@solongate/proxy 0.61.0 → 0.62.0

package/dist/tui/index.js

@@ -124,9 +124,8 @@ function KeyHints({ hints }) {
   ] }, i)) });
 }
 
-// src/tui/panels/Policies.tsx
-import { Box as Box2, Text as Text2, useInput } from "ink";
-import { useEffect as useEffect2, useState as useState2 } from "react";
+// src/tui/panels/Live.tsx
+import { Box as Box2, Text as Text2 } from "ink";
 
 // src/api-client/client.ts
 import { readFileSync, existsSync } from "fs";
@@ -429,16 +428,113 @@ function usePoll(reload, intervalMs, enabled = true) {
   }, [reload, intervalMs, enabled]);
 }
 
-// src/tui/panels/Policies.tsx
+// src/tui/panels/Live.tsx
 import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function Tile({ label, value, color }) {
+  return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", borderStyle: "round", borderColor: "gray", paddingX: 1, marginRight: 1, minWidth: 14, children: [
+    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: label }),
+    /* @__PURE__ */ jsx2(Text2, { bold: true, color, children: value })
+  ] });
+}
+function LivePanel({ active: active2 }) {
+  const stats = useLoader(() => api.stats.get());
+  const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
+  const feed = useLoader(() => api.audit.list({ limit: 12 }));
+  usePoll(() => {
+    stats.reload();
+    ts.reload();
+    feed.reload();
+  }, 2e3, active2);
+  const s = stats.data;
+  const points = ts.data?.timeseries ?? [];
+  const entries = feed.data?.entries ?? [];
+  const denyRate = s && s.total_calls > 0 ? Math.round(s.denied / s.total_calls * 100) : 0;
+  return /* @__PURE__ */ jsx2(DataView, { loading: stats.loading && !s, error: stats.error, children: /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs2(Box2, { children: [
+      /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "\u25CF" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " LIVE \xB7 refreshing every 2s" })
+    ] }),
+    s ? /* @__PURE__ */ jsxs2(Box2, { marginTop: 1, children: [
+      /* @__PURE__ */ jsx2(Tile, { label: "total calls", value: String(s.total_calls) }),
+      /* @__PURE__ */ jsx2(Tile, { label: "allowed", value: String(s.allowed), color: theme.ok }),
+      /* @__PURE__ */ jsx2(Tile, { label: "denied", value: String(s.denied), color: theme.bad }),
+      /* @__PURE__ */ jsx2(Tile, { label: "deny rate", value: denyRate + "%", color: denyRate > 10 ? theme.bad : void 0 }),
+      /* @__PURE__ */ jsx2(Tile, { label: "policies", value: String(s.active_policies), color: theme.accent })
+    ] }) : null,
+    /* @__PURE__ */ jsxs2(Box2, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "Activity \xB7 24h" }),
+      /* @__PURE__ */ jsxs2(Box2, { children: [
+        /* @__PURE__ */ jsx2(Text2, { children: "calls   " }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: sparkline(points.map((p) => p.total), 60) })
+      ] }),
+      /* @__PURE__ */ jsxs2(Box2, { children: [
+        /* @__PURE__ */ jsx2(Text2, { children: "denied  " }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 60) })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs2(Box2, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "Live feed" }),
+      entries.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "  waiting for tool calls\u2026" }) : entries.slice(0, 10).map((e) => /* @__PURE__ */ jsxs2(Box2, { children: [
+        /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), children: e.decision.padEnd(8) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate(e.tool_name, 16).padEnd(17) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: truncate(e.agent_name ?? "\u2014", 14).padEnd(15) }),
+        e.dlp_matches?.length ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "DLP " }) : /* @__PURE__ */ jsx2(Text2, { children: "    " }),
+        /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+          ago(e.created_at),
+          " ago"
+        ] })
+      ] }, e.id))
+    ] })
+  ] }) });
+}
+
+// src/tui/panels/Policies.tsx
+import { Box as Box3, Text as Text3, useInput } from "ink";
+import TextInput from "ink-text-input";
+import { useEffect as useEffect2, useState as useState2 } from "react";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+var constr = (r, g, side) => (r[g]?.[side] ?? []).join(", ");
+var setConstr = (r, g, side, val) => {
+  const arr = val.split(",").map((s) => s.trim()).filter(Boolean);
+  const prev = r[g] ?? {};
+  return { ...r, [g]: { ...prev, [side]: arr } };
+};
+var FIELDS = [
+  { label: "Effect", kind: "effect", get: (r) => r.effect },
+  { label: "Enabled", kind: "enabled", get: (r) => r.enabled ? "yes" : "no" },
+  { label: "Priority", kind: "priority", get: (r) => String(r.priority) },
+  { label: "Tool pattern", kind: "text", get: (r) => r.toolPattern, set: (r, v) => ({ ...r, toolPattern: v || "*" }) },
+  { label: "Description", kind: "text", get: (r) => r.description ?? "", set: (r, v) => ({ ...r, description: v }) },
+  { label: "Cmd allow", kind: "text", get: (r) => constr(r, "commandConstraints", "allowed"), set: (r, v) => setConstr(r, "commandConstraints", "allowed", v) },
+  { label: "Cmd deny", kind: "text", get: (r) => constr(r, "commandConstraints", "denied"), set: (r, v) => setConstr(r, "commandConstraints", "denied", v) },
+  { label: "Path allow", kind: "text", get: (r) => constr(r, "pathConstraints", "allowed"), set: (r, v) => setConstr(r, "pathConstraints", "allowed", v) },
+  { label: "Path deny", kind: "text", get: (r) => constr(r, "pathConstraints", "denied"), set: (r, v) => setConstr(r, "pathConstraints", "denied", v) },
+  { label: "File allow", kind: "text", get: (r) => constr(r, "filenameConstraints", "allowed"), set: (r, v) => setConstr(r, "filenameConstraints", "allowed", v) },
+  { label: "File deny", kind: "text", get: (r) => constr(r, "filenameConstraints", "denied"), set: (r, v) => setConstr(r, "filenameConstraints", "denied", v) },
+  { label: "URL allow", kind: "text", get: (r) => constr(r, "urlConstraints", "allowed"), set: (r, v) => setConstr(r, "urlConstraints", "allowed", v) },
+  { label: "URL deny", kind: "text", get: (r) => constr(r, "urlConstraints", "denied"), set: (r, v) => setConstr(r, "urlConstraints", "denied", v) }
+];
+function ruleSummary(r) {
+  const bits = [];
+  for (const [g, tag] of [["commandConstraints", "cmd"], ["pathConstraints", "path"], ["filenameConstraints", "file"], ["urlConstraints", "url"]]) {
+    const c2 = r[g];
+    const n = (c2?.allowed?.length ?? 0) + (c2?.denied?.length ?? 0);
+    if (n) bits.push(`${tag}:${n}`);
+  }
+  return bits.join(" ");
+}
 function PoliciesPanel({ focused }) {
   const list3 = useLoader(() => api.policies.list());
   const policies = list3.data?.policies ?? [];
   const [view, setView] = useState2("list");
   const [pi, setPi] = useState2(0);
   const [ri, setRi] = useState2(0);
-  const [rules, setRules] = useState2(null);
+  const [fi, setFi] = useState2(0);
+  const [rules, setRules] = useState2([]);
   const [mode, setMode] = useState2("denylist");
+  const [dirty, setDirty] = useState2(false);
+  const [editing, setEditing] = useState2(false);
+  const [editVal, setEditVal] = useState2("");
   const [status, setStatus] = useState2(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
@@ -446,28 +542,44 @@ function PoliciesPanel({ focused }) {
     if (detail.data) {
       setRules(detail.data.rules);
       setMode(detail.data.mode ?? "denylist");
+      setDirty(false);
       setRi(0);
     }
   }, [detail.data]);
-  const persist = async (nextRules, nextMode) => {
-    if (!detail.data || !selected) return;
+  const mutate = (nextRules, nextMode = mode) => {
+    setRules(nextRules);
+    setMode(nextMode);
+    setDirty(true);
+    setStatus(null);
+  };
+  const save = async () => {
+    if (!selected || !detail.data) return;
     setStatus("Saving\u2026");
     try {
       const res = await api.policies.update(selected.id, {
         id: selected.id,
         name: detail.data.name,
         description: detail.data.description,
-        mode: nextMode,
+        mode,
         agents: detail.data.agents,
-        rules: nextRules
+        rules
       });
       setRules(res.rules);
+      setDirty(false);
       setStatus("\u2713 Saved v" + res._version);
       list3.reload();
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
   };
+  const discard = () => {
+    if (detail.data) {
+      setRules(detail.data.rules);
+      setMode(detail.data.mode ?? "denylist");
+    }
+    setDirty(false);
+    setStatus("discarded");
+  };
   useInput(
     (input, key) => {
       if (view === "list") {
@@ -475,44 +587,61 @@ function PoliciesPanel({ focused }) {
         else if (key.downArrow) setPi((n) => Math.min(policies.length - 1, n + 1));
         else if (key.return || key.rightArrow) {
           setStatus(null);
-          setView("detail");
+          setView("rules");
         }
         return;
       }
-      const rs2 = rules ?? [];
-      if (key.leftArrow) {
-        setView("list");
-        setStatus(null);
-      } else if (key.upArrow) setRi((n) => Math.max(0, n - 1));
-      else if (key.downArrow) setRi((n) => Math.min(rs2.length - 1, n + 1));
-      else if (input === " " || input === "e") {
-        if (!rs2[ri]) return;
-        const next = rs2.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r);
-        setRules(next);
-        void persist(next, mode);
-      } else if (input === "d") {
-        const target = rs2[ri];
-        if (!target || !selected) return;
-        setStatus("Deleting\u2026");
-        void api.policies.revokeRule(selected.id, target.id).then(() => {
-          setStatus("\u2713 Deleted");
-          detail.reload();
-          list3.reload();
-        }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
-      } else if (input === "m") {
-        const nm = mode === "denylist" ? "whitelist" : "denylist";
-        setMode(nm);
-        void persist(rs2, nm);
+      if (view === "rules") {
+        if (key.leftArrow) return setView("list"), void setStatus(null);
+        if (key.upArrow) setRi((n) => Math.max(0, n - 1));
+        else if (key.downArrow) setRi((n) => Math.min(rules.length - 1, n + 1));
+        else if (key.return || key.rightArrow) {
+          if (rules[ri]) {
+            setFi(0);
+            setView("rule");
+          }
+        } else if (input === " ") {
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+        } else if (input === "e") {
+          if (rules[ri]) mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+        } else if (input === "d") {
+          if (rules[ri]) {
+            const next = rules.filter((_, i) => i !== ri);
+            setRi((n) => Math.max(0, Math.min(n, next.length - 1)));
+            mutate(next);
+          }
+        } else if (input === "m") {
+          mutate(rules, mode === "denylist" ? "whitelist" : "denylist");
+        } else if (input === "s") void save();
+        else if (input === "x") discard();
+        return;
       }
+      const rule2 = rules[ri];
+      if (!rule2) return setView("rules");
+      const field = FIELDS[fi];
+      if (key.leftArrow) setView("rules");
+      else if (key.upArrow) setFi((n) => Math.max(0, n - 1));
+      else if (key.downArrow) setFi((n) => Math.min(FIELDS.length - 1, n + 1));
+      else if (field.kind === "effect" && (input === " " || key.rightArrow)) {
+        mutate(rules.map((r, i) => i === ri ? { ...r, effect: r.effect === "ALLOW" ? "DENY" : "ALLOW" } : r));
+      } else if (field.kind === "enabled" && (input === " " || key.rightArrow)) {
+        mutate(rules.map((r, i) => i === ri ? { ...r, enabled: !r.enabled } : r));
+      } else if (field.kind === "priority" && (key.rightArrow || key.leftArrow)) {
+        const d = key.rightArrow ? 1 : -1;
+        mutate(rules.map((r, i) => i === ri ? { ...r, priority: Math.max(0, r.priority + d) } : r));
+      } else if (field.kind === "text" && key.return) {
+        setEditVal(field.get(rule2));
+        setEditing(true);
+      } else if (input === "s") void save();
     },
-    { isActive: focused }
+    { isActive: focused && !editing }
   );
   if (view === "list") {
-    return /* @__PURE__ */ jsx2(DataView, { loading: list3.loading && !list3.data, error: list3.error, empty: !!list3.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter open" : "press \u2192 to browse" }),
-      /* @__PURE__ */ jsx2(Box2, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs2(Text2, { color: i === pi ? theme.accentBright : void 0, bold: i === pi, children: [
+    return /* @__PURE__ */ jsx3(DataView, { loading: list3.loading && !list3.data, error: list3.error, empty: !!list3.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter open" : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs3(Text3, { color: i === pi ? theme.accentBright : void 0, bold: i === pi, children: [
         (i === pi ? "\u25B8 " : "  ") + truncate(p.name, 26).padEnd(27),
-        /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+        /* @__PURE__ */ jsxs3(Text3, { color: theme.dim, children: [
           p.mode.padEnd(10),
           " ",
           p.rules.length,
@@ -522,44 +651,94 @@ function PoliciesPanel({ focused }) {
       ] }, p.id)) })
     ] }) });
   }
-  const rs = rules ?? [];
-  return /* @__PURE__ */ jsx2(DataView, { loading: detail.loading && !rules, error: detail.error, children: /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs2(Box2, { children: [
-      /* @__PURE__ */ jsx2(Text2, { bold: true, color: theme.accentBright, children: truncate(selected?.name ?? "", 30) }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "  mode: " }),
-      /* @__PURE__ */ jsx2(Text2, { color: mode === "whitelist" ? theme.ok : void 0, children: mode })
+  const dirtyTag = dirty ? /* @__PURE__ */ jsx3(Text3, { color: theme.warn, children: "  \u25CF unsaved (s save \xB7 x discard)" }) : null;
+  if (view === "rules") {
+    return /* @__PURE__ */ jsx3(DataView, { loading: detail.loading && !detail.data, error: detail.error, children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: truncate(selected?.name ?? "", 28) }),
+        /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  mode: " }),
+        /* @__PURE__ */ jsx3(Text3, { color: mode === "whitelist" ? theme.warn : void 0, children: mode }),
+        dirtyTag
+      ] }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 rule \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 d delete \xB7 m mode \xB7 s save \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "ON", width: 2 },
+            { header: "EFFECT", width: 7 },
+            { header: "PRIO", width: 4 },
+            { header: "TOOL", width: 20 },
+            { header: "CONSTRAINTS", width: 22 }
+          ],
+          rows: rules.map((r, i) => [
+            { value: i === ri ? "\u25B8" : "", color: theme.accentBright },
+            { value: r.enabled ? "\u25CF" : "\u25CB", color: r.enabled ? theme.ok : theme.dim },
+            { value: r.effect, color: r.effect === "ALLOW" ? theme.ok : theme.bad, dim: !r.enabled },
+            { value: String(r.priority), dim: true },
+            { value: truncate(r.toolPattern, 20), color: theme.accent, dim: !r.enabled },
+            { value: ruleSummary(r) || truncate(r.description || "\u2014", 22), dim: true }
+          ])
+        }
+      ) }),
+      rules.length === 0 ? /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "(no rules)" }) : null,
+      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+    ] }) });
+  }
+  const rule = rules[ri];
+  return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs3(Box3, { children: [
+      /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: "Rule " }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: truncate(rule?.id ?? "", 26) }),
+      dirtyTag
     ] }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "\u2191\u2193 rule \xB7 space toggle \xB7 d delete \xB7 m mode \xB7 \u2190 back" }),
-    /* @__PURE__ */ jsx2(Box2, { marginTop: 1, children: /* @__PURE__ */ jsx2(
-      Table,
-      {
-        columns: [
-          { header: "", width: 2 },
-          { header: "EFFECT", width: 7 },
-          { header: "PRIO", width: 4 },
-          { header: "TOOL", width: 20 },
-          { header: "DESCRIPTION", width: 34 }
-        ],
-        rows: rs.map((r, i) => [
-          { value: i === ri ? "\u25B8" : "", color: theme.accentBright },
-          { value: r.effect, color: r.effect === "ALLOW" ? theme.ok : theme.bad, dim: !r.enabled },
-          { value: String(r.priority), dim: true },
-          { value: (r.enabled ? "" : "\u2298 ") + truncate(r.toolPattern, 18), color: theme.accent, dim: !r.enabled },
-          { value: truncate(r.description || "\u2014", 34), dim: !r.enabled }
-        ])
-      }
-    ) }),
-    rs.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "(no rules)" }) : null,
-    status ? /* @__PURE__ */ jsx2(Box2, { marginTop: 1, children: /* @__PURE__ */ jsx2(Text2, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) }) : null
-  ] }) });
+    /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 field \xB7 enter edit text \xB7 space/\u2192 toggle \xB7 s save \xB7 \u2190 back" }),
+    /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: FIELDS.map((f, i) => {
+      const val = rule ? f.get(rule) : "";
+      const active2 = i === fi;
+      return /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx3(Text3, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + f.label.padEnd(13) }),
+        active2 && editing && f.kind === "text" ? /* @__PURE__ */ jsx3(
+          TextInput,
+          {
+            value: editVal,
+            onChange: setEditVal,
+            onSubmit: (v) => {
+              if (rule && f.set) mutate(rules.map((r, idx) => idx === ri ? f.set(r, v) : r));
+              setEditing(false);
+            }
+          }
+        ) : /* @__PURE__ */ jsx3(
+          Text3,
+          {
+            color: f.kind === "effect" ? val === "ALLOW" ? theme.ok : theme.bad : void 0,
+            dimColor: !val,
+            children: val || "\u2014"
+          }
+        )
+      ] }, f.label);
+    }) }),
+    status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+  ] });
 }
 
 // src/tui/panels/RateLimit.tsx
-import { Box as Box3, Text as Text3, useInput as useInput2 } from "ink";
+import { Box as Box4, Text as Text4, useInput as useInput2 } from "ink";
 import { useEffect as useEffect3, useState as useState3 } from "react";
-import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
 var MODES = ["off", "detect", "block"];
-var FIELDS = ["mode", "perMinute", "perHour", "perDay"];
+var FIELDS2 = ["mode", "perMinute", "perHour", "perDay"];
+var BLOCKS2 = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
+function ColoredSpark({ values, limit, width = 60 }) {
+  const v = values.length > width ? values.slice(values.length - width) : values;
+  const max = Math.max(1, ...v);
+  return /* @__PURE__ */ jsx4(Text4, { children: v.map((n, i) => {
+    const ch = BLOCKS2[Math.min(BLOCKS2.length - 1, Math.round(n / max * (BLOCKS2.length - 1)))];
+    const over = limit > 0 && n > limit;
+    return /* @__PURE__ */ jsx4(Text4, { color: over ? theme.bad : theme.accent, children: ch }, i);
+  }) });
+}
 function RateLimitPanel({ focused }) {
   const layersQ = useLoader(() => api.settings.getSecurityLayers());
   const historyQ = useLoader(() => api.settings.getRateLimitHistory());
@@ -573,7 +752,7 @@ function RateLimitPanel({ focused }) {
   }, [layersQ.data, draft]);
   const adjust = (dir, step) => {
     if (!draft) return;
-    const field = FIELDS[fi];
+    const field = FIELDS2[fi];
     if (field === "mode") {
       const idx = (MODES.indexOf(draft.mode) + dir + MODES.length) % MODES.length;
       setDraft({ ...draft, mode: MODES[idx] });
@@ -587,8 +766,7 @@ function RateLimitPanel({ focused }) {
     if (!draft || !layersQ.data) return;
     setStatus("Saving\u2026");
     try {
-      const next = { ...layersQ.data.layers, rateLimit: draft };
-      const res = await api.settings.setSecurityLayers(next);
+      const res = await api.settings.setSecurityLayers({ ...layersQ.data.layers, rateLimit: draft });
       setDraft({ ...res.layers.rateLimit });
       setDirty(false);
       setStatus("\u2713 Saved");
@@ -600,8 +778,8 @@ function RateLimitPanel({ focused }) {
   useInput2(
     (input, key) => {
       const step = key.shift ? 10 : 1;
-      if (key.upArrow) setFi((n) => (n - 1 + FIELDS.length) % FIELDS.length);
-      else if (key.downArrow) setFi((n) => (n + 1) % FIELDS.length);
+      if (key.upArrow) setFi((n) => (n - 1 + FIELDS2.length) % FIELDS2.length);
+      else if (key.downArrow) setFi((n) => (n + 1) % FIELDS2.length);
       else if (key.leftArrow) adjust(-1, step);
       else if (key.rightArrow) adjust(1, step);
       else if (input === "s") void save();
@@ -609,155 +787,206 @@ function RateLimitPanel({ focused }) {
     { isActive: focused }
   );
   const history = (historyQ.data?.history ?? []).slice().sort((a, b) => b.ts - a.ts);
-  const bursts = (insightsQ.data?.["anomalies"] ?? []).slice(0, 6);
-  return /* @__PURE__ */ jsx3(DataView, { loading: layersQ.loading && !draft, error: layersQ.error, children: draft ? /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 field \xB7 \u2190\u2192 \xB11 \xB7 shift+\u2190\u2192 \xB110 \xB7 s save" : "press \u2192 to edit" }),
-    /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx3(FieldRow, { label: "Mode", active: focused && fi === 0, children: /* @__PURE__ */ jsx3(Text3, { color: modeColor(draft.mode), children: draft.mode }) }),
-      /* @__PURE__ */ jsx3(FieldRow, { label: "Per minute", active: focused && fi === 1, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perMinute }) }),
-      /* @__PURE__ */ jsx3(FieldRow, { label: "Per hour", active: focused && fi === 2, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perHour === 0 ? "off" : draft.perHour }) }),
-      /* @__PURE__ */ jsx3(FieldRow, { label: "Per day", active: focused && fi === 3, children: /* @__PURE__ */ jsx3(Text3, { bold: true, children: draft.perDay === 0 ? "off" : draft.perDay }) })
+  const activity = insightsQ.data?.["activity"] ?? {};
+  const minuteSeries = (activity.minute ?? []).map((b) => b.count);
+  const hourSeries = (activity.hour ?? []).map((b) => b.count);
+  const bursts = minuteSeries.filter((c2) => draft && draft.perMinute > 0 && c2 > draft.perMinute).length;
+  return /* @__PURE__ */ jsx4(DataView, { loading: layersQ.loading && !draft, error: layersQ.error, children: draft ? /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: focused ? "\u2191\u2193 field \xB7 \u2190\u2192 \xB11 \xB7 shift+\u2190\u2192 \xB110 \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx4(FieldRow, { label: "Mode", active: focused && fi === 0, children: /* @__PURE__ */ jsx4(Text4, { color: modeColor(draft.mode), children: draft.mode }) }),
+      /* @__PURE__ */ jsx4(FieldRow, { label: "Per minute", active: focused && fi === 1, children: /* @__PURE__ */ jsx4(Text4, { bold: true, children: draft.perMinute }) }),
+      /* @__PURE__ */ jsx4(FieldRow, { label: "Per hour", active: focused && fi === 2, children: /* @__PURE__ */ jsx4(Text4, { bold: true, children: draft.perHour === 0 ? "off" : draft.perHour }) }),
+      /* @__PURE__ */ jsx4(FieldRow, { label: "Per day", active: focused && fi === 3, children: /* @__PURE__ */ jsx4(Text4, { bold: true, children: draft.perDay === 0 ? "off" : draft.perDay }) })
     ] }),
-    dirty || status ? /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, children: [
-      dirty ? /* @__PURE__ */ jsx3(Text3, { color: theme.warn, children: "\u25CF unsaved \u2014 press s to apply   " }) : null,
-      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+    dirty || status ? /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, children: [
+      dirty ? /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "\u25CF unsaved \u2014 press s to apply   " }) : null,
+      status ? /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
     ] }) : null,
-    /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs3(Text3, { color: theme.dim, children: [
+    /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Box4, { children: [
+        /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "Activity " }),
+        bursts > 0 ? /* @__PURE__ */ jsxs4(Text4, { color: theme.bad, children: [
+          bursts,
+          " burst min"
+        ] }) : /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "no bursts" }),
+        insightsQ.loading && !insightsQ.data ? /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: " \u2026" }) : null
+      ] }),
+      /* @__PURE__ */ jsxs4(Box4, { children: [
+        /* @__PURE__ */ jsx4(Text4, { children: "/min  " }),
+        minuteSeries.length ? /* @__PURE__ */ jsx4(ColoredSpark, { values: minuteSeries, limit: draft.perMinute }) : /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "no data" })
+      ] }),
+      /* @__PURE__ */ jsxs4(Box4, { children: [
+        /* @__PURE__ */ jsx4(Text4, { children: "/hour " }),
+        hourSeries.length ? /* @__PURE__ */ jsx4(ColoredSpark, { values: hourSeries, limit: draft.perHour, width: 24 }) : /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "no data" })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs4(Text4, { color: theme.dim, children: [
         "Change history ",
         history.length ? `(${history.length})` : ""
       ] }),
-      history.length ? /* @__PURE__ */ jsx3(
+      history.length ? /* @__PURE__ */ jsx4(
         Table,
         {
           columns: [
-            { header: "WHEN", width: 8 },
+            { header: "WHEN", width: 10 },
             { header: "/MIN", width: 6 },
             { header: "/HOUR", width: 7 },
             { header: "/DAY", width: 6 }
           ],
-          rows: history.slice(0, 5).map((h, i) => [
+          rows: history.slice(0, 4).map((h, i) => [
             { value: ago(h.ts) + " ago", dim: true, bold: i === 0 },
             { value: String(h.minute), bold: i === 0 },
             { value: h.hour === 0 ? "off" : String(h.hour), dim: h.hour === 0 },
             { value: h.day === 0 ? "off" : String(h.day), dim: h.day === 0 }
           ])
         }
-      ) : /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  no changes" })
-    ] }),
-    /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs3(Text3, { color: theme.dim, children: [
-        "Recent bursts ",
-        insightsQ.loading && !insightsQ.data ? "\u2026" : `(${bursts.length})`
-      ] }),
-      bursts.length ? /* @__PURE__ */ jsx3(
-        Table,
-        {
-          columns: [
-            { header: "RESULT", width: 9 },
-            { header: "AGENT", width: 16 },
-            { header: "CALLS/LIMIT", width: 12 },
-            { header: "WHEN", width: 8 }
-          ],
-          rows: bursts.map((b) => [
-            { value: b.blocked ? "blocked" : "BYPASSED", color: b.blocked ? theme.accent : theme.bad, bold: !b.blocked },
-            { value: (b.agent || "\u2014").slice(0, 16), dim: true },
-            { value: `${b.count}/${b.limit}` },
-            { value: ago(b.minute) + " ago", dim: true }
-          ])
-        }
-      ) : /* @__PURE__ */ jsxs3(Text3, { color: theme.dim, children: [
-        "  ",
-        insightsQ.error ? insightsQ.error : "none in 7d"
-      ] })
+      ) : /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "  no changes" })
     ] })
   ] }) : null });
 }
 function FieldRow({ label, active: active2, children }) {
-  return /* @__PURE__ */ jsxs3(Box3, { children: [
-    /* @__PURE__ */ jsx3(Text3, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + label.padEnd(12) }),
+  return /* @__PURE__ */ jsxs4(Box4, { children: [
+    /* @__PURE__ */ jsx4(Text4, { color: active2 ? theme.accentBright : void 0, children: (active2 ? "\u25B8 " : "  ") + label.padEnd(12) }),
     children
   ] });
 }
 
 // src/tui/panels/Dlp.tsx
-import { Box as Box4, Text as Text4, useInput as useInput3 } from "ink";
+import { Box as Box5, Text as Text5, useInput as useInput3 } from "ink";
+import TextInput2 from "ink-text-input";
 import { useEffect as useEffect4, useState as useState4 } from "react";
-import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 var MODES2 = ["off", "detect", "block"];
 function DlpPanel({ focused }) {
   const q = useLoader(() => api.settings.getSecurityLayers());
   const [dlp, setDlp] = useState4(null);
   const [available, setAvailable] = useState4([]);
   const [sel, setSel] = useState4(0);
+  const [dirty, setDirty] = useState4(false);
   const [status, setStatus] = useState4(null);
+  const [adding, setAdding] = useState4(null);
+  const [newName, setNewName] = useState4("");
+  const [newRe, setNewRe] = useState4("");
   useEffect4(() => {
     if (q.data && !dlp) {
-      setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns] });
+      setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
       setAvailable(q.data.availablePatterns);
     }
   }, [q.data, dlp]);
-  const persist = async (nextDlp) => {
-    if (!q.data) return;
-    setDlp(nextDlp);
+  const mutate = (next) => {
+    setDlp(next);
+    setDirty(true);
+    setStatus(null);
+  };
+  const save = async () => {
+    if (!dlp || !q.data) return;
     setStatus("Saving\u2026");
     try {
-      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp: nextDlp });
-      setDlp({ ...res.layers.dlp, patterns: [...res.layers.dlp.patterns] });
+      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp });
+      setDlp({ ...res.layers.dlp, patterns: [...res.layers.dlp.patterns], custom: [...res.layers.dlp.custom] });
+      setDirty(false);
       setStatus("\u2713 Saved");
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
   };
+  const discard = () => {
+    if (q.data) setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
+    setDirty(false);
+    setStatus("discarded");
+  };
+  const customCount = dlp?.custom.length ?? 0;
+  const total = available.length + customCount;
   useInput3(
     (input, key) => {
       if (!dlp) return;
       if (key.upArrow) setSel((n) => Math.max(0, n - 1));
-      else if (key.downArrow) setSel((n) => Math.min(available.length - 1, n + 1));
-      else if (input === " " || key.return) {
+      else if (key.downArrow) setSel((n) => Math.min(total - 1, n + 1));
+      else if (input === "m") {
+        const idx = (MODES2.indexOf(dlp.mode) + 1) % MODES2.length;
+        mutate({ ...dlp, mode: MODES2[idx] });
+      } else if (input === "a") {
+        setNewName("");
+        setNewRe("");
+        setAdding("name");
+      } else if (input === " " && sel < available.length) {
         const p = available[sel];
-        if (!p) return;
         const set = new Set(dlp.patterns);
         if (set.has(p)) set.delete(p);
         else set.add(p);
-        void persist({ ...dlp, patterns: [...set] });
-      } else if (input === "m") {
-        const idx = (MODES2.indexOf(dlp.mode) + 1) % MODES2.length;
-        void persist({ ...dlp, mode: MODES2[idx] });
-      }
+        mutate({ ...dlp, patterns: [...set] });
+      } else if (input === "d" && sel >= available.length) {
+        const ci = sel - available.length;
+        mutate({ ...dlp, custom: dlp.custom.filter((_, i) => i !== ci) });
+        setSel((n) => Math.max(0, n - 1));
+      } else if (input === "s") void save();
+      else if (input === "x") discard();
     },
-    { isActive: focused }
+    { isActive: focused && !adding }
   );
   const enabled = new Set(dlp?.patterns ?? []);
-  return /* @__PURE__ */ jsx4(DataView, { loading: q.loading && !dlp, error: q.error, children: dlp ? /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs4(Box4, { children: [
-      /* @__PURE__ */ jsx4(Text4, { children: "mode: " }),
-      /* @__PURE__ */ jsx4(Text4, { color: modeColor(dlp.mode), children: dlp.mode }),
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: focused ? "   \u2191\u2193 move \xB7 space toggle \xB7 m mode" : "   press \u2192 to edit" })
+  return /* @__PURE__ */ jsx5(DataView, { loading: q.loading && !dlp, error: q.error, children: dlp ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { children: "mode: " }),
+      /* @__PURE__ */ jsx5(Text5, { color: modeColor(dlp.mode), children: dlp.mode }),
+      dirty ? /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: "   \u25CF unsaved (s save \xB7 x discard)" }) : null
     ] }),
-    /* @__PURE__ */ jsx4(Box4, { marginTop: 1, flexDirection: "column", children: available.map((p, i) => {
+    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 space toggle \xB7 m mode \xB7 a add \xB7 d remove \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsx5(Box5, { marginTop: 1, flexDirection: "column", children: available.map((p, i) => {
       const on = enabled.has(p);
-      return /* @__PURE__ */ jsxs4(Text4, { color: focused && i === sel ? theme.accentBright : void 0, bold: focused && i === sel, children: [
-        (focused && i === sel ? "\u25B8 " : "  ") + (on ? "\u25CF " : "\u25CB "),
-        /* @__PURE__ */ jsx4(Text4, { color: on ? theme.ok : theme.dim, children: p })
+      const active2 = focused && sel === i;
+      return /* @__PURE__ */ jsxs5(Text5, { color: active2 ? theme.accentBright : void 0, bold: active2, children: [
+        (active2 ? "\u25B8 " : "  ") + (on ? "\u25CF " : "\u25CB "),
+        /* @__PURE__ */ jsx5(Text5, { color: on ? theme.ok : theme.dim, children: p })
       ] }, p);
     }) }),
-    dlp.custom.length ? /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "Custom:" }),
-      dlp.custom.map((c2) => /* @__PURE__ */ jsxs4(Text4, { children: [
-        "  ",
-        /* @__PURE__ */ jsx4(Text4, { color: theme.accent, children: c2.name }),
-        " ",
-        /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: c2.re })
-      ] }, c2.name))
+    /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "Custom patterns" }),
+      dlp.custom.length === 0 ? /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "  (none \u2014 press a to add)" }) : null,
+      dlp.custom.map((c2, i) => {
+        const active2 = focused && sel === available.length + i;
+        return /* @__PURE__ */ jsxs5(Text5, { color: active2 ? theme.accentBright : void 0, bold: active2, children: [
+          active2 ? "\u25B8 " : "  ",
+          /* @__PURE__ */ jsx5(Text5, { color: theme.accent, children: c2.name }),
+          " ",
+          /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: c2.re })
+        ] }, c2.name + i);
+      })
+    ] }),
+    adding ? /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: adding === "name" ? "New pattern name: " : `Regex for "${newName}": ` }),
+      adding === "name" ? /* @__PURE__ */ jsx5(
+        TextInput2,
+        {
+          value: newName,
+          onChange: setNewName,
+          onSubmit: (v) => {
+            if (!v.trim()) return setAdding(null);
+            setNewName(v.trim());
+            setAdding("re");
+          }
+        }
+      ) : /* @__PURE__ */ jsx5(
+        TextInput2,
+        {
+          value: newRe,
+          onChange: setNewRe,
+          onSubmit: (v) => {
+            if (v.trim() && dlp) mutate({ ...dlp, custom: [...dlp.custom, { name: newName, re: v.trim() }] });
+            setAdding(null);
+          }
+        }
+      )
     ] }) : null,
-    status ? /* @__PURE__ */ jsx4(Box4, { marginTop: 1, children: /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) }) : null
+    status ? /* @__PURE__ */ jsx5(Box5, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text5, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) }) : null
   ] }) : null });
 }
 
 // src/tui/panels/Stats.tsx
-import { Box as Box5, Text as Text5 } from "ink";
-import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+import { Box as Box6, Text as Text6 } from "ink";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function StatsPanel({ active: active2 }) {
   const stats = useLoader(() => api.stats.get());
   const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
@@ -767,50 +996,50 @@ function StatsPanel({ active: active2 }) {
   }, 5e3, active2);
   const s = stats.data;
   const points = ts.data?.timeseries ?? [];
-  return /* @__PURE__ */ jsx5(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs5(Box5, { children: [
-      /* @__PURE__ */ jsxs5(Text5, { bold: true, children: [
+  return /* @__PURE__ */ jsx6(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs6(Box6, { children: [
+      /* @__PURE__ */ jsxs6(Text6, { bold: true, children: [
         s.total_calls,
         " "
       ] }),
-      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "calls    " }),
-      /* @__PURE__ */ jsxs5(Text5, { color: theme.ok, children: [
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "calls    " }),
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
         s.allowed,
         " allowed"
       ] }),
-      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "    " }),
-      /* @__PURE__ */ jsxs5(Text5, { color: theme.bad, children: [
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "    " }),
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
         s.denied,
         " denied"
       ] })
     ] }),
-    /* @__PURE__ */ jsxs5(Text5, { color: theme.dim, children: [
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
       s.active_policies,
       " policies \xB7 ",
       s.registered_tools,
       " tools"
     ] }),
-    /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs5(Text5, { color: theme.dim, children: [
+    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
         "Last 24h ",
         ts.data ? `(per ${ts.data.granularity})` : ""
       ] }),
-      /* @__PURE__ */ jsxs5(Box5, { children: [
-        /* @__PURE__ */ jsx5(Text5, { children: "total   " }),
-        /* @__PURE__ */ jsx5(Text5, { color: theme.accent, children: sparkline(points.map((p) => p.total), 64) })
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { children: "total   " }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: sparkline(points.map((p) => p.total), 64) })
       ] }),
-      /* @__PURE__ */ jsxs5(Box5, { children: [
-        /* @__PURE__ */ jsx5(Text5, { children: "allowed " }),
-        /* @__PURE__ */ jsx5(Text5, { color: theme.ok, children: sparkline(points.map((p) => p.allowed), 64) })
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { children: "allowed " }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.ok, children: sparkline(points.map((p) => p.allowed), 64) })
       ] }),
-      /* @__PURE__ */ jsxs5(Box5, { children: [
-        /* @__PURE__ */ jsx5(Text5, { children: "denied  " }),
-        /* @__PURE__ */ jsx5(Text5, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 64) })
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { children: "denied  " }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 64) })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs5(Box5, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "Recent" }),
-      /* @__PURE__ */ jsx5(
+    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "Recent" }),
+      /* @__PURE__ */ jsx6(
         Table,
         {
           columns: [
@@ -832,111 +1061,183 @@ function StatsPanel({ active: active2 }) {
 }
 
 // src/tui/panels/Audit.tsx
-import { Box as Box6, Text as Text6, useInput as useInput4 } from "ink";
+import { Box as Box7, Text as Text7, useInput as useInput4 } from "ink";
+import TextInput3 from "ink-text-input";
 import { useState as useState5 } from "react";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
-var FILTERS = [void 0, "DENY", "ALLOW"];
+import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+var DECISIONS = [void 0, "DENY", "ALLOW"];
+var SIGNALS = [void 0, "dlp", "ratelimit"];
 function AuditPanel({ active: active2, focused }) {
-  const [fi, setFi] = useState5(0);
-  const filter = FILTERS[fi];
-  const audit = useLoader(() => api.audit.list({ filter, limit: 14 }), [fi]);
-  usePoll(audit.reload, 5e3, active2);
+  const [di, setDi] = useState5(0);
+  const [gi, setGi] = useState5(0);
+  const [tool, setTool] = useState5("");
+  const [agent, setAgent] = useState5("");
+  const [search, setSearch] = useState5("");
+  const [sel, setSel] = useState5(0);
+  const [view, setView] = useState5("list");
+  const [editing, setEditing] = useState5(null);
+  const query = {
+    filter: DECISIONS[di],
+    signal: SIGNALS[gi],
+    tool: tool || void 0,
+    agent_name: agent || void 0,
+    search: search || void 0,
+    limit: 100
+  };
+  const auditQ = useLoader(() => api.audit.list(query), [di, gi, tool, agent, search]);
+  usePoll(auditQ.reload, 6e3, active2 && view === "list" && !editing);
+  const entries = auditQ.data?.entries ?? [];
+  const current = entries[Math.min(sel, Math.max(0, entries.length - 1))];
+  const sessionQ = useLoader(
+    () => view === "detail" && current?.session_id ? api.audit.list({ session_id: current.session_id, limit: 40 }) : Promise.resolve(null),
+    [view, current?.session_id]
+  );
   useInput4(
-    (input) => {
-      if (input === "f") setFi((n) => (n + 1) % FILTERS.length);
+    (input, key) => {
+      if (view === "detail") {
+        if (key.leftArrow || key.escape) setView("list");
+        return;
+      }
+      if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.downArrow) setSel((n) => Math.min(entries.length - 1, n + 1));
+      else if (key.return || key.rightArrow) {
+        if (current) setView("detail");
+      } else if (input === "f") setDi((n) => (n + 1) % DECISIONS.length);
+      else if (input === "g") setGi((n) => (n + 1) % SIGNALS.length);
+      else if (input === "t") setEditing("tool");
+      else if (input === "n") setEditing("agent");
+      else if (input === "/") setEditing("search");
+      else if (input === "c") {
+        setDi(0);
+        setGi(0);
+        setTool("");
+        setAgent("");
+        setSearch("");
+      }
     },
-    { isActive: focused }
+    { isActive: focused && !editing }
   );
-  const entries = audit.data?.entries ?? [];
-  return /* @__PURE__ */ jsx6(DataView, { loading: audit.loading && !audit.data, error: audit.error, empty: !!audit.data && entries.length === 0, emptyText: "No audit entries.", children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-      audit.data?.total ?? 0,
-      " entries \xB7 filter: ",
-      /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: filter ?? "all" }),
-      " (press f)"
+  if (view === "detail" && current) {
+    const sessionCalls = sessionQ.data?.entries ?? [];
+    return /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs7(Box7, { children: [
+        /* @__PURE__ */ jsx7(Text7, { color: decisionColor(current.decision), bold: true, children: current.decision }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: "  " + current.tool_name }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust_level })
+      ] }),
+      /* @__PURE__ */ jsx7(Detail, { label: "reason", value: current.reason ?? "\u2014" }),
+      /* @__PURE__ */ jsx7(Detail, { label: "rule", value: current.matched_rule_id ?? "\u2014" }),
+      /* @__PURE__ */ jsx7(Detail, { label: "agent", value: current.agent_name ?? "\u2014" }),
+      /* @__PURE__ */ jsx7(Detail, { label: "session", value: current.session_id ?? "\u2014" }),
+      /* @__PURE__ */ jsx7(Detail, { label: "dlp", value: current.dlp_matches?.length ? current.dlp_matches.join(", ") : "none", color: current.dlp_matches?.length ? theme.bad : void 0 }),
+      /* @__PURE__ */ jsx7(Detail, { label: "when", value: new Date(current.created_at).toLocaleString() }),
+      current.arguments_summary ? /* @__PURE__ */ jsx7(Detail, { label: "args", value: truncate(JSON.stringify(current.arguments_summary), 60) }) : null,
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+          "Session ",
+          current.session_id ? `\xB7 ${sessionCalls.length} calls` : "(no session id)"
+        ] }),
+        current.session_id ? /* @__PURE__ */ jsx7(
+          Table,
+          {
+            columns: [
+              { header: "DECISION", width: 9 },
+              { header: "TOOL", width: 20 },
+              { header: "REASON", width: 26 },
+              { header: "WHEN", width: 6 }
+            ],
+            rows: sessionCalls.slice(0, 12).map((e) => [
+              { value: e.decision, color: decisionColor(e.decision) },
+              { value: truncate(e.tool_name, 20), color: theme.accent },
+              { value: truncate(e.reason ?? "\u2014", 26) },
+              { value: ago(e.created_at), dim: true }
+            ])
+          }
+        ) : null
+      ] }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2190 back to list" })
+    ] });
+  }
+  const chip = (label, val, on) => /* @__PURE__ */ jsxs7(Text7, { children: [
+    /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      label,
+      ":"
+    ] }),
+    /* @__PURE__ */ jsx7(Text7, { color: on ? theme.accentBright : theme.dim, children: val }),
+    /* @__PURE__ */ jsx7(Text7, { children: " " })
+  ] });
+  return /* @__PURE__ */ jsx7(DataView, { loading: auditQ.loading && !auditQ.data, error: auditQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs7(Box7, { children: [
+      chip("dec", DECISIONS[di] ?? "all", di !== 0),
+      chip("sig", SIGNALS[gi] ?? "all", gi !== 0),
+      chip("tool", tool || "\xB7", !!tool),
+      chip("agent", agent || "\xB7", !!agent),
+      chip("search", search || "\xB7", !!search)
     ] }),
-    /* @__PURE__ */ jsx6(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx6(
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: focused ? "\u2191\u2193 \xB7 enter detail \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 c clear" : "press \u2192 to browse" }),
+    editing ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, children: [
+      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
+        editing,
+        ": "
+      ] }),
+      /* @__PURE__ */ jsx7(
+        TextInput3,
+        {
+          value: editing === "tool" ? tool : editing === "agent" ? agent : search,
+          onChange: editing === "tool" ? setTool : editing === "agent" ? setAgent : setSearch,
+          onSubmit: () => setEditing(null)
+        }
+      )
+    ] }) : null,
+    /* @__PURE__ */ jsx7(Box7, { marginTop: 1, children: /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      auditQ.data?.total ?? 0,
+      " matched \xB7 showing ",
+      Math.min(entries.length, 12)
+    ] }) }),
+    /* @__PURE__ */ jsx7(
       Table,
       {
         columns: [
+          { header: "", width: 2 },
           { header: "DECISION", width: 9 },
           { header: "TOOL", width: 18 },
           { header: "AGENT", width: 14 },
-          { header: "REASON", width: 26 },
+          { header: "REASON", width: 24 },
           { header: "DLP", width: 4 },
           { header: "WHEN", width: 6 }
         ],
-        rows: entries.map((e) => [
-          { value: e.decision, color: decisionColor(e.decision) },
-          { value: truncate(e.tool_name, 18), color: theme.accent },
-          { value: truncate(e.agent_name ?? "\u2014", 14), dim: true },
-          { value: truncate(e.reason ?? "\u2014", 26) },
-          { value: e.dlp_matches?.length ? String(e.dlp_matches.length) : "0", color: e.dlp_matches?.length ? theme.bad : void 0, dim: !e.dlp_matches?.length },
-          { value: ago(e.created_at), dim: true }
-        ])
+        rows: entries.slice(0, 12).map((e, i) => rowFor(e, i === sel && focused))
       }
-    ) })
+    )
   ] }) });
 }
-
-// src/tui/panels/Agents.tsx
-import { Box as Box7, Text as Text7 } from "ink";
-import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
-function AgentsPanel({ active: active2 }) {
-  const agents = useLoader(() => api.agents.live({ limit: 14 }));
-  usePoll(agents.reload, 4e3, active2);
-  const data = agents.data;
-  const rows = data?.agents ?? [];
-  return /* @__PURE__ */ jsx7(DataView, { loading: agents.loading && !data, error: agents.error, empty: !!data && rows.length === 0, emptyText: "No agent sessions.", children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-    data ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.ok, children: [
-        data.counts.active,
-        " active"
-      ] }),
-      " \xB7 ",
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
-        data.counts.idle,
-        " idle"
-      ] }),
-      " \xB7 ",
-      data.counts.deactivated,
-      " off"
-    ] }) : null,
-    /* @__PURE__ */ jsx7(Box7, { marginTop: 1, children: /* @__PURE__ */ jsx7(
-      Table,
-      {
-        columns: [
-          { header: "STATUS", width: 7 },
-          { header: "AGENT", width: 20 },
-          { header: "CALLS", width: 6 },
-          { header: "DENY", width: 5 },
-          { header: "DLP", width: 4 },
-          { header: "TRUST", width: 6 },
-          { header: "CHARACTER", width: 20 }
-        ],
-        rows: rows.map((a) => [
-          { value: a.status, color: modeColor(a.status) },
-          { value: truncate(a.agent_name ?? a.agent_id ?? a.session_id, 20), color: theme.accent },
-          { value: String(a.total_calls) },
-          { value: String(a.denied_calls), color: a.denied_calls ? theme.bad : void 0, dim: !a.denied_calls },
-          { value: String(a.dlp_events), color: a.dlp_events ? theme.bad : void 0, dim: !a.dlp_events },
-          { value: `${a.trust_score}` },
-          { value: truncate(a.character || "\u2014", 20), dim: true }
-        ])
-      }
-    ) })
-  ] }) });
+function rowFor(e, active2) {
+  return [
+    { value: active2 ? "\u25B8" : "", color: theme.accentBright },
+    { value: e.decision, color: decisionColor(e.decision) },
+    { value: truncate(e.tool_name, 18), color: theme.accent },
+    { value: truncate(e.agent_name ?? "\u2014", 14), dim: true },
+    { value: truncate(e.reason ?? "\u2014", 24) },
+    { value: e.dlp_matches?.length ? String(e.dlp_matches.length) : "0", color: e.dlp_matches?.length ? theme.bad : void 0, dim: !e.dlp_matches?.length },
+    { value: ago(e.created_at), dim: true }
+  ];
+}
+function Detail({ label, value, color }) {
+  return /* @__PURE__ */ jsxs7(Box7, { children: [
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx7(Text7, { color, children: value })
+  ] });
 }
 
 // src/tui/App.tsx
 import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
 var SECTIONS = [
+  { label: "Live", Panel: LivePanel },
   { label: "Policies", Panel: PoliciesPanel },
   { label: "Rate Limit", Panel: RateLimitPanel },
   { label: "DLP", Panel: DlpPanel },
   { label: "Stats", Panel: StatsPanel },
-  { label: "Audit", Panel: AuditPanel },
-  { label: "Agents", Panel: AgentsPanel }
+  { label: "Audit", Panel: AuditPanel }
 ];
 var BANNER_HEX = ["#1432A0", "#2850BE", "#3C6ED7", "#5A8CE6", "#82AAF0", "#AAC8FA"];
 function Banner() {