Entry point:
- cmd/reaper/main.go — calls cli.Execute()

CLI (internal/cli/):
- root.go — Cobra root command + version subcommand
- start.go — reaper start with --domains, --hosts, --port, -d flags
- start_unix.go / start_windows.go — platform-specific daemon Setsid
- shutdown.go — reaper shutdown
- logs.go — reaper logs -n N
- search.go — reaper search --method --host --domains --path --status
- get.go — reaper get <id> (full req+res)
- req.go / res.go — raw request / response
- format.go — table and raw output formatting

Proxy (internal/proxy/):
- proxy.go — MITM HTTPS proxy (CONNECT hijack + TLS + plain HTTP)
- cert.go — Ephemeral self-signed CA cert generation (RSA 2048, 30-day expiry)
- scope.go — Domain suffix / host exact-match filtering

Storage (internal/storage/):
- models.go — Entry struct + SearchParams
- store.go — Store interface
- sqlite.go — SQLite implementation with WAL mode, wildcard search

Daemon (internal/daemon/):
- protocol.go — IPC JSON message types
- server.go — Unix socket IPC server
- client.go — Unix socket IPC client + WaitForSocket
- daemon.go — Orchestrator: cert gen → storage → proxy → IPC → signal handling