@solongate/proxy 0.51.0 → 0.52.0

package/dist/index.js

@@ -3412,12 +3412,12 @@ ${ctx.indent}`;
       for (const {
         format,
         test,
-        resolve: resolve7
+        resolve: resolve8
       } of tags) {
         if (test) {
           const match = str.match(test);
           if (match) {
-            let res = resolve7.apply(null, match);
+            let res = resolve8.apply(null, match);
             if (!(res instanceof Scalar)) res = new Scalar(res);
             if (format) res.format = format;
             return res;
@@ -6572,8 +6572,10 @@ var init_cli_utils = __esm({
 var global_install_exports = {};
 __export(global_install_exports, {
   globalPaths: () => globalPaths,
+  installClaudeShim: () => installClaudeShim,
   installGlobalWithKey: () => installGlobalWithKey,
   lockProtected: () => lockProtected,
+  removeClaudeShim: () => removeClaudeShim,
   runGlobalInstall: () => runGlobalInstall,
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
@@ -6646,6 +6648,7 @@ function protectedTargets() {
     join4(p.hooksDir, "guard.mjs"),
     join4(p.hooksDir, "audit.mjs"),
     join4(p.hooksDir, "stop.mjs"),
+    join4(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -6688,6 +6691,7 @@ function ask(question) {
 function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
+  removeClaudeShim();
   if (existsSync4(p.backupPath)) {
     writeFileSync3(p.settingsPath, readFileSync5(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
@@ -6704,6 +6708,77 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    return out[0] || null;
+  } catch {
+    return null;
+  }
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync4(f));
+}
+function writeShimBlock(file, block) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync4(file) ? readFileSync5(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block + "\n";
+  }
+  mkdirSync4(dirname2(file), { recursive: true });
+  writeFileSync3(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) {
+    console.log("  (No shell profile found for auto-shield; run `claude` via `solongate shield -- claude` manually.)");
+    return;
+  }
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block);
+      console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
+    } catch (e) {
+      console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
+    }
+  }
+  console.log("  Open a NEW terminal for it to take effect.");
+}
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
+    try {
+      writeShimBlock(file, null);
+    } catch {
+    }
+  }
+}
 async function runGlobalInstall(opts = {}) {
   const p = globalPaths();
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
@@ -6728,7 +6803,9 @@ async function runGlobalInstall(opts = {}) {
   writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
   writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
   writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join4(p.hooksDir, "shield.mjs"));
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
@@ -6766,12 +6843,14 @@ async function runGlobalInstall(opts = {}) {
 async function installGlobalWithKey(apiKey, apiUrl) {
   await runGlobalInstall({ apiKey, apiUrl });
 }
-var __dirname, HOOKS_DIR;
+var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
     __dirname = dirname2(fileURLToPath(import.meta.url));
     HOOKS_DIR = resolve3(__dirname, "..", "hooks");
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
   }
 });
 
@@ -6925,10 +7004,189 @@ var init_login = __esm({
   }
 });
 
+// src/shield.ts
+var shield_exports = {};
+__export(shield_exports, {
+  runShield: () => runShield
+});
+import { createServer, request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { spawn as spawn2 } from "child_process";
+import { URL as URL2 } from "url";
+import { readFileSync as readFileSync6, existsSync as existsSync5 } from "fs";
+import { resolve as resolve4 } from "path";
+import { homedir as homedir3 } from "os";
+function loadCfg() {
+  try {
+    const sel = (process.env.SOLONGATE_AGENT_ID || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+    const f = resolve4(homedir3(), ".solongate", ".policy-cache-" + sel + ".json");
+    if (existsSync5(f)) {
+      const c3 = JSON.parse(readFileSync6(f, "utf-8"));
+      const d = c3?.security?.dlpRedact;
+      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [] };
+    }
+  } catch {
+  }
+  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [] };
+}
+function redactString(s, cfg) {
+  if (!cfg || typeof s !== "string" || !s) return s;
+  const allow = new Set(cfg.patterns);
+  let out = s;
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const c3 of cfg.custom) {
+    try {
+      out = out.replace(new RegExp(c3.re, "g"), `[REDACTED: ${c3.name || "custom"}]`);
+    } catch {
+    }
+  }
+  return out;
+}
+function redactDeep(value, cfg) {
+  if (typeof value === "string") return redactString(value, cfg);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, cfg));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);
+    return out;
+  }
+  return value;
+}
+function pickUpstream() {
+  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
+  try {
+    return new URL2(raw);
+  } catch {
+    return new URL2("https://api.anthropic.com");
+  }
+}
+function startProxy(upstream) {
+  const cfg = loadCfg();
+  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
+  const server = createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (c3) => chunks.push(c3));
+    req.on("end", () => {
+      let body = Buffer.concat(chunks);
+      try {
+        if (body.length && (req.headers["content-type"] || "").includes("json")) {
+          const parsed = JSON.parse(body.toString("utf-8"));
+          const redacted = redactDeep(parsed, cfg);
+          body = Buffer.from(JSON.stringify(redacted), "utf-8");
+        }
+      } catch {
+      }
+      const headers = { ...req.headers };
+      delete headers["host"];
+      delete headers["content-length"];
+      delete headers["accept-encoding"];
+      headers["content-length"] = String(body.length);
+      const upstreamReq = forward(
+        {
+          protocol: upstream.protocol,
+          hostname: upstream.hostname,
+          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
+          method: req.method,
+          path: req.url,
+          headers: { ...headers, host: upstream.host }
+        },
+        (upRes) => {
+          res.writeHead(upRes.statusCode || 502, upRes.headers);
+          upRes.pipe(res);
+        }
+      );
+      upstreamReq.on("error", (e) => {
+        log4("upstream error:", e.message);
+        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
+        res.end("shield upstream error");
+      });
+      upstreamReq.end(body);
+    });
+    req.on("error", () => {
+      try {
+        res.destroy();
+      } catch {
+      }
+    });
+  });
+  return new Promise((resolveP) => {
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      resolveP({ port, close: () => server.close() });
+    });
+  });
+}
+async function runShield() {
+  const sep = process.argv.indexOf("--");
+  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
+  if (cmd.length === 0) {
+    log4("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
+    process.exit(1);
+  }
+  const upstream = pickUpstream();
+  const { port, close } = await startProxy(upstream);
+  log4(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
+  const child = spawn2(cmd[0], cmd.slice(1), {
+    stdio: "inherit",
+    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
+    shell: process.platform === "win32"
+    // resolve `claude.cmd` etc. on Windows
+  });
+  const shutdown = () => {
+    try {
+      close();
+    } catch {
+    }
+  };
+  child.on("exit", (code, signal) => {
+    shutdown();
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    log4("failed to launch command:", e.message);
+    shutdown();
+    process.exit(1);
+  });
+  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
+    try {
+      child.kill(sig);
+    } catch {
+    }
+  });
+}
+var log4, DLP_PATTERNS;
+var init_shield = __esm({
+  "src/shield.ts"() {
+    "use strict";
+    log4 = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
+`);
+    DLP_PATTERNS = [
+      { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
+      { name: "private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+      { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+      { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
+      { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+      { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
+      { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
+      { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+      { name: "Google API key", re: /AIza[0-9A-Za-z_-]{35}/g },
+      { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
+      { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
+      { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
+      { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
+      { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+      { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi },
+      { name: "secret assignment", re: /(api[_-]?key|secret|token|password|passwd|access[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9/+_.-]{12,}/gi }
+    ];
+  }
+});
+
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync5, copyFileSync } from "fs";
-import { resolve as resolve4 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { resolve as resolve5 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
   const args = argv.slice(2);
@@ -6985,9 +7243,9 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync5(resolve4("package.json"))) return false;
+  if (!existsSync6(resolve5("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync6(resolve4("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve5("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -6996,18 +7254,18 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync6(resolve4("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve5("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync5(resolve4(srcPath))) return resolve4(srcPath);
-        if (existsSync5(resolve4(binPath))) return resolve4(binPath);
+        if (existsSync6(resolve5(srcPath))) return resolve5(srcPath);
+        if (existsSync6(resolve5(binPath))) return resolve5(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync5(resolve4(srcPath))) return resolve4(srcPath);
+      if (existsSync6(resolve5(srcPath))) return resolve5(srcPath);
     }
   } catch {
   }
@@ -7020,10 +7278,10 @@ function findTsEntryFile() {
     "main.ts"
   ];
   for (const c3 of candidates) {
-    const full = resolve4(c3);
-    if (existsSync5(full)) {
+    const full = resolve5(c3);
+    if (existsSync6(full)) {
       try {
-        const content = readFileSync6(full, "utf-8");
+        const content = readFileSync7(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -7032,18 +7290,18 @@ function findTsEntryFile() {
     }
   }
   for (const c3 of candidates) {
-    if (existsSync5(resolve4(c3))) return resolve4(c3);
+    if (existsSync6(resolve5(c3))) return resolve5(c3);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync5(resolve4("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync5(resolve4("yarn.lock"))) return "yarn";
+  if (existsSync6(resolve5("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync6(resolve5("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync6(resolve4("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(resolve5("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/proxy"]) {
       log3("  @solongate/proxy already installed");
@@ -7064,7 +7322,7 @@ function installSdk() {
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync6(filePath, "utf-8");
+  const original = readFileSync7(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -7180,8 +7438,8 @@ async function main2() {
     process.exit(1);
   }
   log3("  Language: TypeScript");
-  const entryFile = opts.file ? resolve4(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync5(entryFile)) {
+  const entryFile = opts.file ? resolve5(opts.file) : findTsEntryFile();
+  if (!entryFile || !existsSync6(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -7194,7 +7452,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync5(backupPath)) {
+    if (!existsSync6(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -7230,7 +7488,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync5(backupPath)) {
+  if (!existsSync6(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -7264,8 +7522,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
-import { resolve as resolve5, join as join5 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { resolve as resolve6, join as join5 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -7474,9 +7732,9 @@ dist/
 }
 async function main3() {
   const opts = parseCreateArgs(process.argv);
-  const dir = resolve5(opts.name);
+  const dir = resolve6(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync6(dir)) {
+  if (existsSync7(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -7555,14 +7813,14 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
-import { resolve as resolve6 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { resolve as resolve7 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
-  const envPath = resolve6(".env");
-  if (!existsSync7(envPath)) return;
+  const envPath = resolve7(".env");
+  if (!existsSync8(envPath)) return;
   try {
-    const content = readFileSync7(envPath, "utf-8");
+    const content = readFileSync8(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -7604,20 +7862,20 @@ function parseCliArgs() {
     }
   }
   if (!apiKey) {
-    log4(red("ERROR: API key not found."));
-    log4("");
-    log4("Set it in .env file:");
-    log4("  SOLONGATE_API_KEY=sg_live_...");
-    log4("");
-    log4("Or pass via environment:");
-    log4(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
+    log5(red("ERROR: API key not found."));
+    log5("");
+    log5("Set it in .env file:");
+    log5("  SOLONGATE_API_KEY=sg_live_...");
+    log5("");
+    log5("Or pass via environment:");
+    log5(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
     process.exit(1);
   }
   if (!apiKey.startsWith("sg_live_")) {
-    log4(red("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
+    log5(red("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
     process.exit(1);
   }
-  return { command, apiKey, file: resolve6(file), policyId };
+  return { command, apiKey, file: resolve7(file), policyId };
 }
 async function listPolicies(apiKey) {
   const res = await fetch(`${API_URL}/api/v1/policies`, {
@@ -7630,18 +7888,18 @@ async function listPolicies(apiKey) {
 async function list(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
-    log4(yellow("No policies found. Create one in the dashboard first."));
-    log4(dim("  https://dashboard.solongate.com/policies"));
+    log5(yellow("No policies found. Create one in the dashboard first."));
+    log5(dim("  https://dashboard.solongate.com/policies"));
     return;
   }
   if (policyId) {
     const match = policies.find((p) => p.id === policyId);
     if (!match) {
-      log4(red(`Policy not found: ${policyId}`));
-      log4("");
-      log4("Available policies:");
+      log5(red(`Policy not found: ${policyId}`));
+      log5("");
+      log5("Available policies:");
       for (const p of policies) {
-        log4(`  ${dim("\u2022")} ${p.id}`);
+        log5(`  ${dim("\u2022")} ${p.id}`);
       }
       process.exit(1);
     }
@@ -7649,10 +7907,10 @@ async function list(apiKey, policyId) {
     printPolicyDetail(full);
     return;
   }
-  log4("");
-  log4(bold(`  Policies (${policies.length})`));
-  log4(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log4("");
+  log5("");
+  log5(bold(`  Policies (${policies.length})`));
+  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5("");
   const fullPolicies = await Promise.all(
     policies.map(
       (p) => fetchCloudPolicy(apiKey, API_URL, p.id).then((full) => ({ policy: p, rules: full.rules })).catch(() => ({ policy: p, rules: [] }))
@@ -7661,136 +7919,136 @@ async function list(apiKey, policyId) {
   for (const { policy, rules } of fullPolicies) {
     printPolicySummary(policy, rules);
   }
-  log4(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log4("");
-  log4(`  ${dim("View details:")}  solongate-proxy list --policy-id <ID>`);
-  log4(`  ${dim("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
-  log4(`  ${dim("Push policy:")}   solongate-proxy push --policy-id <ID>`);
-  log4("");
+  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5("");
+  log5(`  ${dim("View details:")}  solongate-proxy list --policy-id <ID>`);
+  log5(`  ${dim("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
+  log5(`  ${dim("Push policy:")}   solongate-proxy push --policy-id <ID>`);
+  log5("");
 }
 function printPolicySummary(p, rules) {
   const ruleCount = rules.length;
   const allowCount = rules.filter((r) => r.effect === "ALLOW").length;
   const denyCount = rules.filter((r) => r.effect === "DENY").length;
-  log4(`  ${cyan(p.id)}`);
-  log4(`    ${bold(p.name)}  ${dim(`v${p.version ?? "?"}`)}`);
-  log4(`    ${dim("Rules:")} ${ruleCount}  ${green(`${allowCount} ALLOW`)}  ${red(`${denyCount} DENY`)}`);
+  log5(`  ${cyan(p.id)}`);
+  log5(`    ${bold(p.name)}  ${dim(`v${p.version ?? "?"}`)}`);
+  log5(`    ${dim("Rules:")} ${ruleCount}  ${green(`${allowCount} ALLOW`)}  ${red(`${denyCount} DENY`)}`);
   if (p.created_at) {
-    log4(`    ${dim("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
+    log5(`    ${dim("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
   }
-  log4("");
+  log5("");
 }
 function printPolicyDetail(policy) {
-  log4("");
-  log4(bold(`  ${policy.name}`));
-  log4(`  ${dim("ID:")} ${cyan(policy.id)}  ${dim("Version:")} ${policy.version}  ${dim("Rules:")} ${policy.rules.length}`);
-  log4("");
+  log5("");
+  log5(bold(`  ${policy.name}`));
+  log5(`  ${dim("ID:")} ${cyan(policy.id)}  ${dim("Version:")} ${policy.version}  ${dim("Rules:")} ${policy.rules.length}`);
+  log5("");
   if (policy.rules.length === 0) {
-    log4(yellow("  No rules defined."));
-    log4("");
+    log5(yellow("  No rules defined."));
+    log5("");
     return;
   }
-  log4(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   for (const rule of policy.rules) {
     const effectColor = rule.effect === "ALLOW" ? green : red;
-    log4("");
-    log4(`  ${effectColor(rule.effect.padEnd(5))}  ${bold(rule.toolPattern)}  ${dim(`P:${rule.priority}`)}`);
+    log5("");
+    log5(`  ${effectColor(rule.effect.padEnd(5))}  ${bold(rule.toolPattern)}  ${dim(`P:${rule.priority}`)}`);
     if (rule.description) {
-      log4(`         ${dim(rule.description)}`);
+      log5(`         ${dim(rule.description)}`);
     }
-    log4(`         ${dim(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
+    log5(`         ${dim(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
     if (rule.pathConstraints) {
       const pc = rule.pathConstraints;
-      if (pc.rootDirectory) log4(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
-      if (pc.allowed?.length) log4(`         ${green("PATHS")} ${pc.allowed.join(", ")}`);
-      if (pc.denied?.length) log4(`         ${red("DENY")}  ${pc.denied.join(", ")}`);
+      if (pc.rootDirectory) log5(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
+      if (pc.allowed?.length) log5(`         ${green("PATHS")} ${pc.allowed.join(", ")}`);
+      if (pc.denied?.length) log5(`         ${red("DENY")}  ${pc.denied.join(", ")}`);
     }
     if (rule.commandConstraints) {
       const cc = rule.commandConstraints;
-      if (cc.allowed?.length) log4(`         ${green("CMDS")}  ${cc.allowed.join(", ")}`);
-      if (cc.denied?.length) log4(`         ${red("DENY")}  ${cc.denied.join(", ")}`);
+      if (cc.allowed?.length) log5(`         ${green("CMDS")}  ${cc.allowed.join(", ")}`);
+      if (cc.denied?.length) log5(`         ${red("DENY")}  ${cc.denied.join(", ")}`);
     }
     if (rule.filenameConstraints) {
       const fc = rule.filenameConstraints;
-      if (fc.allowed?.length) log4(`         ${green("FILES")} ${fc.allowed.join(", ")}`);
-      if (fc.denied?.length) log4(`         ${red("DENY")}  ${fc.denied.join(", ")}`);
+      if (fc.allowed?.length) log5(`         ${green("FILES")} ${fc.allowed.join(", ")}`);
+      if (fc.denied?.length) log5(`         ${red("DENY")}  ${fc.denied.join(", ")}`);
     }
     if (rule.urlConstraints) {
       const uc = rule.urlConstraints;
-      if (uc.allowed?.length) log4(`         ${green("URLS")}  ${uc.allowed.join(", ")}`);
-      if (uc.denied?.length) log4(`         ${red("DENY")}  ${uc.denied.join(", ")}`);
+      if (uc.allowed?.length) log5(`         ${green("URLS")}  ${uc.allowed.join(", ")}`);
+      if (uc.denied?.length) log5(`         ${red("DENY")}  ${uc.denied.join(", ")}`);
     }
   }
-  log4("");
-  log4(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log4("");
+  log5("");
+  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5("");
 }
 async function pull(apiKey, file, policyId) {
   if (!policyId) {
     const policies = await listPolicies(apiKey);
     if (policies.length === 0) {
-      log4(red("No policies found. Create one in the dashboard first."));
+      log5(red("No policies found. Create one in the dashboard first."));
       process.exit(1);
     }
     if (policies.length === 1) {
       policyId = policies[0].id;
-      log4(dim(`Auto-selecting only policy: ${policyId}`));
+      log5(dim(`Auto-selecting only policy: ${policyId}`));
     } else {
-      log4(yellow(`Found ${policies.length} policies:`));
-      log4("");
+      log5(yellow(`Found ${policies.length} policies:`));
+      log5("");
       for (const p of policies) {
-        log4(`  ${cyan(p.id)}  ${p.name}  ${dim(`v${p.version ?? "?"}`)}`);
+        log5(`  ${cyan(p.id)}  ${p.name}  ${dim(`v${p.version ?? "?"}`)}`);
       }
-      log4("");
-      log4("Use --policy-id <ID> to specify which one to pull.");
+      log5("");
+      log5("Use --policy-id <ID> to specify which one to pull.");
       process.exit(1);
     }
   }
-  log4(`Pulling ${cyan(policyId)} from dashboard...`);
+  log5(`Pulling ${cyan(policyId)} from dashboard...`);
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
   writeFileSync6(file, json, "utf-8");
-  log4("");
-  log4(green("  Saved to: ") + file);
-  log4(`  ${dim("Name:")}    ${policy.name}`);
-  log4(`  ${dim("Version:")} ${policy.version}`);
-  log4(`  ${dim("Rules:")}   ${policy.rules.length}`);
-  log4("");
-  log4(dim("The policy file does not contain an ID."));
-  log4(dim("Use --policy-id to specify the target when pushing/pulling."));
-  log4("");
+  log5("");
+  log5(green("  Saved to: ") + file);
+  log5(`  ${dim("Name:")}    ${policy.name}`);
+  log5(`  ${dim("Version:")} ${policy.version}`);
+  log5(`  ${dim("Rules:")}   ${policy.rules.length}`);
+  log5("");
+  log5(dim("The policy file does not contain an ID."));
+  log5(dim("Use --policy-id to specify the target when pushing/pulling."));
+  log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync7(file)) {
-    log4(red(`ERROR: File not found: ${file}`));
+  if (!existsSync8(file)) {
+    log5(red(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
   if (!policyId) {
-    log4(red("ERROR: --policy-id is required for push."));
-    log4("");
-    log4("This determines which cloud policy to update.");
-    log4("");
-    log4("Usage:");
-    log4("  solongate-proxy push --policy-id my-policy");
-    log4("  solongate-proxy push --policy-id my-policy --file custom.json");
-    log4("");
-    log4("List your policies:");
-    log4("  solongate-proxy list");
+    log5(red("ERROR: --policy-id is required for push."));
+    log5("");
+    log5("This determines which cloud policy to update.");
+    log5("");
+    log5("Usage:");
+    log5("  solongate-proxy push --policy-id my-policy");
+    log5("  solongate-proxy push --policy-id my-policy --file custom.json");
+    log5("");
+    log5("List your policies:");
+    log5("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync7(file, "utf-8");
+  const content = readFileSync8(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);
   } catch {
-    log4(red(`ERROR: Invalid JSON in ${file}`));
+    log5(red(`ERROR: Invalid JSON in ${file}`));
     process.exit(1);
   }
-  log4(`Pushing to ${cyan(policyId)}...`);
-  log4(`  ${dim("File:")}  ${file}`);
-  log4(`  ${dim("Name:")}  ${policy.name || "Unnamed"}`);
-  log4(`  ${dim("Rules:")} ${(policy.rules || []).length}`);
+  log5(`Pushing to ${cyan(policyId)}...`);
+  log5(`  ${dim("File:")}  ${file}`);
+  log5(`  ${dim("Name:")}  ${policy.name || "Unnamed"}`);
+  log5(`  ${dim("Rules:")} ${(policy.rules || []).length}`);
   const checkRes = await fetch(`${API_URL}/api/v1/policies/${policyId}`, {
     headers: { "Authorization": `Bearer ${apiKey}` }
   });
@@ -7812,15 +8070,15 @@ async function push(apiKey, file, policyId) {
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
-    log4(red(`ERROR: Push failed (${res.status}): ${body}`));
+    log5(red(`ERROR: Push failed (${res.status}): ${body}`));
     process.exit(1);
   }
   const data = await res.json();
-  log4("");
-  log4(green(`  Pushed to cloud: v${data._version ?? "created"}`));
-  log4(`  ${dim("Policy ID:")} ${policyId}`);
-  log4(`  ${dim("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
-  log4("");
+  log5("");
+  log5(green(`  Pushed to cloud: v${data._version ?? "created"}`));
+  log5(`  ${dim("Policy ID:")} ${policyId}`);
+  log5(`  ${dim("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
+  log5("");
 }
 async function main4() {
   const { command, apiKey, file, policyId } = parseCliArgs();
@@ -7832,32 +8090,32 @@ async function main4() {
     } else if (command === "list" || command === "ls") {
       await list(apiKey, policyId);
     } else {
-      log4(red(`Unknown command: ${command}`));
-      log4("");
-      log4(bold("Usage:"));
-      log4("  solongate-proxy list                          List all policies");
-      log4("  solongate-proxy list --policy-id <ID>         Show policy details");
-      log4("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
-      log4("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
-      log4("");
-      log4(bold("Flags:"));
-      log4("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
-      log4("  --file, -f <path>         Local file path (default: policy.json)");
-      log4("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
-      log4("");
+      log5(red(`Unknown command: ${command}`));
+      log5("");
+      log5(bold("Usage:"));
+      log5("  solongate-proxy list                          List all policies");
+      log5("  solongate-proxy list --policy-id <ID>         Show policy details");
+      log5("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
+      log5("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
+      log5("");
+      log5(bold("Flags:"));
+      log5("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
+      log5("  --file, -f <path>         Local file path (default: policy.json)");
+      log5("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
+      log5("");
       process.exit(1);
     }
   } catch (err) {
-    log4(red(`ERROR: ${err instanceof Error ? err.message : String(err)}`));
+    log5(red(`ERROR: ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
   }
 }
-var log4, dim, bold, green, red, yellow, cyan, magenta, API_URL;
+var log5, dim, bold, green, red, yellow, cyan, magenta, API_URL;
 var init_pull_push = __esm({
   "src/pull-push.ts"() {
     "use strict";
     init_config();
-    log4 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
+    log5 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
 `);
     dim = (s) => `\x1B[2m${s}\x1B[0m`;
     bold = (s) => `\x1B[1m${s}\x1B[0m`;
@@ -10296,7 +10554,7 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const timer = setTimeout(() => {
         const idx = this.queue.indexOf(onReady);
         if (idx !== -1) this.queue.splice(idx, 1);
@@ -10304,7 +10562,7 @@ var Mutex = class {
       }, timeoutMs);
       const onReady = () => {
         clearTimeout(timer);
-        resolve7();
+        resolve8();
       };
       this.queue.push(onReady);
     });
@@ -10924,7 +11182,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "create", "inject", "pull", "push", "list", "ls"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -10968,6 +11226,11 @@ async function main5() {
     runGlobalRestore2();
     return;
   }
+  if (subcommand === "shield") {
+    const { runShield: runShield2 } = await Promise.resolve().then(() => (init_shield(), shield_exports));
+    await runShield2();
+    return;
+  }
   if (subcommand === "inject") {
     process.argv.splice(2, 1);
     await Promise.resolve().then(() => (init_inject(), inject_exports));