tweek 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

tweek/cli.py

@@ -5,7 +5,7 @@ Tweek CLI - GAH! Security for your AI agents.
 Usage:
     tweek install [--scope global|project]
     tweek uninstall [--scope global|project]
-    tweek status
+    tweek doctor
     tweek config [--skill NAME] [--preset paranoid|cautious|trusted]
     tweek vault store SKILL KEY VALUE
     tweek vault get SKILL KEY
@@ -152,41 +152,7 @@ def _has_tweek_hooks(settings: dict) -> bool:
     return False
 
 
-@main.command(
-    epilog="""\b
-Examples:
-  tweek install                          Install for current project
-  tweek install --global                 Install globally (all projects)
-  tweek install --interactive            Walk through configuration prompts
-  tweek install --preset paranoid        Apply paranoid security preset
-  tweek install --quick                  Zero-prompt install with defaults
-  tweek install --with-sandbox           Install sandbox tool if needed (Linux)
-  tweek install --force-proxy            Override existing proxy configurations
-"""
-)
-@click.option("--global", "install_global", is_flag=True, default=False,
-              help="Install globally to ~/.claude/ (protects all projects)")
-@click.option("--dev-test", is_flag=True, hidden=True,
-              help="Install to test environment (for Tweek development only)")
-@click.option("--backup/--no-backup", default=True,
-              help="Backup existing hooks before installation")
-@click.option("--skip-env-scan", is_flag=True,
-              help="Skip scanning for .env files to migrate")
-@click.option("--interactive", "-i", is_flag=True,
-              help="Interactively configure security settings")
-@click.option("--preset", type=click.Choice(["paranoid", "cautious", "trusted"]),
-              help="Apply a security preset (skip interactive)")
-@click.option("--ai-defaults", is_flag=True,
-              help="Let AI suggest default settings based on detected skills")
-@click.option("--with-sandbox", is_flag=True,
-              help="Prompt to install sandbox tool if not available (Linux only)")
-@click.option("--force-proxy", is_flag=True,
-              help="Force Tweek proxy to override existing proxy configurations (e.g., openclaw)")
-@click.option("--skip-proxy-check", is_flag=True,
-              help="Skip checking for existing proxy configurations")
-@click.option("--quick", is_flag=True,
-              help="Zero-prompt install with cautious defaults (skips env scan and proxy check)")
-def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: bool, interactive: bool, preset: str, ai_defaults: bool, with_sandbox: bool, force_proxy: bool, skip_proxy_check: bool, quick: bool):
+def _install_claude_code_hooks(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: bool, interactive: bool, preset: str, ai_defaults: bool, with_sandbox: bool, force_proxy: bool, skip_proxy_check: bool, quick: bool):
     """Install Tweek hooks into Claude Code.
 
     By default, installs to the current project (./.claude/).
@@ -236,13 +202,13 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
     else:
         console.print()
         console.print("[yellow]⚠ Claude Code not detected on this system[/yellow]")
-        console.print("  [dim]Tweek hooks require Claude Code to function.[/dim]")
-        console.print("  [dim]https://docs.anthropic.com/en/docs/claude-code[/dim]")
+        console.print("  [white]Tweek hooks require Claude Code to function.[/white]")
+        console.print("  [white]https://docs.anthropic.com/en/docs/claude-code[/white]")
         console.print()
         if quick or not click.confirm("Continue installing hooks anyway?", default=False):
             if not quick:
                 console.print()
-                console.print("[dim]Run 'tweek install' later after installing Claude Code.[/dim]")
+                console.print("[white]Run 'tweek install' later after installing Claude Code.[/white]")
             return
         console.print()
 
@@ -250,25 +216,16 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
     # Step 2: Scope selection (always shown unless --global or --quick)
     # ─────────────────────────────────────────────────────────────
     if not install_global and not dev_test and not quick:
-        # Smart default: if in a git repo, default to project; otherwise global
-        in_git_repo = (Path.cwd() / ".git").exists()
-        default_scope = 1 if in_git_repo else 2
-
         console.print()
         console.print("[bold]Installation Scope[/bold]")
         console.print()
-        console.print("  [cyan]1.[/cyan] This project only (./.claude/)")
-        console.print("     [dim]Protects only the current project[/dim]")
-        console.print("  [cyan]2.[/cyan] All projects globally (~/.claude/)")
-        console.print("     [dim]Protects every project on this machine[/dim]")
+        console.print("  [cyan]1.[/cyan] All projects globally (~/.claude/) [green](recommended)[/green]")
+        console.print("     [white]Protects every project on this machine[/white]")
+        console.print("  [cyan]2.[/cyan] This directory only (./.claude/)")
+        console.print("     [white]Protects only the current directory[/white]")
         console.print()
-        if in_git_repo:
-            console.print(f"  [dim]Git repo detected — defaulting to project scope[/dim]")
-        else:
-            console.print(f"  [dim]No git repo — defaulting to global scope[/dim]")
-        console.print()
-        scope_choice = click.prompt("Select", type=click.IntRange(1, 2), default=default_scope)
-        if scope_choice == 2:
+        scope_choice = click.prompt("Select", type=click.IntRange(1, 2), default=1)
+        if scope_choice == 1:
             install_global = True
         console.print()
 
@@ -298,8 +255,8 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                     with open(project_settings) as f:
                         project_config = json.load(f)
                     if _has_tweek_hooks(project_config):
-                        console.print("[dim]Note: Tweek is also installed in this project.[/dim]")
-                        console.print("[dim]Project-level settings take precedence over global.[/dim]")
+                        console.print("[white]Note: Tweek is also installed in this project.[/white]")
+                        console.print("[white]Project-level settings take precedence over global.[/white]")
                         console.print()
             else:
                 # Installing per-project — check if global hooks exist
@@ -308,8 +265,8 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                     with open(global_settings) as f:
                         global_config = json.load(f)
                     if _has_tweek_hooks(global_config):
-                        console.print("[dim]Note: Tweek is also installed globally.[/dim]")
-                        console.print("[dim]Project-level settings will take precedence in this directory.[/dim]")
+                        console.print("[white]Note: Tweek is also installed globally.[/white]")
+                        console.print("[white]Project-level settings will take precedence in this directory.[/white]")
                         console.print()
         except (json.JSONDecodeError, IOError):
             pass
@@ -336,12 +293,12 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                 if openclaw_status["gateway_active"]:
                     console.print(f"  Gateway running on port {openclaw_status['port']}")
                 elif openclaw_status["running"]:
-                    console.print(f"  [dim]Process running (gateway may start on port {openclaw_status['port']})[/dim]")
+                    console.print(f"  [white]Process running (gateway may start on port {openclaw_status['port']})[/white]")
                 else:
-                    console.print(f"  [dim]Installed but not currently running[/dim]")
+                    console.print(f"  [white]Installed but not currently running[/white]")
 
                 if openclaw_status["config_path"]:
-                    console.print(f"  [dim]Config: {openclaw_status['config_path']}[/dim]")
+                    console.print(f"  [white]Config: {openclaw_status['config_path']}[/white]")
 
                 console.print()
 
@@ -353,11 +310,11 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                     console.print("[cyan]Tweek can protect OpenClaw tool calls. Choose a method:[/cyan]")
                     console.print()
                     console.print("  [cyan]1.[/cyan] Protect via [bold]tweek-security[/bold] ClawHub skill")
-                    console.print("     [dim]Screens tool calls through Tweek as a ClawHub skill[/dim]")
+                    console.print("     [white]Screens tool calls through Tweek as a ClawHub skill[/white]")
                     console.print("  [cyan]2.[/cyan] Protect via [bold]tweek protect openclaw[/bold]")
-                    console.print("     [dim]Wraps the OpenClaw gateway with Tweek's proxy[/dim]")
+                    console.print("     [white]Wraps the OpenClaw gateway with Tweek's proxy[/white]")
                     console.print("  [cyan]3.[/cyan] Skip for now")
-                    console.print("     [dim]You can set up OpenClaw protection later[/dim]")
+                    console.print("     [white]You can set up OpenClaw protection later[/white]")
                     console.print()
 
                     choice = click.prompt(
@@ -375,12 +332,12 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                         proxy_override_enabled = True
                         console.print()
                         console.print("[green]✓[/green] OpenClaw proxy protection will be configured")
-                        console.print(f"  [dim]Run 'tweek protect openclaw' after installation to complete setup[/dim]")
+                        console.print(f"  [white]Run 'tweek protect openclaw' after installation to complete setup[/white]")
                         console.print()
                     else:
                         console.print()
-                        console.print("[dim]Skipped. Run 'tweek protect openclaw' or add the[/dim]")
-                        console.print("[dim]tweek-security skill later to protect OpenClaw.[/dim]")
+                        console.print("[white]Skipped. Run 'tweek protect openclaw' or add the[/white]")
+                        console.print("[white]tweek-security skill later to protect OpenClaw.[/white]")
                         console.print()
 
             # Check for other proxy conflicts
@@ -397,7 +354,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
             # Proxy module not fully available, skip detection
             pass
         except Exception as e:
-            console.print(f"[dim]Warning: Could not check for proxy conflicts: {e}[/dim]")
+            console.print(f"[white]Warning: Could not check for proxy conflicts: {e}[/white]")
 
     # ─────────────────────────────────────────────────────────────
     # Step 5: Install hooks into settings.json
@@ -411,7 +368,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
         if settings_file.exists():
             backup_path = settings_file.with_suffix(".json.tweek-backup")
             shutil.copy(settings_file, backup_path)
-            console.print(f"[dim]Backed up existing settings to {backup_path}[/dim]")
+            console.print(f"[white]Backed up existing settings to {backup_path}[/white]")
 
     # Create target directory
     target.mkdir(parents=True, exist_ok=True)
@@ -486,7 +443,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
             shutil.rmtree(skill_target)
         shutil.copytree(skill_source, skill_target)
         console.print(f"[green]✓[/green] Tweek skill installed to: {skill_target}")
-        console.print(f"  [dim]Claude now understands Tweek warnings and commands[/dim]")
+        console.print(f"  [white]Claude now understands Tweek warnings and commands[/white]")
 
         # Add whitelist entry for the skill directory in overrides
         try:
@@ -522,12 +479,12 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                 console.print(f"[green]✓[/green] Skill directory whitelisted in overrides")
 
         except ImportError:
-            console.print(f"[dim]Note: PyYAML not available — skill whitelist not added to overrides[/dim]")
+            console.print(f"[white]Note: PyYAML not available — skill whitelist not added to overrides[/white]")
         except Exception as e:
-            console.print(f"[dim]Warning: Could not update overrides whitelist: {e}[/dim]")
+            console.print(f"[white]Warning: Could not update overrides whitelist: {e}[/white]")
     else:
-        console.print(f"[dim]Tweek skill source not found — skill not installed[/dim]")
-        console.print(f"  [dim]Skill can be installed manually from the tweek repository[/dim]")
+        console.print(f"[white]Tweek skill source not found — skill not installed[/white]")
+        console.print(f"  [white]Skill can be installed manually from the tweek repository[/white]")
 
     # ─────────────────────────────────────────────────────────────
     # Step 7: Security Configuration
@@ -597,7 +554,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
 
             console.print(f"\n[green]✓[/green] Configured {len(unknown_skills)} skills")
         else:
-            console.print("[dim]All detected skills already configured[/dim]")
+            console.print("[white]All detected skills already configured[/white]")
 
         # Apply cautious preset as base
         cfg.apply_preset("cautious")
@@ -631,7 +588,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
         else:
             # Custom: ask about key tools
             console.print("\n[bold]Configure key tools:[/bold]")
-            console.print("[dim](safe/default/risky/dangerous)[/dim]\n")
+            console.print("[white](safe/default/risky/dangerous)[/white]\n")
 
             for tool in ["Bash", "WebFetch", "Edit"]:
                 current = cfg.get_tool_tier(tool)
@@ -650,7 +607,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
         if not cfg.export_config("user"):
             cfg.apply_preset("cautious")
             console.print("\n[green]✓[/green] Applied default [bold]cautious[/bold] security preset")
-            console.print("[dim]Run 'tweek config interactive' to customize[/dim]")
+            console.print("[white]Run 'tweek config interactive' to customize[/white]")
             install_summary["preset"] = "cautious"
         else:
             install_summary["preset"] = "existing"
@@ -672,7 +629,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
 
         if env_files:
             table = Table(title="Found .env Files")
-            table.add_column("#", style="dim")
+            table.add_column("#", style="white")
             table.add_column("Path")
             table.add_column("Credentials", justify="right")
 
@@ -714,7 +671,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                     )
 
                     # Show dry-run preview
-                    console.print(f"  [dim]Preview - credentials to migrate:[/dim]")
+                    console.print(f"  [white]Preview - credentials to migrate:[/white]")
                     for key in keys:
                         console.print(f"    • {key}")
 
@@ -727,9 +684,9 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                         except Exception as e:
                             console.print(f"  [red]✗[/red] Migration failed: {e}")
                     else:
-                        console.print(f"  [dim]Skipped[/dim]")
+                        console.print(f"  [white]Skipped[/white]")
         else:
-            console.print("[dim]No .env files with credentials found[/dim]")
+            console.print("[white]No .env files with credentials found[/white]")
 
     # ─────────────────────────────────────────────────────────────
     # Step 10: Linux: Prompt for firejail installation
@@ -742,8 +699,8 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                 prompt_install_firejail(console)
             else:
                 console.print("\n[yellow]Note:[/yellow] Sandbox (firejail) not installed.")
-                console.print(f"[dim]Install with: {caps.sandbox_install_hint}[/dim]")
-                console.print("[dim]Or run 'tweek install --with-sandbox' to install now[/dim]")
+                console.print(f"[white]Install with: {caps.sandbox_install_hint}[/white]")
+                console.print("[white]Or run 'tweek install --with-sandbox' to install now[/white]")
 
     # ─────────────────────────────────────────────────────────────
     # Step 11: Configure Tweek proxy if override was enabled
@@ -773,7 +730,7 @@ def install(install_global: bool, dev_test: bool, backup: bool, skip_env_scan: b
                 yaml.dump(tweek_config, f, default_flow_style=False)
 
             console.print("\n[green]✓[/green] Proxy override configured")
-            console.print(f"  [dim]Config saved to: {proxy_config_path}[/dim]")
+            console.print(f"  [white]Config saved to: {proxy_config_path}[/white]")
             console.print("  [yellow]Run 'tweek proxy start' to begin intercepting API calls[/yellow]")
             install_summary["proxy"] = True
         except Exception as e:
@@ -804,14 +761,14 @@ def _check_python_version(console: Console, quick: bool) -> None:
             resolved_system = Path(system_python3).resolve()
 
             if resolved_install != resolved_system:
-                console.print(f"[dim]  Note: system python3 is {resolved_system}[/dim]")
-                console.print(f"[dim]  Hooks will use {resolved_install} (the Python running this install)[/dim]")
+                console.print(f"[white]  Note: system python3 is {resolved_system}[/white]")
+                console.print(f"[white]  Hooks will use {resolved_install} (the Python running this install)[/white]")
         except (OSError, ValueError):
             pass
     else:
         if not quick:
             console.print("[yellow]  Note: python3 not found on PATH[/yellow]")
-            console.print(f"[dim]  Hooks will use {sys.executable} directly[/dim]")
+            console.print(f"[white]  Hooks will use {sys.executable} directly[/white]")
 
 
 def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) -> dict:
@@ -861,9 +818,9 @@ def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) ->
         console.print()
         console.print("  [cyan]1.[/cyan] Auto-detect (recommended)")
         if local_model_ready:
-            console.print(f"     [dim]Local model installed ({local_model_name}) — will use it first[/dim]")
+            console.print(f"     [white]Local model installed ({local_model_name}) — will use it first[/white]")
         else:
-            console.print("     [dim]Uses first available: Local model > Anthropic > OpenAI > Google[/dim]")
+            console.print("     [white]Uses first available: Local model > Anthropic > OpenAI > Google[/white]")
         console.print("  [cyan]2.[/cyan] Anthropic (Claude Haiku)")
         console.print("  [cyan]3.[/cyan] OpenAI (GPT-4o-mini)")
         console.print("  [cyan]4.[/cyan] Google (Gemini 2.0 Flash)")
@@ -871,8 +828,8 @@ def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) ->
         console.print("  [cyan]6.[/cyan] Disable screening")
         if not local_model_ready:
             console.print()
-            console.print("  [dim]Tip: Run 'tweek model download' to install the local model[/dim]")
-            console.print("  [dim]     (on-device, no API key, ~45MB download)[/dim]")
+            console.print("  [white]Tip: Run 'tweek model download' to install the local model[/white]")
+            console.print("  [white]     (on-device, no API key, ~45MB download)[/white]")
         console.print()
 
         choice = click.prompt("Select", type=click.IntRange(1, 6), default=1)
@@ -892,8 +849,8 @@ def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) ->
             # Custom endpoint configuration
             console.print()
             console.print("[bold]Custom Endpoint Configuration[/bold]")
-            console.print("[dim]Most local servers (Ollama, LM Studio, vLLM) and cloud providers[/dim]")
-            console.print("[dim](Together, Groq, Mistral) expose an OpenAI-compatible API.[/dim]")
+            console.print("[white]Most local servers (Ollama, LM Studio, vLLM) and cloud providers[/white]")
+            console.print("[white](Together, Groq, Mistral) expose an OpenAI-compatible API.[/white]")
             console.print()
 
             result["provider"] = "openai"
@@ -914,7 +871,7 @@ def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) ->
             console.print()
         elif choice == 6:
             result["provider"] = "disabled"
-            console.print("[dim]Screening disabled. Pattern matching and other layers remain active.[/dim]")
+            console.print("[white]Screening disabled. Pattern matching and other layers remain active.[/white]")
     # else: quick mode — leave as auto
 
     # Resolve display names for summary
@@ -980,7 +937,7 @@ def _configure_llm_provider(tweek_dir: Path, interactive: bool, quick: bool) ->
             else:
                 console.print(f"[green]✓[/green] LLM provider configured: {result['provider_display']}")
         except Exception as e:
-            console.print(f"[dim]Warning: Could not save LLM config: {e}[/dim]")
+            console.print(f"[white]Warning: Could not save LLM config: {e}[/white]")
     else:
         if result["provider_display"] and "disabled" not in (result["provider_display"] or ""):
             console.print(f"[green]✓[/green] LLM provider: {result['provider_display']} ({result.get('model_display', 'auto')})")
@@ -1047,7 +1004,7 @@ def _validate_llm_provider(llm_config: dict) -> None:
         expected_vars = [llm_config["api_key_env"]]
     elif llm_config.get("base_url"):
         # Local endpoints (Ollama etc.) don't need an API key
-        console.print(f"  [dim]Checking endpoint: {llm_config['base_url']}[/dim]")
+        console.print(f"  [white]Checking endpoint: {llm_config['base_url']}[/white]")
         try:
             from tweek.security.llm_reviewer import resolve_provider
             test_provider = resolve_provider(
@@ -1060,10 +1017,10 @@ def _validate_llm_provider(llm_config: dict) -> None:
                 console.print(f"  [green]✓[/green] Endpoint reachable")
             else:
                 console.print(f"  [yellow]⚠[/yellow] Could not verify endpoint")
-                console.print(f"  [dim]Tweek will try this endpoint at runtime[/dim]")
+                console.print(f"  [white]Tweek will try this endpoint at runtime[/white]")
         except Exception:
             console.print(f"  [yellow]⚠[/yellow] Could not verify endpoint")
-            console.print(f"  [dim]Tweek will try this endpoint at runtime[/dim]")
+            console.print(f"  [white]Tweek will try this endpoint at runtime[/white]")
         return
     else:
         expected_vars = env_var_map.get(provider, [])
@@ -1082,8 +1039,8 @@ def _validate_llm_provider(llm_config: dict) -> None:
     if not found_key:
         var_list = " or ".join(expected_vars)
         console.print(f"  [yellow]⚠[/yellow] {var_list} not set in environment")
-        console.print(f"  [dim]LLM review will be disabled until the key is available.[/dim]")
-        console.print(f"  [dim]Set it in your shell profile or .env file, then restart Claude Code.[/dim]")
+        console.print(f"  [white]LLM review will be disabled until the key is available.[/white]")
+        console.print(f"  [white]Set it in your shell profile or .env file, then restart Claude Code.[/white]")
 
         # Offer fallback
         console.print()
@@ -1102,7 +1059,7 @@ def _validate_llm_provider(llm_config: dict) -> None:
             else:
                 llm_config["provider_display"] = "disabled (no API key found)"
                 llm_config["model_display"] = None
-                console.print(f"  [dim]No API keys found — LLM review will be disabled[/dim]")
+                console.print(f"  [white]No API keys found — LLM review will be disabled[/white]")
 
 
 def _print_install_summary(
@@ -1142,7 +1099,7 @@ def _print_install_summary(
                         console.print(f"  [green]✓[/green] Hook Python: {hook_python}")
                     else:
                         console.print(f"  [yellow]⚠[/yellow] Hook Python not found: {hook_python}")
-                        console.print(f"    [dim]Run 'tweek install' again if Python was reinstalled[/dim]")
+                        console.print(f"    [white]Run 'tweek install' again if Python was reinstalled[/white]")
                 except (IndexError, KeyError):
                     pass
             elif has_pre:
@@ -1178,14 +1135,14 @@ def _print_install_summary(
     elif llm_display and "disabled" not in llm_display:
         console.print(f"  [green]✓[/green] LLM reviewer: {llm_display}")
     else:
-        console.print(f"  [dim]○[/dim] LLM reviewer: {llm_display}")
+        console.print(f"  [white]○[/white] LLM reviewer: {llm_display}")
 
     # Sandbox status
     caps = get_capabilities()
     if caps.sandbox_available:
         console.print(f"  [green]✓[/green] Sandbox: {caps.sandbox_tool}")
     else:
-        console.print(f"  [dim]○[/dim] Sandbox: not available ({caps.platform.value})")
+        console.print(f"  [white]○[/white] Sandbox: not available ({caps.platform.value})")
 
     # Summary table
     console.print()
@@ -1213,34 +1170,37 @@ def _print_install_summary(
 
     # Next steps
     console.print()
-    console.print("[dim]Next steps:[/dim]")
-    console.print("[dim]  tweek status       — Verify installation[/dim]")
-    console.print("[dim]  tweek update       — Get latest attack patterns[/dim]")
-    console.print("[dim]  tweek config list  — See security settings[/dim]")
+    console.print("[white]Next steps:[/white]")
+    console.print("[white]  tweek doctor       — Verify installation[/white]")
+    console.print("[white]  tweek update       — Get latest attack patterns[/white]")
+    console.print("[white]  tweek config list  — See security settings[/white]")
     if proxy_override_enabled:
-        console.print("[dim]  tweek proxy start  — Enable API interception[/dim]")
+        console.print("[white]  tweek proxy start  — Enable API interception[/white]")
 
 
 @main.command(
     epilog="""\b
 Examples:
-  tweek uninstall                        Interactive — choose what to remove
-  tweek uninstall --global               Remove global installation directly
-  tweek uninstall --everything           Remove ALL Tweek data system-wide
-  tweek uninstall --confirm              Skip confirmation prompt
+  tweek unprotect                          Interactive — choose what to remove
+  tweek unprotect claude-code              Remove Claude Code hooks
+  tweek unprotect claude-code --global     Remove global Claude Code hooks
+  tweek unprotect claude-desktop           Remove from Claude Desktop
+  tweek unprotect --all                    Remove ALL Tweek data system-wide
 """
 )
-@click.option("--global", "uninstall_global", is_flag=True, default=False,
-              help="Uninstall from ~/.claude/ (global installation)")
-@click.option("--everything", is_flag=True, default=False,
+@click.argument("tool", required=False, type=click.Choice(
+    ["claude-code", "openclaw", "claude-desktop", "chatgpt", "gemini"]))
+@click.option("--all", "remove_all", is_flag=True, default=False,
               help="Remove ALL Tweek data: hooks, skills, config, patterns, logs, MCP integrations")
+@click.option("--global", "unprotect_global", is_flag=True, default=False,
+              help="Remove from ~/.claude/ (global installation)")
 @click.option("--confirm", is_flag=True, help="Skip confirmation prompt")
-def uninstall(uninstall_global: bool, everything: bool, confirm: bool):
-    """Remove Tweek hooks and data from Claude Code.
+def unprotect(tool: str, remove_all: bool, unprotect_global: bool, confirm: bool):
+    """Remove Tweek protection from an AI tool.
 
-    When run without flags, presents an interactive menu to choose scope.
-    Use --global to remove from ~/.claude/ directly.
-    Use --everything to remove ALL Tweek data system-wide.
+    When run without arguments, launches an interactive wizard
+    that walks through each protected tool asking if you want
+    to remove protection. Use --all to remove everything at once.
 
     This command can only be run from an interactive terminal.
     AI agents are blocked from running it.
@@ -1252,64 +1212,71 @@ def uninstall(uninstall_global: bool, everything: bool, confirm: bool):
     # This is Layer 2 of protection (Layer 1 is the PreToolUse hook)
     # ─────────────────────────────────────────────────────────────
     if not sys.stdin.isatty():
-        console.print("[red]ERROR: tweek uninstall must be run from an interactive terminal.[/red]")
-        console.print("[dim]This command cannot be run by AI agents or automated scripts.[/dim]")
-        console.print("[dim]Open a terminal and run the command directly.[/dim]")
+        console.print("[red]ERROR: tweek unprotect must be run from an interactive terminal.[/red]")
+        console.print("[white]This command cannot be run by AI agents or automated scripts.[/white]")
+        console.print("[white]Open a terminal and run the command directly.[/white]")
         raise SystemExit(1)
 
+    # No tool and no --all: run interactive wizard
+    if not tool and not remove_all:
+        _run_unprotect_wizard()
+        return
+
     console.print(TWEEK_BANNER, style="cyan")
 
     tweek_dir = Path("~/.tweek").expanduser()
     global_target = Path("~/.claude").expanduser()
     project_target = Path.cwd() / ".claude"
 
-    if everything:
+    if remove_all:
         _uninstall_everything(global_target, project_target, tweek_dir, confirm)
-    elif uninstall_global:
-        _uninstall_scope(global_target, tweek_dir, confirm, scope_label="global")
-    else:
-        # ── Interactive scope selection ──
-        # Detect what's installed
-        has_project = _has_tweek_at(project_target)
-        has_global = _has_tweek_at(global_target)
-        has_data = tweek_dir.exists() and any(tweek_dir.iterdir()) if tweek_dir.exists() else False
-
-        if not has_project and not has_global and not has_data:
-            console.print("[yellow]No Tweek installation found.[/yellow]")
-            console.print(f"  Checked project:  {project_target}")
-            console.print(f"  Checked global:   {global_target}")
-            console.print(f"  Checked data:     {tweek_dir}")
-            _show_package_removal_hint()
-            return
+        _show_package_removal_hint()
+        return
 
-        console.print("[bold]What would you like to remove?[/bold]\n")
+    if tool == "claude-code":
+        if unprotect_global:
+            _uninstall_scope(global_target, tweek_dir, confirm, scope_label="global")
+        else:
+            _uninstall_scope(project_target, tweek_dir, confirm, scope_label="project")
+        _show_package_removal_hint()
+        return
 
-        options = []
-        if has_project:
-            options.append(("project", f"This project only ({project_target})"))
-        if has_global:
-            options.append(("global", f"Global installation (~/.claude/)"))
-        if has_project or has_global or has_data:
-            options.append(("everything", "Everything — all hooks, skills, config, data, and MCP integrations"))
+    if tool in ("claude-desktop", "chatgpt", "gemini"):
+        try:
+            from tweek.mcp.clients import get_client
+            handler = get_client(tool)
+            result = handler.uninstall()
+            if result.get("success"):
+                console.print(f"[green]{result.get('message', 'Uninstalled successfully')}[/green]")
+                if result.get("backup"):
+                    console.print(f"   Backup: {result['backup']}")
+                if result.get("instructions"):
+                    console.print()
+                    for line in result["instructions"]:
+                        console.print(f"   {line}")
+            else:
+                console.print(f"[red]{result.get('error', 'Uninstallation failed')}[/red]")
+        except Exception as e:
+            console.print(f"[red]Error: {e}[/red]")
+        return
 
-        for i, (_, label) in enumerate(options, 1):
-            console.print(f"  [bold]{i}.[/bold] {label}")
+    if tool == "openclaw":
+        console.print("[yellow]OpenClaw unprotect: removing Tweek proxy configuration...[/yellow]")
+        # TODO: implement openclaw unprotect
+        console.print("[white]Manual step: remove tweek plugin from openclaw.json[/white]")
+        return
 
-        console.print()
-        choice = click.prompt("Select", type=click.IntRange(1, len(options)), default=len(options))
+    _show_package_removal_hint()
 
-        selected = options[choice - 1][0]
-        console.print()
 
-        if selected == "project":
-            _uninstall_scope(project_target, tweek_dir, confirm, scope_label="project")
-        elif selected == "global":
-            _uninstall_scope(global_target, tweek_dir, confirm, scope_label="global")
-        elif selected == "everything":
-            _uninstall_everything(global_target, project_target, tweek_dir, confirm)
+@main.command()
+def status():
+    """Show Tweek protection status dashboard.
 
-    # Always show how to remove the CLI binary itself
-    _show_package_removal_hint()
+    Scans for all supported AI tools and displays which are
+    detected, which are protected by Tweek, and configuration details.
+    """
+    _show_protection_status()
 
 
 # ─────────────────────────────────────────────────────────────
@@ -1369,9 +1336,9 @@ def _show_package_removal_hint():
     console.print("[bold yellow]The tweek CLI binary is still installed on your system.[/bold yellow]")
 
     if len(pkg_cmds) > 1:
-        console.print(f"[dim]Found {len(pkg_cmds)} installations:[/dim]")
+        console.print(f"[white]Found {len(pkg_cmds)} installations:[/white]")
         for cmd in pkg_cmds:
-            console.print(f"  [dim]• {cmd}[/dim]")
+            console.print(f"  [white]• {cmd}[/white]")
 
     console.print()
     label = " + ".join(f"[bold]{cmd}[/bold]" for cmd in pkg_cmds)
@@ -1392,10 +1359,10 @@ def _show_package_removal_hint():
                     console.print(f"[green]✓[/green] Removed ({pkg_cmd})")
                 else:
                     console.print(f"[red]✗[/red] Failed: {result.stderr.strip()}")
-                    console.print(f"  [dim]Run manually: {pkg_cmd}[/dim]")
+                    console.print(f"  [white]Run manually: {pkg_cmd}[/white]")
             except (subprocess.TimeoutExpired, FileNotFoundError, OSError) as e:
                 console.print(f"[red]✗[/red] Could not run: {e}")
-                console.print(f"  [dim]Run manually: {pkg_cmd}[/dim]")
+                console.print(f"  [white]Run manually: {pkg_cmd}[/white]")
 
 
 def _has_tweek_at(target: Path) -> bool:
@@ -1629,18 +1596,18 @@ def _uninstall_scope(target: Path, tweek_dir: Path, confirm: bool, scope_label:
     console.print()
     console.print("[bold]The following will be removed:[/bold]")
     if has_hooks:
-        console.print("  [dim]•[/dim] PreToolUse and PostToolUse hooks from settings.json")
+        console.print("  [white]•[/white] PreToolUse and PostToolUse hooks from settings.json")
     if has_skills:
-        console.print("  [dim]•[/dim] Tweek skill directory (skills/tweek/)")
+        console.print("  [white]•[/white] Tweek skill directory (skills/tweek/)")
     if has_backup:
-        console.print("  [dim]•[/dim] Backup file (settings.json.tweek-backup)")
-    console.print("  [dim]•[/dim] Project whitelist entries from overrides")
+        console.print("  [white]•[/white] Backup file (settings.json.tweek-backup)")
+    console.print("  [white]•[/white] Project whitelist entries from overrides")
     console.print()
 
     if not confirm:
         console.print(f"[yellow]Remove Tweek from this {scope_label}?[/yellow] ", end="")
         if not click.confirm(""):
-            console.print("[dim]Cancelled[/dim]")
+            console.print("[white]Cancelled[/white]")
             return
 
     console.print()
@@ -1656,27 +1623,27 @@ def _uninstall_scope(target: Path, tweek_dir: Path, confirm: bool, scope_label:
     if _remove_skill_directory(target):
         console.print(f"  [green]✓[/green] Removed Tweek skill directory (skills/tweek/)")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: Tweek skill directory not found")
+        console.print(f"  [white]-[/white] Skipped: Tweek skill directory not found")
 
     # 3. Remove backup file
     if _remove_backup_file(target):
         console.print(f"  [green]✓[/green] Removed backup file (settings.json.tweek-backup)")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no backup file found")
+        console.print(f"  [white]-[/white] Skipped: no backup file found")
 
     # 4. Remove whitelist entries
     wl_count = _remove_whitelist_entries(target, tweek_dir)
     if wl_count > 0:
         console.print(f"  [green]✓[/green] Removed {wl_count} whitelist entry(s) from overrides")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no whitelist entries found for this {scope_label}")
+        console.print(f"  [white]-[/white] Skipped: no whitelist entries found for this {scope_label}")
 
     console.print()
     console.print(f"[green]Uninstall complete.[/green] Tweek is no longer active for this {scope_label}.")
     if scope_label == "project":
-        console.print("[dim]Global installation (~/.claude/) was not affected.[/dim]")
+        console.print("[white]Global installation (~/.claude/) was not affected.[/white]")
     else:
-        console.print("[dim]Project installations were not affected.[/dim]")
+        console.print("[white]Project installations were not affected.[/white]")
 
     # Offer to remove data directory
     if tweek_dir.exists() and not confirm:
@@ -1689,7 +1656,7 @@ def _uninstall_scope(target: Path, tweek_dir: Path, confirm: bool, scope_label:
 
         console.print()
         console.print("[yellow]Also remove Tweek data directory (~/.tweek/)?[/yellow]")
-        console.print("[dim]This contains config, patterns, security logs, and overrides.[/dim]")
+        console.print("[white]This contains config, patterns, security logs, and overrides.[/white]")
         if other_has_tweek:
             console.print(f"[bold red]Warning:[/bold red] Tweek is still installed at {other_label} scope ({other_target}).")
             console.print(f"  Removing ~/.tweek/ will affect that installation (no config, patterns, or logs).")
@@ -1704,9 +1671,9 @@ def _uninstall_scope(target: Path, tweek_dir: Path, confirm: bool, scope_label:
             for item in data_removed:
                 console.print(f"  [green]✓[/green] Removed {item}")
             if not data_removed:
-                console.print(f"  [dim]-[/dim] No data to remove")
+                console.print(f"  [white]-[/white] No data to remove")
     elif tweek_dir.exists():
-        console.print("[dim]Tweek data directory (~/.tweek/) was preserved.[/dim]")
+        console.print("[white]Tweek data directory (~/.tweek/) was preserved.[/white]")
 
 
 def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir: Path, confirm: bool):
@@ -1714,28 +1681,28 @@ def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir:
     import json
 
     console.print("[bold yellow]FULL REMOVAL[/bold yellow] — This will remove ALL Tweek data:\n")
-    console.print("  [dim]•[/dim] Hooks from current project (.claude/settings.json)")
-    console.print("  [dim]•[/dim] Hooks from global installation (~/.claude/settings.json)")
-    console.print("  [dim]•[/dim] Tweek skill directories (project + global)")
-    console.print("  [dim]•[/dim] All backup files")
-    console.print("  [dim]•[/dim] Tweek data directory (~/.tweek/)")
+    console.print("  [white]•[/white] Hooks from current project (.claude/settings.json)")
+    console.print("  [white]•[/white] Hooks from global installation (~/.claude/settings.json)")
+    console.print("  [white]•[/white] Tweek skill directories (project + global)")
+    console.print("  [white]•[/white] All backup files")
+    console.print("  [white]•[/white] Tweek data directory (~/.tweek/)")
 
     # Show what exists in ~/.tweek/
     if tweek_dir.exists():
         for item in sorted(tweek_dir.iterdir()):
             if item.is_dir():
-                console.print(f"      [dim]├── {item.name}/ [/dim]")
+                console.print(f"      [white]├── {item.name}/ [/white]")
             else:
-                console.print(f"      [dim]├── {item.name}[/dim]")
+                console.print(f"      [white]├── {item.name}[/white]")
 
-    console.print("  [dim]•[/dim] MCP integrations (Claude Desktop, ChatGPT)")
+    console.print("  [white]•[/white] MCP integrations (Claude Desktop, ChatGPT)")
     console.print()
 
     if not confirm:
         console.print("[bold red]Type 'yes' to confirm full removal[/bold red]: ", end="")
         response = input()
         if response.strip().lower() != "yes":
-            console.print("[dim]Cancelled[/dim]")
+            console.print("[white]Cancelled[/white]")
             return
 
     console.print()
@@ -1746,17 +1713,17 @@ def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir:
     for hook_type in removed_hooks:
         console.print(f"  [green]✓[/green] Removed {hook_type} hook from project settings.json")
     if not removed_hooks:
-        console.print(f"  [dim]-[/dim] Skipped: no project hooks found")
+        console.print(f"  [white]-[/white] Skipped: no project hooks found")
 
     if _remove_skill_directory(project_target):
         console.print(f"  [green]✓[/green] Removed Tweek skill from project")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no project skill directory")
+        console.print(f"  [white]-[/white] Skipped: no project skill directory")
 
     if _remove_backup_file(project_target):
         console.print(f"  [green]✓[/green] Removed project backup file")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no project backup file")
+        console.print(f"  [white]-[/white] Skipped: no project backup file")
 
     console.print()
 
@@ -1766,17 +1733,17 @@ def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir:
     for hook_type in removed_hooks:
         console.print(f"  [green]✓[/green] Removed {hook_type} hook from global settings.json")
     if not removed_hooks:
-        console.print(f"  [dim]-[/dim] Skipped: no global hooks found")
+        console.print(f"  [white]-[/white] Skipped: no global hooks found")
 
     if _remove_skill_directory(global_target):
         console.print(f"  [green]✓[/green] Removed Tweek skill from global installation")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no global skill directory")
+        console.print(f"  [white]-[/white] Skipped: no global skill directory")
 
     if _remove_backup_file(global_target):
         console.print(f"  [green]✓[/green] Removed global backup file")
     else:
-        console.print(f"  [dim]-[/dim] Skipped: no global backup file")
+        console.print(f"  [white]-[/white] Skipped: no global backup file")
 
     console.print()
 
@@ -1786,7 +1753,7 @@ def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir:
     for item in data_removed:
         console.print(f"  [green]✓[/green] Removed {item}")
     if not data_removed:
-        console.print(f"  [dim]-[/dim] Skipped: no data directory found")
+        console.print(f"  [white]-[/white] Skipped: no data directory found")
 
     console.print()
 
@@ -1796,7 +1763,7 @@ def _uninstall_everything(global_target: Path, project_target: Path, tweek_dir:
     for client in mcp_removed:
         console.print(f"  [green]✓[/green] Removed {client} MCP integration")
     if not mcp_removed:
-        console.print(f"  [dim]-[/dim] Skipped: no MCP integrations found")
+        console.print(f"  [white]-[/white] Skipped: no MCP integrations found")
 
     console.print()
     console.print("[green]All Tweek data has been removed.[/green]")
@@ -1875,8 +1842,8 @@ def trust(path: str, reason: str, list_trusted: bool):
         ]
 
         if not whitelist:
-            console.print("[dim]No trusted paths configured.[/dim]")
-            console.print("[dim]Use 'tweek trust' to trust the current project.[/dim]")
+            console.print("[white]No trusted paths configured.[/white]")
+            console.print("[white]Use 'tweek trust' to trust the current project.[/white]")
             return
 
         if trusted_entries:
@@ -1885,16 +1852,16 @@ def trust(path: str, reason: str, list_trusted: bool):
                 entry_reason = entry.get("reason", "")
                 console.print(f"  [green]✓[/green] {entry['path']}")
                 if entry_reason:
-                    console.print(f"    [dim]{entry_reason}[/dim]")
+                    console.print(f"    [white]{entry_reason}[/white]")
 
         if tool_scoped:
             console.print("\n[bold]Tool-scoped whitelist entries:[/bold]\n")
             for entry in tool_scoped:
                 tools = ", ".join(entry.get("tools", []))
                 entry_reason = entry.get("reason", "")
-                console.print(f"  [cyan]○[/cyan] {entry['path']}  [dim]({tools})[/dim]")
+                console.print(f"  [cyan]○[/cyan] {entry['path']}  [white]({tools})[/white]")
                 if entry_reason:
-                    console.print(f"    [dim]{entry_reason}[/dim]")
+                    console.print(f"    [white]{entry_reason}[/white]")
 
         if other_entries:
             console.print("\n[bold]Other whitelist entries:[/bold]\n")
@@ -1905,9 +1872,9 @@ def trust(path: str, reason: str, list_trusted: bool):
                     console.print(f"  [cyan]○[/cyan] Command: {entry['command_prefix']}")
                 entry_reason = entry.get("reason", "")
                 if entry_reason:
-                    console.print(f"    [dim]{entry_reason}[/dim]")
+                    console.print(f"    [white]{entry_reason}[/white]")
 
-        console.print(f"\n[dim]Config: {overrides_path}[/dim]")
+        console.print(f"\n[white]Config: {overrides_path}[/white]")
         return
 
     # Resolve path to absolute
@@ -1924,7 +1891,7 @@ def trust(path: str, reason: str, list_trusted: bool):
 
     if already_trusted:
         console.print(f"[green]✓[/green] Already trusted: {resolved}")
-        console.print("[dim]Use 'tweek untrust' to remove.[/dim]")
+        console.print("[white]Use 'tweek untrust' to remove.[/white]")
         return
 
     # Add whitelist entry (no tools restriction = all tools exempt)
@@ -1942,8 +1909,8 @@ def trust(path: str, reason: str, list_trusted: bool):
         return
 
     console.print(f"[green]✓[/green] Trusted: {resolved}")
-    console.print(f"  [dim]All screening is now skipped for files in this directory.[/dim]")
-    console.print(f"  [dim]To resume screening: tweek untrust {path}[/dim]")
+    console.print(f"  [white]All screening is now skipped for files in this directory.[/white]")
+    console.print(f"  [white]To resume screening: tweek untrust {path}[/white]")
 
 
 @main.command(
@@ -1991,7 +1958,7 @@ def untrust(path: str):
 
     if len(whitelist) == original_len:
         console.print(f"[yellow]This path is not currently trusted:[/yellow] {resolved}")
-        console.print("[dim]Use 'tweek trust --list' to see all trusted paths.[/dim]")
+        console.print("[white]Use 'tweek trust --list' to see all trusted paths.[/white]")
         return
 
     overrides["whitelist"] = whitelist
@@ -2007,7 +1974,7 @@ def untrust(path: str):
         return
 
     console.print(f"[green]✓[/green] Removed trust: {resolved}")
-    console.print(f"  [dim]Tweek will now screen tool calls for files in this directory.[/dim]")
+    console.print(f"  [white]Tweek will now screen tool calls for files in this directory.[/white]")
 
 
 @main.command(
@@ -2038,7 +2005,7 @@ def update(check: bool):
         # First time: clone the repo
         if check:
             console.print("[yellow]Patterns not installed.[/yellow]")
-            console.print(f"[dim]Run 'tweek update' to install from {patterns_repo}[/dim]")
+            console.print(f"[white]Run 'tweek update' to install from {patterns_repo}[/white]")
             return
 
         console.print(f"[cyan]Installing patterns from {patterns_repo}...[/cyan]")
@@ -2060,15 +2027,15 @@ def update(check: bool):
                     data = yaml.safe_load(f)
                 count = data.get("pattern_count", len(data.get("patterns", [])))
                 free_max = data.get("free_tier_max", 23)
-                console.print(f"[dim]Installed {count} patterns ({free_max} free, {count - free_max} pro)[/dim]")
+                console.print(f"[white]Installed {count} patterns ({free_max} free, {count - free_max} pro)[/white]")
 
         except subprocess.CalledProcessError as e:
             console.print(f"[red]✗[/red] Failed to clone patterns: {e.stderr}")
             return
         except FileNotFoundError:
             console.print("[red]\u2717[/red] git not found.")
-            console.print("  [dim]Hint: Install git from https://git-scm.com/downloads[/dim]")
-            console.print("  [dim]On macOS: xcode-select --install[/dim]")
+            console.print("  [white]Hint: Install git from https://git-scm.com/downloads[/white]")
+            console.print("  [white]On macOS: xcode-select --install[/white]")
             return
 
     else:
@@ -2089,7 +2056,7 @@ def update(check: bool):
                 )
                 if "behind" in result2.stdout:
                     console.print("[yellow]Updates available.[/yellow]")
-                    console.print("[dim]Run 'tweek update' to install[/dim]")
+                    console.print("[white]Run 'tweek update' to install[/white]")
                 else:
                     console.print("[green]✓[/green] Patterns are up to date")
             except Exception as e:
@@ -2113,11 +2080,11 @@ def update(check: bool):
 
                 # Show what changed
                 if result.stdout.strip():
-                    console.print(f"[dim]{result.stdout.strip()}[/dim]")
+                    console.print(f"[white]{result.stdout.strip()}[/white]")
 
         except subprocess.CalledProcessError as e:
             console.print(f"[red]✗[/red] Failed to update patterns: {e.stderr}")
-            console.print("[dim]Try: rm -rf ~/.tweek/patterns && tweek update[/dim]")
+            console.print("[white]Try: rm -rf ~/.tweek/patterns && tweek update[/white]")
             return
 
     # Show current version info
@@ -2135,7 +2102,7 @@ def update(check: bool):
             console.print(f"[cyan]Total patterns:[/cyan] {count} (all included free)")
 
             console.print(f"[cyan]All features:[/cyan] LLM review, session analysis, rate limiting, sandbox (open source)")
-            console.print(f"[dim]Pro (teams) and Enterprise (compliance) coming soon: gettweek.com[/dim]")
+            console.print(f"[white]Pro (teams) and Enterprise (compliance) coming soon: gettweek.com[/white]")
 
         except Exception:
             pass
@@ -2168,21 +2135,113 @@ def doctor(verbose: bool, json_out: bool):
         print_doctor_results(checks)
 
 
-# `tweek status` — alias for `tweek doctor`
-@main.command("status")
-@click.option("--verbose", "-v", is_flag=True, help="Show detailed check information")
-@click.option("--json-output", "--json", "json_out", is_flag=True, help="Output results as JSON")
-def status(verbose: bool, json_out: bool):
-    """Show Tweek protection status (alias for 'tweek doctor')."""
-    from tweek.diagnostics import run_health_checks
-    from tweek.cli_helpers import print_doctor_results, print_doctor_json
 
-    checks = run_health_checks(verbose=verbose)
+@main.command("upgrade")
+def upgrade():
+    """Upgrade Tweek to the latest version from PyPI.
 
-    if json_out:
-        print_doctor_json(checks)
-    else:
-        print_doctor_results(checks)
+    Detects how Tweek was installed (uv, pipx, or pip) and runs
+    the appropriate upgrade command.
+    """
+    import subprocess
+
+    console.print("[cyan]Checking for updates...[/cyan]")
+    console.print()
+
+    current_version = None
+    try:
+        from tweek import __version__
+        current_version = __version__
+        console.print(f"  Current version: [bold]{current_version}[/bold]")
+    except ImportError:
+        pass
+
+    # Detect install method and upgrade
+    upgraded = False
+
+    # Try uv first
+    try:
+        result = subprocess.run(
+            ["uv", "tool", "list"], capture_output=True, text=True, timeout=10
+        )
+        if result.returncode == 0 and "tweek" in result.stdout:
+            console.print("  Install method: [cyan]uv[/cyan]")
+            console.print()
+            console.print("[white]Upgrading via uv...[/white]")
+            proc = subprocess.run(
+                ["uv", "tool", "upgrade", "tweek"],
+                capture_output=False, timeout=120
+            )
+            if proc.returncode == 0:
+                upgraded = True
+            else:
+                console.print("[yellow]uv upgrade failed, trying reinstall...[/yellow]")
+                subprocess.run(
+                    ["uv", "tool", "install", "--force", "tweek"],
+                    capture_output=False, timeout=120
+                )
+                upgraded = True
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        pass
+
+    # Try pipx
+    if not upgraded:
+        try:
+            result = subprocess.run(
+                ["pipx", "list"], capture_output=True, text=True, timeout=10
+            )
+            if result.returncode == 0 and "tweek" in result.stdout:
+                console.print("  Install method: [cyan]pipx[/cyan]")
+                console.print()
+                console.print("[white]Upgrading via pipx...[/white]")
+                proc = subprocess.run(
+                    ["pipx", "upgrade", "tweek"],
+                    capture_output=False, timeout=120
+                )
+                upgraded = proc.returncode == 0
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            pass
+
+    # Try pip
+    if not upgraded:
+        try:
+            result = subprocess.run(
+                [sys.executable, "-m", "pip", "show", "tweek"],
+                capture_output=True, text=True, timeout=10
+            )
+            if result.returncode == 0:
+                console.print("  Install method: [cyan]pip[/cyan]")
+                console.print()
+                console.print("[white]Upgrading via pip...[/white]")
+                proc = subprocess.run(
+                    [sys.executable, "-m", "pip", "install", "--upgrade", "tweek"],
+                    capture_output=False, timeout=120
+                )
+                upgraded = proc.returncode == 0
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            pass
+
+    if not upgraded:
+        console.print("[red]Could not determine install method.[/red]")
+        console.print("[white]Try manually:[/white]")
+        console.print("  uv tool upgrade tweek")
+        console.print("  pipx upgrade tweek")
+        console.print("  pip install --upgrade tweek")
+        return
+
+    # Show new version
+    console.print()
+    try:
+        result = subprocess.run(
+            ["tweek", "--version"], capture_output=True, text=True, timeout=10
+        )
+        if result.returncode == 0:
+            new_version = result.stdout.strip()
+            console.print(f"[green]✓[/green] Updated to {new_version}")
+        else:
+            console.print("[green]✓[/green] Update complete")
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        console.print("[green]✓[/green] Update complete")
 
 
 @main.command(
@@ -2241,8 +2300,8 @@ def audit(path, translate, llm_review, json_out):
         skills = scan_installed_skills()
 
         if not skills:
-            console.print("[dim]No installed skills found.[/dim]")
-            console.print("[dim]Specify a file path to audit: tweek audit <path>[/dim]")
+            console.print("[white]No installed skills found.[/white]")
+            console.print("[white]Specify a file path to audit: tweek audit <path>[/white]")
             return
 
         console.print(f"Found {len(skills)} skill(s)")
@@ -2291,7 +2350,7 @@ def _print_audit_result(result):
     risk_icons = {"safe": "[green]SAFE[/green]", "suspicious": "[yellow]SUSPICIOUS[/yellow]", "dangerous": "[red]DANGEROUS[/red]"}
 
     console.print(f"  [bold]{result.skill_name}[/bold] — {risk_icons.get(result.risk_level, result.risk_level)}")
-    console.print(f"  [dim]{result.skill_path}[/dim]")
+    console.print(f"  [white]{result.skill_path}[/white]")
 
     if result.error:
         console.print(f"  [red]Error: {result.error}[/red]")
@@ -2306,12 +2365,12 @@ def _print_audit_result(result):
 
     if result.findings:
         table = Table(show_header=True, header_style="bold", box=None, padding=(0, 2))
-        table.add_column("Severity", style="dim")
+        table.add_column("Severity", style="white")
         table.add_column("Pattern")
         table.add_column("Description")
-        table.add_column("Match", style="dim")
+        table.add_column("Match", style="white")
 
-        severity_styles = {"critical": "red bold", "high": "red", "medium": "yellow", "low": "dim"}
+        severity_styles = {"critical": "red bold", "high": "red", "medium": "yellow", "low": "white"}
 
         for finding in result.findings:
             table.add_row(
@@ -2410,7 +2469,7 @@ def quickstart():
     # Step 2: Security preset
     console.print("[bold cyan]Step 2/4: Security Preset[/bold cyan]")
     console.print("  [cyan]1.[/cyan] paranoid  \u2014 Block everything suspicious, prompt on risky")
-    console.print("  [cyan]2.[/cyan] cautious  \u2014 Block dangerous, prompt on risky [dim](recommended)[/dim]")
+    console.print("  [cyan]2.[/cyan] cautious  \u2014 Block dangerous, prompt on risky [white](recommended)[/white]")
     console.print("  [cyan]3.[/cyan] trusted   \u2014 Allow most operations, block only dangerous")
     console.print()
 
@@ -2449,17 +2508,16 @@ def quickstart():
     if setup_mcp:
         try:
             import mcp  # noqa: F401
-            console.print("[dim]MCP package available. Configure upstream servers in ~/.tweek/config.yaml[/dim]")
-            console.print("[dim]Then run: tweek mcp proxy[/dim]")
+            console.print("[white]MCP package available. Configure upstream servers in ~/.tweek/config.yaml[/white]")
+            console.print("[white]Then run: tweek mcp proxy[/white]")
         except ImportError:
             print_warning("MCP package not installed. Install with: pip install tweek[mcp]")
     else:
-        console.print("[dim]Skipped.[/dim]")
+        console.print("[white]Skipped.[/white]")
 
     console.print()
     console.print("[bold green]Setup complete![/bold green]")
     console.print("  Run [cyan]tweek doctor[/cyan] to verify your installation")
-    console.print("  Run [cyan]tweek status[/cyan] to see protection status")
 
 
 def _quickstart_install_hooks(scope: str) -> None:
@@ -2527,21 +2585,31 @@ def _quickstart_install_hooks(scope: str) -> None:
 # =============================================================================
 
 @main.group(
+    invoke_without_command=True,
     epilog="""\b
 Examples:
-  tweek protect openclaw                One-command OpenClaw protection
-  tweek protect openclaw --paranoid     Use paranoid security preset
-  tweek protect openclaw --port 9999    Override gateway port
-  tweek protect claude                 Install Claude Code hooks (alias for tweek install)
+  tweek protect                          Interactive wizard — detect & protect all tools
+  tweek protect --status                 Show protection status for all tools
+  tweek protect claude-code              Install Claude Code hooks
+  tweek protect openclaw                 One-command OpenClaw protection
+  tweek protect claude-desktop           Configure Claude Desktop integration
+  tweek protect chatgpt                  Set up ChatGPT Desktop integration
+  tweek protect gemini                   Configure Gemini CLI integration
 """
 )
-def protect():
-    """Set up Tweek protection for a specific AI agent.
+@click.option("--status", is_flag=True, help="Show protection status for all tools")
+@click.pass_context
+def protect(ctx, status):
+    """Set up Tweek protection for AI tools.
 
-    One-command setup that auto-detects, configures, and starts
-    screening all tool calls for your AI assistant.
+    When run without a subcommand, launches an interactive wizard
+    that auto-detects installed AI tools and offers to protect them.
     """
-    pass
+    if status:
+        _show_protection_status()
+        return
+    if ctx.invoked_subcommand is None:
+        _run_protect_wizard()
 
 
 @protect.command(
@@ -2589,11 +2657,11 @@ def protect_openclaw(port, paranoid, preset):
         console.print()
         console.print("[red]OpenClaw not detected on this system.[/red]")
         console.print()
-        console.print("[dim]Install OpenClaw first:[/dim]")
+        console.print("[white]Install OpenClaw first:[/white]")
         console.print("  npm install -g openclaw")
         console.print()
-        console.print("[dim]Or if OpenClaw is installed in a non-standard location,[/dim]")
-        console.print("[dim]specify the gateway port manually:[/dim]")
+        console.print("[white]Or if OpenClaw is installed in a non-standard location,[/white]")
+        console.print("[white]specify the gateway port manually:[/white]")
         console.print("  tweek protect openclaw --port 18789")
         return
 
@@ -2610,7 +2678,7 @@ def protect_openclaw(port, paranoid, preset):
     elif openclaw["process_running"]:
         console.print(" [yellow](process running, gateway inactive)[/yellow]")
     else:
-        console.print(" [dim](not running)[/dim]")
+        console.print(" [white](not running)[/white]")
 
     if openclaw["config_path"]:
         console.print(f"  Config:     {openclaw['config_path']}")
@@ -2634,7 +2702,7 @@ def protect_openclaw(port, paranoid, preset):
     if anthropic_key:
         console.print("  LLM Review: [green]active[/green] (ANTHROPIC_API_KEY found)")
     else:
-        console.print("  LLM Review: [dim]available (set ANTHROPIC_API_KEY for semantic analysis)[/dim]")
+        console.print("  LLM Review: [white]available (set ANTHROPIC_API_KEY for semantic analysis)[/white]")
 
     # Show warnings
     for warning in result.warnings:
@@ -2644,53 +2712,366 @@ def protect_openclaw(port, paranoid, preset):
 
     if not openclaw["gateway_active"]:
         console.print("[yellow]Note: OpenClaw gateway is not currently running.[/yellow]")
-        console.print("[dim]Protection will activate when OpenClaw starts.[/dim]")
+        console.print("[white]Protection will activate when OpenClaw starts.[/white]")
         console.print()
 
     console.print("[green]Protection configured.[/green] Screening all OpenClaw tool calls.")
     console.print()
-    console.print("[dim]Verify:     tweek doctor[/dim]")
-    console.print("[dim]Logs:       tweek logs show[/dim]")
-    console.print("[dim]Stop:       tweek proxy stop[/dim]")
+    console.print("[white]Verify:     tweek doctor[/white]")
+    console.print("[white]Logs:       tweek logs show[/white]")
+    console.print("[white]Stop:       tweek proxy stop[/white]")
 
 
 @protect.command(
-    "claude",
+    "claude-code",
     epilog="""\b
 Examples:
-  tweek protect claude                 Install Claude Code hooks (current project)
-  tweek protect claude --global        Install globally (all projects)
+  tweek protect claude-code              Install for current project
+  tweek protect claude-code --global     Install globally (all projects)
+  tweek protect claude-code --quick      Zero-prompt install with defaults
+  tweek protect claude-code --preset paranoid   Apply paranoid security preset
 """
 )
 @click.option("--global", "install_global", is_flag=True, default=False,
               help="Install globally to ~/.claude/ (protects all projects)")
+@click.option("--dev-test", is_flag=True, hidden=True,
+              help="Install to test environment (for Tweek development only)")
+@click.option("--backup/--no-backup", default=True,
+              help="Backup existing hooks before installation")
+@click.option("--skip-env-scan", is_flag=True,
+              help="Skip scanning for .env files to migrate")
+@click.option("--interactive", "-i", is_flag=True,
+              help="Interactively configure security settings")
 @click.option("--preset", type=click.Choice(["paranoid", "cautious", "trusted"]),
-              default=None, help="Security preset to apply")
-@click.pass_context
-def protect_claude(ctx, install_global, preset):
+              help="Apply a security preset (skip interactive)")
+@click.option("--ai-defaults", is_flag=True,
+              help="Let AI suggest default settings based on detected skills")
+@click.option("--with-sandbox", is_flag=True,
+              help="Prompt to install sandbox tool if not available (Linux only)")
+@click.option("--force-proxy", is_flag=True,
+              help="Force Tweek proxy to override existing proxy configurations (e.g., openclaw)")
+@click.option("--skip-proxy-check", is_flag=True,
+              help="Skip checking for existing proxy configurations")
+@click.option("--quick", is_flag=True,
+              help="Zero-prompt install with cautious defaults (skips env scan and proxy check)")
+def protect_claude_code(install_global, dev_test, backup, skip_env_scan, interactive, preset, ai_defaults, with_sandbox, force_proxy, skip_proxy_check, quick):
     """Install Tweek hooks for Claude Code.
 
-    This is equivalent to 'tweek install' -- installs PreToolUse
-    and PostToolUse hooks to screen all Claude Code tool calls.
+    Installs PreToolUse and PostToolUse hooks to screen all
+    Claude Code tool calls through Tweek's security pipeline.
     """
-    # Delegate to the main install command
-    # (use main.commands lookup to avoid name shadowing by mcp install)
-    install_cmd = main.commands['install']
-    ctx.invoke(
-        install_cmd,
+    _install_claude_code_hooks(
         install_global=install_global,
-        dev_test=False,
-        backup=True,
-        skip_env_scan=False,
-        interactive=False,
+        dev_test=dev_test,
+        backup=backup,
+        skip_env_scan=skip_env_scan,
+        interactive=interactive,
         preset=preset,
-        ai_defaults=False,
-        with_sandbox=False,
-        force_proxy=False,
-        skip_proxy_check=False,
+        ai_defaults=ai_defaults,
+        with_sandbox=with_sandbox,
+        force_proxy=force_proxy,
+        skip_proxy_check=skip_proxy_check,
+        quick=quick,
     )
 
 
+@protect.command("claude-desktop")
+def protect_claude_desktop():
+    """Configure Tweek as MCP server for Claude Desktop."""
+    _protect_mcp_client("claude-desktop")
+
+
+@protect.command("chatgpt")
+def protect_chatgpt():
+    """Configure Tweek as MCP server for ChatGPT Desktop."""
+    _protect_mcp_client("chatgpt")
+
+
+@protect.command("gemini")
+def protect_gemini():
+    """Configure Tweek as MCP server for Gemini CLI."""
+    _protect_mcp_client("gemini")
+
+
+def _protect_mcp_client(client_name: str):
+    """Shared logic for MCP client protection commands."""
+    try:
+        from tweek.mcp.clients import get_client
+
+        handler = get_client(client_name)
+        result = handler.install()
+
+        if result.get("success"):
+            console.print(f"[green]{result.get('message', 'Installed successfully')}[/green]")
+            if result.get("config_path"):
+                console.print(f"   Config: {result['config_path']}")
+            if result.get("backup"):
+                console.print(f"   Backup: {result['backup']}")
+            if result.get("instructions"):
+                console.print()
+                for line in result["instructions"]:
+                    console.print(f"   {line}")
+        else:
+            console.print(f"[red]{result.get('error', 'Installation failed')}[/red]")
+    except Exception as e:
+        console.print(f"[red]Error: {e}[/red]")
+
+
+# =============================================================================
+# PROTECT WIZARD & STATUS HELPERS
+# =============================================================================
+
+
+def _detect_all_tools():
+    """Detect all supported AI tools and their protection status.
+
+    Returns list of (tool_id, label, installed, protected, detail) tuples.
+    """
+    import shutil
+    import json
+
+    tools = []
+
+    # Claude Code
+    claude_installed = shutil.which("claude") is not None
+    claude_protected = _has_tweek_at(Path("~/.claude").expanduser()) if claude_installed else False
+    tools.append((
+        "claude-code", "Claude Code", claude_installed, claude_protected,
+        "Hooks in ~/.claude/settings.json" if claude_protected else "",
+    ))
+
+    # OpenClaw
+    oc_installed = False
+    oc_protected = False
+    oc_detail = ""
+    try:
+        from tweek.integrations.openclaw import detect_openclaw_installation
+        openclaw = detect_openclaw_installation()
+        oc_installed = openclaw.get("installed", False)
+        if oc_installed:
+            oc_protected = openclaw.get("tweek_configured", False)
+            oc_detail = f"Gateway port {openclaw.get('gateway_port', '?')}"
+    except Exception:
+        pass
+    tools.append(("openclaw", "OpenClaw", oc_installed, oc_protected, oc_detail))
+
+    # MCP clients
+    mcp_configs = [
+        ("claude-desktop", "Claude Desktop",
+         Path("~/Library/Application Support/Claude/claude_desktop_config.json").expanduser()),
+        ("chatgpt", "ChatGPT Desktop",
+         Path("~/Library/Application Support/com.openai.chat/developer_settings.json").expanduser()),
+        ("gemini", "Gemini CLI",
+         Path("~/.gemini/settings.json").expanduser()),
+    ]
+    for tool_id, label, config_path in mcp_configs:
+        installed = config_path.exists()
+        protected = False
+        if installed:
+            try:
+                with open(config_path) as f:
+                    data = json.load(f)
+                mcp_servers = data.get("mcpServers", {})
+                protected = "tweek-security" in mcp_servers or "tweek" in mcp_servers
+            except Exception:
+                pass
+        detail = str(config_path) if protected else ""
+        tools.append((tool_id, label, installed, protected, detail))
+
+    return tools
+
+
+def _run_protect_wizard():
+    """Interactive wizard: detect tools and ask Y/n for each one."""
+    console.print(TWEEK_BANNER, style="cyan")
+    console.print("[bold]Tweek Protection Wizard[/bold]\n")
+    console.print("Scanning for AI tools...\n")
+
+    tools = _detect_all_tools()
+
+    # Show detection summary
+    detected = [(tid, label, prot) for tid, label, inst, prot, _ in tools if inst]
+    not_detected = [label for _, label, inst, _, _ in tools if not inst]
+
+    if not_detected:
+        for label in not_detected:
+            console.print(f"  [white]{label:<20}[/white] [white]not found[/white]")
+
+    if not detected:
+        console.print("\n[yellow]No AI tools detected on this system.[/yellow]")
+        return
+
+    # Show already-protected tools
+    already_protected = [(tid, label) for tid, label, prot in detected if prot]
+    unprotected = [(tid, label) for tid, label, prot in detected if not prot]
+
+    for _, label in already_protected:
+        console.print(f"  [green]{label:<20} protected[/green]")
+
+    if not unprotected:
+        console.print(f"\n[green]All {len(already_protected)} detected tool(s) already protected.[/green]")
+        console.print("Run 'tweek status' to see details.")
+        return
+
+    for _, label in unprotected:
+        console.print(f"  [yellow]{label:<20} not protected[/yellow]")
+
+    # Ask for preset first (applies to all)
+    console.print()
+    console.print("[bold]Security preset:[/bold]")
+    console.print("  [bold]1.[/bold] cautious [white](recommended)[/white] — screen risky & dangerous tools")
+    console.print("  [bold]2.[/bold] paranoid — screen everything except safe tools")
+    console.print("  [bold]3.[/bold] trusted — only screen dangerous tools")
+    console.print()
+    preset_choice = click.prompt("Select preset", type=click.IntRange(1, 3), default=1)
+    preset = ["cautious", "paranoid", "trusted"][preset_choice - 1]
+
+    # Walk through each unprotected tool
+    console.print()
+    protected_count = 0
+    skipped_count = 0
+
+    for tool_id, label in unprotected:
+        protect_it = click.confirm(f"  Protect {label}?", default=True)
+
+        if not protect_it:
+            console.print(f"    [white]skipped[/white]")
+            skipped_count += 1
+            continue
+
+        try:
+            if tool_id == "claude-code":
+                _install_claude_code_hooks(
+                    install_global=True, dev_test=False, backup=True,
+                    skip_env_scan=True, interactive=False, preset=preset,
+                    ai_defaults=False, with_sandbox=False, force_proxy=False,
+                    skip_proxy_check=True, quick=True,
+                )
+            elif tool_id == "openclaw":
+                from tweek.integrations.openclaw import setup_openclaw_protection
+                result = setup_openclaw_protection(preset=preset)
+                if result.success:
+                    console.print(f"    [green]done[/green]")
+                else:
+                    console.print(f"    [red]failed: {result.error}[/red]")
+                    continue
+            elif tool_id in ("claude-desktop", "chatgpt", "gemini"):
+                _protect_mcp_client(tool_id)
+            protected_count += 1
+        except Exception as e:
+            console.print(f"    [red]error: {e}[/red]")
+
+    console.print()
+    if protected_count:
+        console.print(f"[green]Protected {protected_count} tool(s).[/green]", end="")
+    if skipped_count:
+        console.print(f"  [white]Skipped {skipped_count}.[/white]", end="")
+    console.print()
+    console.print("Run 'tweek status' to see the full dashboard.")
+
+
+def _run_unprotect_wizard():
+    """Interactive wizard: detect protected tools and ask Y/n to unprotect each."""
+    console.print(TWEEK_BANNER, style="cyan")
+    console.print("[bold]Tweek Unprotect Wizard[/bold]\n")
+    console.print("Scanning for protected AI tools...\n")
+
+    tools = _detect_all_tools()
+    tweek_dir = Path("~/.tweek").expanduser()
+    global_target = Path("~/.claude").expanduser()
+    project_target = Path.cwd() / ".claude"
+
+    protected = [(tid, label) for tid, label, inst, prot, _ in tools if inst and prot]
+
+    if not protected:
+        console.print("[yellow]No protected tools found.[/yellow]")
+        return
+
+    for _, label in protected:
+        console.print(f"  [green]{label:<20} protected[/green]")
+
+    console.print()
+    removed_count = 0
+    skipped_count = 0
+
+    for tool_id, label in protected:
+        remove_it = click.confirm(f"  Remove protection from {label}?", default=False)
+
+        if not remove_it:
+            console.print(f"    [white]kept[/white]")
+            skipped_count += 1
+            continue
+
+        try:
+            if tool_id == "claude-code":
+                _uninstall_scope(global_target, tweek_dir, confirm=True, scope_label="global")
+            elif tool_id in ("claude-desktop", "chatgpt", "gemini"):
+                from tweek.mcp.clients import get_client
+                handler = get_client(tool_id)
+                result = handler.uninstall()
+                if result.get("success"):
+                    console.print(f"    [green]{result.get('message', 'removed')}[/green]")
+                else:
+                    console.print(f"    [red]{result.get('error', 'failed')}[/red]")
+                    continue
+            elif tool_id == "openclaw":
+                console.print("    [white]Manual step: remove tweek plugin from openclaw.json[/white]")
+            removed_count += 1
+        except Exception as e:
+            console.print(f"    [red]error: {e}[/red]")
+
+    console.print()
+    if removed_count:
+        console.print(f"[green]Removed protection from {removed_count} tool(s).[/green]", end="")
+    if skipped_count:
+        console.print(f"  [white]Kept {skipped_count}.[/white]", end="")
+    console.print()
+
+
+def _show_protection_status():
+    """Show protection status dashboard for all AI tools."""
+    console.print(TWEEK_BANNER, style="cyan")
+
+    tools = _detect_all_tools()
+
+    # Build status table
+    table = Table(title="Protection Status", show_lines=False)
+    table.add_column("Tool", style="cyan", min_width=18)
+    table.add_column("Installed", justify="center", min_width=10)
+    table.add_column("Protected", justify="center", min_width=10)
+    table.add_column("Details")
+
+    detected_count = 0
+    protected_count = 0
+
+    for tool_id, label, installed, protected, detail in tools:
+        if installed:
+            detected_count += 1
+        if protected:
+            protected_count += 1
+
+        table.add_row(
+            label,
+            "[green]yes[/green]" if installed else "[white]no[/white]",
+            "[green]yes[/green]" if protected else "[yellow]no[/yellow]" if installed else "[white]—[/white]",
+            detail,
+        )
+
+    console.print(table)
+    console.print()
+
+    # Summary line
+    unprotected_count = detected_count - protected_count
+    if detected_count == 0:
+        console.print("[yellow]No AI tools detected.[/yellow]")
+    elif unprotected_count == 0:
+        console.print(f"[green]{protected_count}/{detected_count} detected tools protected.[/green]")
+    else:
+        console.print(f"[yellow]{protected_count}/{detected_count} detected tools protected. {unprotected_count} unprotected.[/yellow]")
+        console.print("[white]Run 'tweek protect' to set up protection.[/white]")
+    console.print()
+
+
 # =============================================================================
 # CONFIG COMMANDS
 # =============================================================================
@@ -2775,7 +3156,7 @@ def config_list(show_tools: bool, show_skills: bool, summary: bool):
     }
 
     source_styles = {
-        "default": "dim",
+        "default": "white",
         "user": "cyan",
         "project": "magenta",
     }
@@ -2784,7 +3165,7 @@ def config_list(show_tools: bool, show_skills: bool, summary: bool):
         table = Table(title="Tool Security Tiers")
         table.add_column("Tool", style="bold")
         table.add_column("Tier")
-        table.add_column("Source", style="dim")
+        table.add_column("Source", style="white")
         table.add_column("Description")
 
         for tool in cfg.list_tools():
@@ -2804,7 +3185,7 @@ def config_list(show_tools: bool, show_skills: bool, summary: bool):
         table = Table(title="Skill Security Tiers")
         table.add_column("Skill", style="bold")
         table.add_column("Tier")
-        table.add_column("Source", style="dim")
+        table.add_column("Source", style="white")
         table.add_column("Description")
 
         for skill in cfg.list_skills():
@@ -2819,8 +3200,8 @@ def config_list(show_tools: bool, show_skills: bool, summary: bool):
 
         console.print(table)
 
-    console.print("\n[dim]Tiers: safe (no checks) → default (regex) → risky (+LLM) → dangerous (+sandbox)[/dim]")
-    console.print("[dim]Sources: default (built-in), user (~/.tweek/config.yaml), project (.tweek/config.yaml)[/dim]")
+    console.print("\n[white]Tiers: safe (no checks) → default (regex) → risky (+LLM) → dangerous (+sandbox)[/white]")
+    console.print("[white]Sources: default (built-in), user (~/.tweek/config.yaml), project (.tweek/config.yaml)[/white]")
 
 
 @config.command("set",
@@ -2883,11 +3264,11 @@ def config_preset(preset_name: str, scope: str):
     console.print(f"[green]✓[/green] Applied [bold]{preset_name}[/bold] preset ({scope} config)")
 
     if preset_name == "paranoid":
-        console.print("[dim]All tools require screening, Bash commands always sandboxed[/dim]")
+        console.print("[white]All tools require screening, Bash commands always sandboxed[/white]")
     elif preset_name == "cautious":
-        console.print("[dim]Balanced: read-only tools safe, Bash dangerous[/dim]")
+        console.print("[white]Balanced: read-only tools safe, Bash dangerous[/white]")
     elif preset_name == "trusted":
-        console.print("[dim]Minimal prompts: only high-risk patterns trigger alerts[/dim]")
+        console.print("[white]Minimal prompts: only high-risk patterns trigger alerts[/white]")
 
 
 @config.command("reset",
@@ -2912,7 +3293,7 @@ def config_reset(skill: str, tool: str, reset_all: bool, scope: str, confirm: bo
 
     if reset_all:
         if not confirm and not click.confirm(f"Reset ALL {scope} configuration?"):
-            console.print("[dim]Cancelled[/dim]")
+            console.print("[white]Cancelled[/white]")
             return
         cfg.reset_all(scope=scope)
         console.print(f"[green]✓[/green] Reset all {scope} configuration to defaults")
@@ -2970,7 +3351,7 @@ def config_validate(scope: str, json_out: bool):
     console.print()
     console.print("[bold]Configuration Validation[/bold]")
     console.print("\u2500" * 40)
-    console.print(f"[dim]Scope: {scope}[/dim]")
+    console.print(f"[white]Scope: {scope}[/white]")
     console.print()
 
     if not issues:
@@ -2986,11 +3367,11 @@ def config_validate(scope: str, json_out: bool):
     level_styles = {
         "error": "[red]ERROR[/red]",
         "warning": "[yellow]WARN[/yellow] ",
-        "info": "[dim]INFO[/dim] ",
+        "info": "[white]INFO[/white] ",
     }
 
     for issue in issues:
-        style = level_styles.get(issue.level, "[dim]???[/dim]  ")
+        style = level_styles.get(issue.level, "[white]???[/white]  ")
         msg = f"  {style}  {issue.key} \u2192 {issue.message}"
         if issue.suggestion:
             msg += f" {issue.suggestion}"
@@ -3102,7 +3483,7 @@ def config_llm(verbose: bool, validate: bool):
         console.print()
         console.print("  [yellow]Status:[/yellow] Disabled (no provider available)")
         console.print()
-        console.print("  [dim]To enable, set one of:[/dim]")
+        console.print("  [white]To enable, set one of:[/white]")
         console.print("    ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_API_KEY")
         console.print("    Or install Ollama: [cyan]https://ollama.ai[/cyan]")
         console.print()
@@ -3137,8 +3518,8 @@ def config_llm(verbose: bool, validate: bool):
                     for m in server.all_models:
                         console.print(f"    - {m}")
             else:
-                console.print("  [dim]No local LLM server detected[/dim]")
-                console.print("  [dim]Checked: Ollama (localhost:11434), LM Studio (localhost:1234)[/dim]")
+                console.print("  [white]No local LLM server detected[/white]")
+                console.print("  [white]Checked: Ollama (localhost:11434), LM Studio (localhost:1234)[/white]")
         except Exception as e:
             console.print(f"  [yellow]Detection error: {e}[/yellow]")
 
@@ -3176,8 +3557,8 @@ def config_llm(verbose: bool, validate: bool):
                 console.print(f"  [green]PASSED[/green] ({score:.0%})")
             else:
                 console.print(f"  [red]FAILED[/red] ({score:.0%}, minimum: 60%)")
-                console.print("  [dim]This model may not reliably classify security threats.[/dim]")
-                console.print("  [dim]Try a larger model: ollama pull qwen2.5:7b-instruct[/dim]")
+                console.print("  [white]This model may not reliably classify security threats.[/white]")
+                console.print("  [white]Try a larger model: ollama pull qwen2.5:7b-instruct[/white]")
         except Exception as e:
             console.print(f"  [red]Validation error: {e}[/red]")
 
@@ -3207,8 +3588,8 @@ def vault_store(skill: str, key: str, value: Optional[str]):
 
     if not VAULT_AVAILABLE:
         console.print("[red]\u2717[/red] Vault not available.")
-        console.print("  [dim]Hint: Install keyring support: pip install keyring[/dim]")
-        console.print("  [dim]On macOS, keyring uses Keychain. On Linux, install gnome-keyring or kwallet.[/dim]")
+        console.print("  [white]Hint: Install keyring support: pip install keyring[/white]")
+        console.print("  [white]On macOS, keyring uses Keychain. On Linux, install gnome-keyring or kwallet.[/white]")
         return
 
     caps = get_capabilities()
@@ -3224,13 +3605,13 @@ def vault_store(skill: str, key: str, value: Optional[str]):
         vault_instance = get_vault()
         if vault_instance.store(skill, key, value):
             console.print(f"[green]\u2713[/green] Stored {key} for skill '{skill}'")
-            console.print(f"[dim]Backend: {caps.vault_backend}[/dim]")
+            console.print(f"[white]Backend: {caps.vault_backend}[/white]")
         else:
             console.print(f"[red]\u2717[/red] Failed to store credential")
-            console.print("  [dim]Hint: Check your keyring backend is unlocked and accessible[/dim]")
+            console.print("  [white]Hint: Check your keyring backend is unlocked and accessible[/white]")
     except Exception as e:
         console.print(f"[red]\u2717[/red] Failed to store credential: {e}")
-        console.print("  [dim]Hint: Check your keyring backend is unlocked and accessible[/dim]")
+        console.print("  [white]Hint: Check your keyring backend is unlocked and accessible[/white]")
 
 
 @vault.command("get",
@@ -3248,7 +3629,7 @@ def vault_get(skill: str, key: str):
 
     if not VAULT_AVAILABLE:
         console.print("[red]\u2717[/red] Vault not available.")
-        console.print("  [dim]Hint: Install keyring support: pip install keyring[/dim]")
+        console.print("  [white]Hint: Install keyring support: pip install keyring[/white]")
         return
 
     vault_instance = get_vault()
@@ -3262,7 +3643,7 @@ def vault_get(skill: str, key: str):
         console.print(value)
     else:
         console.print(f"[red]\u2717[/red] Credential not found: {key} for skill '{skill}'")
-        console.print("  [dim]Hint: Store it with: tweek vault store {skill} {key} <value>[/dim]".format(skill=skill, key=key))
+        console.print("  [white]Hint: Store it with: tweek vault store {skill} {key} <value>[/white]".format(skill=skill, key=key))
 
 
 @vault.command("migrate-env",
@@ -3302,7 +3683,7 @@ def vault_migrate_env(dry_run: bool, env_file: str, skill: str):
             successful = sum(1 for _, s in results if s)
             console.print(f"\n[green]✓[/green] {'Would migrate' if dry_run else 'Migrated'} {successful} credentials to skill '{skill}'")
         else:
-            console.print("[dim]No credentials found to migrate[/dim]")
+            console.print("[white]No credentials found to migrate[/white]")
 
     except Exception as e:
         console.print(f"[red]✗[/red] Migration failed: {e}")
@@ -3369,16 +3750,16 @@ def license_status():
     console.print(f"[bold]License Tier:[/bold] [{tier_color}]{lic.tier.value.upper()}[/{tier_color}]")
 
     if info:
-        console.print(f"[dim]Licensed to: {info.email}[/dim]")
+        console.print(f"[white]Licensed to: {info.email}[/white]")
         if info.expires_at:
             from datetime import datetime
             exp_date = datetime.fromtimestamp(info.expires_at).strftime("%Y-%m-%d")
             if info.is_expired:
                 console.print(f"[red]Expired: {exp_date}[/red]")
             else:
-                console.print(f"[dim]Expires: {exp_date}[/dim]")
+                console.print(f"[white]Expires: {exp_date}[/white]")
         else:
-            console.print("[dim]Expires: Never[/dim]")
+            console.print("[white]Expires: Never[/white]")
     console.print()
 
     # Features table
@@ -3395,7 +3776,7 @@ def license_status():
 
     for feature, required_tier in feature_tiers.items():
         has_it = lic.has_feature(feature)
-        status = "[green]✓[/green]" if has_it else "[dim]○[/dim]"
+        status = "[green]✓[/green]" if has_it else "[white]○[/white]"
         tier_display = required_tier.value.upper()
         if required_tier == Tier.PRO:
             tier_display = f"[cyan]{tier_display}[/cyan]"
@@ -3407,7 +3788,7 @@ def license_status():
     if lic.tier == Tier.FREE:
         console.print()
         console.print("[green]All security features are included free and open source.[/green]")
-        console.print("[dim]Pro (teams) and Enterprise (compliance) coming soon: gettweek.com[/dim]")
+        console.print("[white]Pro (teams) and Enterprise (compliance) coming soon: gettweek.com[/white]")
 
 
 @license.command("activate",
@@ -3427,7 +3808,7 @@ def license_activate(license_key: str):
     if success:
         console.print(f"[green]✓[/green] {message}")
         console.print()
-        console.print("[dim]Run 'tweek license status' to see available features[/dim]")
+        console.print("[white]Run 'tweek license status' to see available features[/white]")
     else:
         console.print(f"[red]✗[/red] {message}")
 
@@ -3447,7 +3828,7 @@ def license_deactivate(confirm: bool):
     if not confirm:
         console.print("[yellow]Deactivate license and revert to FREE tier?[/yellow] ", end="")
         if not click.confirm(""):
-            console.print("[dim]Cancelled[/dim]")
+            console.print("[white]Cancelled[/white]")
             return
 
     lic = get_license()
@@ -3525,7 +3906,7 @@ def logs_show(limit: int, event_type: str, tool: str, blocked: bool, stats: bool
             table.add_column("Severity")
             table.add_column("Count", justify="right")
 
-            severity_styles = {"critical": "red", "high": "yellow", "medium": "blue", "low": "dim"}
+            severity_styles = {"critical": "red", "high": "yellow", "medium": "blue", "low": "white"}
             for pattern in stat_data['top_patterns']:
                 sev = pattern['severity'] or "unknown"
                 style = severity_styles.get(sev, "white")
@@ -3562,7 +3943,7 @@ def logs_show(limit: int, event_type: str, tool: str, blocked: bool, stats: bool
                 et = EventType(event_type)
             except ValueError:
                 console.print(f"[red]Unknown event type: {event_type}[/red]")
-                console.print(f"[dim]Valid types: {', '.join(e.value for e in EventType)}[/dim]")
+                console.print(f"[white]Valid types: {', '.join(e.value for e in EventType)}[/white]")
                 return
 
         events = logger.get_recent_events(limit=limit, event_type=et, tool_name=tool)
@@ -3573,7 +3954,7 @@ def logs_show(limit: int, event_type: str, tool: str, blocked: bool, stats: bool
         return
 
     table = Table(title=title)
-    table.add_column("Time", style="dim")
+    table.add_column("Time", style="white")
     table.add_column("Type", style="cyan")
     table.add_column("Tool", style="green")
     table.add_column("Tier")
@@ -3614,7 +3995,7 @@ def logs_show(limit: int, event_type: str, tool: str, blocked: bool, stats: bool
         )
 
     console.print(table)
-    console.print(f"\n[dim]Showing {len(events)} events. Use --limit to see more.[/dim]")
+    console.print(f"\n[white]Showing {len(events)} events. Use --limit to see more.[/white]")
 
 
 @logs.command("export",
@@ -3665,7 +4046,7 @@ def logs_clear(days: int, confirm: bool):
 
         console.print(f"[yellow]{msg}[/yellow] ", end="")
         if not click.confirm(""):
-            console.print("[dim]Cancelled[/dim]")
+            console.print("[white]Cancelled[/white]")
             return
 
     logger = get_logger()
@@ -3677,7 +4058,7 @@ def logs_clear(days: int, confirm: bool):
         else:
             console.print(f"[green]Cleared {deleted} event(s)[/green]")
     else:
-        console.print("[dim]No events to clear[/dim]")
+        console.print("[white]No events to clear[/white]")
 
 
 @logs.command("bundle",
@@ -3715,11 +4096,11 @@ def logs_bundle(output: str, days: int, no_redact: bool, dry_run: bool):
             size = item.get("size")
             size_str = f" ({size:,} bytes)" if size else ""
             if "not found" in status:
-                console.print(f"  [dim]  SKIP  {name} ({status})[/dim]")
+                console.print(f"  [white]  SKIP  {name} ({status})[/white]")
             else:
                 console.print(f"  [green]  ADD   {name}{size_str}[/green]")
         console.print()
-        console.print("[dim]No files will be collected in dry-run mode.[/dim]")
+        console.print("[white]No files will be collected in dry-run mode.[/white]")
         return
 
     # Determine output path
@@ -3737,9 +4118,9 @@ def logs_bundle(output: str, days: int, no_redact: bool, dry_run: bool):
         result = collector.create_bundle(output_path)
         size = result.stat().st_size
         console.print(f"\n[green]Bundle created: {result}[/green]")
-        console.print(f"[dim]Size: {size:,} bytes[/dim]")
+        console.print(f"[white]Size: {size:,} bytes[/white]")
         if not no_redact:
-            console.print("[dim]Sensitive data has been redacted.[/dim]")
+            console.print("[white]Sensitive data has been redacted.[/white]")
         console.print(f"\n[bold]Send this file to Tweek support for analysis.[/bold]")
     except Exception as e:
         console.print(f"[red]Failed to create bundle: {e}[/red]")
@@ -3785,8 +4166,8 @@ def proxy_start(port: int, web_port: int, foreground: bool, log_only: bool):
 
     if not PROXY_AVAILABLE:
         console.print("[red]\u2717[/red] Proxy dependencies not installed.")
-        console.print("  [dim]Hint: Install with: pip install tweek[proxy][/dim]")
-        console.print("  [dim]This adds mitmproxy for HTTP(S) interception.[/dim]")
+        console.print("  [white]Hint: Install with: pip install tweek[proxy][/white]")
+        console.print("  [white]This adds mitmproxy for HTTP(S) interception.[/white]")
         return
 
     from tweek.proxy.server import start_proxy
@@ -3807,7 +4188,7 @@ def proxy_start(port: int, web_port: int, foreground: bool, log_only: bool):
         console.print(f"  export HTTPS_PROXY=http://127.0.0.1:{port}")
         console.print(f"  export HTTP_PROXY=http://127.0.0.1:{port}")
         console.print()
-        console.print("[dim]Or use 'tweek proxy wrap' to create a wrapper script[/dim]")
+        console.print("[white]Or use 'tweek proxy wrap' to create a wrapper script[/white]")
     else:
         console.print(f"[red]✗[/red] {message}")
 
@@ -3852,7 +4233,7 @@ def proxy_trust():
 
     if not PROXY_AVAILABLE:
         console.print("[red]✗[/red] Proxy dependencies not installed.")
-        console.print("[dim]Run: pip install tweek\\[proxy][/dim]")
+        console.print("[white]Run: pip install tweek\\[proxy][/white]")
         return
 
     from tweek.proxy.server import install_ca_certificate, get_proxy_info
@@ -3864,11 +4245,11 @@ def proxy_trust():
     console.print("This will install a local CA certificate to enable HTTPS interception.")
     console.print("The certificate is generated on YOUR machine and never transmitted.")
     console.print()
-    console.print(f"[dim]Certificate location: {info['ca_cert']}[/dim]")
+    console.print(f"[white]Certificate location: {info['ca_cert']}[/white]")
     console.print()
 
     if not click.confirm("Install certificate? (requires admin password)"):
-        console.print("[dim]Cancelled[/dim]")
+        console.print("[white]Cancelled[/white]")
         return
 
     success, message = install_ca_certificate()
@@ -3920,7 +4301,7 @@ def proxy_config(set_enabled, set_disabled, port):
             yaml.dump(config, f, default_flow_style=False)
 
         console.print(f"[green]✓[/green] Proxy mode enabled (port {port})")
-        console.print("[dim]Run 'tweek proxy start' to start the proxy[/dim]")
+        console.print("[white]Run 'tweek proxy start' to start the proxy[/white]")
 
     elif set_disabled:
         if "proxy" in config:
@@ -3962,10 +4343,10 @@ def proxy_wrap(app_name: str, command: str, output: str, port: int):
     console.print(f"  chmod +x {output_path}")
     console.print(f"  ./{output_path.name}")
     console.print()
-    console.print("[dim]The script will:[/dim]")
-    console.print("[dim]  1. Start Tweek proxy if not running[/dim]")
-    console.print("[dim]  2. Set proxy environment variables[/dim]")
-    console.print(f"[dim]  3. Run: {command}[/dim]")
+    console.print("[white]The script will:[/white]")
+    console.print("[white]  1. Start Tweek proxy if not running[/white]")
+    console.print("[white]  2. Set proxy environment variables[/white]")
+    console.print(f"[white]  3. Run: {command}[/white]")
 
 
 @proxy.command("setup",
@@ -4040,9 +4421,9 @@ def proxy_setup():
             print_warning("Certificate module not available. Run: tweek proxy trust")
         except Exception as e:
             print_warning(f"Could not set up certificate: {e}")
-            console.print("  [dim]You can do this later with: tweek proxy trust[/dim]")
+            console.print("  [white]You can do this later with: tweek proxy trust[/white]")
     else:
-        console.print("  [dim]Skipped. Run 'tweek proxy trust' later.[/dim]")
+        console.print("  [white]Skipped. Run 'tweek proxy trust' later.[/white]")
     console.print()
 
     # Step 3: Shell environment
@@ -4066,13 +4447,13 @@ def proxy_setup():
                     f.write(f"export HTTP_PROXY=http://127.0.0.1:{port}\n")
                     f.write(f"export HTTPS_PROXY=http://127.0.0.1:{port}\n")
                 print_success(f"Added to {shell_rc}")
-                console.print(f"  [dim]Restart your shell or run: source {shell_rc}[/dim]")
+                console.print(f"  [white]Restart your shell or run: source {shell_rc}[/white]")
             except Exception as e:
                 print_warning(f"Could not write to {shell_rc}: {e}")
         else:
-            console.print("  [dim]Skipped. Set HTTP_PROXY and HTTPS_PROXY manually.[/dim]")
+            console.print("  [white]Skipped. Set HTTP_PROXY and HTTPS_PROXY manually.[/white]")
     else:
-        console.print("  [dim]Could not detect shell config file.[/dim]")
+        console.print("  [white]Could not detect shell config file.[/white]")
         console.print(f"  Add these to your shell profile:")
         console.print(f"    export HTTP_PROXY=http://127.0.0.1:{port}")
         console.print(f"    export HTTPS_PROXY=http://127.0.0.1:{port}")
@@ -4166,7 +4547,7 @@ def plugins_list(category: str, show_all: bool):
                 license_style = "green" if license_tier == LicenseTier.FREE else "cyan"
 
                 source_str = info.source.value if hasattr(info, 'source') else "builtin"
-                source_style = "blue" if source_str == "git" else "dim"
+                source_style = "blue" if source_str == "git" else "white"
 
                 table.add_row(
                     info.name,
@@ -4180,6 +4561,18 @@ def plugins_list(category: str, show_all: bool):
             console.print(table)
             console.print()
 
+        # Summary line across all categories
+        total_count = 0
+        enabled_count = 0
+        for cat in list(PluginCategory):
+            for info in registry.list_plugins(cat):
+                total_count += 1
+                if info.enabled:
+                    enabled_count += 1
+        disabled_count = total_count - enabled_count
+        console.print(f"Plugins: {total_count} registered, {enabled_count} enabled, {disabled_count} disabled")
+        console.print()
+
     except ImportError as e:
         console.print(f"[red]Plugin system not available: {e}[/red]")
 
@@ -4236,7 +4629,7 @@ def plugins_info(plugin_name: str, category: str):
         plugin_cfg = cfg.get_plugin_config(found_cat, plugin_name)
 
         console.print(f"\n[bold]{found_info.name}[/bold] ({found_cat})")
-        console.print(f"[dim]{found_info.metadata.description}[/dim]")
+        console.print(f"[white]{found_info.metadata.description}[/white]")
         console.print()
 
         table = Table(show_header=False)
@@ -4408,7 +4801,7 @@ def plugins_scan(content: str, direction: str, plugin: str):
 
         if not plugins_to_use:
             console.print("[yellow]No compliance plugins enabled.[/yellow]")
-            console.print("[dim]Enable plugins with: tweek plugins enable <name> -c compliance[/dim]")
+            console.print("[white]Enable plugins with: tweek plugins enable <name> -c compliance[/white]")
             return
 
         for p in plugins_to_use:
@@ -4422,12 +4815,12 @@ def plugins_scan(content: str, direction: str, plugin: str):
                         "critical": "red bold",
                         "high": "red",
                         "medium": "yellow",
-                        "low": "dim",
+                        "low": "white",
                     }
                     style = severity_styles.get(finding.severity.value, "white")
 
                     console.print(f"  [{style}]{finding.severity.value.upper()}[/{style}] {finding.pattern_name}")
-                    console.print(f"    [dim]Matched: {finding.matched_text[:60]}{'...' if len(finding.matched_text) > 60 else ''}[/dim]")
+                    console.print(f"    [white]Matched: {finding.matched_text[:60]}{'...' if len(finding.matched_text) > 60 else ''}[/white]")
                     if finding.description:
                         console.print(f"    {finding.description}")
 
@@ -4501,11 +4894,11 @@ def plugins_install(name: str, version: str, from_lockfile: bool, no_verify: boo
             console.print(f"[green]\u2713[/green] {msg}")
         else:
             console.print(f"[red]\u2717[/red] {msg}")
-            console.print(f"  [dim]Hint: Check network connectivity or try: tweek plugins registry --refresh[/dim]")
+            console.print(f"  [white]Hint: Check network connectivity or try: tweek plugins registry --refresh[/white]")
 
     except Exception as e:
         console.print(f"[red]Error: {e}[/red]")
-        console.print(f"  [dim]Hint: Check network connectivity and try again[/dim]")
+        console.print(f"  [white]Hint: Check network connectivity and try again[/white]")
 
 
 @plugins.command("update",
@@ -4873,87 +5266,6 @@ def serve():
         console.print(f"[red]MCP server error: {e}[/red]")
 
 
-@mcp.command(
-    epilog="""\b
-Examples:
-  tweek mcp install claude-desktop       Configure Claude Desktop integration
-  tweek mcp install chatgpt              Set up ChatGPT Desktop integration
-  tweek mcp install gemini               Configure Gemini CLI integration
-"""
-)
-@click.argument("client", type=click.Choice(["claude-desktop", "chatgpt", "gemini"]))
-def install(client):
-    """Install Tweek as MCP server for a desktop client.
-
-    Supported clients:
-      claude-desktop  - Auto-configures Claude Desktop
-      chatgpt         - Provides Developer Mode setup instructions
-      gemini          - Auto-configures Gemini CLI settings
-    """
-    try:
-        from tweek.mcp.clients import get_client
-
-        handler = get_client(client)
-        result = handler.install()
-
-        if result.get("success"):
-            console.print(f"[green]✅ {result.get('message', 'Installed successfully')}[/green]")
-
-            if result.get("config_path"):
-                console.print(f"   Config: {result['config_path']}")
-
-            if result.get("backup"):
-                console.print(f"   Backup: {result['backup']}")
-
-            # Show instructions for manual setup clients
-            if result.get("instructions"):
-                console.print()
-                for line in result["instructions"]:
-                    console.print(f"   {line}")
-        else:
-            console.print(f"[red]❌ {result.get('error', 'Installation failed')}[/red]")
-
-    except Exception as e:
-        console.print(f"[red]Error: {e}[/red]")
-
-
-@mcp.command(
-    epilog="""\b
-Examples:
-  tweek mcp uninstall claude-desktop     Remove from Claude Desktop
-  tweek mcp uninstall chatgpt            Remove from ChatGPT Desktop
-  tweek mcp uninstall gemini             Remove from Gemini CLI
-"""
-)
-@click.argument("client", type=click.Choice(["claude-desktop", "chatgpt", "gemini"]))
-def uninstall(client):
-    """Remove Tweek MCP server from a desktop client.
-
-    Supported clients: claude-desktop, chatgpt, gemini
-    """
-    try:
-        from tweek.mcp.clients import get_client
-
-        handler = get_client(client)
-        result = handler.uninstall()
-
-        if result.get("success"):
-            console.print(f"[green]✅ {result.get('message', 'Uninstalled successfully')}[/green]")
-
-            if result.get("backup"):
-                console.print(f"   Backup: {result['backup']}")
-
-            if result.get("instructions"):
-                console.print()
-                for line in result["instructions"]:
-                    console.print(f"   {line}")
-        else:
-            console.print(f"[red]❌ {result.get('error', 'Uninstallation failed')}[/red]")
-
-    except Exception as e:
-        console.print(f"[red]Error: {e}[/red]")
-
-
 # =============================================================================
 # MCP PROXY COMMANDS
 # =============================================================================
@@ -5109,13 +5421,13 @@ def chamber_list():
     items = chamber.list_chamber()
 
     if not items:
-        console.print("[dim]Chamber is empty.[/dim]")
+        console.print("[white]Chamber is empty.[/white]")
         return
 
     table = Table(title="Isolation Chamber")
     table.add_column("Name", style="cyan")
     table.add_column("Has SKILL.md", style="green")
-    table.add_column("Path", style="dim")
+    table.add_column("Path", style="white")
 
     for item in items:
         has_md = "Yes" if item["has_skill_md"] else "[red]No[/red]"
@@ -5210,7 +5522,7 @@ def jail_list():
     items = chamber.list_jail()
 
     if not items:
-        console.print("[dim]Jail is empty.[/dim]")
+        console.print("[white]Jail is empty.[/white]")
         return
 
     table = Table(title="Skill Jail")
@@ -5282,7 +5594,7 @@ def skills_report(name: str):
     report_data = chamber.get_report(name)
 
     if not report_data:
-        console.print(f"[dim]No report found for '{name}'.[/dim]")
+        console.print(f"[white]No report found for '{name}'.[/white]")
         return
 
     console.print(Panel(
@@ -5404,7 +5716,7 @@ def sandbox_status():
     else:
         console.print(f"[bold]Project:[/bold] {project_dir}")
         console.print(f"[bold]Layer:[/bold] 0-1 (no project isolation)")
-        console.print("[dim]Run 'tweek sandbox init' to enable project isolation.[/dim]")
+        console.print("[white]Run 'tweek sandbox init' to enable project isolation.[/white]")
 
 
 @sandbox.command("init")
@@ -5478,7 +5790,7 @@ def sandbox_list():
     projects = registry.list_projects()
 
     if not projects:
-        console.print("[dim]No projects registered. Run 'tweek sandbox init' in a project.[/dim]")
+        console.print("[white]No projects registered. Run 'tweek sandbox init' in a project.[/white]")
         return
 
     table = Table(title="Registered Projects")
@@ -5550,12 +5862,12 @@ def sandbox_logs(show_global: bool, limit: int):
 
     events = logger.get_recent_events(limit=limit)
     if not events:
-        console.print("[dim]No events found.[/dim]")
+        console.print("[white]No events found.[/white]")
         return
 
     from rich.table import Table
     table = Table()
-    table.add_column("Time", style="dim")
+    table.add_column("Time", style="white")
     table.add_column("Type")
     table.add_column("Tool")
     table.add_column("Decision", style="green")
@@ -5635,7 +5947,7 @@ def sandbox_verify():
         checks_passed += 1
     else:
         console.print("  Sandbox initialized: [red]NO[/red]")
-        console.print("  [dim]Run 'tweek sandbox init' to enable.[/dim]")
+        console.print("  [white]Run 'tweek sandbox init' to enable.[/white]")
 
     # Check 3: Layer
     checks_total += 1
@@ -5656,7 +5968,7 @@ def sandbox_verify():
     elif sandbox:
         console.print("  Project security.db: [yellow]NOT FOUND[/yellow]")
     else:
-        console.print("  Project security.db: [dim]N/A (sandbox inactive)[/dim]")
+        console.print("  Project security.db: [white]N/A (sandbox inactive)[/white]")
 
     # Check 5: .gitignore
     checks_total += 1
@@ -5686,7 +5998,7 @@ def docker_init():
     bridge = DockerBridge()
     if not bridge.is_docker_available():
         console.print("[red]Docker is not installed or not running.[/red]")
-        console.print("[dim]Install Docker Desktop from https://www.docker.com/products/docker-desktop/[/dim]")
+        console.print("[white]Install Docker Desktop from https://www.docker.com/products/docker-desktop/[/white]")
         raise SystemExit(1)
 
     from tweek.sandbox.project import _detect_project_dir
@@ -5697,7 +6009,7 @@ def docker_init():
 
     compose_path = bridge.init(project_dir)
     console.print(f"[green]Docker Sandbox config generated: {compose_path}[/green]")
-    console.print("[dim]Run 'tweek sandbox docker run' to start the container.[/dim]")
+    console.print("[white]Run 'tweek sandbox docker run' to start the container.[/white]")
 
 
 @sandbox_docker.command("run")
@@ -5734,7 +6046,7 @@ def docker_status():
         compose = project_dir / ".tweek" / "docker-compose.yaml"
         console.print(f"[bold]Docker config:[/bold] {'exists' if compose.exists() else 'not generated'}")
     else:
-        console.print("[dim]Not in a project directory.[/dim]")
+        console.print("[white]Not in a project directory.[/white]")
 
 
 # =========================================================================
@@ -5795,7 +6107,7 @@ def override_create(pattern: str, mode: str, duration_minutes: Optional[int], re
     if reason:
         console.print(f"  Reason: {reason}")
     console.print()
-    console.print("[dim]Next time this pattern triggers, you'll see an 'ask' prompt instead of a hard block.[/dim]")
+    console.print("[white]Next time this pattern triggers, you'll see an 'ask' prompt instead of a hard block.[/white]")
 
 
 @override_group.command("list")
@@ -5808,7 +6120,7 @@ def override_list():
     active_patterns = {o["pattern"] for o in active}
 
     if not all_overrides:
-        console.print("[dim]No break-glass overrides found.[/dim]")
+        console.print("[white]No break-glass overrides found.[/white]")
         return
 
     table = Table(title="Break-Glass Overrides")
@@ -5822,9 +6134,9 @@ def override_list():
         if o["pattern"] in active_patterns and not o.get("used"):
             status = "[green]active[/green]"
         elif o.get("used"):
-            status = "[dim]consumed[/dim]"
+            status = "[white]consumed[/white]"
         else:
-            status = "[dim]expired[/dim]"
+            status = "[white]expired[/white]"
 
         table.add_row(
             o["pattern"],
@@ -5913,7 +6225,7 @@ def feedback_stats(above_threshold: bool):
 
     stats = get_stats()
     if not stats:
-        console.print("[dim]No feedback data recorded yet.[/dim]")
+        console.print("[white]No feedback data recorded yet.[/white]")
         return
 
     table = Table(title="Pattern FP Statistics")
@@ -5954,7 +6266,7 @@ def feedback_reset(pattern_name: str):
         if result.get("was_demoted"):
             console.print(f"  Restored severity: {result.get('original_severity')}")
     else:
-        console.print(f"[dim]No feedback data found for '{pattern_name}'.[/dim]")
+        console.print(f"[white]No feedback data found for '{pattern_name}'.[/white]")
 
 
 # =========================================================================
@@ -5995,7 +6307,7 @@ def memory_status():
     if last_decay:
         console.print(f"  Last decay: {last_decay}")
     else:
-        console.print("  Last decay: [dim]never[/dim]")
+        console.print("  Last decay: [white]never[/white]")
 
     db_size = stats.get("db_size_bytes", 0)
     if db_size > 1024 * 1024:
@@ -6019,7 +6331,7 @@ def memory_patterns(min_decisions: int, sort_by: str):
     patterns = store.get_pattern_stats(min_decisions=min_decisions, sort_by=sort_by)
 
     if not patterns:
-        console.print("[dim]No pattern decision data recorded yet.[/dim]")
+        console.print("[white]No pattern decision data recorded yet.[/white]")
         return
 
     table = Table(title="Pattern Decision History")
@@ -6036,7 +6348,7 @@ def memory_patterns(min_decisions: int, sort_by: str):
         ratio_style = "green" if ratio >= 0.9 else ("yellow" if ratio >= 0.5 else "red")
         table.add_row(
             p.get("pattern_name", "?"),
-            p.get("path_prefix") or "[dim]-[/dim]",
+            p.get("path_prefix") or "[white]-[/white]",
             str(p.get("total_decisions", 0)),
             f"{p.get('weighted_approvals', 0):.1f}",
             f"{p.get('weighted_denials', 0):.1f}",
@@ -6057,7 +6369,7 @@ def memory_sources(suspicious: bool):
     sources = store.get_all_sources(suspicious_only=suspicious)
 
     if not sources:
-        console.print("[dim]No source trust data recorded yet.[/dim]")
+        console.print("[white]No source trust data recorded yet.[/white]")
         return
 
     table = Table(title="Source Trust Scores")
@@ -6092,7 +6404,7 @@ def memory_suggestions(show_all: bool):
     suggestions = store.get_whitelist_suggestions(pending_only=not show_all)
 
     if not suggestions:
-        console.print("[dim]No whitelist suggestions available.[/dim]")
+        console.print("[white]No whitelist suggestions available.[/white]")
         return
 
     table = Table(title="Learned Whitelist Suggestions")
@@ -6110,8 +6422,8 @@ def memory_suggestions(show_all: bool):
         table.add_row(
             str(s.id),
             s.pattern_name,
-            s.tool_name or "[dim]-[/dim]",
-            s.path_prefix or "[dim]-[/dim]",
+            s.tool_name or "[white]-[/white]",
+            s.path_prefix or "[white]-[/white]",
             str(s.approval_count),
             str(s.denial_count),
             f"{s.confidence:.0%}",
@@ -6130,7 +6442,7 @@ def memory_accept(suggestion_id: int):
     store = get_memory_store()
     if store.review_whitelist_suggestion(suggestion_id, accepted=True):
         console.print(f"[bold green]Accepted[/bold green] suggestion #{suggestion_id}")
-        console.print("  [dim]Note: To apply to overrides.yaml, manually add the whitelist rule.[/dim]")
+        console.print("  [white]Note: To apply to overrides.yaml, manually add the whitelist rule.[/white]")
     else:
         console.print(f"[red]Suggestion #{suggestion_id} not found.[/red]")
 
@@ -6161,7 +6473,7 @@ def memory_baseline(project_hash: Optional[str]):
     baselines = store.get_workflow_baseline(project_hash)
 
     if not baselines:
-        console.print("[dim]No workflow baseline data for this project.[/dim]")
+        console.print("[white]No workflow baseline data for this project.[/white]")
         return
 
     table = Table(title=f"Workflow Baseline (project: {project_hash[:8]}...)")
@@ -6177,7 +6489,7 @@ def memory_baseline(project_hash: Optional[str]):
         pct_style = "green" if denial_pct < 0.1 else ("yellow" if denial_pct < 0.3 else "red")
         table.add_row(
             b.tool_name,
-            str(b.hour_of_day) if b.hour_of_day is not None else "[dim]-[/dim]",
+            str(b.hour_of_day) if b.hour_of_day is not None else "[white]-[/white]",
             str(b.invocation_count),
             str(b.denied_count),
             f"[{pct_style}]{denial_pct:.0%}[/{pct_style}]",
@@ -6196,7 +6508,7 @@ def memory_audit(limit: int):
     entries = store.get_audit_log(limit=limit)
 
     if not entries:
-        console.print("[dim]No audit entries.[/dim]")
+        console.print("[white]No audit entries.[/white]")
         return
 
     table = Table(title=f"Memory Audit Log (last {limit})")
@@ -6238,7 +6550,7 @@ def memory_clear(table_name: Optional[str], confirm: bool):
     if not confirm:
         target = table_name or "ALL"
         if not click.confirm(f"Clear {target} memory data? This cannot be undone"):
-            console.print("[dim]Cancelled.[/dim]")
+            console.print("[white]Cancelled.[/white]")
             return
 
     store = get_memory_store()