@solongate/proxy 0.59.4 → 0.60.0

package/dist/index.js

@@ -41,8 +41,8 @@ function loginCredential() {
   try {
     const p = join(homedir(), ".solongate", "cloud-guard.json");
     if (!existsSync(p)) return {};
-    const c3 = JSON.parse(readFileSync(p, "utf-8"));
-    return c3 && typeof c3 === "object" ? c3 : {};
+    const c2 = JSON.parse(readFileSync(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
   }
@@ -78,6 +78,7 @@ async function fetchCloudPolicy(apiKey, apiUrl, policyId) {
   return {
     id: String(data.id ?? "cloud"),
     name: String(data.name ?? "Cloud Policy"),
+    description: String(data.description ?? ""),
     version: Number(data._version ?? 1),
     rules: data.rules ?? [],
     createdAt: String(data._created_at ?? ""),
@@ -131,12 +132,12 @@ async function sendAuditLog(apiKey, apiUrl, entry) {
 `);
   try {
     const line = JSON.stringify({ ...entry, timestamp: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
-    appendFile(AUDIT_LOG_BACKUP_PATH, line, "utf-8").catch((err) => {
-      process.stderr.write(`[SolonGate] Audit backup write error: ${err instanceof Error ? err.message : String(err)}
+    appendFile(AUDIT_LOG_BACKUP_PATH, line, "utf-8").catch((err2) => {
+      process.stderr.write(`[SolonGate] Audit backup write error: ${err2 instanceof Error ? err2.message : String(err2)}
 `);
     });
-  } catch (err) {
-    process.stderr.write(`[SolonGate] Audit backup write error: ${err instanceof Error ? err.message : String(err)}
+  } catch (err2) {
+    process.stderr.write(`[SolonGate] Audit backup write error: ${err2 instanceof Error ? err2.message : String(err2)}
 `);
   }
 }
@@ -197,21 +198,6 @@ function parseArgs(argv) {
   let separatorIndex = args.indexOf("--");
   const flags = separatorIndex >= 0 ? args.slice(0, separatorIndex) : args;
   let upstreamArgs = separatorIndex >= 0 ? args.slice(separatorIndex + 1) : [];
-  const flagsWithValue = /* @__PURE__ */ new Set([
-    "--policy",
-    "--name",
-    "--rate-limit",
-    "--global-rate-limit",
-    "--config",
-    "--api-key",
-    "--api-url",
-    "--upstream-url",
-    "--upstream-transport",
-    "--port",
-    "--policy-id",
-    "--id",
-    "--agent-name"
-  ]);
   for (let i = 0; i < flags.length; i++) {
     if (!flags[i].startsWith("--")) {
       if (upstreamArgs.length === 0) {
@@ -412,11 +398,11 @@ var require_json = __commonJS({
       try {
         JSON.parse(str);
         return true;
-      } catch (err) {
-        if (err instanceof SyntaxError) {
+      } catch (err2) {
+        if (err2 instanceof SyntaxError) {
           return false;
         }
-        throw err;
+        throw err2;
       }
     }
     module.exports = {
@@ -779,9 +765,9 @@ var require_PlainValue_516d5bc2 = __commonJS({
         }
       }
       const offset = col > 1 ? " ".repeat(col - 1) : "";
-      const err = "^".repeat(errLen);
+      const err2 = "^".repeat(errLen);
       return `${src}
-${offset}${err}${errEnd}`;
+${offset}${err2}${errEnd}`;
     }
     var Range = class _Range {
       static copy(orig) {
@@ -1447,9 +1433,9 @@ var require_parse_cst = __commonJS({
           offset = this.node.range.end;
         } else {
           if (inlineComment) {
-            const c3 = comments[0];
-            this.props.push(c3);
-            offset = c3.end;
+            const c2 = comments[0];
+            this.props.push(c2);
+            offset = c2.end;
           } else {
             offset = PlainValue.Node.endOfLine(src, start + 1);
           }
@@ -2749,7 +2735,7 @@ var require_parse_cst = __commonJS({
         };
       }
     };
-    function parse(src) {
+    function parse2(src) {
       const cr = [];
       if (src.indexOf("\r") !== -1) {
         src = src.replace(/\r\n?/g, (match, offset2) => {
@@ -2780,7 +2766,7 @@ var require_parse_cst = __commonJS({
       documents.toString = () => documents.join("...\n");
       return documents;
     }
-    exports.parse = parse;
+    exports.parse = parse2;
   }
 });
 
@@ -3190,8 +3176,8 @@ ${ctx.indent}`;
       } else if (node instanceof Collection) {
         let count = 0;
         for (const item of node.items) {
-          const c3 = getAliasCount(item, anchors);
-          if (c3 > count) count = c3;
+          const c2 = getAliasCount(item, anchors);
+          if (c2 > count) count = c2;
         }
         return count;
       } else if (node instanceof Pair) {
@@ -3412,12 +3398,12 @@ ${ctx.indent}`;
       for (const {
         format,
         test,
-        resolve: resolve9
+        resolve: resolve10
       } of tags) {
         if (test) {
           const match = str.match(test);
           if (match) {
-            let res = resolve9.apply(null, match);
+            let res = resolve10.apply(null, match);
             if (!(res instanceof Scalar)) res = new Scalar(res);
             if (format) res.format = format;
             return res;
@@ -3831,15 +3817,15 @@ ${indent}`);
       }
       if (lastItem && lastItem.char !== char) {
         const msg = `Expected ${name} to end with ${char}`;
-        let err;
+        let err2;
         if (typeof lastItem.offset === "number") {
-          err = new PlainValue.YAMLSemanticError(cst, msg);
-          err.offset = lastItem.offset + 1;
+          err2 = new PlainValue.YAMLSemanticError(cst, msg);
+          err2.offset = lastItem.offset + 1;
         } else {
-          err = new PlainValue.YAMLSemanticError(lastItem, msg);
-          if (lastItem.range && lastItem.range.end) err.offset = lastItem.range.end - lastItem.range.start;
+          err2 = new PlainValue.YAMLSemanticError(lastItem, msg);
+          if (lastItem.range && lastItem.range.end) err2.offset = lastItem.range.end - lastItem.range.start;
         }
-        errors.push(err);
+        errors.push(err2);
       }
     }
     function checkFlowCommentSpace(errors, comment) {
@@ -4378,9 +4364,9 @@ ${ca}` : ca;
             continue;
           }
           const msg = `Flow map contains an unexpected ${char}`;
-          const err = new PlainValue.YAMLSyntaxError(cst, msg);
-          err.offset = offset;
-          doc.errors.push(err);
+          const err2 = new PlainValue.YAMLSyntaxError(cst, msg);
+          err2.offset = offset;
+          doc.errors.push(err2);
         } else if (item.type === PlainValue.Type.BLANK_LINE) {
           comments.push({
             afterKey: !!key,
@@ -4496,9 +4482,9 @@ ${ca}` : ca;
               key = items.pop();
               if (key instanceof Pair) {
                 const msg = "Chaining flow sequence pairs is invalid";
-                const err = new PlainValue.YAMLSemanticError(cst, msg);
-                err.offset = offset;
-                doc.errors.push(err);
+                const err2 = new PlainValue.YAMLSemanticError(cst, msg);
+                err2.offset = offset;
+                doc.errors.push(err2);
               }
               if (!explicitKey && typeof keyStart === "number") {
                 const keyEnd = item.range ? item.range.start : item.offset;
@@ -4520,9 +4506,9 @@ ${ca}` : ca;
             next = null;
           } else if (next === "[" || char !== "]" || i < cst.items.length - 1) {
             const msg = `Flow sequence contains an unexpected ${char}`;
-            const err = new PlainValue.YAMLSyntaxError(cst, msg);
-            err.offset = offset;
-            doc.errors.push(err);
+            const err2 = new PlainValue.YAMLSyntaxError(cst, msg);
+            err2.offset = offset;
+            doc.errors.push(err2);
           }
         } else if (item.type === PlainValue.Type.BLANK_LINE) {
           comments.push({
@@ -6059,7 +6045,7 @@ var require_dist = __commonJS({
       }
       return doc;
     }
-    function parse(src, options) {
+    function parse2(src, options) {
       const doc = parseDocument(src, options);
       doc.warnings.forEach((warning) => warnings.warn(warning));
       if (doc.errors.length > 0) throw doc.errors[0];
@@ -6074,7 +6060,7 @@ var require_dist = __commonJS({
       createNode,
       defaultOptions: Document$1.defaultOptions,
       Document,
-      parse,
+      parse: parse2,
       parseAllDocuments,
       parseCST: parseCst.parse,
       parseDocument,
@@ -6104,7 +6090,7 @@ var require_yaml2 = __commonJS({
       "YAMLSyntaxError",
       "YAMLWarning"
     ]);
-    function parse(str) {
+    function parse2(str) {
       if (typeof str !== "string") {
         return { ok: false, result: void 0 };
       }
@@ -6112,11 +6098,11 @@ var require_yaml2 = __commonJS({
       try {
         global.YAML_SILENCE_WARNINGS = true;
         return { ok: true, result: yaml.parse(str) };
-      } catch (err) {
-        if (err && errors.has(err.name)) {
+      } catch (err2) {
+        if (err2 && errors.has(err2.name)) {
           return { ok: false, result: void 0 };
         }
-        throw err;
+        throw err2;
       } finally {
         global.YAML_SILENCE_WARNINGS = YAML_SILENCE_WARNINGS_CACHED;
       }
@@ -6124,9 +6110,9 @@ var require_yaml2 = __commonJS({
     module.exports = {
       // is_valid is expected to return nothing if input is invalid otherwise
       // true/false for it being valid YAML.
-      "yaml.is_valid": (str) => typeof str === "string" ? parse(str).ok : void 0,
+      "yaml.is_valid": (str) => typeof str === "string" ? parse2(str).ok : void 0,
       "yaml.marshal": (data) => yaml.stringify(data),
-      "yaml.unmarshal": (str) => parse(str).result
+      "yaml.unmarshal": (str) => parse2(str).result
     };
   }
 });
@@ -6568,6 +6554,1743 @@ var init_cli_utils = __esm({
   }
 });
 
+// src/api-client/client.ts
+var client_exports = {};
+__export(client_exports, {
+  ApiError: () => ApiError,
+  DEFAULT_API_URL: () => DEFAULT_API_URL2,
+  NotAuthenticatedError: () => NotAuthenticatedError,
+  isAuthenticated: () => isAuthenticated,
+  request: () => request,
+  resolveCredentials: () => resolveCredentials
+});
+import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { resolve as resolve3, join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+function loginCredentialFile() {
+  try {
+    const p = join4(homedir2(), ".solongate", "cloud-guard.json");
+    if (!existsSync3(p)) return {};
+    const c2 = JSON.parse(readFileSync4(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
+  } catch {
+    return {};
+  }
+}
+function dotenvApiKey() {
+  try {
+    const envPath = resolve3(".env");
+    if (!existsSync3(envPath)) return void 0;
+    for (const line of readFileSync4(envPath, "utf-8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (key !== "SOLONGATE_API_KEY") continue;
+      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isAuthenticated() {
+  try {
+    resolveCredentials();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveCredentials(apiUrlOverride) {
+  if (cached && !apiUrlOverride) return cached;
+  const file = loginCredentialFile();
+  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
+  if (!apiKey) throw new NotAuthenticatedError();
+  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL2;
+  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
+  if (!apiUrlOverride) cached = creds;
+  return creds;
+}
+function buildUrl(base, path, query) {
+  const url = new URL(`${base}/api/v1${path}`);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v === void 0) continue;
+      url.searchParams.set(k, String(v));
+    }
+  }
+  return url.toString();
+}
+async function request(method, path, opts = {}) {
+  const creds = resolveCredentials(opts.apiUrl);
+  const url = buildUrl(creds.apiUrl, path, opts.query);
+  const headers = {
+    Authorization: `Bearer ${creds.apiKey}`
+  };
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: bodyInit,
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+    });
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
+    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
+  }
+  const text = await res.text().catch(() => "");
+  let json = void 0;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const envelope = json?.error;
+    if (envelope && typeof envelope === "object") {
+      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
+    }
+    if (typeof envelope === "string") {
+      throw new ApiError(res.status, "ERROR", envelope);
+    }
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
+    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
+  }
+  return json;
+}
+var DEFAULT_API_URL2, ApiError, NotAuthenticatedError, cached;
+var init_client = __esm({
+  "src/api-client/client.ts"() {
+    "use strict";
+    DEFAULT_API_URL2 = "https://api.solongate.com";
+    ApiError = class extends Error {
+      status;
+      code;
+      constructor(status, code, message) {
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.code = code;
+      }
+    };
+    NotAuthenticatedError = class extends Error {
+      constructor() {
+        super("Not logged in. Run `solongate login` first.");
+        this.name = "NotAuthenticatedError";
+      }
+    };
+    cached = null;
+  }
+});
+
+// src/tui/theme.ts
+function decisionColor(decision) {
+  const d = (decision || "").toUpperCase();
+  if (d === "ALLOW") return theme.ok;
+  if (d === "DENY" || d === "DENIED") return theme.bad;
+  return theme.dim;
+}
+function modeColor(m) {
+  if (m === "block" || m === "active" || m === "on") return theme.ok;
+  if (m === "detect" || m === "idle") return theme.warn;
+  return theme.dim;
+}
+function sparkline(values, width2) {
+  let v = values;
+  if (width2 && v.length > width2) v = v.slice(v.length - width2);
+  if (v.length === 0) return "";
+  const max = Math.max(...v, 0);
+  if (max === 0) return BLOCKS[0].repeat(v.length);
+  return v.map((n) => BLOCKS[Math.min(BLOCKS.length - 1, Math.round(n / max * (BLOCKS.length - 1)))]).join("");
+}
+function truncate2(s, n) {
+  if (!s) return "";
+  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+function ago(ts) {
+  const t = typeof ts === "number" ? ts : Date.parse(ts);
+  if (Number.isNaN(t)) return String(ts ?? "");
+  const s = Math.max(0, (Date.now() - t) / 1e3);
+  if (s < 60) return `${Math.floor(s)}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h`;
+  return `${Math.floor(s / 86400)}d`;
+}
+var theme, BLOCKS;
+var init_theme = __esm({
+  "src/tui/theme.ts"() {
+    "use strict";
+    theme = {
+      accent: "cyan",
+      accentBright: "#5a8ce6",
+      ok: "green",
+      warn: "yellow",
+      bad: "red",
+      dim: "gray"
+    };
+    BLOCKS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
+  }
+});
+
+// src/tui/components.tsx
+import { Box, Text } from "ink";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function DataView({
+  loading,
+  error,
+  empty,
+  emptyText,
+  children
+}) {
+  if (error) return /* @__PURE__ */ jsxs(Text, { color: theme.bad, children: [
+    "\u2717 ",
+    error
+  ] });
+  if (loading) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "Loading\u2026" });
+  if (empty) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: emptyText ?? "No data." });
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function Table({ columns, rows }) {
+  const fit = (s, w) => {
+    const v = s ?? "";
+    if (v.length > w) return v.slice(0, Math.max(0, w - 1)) + "\u2026";
+    return v.padEnd(w);
+  };
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx(Box, { children: columns.map((c2, i) => /* @__PURE__ */ jsx(Text, { color: theme.dim, children: fit(c2.header, c2.width) + "  " }, i)) }),
+    rows.map((row, ri) => /* @__PURE__ */ jsx(Box, { children: row.map((cell, ci) => /* @__PURE__ */ jsx(Text, { color: cell.color, dimColor: cell.dim, bold: cell.bold, children: fit(cell.value, columns[ci]?.width ?? 10) + "  " }, ci)) }, ri))
+  ] });
+}
+function KeyHints({ hints }) {
+  return /* @__PURE__ */ jsx(Box, { children: hints.map(([key, label], i) => /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: key }),
+    " ",
+    label,
+    i < hints.length - 1 ? "   " : ""
+  ] }, i)) });
+}
+var init_components = __esm({
+  "src/tui/components.tsx"() {
+    "use strict";
+    init_theme();
+  }
+});
+
+// src/api-client/types.ts
+var init_types = __esm({
+  "src/api-client/types.ts"() {
+    "use strict";
+  }
+});
+
+// src/api-client/policies.ts
+var policies_exports = {};
+__export(policies_exports, {
+  active: () => active,
+  addRule: () => addRule,
+  create: () => create,
+  dryRun: () => dryRun,
+  get: () => get,
+  list: () => list,
+  remove: () => remove,
+  revokeRule: () => revokeRule,
+  rollback: () => rollback,
+  setActive: () => setActive,
+  update: () => update,
+  versions: () => versions
+});
+function list() {
+  return request("GET", "/policies");
+}
+function get(id, version) {
+  return request("GET", `/policies/${encodeURIComponent(id)}`, {
+    query: version !== void 0 ? { version } : void 0
+  });
+}
+function create(policy) {
+  return request("POST", "/policies", { body: policy });
+}
+function update(id, policy) {
+  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+}
+function remove(id) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
+}
+function addRule(id, spec) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
+}
+function revokeRule(id, ruleId) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
+}
+function versions(id, opts = {}) {
+  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
+}
+function rollback(id, version) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
+}
+function active(agentId) {
+  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
+}
+function setActive(policyId) {
+  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
+}
+function dryRun(body) {
+  return request("POST", "/policies/dry-run", { body });
+}
+var init_policies = __esm({
+  "src/api-client/policies.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/settings.ts
+var settings_exports = {};
+__export(settings_exports, {
+  clearRateLimitHistory: () => clearRateLimitHistory,
+  getGuardStatus: () => getGuardStatus,
+  getRateLimitHistory: () => getRateLimitHistory,
+  getSecurityLayers: () => getSecurityLayers,
+  setSecurityLayers: () => setSecurityLayers
+});
+function getSecurityLayers() {
+  return request("GET", "/settings/security-layers");
+}
+function setSecurityLayers(layers) {
+  return request("PUT", "/settings/security-layers", { body: { layers } });
+}
+function getRateLimitHistory() {
+  return request("GET", "/settings/rate-limit-history");
+}
+function clearRateLimitHistory() {
+  return request("DELETE", "/settings/rate-limit-history", { query: { all: 1 } });
+}
+function getGuardStatus() {
+  return request("GET", "/settings/guard-status");
+}
+var init_settings = __esm({
+  "src/api-client/settings.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/stats.ts
+var stats_exports = {};
+__export(stats_exports, {
+  drift: () => drift,
+  get: () => get2,
+  securityInsights: () => securityInsights,
+  timeseries: () => timeseries
+});
+function get2() {
+  return request("GET", "/stats");
+}
+function timeseries(opts = {}) {
+  return request("GET", "/stats/timeseries", { query: opts });
+}
+function drift(days) {
+  return request("GET", "/stats/drift", { query: days !== void 0 ? { days } : void 0 });
+}
+function securityInsights(days) {
+  return request("GET", "/stats/security-insights", { query: days !== void 0 ? { days } : void 0 });
+}
+var init_stats = __esm({
+  "src/api-client/stats.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/audit.ts
+var audit_exports = {};
+__export(audit_exports, {
+  list: () => list2,
+  whitelist: () => whitelist
+});
+function list2(query = {}) {
+  return request("GET", "/audit-logs", { query });
+}
+function whitelist(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
+}
+var init_audit = __esm({
+  "src/api-client/audit.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/agents.ts
+var agents_exports = {};
+__export(agents_exports, {
+  anomalies: () => anomalies,
+  get: () => get3,
+  live: () => live
+});
+function live(opts = {}) {
+  return request("GET", "/agents/live", {
+    query: { limit: opts.limit, include_deactivated: opts.includeDeactivated ? 1 : void 0 }
+  });
+}
+function get3(id, scan = false) {
+  return request("GET", `/agents/${encodeURIComponent(id)}`, { query: scan ? { scan: 1 } : void 0 });
+}
+function anomalies(id, limit) {
+  return request("GET", `/agents/${encodeURIComponent(id)}/anomalies`, {
+    query: limit !== void 0 ? { limit } : void 0
+  });
+}
+var init_agents = __esm({
+  "src/api-client/agents.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/index.ts
+var api;
+var init_api_client = __esm({
+  "src/api-client/index.ts"() {
+    "use strict";
+    init_client();
+    init_types();
+    init_policies();
+    init_settings();
+    init_stats();
+    init_audit();
+    init_agents();
+    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+  }
+});
+
+// src/tui/hooks.ts
+import { useCallback, useEffect, useRef, useState } from "react";
+function useLoader(fn, deps = []) {
+  const [data, setData] = useState(null);
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(true);
+  const [nonce, setNonce] = useState(0);
+  const alive = useRef(true);
+  const fnRef = useRef(fn);
+  fnRef.current = fn;
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+  useEffect(() => {
+    setLoading(true);
+    fnRef.current().then((d) => {
+      if (!alive.current) return;
+      setData(d);
+      setError(null);
+    }).catch((e) => {
+      if (!alive.current) return;
+      setError(e instanceof Error ? e.message : String(e));
+    }).finally(() => {
+      if (alive.current) setLoading(false);
+    });
+  }, [nonce, ...deps]);
+  const reload = useCallback(() => setNonce((n) => n + 1), []);
+  return { data, error, loading, reload };
+}
+function usePoll(reload, intervalMs, enabled = true) {
+  useEffect(() => {
+    if (!enabled) return;
+    const t = setInterval(reload, intervalMs);
+    return () => clearInterval(t);
+  }, [reload, intervalMs, enabled]);
+}
+var init_hooks = __esm({
+  "src/tui/hooks.ts"() {
+    "use strict";
+  }
+});
+
+// src/tui/panels/Policies.tsx
+import { Box as Box2, Text as Text2, useInput } from "ink";
+import { useState as useState2 } from "react";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function PoliciesPanel({ focused }) {
+  const [sel, setSel] = useState2(0);
+  const list4 = useLoader(() => api.policies.list());
+  const policies = list4.data?.policies ?? [];
+  const selected = policies[Math.min(sel, Math.max(0, policies.length - 1))];
+  const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
+  useInput(
+    (_input, key) => {
+      if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      if (key.downArrow) setSel((n) => Math.min(policies.length - 1, n + 1));
+    },
+    { isActive: focused }
+  );
+  return /* @__PURE__ */ jsx2(DataView, { loading: list4.loading && !list4.data, error: list4.error, empty: !!list4.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: focused ? "\u2191\u2193 select policy" : "press \u2192 to browse" }),
+    /* @__PURE__ */ jsx2(Box2, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs2(Text2, { color: i === sel ? theme.accentBright : void 0, bold: i === sel, children: [
+      (i === sel ? "\u25B8 " : "  ") + truncate2(p.name, 26).padEnd(27),
+      /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+        p.mode.padEnd(10),
+        " ",
+        p.rules.length,
+        " rules \xB7 v",
+        p.version
+      ] })
+    ] }, p.id)) }),
+    selected ? /* @__PURE__ */ jsxs2(Box2, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+        "Rules of ",
+        /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: selected.id })
+      ] }),
+      /* @__PURE__ */ jsx2(
+        Table,
+        {
+          columns: [
+            { header: "EFFECT", width: 7 },
+            { header: "PRIO", width: 4 },
+            { header: "TOOL", width: 22 },
+            { header: "DESCRIPTION", width: 34 }
+          ],
+          rows: (detail.data?.rules ?? []).slice(0, 10).map((r) => [
+            { value: r.effect, color: r.effect === "ALLOW" ? theme.ok : theme.bad },
+            { value: String(r.priority), dim: true },
+            { value: truncate2(r.toolPattern, 22), color: theme.accent },
+            { value: truncate2(r.description || "\u2014", 34) }
+          ])
+        }
+      )
+    ] }) : null
+  ] }) });
+}
+var init_Policies = __esm({
+  "src/tui/panels/Policies.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+  }
+});
+
+// src/tui/panels/RateLimit.tsx
+import { Box as Box3, Text as Text3, useInput as useInput2 } from "ink";
+import { useEffect as useEffect2, useState as useState3 } from "react";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function RateLimitPanel({ focused }) {
+  const layersQ = useLoader(() => api.settings.getSecurityLayers());
+  const historyQ = useLoader(() => api.settings.getRateLimitHistory());
+  const [draft, setDraft] = useState3(null);
+  const [dirty, setDirty] = useState3(false);
+  const [fi, setFi] = useState3(0);
+  const [status, setStatus] = useState3(null);
+  useEffect2(() => {
+    if (layersQ.data && !draft) setDraft({ ...layersQ.data.layers.rateLimit });
+  }, [layersQ.data, draft]);
+  const adjust = (dir) => {
+    if (!draft) return;
+    const field = FIELDS[fi];
+    if (field === "mode") {
+      const idx = (MODES.indexOf(draft.mode) + dir + MODES.length) % MODES.length;
+      setDraft({ ...draft, mode: MODES[idx] });
+    } else {
+      const step = 10;
+      setDraft({ ...draft, [field]: Math.max(0, draft[field] + dir * step) });
+    }
+    setDirty(true);
+    setStatus(null);
+  };
+  const save = async () => {
+    if (!draft || !layersQ.data) return;
+    setStatus("Saving\u2026");
+    try {
+      const next = { ...layersQ.data.layers, rateLimit: draft };
+      const res = await api.settings.setSecurityLayers(next);
+      setDraft({ ...res.layers.rateLimit });
+      setDirty(false);
+      setStatus("\u2713 Saved");
+      historyQ.reload();
+    } catch (e) {
+      setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
+    }
+  };
+  useInput2(
+    (input, key) => {
+      if (key.upArrow) setFi((n) => (n - 1 + FIELDS.length) % FIELDS.length);
+      else if (key.downArrow) setFi((n) => (n + 1) % FIELDS.length);
+      else if (key.leftArrow) adjust(-1);
+      else if (key.rightArrow) adjust(1);
+      else if (input === "s") void save();
+    },
+    { isActive: focused }
+  );
+  const history = historyQ.data?.history ?? [];
+  return /* @__PURE__ */ jsx3(DataView, { loading: layersQ.loading && !draft, error: layersQ.error, children: draft ? /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 field   \u2190\u2192 change   s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx3(Row, { label: "Mode", active: focused && fi === 0, children: /* @__PURE__ */ jsx3(Text3, { color: modeColor(draft.mode), children: draft.mode }) }),
+      /* @__PURE__ */ jsx3(Row, { label: "Per minute", active: focused && fi === 1, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perMinute }) }),
+      /* @__PURE__ */ jsx3(Row, { label: "Per hour", active: focused && fi === 2, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perHour === 0 ? "off" : draft.perHour }) }),
+      /* @__PURE__ */ jsx3(Row, { label: "Per day", active: focused && fi === 3, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perDay === 0 ? "off" : draft.perDay }) })
+    ] }),
+    history.length ? /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, children: [
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "history " }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.accent, children: sparkline(history.map((h) => h.minute), 40) }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  " + history.length + " changes" })
+    ] }) : null,
+    /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, children: [
+      dirty ? /* @__PURE__ */ jsx3(Text3, { color: theme.warn, children: "\u25CF unsaved \u2014 press s to apply   " }) : null,
+      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+    ] })
+  ] }) : null });
+}
+function Row({ label, active: active2, children }) {
+  return /* @__PURE__ */ jsxs3(Box3, { children: [
+    /* @__PURE__ */ jsx3(Text3, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + label.padEnd(12) }),
+    children
+  ] });
+}
+var MODES, FIELDS;
+var init_RateLimit = __esm({
+  "src/tui/panels/RateLimit.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+    MODES = ["off", "detect", "block"];
+    FIELDS = ["mode", "perMinute", "perHour", "perDay"];
+  }
+});
+
+// src/tui/panels/Dlp.tsx
+import { Box as Box4, Text as Text4, useInput as useInput3 } from "ink";
+import { useEffect as useEffect3, useState as useState4 } from "react";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function DlpPanel({ focused }) {
+  const q = useLoader(() => api.settings.getSecurityLayers());
+  const [dlp, setDlp] = useState4(null);
+  const [available, setAvailable] = useState4([]);
+  const [sel, setSel] = useState4(0);
+  const [status, setStatus] = useState4(null);
+  useEffect3(() => {
+    if (q.data && !dlp) {
+      setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns] });
+      setAvailable(q.data.availablePatterns);
+    }
+  }, [q.data, dlp]);
+  const persist = async (nextDlp) => {
+    if (!q.data) return;
+    setDlp(nextDlp);
+    setStatus("Saving\u2026");
+    try {
+      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp: nextDlp });
+      setDlp({ ...res.layers.dlp, patterns: [...res.layers.dlp.patterns] });
+      setStatus("\u2713 Saved");
+    } catch (e) {
+      setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
+    }
+  };
+  useInput3(
+    (input, key) => {
+      if (!dlp) return;
+      if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.downArrow) setSel((n) => Math.min(available.length - 1, n + 1));
+      else if (input === " " || key.return) {
+        const p = available[sel];
+        if (!p) return;
+        const set = new Set(dlp.patterns);
+        if (set.has(p)) set.delete(p);
+        else set.add(p);
+        void persist({ ...dlp, patterns: [...set] });
+      } else if (input === "m") {
+        const idx = (MODES2.indexOf(dlp.mode) + 1) % MODES2.length;
+        void persist({ ...dlp, mode: MODES2[idx] });
+      }
+    },
+    { isActive: focused }
+  );
+  const enabled = new Set(dlp?.patterns ?? []);
+  return /* @__PURE__ */ jsx4(DataView, { loading: q.loading && !dlp, error: q.error, children: dlp ? /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs4(Box4, { children: [
+      /* @__PURE__ */ jsx4(Text4, { children: "mode: " }),
+      /* @__PURE__ */ jsx4(Text4, { color: modeColor(dlp.mode), children: dlp.mode }),
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: focused ? "   \u2191\u2193 move \xB7 space toggle \xB7 m mode" : "   press \u2192 to edit" })
+    ] }),
+    /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: available.map((p, i) => {
+      const on = enabled.has(p);
+      return /* @__PURE__ */ jsxs4(Text4, { color: focused && i === sel ? theme.accentBright : void 0, bold: focused && i === sel, children: [
+        (focused && i === sel ? "\u25B8 " : "  ") + (on ? "\u25CF " : "\u25CB "),
+        /* @__PURE__ */ jsx4(Text4, { color: on ? theme.ok : theme.dim, children: p })
+      ] }, p);
+    }) }),
+    dlp.custom.length ? /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "Custom:" }),
+      dlp.custom.map((c2) => /* @__PURE__ */ jsxs4(Text4, { children: [
+        "  ",
+        /* @__PURE__ */ jsx4(Text4, { color: theme.accent, children: c2.name }),
+        " ",
+        /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: c2.re })
+      ] }, c2.name))
+    ] }) : null,
+    status ? /* @__PURE__ */ jsx4(Box4, { marginTop: 1, children: /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) }) : null
+  ] }) : null });
+}
+var MODES2;
+var init_Dlp = __esm({
+  "src/tui/panels/Dlp.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+    MODES2 = ["off", "detect", "block"];
+  }
+});
+
+// src/tui/panels/Stats.tsx
+import { Box as Box5, Text as Text5 } from "ink";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+function StatsPanel({ active: active2 }) {
+  const stats = useLoader(() => api.stats.get());
+  const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
+  usePoll(() => {
+    stats.reload();
+    ts.reload();
+  }, 5e3, active2);
+  const s = stats.data;
+  const points = ts.data?.timeseries ?? [];
+  return /* @__PURE__ */ jsx5(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsxs5(Text5, { bold: true, children: [
+        s.total_calls,
+        " "
+      ] }),
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "calls    " }),
+      /* @__PURE__ */ jsxs5(Text5, { color: theme.ok, children: [
+        s.allowed,
+        " allowed"
+      ] }),
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "    " }),
+      /* @__PURE__ */ jsxs5(Text5, { color: theme.bad, children: [
+        s.denied,
+        " denied"
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs5(Text5, { color: theme.dim, children: [
+      s.active_policies,
+      " policies \xB7 ",
+      s.registered_tools,
+      " tools"
+    ] }),
+    /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs5(Text5, { color: theme.dim, children: [
+        "Last 24h ",
+        ts.data ? `(per ${ts.data.granularity})` : ""
+      ] }),
+      /* @__PURE__ */ jsxs5(Box5, { children: [
+        /* @__PURE__ */ jsx5(Text5, { children: "total   " }),
+        /* @__PURE__ */ jsx5(Text5, { color: theme.accent, children: sparkline(points.map((p) => p.total), 64) })
+      ] }),
+      /* @__PURE__ */ jsxs5(Box5, { children: [
+        /* @__PURE__ */ jsx5(Text5, { children: "allowed " }),
+        /* @__PURE__ */ jsx5(Text5, { color: theme.ok, children: sparkline(points.map((p) => p.allowed), 64) })
+      ] }),
+      /* @__PURE__ */ jsxs5(Box5, { children: [
+        /* @__PURE__ */ jsx5(Text5, { children: "denied  " }),
+        /* @__PURE__ */ jsx5(Text5, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 64) })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "Recent" }),
+      /* @__PURE__ */ jsx5(
+        Table,
+        {
+          columns: [
+            { header: "DECISION", width: 9 },
+            { header: "TOOL", width: 20 },
+            { header: "MS", width: 5 },
+            { header: "WHEN", width: 6 }
+          ],
+          rows: (s.recent_activity ?? []).slice(0, 8).map((a) => [
+            { value: a.decision, color: decisionColor(a.decision) },
+            { value: truncate2(a.tool_name, 20), color: theme.accent },
+            { value: String(a.evaluation_time_ms ?? "\u2014"), dim: true },
+            { value: ago(a.created_at), dim: true }
+          ])
+        }
+      )
+    ] })
+  ] }) : null });
+}
+var init_Stats = __esm({
+  "src/tui/panels/Stats.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+  }
+});
+
+// src/tui/panels/Audit.tsx
+import { Box as Box6, Text as Text6, useInput as useInput4 } from "ink";
+import { useState as useState5 } from "react";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function AuditPanel({ active: active2, focused }) {
+  const [fi, setFi] = useState5(0);
+  const filter = FILTERS[fi];
+  const audit = useLoader(() => api.audit.list({ filter, limit: 14 }), [fi]);
+  usePoll(audit.reload, 5e3, active2);
+  useInput4(
+    (input) => {
+      if (input === "f") setFi((n) => (n + 1) % FILTERS.length);
+    },
+    { isActive: focused }
+  );
+  const entries = audit.data?.entries ?? [];
+  return /* @__PURE__ */ jsx6(DataView, { loading: audit.loading && !audit.data, error: audit.error, empty: !!audit.data && entries.length === 0, emptyText: "No audit entries.", children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+      audit.data?.total ?? 0,
+      " entries \xB7 filter: ",
+      /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: filter ?? "all" }),
+      " (press f)"
+    ] }),
+    /* @__PURE__ */ jsx6(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx6(
+      Table,
+      {
+        columns: [
+          { header: "DECISION", width: 9 },
+          { header: "TOOL", width: 18 },
+          { header: "AGENT", width: 14 },
+          { header: "REASON", width: 26 },
+          { header: "DLP", width: 4 },
+          { header: "WHEN", width: 6 }
+        ],
+        rows: entries.map((e) => [
+          { value: e.decision, color: decisionColor(e.decision) },
+          { value: truncate2(e.tool_name, 18), color: theme.accent },
+          { value: truncate2(e.agent_name ?? "\u2014", 14), dim: true },
+          { value: truncate2(e.reason ?? "\u2014", 26) },
+          { value: e.dlp_matches?.length ? String(e.dlp_matches.length) : "0", color: e.dlp_matches?.length ? theme.bad : void 0, dim: !e.dlp_matches?.length },
+          { value: ago(e.created_at), dim: true }
+        ])
+      }
+    ) })
+  ] }) });
+}
+var FILTERS;
+var init_Audit = __esm({
+  "src/tui/panels/Audit.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+    FILTERS = [void 0, "DENY", "ALLOW"];
+  }
+});
+
+// src/tui/panels/Agents.tsx
+import { Box as Box7, Text as Text7 } from "ink";
+import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+function AgentsPanel({ active: active2 }) {
+  const agents = useLoader(() => api.agents.live({ limit: 14 }));
+  usePoll(agents.reload, 4e3, active2);
+  const data = agents.data;
+  const rows = data?.agents ?? [];
+  return /* @__PURE__ */ jsx7(DataView, { loading: agents.loading && !data, error: agents.error, empty: !!data && rows.length === 0, emptyText: "No agent sessions.", children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+    data ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      /* @__PURE__ */ jsxs7(Text7, { color: theme.ok, children: [
+        data.counts.active,
+        " active"
+      ] }),
+      " \xB7 ",
+      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
+        data.counts.idle,
+        " idle"
+      ] }),
+      " \xB7 ",
+      data.counts.deactivated,
+      " off"
+    ] }) : null,
+    /* @__PURE__ */ jsx7(Box7, { marginTop: 1, children: /* @__PURE__ */ jsx7(
+      Table,
+      {
+        columns: [
+          { header: "STATUS", width: 7 },
+          { header: "AGENT", width: 20 },
+          { header: "CALLS", width: 6 },
+          { header: "DENY", width: 5 },
+          { header: "DLP", width: 4 },
+          { header: "TRUST", width: 6 },
+          { header: "CHARACTER", width: 20 }
+        ],
+        rows: rows.map((a) => [
+          { value: a.status, color: modeColor(a.status) },
+          { value: truncate2(a.agent_name ?? a.agent_id ?? a.session_id, 20), color: theme.accent },
+          { value: String(a.total_calls) },
+          { value: String(a.denied_calls), color: a.denied_calls ? theme.bad : void 0, dim: !a.denied_calls },
+          { value: String(a.dlp_events), color: a.dlp_events ? theme.bad : void 0, dim: !a.dlp_events },
+          { value: `${a.trust_score}` },
+          { value: truncate2(a.character || "\u2014", 20), dim: true }
+        ])
+      }
+    ) })
+  ] }) });
+}
+var init_Agents = __esm({
+  "src/tui/panels/Agents.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+  }
+});
+
+// src/tui/App.tsx
+import { Box as Box8, Text as Text8, useApp, useInput as useInput5 } from "ink";
+import { useState as useState6 } from "react";
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function Banner() {
+  const wide = (process.stdout.columns ?? 80) >= 82;
+  if (!wide) {
+    return /* @__PURE__ */ jsxs8(Box8, { children: [
+      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "SolonGate" }),
+      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " \u2014 security control center" })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
+    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx8(Text8, { bold: true, color: BANNER_HEX[i], children: line }, i)),
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
+  ] });
+}
+function App() {
+  const { exit } = useApp();
+  const [section, setSection] = useState6(0);
+  const [focus, setFocus] = useState6("nav");
+  useInput5((input, key) => {
+    if (focus === "nav") {
+      if (key.upArrow) setSection((n) => (n - 1 + SECTIONS.length) % SECTIONS.length);
+      else if (key.downArrow) setSection((n) => (n + 1) % SECTIONS.length);
+      else if (key.rightArrow || key.return || key.tab) setFocus("panel");
+      else if (input === "q") exit();
+    } else {
+      if (key.escape || key.tab) setFocus("nav");
+    }
+  });
+  const current = SECTIONS[section];
+  const Panel = current.Panel;
+  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", paddingX: 1, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx8(Banner, {}),
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, children: [
+      /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx8(Text8, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
+      /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, minHeight: 16, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx8(Panel, { active: true, focused: focus === "panel" }) })
+    ] }),
+    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, children: focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "move"], ["\u2190\u2192/space/s", "edit"], ["esc", "back to menu"]] }) })
+  ] });
+}
+var SECTIONS, BANNER_HEX;
+var init_App = __esm({
+  "src/tui/App.tsx"() {
+    "use strict";
+    init_cli_utils();
+    init_components();
+    init_theme();
+    init_Policies();
+    init_RateLimit();
+    init_Dlp();
+    init_Stats();
+    init_Audit();
+    init_Agents();
+    SECTIONS = [
+      { label: "Policies", Panel: PoliciesPanel },
+      { label: "Rate Limit", Panel: RateLimitPanel },
+      { label: "DLP", Panel: DlpPanel },
+      { label: "Stats", Panel: StatsPanel },
+      { label: "Audit", Panel: AuditPanel },
+      { label: "Agents", Panel: AgentsPanel }
+    ];
+    BANNER_HEX = ["#1432A0", "#2850BE", "#3C6ED7", "#5A8CE6", "#82AAF0", "#AAC8FA"];
+  }
+});
+
+// src/tui/index.tsx
+var tui_exports = {};
+__export(tui_exports, {
+  launchTui: () => launchTui
+});
+import { render } from "ink";
+import { jsx as jsx9 } from "react/jsx-runtime";
+async function launchTui() {
+  if (!process.stdout.isTTY || !process.stdin.isTTY) {
+    process.stderr.write(
+      "The SolonGate TUI needs an interactive terminal.\nUse the scriptable commands instead, e.g. `solongate stats`, `solongate policy list`.\n"
+    );
+    return;
+  }
+  if (!isAuthenticated()) {
+    process.stderr.write("Not logged in. Run `solongate login` first.\n");
+    return;
+  }
+  const { waitUntilExit } = render(/* @__PURE__ */ jsx9(App, {}));
+  await waitUntilExit();
+}
+var init_tui = __esm({
+  "src/tui/index.tsx"() {
+    "use strict";
+    init_App();
+    init_client();
+  }
+});
+
+// src/commands/format.ts
+function printJson(value) {
+  out(JSON.stringify(value, null, 2));
+}
+function decisionColor2(decision) {
+  const d = decision.toUpperCase();
+  if (d === "ALLOW") return green(d);
+  if (d === "DENY" || d === "DENIED") return red(d);
+  return dim(d);
+}
+function table(headers, rows) {
+  const cols = headers.length;
+  const w = new Array(cols).fill(0);
+  for (let i = 0; i < cols; i++) w[i] = width(headers[i] ?? "");
+  for (const row of rows) {
+    for (let i = 0; i < cols; i++) w[i] = Math.max(w[i], width(row[i] ?? ""));
+  }
+  const pad = (s, i) => s + " ".repeat(Math.max(0, w[i] - width(s)));
+  err("  " + headers.map((h, i) => dim(pad(h, i))).join("  "));
+  for (const row of rows) {
+    err("  " + row.map((cell, i) => pad(cell ?? "", i)).join("  "));
+  }
+}
+function truncate3(s, n) {
+  if (s.length <= n) return s;
+  return s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+function sparkline2(values) {
+  if (values.length === 0) return "";
+  const max = Math.max(...values, 0);
+  if (max === 0) return BLOCKS2[0].repeat(values.length);
+  return values.map((v) => BLOCKS2[Math.min(BLOCKS2.length - 1, Math.round(v / max * (BLOCKS2.length - 1)))]).join("");
+}
+var out, err, dim, bold, green, red, yellow, cyan, ANSI, width, BLOCKS2;
+var init_format = __esm({
+  "src/commands/format.ts"() {
+    "use strict";
+    init_cli_utils();
+    out = (s = "") => void process.stdout.write(s + "\n");
+    err = (s = "") => void process.stderr.write(s + "\n");
+    dim = (s) => `${c.dim}${s}${c.reset}`;
+    bold = (s) => `${c.bold}${s}${c.reset}`;
+    green = (s) => `${c.green}${s}${c.reset}`;
+    red = (s) => `${c.red}${s}${c.reset}`;
+    yellow = (s) => `${c.yellow}${s}${c.reset}`;
+    cyan = (s) => `${c.cyan}${s}${c.reset}`;
+    ANSI = /\x1b\[[0-9;]*m/g;
+    width = (s) => s.replace(ANSI, "").length;
+    BLOCKS2 = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
+  }
+});
+
+// src/commands/args.ts
+function parse(argv) {
+  const positionals = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith("--")) {
+      const body = tok.slice(2);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        flags[body] = next;
+        i++;
+      } else {
+        flags[body] = true;
+      }
+    } else {
+      positionals.push(tok);
+    }
+  }
+  return { positionals, flags };
+}
+function flagStr(flags, name) {
+  const v = flags[name];
+  return typeof v === "string" ? v : void 0;
+}
+function flagNum(flags, name) {
+  const v = flagStr(flags, name);
+  if (v === void 0) return void 0;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function flagBool(flags, name) {
+  return flags[name] === true || flags[name] === "true";
+}
+var init_args = __esm({
+  "src/commands/args.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/policy.ts
+import { readFileSync as readFileSync5 } from "fs";
+async function run(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0];
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case void 0:
+    case "help":
+      err(USAGE);
+      return sub ? 0 : 1;
+    case "list": {
+      const { policies } = await api.policies.list();
+      if (json) return printJson(policies), 0;
+      if (policies.length === 0) {
+        err(dim("  No policies. Create one at https://dashboard.solongate.com"));
+        return 0;
+      }
+      table(
+        ["ID", "NAME", "MODE", "RULES", "VER", "UPDATED BY"],
+        policies.map((p) => [
+          cyan(p.id),
+          truncate3(p.name, 28),
+          p.mode === "whitelist" ? green("whitelist") : "denylist",
+          String(p.rules?.length ?? 0),
+          `v${p.version}`,
+          dim(truncate3(p.created_by || "\u2014", 20))
+        ])
+      );
+      return 0;
+    }
+    case "show": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy show <id> [--version N]"), 1;
+      const p = await api.policies.get(id, flagNum(flags, "version"));
+      if (json) return printJson(p), 0;
+      err("");
+      err(`  ${bold(p.name)} ${dim(`(${p.id})`)}  v${p._version}`);
+      if (p.description) err(`  ${dim(p.description)}`);
+      err(`  mode: ${p.mode === "whitelist" ? green("whitelist") : "denylist"}   rules: ${p.rules.length}`);
+      err("");
+      printRules(p.rules);
+      return 0;
+    }
+    case "rules": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy rules <id>"), 1;
+      const p = await api.policies.get(id);
+      if (json) return printJson(p.rules), 0;
+      printRules(p.rules);
+      return 0;
+    }
+    case "allow": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy allow <id> --tool <pattern> [--command|--path|--url <val>]"), 1;
+      const toolPattern = flagStr(flags, "tool") ?? "*";
+      let kind = "tool";
+      let value;
+      for (const k of ["command", "path", "url"]) {
+        const v = flagStr(flags, k);
+        if (v !== void 0) {
+          kind = k;
+          value = v;
+        }
+      }
+      const res = await api.policies.addRule(id, { toolPattern, kind, value });
+      if (json) return printJson(res), 0;
+      if (res.deduped) err(green("  \u2713 ") + dim("Equivalent ALLOW rule already present."));
+      else err(green(`  \u2713 Rule added`) + dim(` (${res.rule?.id}) \u2192 v${res.policy_version}`));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      const ruleId = positionals[2];
+      if (!id || !ruleId) return err("  Usage: policy revoke <id> <ruleId>"), 1;
+      const res = await api.policies.revokeRule(id, ruleId);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Revoked ${ruleId}`) + dim(` \u2192 v${res.policy_version}`));
+      return 0;
+    }
+    case "versions": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy versions <id>"), 1;
+      const { versions: versions2 } = await api.policies.versions(id, { limit: flagNum(flags, "limit") });
+      if (json) return printJson(versions2), 0;
+      table(
+        ["VER", "RULES", "REASON", "BY", "WHEN"],
+        versions2.map((v) => [
+          `v${v.version}`,
+          String(v.rules_count),
+          truncate3(v.reason || "\u2014", 40),
+          dim(truncate3(v.created_by || "\u2014", 18)),
+          dim(v.created_at)
+        ])
+      );
+      return 0;
+    }
+    case "rollback": {
+      const id = positionals[1];
+      const version = Number(positionals[2]);
+      if (!id || !Number.isFinite(version)) return err("  Usage: policy rollback <id> <version>"), 1;
+      const res = await api.policies.rollback(id, version);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Rolled back ${res.policy_id} from v${res.rolled_back_from} \u2192 v${res.version}`));
+      return 0;
+    }
+    case "active": {
+      const a = await api.policies.active();
+      if (json) return printJson(a), 0;
+      if (!a.policy) {
+        err(dim("  No active policy resolves for this project."));
+        return 0;
+      }
+      err("");
+      err(`  Active: ${bold(a.policy.name)} ${dim(`(${a.policy.id})`)}  v${a.version}`);
+      err(`  matched by: ${cyan(a.matched_by ?? "\u2014")}   self-protection: ${a.self_protection_enabled ? green("on") : dim("off")}`);
+      const rl = a.security?.rateLimit;
+      if (rl) err(`  rate limit: ${rl.perMinute}/min  ${rl.perHour}/h  ${rl.perDay}/day`);
+      if (a.security?.dlpBlock) err(`  DLP block: ${a.security.dlpBlock.patterns.length} patterns`);
+      return 0;
+    }
+    case "activate": {
+      if (flagBool(flags, "clear")) {
+        const res2 = await api.policies.setActive(null);
+        if (json) return printJson(res2), 0;
+        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+      }
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      const res = await api.policies.setActive(id);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));
+      return 0;
+    }
+    case "dry-run": {
+      const target = positionals[1];
+      if (!target) return err("  Usage: policy dry-run <id|file.json> [--limit N]"), 1;
+      const rules = await resolveRules(target);
+      const res = await api.policies.dryRun({
+        rules,
+        mode: flagStr(flags, "mode") ?? void 0,
+        limit: flagNum(flags, "limit")
+      });
+      if (json) return printJson(res), 0;
+      err("");
+      err(`  Replayed ${bold(String(res.evaluated))} recent calls against ${rules.length} rule(s)`);
+      err(`  would allow: ${green(String(res.would_allow))}   would deny: ${decisionColor2("DENY")} ${res.would_deny}`);
+      err(`  ${green("newly allowed")}: ${res.newly_allowed}   ${decisionColor2("DENY")}${dim(" newly blocked")}: ${res.newly_blocked}   unchanged: ${res.unchanged}`);
+      if (res.sample_newly_blocked.length) {
+        err(dim("\n  Sample newly-blocked:"));
+        for (const s of res.sample_newly_blocked.slice(0, 8)) err(`    ${decisionColor2("DENY")} ${s.tool}  ${dim(truncate3(s.preview, 50))}`);
+      }
+      return 0;
+    }
+    default:
+      err(`  Unknown: policy ${sub}
+`);
+      err(USAGE);
+      return 1;
+  }
+}
+function printRules(rules) {
+  if (rules.length === 0) return void err(dim("  (no rules)"));
+  table(
+    ["EFFECT", "PRIO", "TOOL", "ID", "DESCRIPTION"],
+    rules.map((r) => [
+      r.effect === "ALLOW" ? green("ALLOW") : decisionColor2("DENY"),
+      String(r.priority),
+      cyan(truncate3(r.toolPattern, 24)),
+      dim(truncate3(r.id, 22)),
+      truncate3(r.description || "\u2014", 40)
+    ])
+  );
+}
+async function resolveRules(target) {
+  if (target.endsWith(".json")) {
+    const parsed = JSON.parse(readFileSync5(target, "utf-8"));
+    return parsed.rules ?? [];
+  }
+  const p = await api.policies.get(target);
+  return p.rules;
+}
+var USAGE;
+var init_policy = __esm({
+  "src/commands/policy.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE = `${bold("solongate policy")} \u2014 manage cloud policies
+
+  policy list                          List all policies
+  policy show <id> [--version N]       Show one policy (rules, mode)
+  policy rules <id>                    List a policy's rules
+  policy allow <id> --tool <p> [--command|--path|--url <val>]
+                                       Append an ALLOW rule
+  policy revoke <id> <ruleId>          Remove a rule
+  policy versions <id>                 List version history
+  policy rollback <id> <version>       Roll back to a version
+  policy active                        Show the resolved active policy
+  policy activate <id> | --clear       Pin / unpin the active policy
+  policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]
+                                       Replay recent traffic against a policy's rules
+
+  Add --json to any read command for machine-readable output.`;
+  }
+});
+
+// src/commands/ratelimit.ts
+async function run2(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE2), 0;
+    case "show": {
+      const [{ layers }, { history }] = await Promise.all([
+        api.settings.getSecurityLayers(),
+        api.settings.getRateLimitHistory()
+      ]);
+      if (json) return printJson({ rateLimit: layers.rateLimit, history }), 0;
+      const rl = layers.rateLimit;
+      err("");
+      err(`  Rate limit   mode: ${modeColor2(rl.mode)}`);
+      err(`  ${bold(String(rl.perMinute))} ${dim("/min")}   ${bold(String(rl.perHour))} ${dim("/hour")}   ${bold(String(rl.perDay))} ${dim("/day")}`);
+      if (history.length) {
+        const spark = sparkline2(history.map((h) => h.minute));
+        err(`  history      ${cyan(spark)} ${dim(`(${history.length} changes, per-min)`)}`);
+      }
+      return 0;
+    }
+    case "history": {
+      const { history } = await api.settings.getRateLimitHistory();
+      if (json) return printJson(history), 0;
+      if (!history.length) return err(dim("  No rate-limit changes recorded.")), 0;
+      table(
+        ["WHEN", "MINUTE", "HOUR", "DAY"],
+        history.map((h) => [dim(new Date(h.ts).toISOString()), String(h.minute), String(h.hour), String(h.day)])
+      );
+      return 0;
+    }
+    case "set": {
+      const minute = flagNum(flags, "minute");
+      const hour = flagNum(flags, "hour");
+      const day = flagNum(flags, "day");
+      const mode = flagStr(flags, "mode");
+      if (minute === void 0 && hour === void 0 && day === void 0 && !mode) {
+        return err("  Usage: ratelimit set --minute N [--hour N] [--day N] [--mode off|detect|block]"), 1;
+      }
+      const { layers } = await api.settings.getSecurityLayers();
+      const next = {
+        ...layers,
+        rateLimit: {
+          mode: mode ?? layers.rateLimit.mode,
+          perMinute: minute ?? layers.rateLimit.perMinute,
+          perHour: hour ?? layers.rateLimit.perHour,
+          perDay: day ?? layers.rateLimit.perDay
+        }
+      };
+      const res = await api.settings.setSecurityLayers(next);
+      if (json) return printJson(res.layers.rateLimit), 0;
+      const r = res.layers.rateLimit;
+      err(green("  \u2713 Rate limit updated") + dim(`  ${r.perMinute}/min ${r.perHour}/h ${r.perDay}/day  (${r.mode})`));
+      return 0;
+    }
+    default:
+      return err(USAGE2), 1;
+  }
+}
+var USAGE2, modeColor2;
+var init_ratelimit = __esm({
+  "src/commands/ratelimit.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE2 = `${bold("solongate ratelimit")} \u2014 request throttling
+
+  ratelimit show                       Current limits + change history
+  ratelimit set --minute N [--hour N] [--day N] [--mode off|detect|block]
+  ratelimit history                    Recent limit changes
+
+  Add --json for machine-readable output.`;
+    modeColor2 = (m) => m === "block" ? green(m) : m === "detect" ? yellow(m) : dim(m);
+  }
+});
+
+// src/commands/dlp.ts
+async function run3(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  const { layers, availablePatterns } = await api.settings.getSecurityLayers();
+  const save = async (next) => (await api.settings.setSecurityLayers(next)).layers;
+  switch (sub) {
+    case "help":
+      return err(USAGE3), 0;
+    case "show": {
+      if (json) return printJson({ dlp: layers.dlp, availablePatterns }), 0;
+      err("");
+      err(`  DLP   mode: ${modeColor3(layers.dlp.mode)}`);
+      const enabled = new Set(layers.dlp.patterns);
+      table(
+        ["", "PATTERN"],
+        availablePatterns.map((p) => [enabled.has(p) ? green("\u25CF") : dim("\u25CB"), enabled.has(p) ? p : dim(p)])
+      );
+      if (layers.dlp.custom.length) {
+        err(dim("\n  Custom:"));
+        for (const c2 of layers.dlp.custom) err(`    ${cyan(c2.name)}  ${dim(c2.re)}`);
+      }
+      return 0;
+    }
+    case "mode": {
+      const mode = positionals[1];
+      if (!mode || !["off", "detect", "block"].includes(mode)) return err("  Usage: dlp mode <off|detect|block>"), 1;
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, mode } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 DLP mode \u2192 ${saved.dlp.mode}`)), 0;
+    }
+    case "enable":
+    case "disable": {
+      const pattern = positionals.slice(1).join(" ");
+      if (!pattern) return err(`  Usage: dlp ${sub} <pattern>`), 1;
+      if (!availablePatterns.includes(pattern)) {
+        err(`  Unknown pattern: "${pattern}". Available:`);
+        for (const p of availablePatterns) err(`    ${dim("\u2022")} ${p}`);
+        return 1;
+      }
+      const set = new Set(layers.dlp.patterns);
+      if (sub === "enable") set.add(pattern);
+      else set.delete(pattern);
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, patterns: [...set] } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 ${sub}d "${pattern}"`) + dim(` (${saved.dlp.patterns.length} active)`)), 0;
+    }
+    case "add-custom": {
+      const name = flagStr(flags, "name");
+      const re = flagStr(flags, "re");
+      if (!name || !re) return err("  Usage: dlp add-custom --name <name> --re <regex>"), 1;
+      const custom = [...layers.dlp.custom.filter((c2) => c2.name !== name), { name, re }];
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, custom } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 Custom pattern "${name}" added`)), 0;
+    }
+    case "remove-custom": {
+      const name = positionals.slice(1).join(" ");
+      if (!name) return err("  Usage: dlp remove-custom <name>"), 1;
+      const custom = layers.dlp.custom.filter((c2) => c2.name !== name);
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, custom } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 Removed custom pattern "${name}"`)), 0;
+    }
+    default:
+      return err(USAGE3), 1;
+  }
+}
+var USAGE3, modeColor3;
+var init_dlp = __esm({
+  "src/commands/dlp.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE3 = `${bold("solongate dlp")} \u2014 data-loss prevention
+
+  dlp show                             Current mode + enabled patterns
+  dlp mode <off|detect|block>          Set enforcement mode
+  dlp enable <pattern>                 Enable a built-in pattern
+  dlp disable <pattern>                Disable a built-in pattern
+  dlp add-custom --name X --re <regex> Add a custom pattern
+  dlp remove-custom <name>             Remove a custom pattern
+
+  Add --json for machine-readable output.`;
+    modeColor3 = (m) => m === "block" ? green(m) : m === "detect" ? yellow(m) : dim(m);
+  }
+});
+
+// src/commands/stats.ts
+async function run4(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "overview";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE4), 0;
+    case "overview": {
+      const s = await api.stats.get();
+      if (json) return printJson(s), 0;
+      err("");
+      err(`  ${bold(String(s.total_calls))} calls   ${green(String(s.allowed))} allowed   ${red(String(s.denied))} denied`);
+      err(`  ${dim(`${s.active_policies} active policies \xB7 ${s.registered_tools} tools`)}`);
+      if (s.recent_activity.length) {
+        err(dim("\n  Recent:"));
+        table(
+          ["DECISION", "TOOL", "TRUST", "MS", "WHEN"],
+          s.recent_activity.map((a) => [
+            decisionColor2(a.decision),
+            cyan(truncate3(a.tool_name, 24)),
+            dim(a.trust_level),
+            String(a.evaluation_time_ms ?? "\u2014"),
+            dim(a.created_at)
+          ])
+        );
+      }
+      return 0;
+    }
+    case "timeseries": {
+      const period = flagStr(flags, "period") ?? "24h";
+      const ts = await api.stats.timeseries({ period });
+      if (json) return printJson(ts), 0;
+      const pts = ts.timeseries;
+      err("");
+      err(`  Timeseries ${dim(`(${ts.period}, per ${ts.granularity})`)}`);
+      err(`  total    ${cyan(sparkline2(pts.map((p) => p.total)))}  ${dim(`max ${Math.max(0, ...pts.map((p) => p.total))}`)}`);
+      err(`  allowed  ${green(sparkline2(pts.map((p) => p.allowed)))}`);
+      err(`  denied   ${red(sparkline2(pts.map((p) => p.denied)))}`);
+      return 0;
+    }
+    case "drift": {
+      const d = await api.stats.drift(flagNum(flags, "days"));
+      if (json) return printJson(d), 0;
+      err("");
+      err(`  Denial drift ${dim(`(${d.days}d: ${d.total_current} now vs ${d.total_previous} prev)`)}`);
+      if (!d.rules.length) return err(dim("  No denials in window.")), 0;
+      table(
+        ["NOW", "PREV", "\u0394", "RULE", "REASON"],
+        d.rules.slice(0, 20).map((r) => [
+          bold(String(r.current)),
+          dim(String(r.previous)),
+          r.is_new ? green("NEW") : r.spike ? red(`+${r.delta}`) : String(r.delta),
+          cyan(truncate3(r.rule_id ?? "\u2014", 22)),
+          truncate3(r.reason ?? r.last_tool ?? "\u2014", 36)
+        ])
+      );
+      return 0;
+    }
+    default:
+      return err(USAGE4), 1;
+  }
+}
+var USAGE4;
+var init_stats2 = __esm({
+  "src/commands/stats.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE4 = `${bold("solongate stats")} \u2014 traffic & security stats
+
+  stats                                Overview (totals, recent activity)
+  stats timeseries [--period 24h|7d|30d|all]
+  stats drift [--days N]               Denials rising/falling vs previous window
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/audit.ts
+async function run5(argv) {
+  const { positionals, flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  if (positionals[0] === "help") return err(USAGE5), 0;
+  if (positionals[0] === "whitelist") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit whitelist <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.whitelist(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent ALLOW already present."));
+    else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
+  const query = {
+    filter: flagStr(flags, "filter"),
+    tool: flagStr(flags, "tool"),
+    signal: flagStr(flags, "signal"),
+    search: flagStr(flags, "search"),
+    agent_name: flagStr(flags, "agent-name"),
+    limit: flagNum(flags, "limit") ?? 30
+  };
+  const res = await api.audit.list(query);
+  if (json) return printJson(res), 0;
+  err("");
+  err(`  ${bold(String(res.total))} matching entries ${dim(`(showing ${res.entries.length})`)}`);
+  if (!res.entries.length) return 0;
+  table(
+    ["DECISION", "TOOL", "AGENT", "REASON", "DLP", "WHEN", "ID"],
+    res.entries.map((e) => [
+      decisionColor2(e.decision),
+      cyan(truncate3(e.tool_name, 22)),
+      dim(truncate3(e.agent_name ?? "\u2014", 16)),
+      truncate3(e.reason ?? "\u2014", 30),
+      e.dlp_matches?.length ? red(String(e.dlp_matches.length)) : dim("0"),
+      dim(e.created_at),
+      dim(truncate3(e.id, 10))
+    ])
+  );
+  return 0;
+}
+var USAGE5;
+var init_audit2 = __esm({
+  "src/commands/audit.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE5 = `${bold("solongate audit")} \u2014 audit log
+
+  audit [--filter ALLOW|DENY] [--tool <substr>] [--signal dlp|ratelimit]
+        [--search <text>] [--agent-name <name>] [--limit N]
+  audit whitelist <logId> [--scope exact|tool]
+                                       Turn a denied call into an ALLOW rule
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/agents.ts
+async function runAgents(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const res = await api.agents.live({ limit: flagNum(flags, "limit"), includeDeactivated: flagBool(flags, "all") });
+  if (json) return printJson(res), 0;
+  err("");
+  err(`  Agents   ${green(String(res.counts.active))} active   ${yellow(String(res.counts.idle))} idle   ${dim(String(res.counts.deactivated) + " off")}`);
+  if (!res.agents.length) return err(dim("  No agent sessions.")), 0;
+  table(
+    ["STATUS", "AGENT", "CALLS", "DENY", "DLP", "TRUST", "CHARACTER"],
+    res.agents.map((a) => [
+      statusColor(a.status),
+      cyan(truncate3(a.agent_name ?? a.agent_id ?? a.session_id, 20)),
+      String(a.total_calls),
+      a.denied_calls ? red(String(a.denied_calls)) : dim("0"),
+      a.dlp_events ? red(String(a.dlp_events)) : dim("0"),
+      `${a.trust_score}`,
+      dim(truncate3(a.character || "\u2014", 22))
+    ])
+  );
+  return 0;
+}
+async function runAgent(argv) {
+  const { positionals, flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const id = positionals[0];
+  if (!id) return err("  Usage: solongate agent <agent_id> [--json]"), 1;
+  const a = await api.agents.get(id);
+  if (json) return printJson(a), 0;
+  err("");
+  err(`  ${bold(a.agent_id)}   status: ${statusColor(String(a.status))}`);
+  const base = a.baseline;
+  if (base) {
+    err(`  ${dim(base.character ?? "")}   trust ${bold(String(base.trustScore ?? "\u2014"))}/100   deny-rate ${(Number(base.denyRate ?? 0) * 100).toFixed(0)}%`);
+  }
+  const feed = a.recent_feed ?? [];
+  if (feed.length) {
+    err(dim("\n  Recent:"));
+    table(
+      ["DECISION", "TOOL", "REASON", "WHEN"],
+      feed.slice(0, 15).map((f) => [
+        f.decision === "ALLOW" ? green("ALLOW") : red(String(f.decision)),
+        cyan(truncate3(String(f.tool), 22)),
+        truncate3(String(f.reason ?? "\u2014"), 30),
+        dim(String(f.created_at))
+      ])
+    );
+  }
+  return 0;
+}
+var statusColor;
+var init_agents2 = __esm({
+  "src/commands/agents.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    statusColor = (s) => s === "active" ? green(s) : s === "idle" ? yellow(s) : dim(s);
+  }
+});
+
+// src/commands/index.ts
+var commands_exports = {};
+__export(commands_exports, {
+  COMMAND_NAMES: () => COMMAND_NAMES,
+  runCommand: () => runCommand
+});
+async function dispatch(command, argv) {
+  switch (command) {
+    case "policy":
+      return run(argv);
+    case "ratelimit":
+      return run2(argv);
+    case "dlp":
+      return run3(argv);
+    case "stats":
+      return run4(argv);
+    case "audit":
+      return run5(argv);
+    case "agents":
+      return runAgents(argv);
+    case "agent":
+      return runAgent(argv);
+    default:
+      err(`  Unknown command: ${command}`);
+      return 1;
+  }
+}
+async function runCommand(command, argv) {
+  try {
+    return await dispatch(command, argv);
+  } catch (e) {
+    if (e instanceof NotAuthenticatedError) {
+      err(red("  \u2717 ") + e.message);
+      return 1;
+    }
+    if (e instanceof ApiError) {
+      err(red("  \u2717 ") + `${e.message}` + (e.status ? ` (${e.status})` : ""));
+      return 1;
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    err(red("  \u2717 ") + msg);
+    return 1;
+  }
+}
+var COMMAND_NAMES;
+var init_commands = __esm({
+  "src/commands/index.ts"() {
+    "use strict";
+    init_api_client();
+    init_format();
+    init_policy();
+    init_ratelimit();
+    init_dlp();
+    init_stats2();
+    init_audit2();
+    init_agents2();
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+  }
+});
+
 // src/global-install.ts
 var global_install_exports = {};
 __export(global_install_exports, {
@@ -6580,9 +8303,9 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync4 } from "fs";
-import { resolve as resolve3, join as join4, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
+import { resolve as resolve4, join as join5, dirname } from "path";
+import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -6645,10 +8368,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join4(p.hooksDir, "guard.mjs"),
-    join4(p.hooksDir, "audit.mjs"),
-    join4(p.hooksDir, "stop.mjs"),
-    join4(p.hooksDir, "shield.mjs"),
+    join5(p.hooksDir, "guard.mjs"),
+    join5(p.hooksDir, "audit.mjs"),
+    join5(p.hooksDir, "stop.mjs"),
+    join5(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -6660,26 +8383,26 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir2();
-  const sgDir = join4(home, ".solongate");
-  const hooksDir = join4(sgDir, "hooks");
-  const claudeDir = join4(home, ".claude");
+  const home = homedir3();
+  const sgDir = join5(home, ".solongate");
+  const hooksDir = join5(sgDir, "hooks");
+  const claudeDir = join5(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join4(claudeDir, "settings.json"),
-    backupPath: join4(claudeDir, "settings.solongate.bak"),
-    configPath: join4(sgDir, "cloud-guard.json")
+    settingsPath: join5(claudeDir, "settings.json"),
+    backupPath: join5(claudeDir, "settings.solongate.bak"),
+    configPath: join5(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync5(join4(HOOKS_DIR, filename), "utf-8");
+  return readFileSync6(join5(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync5(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join5(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -6693,11 +8416,11 @@ function runGlobalRestore() {
   unlockProtected();
   removeClaudeShim();
   if (existsSync4(p.backupPath)) {
-    writeFileSync3(p.settingsPath, readFileSync5(p.backupPath, "utf-8"));
+    writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
   } else if (existsSync4(p.settingsPath)) {
     try {
-      const s = JSON.parse(readFileSync5(p.settingsPath, "utf-8"));
+      const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
       delete s.hooks;
       writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
@@ -6714,12 +8437,12 @@ function escapeRe(s) {
 function resolveRealClaude() {
   try {
     const finder = process.platform === "win32" ? "where" : "which";
-    const out = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
     if (process.platform === "win32") {
       const low = (s) => s.toLowerCase();
-      return out.find((l) => low(l).endsWith(".cmd")) || out.find((l) => low(l).endsWith(".exe")) || out.find((l) => low(l).endsWith(".bat")) || out[0] || null;
+      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
     }
-    return out[0] || null;
+    return out2[0] || null;
   } catch {
     return null;
   }
@@ -6733,17 +8456,17 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync4(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join5(homedir3(), f)).filter((f) => existsSync4(f));
 }
 function writeShimBlock(file, block) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync5(file, "utf-8") : "";
+  let content = existsSync4(file) ? readFileSync6(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block + "\n";
   }
-  mkdirSync4(dirname2(file), { recursive: true });
+  mkdirSync3(dirname(file), { recursive: true });
   writeFileSync3(file, content);
 }
 function installClaudeShim(shieldPath) {
@@ -6788,7 +8511,7 @@ async function runGlobalInstall(opts = {}) {
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
   if (!apiKey || apiKey === "sg_live_your_key_here") {
     try {
-      const cfg = JSON.parse(readFileSync5(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync6(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
     } catch {
     }
@@ -6801,20 +8524,20 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync4(p.hooksDir, { recursive: true });
-  mkdirSync4(p.claudeDir, { recursive: true });
+  mkdirSync3(p.hooksDir, { recursive: true });
+  mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync3(join5(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join5(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join5(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join5(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
   if (existsSync4(p.settingsPath)) {
-    const raw = readFileSync5(p.settingsPath, "utf-8");
+    const raw = readFileSync6(p.settingsPath, "utf-8");
     if (!existsSync4(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
@@ -6825,9 +8548,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join4(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join4(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join5(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join5(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join5(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const merged = {
     ...existing,
@@ -6851,8 +8574,8 @@ var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
-    __dirname = dirname2(fileURLToPath(import.meta.url));
-    HOOKS_DIR = resolve3(__dirname, "..", "hooks");
+    __dirname = dirname(fileURLToPath(import.meta.url));
+    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
     SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
     SHIM_END = "# <<< SolonGate shield <<<";
   }
@@ -7001,8 +8724,8 @@ var init_login = __esm({
     init_global_install();
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
     SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-    main().catch((err) => {
-      console.log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+    main().catch((err2) => {
+      console.log(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
     });
   }
@@ -7017,21 +8740,21 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn2 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync6, existsSync as existsSync5, readdirSync, statSync } from "fs";
-import { resolve as resolve4 } from "path";
-import { homedir as homedir3 } from "os";
+import { readFileSync as readFileSync7, existsSync as existsSync5, readdirSync, statSync } from "fs";
+import { resolve as resolve5 } from "path";
+import { homedir as homedir4 } from "os";
 function findCacheFile() {
-  const dir = resolve4(homedir3(), ".solongate");
+  const dir = resolve5(homedir4(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
-    const f = resolve4(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
+    const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
     if (existsSync5(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
     for (const name of readdirSync(dir)) {
       if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
-        const full = resolve4(dir, name);
+        const full = resolve5(dir, name);
         const ts = statSync(full).mtimeMs;
         if (ts > bestTs) {
           bestTs = ts;
@@ -7047,9 +8770,9 @@ function loadCfg() {
   try {
     const f = findCacheFile();
     if (f && existsSync5(f)) {
-      const c3 = JSON.parse(readFileSync6(f, "utf-8"));
-      const d = c3?.security?.dlpRedact;
-      const g = c3?.security?.ghost;
+      const c2 = JSON.parse(readFileSync7(f, "utf-8"));
+      const d = c2?.security?.dlpRedact;
+      const g = c2?.security?.ghost;
       const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
       if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
       return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
@@ -7061,15 +8784,15 @@ function loadCfg() {
 function ghostGlobToRegExp(glob) {
   let re = "";
   for (let i = 0; i < glob.length; i++) {
-    const c3 = glob[i];
-    if (c3 === "*") {
+    const c2 = glob[i];
+    if (c2 === "*") {
       if (glob[i + 1] === "*") {
         re += ".*";
         i++;
       } else re += "[^/]*";
-    } else if (c3 === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c3) !== -1) re += "\\" + c3;
-    else re += c3;
+    } else if (c2 === "?") re += "[^/]";
+    else if ("\\^$.|+()[]{}".indexOf(c2) !== -1) re += "\\" + c2;
+    else re += c2;
   }
   try {
     return new RegExp("^" + re + "$");
@@ -7160,31 +8883,31 @@ function dlpGlobToRe(glob, flags) {
 function redactString(s, cfg) {
   if (!cfg || typeof s !== "string" || !s) return s;
   const allow = new Set(cfg.patterns);
-  let out = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out = out.replace(p.re, `[REDACTED: ${p.name}]`);
-  for (const c3 of cfg.custom) {
+  let out2 = s;
+  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, `[REDACTED: ${p.name}]`);
+  for (const c2 of cfg.custom) {
     try {
-      out = out.replace(dlpGlobToRe(c3.re, "g"), `[REDACTED: ${c3.name || "custom"}]`);
+      out2 = out2.replace(dlpGlobToRe(c2.re, "g"), `[REDACTED: ${c2.name || "custom"}]`);
     } catch {
     }
   }
-  return out;
+  return out2;
 }
 function redactDeep(value, cfg) {
   const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
   if (typeof value === "string") {
-    let out = redactString(value, cfg);
-    if (ghost && ghost.length) out = ghostStripLines(out, ghost);
-    return out;
+    let out2 = redactString(value, cfg);
+    if (ghost && ghost.length) out2 = ghostStripLines(out2, ghost);
+    return out2;
   }
   if (Array.isArray(value)) {
     const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
     return arr.map((v) => redactDeep(v, cfg));
   }
   if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, cfg);
-    return out;
+    const out2 = {};
+    for (const [k, v] of Object.entries(value)) out2[k] = redactDeep(v, cfg);
+    return out2;
   }
   return value;
 }
@@ -7201,7 +8924,7 @@ function startProxy(upstream) {
   const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
   const server = createServer((req, res) => {
     const chunks = [];
-    req.on("data", (c3) => chunks.push(c3));
+    req.on("data", (c2) => chunks.push(c2));
     req.on("end", () => {
       let body = Buffer.concat(chunks);
       try {
@@ -7323,9 +9046,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { resolve as resolve5, join as join5, isAbsolute } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { resolve as resolve6, join as join6, isAbsolute } from "path";
+import { homedir as homedir5 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -7342,16 +9065,16 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve5(homedir4(), ".solongate", "local-logs");
+  return resolve6(homedir5(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve5(homedir4(), ".solongate");
+  const base = resolve6(homedir5(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c3 = JSON.parse(readFileSync7(join5(base, f), "utf-8"));
-        const p = c3?.security?.localLogs?.path;
+        const c2 = JSON.parse(readFileSync8(join6(base, f), "utf-8"));
+        const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
       }
@@ -7359,7 +9082,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync7(join5(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync8(join6(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -7388,7 +9111,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join5(dir, LOG_FILENAME);
+  const file = join6(dir, LOG_FILENAME);
   try {
     const st = statSync2(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -7449,7 +9172,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync7(info.file, "utf-8");
+        const text = readFileSync8(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -7479,12 +9202,12 @@ async function runLogsServer() {
     process.stdout.write(`[SolonGate] Keep this running; the dashboard reads your logs live from here. Ctrl+C to stop.
 `);
   });
-  server.on("error", (err) => {
-    if (err.code === "EADDRINUSE") {
+  server.on("error", (err2) => {
+    if (err2.code === "EADDRINUSE") {
       process.stderr.write(`[SolonGate] Port ${port} is already in use. Pass --port <n> or set SOLONGATE_LOGS_PORT.
 `);
     } else {
-      process.stderr.write(`[SolonGate] Local logs agent error: ${err.message}
+      process.stderr.write(`[SolonGate] Local logs agent error: ${err2.message}
 `);
     }
     process.exit(1);
@@ -7501,8 +9224,8 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, existsSync as existsSync7, copyFileSync } from "fs";
-import { resolve as resolve6 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
   const args = argv.slice(2);
@@ -7559,9 +9282,9 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync7(resolve6("package.json"))) return false;
+  if (!existsSync6(resolve7("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -7570,18 +9293,18 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
-        if (existsSync7(resolve6(binPath))) return resolve6(binPath);
+        if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
+        if (existsSync6(resolve7(binPath))) return resolve7(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
+      if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
     }
   } catch {
   }
@@ -7593,11 +9316,11 @@ function findTsEntryFile() {
     "server.ts",
     "main.ts"
   ];
-  for (const c3 of candidates) {
-    const full = resolve6(c3);
-    if (existsSync7(full)) {
+  for (const c2 of candidates) {
+    const full = resolve7(c2);
+    if (existsSync6(full)) {
       try {
-        const content = readFileSync8(full, "utf-8");
+        const content = readFileSync9(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -7605,19 +9328,19 @@ function findTsEntryFile() {
       }
     }
   }
-  for (const c3 of candidates) {
-    if (existsSync7(resolve6(c3))) return resolve6(c3);
+  for (const c2 of candidates) {
+    if (existsSync6(resolve7(c2))) return resolve7(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync7(resolve6("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync7(resolve6("yarn.lock"))) return "yarn";
+  if (existsSync6(resolve7("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync6(resolve7("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync8(resolve6("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/proxy"]) {
       log3("  @solongate/proxy already installed");
@@ -7631,14 +9354,14 @@ function installSdk() {
   try {
     execSync(cmd, { stdio: "pipe", cwd: process.cwd() });
     return true;
-  } catch (err) {
-    log3(`  Failed to install: ${err instanceof Error ? err.message : String(err)}`);
+  } catch (err2) {
+    log3(`  Failed to install: ${err2 instanceof Error ? err2.message : String(err2)}`);
     log3("  You can install manually: npm install @solongate/proxy");
     return false;
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync8(filePath, "utf-8");
+  const original = readFileSync9(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -7754,8 +9477,8 @@ async function main2() {
     process.exit(1);
   }
   log3("  Language: TypeScript");
-  const entryFile = opts.file ? resolve6(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync7(entryFile)) {
+  const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
+  if (!entryFile || !existsSync6(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -7768,7 +9491,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync7(backupPath)) {
+    if (!existsSync6(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -7804,7 +9527,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync7(backupPath)) {
+  if (!existsSync6(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -7829,8 +9552,8 @@ var init_inject = __esm({
   "src/inject.ts"() {
     "use strict";
     init_cli_utils();
-    main2().catch((err) => {
-      log3(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+    main2().catch((err2) => {
+      log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
     });
   }
@@ -7838,8 +9561,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
-import { resolve as resolve7, join as join6 } from "path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { resolve as resolve8, join as join7 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -7854,11 +9577,11 @@ function withSpinner(message, fn) {
     process.stderr.write(`\r  ${c.green}\u2713${c.reset} ${message}${" ".repeat(20)}
 `);
     return result;
-  } catch (err) {
+  } catch (err2) {
     clearInterval(id);
     process.stderr.write(`\r  ${c.red}\u2717${c.reset} ${message} \u2014 failed${" ".repeat(10)}
 `);
-    throw err;
+    throw err2;
   }
 }
 function parseCreateArgs(argv) {
@@ -7919,7 +9642,7 @@ EXAMPLES
 }
 function createProject(dir, name, _policy) {
   writeFileSync5(
-    join6(dir, "package.json"),
+    join7(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -7949,7 +9672,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   writeFileSync5(
-    join6(dir, "tsconfig.json"),
+    join7(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -7969,9 +9692,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync5(join6(dir, "src"), { recursive: true });
+  mkdirSync4(join7(dir, "src"), { recursive: true });
   writeFileSync5(
-    join6(dir, "src", "index.ts"),
+    join7(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -8013,7 +9736,7 @@ console.log('Press Ctrl+C to stop.');
 `
   );
   writeFileSync5(
-    join6(dir, ".mcp.json"),
+    join7(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -8031,12 +9754,12 @@ console.log('Press Ctrl+C to stop.');
     ) + "\n"
   );
   writeFileSync5(
-    join6(dir, ".env"),
+    join7(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
   writeFileSync5(
-    join6(dir, ".gitignore"),
+    join7(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -8048,14 +9771,14 @@ dist/
 }
 async function main3() {
   const opts = parseCreateArgs(process.argv);
-  const dir = resolve7(opts.name);
+  const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync8(dir)) {
+  if (existsSync7(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -8120,8 +9843,8 @@ var init_create = __esm({
   "src/create.ts"() {
     "use strict";
     init_cli_utils();
-    main3().catch((err) => {
-      log3(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
+    main3().catch((err2) => {
+      log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
     });
   }
@@ -8129,14 +9852,14 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8 } from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
-  const envPath = resolve8(".env");
-  if (!existsSync9(envPath)) return;
+  const envPath = resolve9(".env");
+  if (!existsSync8(envPath)) return;
   try {
-    const content = readFileSync9(envPath, "utf-8");
+    const content = readFileSync10(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -8178,7 +9901,7 @@ function parseCliArgs() {
     }
   }
   if (!apiKey) {
-    log5(red("ERROR: API key not found."));
+    log5(red2("ERROR: API key not found."));
     log5("");
     log5("Set it in .env file:");
     log5("  SOLONGATE_API_KEY=sg_live_...");
@@ -8188,10 +9911,10 @@ function parseCliArgs() {
     process.exit(1);
   }
   if (!apiKey.startsWith("sg_live_")) {
-    log5(red("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
+    log5(red2("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
     process.exit(1);
   }
-  return { command, apiKey, file: resolve8(file), policyId };
+  return { command, apiKey, file: resolve9(file), policyId };
 }
 async function listPolicies(apiKey) {
   const res = await fetch(`${API_URL}/api/v1/policies`, {
@@ -8201,21 +9924,21 @@ async function listPolicies(apiKey) {
   const data = await res.json();
   return data.policies ?? [];
 }
-async function list(apiKey, policyId) {
+async function list3(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
-    log5(yellow("No policies found. Create one in the dashboard first."));
-    log5(dim("  https://dashboard.solongate.com/policies"));
+    log5(yellow2("No policies found. Create one in the dashboard first."));
+    log5(dim2("  https://dashboard.solongate.com/policies"));
     return;
   }
   if (policyId) {
     const match = policies.find((p) => p.id === policyId);
     if (!match) {
-      log5(red(`Policy not found: ${policyId}`));
+      log5(red2(`Policy not found: ${policyId}`));
       log5("");
       log5("Available policies:");
       for (const p of policies) {
-        log5(`  ${dim("\u2022")} ${p.id}`);
+        log5(`  ${dim2("\u2022")} ${p.id}`);
       }
       process.exit(1);
     }
@@ -8224,8 +9947,8 @@ async function list(apiKey, policyId) {
     return;
   }
   log5("");
-  log5(bold(`  Policies (${policies.length})`));
-  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5(bold2(`  Policies (${policies.length})`));
+  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   log5("");
   const fullPolicies = await Promise.all(
     policies.map(
@@ -8233,115 +9956,115 @@ async function list(apiKey, policyId) {
     )
   );
   for (const { policy, rules } of fullPolicies) {
-    printPolicySummary(policy, rules);
+    printPolicySummary(policy, [...rules]);
   }
-  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   log5("");
-  log5(`  ${dim("View details:")}  solongate-proxy list --policy-id <ID>`);
-  log5(`  ${dim("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
-  log5(`  ${dim("Push policy:")}   solongate-proxy push --policy-id <ID>`);
+  log5(`  ${dim2("View details:")}  solongate-proxy list --policy-id <ID>`);
+  log5(`  ${dim2("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
+  log5(`  ${dim2("Push policy:")}   solongate-proxy push --policy-id <ID>`);
   log5("");
 }
 function printPolicySummary(p, rules) {
   const ruleCount = rules.length;
   const allowCount = rules.filter((r) => r.effect === "ALLOW").length;
   const denyCount = rules.filter((r) => r.effect === "DENY").length;
-  log5(`  ${cyan(p.id)}`);
-  log5(`    ${bold(p.name)}  ${dim(`v${p.version ?? "?"}`)}`);
-  log5(`    ${dim("Rules:")} ${ruleCount}  ${green(`${allowCount} ALLOW`)}  ${red(`${denyCount} DENY`)}`);
+  log5(`  ${cyan2(p.id)}`);
+  log5(`    ${bold2(p.name)}  ${dim2(`v${p.version ?? "?"}`)}`);
+  log5(`    ${dim2("Rules:")} ${ruleCount}  ${green2(`${allowCount} ALLOW`)}  ${red2(`${denyCount} DENY`)}`);
   if (p.created_at) {
-    log5(`    ${dim("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
+    log5(`    ${dim2("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
   }
   log5("");
 }
 function printPolicyDetail(policy) {
   log5("");
-  log5(bold(`  ${policy.name}`));
-  log5(`  ${dim("ID:")} ${cyan(policy.id)}  ${dim("Version:")} ${policy.version}  ${dim("Rules:")} ${policy.rules.length}`);
+  log5(bold2(`  ${policy.name}`));
+  log5(`  ${dim2("ID:")} ${cyan2(policy.id)}  ${dim2("Version:")} ${policy.version}  ${dim2("Rules:")} ${policy.rules.length}`);
   log5("");
   if (policy.rules.length === 0) {
-    log5(yellow("  No rules defined."));
+    log5(yellow2("  No rules defined."));
     log5("");
     return;
   }
-  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   for (const rule of policy.rules) {
-    const effectColor = rule.effect === "ALLOW" ? green : red;
+    const effectColor = rule.effect === "ALLOW" ? green2 : red2;
     log5("");
-    log5(`  ${effectColor(rule.effect.padEnd(5))}  ${bold(rule.toolPattern)}  ${dim(`P:${rule.priority}`)}`);
+    log5(`  ${effectColor(rule.effect.padEnd(5))}  ${bold2(rule.toolPattern)}  ${dim2(`P:${rule.priority}`)}`);
     if (rule.description) {
-      log5(`         ${dim(rule.description)}`);
+      log5(`         ${dim2(rule.description)}`);
     }
-    log5(`         ${dim(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
+    log5(`         ${dim2(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
     if (rule.pathConstraints) {
       const pc = rule.pathConstraints;
       if (pc.rootDirectory) log5(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
-      if (pc.allowed?.length) log5(`         ${green("PATHS")} ${pc.allowed.join(", ")}`);
-      if (pc.denied?.length) log5(`         ${red("DENY")}  ${pc.denied.join(", ")}`);
+      if (pc.allowed?.length) log5(`         ${green2("PATHS")} ${pc.allowed.join(", ")}`);
+      if (pc.denied?.length) log5(`         ${red2("DENY")}  ${pc.denied.join(", ")}`);
     }
     if (rule.commandConstraints) {
       const cc = rule.commandConstraints;
-      if (cc.allowed?.length) log5(`         ${green("CMDS")}  ${cc.allowed.join(", ")}`);
-      if (cc.denied?.length) log5(`         ${red("DENY")}  ${cc.denied.join(", ")}`);
+      if (cc.allowed?.length) log5(`         ${green2("CMDS")}  ${cc.allowed.join(", ")}`);
+      if (cc.denied?.length) log5(`         ${red2("DENY")}  ${cc.denied.join(", ")}`);
     }
     if (rule.filenameConstraints) {
       const fc = rule.filenameConstraints;
-      if (fc.allowed?.length) log5(`         ${green("FILES")} ${fc.allowed.join(", ")}`);
-      if (fc.denied?.length) log5(`         ${red("DENY")}  ${fc.denied.join(", ")}`);
+      if (fc.allowed?.length) log5(`         ${green2("FILES")} ${fc.allowed.join(", ")}`);
+      if (fc.denied?.length) log5(`         ${red2("DENY")}  ${fc.denied.join(", ")}`);
     }
     if (rule.urlConstraints) {
       const uc = rule.urlConstraints;
-      if (uc.allowed?.length) log5(`         ${green("URLS")}  ${uc.allowed.join(", ")}`);
-      if (uc.denied?.length) log5(`         ${red("DENY")}  ${uc.denied.join(", ")}`);
+      if (uc.allowed?.length) log5(`         ${green2("URLS")}  ${uc.allowed.join(", ")}`);
+      if (uc.denied?.length) log5(`         ${red2("DENY")}  ${uc.denied.join(", ")}`);
     }
   }
   log5("");
-  log5(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   log5("");
 }
 async function pull(apiKey, file, policyId) {
   if (!policyId) {
     const policies = await listPolicies(apiKey);
     if (policies.length === 0) {
-      log5(red("No policies found. Create one in the dashboard first."));
+      log5(red2("No policies found. Create one in the dashboard first."));
       process.exit(1);
     }
     if (policies.length === 1) {
       policyId = policies[0].id;
-      log5(dim(`Auto-selecting only policy: ${policyId}`));
+      log5(dim2(`Auto-selecting only policy: ${policyId}`));
     } else {
-      log5(yellow(`Found ${policies.length} policies:`));
+      log5(yellow2(`Found ${policies.length} policies:`));
       log5("");
       for (const p of policies) {
-        log5(`  ${cyan(p.id)}  ${p.name}  ${dim(`v${p.version ?? "?"}`)}`);
+        log5(`  ${cyan2(p.id)}  ${p.name}  ${dim2(`v${p.version ?? "?"}`)}`);
       }
       log5("");
       log5("Use --policy-id <ID> to specify which one to pull.");
       process.exit(1);
     }
   }
-  log5(`Pulling ${cyan(policyId)} from dashboard...`);
+  log5(`Pulling ${cyan2(policyId)} from dashboard...`);
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
   writeFileSync6(file, json, "utf-8");
   log5("");
-  log5(green("  Saved to: ") + file);
-  log5(`  ${dim("Name:")}    ${policy.name}`);
-  log5(`  ${dim("Version:")} ${policy.version}`);
-  log5(`  ${dim("Rules:")}   ${policy.rules.length}`);
+  log5(green2("  Saved to: ") + file);
+  log5(`  ${dim2("Name:")}    ${policy.name}`);
+  log5(`  ${dim2("Version:")} ${policy.version}`);
+  log5(`  ${dim2("Rules:")}   ${policy.rules.length}`);
   log5("");
-  log5(dim("The policy file does not contain an ID."));
-  log5(dim("Use --policy-id to specify the target when pushing/pulling."));
+  log5(dim2("The policy file does not contain an ID."));
+  log5(dim2("Use --policy-id to specify the target when pushing/pulling."));
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync9(file)) {
-    log5(red(`ERROR: File not found: ${file}`));
+  if (!existsSync8(file)) {
+    log5(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
   if (!policyId) {
-    log5(red("ERROR: --policy-id is required for push."));
+    log5(red2("ERROR: --policy-id is required for push."));
     log5("");
     log5("This determines which cloud policy to update.");
     log5("");
@@ -8353,18 +10076,18 @@ async function push(apiKey, file, policyId) {
     log5("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync9(file, "utf-8");
+  const content = readFileSync10(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);
   } catch {
-    log5(red(`ERROR: Invalid JSON in ${file}`));
+    log5(red2(`ERROR: Invalid JSON in ${file}`));
     process.exit(1);
   }
-  log5(`Pushing to ${cyan(policyId)}...`);
-  log5(`  ${dim("File:")}  ${file}`);
-  log5(`  ${dim("Name:")}  ${policy.name || "Unnamed"}`);
-  log5(`  ${dim("Rules:")} ${(policy.rules || []).length}`);
+  log5(`Pushing to ${cyan2(policyId)}...`);
+  log5(`  ${dim2("File:")}  ${file}`);
+  log5(`  ${dim2("Name:")}  ${policy.name || "Unnamed"}`);
+  log5(`  ${dim2("Rules:")} ${(policy.rules || []).length}`);
   const checkRes = await fetch(`${API_URL}/api/v1/policies/${policyId}`, {
     headers: { "Authorization": `Bearer ${apiKey}` }
   });
@@ -8386,14 +10109,14 @@ async function push(apiKey, file, policyId) {
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
-    log5(red(`ERROR: Push failed (${res.status}): ${body}`));
+    log5(red2(`ERROR: Push failed (${res.status}): ${body}`));
     process.exit(1);
   }
   const data = await res.json();
   log5("");
-  log5(green(`  Pushed to cloud: v${data._version ?? "created"}`));
-  log5(`  ${dim("Policy ID:")} ${policyId}`);
-  log5(`  ${dim("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
+  log5(green2(`  Pushed to cloud: v${data._version ?? "created"}`));
+  log5(`  ${dim2("Policy ID:")} ${policyId}`);
+  log5(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
   log5("");
 }
 async function main4() {
@@ -8404,41 +10127,41 @@ async function main4() {
     } else if (command === "push") {
       await push(apiKey, file, policyId);
     } else if (command === "list" || command === "ls") {
-      await list(apiKey, policyId);
+      await list3(apiKey, policyId);
     } else {
-      log5(red(`Unknown command: ${command}`));
+      log5(red2(`Unknown command: ${command}`));
       log5("");
-      log5(bold("Usage:"));
+      log5(bold2("Usage:"));
       log5("  solongate-proxy list                          List all policies");
       log5("  solongate-proxy list --policy-id <ID>         Show policy details");
       log5("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
       log5("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
       log5("");
-      log5(bold("Flags:"));
+      log5(bold2("Flags:"));
       log5("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
       log5("  --file, -f <path>         Local file path (default: policy.json)");
       log5("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
       log5("");
       process.exit(1);
     }
-  } catch (err) {
-    log5(red(`ERROR: ${err instanceof Error ? err.message : String(err)}`));
+  } catch (err2) {
+    log5(red2(`ERROR: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 }
-var log5, dim, bold, green, red, yellow, cyan, magenta, API_URL;
+var log5, dim2, bold2, green2, red2, yellow2, cyan2, magenta, API_URL;
 var init_pull_push = __esm({
   "src/pull-push.ts"() {
     "use strict";
     init_config();
     log5 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
 `);
-    dim = (s) => `\x1B[2m${s}\x1B[0m`;
-    bold = (s) => `\x1B[1m${s}\x1B[0m`;
-    green = (s) => `\x1B[32m${s}\x1B[0m`;
-    red = (s) => `\x1B[31m${s}\x1B[0m`;
-    yellow = (s) => `\x1B[33m${s}\x1B[0m`;
-    cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+    dim2 = (s) => `\x1B[2m${s}\x1B[0m`;
+    bold2 = (s) => `\x1B[1m${s}\x1B[0m`;
+    green2 = (s) => `\x1B[32m${s}\x1B[0m`;
+    red2 = (s) => `\x1B[31m${s}\x1B[0m`;
+    yellow2 = (s) => `\x1B[33m${s}\x1B[0m`;
+    cyan2 = (s) => `\x1B[36m${s}\x1B[0m`;
     magenta = (s) => `\x1B[35m${s}\x1B[0m`;
     API_URL = "https://api.solongate.com";
     main4();
@@ -8467,7 +10190,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { createServer as createHttpServer } from "http";
 import { resolve as resolve2, join as join3 } from "path";
-import { mkdirSync as mkdirSync3, appendFileSync } from "fs";
+import { mkdirSync as mkdirSync2, appendFileSync } from "fs";
 
 // src/core/errors.ts
 var SolonGateError = class extends Error {
@@ -9343,12 +11066,12 @@ function looksLikeFilename(s) {
 }
 
 // src/policy-engine/opa/request-adapter.ts
-function toOpaInput(request) {
-  const args = request.arguments ?? {};
+function toOpaInput(request2) {
+  const args = request2.arguments ?? {};
   return {
-    tool_name: request.toolName,
-    permission: request.requiredPermission ?? "",
-    trust_level: request.context.trustLevel,
+    tool_name: request2.toolName,
+    permission: request2.requiredPermission ?? "",
+    trust_level: request2.context.trustLevel,
     arguments: args,
     paths: extractPathArguments(args),
     commands: extractCommandArguments(args),
@@ -9421,12 +11144,12 @@ var OpaEvaluator = class {
   // Evaluates an execution request against the loaded OPA policy.
   // Returns a PolicyDecision matching the same interface as the legacy evaluator,
   // ensuring full backward compatibility.
-  evaluate(request) {
+  evaluate(request2) {
     if (!this.policy || !this.initialized) {
       throw new Error("OPA policy not loaded. Call loadBundle() or loadWasm() first.");
     }
     const startTime = performance.now();
-    const input = toOpaInput(request);
+    const input = toOpaInput(request2);
     const results = this.policy.evaluate(input);
     const endTime = performance.now();
     const decision = results?.[0]?.result;
@@ -9496,11 +11219,11 @@ var PolicyEngine = class {
   // Never throws for denials - denial is a normal outcome, not an error.
   // OPA WASM is the only evaluator. If no WASM bundle is loaded, evaluation
   // fails CLOSED (default DENY) — there is no legacy fallback.
-  evaluate(request) {
+  evaluate(request2) {
     const startTime = performance.now();
     let decision;
     if (this.opaEvaluator?.isReady()) {
-      decision = this.opaEvaluator.evaluate(request);
+      decision = this.opaEvaluator.evaluate(request2);
     } else {
       decision = {
         effect: DEFAULT_POLICY_EFFECT,
@@ -9513,7 +11236,7 @@ var PolicyEngine = class {
     const elapsed = performance.now() - startTime;
     if (elapsed > this.timeoutMs) {
       console.warn(
-        `[SolonGate] Policy evaluation took ${elapsed.toFixed(1)}ms (limit: ${this.timeoutMs}ms) for tool "${request.toolName}"`
+        `[SolonGate] Policy evaluation took ${elapsed.toFixed(1)}ms (limit: ${this.timeoutMs}ms) for tool "${request2.toolName}"`
       );
     }
     return decision;
@@ -9677,7 +11400,7 @@ var PolicyStore = class {
 
 // src/policy-engine/opa/rego-compiler.ts
 import { execFileSync } from "child_process";
-import { writeFileSync, readFileSync as readFileSync2, mkdirSync as mkdirSync2, rmSync } from "fs";
+import { writeFileSync, readFileSync as readFileSync2, mkdirSync, rmSync } from "fs";
 import { join as join2 } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
@@ -9776,7 +11499,7 @@ async function interceptToolCall(params, upstreamCall, options) {
   const requestId = randomUUID2();
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
   const context = createSecurityContext({ requestId });
-  const request = {
+  const request2 = {
     context,
     toolName: params.name,
     serverName: "default",
@@ -9793,7 +11516,7 @@ async function interceptToolCall(params, upstreamCall, options) {
       if (!toolLimit.allowed) {
         const result = {
           status: "ERROR",
-          request,
+          request: request2,
           error: new RateLimitError(params.name, options.rateLimitPerTool),
           timestamp
         };
@@ -9810,7 +11533,7 @@ async function interceptToolCall(params, upstreamCall, options) {
       if (!globalLimit.allowed) {
         const result = {
           status: "ERROR",
-          request,
+          request: request2,
           error: new RateLimitError("*", options.globalRateLimitPerMinute),
           timestamp
         };
@@ -9823,7 +11546,7 @@ async function interceptToolCall(params, upstreamCall, options) {
     if (options.exfiltrationTracker.detectChain(params.name)) {
       const result = {
         status: "DENIED",
-        request,
+        request: request2,
         decision: {
           effect: "DENY",
           matchedRule: null,
@@ -9840,11 +11563,11 @@ async function interceptToolCall(params, upstreamCall, options) {
     }
     options.exfiltrationTracker.record(params.name);
   }
-  const decision = options.policyEngine.evaluate(request);
+  const decision = options.policyEngine.evaluate(request2);
   if (decision.effect === "DENY") {
     const result = {
       status: "DENIED",
-      request,
+      request: request2,
       decision,
       timestamp
     };
@@ -9894,7 +11617,7 @@ ${item.text}`;
     }
     const result = {
       status: "ALLOWED",
-      request,
+      request: request2,
       decision,
       toolResult: finalResult,
       durationMs,
@@ -9905,7 +11628,7 @@ ${item.text}`;
   } catch (error) {
     const result = {
       status: "ERROR",
-      request,
+      request: request2,
       error: error instanceof Error ? new PolicyDeniedError(params.name, error.message) : new PolicyDeniedError(params.name, "Unknown upstream error"),
       timestamp
     };
@@ -10170,8 +11893,8 @@ var ServerVerifier = class {
   /**
    * Validates a complete signed request including timestamp, nonce, and signature.
    */
-  validateSignedRequest(request) {
-    const requestTime = new Date(request.timestamp).getTime();
+  validateSignedRequest(request2) {
+    const requestTime = new Date(request2.timestamp).getTime();
     const now = Date.now();
     if (isNaN(requestTime)) {
       return { valid: false, reason: "Invalid timestamp" };
@@ -10182,13 +11905,13 @@ var ServerVerifier = class {
     if (requestTime > now + 3e4) {
       return { valid: false, reason: "Request timestamp in the future" };
     }
-    if (this.usedNonces.has(request.nonce)) {
+    if (this.usedNonces.has(request2.nonce)) {
       return { valid: false, reason: "Duplicate nonce (replay detected)" };
     }
-    if (!this.verifySignature(request.params, request.capabilityToken, request.signature)) {
+    if (!this.verifySignature(request2.params, request2.capabilityToken, request2.signature)) {
       return { valid: false, reason: "Invalid signature" };
     }
-    this.usedNonces.add(request.nonce);
+    this.usedNonces.add(request2.nonce);
     return { valid: true };
   }
 };
@@ -10450,9 +12173,9 @@ var SolonGate = class {
         throw new LicenseError("Your subscription is inactive. Renew at https://solongate.com");
       }
       this.licenseValidated = true;
-    } catch (err) {
-      if (err instanceof LicenseError) throw err;
-      console.warn("[SolonGate] License validation failed (network error), allowing through:", err instanceof Error ? err.message : String(err));
+    } catch (err2) {
+      if (err2 instanceof LicenseError) throw err2;
+      console.warn("[SolonGate] License validation failed (network error), allowing through:", err2 instanceof Error ? err2.message : String(err2));
       this.licenseValidated = true;
     }
   }
@@ -10501,10 +12224,10 @@ var SolonGate = class {
       }
       const wasmBytes = new Uint8Array(await res.arrayBuffer());
       await this.policyEngine.loadWasmBundle(wasmBytes);
-    } catch (err) {
+    } catch (err2) {
       console.warn(
         "[SolonGate] Failed to load policy WASM bundle:",
-        err instanceof Error ? err.message : String(err)
+        err2 instanceof Error ? err2.message : String(err2)
       );
     }
   }
@@ -10719,8 +12442,8 @@ var PolicySyncManager = class {
         this.debounceTimer = setTimeout(() => this.onFileChange(filePath), 300);
       });
       log(`Watching ${filePath} for changes`);
-    } catch (err) {
-      log(`File watch failed: ${err instanceof Error ? err.message : String(err)}`);
+    } catch (err2) {
+      log(`File watch failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
   }
   /**
@@ -10751,12 +12474,12 @@ var PolicySyncManager = class {
           const result = await this.pushToCloud(newPolicy);
           this.cloudVersion = result.version;
           log(`Pushed to cloud: v${result.version}`);
-        } catch (err) {
-          log(`Cloud push failed: ${err instanceof Error ? err.message : String(err)}`);
+        } catch (err2) {
+          log(`Cloud push failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
         }
       }
-    } catch (err) {
-      log(`File read error: ${err instanceof Error ? err.message : String(err)}`);
+    } catch (err2) {
+      log(`File read error: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
   }
   /**
@@ -10845,8 +12568,8 @@ var PolicySyncManager = class {
       const { id: _id, ...rest } = policy;
       const json = JSON.stringify(rest, null, 2) + "\n";
       writeFileSync2(this.localPath, json, "utf-8");
-    } catch (err) {
-      log(`File write error: ${err instanceof Error ? err.message : String(err)}`);
+    } catch (err2) {
+      log(`File write error: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
   }
   /**
@@ -10870,7 +12593,7 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const timer = setTimeout(() => {
         const idx = this.queue.indexOf(onReady);
         if (idx !== -1) this.queue.splice(idx, 1);
@@ -10878,7 +12601,7 @@ var Mutex = class {
       }, timeoutMs);
       const onReady = () => {
         clearTimeout(timer);
-        resolve9();
+        resolve10();
       };
       this.queue.push(onReady);
     });
@@ -10914,8 +12637,6 @@ var SolonGateProxy = class {
   /** Agent identity for trust map — resolved from CLI flag, HTTP headers, or MCP clientInfo */
   agentId = null;
   agentName = null;
-  /** Per-session agent info for HTTP mode (keyed by session ID) */
-  httpAgentInfo = /* @__PURE__ */ new Map();
   /** Per-request sub-agent info from HTTP headers (transient, overwritten per request) */
   httpSubAgent = null;
   constructor(config) {
@@ -10949,8 +12670,8 @@ var SolonGateProxy = class {
     return { id: raw.toLowerCase().replace(/\s+/g, "-"), name: raw };
   }
   /** Extract sub-agent identity from MCP _meta field */
-  extractSubAgent(request) {
-    const meta = request?.params?._meta;
+  extractSubAgent(request2) {
+    const meta = request2?.params?._meta;
     if (meta && typeof meta === "object") {
       const solonMeta = meta["io.solongate/agent"];
       if (solonMeta && typeof solonMeta === "object") {
@@ -10994,9 +12715,9 @@ var SolonGateProxy = class {
             process.exit(1);
           }
           log2("License validated.");
-        } catch (err) {
+        } catch (err2) {
           log2(`ERROR: Unable to reach SolonGate license server. Check your internet connection.`);
-          log2(`Details: ${err instanceof Error ? err.message : String(err)}`);
+          log2(`Details: ${err2 instanceof Error ? err2.message : String(err2)}`);
           process.exit(1);
         }
       }
@@ -11005,8 +12726,8 @@ var SolonGateProxy = class {
           const cloudPolicy = await fetchCloudPolicy(this.config.apiKey, apiUrl, this.config.policyId);
           this.config.policy = cloudPolicy;
           log2(`Loaded cloud policy: ${cloudPolicy.name} (${cloudPolicy.rules.length} rules)`);
-        } catch (err) {
-          log2(`Cloud policy fetch failed, using local policy: ${err instanceof Error ? err.message : String(err)}`);
+        } catch (err2) {
+          log2(`Cloud policy fetch failed, using local policy: ${err2 instanceof Error ? err2.message : String(err2)}`);
         }
       }
     }
@@ -11121,7 +12842,7 @@ var SolonGateProxy = class {
             pid: process.pid
           };
           const debugDir = resolve2(".solongate");
-          mkdirSync3(debugDir, { recursive: true });
+          mkdirSync2(debugDir, { recursive: true });
           appendFileSync(join3(debugDir, ".debug-proxy"), JSON.stringify(debugInfo) + "\n");
         } catch {
         }
@@ -11140,9 +12861,9 @@ var SolonGateProxy = class {
     });
     const MAX_ARGUMENT_SIZE = 1024 * 1024;
     const MUTEX_TIMEOUT_MS = 3e4;
-    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
-      const { name, arguments: args } = request.params;
-      const subAgent = this.extractSubAgent(request) || this.httpSubAgent;
+    this.server.setRequestHandler(CallToolRequestSchema, async (request2) => {
+      const { name, arguments: args } = request2.params;
+      const subAgent = this.extractSubAgent(request2) || this.httpSubAgent;
       const argsSize = TEXT_ENCODER.encode(JSON.stringify(args ?? {})).length;
       if (argsSize > MAX_ARGUMENT_SIZE) {
         log2(`DENY: ${name} \u2014 payload size ${argsSize} exceeds limit ${MAX_ARGUMENT_SIZE}`);
@@ -11226,9 +12947,9 @@ var SolonGateProxy = class {
         return { resources: [] };
       }
     });
-    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+    this.server.setRequestHandler(ReadResourceRequestSchema, async (request2) => {
       if (!this.client) throw new Error("Upstream client disconnected");
-      const uri = request.params.uri;
+      const uri = request2.params.uri;
       log2(`Resource read: ${uri}`);
       const resourceResult = await this.client.readResource({ uri });
       if (resourceResult.contents) {
@@ -11263,12 +12984,12 @@ ${content.text}`;
         return { prompts: [] };
       }
     });
-    this.server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+    this.server.setRequestHandler(GetPromptRequestSchema, async (request2) => {
       if (!this.client) throw new Error("Upstream client disconnected");
-      const args = request.params.arguments;
-      log2(`Prompt get: ${request.params.name}`);
+      const args = request2.params.arguments;
+      log2(`Prompt get: ${request2.params.name}`);
       const promptResult = await this.client.getPrompt({
-        name: request.params.name,
+        name: request2.params.name,
         arguments: args
       });
       if (promptResult.messages) {
@@ -11277,7 +12998,7 @@ ${content.text}`;
             const scan = scanResponse(msg.content.text);
             if (!scan.safe) {
               const threats = scan.threats.map((t) => t.type).join(", ");
-              log2(`WARNING prompt response: ${request.params.name} \u2014 ${threats}`);
+              log2(`WARNING prompt response: ${request2.params.name} \u2014 ${threats}`);
               msg.content.text = `${RESPONSE_WARNING_MARKER}
 
 ${msg.content.text}`;
@@ -11383,8 +13104,8 @@ ${msg.content.text}`;
         const body = await res.text().catch(() => "");
         log2(`MCP server registration failed (${res.status}): ${body}`);
       }
-    }).catch((err) => {
-      log2(`MCP server registration error: ${err instanceof Error ? err.message : String(err)}`);
+    }).catch((err2) => {
+      log2(`MCP server registration error: ${err2 instanceof Error ? err2.message : String(err2)}`);
     });
   }
   /**
@@ -11397,33 +13118,6 @@ ${msg.content.text}`;
   /**
    * Extract protected filenames from policy DENY rules (filenameConstraints.denied).
    */
-  extractProtectedFiles() {
-    const files = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.filenameConstraints?.denied;
-        if (denied) {
-          for (const f of denied) files.add(f);
-        }
-      }
-    }
-    return [...files];
-  }
-  /**
-   * Extract protected paths from policy DENY rules (pathConstraints.denied).
-   */
-  extractProtectedPaths() {
-    const paths = /* @__PURE__ */ new Set();
-    for (const rule of this.config.policy.rules) {
-      if (rule.effect === "DENY" && rule.enabled !== false) {
-        const denied = rule.pathConstraints?.denied;
-        if (denied) {
-          for (const p of denied) paths.add(p);
-        }
-      }
-    }
-    return [...paths];
-  }
   startPolicySync() {
     const apiKey = this.config.apiKey;
     if (!apiKey) return;
@@ -11498,7 +13192,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "ui", "dashboard", "tui"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -11533,9 +13227,26 @@ function printWelcome() {
 async function main5() {
   const subcommand = process.argv[2];
   if (process.argv.length <= 2) {
+    const { isAuthenticated: isAuthenticated2 } = await Promise.resolve().then(() => (init_client(), client_exports));
+    if (process.stdout.isTTY && isAuthenticated2()) {
+      const { launchTui: launchTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
+      await launchTui2();
+      return;
+    }
     printWelcome();
     return;
   }
+  if (subcommand === "ui" || subcommand === "dashboard" || subcommand === "tui") {
+    const { launchTui: launchTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
+    await launchTui2();
+    return;
+  }
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"]);
+  if (MGMT_COMMANDS.has(subcommand ?? "")) {
+    const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    const code = await runCommand2(subcommand, process.argv.slice(3));
+    process.exit(code);
+  }
   if (subcommand === "login") {
     await Promise.resolve().then(() => (init_login(), login_exports));
     return;
@@ -11573,8 +13284,8 @@ async function main5() {
     const config = parseArgs(process.argv);
     const proxy = new SolonGateProxy(config);
     await proxy.start();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+  } catch (err2) {
+    const message = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(`[SolonGate] Fatal: ${message}
 `);
     process.exit(1);