@solongate/proxy 0.49.1 → 0.51.0

package/dist/init.js

@@ -1,910 +0,0 @@
-#!/usr/bin/env node
-
-// src/init.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { resolve as resolve2, join as join2, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { execFileSync as execFileSync2 } from "child_process";
-import { createInterface as createInterface2 } from "readline";
-
-// src/cli-utils.ts
-var c = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  italic: "\x1B[3m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m",
-  blue1: "\x1B[38;2;20;50;160m",
-  blue2: "\x1B[38;2;40;80;190m",
-  blue3: "\x1B[38;2;60;110;215m",
-  blue4: "\x1B[38;2;90;140;230m",
-  blue5: "\x1B[38;2;130;170;240m",
-  blue6: "\x1B[38;2;170;200;250m",
-  green: "\x1B[38;2;80;200;120m",
-  red: "\x1B[38;2;220;80;80m",
-  cyan: "\x1B[38;2;100;200;220m",
-  yellow: "\x1B[38;2;220;200;80m",
-  bgBlue: "\x1B[48;2;20;50;160m"
-};
-var BANNER_FULL = [
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  ",
-  " \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  ",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
-];
-var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
-
-// src/global-install.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
-import { resolve, join, dirname } from "path";
-import { homedir } from "os";
-import { fileURLToPath } from "url";
-import { createInterface } from "readline";
-import { execFileSync } from "child_process";
-var __dirname = dirname(fileURLToPath(import.meta.url));
-var HOOKS_DIR = resolve(__dirname, "..", "hooks");
-function lockFile(file) {
-  if (!existsSync(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join(p.hooksDir, "guard.mjs"),
-    join(p.hooksDir, "audit.mjs"),
-    join(p.hooksDir, "stop.mjs"),
-    p.configPath,
-    p.settingsPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir();
-  const sgDir = join(home, ".solongate");
-  const hooksDir = join(sgDir, "hooks");
-  const claudeDir = join(home, ".claude");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    settingsPath: join(claudeDir, "settings.json"),
-    backupPath: join(claudeDir, "settings.solongate.bak"),
-    configPath: join(sgDir, "cloud-guard.json")
-  };
-}
-function readHook(filename) {
-  return readFileSync(join(HOOKS_DIR, filename), "utf-8");
-}
-function readGuard() {
-  const bundled = join(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync(bundled) ? readFileSync(bundled, "utf-8") : readHook("guard.mjs");
-}
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => rl.question(question, (a) => {
-    rl.close();
-    res(a.trim());
-  }));
-}
-function runGlobalRestore() {
-  const p = globalPaths();
-  unlockProtected();
-  if (existsSync(p.backupPath)) {
-    writeFileSync(p.settingsPath, readFileSync(p.backupPath, "utf-8"));
-    console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync(p.settingsPath)) {
-    try {
-      const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
-      delete s.hooks;
-      writeFileSync(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-      console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
-    } catch {
-    }
-  } else {
-    console.log("  Nothing to restore \u2014 no global Claude Code settings found.");
-  }
-  console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
-}
-async function runGlobalInstall(opts = {}) {
-  const p = globalPaths();
-  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    try {
-      const cfg = JSON.parse(readFileSync(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
-    } catch {
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync(p.hooksDir, { recursive: true });
-  mkdirSync(p.claudeDir, { recursive: true });
-  unlockProtected();
-  writeFileSync(join(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync(join(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-  console.log(`  Wrote ${p.configPath}`);
-  let existing = {};
-  if (existsSync(p.settingsPath)) {
-    const raw = readFileSync(p.settingsPath, "utf-8");
-    if (!existsSync(p.backupPath)) {
-      writeFileSync(p.backupPath, raw);
-      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
-    }
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const guardAbs = join(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const merged = {
-    ...existing,
-    hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: `"${nodeBin}" "${guardAbs}" claude-code "Claude Code"` }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: `"${nodeBin}" "${auditAbs}" claude-code "Claude Code"` }] }],
-      Stop: [{ matcher: "", hooks: [{ type: "command", command: `"${nodeBin}" "${stopAbs}" claude-code "Claude Code"` }] }]
-    }
-  };
-  writeFileSync(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
-    lockProtected();
-    console.log("  Locked protection files (OS-level read-only/immutable).");
-  }
-}
-
-// src/init.ts
-var SEARCH_PATHS = [
-  ".mcp.json",
-  "mcp.json",
-  ".claude/mcp.json"
-];
-var CLAUDE_DESKTOP_PATHS = process.platform === "win32" ? [join2(process.env["APPDATA"] ?? "", "Claude", "claude_desktop_config.json")] : process.platform === "darwin" ? [join2(process.env["HOME"] ?? "", "Library", "Application Support", "Claude", "claude_desktop_config.json")] : [join2(process.env["HOME"] ?? "", ".config", "claude", "claude_desktop_config.json")];
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var spinnerInterval = null;
-var spinnerFrame = 0;
-function startSpinner(message) {
-  spinnerFrame = 0;
-  process.stderr.write(`  ${SPINNER_FRAMES[0]} ${message}`);
-  spinnerInterval = setInterval(() => {
-    spinnerFrame = (spinnerFrame + 1) % SPINNER_FRAMES.length;
-    process.stderr.write(`\r  ${SPINNER_FRAMES[spinnerFrame]} ${message}`);
-  }, 80);
-}
-function stopSpinner(result) {
-  if (spinnerInterval) {
-    clearInterval(spinnerInterval);
-    spinnerInterval = null;
-  }
-  process.stderr.write(`\r  ${result}
-`);
-}
-function findConfigFile(explicitPath, createIfMissing = false) {
-  if (explicitPath) {
-    if (existsSync2(explicitPath)) {
-      return { path: resolve2(explicitPath), type: "mcp" };
-    }
-    return null;
-  }
-  for (const searchPath of SEARCH_PATHS) {
-    const full = resolve2(searchPath);
-    if (existsSync2(full)) return { path: full, type: "mcp" };
-  }
-  if (createIfMissing) {
-    const starterConfig = {
-      mcpServers: {
-        "filesystem": {
-          command: "npx",
-          args: ["-y", "@modelcontextprotocol/server-filesystem@latest", "."]
-        },
-        "playwright": {
-          command: "npx",
-          args: ["-y", "@playwright/mcp@latest"]
-        }
-      }
-    };
-    const starterPath = resolve2(".mcp.json");
-    writeFileSync2(starterPath, JSON.stringify(starterConfig, null, 2) + "\n");
-    console.log("  Created .mcp.json with starter servers (filesystem, playwright).");
-    console.log("");
-    return { path: starterPath, type: "mcp", created: true };
-  }
-  for (const desktopPath of CLAUDE_DESKTOP_PATHS) {
-    if (existsSync2(desktopPath)) return { path: desktopPath, type: "claude-desktop" };
-  }
-  return null;
-}
-function readConfig(filePath) {
-  const content = readFileSync2(filePath, "utf-8");
-  const parsed = JSON.parse(content);
-  if (parsed.mcpServers) return parsed;
-  throw new Error(`Unrecognized config format in ${filePath}`);
-}
-function isAlreadyProtected(server) {
-  const args = server.args ?? [];
-  if (server.command === "solongate-proxy") return true;
-  if (server.command === "@solongate/proxy") return true;
-  for (const arg of args) {
-    if (arg === "-y" || arg === "--yes") continue;
-    if (arg === "@solongate/proxy" || arg === "@solongate/proxy@latest" || arg === "solongate-proxy") return true;
-    if (/[/\\]packages[/\\]proxy[/\\]dist[/\\]index\.js$/.test(arg)) return true;
-    break;
-  }
-  return false;
-}
-function wrapServer(serverName, server, policy, agentName) {
-  const env = { ...server.env ?? {} };
-  env.SOLONGATE_API_KEY = "${SOLONGATE_API_KEY}";
-  const proxyArgs = ["-y", "@solongate/proxy@latest"];
-  if (policy) {
-    proxyArgs.push("--policy", policy);
-  }
-  if (agentName) {
-    proxyArgs.push("--agent-name", agentName);
-  }
-  proxyArgs.push("--verbose", "--", server.command, ...server.args ?? []);
-  return {
-    command: "npx",
-    args: proxyArgs,
-    env
-  };
-}
-async function prompt(question) {
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      res(answer.trim());
-    });
-  });
-}
-function parseInitArgs(argv) {
-  const args = argv.slice(2);
-  const options = {
-    all: false,
-    tools: [],
-    global: false,
-    restore: false
-  };
-  for (let i = 0; i < args.length; i++) {
-    switch (args[i]) {
-      case "--config":
-        options.configPath = args[++i];
-        break;
-      case "--policy":
-        options.policy = args[++i];
-        break;
-      case "--api-key":
-        options.apiKey = args[++i];
-        break;
-      case "--all":
-        options.all = true;
-        break;
-      case "--global":
-      case "-g":
-        options.global = true;
-        break;
-      case "--restore":
-      case "--uninstall":
-        options.restore = true;
-        break;
-      case "--claude-code":
-        options.tools.push("claude-code");
-        break;
-      case "--gemini":
-        options.tools.push("gemini");
-        break;
-      case "--help":
-      case "-h":
-        printHelp();
-        process.exit(0);
-    }
-  }
-  return options;
-}
-function printHelp() {
-  const help = `
-SolonGate Init \u2014 Protect your MCP servers in seconds
-
-USAGE
-  npx @solongate/proxy init --all
-  npx @solongate/proxy init --global          # system-wide (every project)
-
-OPTIONS
-  --config <path>     Path to MCP config file (default: auto-detect)
-  --policy <file>     Custom policy JSON file (auto-detects policy.json)
-  --api-key <key>     SolonGate API key (sg_live_... or sg_test_...)
-  --all               Protect all servers without prompting
-  --global, -g        Install a SYSTEM-WIDE Claude Code hook (~/.claude) that
-                      guards EVERY session on the machine with your cloud
-                      policy (OPA WASM) \u2014 like the air-gapped product.
-  --restore           With --global: undo the system-wide install.
-  -h, --help          Show this help message
-
-AI TOOL HOOKS (default: all)
-  --claude-code       Install hooks for Claude Code
-  --gemini            Install hooks for Gemini CLI
-
-EXAMPLES
-  npx @solongate/proxy init --all                          # Protect everything, all tools
-  npx @solongate/proxy init --all --claude-code            # Only Claude Code hooks
-  npx @solongate/proxy init --all --policy policy.json     # With custom policy
-  npx @solongate/proxy init --global --api-key sg_live_\u2026   # System-wide enforcement
-  npx @solongate/proxy init --global --restore             # Undo system-wide install
-`;
-  console.log(help);
-}
-var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-var HOOKS_DIR2 = resolve2(__dirname2, "..", "hooks");
-function readHookScript(filename) {
-  return readFileSync2(join2(HOOKS_DIR2, filename), "utf-8");
-}
-function readGuardForGlobal() {
-  const bundled = join2(HOOKS_DIR2, "guard.bundled.mjs");
-  if (existsSync2(bundled)) return readFileSync2(bundled, "utf-8");
-  return readFileSync2(join2(HOOKS_DIR2, "guard.mjs"), "utf-8");
-}
-function unlockProtectedDirs() {
-  const dirs = [".solongate", ".claude", ".gemini"];
-  for (const dir of dirs) {
-    const fullDir = resolve2(dir);
-    if (!existsSync2(fullDir)) continue;
-    try {
-      if (process.platform === "win32") {
-        try {
-          execFileSync2("icacls", [fullDir, "/remove:d", "*S-1-1-0", "/T", "/Q"], { stdio: "ignore" });
-        } catch {
-        }
-        try {
-          execFileSync2("attrib", ["-R", "/S", "/D", fullDir], { stdio: "ignore" });
-        } catch {
-        }
-      } else {
-        try {
-          execFileSync2("chattr", ["-i", "-R", fullDir], { stdio: "ignore" });
-        } catch {
-        }
-        execFileSync2("chmod", ["-R", "u+w", fullDir], { stdio: "ignore" });
-      }
-    } catch {
-    }
-  }
-  const protectedFiles = [".env", ".gitignore", ".mcp.json", "policy.json"];
-  for (const file of protectedFiles) {
-    const fullPath = resolve2(file);
-    if (!existsSync2(fullPath)) continue;
-    try {
-      if (process.platform === "win32") {
-        try {
-          execFileSync2("icacls", [fullPath, "/remove:d", "*S-1-1-0", "/Q"], { stdio: "ignore" });
-        } catch {
-        }
-        try {
-          execFileSync2("attrib", ["-R", fullPath], { stdio: "ignore" });
-        } catch {
-        }
-      } else {
-        try {
-          execFileSync2("chattr", ["-i", fullPath], { stdio: "ignore" });
-        } catch {
-        }
-        execFileSync2("chmod", ["u+w", fullPath], { stdio: "ignore" });
-      }
-    } catch {
-    }
-  }
-}
-function installHooks(selectedTools = [], wrappedMcpConfig) {
-  unlockProtectedDirs();
-  const hooksDir = resolve2(".solongate", "hooks");
-  mkdirSync2(hooksDir, { recursive: true });
-  const hookFiles = ["guard.mjs", "audit.mjs", "stop.mjs"];
-  let hooksUpdated = 0;
-  let hooksSkipped = 0;
-  for (const filename of hookFiles) {
-    const hookPath = join2(hooksDir, filename);
-    const latest = filename === "guard.mjs" ? readGuardForGlobal() : readHookScript(filename);
-    let needsWrite = true;
-    if (existsSync2(hookPath)) {
-      const current = readFileSync2(hookPath, "utf-8");
-      if (current === latest) {
-        needsWrite = false;
-        hooksSkipped++;
-      }
-    }
-    if (needsWrite) {
-      writeFileSync2(hookPath, latest);
-      hooksUpdated++;
-      console.log(`  ${existsSync2(hookPath) ? "Updated" : "Created"} ${hookPath}`);
-    }
-  }
-  if (hooksSkipped > 0 && hooksUpdated === 0) {
-    console.log(`  Hook files already up to date`);
-  }
-  const allClients = [
-    { name: "Claude Code", dir: ".claude", key: "claude-code", agentId: "claude-code", agentName: "Claude Code" },
-    { name: "Gemini CLI", dir: ".gemini", key: "gemini", agentId: "gemini-cli", agentName: "Gemini CLI" }
-  ];
-  const clients = selectedTools.length > 0 ? allClients.filter((c2) => selectedTools.includes(c2.key)) : allClients;
-  const activatedNames = [];
-  const skippedNames = [];
-  for (const client of clients) {
-    const clientDir = resolve2(client.dir);
-    mkdirSync2(clientDir, { recursive: true });
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const guardCmd = `"${nodeBin}" .solongate/hooks/guard.mjs ${client.agentId} "${client.agentName}"`;
-    const auditCmd = `"${nodeBin}" .solongate/hooks/audit.mjs ${client.agentId} "${client.agentName}"`;
-    const stopCmd = `"${nodeBin}" .solongate/hooks/stop.mjs ${client.agentId} "${client.agentName}"`;
-    if (client.key === "gemini") {
-      const result = installGeminiConfig(clientDir, guardCmd, auditCmd, stopCmd, wrappedMcpConfig);
-      if (result === "skipped") skippedNames.push(client.name);
-      else activatedNames.push(client.name);
-    } else {
-      const result = installStandardHookConfig(clientDir, client.name, guardCmd, auditCmd, stopCmd);
-      if (result === "skipped") skippedNames.push(client.name);
-      else activatedNames.push(client.name);
-    }
-  }
-  console.log("");
-  if (activatedNames.length > 0) {
-    console.log("  Hooks installed:");
-    console.log("  guard.mjs  \u2192 blocks policy-violating calls (pre-execution)");
-    console.log("  audit.mjs  \u2192 logs all calls to dashboard (post-execution)");
-    console.log("  stop.mjs   \u2192 tracks text-only responses (no tool calls)");
-    console.log(`  Activated for: ${activatedNames.join(", ")}`);
-  }
-  if (skippedNames.length > 0) {
-    console.log(`  Already configured: ${skippedNames.join(", ")}`);
-  }
-}
-function installStandardHookConfig(clientDir, clientName, guardCmd, auditCmd, stopCmd) {
-  const settingsPath = join2(clientDir, "settings.json");
-  const hookSettings = {
-    PreToolUse: [
-      { matcher: "", hooks: [{ type: "command", command: guardCmd }] }
-    ],
-    PostToolUse: [
-      { matcher: "", hooks: [{ type: "command", command: auditCmd }] }
-    ],
-    Stop: [
-      { matcher: "", hooks: [{ type: "command", command: stopCmd }] }
-    ]
-  };
-  let existing = {};
-  try {
-    existing = JSON.parse(readFileSync2(settingsPath, "utf-8"));
-  } catch {
-  }
-  const merged = { ...existing, hooks: hookSettings };
-  const mergedStr = JSON.stringify(merged, null, 2) + "\n";
-  const existingStr = existsSync2(settingsPath) ? readFileSync2(settingsPath, "utf-8") : "";
-  if (mergedStr === existingStr) return "skipped";
-  writeFileSync2(settingsPath, mergedStr);
-  console.log(`  ${existingStr ? "Updated" : "Created"} ${settingsPath}`);
-  return "installed";
-}
-function installGeminiConfig(clientDir, guardCmd, auditCmd, _stopCmd, wrappedMcpConfig) {
-  const settingsPath = join2(clientDir, "settings.json");
-  let existing = {};
-  try {
-    existing = JSON.parse(readFileSync2(settingsPath, "utf-8"));
-  } catch {
-  }
-  const merged = { ...existing };
-  if (wrappedMcpConfig) {
-    const geminiMcp = {};
-    for (const [name, server] of Object.entries(wrappedMcpConfig.mcpServers)) {
-      const args = [...server.args ?? []];
-      const agentIdx = args.indexOf("--agent-name");
-      if (agentIdx >= 0 && agentIdx + 1 < args.length) {
-        args[agentIdx + 1] = "gemini-cli";
-      } else {
-        const sepIdx = args.indexOf("--");
-        if (sepIdx >= 0) args.splice(sepIdx, 0, "--agent-name", "gemini-cli");
-      }
-      geminiMcp[name] = { ...server, args };
-    }
-    merged.mcpServers = geminiMcp;
-  }
-  merged.hooks = {
-    BeforeTool: [
-      { matcher: ".*", hooks: [{ type: "command", command: guardCmd }] }
-    ],
-    AfterTool: [
-      { matcher: ".*", hooks: [{ type: "command", command: auditCmd }] }
-    ]
-  };
-  const mergedStr = JSON.stringify(merged, null, 2) + "\n";
-  const existingStr = existsSync2(settingsPath) ? readFileSync2(settingsPath, "utf-8") : "";
-  if (mergedStr === existingStr) return "skipped";
-  writeFileSync2(settingsPath, mergedStr);
-  console.log(`  ${existingStr ? "Updated" : "Created"} ${settingsPath}`);
-  return "installed";
-}
-function ensureEnvFile() {
-  let envChanged = false;
-  let gitignoreChanged = false;
-  const envPath = resolve2(".env");
-  if (!existsSync2(envPath)) {
-    const envContent = `# SolonGate Configuration
-# IMPORTANT: Never commit this file to git!
-
-# Your SolonGate API key \u2014 get one at https://dashboard.solongate.com
-SOLONGATE_API_KEY=sg_live_your_key_here
-
-# AI Judge (semantic security layer) \u2014 get a free key at https://console.groq.com/keys
-# Enable with: npx @solongate/proxy --ai-judge ...
-GROQ_API_KEY=gsk_your_groq_key_here
-`;
-    writeFileSync2(envPath, envContent);
-    console.log(`  Created .env`);
-    console.log(`  \u2192 Set your API key in .env (get one at https://dashboard.solongate.com)`);
-    envChanged = true;
-  } else {
-    const existingEnv = readFileSync2(envPath, "utf-8");
-    if (!existingEnv.includes("SOLONGATE_API_KEY")) {
-      const separator = existingEnv.endsWith("\n") ? "" : "\n";
-      const appendContent = `${separator}
-# SolonGate API key \u2014 get one at https://dashboard.solongate.com
-SOLONGATE_API_KEY=sg_live_your_key_here
-`;
-      writeFileSync2(envPath, existingEnv + appendContent);
-      console.log(`  Updated .env (added SOLONGATE_API_KEY)`);
-      console.log(`  \u2192 Set your API key in .env (get one at https://dashboard.solongate.com)`);
-      envChanged = true;
-    }
-  }
-  const gitignorePath = resolve2(".gitignore");
-  const requiredLines = [
-    ".env",
-    ".env.local",
-    ".mcp.json",
-    ".solongate/**",
-    ".claude/**",
-    ".gemini/**"
-  ];
-  if (existsSync2(gitignorePath)) {
-    let gitignore = readFileSync2(gitignorePath, "utf-8");
-    const existingLines = new Set(gitignore.split("\n").map((l) => l.trim()));
-    const missing = requiredLines.filter((line) => !existingLines.has(line));
-    if (missing.length > 0) {
-      gitignore = gitignore.trimEnd() + "\n\n# SolonGate\n" + missing.join("\n") + "\n";
-      writeFileSync2(gitignorePath, gitignore);
-      console.log(`  Updated .gitignore (+${missing.length} entries)`);
-      gitignoreChanged = true;
-    }
-  } else {
-    const content = "# SolonGate\n" + requiredLines.join("\n") + "\nnode_modules/\n";
-    writeFileSync2(gitignorePath, content);
-    console.log(`  Created .gitignore`);
-    gitignoreChanged = true;
-  }
-  if (!envChanged && !gitignoreChanged) {
-    console.log(`  .env and .gitignore already up to date`);
-  }
-  return { envChanged, gitignoreChanged };
-}
-async function main() {
-  const options = parseInitArgs(process.argv);
-  if (options.global) {
-    console.log("");
-    console.log(`  ${c.bold}SolonGate \u2014 Global Install${c.reset}`);
-    console.log("");
-    if (options.restore) {
-      runGlobalRestore();
-    } else {
-      await runGlobalInstall({ apiKey: options.apiKey });
-      console.log("");
-      console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-      console.log("  \u2502  Global enforcement active.                     \u2502");
-      console.log("  \u2502  Every Claude Code session on this machine is   \u2502");
-      console.log("  \u2502  now guarded by your cloud policy (OPA WASM).   \u2502");
-      console.log("  \u2502                                                 \u2502");
-      console.log("  \u2502  Undo:  init --global --restore                 \u2502");
-      console.log("  \u2502  Logs:  https://dashboard.solongate.com         \u2502");
-      console.log("  \u2502  Restart Claude Code to apply.                  \u2502");
-      console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-    }
-    console.log("");
-    return;
-  }
-  const fullBanner = BANNER_FULL;
-  const mediumBanner = [
-    " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557",
-    " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551",
-    " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551",
-    " \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551",
-    " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551",
-    " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D",
-    "          \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-    "         \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
-    "         \u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  ",
-    "         \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  ",
-    "         \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-    "          \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
-  ];
-  const smallBanner = [
-    " \u250F\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513",
-    " \u2503   \u2554\u2550\u2557\u2554\u2550\u2557\u2566  \u2554\u2550\u2557\u2554\u2557\u2554\u2554\u2550\u2557    \u2503",
-    " \u2503   \u255A\u2550\u2557\u2551 \u2551\u2551  \u2551 \u2551\u2551\u2551\u2551\u2551 \u2566    \u2503",
-    " \u2503   \u255A\u2550\u255D\u255A\u2550\u255D\u2569\u2550\u255D\u255A\u2550\u255D\u255D\u255A\u255D\u255A\u2550\u255D   \u2503",
-    " \u2503      \u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2566\u2557\u2554\u2550\u2557       \u2503",
-    " \u2503      \u2551 \u2566\u2560\u2550\u2563 \u2551 \u2551\u2563        \u2503",
-    " \u2503      \u255A\u2550\u255D\u2569 \u2569 \u2569 \u255A\u2550\u255D       \u2503",
-    " \u2517\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u251B"
-  ];
-  const cols = process.stdout.columns || 80;
-  const bannerLines = cols >= 82 ? fullBanner : cols >= 50 ? mediumBanner : smallBanner;
-  const bannerColors = BANNER_COLORS;
-  console.log("");
-  for (let i = 0; i < bannerLines.length; i++) {
-    console.log(`${c.bold}${bannerColors[i % bannerColors.length]}${bannerLines[i]}${c.reset}`);
-  }
-  console.log("");
-  console.log(`  ${c.dim}${c.italic}Init Setup${c.reset}`);
-  console.log("");
-  startSpinner("Scanning for MCP config...");
-  await sleep(400);
-  const configInfo = findConfigFile(options.configPath, true);
-  if (!configInfo) {
-    stopSpinner("\u2717 No MCP config found and could not create one.");
-    process.exit(1);
-  }
-  stopSpinner(`\u2713 Found config: ${configInfo.path}`);
-  console.log(`  Type:   ${configInfo.type === "claude-desktop" ? "Claude Desktop" : "MCP JSON"}`);
-  console.log("");
-  const config = readConfig(configInfo.path);
-  const serverNames = Object.keys(config.mcpServers);
-  if (serverNames.length === 0) {
-    console.log("  No MCP servers found in config.");
-    process.exit(1);
-  }
-  startSpinner("Analyzing servers...");
-  await sleep(300);
-  const toProtect = [];
-  const alreadyProtected = [];
-  const skipped = [];
-  for (const name of serverNames) {
-    const server = config.mcpServers[name];
-    if (isAlreadyProtected(server)) {
-      alreadyProtected.push(name);
-    } else {
-      if (options.all) {
-        toProtect.push(name);
-      }
-    }
-  }
-  stopSpinner(`\u2713 Found ${serverNames.length} MCP server(s)`);
-  console.log("");
-  for (const name of serverNames) {
-    const server = config.mcpServers[name];
-    if (alreadyProtected.includes(name)) {
-      console.log(`    [protected] ${name}`);
-    } else {
-      console.log(`    [exposed]   ${name} \u2192 ${server.command} ${(server.args ?? []).join(" ")}`);
-    }
-  }
-  console.log("");
-  if (alreadyProtected.length === serverNames.length) {
-    console.log("  All servers are already protected by SolonGate!");
-    ensureEnvFile();
-    console.log("");
-    installHooks(options.tools, config);
-    process.exit(0);
-  }
-  if (!options.all) {
-    const exposed = serverNames.filter((n) => !alreadyProtected.includes(n));
-    for (const name of exposed) {
-      const answer = await prompt(`  Protect "${name}"? [Y/n] `);
-      if (answer === "" || answer.toLowerCase() === "y" || answer.toLowerCase() === "yes") {
-        toProtect.push(name);
-      } else {
-        skipped.push(name);
-      }
-    }
-  }
-  if (toProtect.length === 0) {
-    console.log("  No servers selected for protection.");
-    ensureEnvFile();
-    process.exit(0);
-  }
-  console.log("");
-  startSpinner("Setting up environment...");
-  await sleep(300);
-  stopSpinner("\u2713 Environment");
-  ensureEnvFile();
-  console.log("");
-  let apiKey = options.apiKey || process.env.SOLONGATE_API_KEY || "";
-  if (!apiKey) {
-    const envPath = resolve2(".env");
-    if (existsSync2(envPath)) {
-      const envContent = readFileSync2(envPath, "utf-8");
-      const match = envContent.match(/^SOLONGATE_API_KEY=(sg_(?:live|test)_\w+)/m);
-      if (match) apiKey = match[1];
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    if (options.all) {
-      apiKey = "sg_test_demo_init_key";
-      console.log("  No API key found \u2014 using demo test key.");
-      console.log("  Set your real key in .env for cloud features.");
-      console.log("");
-    } else {
-      apiKey = await prompt("  Enter your SolonGate API key (from https://dashboard.solongate.com): ");
-    }
-    if (!apiKey) {
-      console.log("  API key is required. Get one at https://dashboard.solongate.com");
-      process.exit(1);
-    }
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key format. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  let policyValue;
-  if (options.policy) {
-    const policyPath = resolve2(options.policy);
-    if (existsSync2(policyPath)) {
-      policyValue = `./${options.policy}`;
-      console.log(`  Policy:  ${policyPath}`);
-    } else {
-      console.log(`  Policy file not found: ${options.policy}`);
-      process.exit(1);
-    }
-  } else {
-    const defaultPolicy = resolve2("policy.json");
-    if (existsSync2(defaultPolicy)) {
-      policyValue = "./policy.json";
-      console.log(`  Policy:  ${defaultPolicy} (auto-detected)`);
-    } else {
-      console.log(`  Policy:  cloud-managed (fetched via API key)`);
-    }
-  }
-  console.log(`  API Key: ${apiKey.slice(0, 12)}...${apiKey.slice(-4)}`);
-  console.log(`  Protecting: ${toProtect.join(", ")}`);
-  console.log("");
-  startSpinner("Wrapping MCP servers with proxy...");
-  const newConfig = { mcpServers: {} };
-  for (const name of serverNames) {
-    if (toProtect.includes(name)) {
-      newConfig.mcpServers[name] = wrapServer(name, config.mcpServers[name], policyValue);
-    } else {
-      newConfig.mcpServers[name] = config.mcpServers[name];
-    }
-  }
-  const currentContent = readFileSync2(configInfo.path, "utf-8");
-  let newContent;
-  if (configInfo.type === "claude-desktop") {
-    const original = JSON.parse(currentContent);
-    original.mcpServers = newConfig.mcpServers;
-    newContent = JSON.stringify(original, null, 2) + "\n";
-  } else {
-    newContent = JSON.stringify(newConfig, null, 2) + "\n";
-  }
-  await sleep(400);
-  if (newContent === currentContent) {
-    stopSpinner("\u2713 Config already up to date");
-  } else {
-    writeFileSync2(configInfo.path, newContent);
-    stopSpinner("\u2713 Config updated");
-  }
-  console.log("");
-  startSpinner("Installing hooks...");
-  await sleep(300);
-  stopSpinner("\u2713 Hooks");
-  installHooks(options.tools, newConfig);
-  console.log("");
-  const allUpToDate = toProtect.length === 0 && alreadyProtected.length === serverNames.length;
-  console.log("  \u2500\u2500 Summary \u2500\u2500");
-  console.log("");
-  for (const name of toProtect) {
-    console.log(`  \u2713 ${name} \u2014 protected`);
-  }
-  for (const name of alreadyProtected) {
-    console.log(`  \u25CF ${name} \u2014 already protected`);
-  }
-  for (const name of skipped) {
-    console.log(`  \u25CB ${name} \u2014 skipped`);
-  }
-  console.log("");
-  if (allUpToDate) {
-    console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-    console.log("  \u2502  Everything is already up to date!              \u2502");
-    console.log("  \u2502                                                 \u2502");
-    console.log("  \u2502  All MCP servers protected, hooks configured.   \u2502");
-    console.log("  \u2502  View logs: https://dashboard.solongate.com     \u2502");
-    console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  } else {
-    console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-    console.log("  \u2502  Setup complete!                                \u2502");
-    console.log("  \u2502                                                 \u2502");
-    console.log("  \u2502  MCP servers  \u2192 Protected via proxy             \u2502");
-    console.log("  \u2502  AI tools     \u2192 Guarded via hooks               \u2502");
-    console.log("  \u2502  Claude Code, Gemini CLI                         \u2502");
-    console.log("  \u2502  API key      \u2192 Set in .env                     \u2502");
-    console.log("  \u2502                                                 \u2502");
-    console.log("  \u2502  View logs: https://dashboard.solongate.com     \u2502");
-    console.log("  \u2502                                                 \u2502");
-    console.log("  \u2502  Restart your MCP client to apply changes.      \u2502");
-    console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  }
-  console.log("");
-}
-main().catch((err) => {
-  console.log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
-});