey(
+        "  Review it, run `veefore policies test`, then `veefore policies deploy` when you are ready."
+      )
     );
-    const proceed = await confirm("Deploy anyway?", { yes: flags.yes });
-    if (!proceed) {
-      out(style.grey("Cancelled. Add test cases first."));
-      return 1;
+  } catch (error) {
+    policySpinner.fail("Could not create the starter policy");
+    if (error instanceof CliApiError) {
+      out(style.grey(`  ${error.message}`));
+      out(style.grey("  You can create one from a template in the console instead."));
+      return;
     }
+    throw error;
   }
-  const reason = valueFor(args, "--reason") ?? await ask("Reason for this change (recorded in the audit trail, min 10 characters):");
-  if (reason.trim().length < 10) {
-    throw new CliError("A reason of at least 10 characters is required.");
-  }
-  if (context.config.environmentType === "PRODUCTION") {
-    out();
-    out(`  ${symbol.warn} ${style.amber("This affects a PRODUCTION environment.")}`);
+}
+async function validateConnection(api, gatewayUrl, agentId, environmentId) {
+  const checks = [];
+  try {
+    await api.get("/v1/auth/session");
+    checks.push({ name: "Control plane reachable", status: "pass", message: api.controlPlaneUrl });
+  } catch (error) {
+    checks.push({
+      name: "Control plane reachable",
+      status: "fail",
+      message: error instanceof Error ? error.message : String(error)
+    });
   }
-  const confirmed = await confirm(`Activate v${target.versionNumber}?`, { yes: flags.yes });
-  if (!confirmed) {
-    out(style.grey("Cancelled. No change was made."));
-    return 1;
+  try {
+    const response = await fetch(`${gatewayUrl}/health`, {
+      signal: AbortSignal.timeout(5e3)
+    });
+    const body = await response.json();
+    checks.push({
+      name: "Gateway reachable",
+      status: response.ok ? "pass" : "fail",
+      message: `${gatewayUrl} \u2014 ${body.status ?? response.status} (${body.enforcement_posture ?? "unknown posture"})`
+    });
+  } catch (error) {
+    checks.push({
+      name: "Gateway reachable",
+      status: "fail",
+      message: `${gatewayUrl} \u2014 ${error instanceof Error ? error.message : String(error)}. Start it with \`npm run dev:gateway\`.`
+    });
   }
-  const deploySpinner = spinner(`Activating v${target.versionNumber}`);
   try {
-    await withStepUp(
-      context.api,
-      () => context.api.post(`/v1/policies/${policyId}/activate`, {
-        version_id: target.id,
-        reason
-      })
+    const identities = await api.get(
+      `/v1/agents/${agentId}/identities`
     );
-    deploySpinner.succeed(`${policy.name} v${target.versionNumber} is ACTIVE`);
+    const active = identities.find((identity) => identity.status === "ACTIVE");
+    checks.push({
+      name: "Agent identity active",
+      status: active ? "pass" : "fail",
+      message: active ? `expires ${active.expiresAt.slice(0, 10)}` : "no ACTIVE identity"
+    });
   } catch (error) {
-    deploySpinner.fail("Activation failed");
-    throw error;
+    checks.push({
+      name: "Agent identity active",
+      status: "warn",
+      message: error instanceof Error ? error.message : String(error)
+    });
   }
-  out();
-  out(`  ${symbol.pass} The previous version is marked SUPERSEDED and can be rolled back.`);
-  out(`  ${symbol.pass} The change and its diff are recorded in the audit trail.`);
-  out(style.grey("  Roll back with: veefore policies deploy <policyId> --version <previous>"));
-  out();
-  return 0;
-}
-async function diffPolicy(args, flags) {
-  const context = await resolveContext(flags);
-  const policyId = positional(args);
-  if (!policyId) {
-    throw new CliError(
-      "A policy id is required.",
-      "Usage: veefore policies diff <policyId> --from <n> --to <n>"
+  try {
+    const passport = await api.get(
+      `/v1/passports/${agentId}`
     );
+    checks.push({
+      name: "Agent passport issued",
+      status: passport ? "pass" : "warn",
+      message: passport ? `version ${passport.version}` : "not issued yet"
+    });
+  } catch {
+    checks.push({ name: "Agent passport issued", status: "warn", message: "could not read" });
   }
-  const from = valueFor(args, "--from");
-  const to = valueFor(args, "--to");
-  const diff = await context.api.get(`/v1/policies/${policyId}/diff`, { from, to });
-  if (flags.json) {
-    printJson(diff);
-    return 0;
-  }
-  heading(`Policy diff v${diff.from} \u2192 v${diff.to}`);
-  for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
-  for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
-  for (const rule of diff.changed) {
-    out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
+  try {
+    const environment = await api.get(
+      `/v1/environments/${environmentId}`
+    );
+    checks.push({
+      name: "Enforcement mode",
+      status: "pass",
+      message: environment.gatewayMode === "ENFORCE" ? "ENFORCE \u2014 decisions are enforced" : `${environment.gatewayMode} \u2014 decisions are recorded but not enforced`
+    });
+  } catch {
+    checks.push({ name: "Enforcement mode", status: "warn", message: "could not read" });
   }
-  if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
-    out(style.grey("  No differences."));
+  return checks;
+}
+function parseInitArgs(args) {
+  const options = { force: false, skipPolicy: false, skipCode: false };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    const next = () => {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("-")) {
+        throw new CliError(`Option ${String(arg)} requires a value.`);
+      }
+      index += 1;
+      return value;
+    };
+    switch (arg) {
+      case "--force":
+        options.force = true;
+        break;
+      case "--skip-policy":
+        options.skipPolicy = true;
+        break;
+      case "--skip-code":
+        options.skipCode = true;
+        break;
+      case "--new-agent":
+        options.newAgent = true;
+        break;
+      case "--control-plane":
+        options.controlPlaneUrl = next();
+        break;
+      case "--gateway":
+        options.gatewayUrl = next();
+        break;
+      case "--organization":
+        options.organizationId = next();
+        break;
+      case "--workspace":
+        options.workspaceId = next();
+        break;
+      case "--environment":
+        options.environmentId = next();
+        break;
+      case "--name":
+        options.agentName = next();
+        break;
+      case "--capability":
+        options.capabilities = [...options.capabilities ?? [], next()];
+        break;
+      case "--approval-mode": {
+        const value = next().toLowerCase();
+        if (value !== "wait" && value !== "throw") {
+          throw new CliError('--approval-mode must be "wait" or "throw".');
+        }
+        options.approvalMode = value;
+        break;
+      }
+      default:
+        if (arg?.startsWith("-")) {
+          throw new CliError(`Unknown option for \`veefore init\`: ${arg}`);
+        }
+    }
   }
-  if (diff.riskAssessment) {
-    out();
-    out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
+  return options;
+}
+async function projectHome(existing, flags) {
+  enterApp();
+  try {
+    return await projectHomeLoop(existing, flags);
+  } finally {
+    leaveApp();
+    printFarewell();
   }
-  out();
-  return 0;
 }
-
-// src/help.ts
-var COMMANDS = [
-  {
-    name: "init",
-    summary: "Set up this project with Veefore. Also runs as plain `veefore`.",
-    usage: "veefore init [options]",
-    description: "Connects to hosted Veefore, or to the self-hosted Veefore named with --control-plane (remembered afterwards), signs you in through the browser, scans the project locally (framework, tools, the hosts they call, the credentials they read \u2014 names only, never values), shows what it will set up and asks once. It then creates an agent with a key pair generated on this machine, registers each tool with its own capability and authorizes it for this agent, adds a starter policy in OBSERVE mode, writes veefore.config.json and .env.local, and validates the connection. The private key is written to .env.local only and is never sent, printed or recoverable.",
-    options: [
-      ["--force", "Replace an existing veefore.config.json."],
-      [
-        "--new-agent",
-        "Create a separate agent even if one with this name exists. By default the existing agent is reused with a new key, so its delegations and limits keep applying."
-      ],
-      ["--control-plane <url>", "Self-hosted Veefore address. Needed once; remembered after."],
-      ["--gateway <url>", "Gateway base URL that agents will call."],
-      ["--organization <id>", "Skip the organization prompt."],
-      ["--workspace <id>", "Skip the workspace prompt."],
-      ["--environment <id>", "Skip the environment prompt."],
-      ["--name <name>", "Agent display name."],
-      ["--capability <key>", "Grant a capability. Repeatable."],
-      ["--skip-policy", "Do not create a starter policy."],
-      ["--skip-code", "Do not offer to change your code; run `veefore integrate` later."],
-      [
-        "--approval-mode <wait|throw>",
-        "When approval is required, guarded tools wait for the decision (default) or return at once."
-      ]
-    ],
-    examples: ["veefore init", "veefore init --name finance-agent --capability refund.create"]
-  },
-  {
-    name: "scan",
-    summary: "Preview what setup would find, without changing anything.",
-    usage: "veefore scan [--json]",
-    description: "Scans the project locally and lists its framework, tools, the external hosts each tool calls and the credentials the code reads. Reads source files only: .env files and other hidden files are never opened, and secret values are never read. Needs no sign-in.",
-    options: [["--json", "Machine-readable scan and the setup plan it implies."]]
-  },
-  {
-    name: "integrate",
-    summary: "Wrap your registered tools in guard() so Veefore decides every call.",
-    usage: "veefore integrate [--dry-run] [--check] [--assist=manual|own|veefore|off] [--yes]",
-    description: "Finds each tool registered for this agent in your code and wraps its function in guard() (TypeScript/JavaScript) or adds @guard above it (Python). Your function bodies are not edited. Shows a diff and asks before writing, backs up every file it changes, then runs your TypeScript compiler (--noEmit), node --check or a Python syntax check; if a check newly fails, every file is restored automatically. For tools it will not change on its own, you choose: make the change yourself from exact instructions, use AI with your own Anthropic or OpenAI key (code goes only to that provider), or use Veefore AI if enabled. Before anything is sent, secrets are replaced with placeholders and you see what goes where and must agree; an AI change is accepted only if it keeps every line of your code and adds nothing but the guard, and you still review the diff.",
-    options: [
-      ["--dry-run", "Show the diff and write nothing."],
-      ["--check", "Report which registered tools are guarded in the code. Exits 1 if any are not."],
-      ["--assist=<how>", "manual (default when not interactive), own, veefore, or off."],
-      ["--yes", "Apply without asking."]
-    ],
-    examples: [
-      "veefore integrate --dry-run",
-      "veefore integrate --assist=manual",
-      "ANTHROPIC_API_KEY=\u2026 veefore integrate --assist=own",
-      "veefore integrate --check"
-    ]
-  },
-  {
-    name: "undo",
-    summary: "Restore the files the last `veefore integrate` changed.",
-    usage: "veefore undo [--force]",
-    description: "Restores each file from the backup taken before the last rewrite. A file you edited afterwards is left alone and listed, unless --force is given.",
-    options: [["--force", "Restore files even if they were edited after the rewrite."]]
-  },
-  {
-    name: "remove",
-    summary: "Take Veefore out of this project: guard() from the code, then disconnect.",
-    usage: "veefore remove [--dry-run] [--keep-agent]",
-    description: "Offers to revoke the agent in Veefore if it is still active, removes every guard() this CLI added (showing the diff, asking once, backing up and rolling back if your checks fail), then deletes veefore.config.json and the Veefore block in .env.local, including the private key. Edits you made after setup are kept. `veefore` offers this automatically when the agent was revoked in the console.",
-    options: [
-      ["--dry-run", "Show what would change and write nothing."],
-      ["--keep-agent", "Do not offer to revoke the agent in Veefore."]
-    ],
-    examples: ["veefore remove --dry-run", "veefore remove"]
-  },
-  {
-    name: "dev",
-    summary: "Watch decisions live while you build.",
-    usage: "veefore dev [--all]",
-    description: "Confirms the gateway is reachable, reports the enforcement mode, then streams every decision for this agent with the next concrete step for each outcome.",
-    options: [["--all", "Stream decisions for every agent in the environment."]]
-  },
-  {
-    name: "doctor",
-    summary: "Audit the security posture of this setup.",
-    usage: "veefore doctor [--strict]",
-    description: "Checks authentication, MFA, TLS, local secret permissions, identity and passport validity, gateway health, dangerous tools, network restrictions, policy coverage, production data access, MCP transport and authorization, audit chain integrity, credential rotation, and SDK version alignment.",
-    options: [["--strict", "Exit non-zero on warnings as well as failures."]]
-  },
-  {
-    name: "status",
-    summary: "Show the current environment, mode and agent health.",
-    usage: "veefore status",
-    description: "Prints the active organization, workspace and environment, the enforcement mode, the agent lifecycle state, gateway health, and the last few decisions."
-  },
-  {
-    name: "test",
-    summary: "Verify enforcement works, without performing any action.",
-    usage: "veefore test [--tool <key>]",
-    description: "Runs a dry-run probe across every tool this agent is authorized for, checks that policy test cases pass, and fails if a dangerous tool is permitted only by the default decision. Suitable as a CI gate.",
-    options: [["--tool <key>", "Probe a single tool."]]
-  },
-  {
-    name: "agents",
-    summary: "Inspect and control the agent fleet.",
-    usage: "veefore agents <list|show|pause|resume|suspend|revoke|rotate-key> [agentId]",
-    description: "Lifecycle control. `revoke` is irreversible for the identity and shows the full blast radius before asking for confirmation. `rotate-key` issues a new key pair and invalidates every outstanding session for that agent.",
-    options: [
-      ["--all", "List across the whole organization, not just this environment."],
-      ["--status <status>", "Filter by lifecycle status."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."]
-    ],
-    examples: [
-      "veefore agents list",
-      'veefore agents revoke agt_01ABC --reason "Key suspected compromised"'
-    ]
-  },
-  {
-    name: "policies",
-    summary: "List, test and deploy policies.",
-    usage: "veefore policies <list|show|test|deploy|diff> [policyId]",
-    description: "`test` runs the recorded test cases. `deploy` activates a version and refuses to do so while any test case fails; it requires a reason and step-up authentication.",
-    options: [
-      ["--version <n>", "Version to deploy, for `deploy`."],
-      ["--from <n> --to <n>", "Versions to compare, for `diff`."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."]
-    ],
-    examples: [
-      "veefore policies list",
-      "veefore policies test",
-      "veefore policies deploy pol_01ABC"
-    ]
-  },
-  {
-    name: "logs",
-    summary: "Read or stream the decision log.",
-    usage: "veefore logs [--follow] [--decision <d>] [--limit <n>]",
-    description: "Every line is a server-side decision with the policy and rule that produced it.",
-    options: [
-      ["--follow, -f", "Stream new decisions as they happen."],
-      ["--decision <d>", "Filter by decision, e.g. BLOCK."],
-      ["--agent <id>", "Filter by agent."],
-      ["--all", "Include every agent in the environment."],
-      ["--limit <n>", "Number of recent decisions to show."]
-    ]
-  },
-  {
-    name: "audit",
-    summary: "Query, verify and export the audit trail.",
-    usage: "veefore audit <list|show|verify|export> [eventId]",
-    description: "`verify` re-checks the hash chain and exits non-zero if it is broken. `export` returns a JSON or CSV file together with a content hash an auditor can use to prove the file is unaltered.",
-    options: [
-      ["--severity <s>", "Filter by severity."],
-      ["--type <t>", "Filter by event type."],
-      ["--from <iso> --to <iso>", "Time range."],
-      ["--format <json|csv>", "Export format."],
-      ['--reason "<text>"', "Why this export is being taken. Recorded in the audit trail."],
-      ["--out <file>", "Write the export to a file (mode 0600)."]
-    ],
-    examples: [
-      "veefore audit verify",
-      'veefore audit export --format csv --reason "Quarterly SOC 2 evidence" --out audit.csv'
-    ]
-  },
-  {
-    name: "deploy",
-    summary: "Promote the environment to enforcement.",
-    usage: "veefore deploy [--mode ENFORCE|SIMULATE|OBSERVE]",
-    description: "Runs preflight checks, replays recent observed traffic to show exactly what starts being refused, then requires confirmation, a reason and step-up authentication. Reducing enforcement always requires a reason and is recorded as a CRITICAL audit event.",
-    options: [
-      ["--mode <mode>", "Target mode. Defaults to ENFORCE."],
-      ['--reason "<text>"', "Reason recorded in the audit trail."],
-      ["--skip-preflight", "Incident use only. Recorded in the audit reason."]
-    ]
-  },
-  {
-    name: "login",
-    summary: "Sign in through your browser and store a session token.",
-    usage: "veefore login [--device] [--password] [--control-plane <url>]",
-    description: "Opens the console in your browser, where you sign in (or create an account) and approve this terminal. The terminal never sees your password. Over SSH, or with --device, it prints a link and a code to enter in any browser instead. Only the resulting session token is stored, in ~/.veefore/credentials.json at mode 0600, and the session can be revoked from your profile. In CI, set VEEFORE_EMAIL and VEEFORE_PASSWORD.",
-    options: [
-      ["--device", "Show a link and a code instead of opening a browser here."],
-      ["--password", "Type email and password in the terminal instead of using the browser."]
+async function projectHomeLoop(existing, flags) {
+  const source = welcomeSource(flags);
+  let last = 0;
+  for (let round = 0; ; round += 1) {
+    await beginScreen(source, { animate: round === 0 });
+    const state = await agentState(existing);
+    printProjectSummary(existing, state);
+    const choices = homeChoices(existing, state, flags);
+    choices.push({ label: "Exit", hint: "esc", run: async () => last, leaves: true });
+    out();
+    let picked;
+    try {
+      picked = await select(
+        "What would you like to do?",
+        choices.map((choice) => ({ label: choice.label, hint: choice.hint, value: choice })),
+        {
+          // Repainted as soon as a sign-in, sign-out or project change is
+          // noticed, so the panel and the status never sit stale.
+          redraw: () => {
+            drawScreen(source);
+            printProjectSummary(existing, state);
+            out();
+          }
+        }
+      );
+    } catch (error) {
+      if (error instanceof MenuCancelled) return last;
+      throw error;
+    }
+    if (picked.leaves) {
+      return onOrdinaryScreen(async () => {
+        drawScreen(source);
+        try {
+          return await picked.run();
+        } catch (error) {
+          return error instanceof MenuCancelled ? last : reportError(error, flags);
+        }
+      });
+    }
+    last = await runOnScreen(source, flags, () => picked.run(), {
+      label: "Back to menu",
+      live: picked.live
+    });
+    if (!isInteractive()) return last;
+  }
+}
+function printProjectSummary(existing, state) {
+  out();
+  details([
+    ["Agent", `${existing.agentName} (${existing.agentId})`],
+    ["Environment", `${existing.environmentName} (${existing.environmentType})`],
+    [
+      "Status",
+      state.kind === "ok" ? decisionStyle(state.status) : state.kind === "signed-out" ? style.amber("not signed in") : state.kind === "session-ended" ? style.amber("signed out") : state.kind === "missing" ? style.red("agent not found") : style.amber("Veefore not reachable")
     ]
-  },
-  {
-    name: "logout",
-    summary: "Sign out of Veefore on this machine.",
-    usage: "veefore logout [--all]",
-    description: 'Ends the session on the server and deletes the stored token. Signing out of the console with "Also sign out of the Veefore CLI" ticked does the same for every terminal you approved; the next command here then says you were signed out and asks you to sign in again.',
-    options: [["--all", "Sign out of every control plane this machine is signed in to."]]
+  ]);
+  if (state.kind === "session-ended") {
+    out(`${symbol.warn} ${state.message}`);
+  }
+}
+function homeChoices(existing, state, flags) {
+  const ended = state.kind === "missing" || state.kind === "ok" && ENDED_STATUSES.includes(state.status);
+  if (ended) {
+    out();
+    out(
+      `${symbol.warn} ${style.amber(
+        state.kind === "missing" ? "This agent no longer exists in Veefore." : `This agent was ${state.kind === "ok" ? state.status.toLowerCase() : "removed"} in Veefore.`
+      )} Every tool call wrapped in guard() is now refused.`
+    );
+    return [
+      {
+        label: "Remove Veefore from this project",
+        hint: "take guard() out of the code, disconnect",
+        run: () => removeCommand([], flags, state),
+        leaves: true
+      },
+      {
+        label: "Set it up again with a new agent",
+        hint: "the guarded code keeps working",
+        run: () => initCommand(["--force"], flags),
+        leaves: true
+      }
+    ];
+  }
+  const choices = [];
+  if (state.kind === "signed-out" || state.kind === "session-ended") {
+    choices.push({
+      label: "Sign in",
+      hint: "veefore login",
+      run: async () => {
+        await login(existing.controlPlaneUrl);
+        return 0;
+      }
+    });
+  }
+  choices.push(
+    {
+      label: "Watch decisions live",
+      hint: "veefore dev",
+      run: () => devCommand([], flags),
+      live: true
+    },
+    { label: "Check status", hint: "veefore status", run: () => statusCommand([], flags) },
+    {
+      label: "Protect tools in the code",
+      hint: "veefore integrate",
+      run: () => integrateCommand([], flags)
+    },
+    {
+      label: "Check every tool is guarded",
+      hint: "veefore integrate --check",
+      run: () => integrateCommand(["--check"], flags)
+    },
+    { label: "Test enforcement", hint: "veefore test", run: () => testCommand([], flags) },
+    {
+      label: "Audit the security posture",
+      hint: "veefore doctor",
+      run: () => doctorCommand([], flags)
+    },
+    { label: "Turn on enforcement", hint: "veefore deploy", run: () => deployCommand([], flags) },
+    {
+      label: "Re-run setup for this project",
+      hint: "veefore init --force",
+      run: () => initCommand(["--force"], flags),
+      leaves: true
+    },
+    {
+      label: "Remove Veefore from this project",
+      hint: "veefore remove",
+      run: () => removeCommand([], flags, state),
+      leaves: true
+    }
+  );
+  if (state.kind === "ok" || state.kind === "unreachable") {
+    choices.push({
+      label: "Sign out",
+      hint: "veefore logout",
+      run: async () => {
+        await logout(existing.controlPlaneUrl);
+        return 0;
+      }
+      // Deliberately not `leaves`: signing out comes back to this menu, so the
+      // panel and the status redraw as signed out and the next step on offer
+      // is Sign in. Leaving instead would quit on the one action whose result
+      // a person most wants to see confirmed.
+    });
   }
-];
-var GLOBAL_OPTIONS = [
-  ["--json", "Machine-readable output."],
-  ["--yes, -y", "Assume yes for confirmations. Never skips step-up authentication."],
-  ["--verbose", "Expanded output."],
-  [
-    "--control-plane <url>",
-    "Use this Veefore instead of the one found automatically (hosted, or the last you signed in to)."
-  ],
-  ["--gateway <url>", "Override the configured gateway URL."],
-  ["--version, -V", "Print the CLI version."],
-  ["--help, -h", "Show help."]
-];
-function printRootHelp(version) {
-  out();
-  out(
-    `${style.bold("veefore")} ${style.grey(version)} \u2014 identity, authority and policy for AI agents`
+  return choices;
+}
+
+// src/commands/policies.ts
+function caseCount(result) {
+  return result.passed + result.failed;
+}
+async function policiesCommand(args, flags) {
+  const [subcommand, ...rest] = args;
+  switch (subcommand) {
+    case void 0:
+    case "list":
+      return listPolicies(rest, flags);
+    case "show":
+      return showPolicy(rest, flags);
+    case "test":
+      return testPolicies(rest, flags);
+    case "deploy":
+      return deployPolicy(rest, flags);
+    case "diff":
+      return diffPolicy(rest, flags);
+    default:
+      throw new CliError(
+        `Unknown subcommand \`veefore policies ${subcommand}\`.`,
+        "Available: list, show, test, deploy, diff."
+      );
+  }
+}
+async function listPolicies(args, flags) {
+  const context = await resolveContext(flags);
+  const policies = await context.api.get("/v1/policies", {
+    workspace_id: args.includes("--all") ? void 0 : context.config.workspaceId,
+    status: valueFor(args, "--status")
+  });
+  if (flags.json) {
+    printJson({ items: policies });
+    return 0;
+  }
+  heading(`Policies in ${context.config.workspaceName}`);
+  table(
+    [
+      { header: "NAME", key: "name", width: 30 },
+      { header: "KEY", key: "key", width: 24 },
+      { header: "STATUS", key: "status", width: 18 },
+      { header: "ACTIVE v", key: "active", width: 10, align: "right" },
+      { header: "LATEST v", key: "latest", width: 10, align: "right" },
+      { header: "BINDINGS", key: "bindings", width: 9, align: "right" },
+      { header: "24H", key: "evaluations", width: 7, align: "right" }
+    ],
+    policies.map((policy) => ({
+      name: policy.name,
+      key: policy.key,
+      status: decisionStyle(policy.status),
+      active: policy.activeVersion ? String(policy.activeVersion.versionNumber) : "\u2014",
+      latest: policy.latestVersion ? String(policy.latestVersion.versionNumber) : "\u2014",
+      bindings: String(policy.bindings.length),
+      evaluations: String(policy.evaluations24h)
+    }))
+  );
+  const unbound = policies.filter(
+    (policy) => policy.status === "ACTIVE" && policy.bindings.length === 0
   );
+  const drafts = policies.filter((policy) => policy.status === "DRAFT");
   out();
-  out(style.bold("USAGE"));
-  out("  veefore <command> [options]");
+  if (unbound.length > 0) {
+    out(
+      `  ${symbol.warn} ${style.amber(`${unbound.length} active policy/policies are not bound to any scope, so they evaluate nothing.`)}`
+    );
+  }
+  if (drafts.length > 0) {
+    out(
+      `  ${symbol.info} ${drafts.length} draft(s). Run ${style.bold("veefore policies deploy <policyId>")} once the tests pass.`
+    );
+  }
+  if (policies.length === 0) {
+    out(`  ${symbol.warn} No policies exist. Nothing is being evaluated against rules.`);
+  }
   out();
-  out(style.bold("COMMANDS"));
-  const width = Math.max(...COMMANDS.map((command) => command.name.length));
-  for (const command of COMMANDS) {
-    out(`  ${style.cyan(command.name.padEnd(width))}  ${command.summary}`);
+  return 0;
+}
+async function showPolicy(args, flags) {
+  const context = await resolveContext(flags);
+  const policyId = positional(args);
+  if (!policyId)
+    throw new CliError("A policy id is required. Usage: veefore policies show <policyId>");
+  const policy = await context.api.get(
+    `/v1/policies/${policyId}`
+  );
+  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
+  if (flags.json) {
+    printJson({ policy, versions });
+    return 0;
+  }
+  heading(policy.name);
+  details([
+    ["ID", policy.id],
+    ["Key", policy.key],
+    ["Status", decisionStyle(policy.status)],
+    ["Priority", String(policy.priority)],
+    [
+      "Active version",
+      policy.activeVersion ? `v${policy.activeVersion.versionNumber}` : style.grey("none")
+    ],
+    ["Bound agents", String(policy.boundAgentCount)],
+    ["Evaluations (24h)", `${policy.evaluations24h} ${style.grey(`${policy.blocks24h} blocked`)}`],
+    ["Owner", policy.ownerEmail ?? style.grey("unknown")],
+    ["Description", policy.description || style.grey("none")]
+  ]);
+  if (policy.plainEnglish && policy.plainEnglish.length > 0) {
+    heading("In plain English");
+    for (const line of policy.plainEnglish) out(`  ${symbol.bullet} ${line}`);
+  }
+  if (policy.bindings.length > 0) {
+    heading("Bindings");
+    table(
+      [
+        { header: "SCOPE", key: "scope", width: 14 },
+        { header: "TARGET", key: "target", width: 34 },
+        { header: "ENABLED", key: "enabled", width: 8 }
+      ],
+      policy.bindings.map((binding) => ({
+        scope: binding.scope,
+        target: binding.scopeId,
+        enabled: binding.enabled ? style.green("yes") : style.red("no")
+      }))
+    );
   }
+  heading("Versions");
+  table(
+    [
+      { header: "v", key: "version", width: 4, align: "right" },
+      { header: "STATUS", key: "status", width: 20 },
+      { header: "CREATED", key: "created", width: 20 },
+      { header: "SUMMARY", key: "summary", width: 40 }
+    ],
+    versions.map((version) => ({
+      version: String(version.versionNumber),
+      status: decisionStyle(version.status),
+      created: version.createdAt.slice(0, 16).replace("T", " "),
+      summary: version.changeSummary ?? ""
+    }))
+  );
   out();
-  out(style.bold("GLOBAL OPTIONS"));
-  renderOptions(GLOBAL_OPTIONS);
+  return 0;
+}
+async function testPolicies(args, flags) {
+  const context = await resolveContext(flags);
+  const explicit = positional(args);
+  const targets = explicit ? [await context.api.get(`/v1/policies/${explicit}`)] : await context.api.get("/v1/policies", {
+    workspace_id: context.config.workspaceId
+  });
+  if (targets.length === 0) {
+    out(`${symbol.warn} No policies to test.`);
+    return 0;
+  }
+  const reports = [];
+  for (const policy of targets) {
+    try {
+      const result = await context.api.post(
+        `/v1/policies/${policy.id}/tests/run`,
+        {}
+      );
+      reports.push({ policy, result });
+    } catch (error) {
+      reports.push({
+        policy,
+        result: null,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  if (flags.json) {
+    printJson(reports);
+  } else {
+    renderTestReports(reports);
+  }
+  const failed = reports.filter(
+    (report) => report.error !== void 0 || (report.result?.failed ?? 0) > 0
+  );
+  return failed.length > 0 ? 1 : 0;
+}
+function renderTestReports(reports) {
+  heading("Policy tests");
+  let totalCases = 0;
+  let totalFailed = 0;
+  let withoutTests = 0;
+  for (const report of reports) {
+    if (report.error) {
+      out(`${symbol.fail} ${style.bold(report.policy.name)} ${style.grey(report.error)}`);
+      totalFailed += 1;
+      continue;
+    }
+    const result = report.result;
+    if (!result || caseCount(result) === 0) {
+      withoutTests += 1;
+      out(
+        `${symbol.warn} ${style.bold(report.policy.name)} ${style.amber("no test cases recorded")}`
+      );
+      continue;
+    }
+    totalCases += caseCount(result);
+    totalFailed += result.failed;
+    const icon = result.failed === 0 ? symbol.pass : symbol.fail;
+    out(
+      `${icon} ${style.bold(report.policy.name)} ${style.grey(`${result.passed}/${caseCount(result)} passing`)}`
+    );
+    for (const testCase of result.results.filter((entry) => !entry.passed)) {
+      out(
+        `    ${symbol.fail} ${testCase.name}: expected ${decisionStyle(testCase.expected)}, got ${decisionStyle(testCase.actual)}`
+      );
+      if (testCase.reason) out(`      ${style.grey(testCase.reason)}`);
+    }
+  }
   out();
-  out(style.bold("GETTING STARTED"));
-  out(
-    `  ${style.grey("1.")} veefore          ${style.grey("sign in, scan, set up and protect this project")}`
-  );
   out(
-    `  ${style.grey("2.")} veefore dev      ${style.grey("watch what your agent actually does")}`
+    totalFailed === 0 ? `  ${symbol.pass} ${style.green(`All ${totalCases} test case(s) passing.`)}` : `  ${symbol.fail} ${style.red(`${totalFailed} failure(s) across ${totalCases} test case(s).`)}`
   );
-  out(`  ${style.grey("3.")} veefore doctor   ${style.grey("check the security posture")}`);
-  out(`  ${style.grey("4.")} veefore deploy   ${style.grey("turn enforcement on")}`);
-  out();
-  out(style.grey("  Run `veefore <command> --help` for detail on any command."));
+  if (withoutTests > 0) {
+    out(
+      `  ${symbol.warn} ${style.amber(`${withoutTests} policy/policies have no test cases.`)} Add cases so activation can be proven safe.`
+    );
+  }
   out();
 }
-function printCommandHelp(name) {
-  const command = COMMANDS.find((entry) => entry.name === name);
-  if (!command) return false;
-  out();
-  out(`${style.bold(`veefore ${command.name}`)} \u2014 ${command.summary}`);
-  out();
-  out(style.bold("USAGE"));
-  out(`  ${command.usage}`);
-  out();
-  out(style.bold("DESCRIPTION"));
-  for (const line of wrap2(command.description, 76)) out(`  ${line}`);
-  if (command.options && command.options.length > 0) {
-    out();
-    out(style.bold("OPTIONS"));
-    renderOptions(command.options);
+async function deployPolicy(args, flags) {
+  const context = await resolveContext(flags);
+  const policyId = positional(args);
+  if (!policyId) {
+    throw new CliError(
+      "A policy id is required.",
+      'Usage: veefore policies deploy <policyId> [--version <n>] [--reason "\u2026"]'
+    );
   }
-  if (command.examples && command.examples.length > 0) {
-    out();
-    out(style.bold("EXAMPLES"));
-    for (const example of command.examples) out(`  ${style.grey("$")} ${example}`);
+  const policy = await context.api.get(`/v1/policies/${policyId}`);
+  const versions = await context.api.get(`/v1/policies/${policyId}/versions`);
+  const requested = valueFor(args, "--version");
+  const target = requested ? versions.find((version) => String(version.versionNumber) === requested) : versions.find((version) => version.status === "DRAFT") ?? versions.find((version) => version.status === "TESTED");
+  if (!target) {
+    throw new CliError(
+      requested ? `Version ${requested} was not found for this policy.` : "There is no draft version to deploy.",
+      "Edit the policy in the console to create a new draft, then deploy it."
+    );
   }
-  out();
-  return true;
-}
-function renderOptions(options) {
-  const width = Math.max(...options.map(([flag]) => flag.length));
-  for (const [flag, description] of options) {
-    out(`  ${style.cyan(flag.padEnd(width))}  ${description}`);
+  if (target.versionNumber === policy.activeVersion?.versionNumber) {
+    out(`${symbol.info} Version ${target.versionNumber} is already active. Nothing to do.`);
+    return 0;
   }
-}
-function wrap2(text, width) {
-  const words2 = text.split(/\s+/);
-  const lines = [];
-  let current = "";
-  for (const word of words2) {
-    if (current.length + word.length + 1 > width) {
-      lines.push(current);
-      current = word;
-    } else {
-      current = current === "" ? word : `${current} ${word}`;
+  heading(`Deploy ${policy.name} v${target.versionNumber}`);
+  details([
+    ["Environment", `${context.config.environmentName} (${context.config.environmentType})`],
+    ["Policy", `${policy.name} (${policy.id})`],
+    [
+      "Currently active",
+      policy.activeVersion === null ? style.grey("none \u2014 this will be the first active version") : `v${policy.activeVersion.versionNumber}`
+    ],
+    ["Deploying", `v${target.versionNumber}`],
+    ["Bindings", String(policy.bindings.length)]
+  ]);
+  if (policy.bindings.length === 0) {
+    out();
+    out(
+      `  ${symbol.warn} ${style.amber("This policy is not bound to any scope.")} Activating it will not change any decision until you bind it.`
+    );
+  }
+  if (policy.activeVersion !== null) {
+    const diff = await context.api.get(`/v1/policies/${policyId}/diff`, {
+      from: policy.activeVersion.versionNumber,
+      to: target.versionNumber
+    }).catch(() => null);
+    if (diff) {
+      heading("Changes");
+      for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
+      for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
+      for (const rule of diff.changed) {
+        out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
+      }
+      if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
+        out(style.grey("  No rule changes."));
+      }
+      if (diff.riskAssessment) {
+        out();
+        out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
+      }
     }
   }
-  if (current !== "") lines.push(current);
-  return lines;
-}
-
-// src/home.ts
-async function homeCommand(args, flags) {
-  const source = welcomeSource(flags);
-  let first = true;
-  for (; ; ) {
-    if (readProjectConfig()) return initCommand(args, flags);
-    await beginScreen(source, { animate: first });
-    first = false;
-    out();
-    out(style.bold("Let's get started."));
+  heading("Tests");
+  const testSpinner = spinner("Running recorded test cases");
+  let testResult = null;
+  try {
+    testResult = await context.api.post(`/v1/policies/${policyId}/tests/run`, {
+      version_id: target.id
+    });
+    testSpinner.succeed(`${testResult.passed}/${caseCount(testResult)} test case(s) passing`);
+  } catch (error) {
+    testSpinner.fail("Could not run the test cases");
+    throw error;
+  }
+  if (testResult.failed > 0) {
     out();
-    let action;
-    try {
-      action = await select("What would you like to do?", [
-        { label: "Set up this project", hint: "recommended \xB7 veefore init", value: "setup" },
-        {
-          label: "Preview what setup would find",
-          hint: "veefore scan \xB7 changes nothing",
-          value: "scan"
-        },
-        { label: "Sign in", hint: "veefore login", value: "login" },
-        { label: "Show every command", hint: "veefore help", value: "help" },
-        { label: "Exit", hint: "esc", value: "exit" }
-      ]);
-    } catch (error) {
-      if (error instanceof MenuCancelled) return 0;
-      throw error;
+    for (const failure of testResult.results.filter((entry) => !entry.passed)) {
+      out(
+        `  ${symbol.fail} ${failure.name}: expected ${decisionStyle(failure.expected)}, got ${decisionStyle(failure.actual)}`
+      );
     }
-    if (action === "exit") return 0;
-    if (action === "setup") {
-      await runOnScreen(source, flags, () => initCommand(args, flags), {
-        // Setup done: "Continue", and the next pass opens the project home
-        // with the panel filled in. Otherwise "Back to menu", to read why and
-        // choose again.
-        label: () => readProjectConfig() ? "Continue" : "Back to menu"
-      });
-      continue;
+    out();
+    throw new CliError(
+      `${testResult.failed} test case(s) fail. This version will not be deployed.`,
+      "Fix the rules or the expectations, then deploy again. Use --force only if you accept the risk and the server permits it."
+    );
+  }
+  if (caseCount(testResult) === 0) {
+    out();
+    out(
+      `  ${symbol.warn} ${style.amber("This policy has no test cases.")} There is no evidence the new rules behave as intended.`
+    );
+    const proceed = await confirm("Deploy anyway?", { yes: flags.yes });
+    if (!proceed) {
+      out(style.grey("Cancelled. Add test cases first."));
+      return 1;
     }
-    const code = await runOnScreen(source, flags, async () => {
-      switch (action) {
-        case "scan":
-          return scanCommand([], flags);
-        case "login":
-          await login(resolveControlPlaneUrl(flags.controlPlaneUrl));
-          return 0;
-        case "help":
-          printRootHelp(source().version);
-          return 0;
-      }
-      return 0;
-    });
-    if (!isInteractive()) return code;
   }
-}
-async function initWithWelcome(args, flags) {
-  await beginScreen(welcomeSource(flags), { animate: true });
-  return initCommand(args, flags);
-}
-async function runOnScreen(source, flags, run2, options = {}) {
-  await beginScreen(source, { compact: true });
-  let code = 0;
+  const reason = valueFor(args, "--reason") ?? await ask("Reason for this change (recorded in the audit trail, min 10 characters):");
+  if (reason.trim().length < 10) {
+    throw new CliError("A reason of at least 10 characters is required.");
+  }
+  if (context.config.environmentType === "PRODUCTION") {
+    out();
+    out(`  ${symbol.warn} ${style.amber("This affects a PRODUCTION environment.")}`);
+  }
+  const confirmed = await confirm(`Activate v${target.versionNumber}?`, { yes: flags.yes });
+  if (!confirmed) {
+    out(style.grey("Cancelled. No change was made."));
+    return 1;
+  }
+  const deploySpinner = spinner(`Activating v${target.versionNumber}`);
   try {
-    code = await run2();
+    await withStepUp(
+      context.api,
+      () => context.api.post(`/v1/policies/${policyId}/activate`, {
+        version_id: target.id,
+        reason
+      })
+    );
+    deploySpinner.succeed(`${policy.name} v${target.versionNumber} is ACTIVE`);
   } catch (error) {
-    code = error instanceof MenuCancelled ? 0 : reportError(error, flags);
+    deploySpinner.fail("Activation failed");
+    throw error;
   }
-  const label = options.label ?? "Back";
-  await pressBack(typeof label === "function" ? label() : label);
-  return code;
+  out();
+  out(`  ${symbol.pass} The previous version is marked SUPERSEDED and can be rolled back.`);
+  out(`  ${symbol.pass} The change and its diff are recorded in the audit trail.`);
+  out(style.grey("  Roll back with: veefore policies deploy <policyId> --version <previous>"));
+  out();
+  return 0;
+}
+async function diffPolicy(args, flags) {
+  const context = await resolveContext(flags);
+  const policyId = positional(args);
+  if (!policyId) {
+    throw new CliError(
+      "A policy id is required.",
+      "Usage: veefore policies diff <policyId> --from <n> --to <n>"
+    );
+  }
+  const from = valueFor(args, "--from");
+  const to = valueFor(args, "--to");
+  const diff = await context.api.get(`/v1/policies/${policyId}/diff`, { from, to });
+  if (flags.json) {
+    printJson(diff);
+    return 0;
+  }
+  heading(`Policy diff v${diff.from} \u2192 v${diff.to}`);
+  for (const rule of diff.added) out(`  ${style.green("+")} ${rule.name}`);
+  for (const rule of diff.removed) out(`  ${style.red("-")} ${rule.name}`);
+  for (const rule of diff.changed) {
+    out(`  ${style.amber("~")} ${rule.name} ${style.grey(rule.summary)}`);
+  }
+  if (diff.added.length + diff.removed.length + diff.changed.length === 0) {
+    out(style.grey("  No differences."));
+  }
+  if (diff.riskAssessment) {
+    out();
+    out(`  ${style.bold("Risk assessment")}: ${diff.riskAssessment}`);
+  }
+  out();
+  return 0;
 }
 
 // src/index.ts