@solongate/proxy 0.3.1 → 0.4.1

package/dist/index.js

@@ -4,29 +4,536 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// src/config.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
+  let resolvedId = policyId;
+  if (!resolvedId) {
+    const listRes = await fetch(`${apiUrl}/api/v1/policies`, {
+      headers: { "Authorization": `Bearer ${apiKey}` }
+    });
+    if (!listRes.ok) {
+      const body = await listRes.text().catch(() => "");
+      throw new Error(`Failed to list policies from cloud (${listRes.status}): ${body}`);
+    }
+    const listData = await listRes.json();
+    const policies = listData.policies ?? [];
+    if (policies.length === 0) {
+      throw new Error("No policies found in cloud. Create one in the dashboard first.");
+    }
+    resolvedId = policies[0].id;
+  }
+  const url = `${apiUrl}/api/v1/policies/${resolvedId}`;
+  const res = await fetch(url, {
+    headers: { "Authorization": `Bearer ${apiKey}` }
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Failed to fetch policy from cloud (${res.status}): ${body}`);
+  }
+  const data = await res.json();
+  return {
+    id: String(data.id ?? "cloud"),
+    name: String(data.name ?? "Cloud Policy"),
+    version: Number(data._version ?? 1),
+    rules: data.rules ?? [],
+    createdAt: String(data._created_at ?? ""),
+    updatedAt: ""
+  };
+}
+async function sendAuditLog(apiKey, apiUrl, entry) {
+  const url = `${apiUrl}/api/v1/audit-logs`;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(entry)
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      process.stderr.write(`[SolonGate] Audit log failed (${res.status}): ${body}
+`);
+    }
+  } catch (err) {
+    process.stderr.write(`[SolonGate] Audit log error: ${err instanceof Error ? err.message : String(err)}
+`);
+  }
+}
+function loadPolicy(source) {
+  if (typeof source === "object") return source;
+  if (PRESETS[source]) return PRESETS[source];
+  const filePath = resolve(source);
+  if (existsSync(filePath)) {
+    const content = readFileSync(filePath, "utf-8");
+    return JSON.parse(content);
+  }
+  throw new Error(
+    `Unknown policy "${source}". Use a preset (${Object.keys(PRESETS).join(", ")}), a JSON file path, or a PolicySet object.`
+  );
+}
+function parseArgs(argv) {
+  const args = argv.slice(2);
+  let policySource = "restricted";
+  let name = "solongate-proxy";
+  let verbose = false;
+  let rateLimitPerTool;
+  let globalRateLimit;
+  let configFile;
+  let apiKey;
+  let apiUrl;
+  let upstreamUrl;
+  let upstreamTransport;
+  let port;
+  let separatorIndex = args.indexOf("--");
+  const flags = separatorIndex >= 0 ? args.slice(0, separatorIndex) : args;
+  const upstreamArgs = separatorIndex >= 0 ? args.slice(separatorIndex + 1) : [];
+  for (let i = 0; i < flags.length; i++) {
+    switch (flags[i]) {
+      case "--policy":
+        policySource = flags[++i];
+        break;
+      case "--name":
+        name = flags[++i];
+        break;
+      case "--verbose":
+        verbose = true;
+        break;
+      case "--rate-limit":
+        rateLimitPerTool = parseInt(flags[++i], 10);
+        break;
+      case "--global-rate-limit":
+        globalRateLimit = parseInt(flags[++i], 10);
+        break;
+      case "--config":
+        configFile = flags[++i];
+        break;
+      case "--api-key":
+        apiKey = flags[++i];
+        break;
+      case "--api-url":
+        apiUrl = flags[++i];
+        break;
+      case "--upstream-url":
+        upstreamUrl = flags[++i];
+        break;
+      case "--upstream-transport":
+        upstreamTransport = flags[++i];
+        break;
+      case "--port":
+        port = parseInt(flags[++i], 10);
+        break;
+    }
+  }
+  if (!apiKey) {
+    const envKey = process.env.SOLONGATE_API_KEY;
+    if (envKey) {
+      apiKey = envKey;
+    } else {
+      throw new Error(
+        "A valid SolonGate API key is required.\n\nUsage: solongate-proxy --api-key sg_live_xxx -- <command>\n   or: set SOLONGATE_API_KEY=sg_live_xxx\n\nGet your API key at https://solongate.com\n"
+      );
+    }
+  }
+  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
+    throw new Error(
+      "Invalid API key format. Keys must start with 'sg_live_' or 'sg_test_'.\nGet your API key at https://solongate.com\n"
+    );
+  }
+  const resolvedPolicyPath = resolvePolicyPath(policySource);
+  if (configFile) {
+    const filePath = resolve(configFile);
+    const content = readFileSync(filePath, "utf-8");
+    const fileConfig = JSON.parse(content);
+    if (!fileConfig.upstream) {
+      throw new Error('Config file must include "upstream" with at least "command" or "url"');
+    }
+    const cfgPolicySource = fileConfig.policy ?? policySource;
+    return {
+      upstream: fileConfig.upstream,
+      policy: loadPolicy(cfgPolicySource),
+      name: fileConfig.name ?? name,
+      verbose: fileConfig.verbose ?? verbose,
+      rateLimitPerTool: fileConfig.rateLimitPerTool ?? rateLimitPerTool,
+      globalRateLimit: fileConfig.globalRateLimit ?? globalRateLimit,
+      apiKey: apiKey ?? fileConfig.apiKey,
+      apiUrl: apiUrl ?? fileConfig.apiUrl,
+      port: port ?? fileConfig.port,
+      policyPath: resolvePolicyPath(cfgPolicySource) ?? void 0
+    };
+  }
+  if (upstreamUrl) {
+    const transport = upstreamTransport ?? (upstreamUrl.includes("/sse") ? "sse" : "http");
+    return {
+      upstream: {
+        transport,
+        command: "",
+        // not used for URL-based transports
+        url: upstreamUrl
+      },
+      policy: loadPolicy(policySource),
+      name,
+      verbose,
+      rateLimitPerTool,
+      globalRateLimit,
+      apiKey,
+      apiUrl,
+      port,
+      policyPath: resolvedPolicyPath ?? void 0
+    };
+  }
+  if (upstreamArgs.length === 0) {
+    throw new Error(
+      "No upstream server command provided.\n\nUsage: solongate-proxy [options] -- <command> [args...]\n\nExamples:\n  solongate-proxy -- node my-server.js\n  solongate-proxy --policy restricted -- npx @openclaw/server\n  solongate-proxy --upstream-url http://localhost:3001/mcp\n  solongate-proxy --config solongate.json\n"
+    );
+  }
+  const [command, ...commandArgs] = upstreamArgs;
+  return {
+    upstream: {
+      transport: upstreamTransport ?? "stdio",
+      command,
+      args: commandArgs,
+      env: { ...process.env }
+    },
+    policy: loadPolicy(policySource),
+    name,
+    verbose,
+    rateLimitPerTool,
+    globalRateLimit,
+    apiKey,
+    apiUrl,
+    port,
+    policyPath: resolvedPolicyPath ?? void 0
+  };
+}
+function resolvePolicyPath(source) {
+  if (PRESETS[source]) return null;
+  const filePath = resolve(source);
+  if (existsSync(filePath)) return filePath;
+  return null;
+}
+var PRESETS;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    PRESETS = {
+      restricted: {
+        id: "restricted",
+        name: "Restricted",
+        description: "Blocks dangerous commands (rm -rf, curl|bash, dd, etc.), allows safe tools with path restrictions",
+        version: 1,
+        rules: [
+          {
+            id: "deny-dangerous-commands",
+            description: "Block dangerous shell commands",
+            effect: "DENY",
+            priority: 50,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            commandConstraints: {
+              denied: [
+                "rm -rf *",
+                "rm -r /*",
+                "mkfs*",
+                "dd if=*",
+                "curl*|*bash*",
+                "curl*|*sh*",
+                "wget*|*bash*",
+                "wget*|*sh*",
+                "shutdown*",
+                "reboot*",
+                "kill -9*",
+                "chmod*777*",
+                "iptables*",
+                "passwd*",
+                "useradd*",
+                "userdel*"
+              ]
+            },
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "deny-sensitive-paths",
+            description: "Block access to sensitive files",
+            effect: "DENY",
+            priority: 51,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            pathConstraints: {
+              denied: [
+                "**/.env*",
+                "**/.ssh/**",
+                "**/.aws/**",
+                "**/.kube/**",
+                "**/credentials*",
+                "**/secrets*",
+                "**/*.pem",
+                "**/*.key",
+                "/etc/passwd",
+                "/etc/shadow",
+                "/proc/**",
+                "/dev/**"
+              ]
+            },
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-rest",
+            description: "Allow all other tool calls",
+            effect: "ALLOW",
+            priority: 1e3,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          }
+        ],
+        createdAt: "",
+        updatedAt: ""
+      },
+      "read-only": {
+        id: "read-only",
+        name: "Read Only",
+        description: "Only allows read/list/get/search/query tools",
+        version: 1,
+        rules: [
+          {
+            id: "allow-read",
+            description: "Allow read tools",
+            effect: "ALLOW",
+            priority: 100,
+            toolPattern: "*read*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-list",
+            description: "Allow list tools",
+            effect: "ALLOW",
+            priority: 101,
+            toolPattern: "*list*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-get",
+            description: "Allow get tools",
+            effect: "ALLOW",
+            priority: 102,
+            toolPattern: "*get*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-search",
+            description: "Allow search tools",
+            effect: "ALLOW",
+            priority: 103,
+            toolPattern: "*search*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-query",
+            description: "Allow query tools",
+            effect: "ALLOW",
+            priority: 104,
+            toolPattern: "*query*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          }
+        ],
+        createdAt: "",
+        updatedAt: ""
+      },
+      sandbox: {
+        id: "sandbox",
+        name: "Sandbox",
+        description: "Allows file ops within working directory only, blocks dangerous commands, allows safe shell commands",
+        version: 1,
+        rules: [
+          {
+            id: "deny-dangerous-commands",
+            description: "Block dangerous shell commands",
+            effect: "DENY",
+            priority: 50,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            commandConstraints: {
+              denied: [
+                "rm -rf *",
+                "rm -r /*",
+                "mkfs*",
+                "dd if=*",
+                "curl*|*bash*",
+                "wget*|*sh*",
+                "shutdown*",
+                "reboot*",
+                "chmod*777*"
+              ]
+            },
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-safe-commands",
+            description: "Allow safe shell commands only",
+            effect: "ALLOW",
+            priority: 100,
+            toolPattern: "*shell*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            commandConstraints: {
+              allowed: [
+                "ls*",
+                "cat*",
+                "head*",
+                "tail*",
+                "wc*",
+                "grep*",
+                "find*",
+                "echo*",
+                "pwd",
+                "whoami",
+                "date",
+                "env",
+                "git*",
+                "npm*",
+                "pnpm*",
+                "yarn*",
+                "node*",
+                "python*",
+                "pip*"
+              ]
+            },
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "deny-sensitive-paths",
+            description: "Block access to sensitive files",
+            effect: "DENY",
+            priority: 51,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            pathConstraints: {
+              denied: [
+                "**/.env*",
+                "**/.ssh/**",
+                "**/.aws/**",
+                "**/credentials*",
+                "**/*.pem",
+                "**/*.key"
+              ]
+            },
+            createdAt: "",
+            updatedAt: ""
+          },
+          {
+            id: "allow-rest",
+            description: "Allow all other tools",
+            effect: "ALLOW",
+            priority: 1e3,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          }
+        ],
+        createdAt: "",
+        updatedAt: ""
+      },
+      permissive: {
+        id: "permissive",
+        name: "Permissive",
+        description: "Allows all tool calls (monitoring only)",
+        version: 1,
+        rules: [
+          {
+            id: "allow-all",
+            description: "Allow all",
+            effect: "ALLOW",
+            priority: 1e3,
+            toolPattern: "*",
+            permission: "EXECUTE",
+            minimumTrustLevel: "UNTRUSTED",
+            enabled: true,
+            createdAt: "",
+            updatedAt: ""
+          }
+        ],
+        createdAt: "",
+        updatedAt: ""
+      },
+      "deny-all": {
+        id: "deny-all",
+        name: "Deny All",
+        description: "Blocks all tool calls",
+        version: 1,
+        rules: [],
+        createdAt: "",
+        updatedAt: ""
+      }
+    };
+  }
+});
+
 // src/init.ts
 var init_exports = {};
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, copyFileSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, copyFileSync, mkdirSync } from "fs";
 import { resolve as resolve2, join } from "path";
 import { createInterface } from "readline";
 function findConfigFile(explicitPath) {
   if (explicitPath) {
-    if (existsSync2(explicitPath)) {
+    if (existsSync3(explicitPath)) {
       return { path: resolve2(explicitPath), type: "mcp" };
     }
     return null;
   }
   for (const searchPath of SEARCH_PATHS) {
     const full = resolve2(searchPath);
-    if (existsSync2(full)) return { path: full, type: "mcp" };
+    if (existsSync3(full)) return { path: full, type: "mcp" };
   }
   for (const desktopPath of CLAUDE_DESKTOP_PATHS) {
-    if (existsSync2(desktopPath)) return { path: desktopPath, type: "claude-desktop" };
+    if (existsSync3(desktopPath)) return { path: desktopPath, type: "claude-desktop" };
   }
   return null;
 }
 function readConfig(filePath) {
-  const content = readFileSync2(filePath, "utf-8");
+  const content = readFileSync3(filePath, "utf-8");
   const parsed = JSON.parse(content);
   if (parsed.mcpServers) return parsed;
   throw new Error(`Unrecognized config format in ${filePath}`);
@@ -97,7 +604,7 @@ function parseInitArgs(argv) {
     }
   }
   if (!POLICY_PRESETS.includes(options.policy)) {
-    if (!existsSync2(resolve2(options.policy))) {
+    if (!existsSync3(resolve2(options.policy))) {
       console.error(`Unknown policy: ${options.policy}`);
       console.error(`Available presets: ${POLICY_PRESETS.join(", ")}`);
       process.exit(1);
@@ -141,16 +648,16 @@ function installClaudeCodeHooks(apiKey) {
   const hooksDir = resolve2(".claude", "hooks");
   mkdirSync(hooksDir, { recursive: true });
   const guardPath = join(hooksDir, "guard.mjs");
-  writeFileSync(guardPath, GUARD_SCRIPT);
+  writeFileSync2(guardPath, GUARD_SCRIPT);
   console.error(`  Created ${guardPath}`);
   const auditPath = join(hooksDir, "audit.mjs");
-  writeFileSync(auditPath, AUDIT_SCRIPT);
+  writeFileSync2(auditPath, AUDIT_SCRIPT);
   console.error(`  Created ${auditPath}`);
   const settingsPath = resolve2(".claude", "settings.json");
   let settings = {};
-  if (existsSync2(settingsPath)) {
+  if (existsSync3(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync2(settingsPath, "utf-8"));
+      settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
     } catch {
     }
   }
@@ -184,7 +691,7 @@ function installClaudeCodeHooks(apiKey) {
   const envObj = settings.env || {};
   envObj.SOLONGATE_API_KEY = apiKey;
   settings.env = envObj;
-  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   console.error(`  Created ${settingsPath}`);
   console.error("");
   console.error("  Claude Code hooks installed!");
@@ -193,7 +700,7 @@ function installClaudeCodeHooks(apiKey) {
 }
 function ensureEnvFile() {
   const envPath = resolve2(".env");
-  if (!existsSync2(envPath)) {
+  if (!existsSync3(envPath)) {
     const envContent = `# SolonGate API Keys
 # Get your keys from the dashboard: https://solongate.com
 # IMPORTANT: Never commit this file to git!
@@ -204,14 +711,14 @@ SOLONGATE_API_KEY=sg_live_your_key_here
 # Test key \u2014 local-only, no cloud connection (for development)
 # SOLONGATE_API_KEY=sg_test_your_key_here
 `;
-    writeFileSync(envPath, envContent);
+    writeFileSync2(envPath, envContent);
     console.error(`  Created .env with placeholder API keys`);
     console.error(`  \u2192 Edit .env and replace with your real keys from https://solongate.com`);
     console.error("");
   }
   const gitignorePath = resolve2(".gitignore");
-  if (existsSync2(gitignorePath)) {
-    let gitignore = readFileSync2(gitignorePath, "utf-8");
+  if (existsSync3(gitignorePath)) {
+    let gitignore = readFileSync3(gitignorePath, "utf-8");
     let updated = false;
     if (!gitignore.includes(".env")) {
       gitignore = gitignore.trimEnd() + "\n.env\n.env.local\n";
@@ -222,11 +729,11 @@ SOLONGATE_API_KEY=sg_live_your_key_here
       updated = true;
     }
     if (updated) {
-      writeFileSync(gitignorePath, gitignore);
+      writeFileSync2(gitignorePath, gitignore);
       console.error(`  Updated .gitignore (added .env + .mcp.json)`);
     }
   } else {
-    writeFileSync(gitignorePath, ".env\n.env.local\n.mcp.json\nnode_modules/\n");
+    writeFileSync2(gitignorePath, ".env\n.env.local\n.mcp.json\nnode_modules/\n");
     console.error(`  Created .gitignore (with .env and .mcp.json excluded)`);
   }
 }
@@ -274,7 +781,7 @@ async function main() {
   console.error("");
   const backupPath = configInfo.path + ".solongate-backup";
   if (options.restore) {
-    if (!existsSync2(backupPath)) {
+    if (!existsSync3(backupPath)) {
       console.error("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -331,8 +838,8 @@ async function main() {
   let apiKey = options.apiKey || process.env.SOLONGATE_API_KEY || "";
   if (!apiKey) {
     const envPath = resolve2(".env");
-    if (existsSync2(envPath)) {
-      const envContent = readFileSync2(envPath, "utf-8");
+    if (existsSync3(envPath)) {
+      const envContent = readFileSync3(envPath, "utf-8");
       const match = envContent.match(/^SOLONGATE_API_KEY=(sg_(?:live|test)_\w+)/m);
       if (match) apiKey = match[1];
     }
@@ -367,16 +874,16 @@ async function main() {
     console.error(JSON.stringify(newConfig, null, 2));
     process.exit(0);
   }
-  if (!existsSync2(backupPath)) {
+  if (!existsSync3(backupPath)) {
     copyFileSync(configInfo.path, backupPath);
     console.error(`  Backup: ${backupPath}`);
   }
   if (configInfo.type === "claude-desktop") {
-    const original = JSON.parse(readFileSync2(configInfo.path, "utf-8"));
+    const original = JSON.parse(readFileSync3(configInfo.path, "utf-8"));
     original.mcpServers = newConfig.mcpServers;
-    writeFileSync(configInfo.path, JSON.stringify(original, null, 2) + "\n");
+    writeFileSync2(configInfo.path, JSON.stringify(original, null, 2) + "\n");
   } else {
-    writeFileSync(configInfo.path, JSON.stringify(newConfig, null, 2) + "\n");
+    writeFileSync2(configInfo.path, JSON.stringify(newConfig, null, 2) + "\n");
   }
   console.error("  Config updated!");
   console.error("");
@@ -635,7 +1142,7 @@ process.stdin.on('end', async () => {
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, copyFileSync as copyFileSync2 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, copyFileSync as copyFileSync2 } from "fs";
 import { resolve as resolve3 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -668,7 +1175,7 @@ function parseInjectArgs(argv) {
   return opts;
 }
 function printHelp2() {
-  log2(`
+  log3(`
 SolonGate Inject \u2014 Add security to your MCP server in seconds
 
 USAGE
@@ -692,7 +1199,7 @@ WHAT IT DOES
   All tool() calls are automatically protected by SolonGate.
 `);
 }
-function log2(msg) {
+function log3(msg) {
   process.stderr.write(msg + "\n");
 }
 function printBanner(subtitle) {
@@ -705,18 +1212,18 @@ function printBanner(subtitle) {
     " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
   ];
   const colors = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
-  log2("");
+  log3("");
   for (let i = 0; i < lines.length; i++) {
-    log2(`${c.bold}${colors[i]}${lines[i]}${c.reset}`);
+    log3(`${c.bold}${colors[i]}${lines[i]}${c.reset}`);
   }
-  log2("");
-  log2(`  ${c.dim}${c.italic}${subtitle}${c.reset}`);
-  log2("");
+  log3("");
+  log3(`  ${c.dim}${c.italic}${subtitle}${c.reset}`);
+  log3("");
 }
 function detectProject() {
-  if (!existsSync3(resolve3("package.json"))) return false;
+  if (!existsSync4(resolve3("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync3(resolve3("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync4(resolve3("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -725,18 +1232,18 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync3(resolve3("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync4(resolve3("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync3(resolve3(srcPath))) return resolve3(srcPath);
-        if (existsSync3(resolve3(binPath))) return resolve3(binPath);
+        if (existsSync4(resolve3(srcPath))) return resolve3(srcPath);
+        if (existsSync4(resolve3(binPath))) return resolve3(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync3(resolve3(srcPath))) return resolve3(srcPath);
+      if (existsSync4(resolve3(srcPath))) return resolve3(srcPath);
     }
   } catch {
   }
@@ -750,9 +1257,9 @@ function findTsEntryFile() {
   ];
   for (const c3 of candidates) {
     const full = resolve3(c3);
-    if (existsSync3(full)) {
+    if (existsSync4(full)) {
       try {
-        const content = readFileSync3(full, "utf-8");
+        const content = readFileSync4(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -761,39 +1268,39 @@ function findTsEntryFile() {
     }
   }
   for (const c3 of candidates) {
-    if (existsSync3(resolve3(c3))) return resolve3(c3);
+    if (existsSync4(resolve3(c3))) return resolve3(c3);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync3(resolve3("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync3(resolve3("yarn.lock"))) return "yarn";
+  if (existsSync4(resolve3("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync4(resolve3("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync3(resolve3("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync4(resolve3("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/sdk"]) {
-      log2("  @solongate/sdk already installed");
+      log3("  @solongate/sdk already installed");
       return true;
     }
   } catch {
   }
   const pm = detectPackageManager();
   const cmd = pm === "yarn" ? "yarn add @solongate/sdk" : `${pm} install @solongate/sdk`;
-  log2(`  Installing @solongate/sdk via ${pm}...`);
+  log3(`  Installing @solongate/sdk via ${pm}...`);
   try {
     execSync(cmd, { stdio: "pipe", cwd: process.cwd() });
     return true;
   } catch (err) {
-    log2(`  Failed to install: ${err instanceof Error ? err.message : String(err)}`);
-    log2("  You can install manually: npm install @solongate/sdk");
+    log3(`  Failed to install: ${err instanceof Error ? err.message : String(err)}`);
+    log3("  You can install manually: npm install @solongate/sdk");
     return false;
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync3(filePath, "utf-8");
+  const original = readFileSync4(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -871,14 +1378,14 @@ function findImportInsertPosition(content) {
 }
 function showDiff(result) {
   if (result.original === result.modified) {
-    log2("  No changes needed.");
+    log3("  No changes needed.");
     return;
   }
   const origLines = result.original.split("\n");
   const modLines = result.modified.split("\n");
-  log2("");
-  log2(`  File: ${result.file}`);
-  log2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  log3("");
+  log3(`  File: ${result.file}`);
+  log3("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   const maxLines = Math.max(origLines.length, modLines.length);
   let diffCount = 0;
   for (let i = 0; i < maxLines; i++) {
@@ -886,99 +1393,99 @@ function showDiff(result) {
     const mod = modLines[i];
     if (orig !== mod) {
       if (diffCount < 30) {
-        if (orig !== void 0) log2(`  - ${orig}`);
-        if (mod !== void 0) log2(`  + ${mod}`);
+        if (orig !== void 0) log3(`  - ${orig}`);
+        if (mod !== void 0) log3(`  + ${mod}`);
       }
       diffCount++;
     }
   }
   if (diffCount > 30) {
-    log2(`  ... and ${diffCount - 30} more line changes`);
+    log3(`  ... and ${diffCount - 30} more line changes`);
   }
-  log2("");
+  log3("");
 }
 async function main2() {
   const opts = parseInjectArgs(process.argv);
   printBanner("Inject SDK");
   if (!detectProject()) {
-    log2("  Could not detect a TypeScript MCP server project.");
-    log2("  Make sure you are in a project directory with:");
-    log2("    package.json + @modelcontextprotocol/sdk in dependencies");
-    log2("");
-    log2("  To create a new MCP server: npx @solongate/proxy create <name>");
+    log3("  Could not detect a TypeScript MCP server project.");
+    log3("  Make sure you are in a project directory with:");
+    log3("    package.json + @modelcontextprotocol/sdk in dependencies");
+    log3("");
+    log3("  To create a new MCP server: npx @solongate/proxy create <name>");
     process.exit(1);
   }
-  log2("  Language: TypeScript");
+  log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve3(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync3(entryFile)) {
-    log2(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
-    log2("");
-    log2("  Specify it manually: --file <path>");
-    log2("");
-    log2("  Common entry points:");
-    log2("    src/index.ts, src/server.ts, index.ts");
+  if (!entryFile || !existsSync4(entryFile)) {
+    log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
+    log3("");
+    log3("  Specify it manually: --file <path>");
+    log3("");
+    log3("  Common entry points:");
+    log3("    src/index.ts, src/server.ts, index.ts");
     process.exit(1);
   }
-  log2(`  Entry:    ${entryFile}`);
-  log2("");
+  log3(`  Entry:    ${entryFile}`);
+  log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync3(backupPath)) {
-      log2("  No backup found. Nothing to restore.");
+    if (!existsSync4(backupPath)) {
+      log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
     copyFileSync2(backupPath, entryFile);
-    log2(`  Restored original file from backup.`);
-    log2(`  Backup: ${backupPath}`);
+    log3(`  Restored original file from backup.`);
+    log3(`  Backup: ${backupPath}`);
     process.exit(0);
   }
   if (!opts.skipInstall && !opts.dryRun) {
     installSdk();
-    log2("");
+    log3("");
   }
   const result = injectTypeScript(entryFile);
-  log2(`  Changes (${result.changes.length}):`);
+  log3(`  Changes (${result.changes.length}):`);
   for (const change of result.changes) {
-    log2(`    - ${change}`);
+    log3(`    - ${change}`);
   }
   if (result.changes.length === 1 && result.changes[0].includes("Already injected")) {
-    log2("");
-    log2("  Your MCP server is already protected by SolonGate!");
+    log3("");
+    log3("  Your MCP server is already protected by SolonGate!");
     process.exit(0);
   }
   if (result.original === result.modified) {
-    log2("");
-    log2("  No changes were made. The file may not contain recognizable MCP patterns.");
-    log2("  See docs: https://solongate.com/docs/integration");
+    log3("");
+    log3("  No changes were made. The file may not contain recognizable MCP patterns.");
+    log3("  See docs: https://solongate.com/docs/integration");
     process.exit(0);
   }
   if (opts.dryRun) {
-    log2("");
-    log2("  --- DRY RUN (no changes written) ---");
+    log3("");
+    log3("  --- DRY RUN (no changes written) ---");
     showDiff(result);
-    log2("  To apply: npx @solongate/proxy inject");
+    log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync3(backupPath)) {
+  if (!existsSync4(backupPath)) {
     copyFileSync2(entryFile, backupPath);
-    log2("");
-    log2(`  Backup: ${backupPath}`);
-  }
-  writeFileSync2(entryFile, result.modified);
-  log2("");
-  log2("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  log2("  \u2502  SolonGate SDK injected successfully!         \u2502");
-  log2("  \u2502                                               \u2502");
-  log2("  \u2502  McpServer \u2192 SecureMcpServer                  \u2502");
-  log2("  \u2502  All tool() calls are now auto-protected.     \u2502");
-  log2("  \u2502                                               \u2502");
-  log2("  \u2502  Set your API key:                             \u2502");
-  log2("  \u2502    export SOLONGATE_API_KEY=sg_live_xxx        \u2502");
-  log2("  \u2502                                               \u2502");
-  log2("  \u2502  To undo:                                     \u2502");
-  log2("  \u2502    npx @solongate/proxy inject --restore       \u2502");
-  log2("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  log2("");
+    log3("");
+    log3(`  Backup: ${backupPath}`);
+  }
+  writeFileSync3(entryFile, result.modified);
+  log3("");
+  log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
+  log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
+  log3("  \u2502                                               \u2502");
+  log3("  \u2502  McpServer \u2192 SecureMcpServer                  \u2502");
+  log3("  \u2502  All tool() calls are now auto-protected.     \u2502");
+  log3("  \u2502                                               \u2502");
+  log3("  \u2502  Set your API key:                             \u2502");
+  log3("  \u2502    export SOLONGATE_API_KEY=sg_live_xxx        \u2502");
+  log3("  \u2502                                               \u2502");
+  log3("  \u2502  To undo:                                     \u2502");
+  log3("  \u2502    npx @solongate/proxy inject --restore       \u2502");
+  log3("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
+  log3("");
 }
 var c;
 var init_inject = __esm({
@@ -999,7 +1506,7 @@ var init_inject = __esm({
       blue6: "\x1B[38;2;170;200;250m"
     };
     main2().catch((err) => {
-      log2(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+      log3(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
       process.exit(1);
     });
   }
@@ -1007,10 +1514,10 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, existsSync as existsSync4 } from "fs";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join2 } from "path";
 import { execSync as execSync2 } from "child_process";
-function log3(msg) {
+function log4(msg) {
   process.stderr.write(msg + "\n");
 }
 function printBanner2(subtitle) {
@@ -1023,13 +1530,13 @@ function printBanner2(subtitle) {
     " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
   ];
   const colors = [c2.blue1, c2.blue2, c2.blue3, c2.blue4, c2.blue5, c2.blue6];
-  log3("");
+  log4("");
   for (let i = 0; i < lines.length; i++) {
-    log3(`${c2.bold}${colors[i]}${lines[i]}${c2.reset}`);
+    log4(`${c2.bold}${colors[i]}${lines[i]}${c2.reset}`);
   }
-  log3("");
-  log3(`  ${c2.dim}${c2.italic}${subtitle}${c2.reset}`);
-  log3("");
+  log4("");
+  log4(`  ${c2.dim}${c2.italic}${subtitle}${c2.reset}`);
+  log4("");
 }
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -1078,20 +1585,20 @@ function parseCreateArgs(argv) {
     }
   }
   if (!opts.name) {
-    log3("");
-    log3("  Error: Project name required.");
-    log3("");
-    log3("  Usage: npx @solongate/proxy create <name>");
-    log3("");
-    log3("  Examples:");
-    log3("    npx @solongate/proxy create my-mcp-server");
-    log3("    npx @solongate/proxy create weather-api");
+    log4("");
+    log4("  Error: Project name required.");
+    log4("");
+    log4("  Usage: npx @solongate/proxy create <name>");
+    log4("");
+    log4("  Examples:");
+    log4("    npx @solongate/proxy create my-mcp-server");
+    log4("    npx @solongate/proxy create weather-api");
     process.exit(1);
   }
   return opts;
 }
 function printHelp3() {
-  log3(`
+  log4(`
 SolonGate Create \u2014 Scaffold a secure MCP server in seconds
 
 USAGE
@@ -1108,7 +1615,7 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, "package.json"),
     JSON.stringify(
       {
@@ -1138,7 +1645,7 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, "tsconfig.json"),
     JSON.stringify(
       {
@@ -1160,7 +1667,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   mkdirSync2(join2(dir, "src"), { recursive: true });
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
@@ -1205,7 +1712,7 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, ".mcp.json"),
     JSON.stringify(
       {
@@ -1223,12 +1730,12 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync3(
+  writeFileSync4(
     join2(dir, ".gitignore"),
     `node_modules/
 dist/
@@ -1243,8 +1750,8 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve4(opts.name);
   printBanner2("Create MCP Server");
-  if (existsSync4(dir)) {
-    log3(`  ${c2.red}Error:${c2.reset} Directory "${opts.name}" already exists.`);
+  if (existsSync5(dir)) {
+    log4(`  ${c2.red}Error:${c2.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
@@ -1256,19 +1763,19 @@ async function main3() {
       execSync2("npm install", { cwd: dir, stdio: "pipe" });
     });
   }
-  log3("");
+  log4("");
   const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
   const W = 52;
   const hr = "\u2500".repeat(W + 2);
   const bLine = (text) => {
     const visible = stripAnsi(text);
     const padding = W - visible.length;
-    log3(`  ${c2.dim}\u2502${c2.reset} ${text}${" ".repeat(Math.max(0, padding))} ${c2.dim}\u2502${c2.reset}`);
+    log4(`  ${c2.dim}\u2502${c2.reset} ${text}${" ".repeat(Math.max(0, padding))} ${c2.dim}\u2502${c2.reset}`);
   };
-  const bEmpty = () => log3(`  ${c2.dim}\u2502${c2.reset} ${" ".repeat(W)} ${c2.dim}\u2502${c2.reset}`);
-  log3(`  ${c2.dim}\u256D${hr}\u256E${c2.reset}`);
-  log3(`  ${c2.dim}\u2502${c2.reset} ${c2.green}${c2.bold}\u2714  MCP Server created successfully!${c2.reset}${" ".repeat(W - 35)} ${c2.dim}\u2502${c2.reset}`);
-  log3(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
+  const bEmpty = () => log4(`  ${c2.dim}\u2502${c2.reset} ${" ".repeat(W)} ${c2.dim}\u2502${c2.reset}`);
+  log4(`  ${c2.dim}\u256D${hr}\u256E${c2.reset}`);
+  log4(`  ${c2.dim}\u2502${c2.reset} ${c2.green}${c2.bold}\u2714  MCP Server created successfully!${c2.reset}${" ".repeat(W - 35)} ${c2.dim}\u2502${c2.reset}`);
+  log4(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
   bEmpty();
   bLine(`${c2.yellow}Next steps:${c2.reset}`);
   bEmpty();
@@ -1277,7 +1784,7 @@ async function main3() {
   bLine(`  ${c2.cyan}$${c2.reset} npm run dev          ${c2.dim}# dev mode${c2.reset}`);
   bLine(`  ${c2.cyan}$${c2.reset} npm start            ${c2.dim}# production${c2.reset}`);
   bEmpty();
-  log3(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
+  log4(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
   bEmpty();
   bLine(`${c2.yellow}Set your API key:${c2.reset}`);
   bEmpty();
@@ -1285,14 +1792,14 @@ async function main3() {
   bEmpty();
   bLine(`${c2.dim}https://dashboard.solongate.com/api-keys/${c2.reset}`);
   bEmpty();
-  log3(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
+  log4(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
   bEmpty();
   bLine(`${c2.yellow}Use with OpenClaw:${c2.reset}`);
   bEmpty();
   bLine(`  ${c2.cyan}$${c2.reset} solongate-proxy -- npx @openclaw/server`);
   bLine(`  ${c2.dim}Wraps OpenClaw servers with SolonGate protection${c2.reset}`);
   bEmpty();
-  log3(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
+  log4(`  ${c2.dim}\u251C${hr}\u2524${c2.reset}`);
   bEmpty();
   bLine(`${c2.yellow}Use with Claude Code / Cursor / MCP client:${c2.reset}`);
   bEmpty();
@@ -1305,512 +1812,190 @@ async function main3() {
   bLine(`  ${c2.dim}1.${c2.reset} Replace ${c2.blue3}sg_live_YOUR_KEY_HERE${c2.reset} in .env`);
   bLine(`  ${c2.dim}2.${c2.reset} ${c2.cyan}$${c2.reset} npm run build && npm start`);
   bEmpty();
-  log3(`  ${c2.dim}\u2570${hr}\u256F${c2.reset}`);
-  log3("");
+  log4(`  ${c2.dim}\u2570${hr}\u256F${c2.reset}`);
+  log4("");
 }
 var c2;
-var init_create = __esm({
-  "src/create.ts"() {
-    "use strict";
-    c2 = {
-      reset: "\x1B[0m",
-      bold: "\x1B[1m",
-      dim: "\x1B[2m",
-      italic: "\x1B[3m",
-      white: "\x1B[97m",
-      gray: "\x1B[90m",
-      blue1: "\x1B[38;2;20;50;160m",
-      blue2: "\x1B[38;2;40;80;190m",
-      blue3: "\x1B[38;2;60;110;215m",
-      blue4: "\x1B[38;2;90;140;230m",
-      blue5: "\x1B[38;2;130;170;240m",
-      blue6: "\x1B[38;2;170;200;250m",
-      green: "\x1B[38;2;80;200;120m",
-      red: "\x1B[38;2;220;80;80m",
-      cyan: "\x1B[38;2;100;200;220m",
-      yellow: "\x1B[38;2;220;200;80m",
-      bgBlue: "\x1B[48;2;20;50;160m"
-    };
-    main3().catch((err) => {
-      log3(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    });
-  }
-});
-
-// src/config.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve } from "path";
-async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
-  const url = `${apiUrl}/api/v1/policies/${policyId ?? "default"}`;
-  const res = await fetch(url, {
-    headers: { "Authorization": `Bearer ${apiKey}` }
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(`Failed to fetch policy from cloud (${res.status}): ${body}`);
-  }
-  const data = await res.json();
-  return {
-    id: String(data.id ?? "cloud"),
-    name: String(data.name ?? "Cloud Policy"),
-    version: Number(data._version ?? 1),
-    rules: data.rules ?? [],
-    createdAt: String(data._created_at ?? ""),
-    updatedAt: ""
-  };
-}
-async function sendAuditLog(apiKey, apiUrl, entry) {
-  const url = `${apiUrl}/api/v1/audit-logs`;
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        "Authorization": `Bearer ${apiKey}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(entry)
-    });
-    if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      process.stderr.write(`[SolonGate] Audit log failed (${res.status}): ${body}
-`);
-    }
-  } catch (err) {
-    process.stderr.write(`[SolonGate] Audit log error: ${err instanceof Error ? err.message : String(err)}
-`);
-  }
-}
-var PRESETS = {
-  restricted: {
-    id: "restricted",
-    name: "Restricted",
-    description: "Blocks dangerous commands (rm -rf, curl|bash, dd, etc.), allows safe tools with path restrictions",
-    version: 1,
-    rules: [
-      {
-        id: "deny-dangerous-commands",
-        description: "Block dangerous shell commands",
-        effect: "DENY",
-        priority: 50,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        commandConstraints: {
-          denied: [
-            "rm -rf *",
-            "rm -r /*",
-            "mkfs*",
-            "dd if=*",
-            "curl*|*bash*",
-            "curl*|*sh*",
-            "wget*|*bash*",
-            "wget*|*sh*",
-            "shutdown*",
-            "reboot*",
-            "kill -9*",
-            "chmod*777*",
-            "iptables*",
-            "passwd*",
-            "useradd*",
-            "userdel*"
-          ]
-        },
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "deny-sensitive-paths",
-        description: "Block access to sensitive files",
-        effect: "DENY",
-        priority: 51,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        pathConstraints: {
-          denied: [
-            "**/.env*",
-            "**/.ssh/**",
-            "**/.aws/**",
-            "**/.kube/**",
-            "**/credentials*",
-            "**/secrets*",
-            "**/*.pem",
-            "**/*.key",
-            "/etc/passwd",
-            "/etc/shadow",
-            "/proc/**",
-            "/dev/**"
-          ]
-        },
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-rest",
-        description: "Allow all other tool calls",
-        effect: "ALLOW",
-        priority: 1e3,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      }
-    ],
-    createdAt: "",
-    updatedAt: ""
-  },
-  "read-only": {
-    id: "read-only",
-    name: "Read Only",
-    description: "Only allows read/list/get/search/query tools",
-    version: 1,
-    rules: [
-      {
-        id: "allow-read",
-        description: "Allow read tools",
-        effect: "ALLOW",
-        priority: 100,
-        toolPattern: "*read*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-list",
-        description: "Allow list tools",
-        effect: "ALLOW",
-        priority: 101,
-        toolPattern: "*list*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-get",
-        description: "Allow get tools",
-        effect: "ALLOW",
-        priority: 102,
-        toolPattern: "*get*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-search",
-        description: "Allow search tools",
-        effect: "ALLOW",
-        priority: 103,
-        toolPattern: "*search*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-query",
-        description: "Allow query tools",
-        effect: "ALLOW",
-        priority: 104,
-        toolPattern: "*query*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      }
-    ],
-    createdAt: "",
-    updatedAt: ""
-  },
-  sandbox: {
-    id: "sandbox",
-    name: "Sandbox",
-    description: "Allows file ops within working directory only, blocks dangerous commands, allows safe shell commands",
-    version: 1,
-    rules: [
-      {
-        id: "deny-dangerous-commands",
-        description: "Block dangerous shell commands",
-        effect: "DENY",
-        priority: 50,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        commandConstraints: {
-          denied: [
-            "rm -rf *",
-            "rm -r /*",
-            "mkfs*",
-            "dd if=*",
-            "curl*|*bash*",
-            "wget*|*sh*",
-            "shutdown*",
-            "reboot*",
-            "chmod*777*"
-          ]
-        },
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-safe-commands",
-        description: "Allow safe shell commands only",
-        effect: "ALLOW",
-        priority: 100,
-        toolPattern: "*shell*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        commandConstraints: {
-          allowed: [
-            "ls*",
-            "cat*",
-            "head*",
-            "tail*",
-            "wc*",
-            "grep*",
-            "find*",
-            "echo*",
-            "pwd",
-            "whoami",
-            "date",
-            "env",
-            "git*",
-            "npm*",
-            "pnpm*",
-            "yarn*",
-            "node*",
-            "python*",
-            "pip*"
-          ]
-        },
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "deny-sensitive-paths",
-        description: "Block access to sensitive files",
-        effect: "DENY",
-        priority: 51,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        pathConstraints: {
-          denied: [
-            "**/.env*",
-            "**/.ssh/**",
-            "**/.aws/**",
-            "**/credentials*",
-            "**/*.pem",
-            "**/*.key"
-          ]
-        },
-        createdAt: "",
-        updatedAt: ""
-      },
-      {
-        id: "allow-rest",
-        description: "Allow all other tools",
-        effect: "ALLOW",
-        priority: 1e3,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      }
-    ],
-    createdAt: "",
-    updatedAt: ""
-  },
-  permissive: {
-    id: "permissive",
-    name: "Permissive",
-    description: "Allows all tool calls (monitoring only)",
-    version: 1,
-    rules: [
-      {
-        id: "allow-all",
-        description: "Allow all",
-        effect: "ALLOW",
-        priority: 1e3,
-        toolPattern: "*",
-        permission: "EXECUTE",
-        minimumTrustLevel: "UNTRUSTED",
-        enabled: true,
-        createdAt: "",
-        updatedAt: ""
-      }
-    ],
-    createdAt: "",
-    updatedAt: ""
-  },
-  "deny-all": {
-    id: "deny-all",
-    name: "Deny All",
-    description: "Blocks all tool calls",
-    version: 1,
-    rules: [],
-    createdAt: "",
-    updatedAt: ""
-  }
-};
-function loadPolicy(source) {
-  if (typeof source === "object") return source;
-  if (PRESETS[source]) return PRESETS[source];
-  const filePath = resolve(source);
-  if (existsSync(filePath)) {
-    const content = readFileSync(filePath, "utf-8");
-    return JSON.parse(content);
-  }
-  throw new Error(
-    `Unknown policy "${source}". Use a preset (${Object.keys(PRESETS).join(", ")}), a JSON file path, or a PolicySet object.`
-  );
-}
-function parseArgs(argv) {
-  const args = argv.slice(2);
-  let policySource = "restricted";
-  let name = "solongate-proxy";
-  let verbose = false;
-  let rateLimitPerTool;
-  let globalRateLimit;
-  let configFile;
-  let apiKey;
-  let apiUrl;
-  let upstreamUrl;
-  let upstreamTransport;
-  let port;
-  let separatorIndex = args.indexOf("--");
-  const flags = separatorIndex >= 0 ? args.slice(0, separatorIndex) : args;
-  const upstreamArgs = separatorIndex >= 0 ? args.slice(separatorIndex + 1) : [];
-  for (let i = 0; i < flags.length; i++) {
-    switch (flags[i]) {
-      case "--policy":
-        policySource = flags[++i];
-        break;
-      case "--name":
-        name = flags[++i];
-        break;
-      case "--verbose":
-        verbose = true;
-        break;
-      case "--rate-limit":
-        rateLimitPerTool = parseInt(flags[++i], 10);
-        break;
-      case "--global-rate-limit":
-        globalRateLimit = parseInt(flags[++i], 10);
-        break;
-      case "--config":
-        configFile = flags[++i];
-        break;
+var init_create = __esm({
+  "src/create.ts"() {
+    "use strict";
+    c2 = {
+      reset: "\x1B[0m",
+      bold: "\x1B[1m",
+      dim: "\x1B[2m",
+      italic: "\x1B[3m",
+      white: "\x1B[97m",
+      gray: "\x1B[90m",
+      blue1: "\x1B[38;2;20;50;160m",
+      blue2: "\x1B[38;2;40;80;190m",
+      blue3: "\x1B[38;2;60;110;215m",
+      blue4: "\x1B[38;2;90;140;230m",
+      blue5: "\x1B[38;2;130;170;240m",
+      blue6: "\x1B[38;2;170;200;250m",
+      green: "\x1B[38;2;80;200;120m",
+      red: "\x1B[38;2;220;80;80m",
+      cyan: "\x1B[38;2;100;200;220m",
+      yellow: "\x1B[38;2;220;200;80m",
+      bgBlue: "\x1B[48;2;20;50;160m"
+    };
+    main3().catch((err) => {
+      log4(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    });
+  }
+});
+
+// src/pull-push.ts
+var pull_push_exports = {};
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
+import { resolve as resolve5 } from "path";
+function loadEnv() {
+  if (process.env.SOLONGATE_API_KEY) return;
+  const envPath = resolve5(".env");
+  if (!existsSync6(envPath)) return;
+  try {
+    const content = readFileSync5(envPath, "utf-8");
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      const val = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+      if (key === "SOLONGATE_API_KEY") {
+        process.env.SOLONGATE_API_KEY = val;
+        return;
+      }
+    }
+  } catch {
+  }
+}
+function parseCliArgs() {
+  loadEnv();
+  const args = process.argv.slice(2);
+  const command = args[0];
+  let apiKey = process.env.SOLONGATE_API_KEY || "";
+  let file = "policy.json";
+  let policyId;
+  for (let i = 1; i < args.length; i++) {
+    switch (args[i]) {
       case "--api-key":
-        apiKey = flags[++i];
-        break;
-      case "--api-url":
-        apiUrl = flags[++i];
-        break;
-      case "--upstream-url":
-        upstreamUrl = flags[++i];
+        apiKey = args[++i];
         break;
-      case "--upstream-transport":
-        upstreamTransport = flags[++i];
+      case "--policy":
+      case "--output":
+      case "--file":
+      case "-f":
+      case "-o":
+        file = args[++i];
         break;
-      case "--port":
-        port = parseInt(flags[++i], 10);
+      case "--policy-id":
+      case "--id":
+        policyId = args[++i];
         break;
     }
   }
   if (!apiKey) {
-    const envKey = process.env.SOLONGATE_API_KEY;
-    if (envKey) {
-      apiKey = envKey;
-    } else {
-      throw new Error(
-        "A valid SolonGate API key is required.\n\nUsage: solongate-proxy --api-key sg_live_xxx -- <command>\n   or: set SOLONGATE_API_KEY=sg_live_xxx\n\nGet your API key at https://solongate.com\n"
-      );
-    }
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    throw new Error(
-      "Invalid API key format. Keys must start with 'sg_live_' or 'sg_test_'.\nGet your API key at https://solongate.com\n"
-    );
+    log5("ERROR: API key not found.");
+    log5("");
+    log5("Set it in .env file:");
+    log5("  SOLONGATE_API_KEY=sg_live_...");
+    log5("");
+    log5("Or pass via environment:");
+    log5(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
+    process.exit(1);
   }
-  if (configFile) {
-    const filePath = resolve(configFile);
-    const content = readFileSync(filePath, "utf-8");
-    const fileConfig = JSON.parse(content);
-    if (!fileConfig.upstream) {
-      throw new Error('Config file must include "upstream" with at least "command" or "url"');
-    }
-    return {
-      upstream: fileConfig.upstream,
-      policy: loadPolicy(fileConfig.policy ?? policySource),
-      name: fileConfig.name ?? name,
-      verbose: fileConfig.verbose ?? verbose,
-      rateLimitPerTool: fileConfig.rateLimitPerTool ?? rateLimitPerTool,
-      globalRateLimit: fileConfig.globalRateLimit ?? globalRateLimit,
-      apiKey: apiKey ?? fileConfig.apiKey,
-      apiUrl: apiUrl ?? fileConfig.apiUrl,
-      port: port ?? fileConfig.port
-    };
+  if (!apiKey.startsWith("sg_live_")) {
+    log5("ERROR: Pull/push requires a live API key (sg_live_...).");
+    process.exit(1);
   }
-  if (upstreamUrl) {
-    const transport = upstreamTransport ?? (upstreamUrl.includes("/sse") ? "sse" : "http");
-    return {
-      upstream: {
-        transport,
-        command: "",
-        // not used for URL-based transports
-        url: upstreamUrl
-      },
-      policy: loadPolicy(policySource),
-      name,
-      verbose,
-      rateLimitPerTool,
-      globalRateLimit,
-      apiKey,
-      apiUrl,
-      port
-    };
+  return { command, apiKey, file: resolve5(file), policyId };
+}
+async function pull(apiKey, file, policyId) {
+  const apiUrl = "https://api.solongate.com";
+  log5(`Pulling policy from dashboard...`);
+  const policy = await fetchCloudPolicy(apiKey, apiUrl, policyId);
+  const json = JSON.stringify(policy, null, 2) + "\n";
+  writeFileSync5(file, json, "utf-8");
+  log5(`Saved: ${file}`);
+  log5(`  Name: ${policy.name}`);
+  log5(`  Version: ${policy.version}`);
+  log5(`  Rules: ${policy.rules.length}`);
+  log5("");
+  log5("Done. Policy pulled from dashboard to local file.");
+}
+async function push(apiKey, file) {
+  const apiUrl = "https://api.solongate.com";
+  if (!existsSync6(file)) {
+    log5(`ERROR: File not found: ${file}`);
+    process.exit(1);
   }
-  if (upstreamArgs.length === 0) {
-    throw new Error(
-      "No upstream server command provided.\n\nUsage: solongate-proxy [options] -- <command> [args...]\n\nExamples:\n  solongate-proxy -- node my-server.js\n  solongate-proxy --policy restricted -- npx @openclaw/server\n  solongate-proxy --upstream-url http://localhost:3001/mcp\n  solongate-proxy --config solongate.json\n"
-    );
+  const content = readFileSync5(file, "utf-8");
+  let policy;
+  try {
+    policy = JSON.parse(content);
+  } catch {
+    log5(`ERROR: Invalid JSON in ${file}`);
+    process.exit(1);
   }
-  const [command, ...commandArgs] = upstreamArgs;
-  return {
-    upstream: {
-      transport: upstreamTransport ?? "stdio",
-      command,
-      args: commandArgs,
-      env: { ...process.env }
+  log5(`Pushing policy to dashboard...`);
+  log5(`  File: ${file}`);
+  log5(`  Name: ${policy.name || "Unnamed"}`);
+  log5(`  Rules: ${(policy.rules || []).length}`);
+  const res = await fetch(`${apiUrl}/api/v1/policies`, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
     },
-    policy: loadPolicy(policySource),
-    name,
-    verbose,
-    rateLimitPerTool,
-    globalRateLimit,
-    apiKey,
-    apiUrl,
-    port
-  };
+    body: JSON.stringify({
+      id: policy.id || "default",
+      name: policy.name || "Local Policy",
+      description: policy.description || "Pushed from local file",
+      version: policy.version || 1,
+      rules: policy.rules || []
+    })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    log5(`ERROR: Push failed (${res.status}): ${body}`);
+    process.exit(1);
+  }
+  const data = await res.json();
+  log5(`  Cloud version: ${data._version ?? "created"}`);
+  log5("");
+  log5("Done. Policy pushed from local file to dashboard.");
+}
+async function main4() {
+  const { command, apiKey, file, policyId } = parseCliArgs();
+  try {
+    if (command === "pull") {
+      await pull(apiKey, file, policyId);
+    } else if (command === "push") {
+      await push(apiKey, file);
+    } else {
+      log5(`Unknown command: ${command}`);
+      log5("Usage: solongate-proxy pull|push [--file policy.json]");
+      process.exit(1);
+    }
+  } catch (err) {
+    log5(`ERROR: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
 }
+var log5;
+var init_pull_push = __esm({
+  "src/pull-push.ts"() {
+    "use strict";
+    init_config();
+    log5 = (...args) => process.stderr.write(`[SolonGate] ${args.map(String).join(" ")}
+`);
+    main4();
+  }
+});
+
+// src/index.ts
+init_config();
 
 // src/proxy.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -3348,7 +3533,202 @@ var SolonGate = class {
 };
 
 // src/proxy.ts
-var log = (...args) => process.stderr.write(`[SolonGate] ${args.map(String).join(" ")}
+init_config();
+
+// src/sync.ts
+init_config();
+import { readFileSync as readFileSync2, writeFileSync, watch, existsSync as existsSync2 } from "fs";
+var log = (...args) => process.stderr.write(`[SolonGate Sync] ${args.map(String).join(" ")}
+`);
+var PolicySyncManager = class {
+  localPath;
+  apiKey;
+  apiUrl;
+  pollIntervalMs;
+  onPolicyUpdate;
+  currentPolicy;
+  localVersion;
+  cloudVersion;
+  skipNextWatch = false;
+  debounceTimer = null;
+  pollTimer = null;
+  watcher = null;
+  isLiveKey;
+  constructor(opts) {
+    this.localPath = opts.localPath;
+    this.apiKey = opts.apiKey;
+    this.apiUrl = opts.apiUrl;
+    this.pollIntervalMs = opts.pollIntervalMs ?? 6e4;
+    this.onPolicyUpdate = opts.onPolicyUpdate;
+    this.currentPolicy = opts.initialPolicy;
+    this.localVersion = opts.initialPolicy.version ?? 0;
+    this.cloudVersion = 0;
+    this.isLiveKey = opts.apiKey.startsWith("sg_live_");
+  }
+  /**
+   * Start watching local file and polling cloud.
+   */
+  start() {
+    if (this.localPath && existsSync2(this.localPath)) {
+      this.startFileWatcher();
+    }
+    if (this.isLiveKey) {
+      this.pushToCloud(this.currentPolicy).catch(() => {
+      });
+      this.startPolling();
+    }
+  }
+  /**
+   * Stop all watchers and timers.
+   */
+  stop() {
+    if (this.watcher) {
+      this.watcher.close();
+      this.watcher = null;
+    }
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer);
+      this.pollTimer = null;
+    }
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+      this.debounceTimer = null;
+    }
+  }
+  /**
+   * Watch local file for changes (debounced).
+   */
+  startFileWatcher() {
+    if (!this.localPath) return;
+    const filePath = this.localPath;
+    try {
+      this.watcher = watch(filePath, () => {
+        if (this.debounceTimer) clearTimeout(this.debounceTimer);
+        this.debounceTimer = setTimeout(() => this.onFileChange(filePath), 300);
+      });
+      log(`Watching ${filePath} for changes`);
+    } catch (err) {
+      log(`File watch failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  /**
+   * Handle local file change event.
+   */
+  async onFileChange(filePath) {
+    if (this.skipNextWatch) {
+      this.skipNextWatch = false;
+      return;
+    }
+    try {
+      if (!existsSync2(filePath)) {
+        log("Policy file deleted \u2014 keeping current policy");
+        return;
+      }
+      const content = readFileSync2(filePath, "utf-8");
+      const newPolicy = JSON.parse(content);
+      if (newPolicy.version <= this.localVersion) {
+        newPolicy.version = Math.max(this.localVersion, this.cloudVersion) + 1;
+        this.writeToFile(newPolicy);
+      }
+      if (this.policiesEqual(newPolicy, this.currentPolicy)) return;
+      log(`File changed: ${newPolicy.name} v${newPolicy.version}`);
+      this.localVersion = newPolicy.version;
+      this.currentPolicy = newPolicy;
+      this.onPolicyUpdate(newPolicy);
+      if (this.isLiveKey) {
+        try {
+          const result = await this.pushToCloud(newPolicy);
+          this.cloudVersion = result.version;
+          log(`Pushed to cloud: v${result.version}`);
+        } catch (err) {
+          log(`Cloud push failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+    } catch (err) {
+      log(`File read error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  /**
+   * Poll cloud for policy changes.
+   */
+  startPolling() {
+    this.pollTimer = setInterval(() => this.onPollTick(), this.pollIntervalMs);
+  }
+  /**
+   * Handle poll tick — fetch cloud policy and compare.
+   */
+  async onPollTick() {
+    try {
+      const cloudPolicy = await fetchCloudPolicy(this.apiKey, this.apiUrl);
+      const cloudVer = cloudPolicy.version ?? 0;
+      if (cloudVer <= this.localVersion && this.policiesEqual(cloudPolicy, this.currentPolicy)) {
+        return;
+      }
+      if (cloudVer > this.localVersion || !this.policiesEqual(cloudPolicy, this.currentPolicy)) {
+        log(`Cloud update: ${cloudPolicy.name} v${cloudVer} (was v${this.localVersion})`);
+        this.cloudVersion = cloudVer;
+        this.localVersion = cloudVer;
+        this.currentPolicy = cloudPolicy;
+        this.onPolicyUpdate(cloudPolicy);
+        if (this.localPath) {
+          this.writeToFile(cloudPolicy);
+          log(`Updated local file: ${this.localPath}`);
+        }
+      }
+    } catch {
+    }
+  }
+  /**
+   * Push policy to cloud API.
+   */
+  async pushToCloud(policy) {
+    const url = `${this.apiUrl}/api/v1/policies`;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        id: policy.id || "default",
+        name: policy.name || "Default Policy",
+        description: policy.description || "Synced from proxy",
+        version: policy.version || 1,
+        rules: policy.rules
+      })
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      throw new Error(`Push failed (${res.status}): ${body}`);
+    }
+    const data = await res.json();
+    return { version: Number(data._version ?? policy.version) };
+  }
+  /**
+   * Write policy to local file (with loop prevention).
+   */
+  writeToFile(policy) {
+    if (!this.localPath) return;
+    this.skipNextWatch = true;
+    try {
+      const json = JSON.stringify(policy, null, 2) + "\n";
+      writeFileSync(this.localPath, json, "utf-8");
+    } catch (err) {
+      log(`File write error: ${err instanceof Error ? err.message : String(err)}`);
+      this.skipNextWatch = false;
+    }
+  }
+  /**
+   * Compare two policies by rules content (ignoring timestamps).
+   */
+  policiesEqual(a, b) {
+    if (a.id !== b.id || a.name !== b.name || a.rules.length !== b.rules.length) return false;
+    return JSON.stringify(a.rules) === JSON.stringify(b.rules);
+  }
+};
+
+// src/proxy.ts
+var log2 = (...args) => process.stderr.write(`[SolonGate] ${args.map(String).join(" ")}
 `);
 var Mutex = class {
   queue = [];
@@ -3358,8 +3738,8 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve5) => {
-      this.queue.push(resolve5);
+    return new Promise((resolve6) => {
+      this.queue.push(resolve6);
     });
   }
   release() {
@@ -3377,6 +3757,7 @@ var SolonGateProxy = class {
   client = null;
   server = null;
   callMutex = new Mutex();
+  syncManager = null;
   upstreamTools = [];
   constructor(config) {
     this.config = config;
@@ -3393,20 +3774,20 @@ var SolonGateProxy = class {
     });
     const warnings = this.gate.getWarnings();
     for (const w of warnings) {
-      log("WARNING:", w);
+      log2("WARNING:", w);
     }
   }
   /**
    * Start the proxy: connect to upstream, then serve downstream.
    */
   async start() {
-    log("Starting SolonGate Proxy...");
+    log2("Starting SolonGate Proxy...");
     const apiUrl = this.config.apiUrl ?? "https://api.solongate.com";
     if (this.config.apiKey) {
       if (this.config.apiKey.startsWith("sg_test_")) {
-        log("Using test API key \u2014 skipping online validation.");
+        log2("Using test API key \u2014 skipping online validation.");
       } else {
-        log(`Validating license with ${apiUrl}...`);
+        log2(`Validating license with ${apiUrl}...`);
         try {
           const res = await fetch(`${apiUrl}/api/v1/auth/me`, {
             headers: {
@@ -3416,17 +3797,17 @@ var SolonGateProxy = class {
             signal: AbortSignal.timeout(1e4)
           });
           if (res.status === 401) {
-            log("ERROR: Invalid or expired API key.");
+            log2("ERROR: Invalid or expired API key.");
             process.exit(1);
           }
           if (res.status === 403) {
-            log("ERROR: Your subscription is inactive. Renew at https://solongate.com");
+            log2("ERROR: Your subscription is inactive. Renew at https://solongate.com");
             process.exit(1);
           }
-          log("License validated.");
+          log2("License validated.");
         } catch (err) {
-          log(`ERROR: Unable to reach SolonGate license server. Check your internet connection.`);
-          log(`Details: ${err instanceof Error ? err.message : String(err)}`);
+          log2(`ERROR: Unable to reach SolonGate license server. Check your internet connection.`);
+          log2(`Details: ${err instanceof Error ? err.message : String(err)}`);
           process.exit(1);
         }
       }
@@ -3434,28 +3815,27 @@ var SolonGateProxy = class {
         try {
           const cloudPolicy = await fetchCloudPolicy(this.config.apiKey, apiUrl);
           this.config.policy = cloudPolicy;
-          log(`Loaded cloud policy: ${cloudPolicy.name} (${cloudPolicy.rules.length} rules)`);
+          log2(`Loaded cloud policy: ${cloudPolicy.name} (${cloudPolicy.rules.length} rules)`);
         } catch (err) {
-          log(`Cloud policy fetch failed, using local policy: ${err instanceof Error ? err.message : String(err)}`);
+          log2(`Cloud policy fetch failed, using local policy: ${err instanceof Error ? err.message : String(err)}`);
         }
       }
     }
     this.gate.loadPolicy(this.config.policy);
-    log(`Policy: ${this.config.policy.name} (${this.config.policy.rules.length} rules)`);
+    log2(`Policy: ${this.config.policy.name} (${this.config.policy.rules.length} rules)`);
     const transport = this.config.upstream.transport ?? "stdio";
     if (transport === "stdio") {
-      log(`Upstream: [stdio] ${this.config.upstream.command} ${(this.config.upstream.args ?? []).join(" ")}`);
+      log2(`Upstream: [stdio] ${this.config.upstream.command} ${(this.config.upstream.args ?? []).join(" ")}`);
     } else {
-      log(`Upstream: [${transport}] ${this.config.upstream.url}`);
+      log2(`Upstream: [${transport}] ${this.config.upstream.url}`);
     }
     await this.connectUpstream();
     await this.discoverTools();
     this.registerToolsToCloud();
     this.registerServerToCloud();
-    this.syncPolicyToCloud();
+    this.startPolicySync();
     this.createServer();
     await this.serve();
-    this.startPolicyPolling();
   }
   /**
    * Connect to the upstream MCP server.
@@ -3493,7 +3873,7 @@ var SolonGateProxy = class {
         break;
       }
     }
-    log(`Connected to upstream server (${upstreamTransport})`);
+    log2(`Connected to upstream server (${upstreamTransport})`);
   }
   /**
    * Discover tools from the upstream server.
@@ -3506,9 +3886,9 @@ var SolonGateProxy = class {
       description: t.description,
       inputSchema: t.inputSchema
     }));
-    log(`Discovered ${this.upstreamTools.length} tools from upstream:`);
+    log2(`Discovered ${this.upstreamTools.length} tools from upstream:`);
     for (const tool of this.upstreamTools) {
-      log(`  - ${tool.name}: ${tool.description ?? "(no description)"}`);
+      log2(`  - ${tool.name}: ${tool.description ?? "(no description)"}`);
     }
   }
   /**
@@ -3537,13 +3917,13 @@ var SolonGateProxy = class {
       const { name, arguments: args } = request.params;
       const argsSize = JSON.stringify(args ?? {}).length;
       if (argsSize > MAX_ARGUMENT_SIZE) {
-        log(`DENY: ${name} \u2014 payload size ${argsSize} exceeds limit ${MAX_ARGUMENT_SIZE}`);
+        log2(`DENY: ${name} \u2014 payload size ${argsSize} exceeds limit ${MAX_ARGUMENT_SIZE}`);
         return {
           content: [{ type: "text", text: `Request payload too large (${Math.round(argsSize / 1024)}KB > ${Math.round(MAX_ARGUMENT_SIZE / 1024)}KB limit)` }],
           isError: true
         };
       }
-      log(`Tool call: ${name}`);
+      log2(`Tool call: ${name}`);
       await this.callMutex.acquire();
       const startTime = Date.now();
       try {
@@ -3560,10 +3940,10 @@ var SolonGateProxy = class {
         );
         const decision = result.isError ? "DENY" : "ALLOW";
         const evaluationTimeMs = Date.now() - startTime;
-        log(`Result: ${decision} (${evaluationTimeMs}ms)`);
+        log2(`Result: ${decision} (${evaluationTimeMs}ms)`);
         if (this.config.apiKey && !this.config.apiKey.startsWith("sg_test_")) {
           const apiUrl = this.config.apiUrl ?? "https://api.solongate.com";
-          log(`Sending audit log: ${name} \u2192 ${decision} (key: ${this.config.apiKey.slice(0, 16)}...)`);
+          log2(`Sending audit log: ${name} \u2192 ${decision} (key: ${this.config.apiKey.slice(0, 16)}...)`);
           let reason = "allowed";
           let matchedRule;
           if (result.isError) {
@@ -3586,7 +3966,7 @@ var SolonGateProxy = class {
             evaluationTimeMs
           });
         } else {
-          log(`Skipping audit log (apiKey: ${this.config.apiKey ? "test key" : "not set"})`);
+          log2(`Skipping audit log (apiKey: ${this.config.apiKey ? "test key" : "not set"})`);
         }
         return {
           content: [...result.content],
@@ -3660,13 +4040,13 @@ var SolonGateProxy = class {
           registered++;
         } else {
           const body = await res.text().catch(() => "");
-          log(`Tool registration failed for "${tool.name}" (${res.status}): ${body}`);
+          log2(`Tool registration failed for "${tool.name}" (${res.status}): ${body}`);
         }
       }).catch((err) => {
-        log(`Tool registration error for "${tool.name}": ${err instanceof Error ? err.message : String(err)}`);
+        log2(`Tool registration error for "${tool.name}": ${err instanceof Error ? err.message : String(err)}`);
       });
     }
-    log(`Registering ${total} tools to dashboard...`);
+    log2(`Registering ${total} tools to dashboard...`);
   }
   /**
    * Guess tool permissions from tool name.
@@ -3720,68 +4100,42 @@ var SolonGateProxy = class {
       })
     }).then(async (res) => {
       if (res.ok) {
-        log(`Registered MCP server "${serverName}" to dashboard.`);
+        log2(`Registered MCP server "${serverName}" to dashboard.`);
       } else if (res.status === 409) {
-        log(`MCP server "${serverName}" already registered.`);
+        log2(`MCP server "${serverName}" already registered.`);
       } else {
         const body = await res.text().catch(() => "");
-        log(`MCP server registration failed (${res.status}): ${body}`);
+        log2(`MCP server registration failed (${res.status}): ${body}`);
       }
     }).catch((err) => {
-      log(`MCP server registration error: ${err instanceof Error ? err.message : String(err)}`);
+      log2(`MCP server registration error: ${err instanceof Error ? err.message : String(err)}`);
     });
   }
   /**
-   * Sync the active policy to the SolonGate Cloud API.
-   * This makes it visible on the Dashboard Policies page.
+   * Start bidirectional policy sync between local JSON file and cloud dashboard.
+   *
+   * - Watches local policy.json for changes → pushes to cloud API
+   * - Polls cloud API for dashboard changes → writes to local policy.json
+   * - Version number determines which is newer (higher wins, cloud wins on tie)
    */
-  syncPolicyToCloud() {
-    if (!this.config.apiKey || this.config.apiKey.startsWith("sg_test_")) return;
+  startPolicySync() {
+    const apiKey = this.config.apiKey;
+    if (!apiKey) return;
     const apiUrl = this.config.apiUrl ?? "https://api.solongate.com";
-    const policy = this.config.policy;
-    fetch(`${apiUrl}/api/v1/policies`, {
-      method: "POST",
-      headers: {
-        "Authorization": `Bearer ${this.config.apiKey}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        id: policy.id || "default",
-        name: policy.name || "Default Policy",
-        description: policy.description || `Policy synced from proxy`,
-        version: policy.version || 1,
-        rules: policy.rules
-      })
-    }).then(async (res) => {
-      if (res.ok) {
-        log(`Synced policy "${policy.name}" to dashboard.`);
-      } else {
-        const body = await res.text().catch(() => "");
-        log(`Policy sync failed (${res.status}): ${body}`);
+    this.syncManager = new PolicySyncManager({
+      localPath: this.config.policyPath ?? null,
+      apiKey,
+      apiUrl,
+      pollIntervalMs: 6e4,
+      initialPolicy: this.config.policy,
+      onPolicyUpdate: (policy) => {
+        this.config.policy = policy;
+        this.gate.loadPolicy(policy);
+        log2(`Policy hot-reloaded: ${policy.name} v${policy.version} (${policy.rules.length} rules)`);
       }
-    }).catch((err) => {
-      log(`Policy sync error: ${err instanceof Error ? err.message : String(err)}`);
     });
-  }
-  /**
-   * Poll for policy updates from dashboard every 60 seconds.
-   * When user changes policy in dashboard, proxy picks it up automatically.
-   */
-  startPolicyPolling() {
-    if (!this.config.apiKey || this.config.apiKey.startsWith("sg_test_")) return;
-    const apiUrl = this.config.apiUrl ?? "https://api.solongate.com";
-    const POLL_INTERVAL = 6e4;
-    setInterval(async () => {
-      try {
-        const newPolicy = await fetchCloudPolicy(this.config.apiKey, apiUrl);
-        if (newPolicy.version !== this.config.policy.version || newPolicy.rules.length !== this.config.policy.rules.length) {
-          this.config.policy = newPolicy;
-          this.gate.loadPolicy(newPolicy);
-          log(`Policy updated from dashboard: ${newPolicy.name} v${newPolicy.version} (${newPolicy.rules.length} rules)`);
-        }
-      } catch {
-      }
-    }, POLL_INTERVAL);
+    this.syncManager.start();
+    log2("Bidirectional policy sync started.");
   }
   /**
    * Start serving downstream.
@@ -3807,14 +4161,14 @@ var SolonGateProxy = class {
         }
       });
       httpServer.listen(this.config.port, () => {
-        log(`Proxy is live on http://localhost:${this.config.port}/mcp`);
-        log("All tool calls are now protected by SolonGate.");
+        log2(`Proxy is live on http://localhost:${this.config.port}/mcp`);
+        log2("All tool calls are now protected by SolonGate.");
       });
     } else {
       const transport = new StdioServerTransport();
       await this.server.connect(transport);
-      log("Proxy is live. All tool calls are now protected by SolonGate.");
-      log("Waiting for requests...");
+      log2("Proxy is live. All tool calls are now protected by SolonGate.");
+      log2("Waiting for requests...");
     }
   }
 };
@@ -3832,7 +4186,7 @@ console.error = (...args) => {
   process.stderr.write(`[SolonGate ERROR] ${args.map(String).join(" ")}
 `);
 };
-async function main4() {
+async function main5() {
   const subcommand = process.argv[2];
   if (subcommand === "init") {
     process.argv.splice(2, 1);
@@ -3849,6 +4203,10 @@ async function main4() {
     await Promise.resolve().then(() => (init_create(), create_exports));
     return;
   }
+  if (subcommand === "pull" || subcommand === "push") {
+    await Promise.resolve().then(() => (init_pull_push(), pull_push_exports));
+    return;
+  }
   try {
     const config = parseArgs(process.argv);
     const proxy = new SolonGateProxy(config);
@@ -3860,4 +4218,4 @@ async function main4() {
     process.exit(1);
   }
 }
-main4();
+main5();