@solongate/proxy 0.68.0 → 0.69.0

package/dist/index.js

@@ -7020,12 +7020,12 @@ var init_hooks = __esm({
 
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
-import { closeSync, openSync, readSync, statSync } from "fs";
+import { closeSync, mkdirSync as mkdirSync3, openSync, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { dirname, join as join5 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
-function tailLines(file, maxBytes = 65536) {
+function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
     const start = Math.max(0, size - maxBytes);
@@ -7040,6 +7040,9 @@ function tailLines(file, maxBytes = 65536) {
     return [];
   }
 }
+function oscCopy(text) {
+  process.stdout.write(`\x1B]52;c;${Buffer.from(text, "utf-8").toString("base64")}\x07`);
+}
 function cloudItem(e) {
   return {
     id: "c:" + e.id,
@@ -7049,7 +7052,11 @@ function cloudItem(e) {
     permission: (e.permission ?? "").slice(0, 4),
     detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
     dlp: !!e.dlp_matches?.length,
-    source: "cloud"
+    source: "cloud",
+    session: e.session_id ?? void 0,
+    agent: e.agent_name ?? void 0,
+    evalMs: e.evaluation_time_ms ?? void 0,
+    rule: e.matched_rule_id ?? void 0
   };
 }
 function ColumnChart({ series, hot, height, width: width2, color, hotColor = theme.bad }) {
@@ -7068,7 +7075,7 @@ function ColumnChart({ series, hot, height, width: width2, color, hotColor = the
       else if (frac >= (r - 0.5) / height) ch = "\u2584";
       else if (r === 1) ch = "\u2581";
       else ch = " ";
-      const c2 = r === 1 && v === 0 ? "#233457" : hotPad?.[i] ? hotColor : color;
+      const c2 = r === 1 && v === 0 ? DIM_FLOOR : hotPad?.[i] ? hotColor : color;
       const last = segs[segs.length - 1];
       if (last && last.color === c2) last.text += ch;
       else segs.push({ text: ch, color: c2 });
@@ -7084,7 +7091,7 @@ function HBar({ label, value, max, width: width2, color }) {
   return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: label.padEnd(10) }),
     /* @__PURE__ */ jsx2(Text2, { color, children: "\u2588".repeat(Math.min(width2, filled)) }),
-    /* @__PURE__ */ jsx2(Text2, { color: "#233457", children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
+    /* @__PURE__ */ jsx2(Text2, { color: DIM_FLOOR, children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " " + value })
   ] });
 }
@@ -7109,18 +7116,12 @@ function LivePanel({ active: active2 }) {
   const [localOn, setLocalOn] = useState2(null);
   const [ring, setRing] = useState2(null);
   const [log6, setLog] = useState2([]);
+  const [filter, setFilter] = useState2("all");
+  const [scroll, setScroll] = useState2(0);
+  const [toast, setToast] = useState2(null);
   const seenRef = useRef2(/* @__PURE__ */ new Set());
   const lastLocalTs = useRef2(0);
   const pausedUntil = useRef2(0);
-  const [frozen, setFrozen] = useState2(false);
-  const frozenRef = useRef2(false);
-  frozenRef.current = frozen;
-  useInput(
-    (input) => {
-      if (input === "p") setFrozen((f) => !f);
-    },
-    { isActive: active2 }
-  );
   const pushLog = useCallback2((msg, level = "ok") => {
     setLog((prev) => [...prev.slice(-59), { ts: Date.now(), msg, level }]);
   }, []);
@@ -7136,9 +7137,8 @@ function LivePanel({ active: active2 }) {
     },
     [pushLog]
   );
-  const paused = () => frozenRef.current || Date.now() < pausedUntil.current;
+  const paused = () => Date.now() < pausedUntil.current;
   const pollLocal = useCallback2(() => {
-    if (frozenRef.current) return;
     const lines = tailLines(LOCAL_LOG);
     if (!lines.length) {
       setLocalOn((prev) => prev === null ? false : prev);
@@ -7161,7 +7161,9 @@ function LivePanel({ active: active2 }) {
           dlp: !!j.dlp,
           source: "local",
           session: j.session_id,
-          agent: j.agent_name
+          agent: j.agent_name,
+          evalMs: j.evaluation_time_ms,
+          rule: j.matched_rule_id
         });
       } catch {
       }
@@ -7170,9 +7172,7 @@ function LivePanel({ active: active2 }) {
       lastLocalTs.current = fresh[fresh.length - 1].at;
       setLocalBuf((prev) => [...prev, ...fresh].slice(-400));
       const denies = fresh.filter((f) => f.decision !== "ALLOW").length;
-      if (lastLocalTs.current !== fresh[0].at || fresh.length < 10) {
-        pushLog(`local +${fresh.length} calls${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : "warn");
-      }
+      if (fresh.length < 10) pushLog(`local +${fresh.length} calls${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : "warn");
     }
     const ringLines = tailLines(RING, 8192).slice(-30);
     if (ringLines.length) {
@@ -7209,9 +7209,7 @@ function LivePanel({ active: active2 }) {
       const fresh = fd.entries.filter((e) => !seenRef.current.has(e.id));
       const firstLoad = seenRef.current.size === 0 && fresh.length > 1;
       for (const e of fresh) seenRef.current.add(e.id);
-      if (fresh.length) {
-        setCloudBuf((prev) => [...prev, ...fresh.map(cloudItem).sort((a, b) => a.at - b.at)].slice(-400));
-      }
+      if (fresh.length) setCloudBuf((prev) => [...prev, ...fresh.map(cloudItem).sort((a, b) => a.at - b.at)].slice(-400));
       const denies = fresh.filter((e) => e.decision !== "ALLOW").length;
       if (firstLoad) pushLog(`cloud link up \xB7 api ${ms}ms \xB7 ${fresh.length} calls`);
       else pushLog(`api ${ms}ms \xB7 +${fresh.length} cloud${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : fresh.length ? "warn" : "ok");
@@ -7251,26 +7249,32 @@ function LivePanel({ active: active2 }) {
   }, [active2, pollFeed, pollMedium, pollSlow]);
   const sessions = useLoader(() => api.agents.live({ limit: 30, includeDeactivated: true }));
   const insights = useLoader(() => api.stats.securityInsights(7));
+  const guard = useLoader(() => api.settings.getGuardStatus());
   usePoll(() => {
     if (!paused()) sessions.reload();
   }, 1e4, active2);
   usePoll(() => {
     if (!paused()) insights.reload();
   }, 3e4, active2);
+  usePoll(() => {
+    if (!paused()) guard.reload();
+  }, 6e4, active2);
   const [tick, setTick] = useState2(0);
   useEffect2(() => {
-    if (!active2 || frozen) return;
-    const t = setInterval(() => setTick((n) => n + 1), 200);
+    if (!active2) return;
+    const t = setInterval(() => setTick((n) => n + 1), 500);
     return () => clearInterval(t);
-  }, [active2, frozen]);
+  }, [active2]);
   const startRef = useRef2(Date.now());
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const ins = insights.data ?? {};
   const spin = SPIN[tick % SPIN.length];
-  const points = tsData?.timeseries ?? [];
-  const mergedAll = [...cloudBuf, ...localBuf].sort((a, b) => a.at - b.at);
   const nowMs = Date.now();
+  const mergedAll = [...cloudBuf, ...localBuf].sort((a, b) => a.at - b.at);
+  const filtered = filter === "all" ? mergedAll : mergedAll.filter((e) => e.source === filter);
+  const visible = filtered.slice(-STREAM_KEEP);
+  const points = tsData?.timeseries ?? [];
   const minuteCounts = new Array(60).fill(0);
   const minuteHot = new Array(60).fill(false);
   for (const e of mergedAll) {
@@ -7286,14 +7290,14 @@ function LivePanel({ active: active2 }) {
   const trafficLabel = localTraffic ? "calls/min \xB7 60m \xB7 local+cloud" : "24h \xB7 cloud";
   const rl = ins.layers?.rateLimit;
   const dl = ins.layers?.dlp;
-  const minuteNow = (ins.activity?.minute ?? []).slice(-1)[0]?.count ?? 0;
+  const gh = ins.layers?.ghost;
+  const minuteNow = minuteCounts[59] ?? 0;
   const dlpBars = (ins.dlpByPattern ?? []).slice(0, 2);
   const maxDlpBar = dlpBars[0]?.count ?? 1;
-  const merged = mergedAll;
-  const denials = merged.filter((e) => e.decision !== "ALLOW");
+  const denials = mergedAll.filter((e) => e.decision !== "ALLOW");
   const lastDeny = denials[denials.length - 1];
   const toolCounts = /* @__PURE__ */ new Map();
-  for (const e of merged) toolCounts.set(e.tool, (toolCounts.get(e.tool) ?? 0) + 1);
+  for (const e of mergedAll) toolCounts.set(e.tool, (toolCounts.get(e.tool) ?? 0) + 1);
   const topTools = [...toolCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
   const latNow = lat[lat.length - 1] ?? 0;
   const sortedLat = [...lat].sort((a, b) => a - b);
@@ -7314,19 +7318,53 @@ function LivePanel({ active: active2 }) {
   }
   const localSessList = [...localSess.entries()].sort((a, b) => b[1].lastAt - a[1].lastAt);
   const chartH = rows >= 36 ? 6 : 4;
-  const colH = rows >= 32 ? 6 : 5;
-  const streamRows = Math.max(4, rows - 6 - chartH - colH - (localOn === false ? 1 : 0));
-  const tail = merged.slice(-streamRows);
+  const colH = rows >= 32 ? 7 : 5;
+  const streamRows = Math.max(4, rows - 5 - (1 + chartH) - colH);
   const innerW = cols - 2;
   const leftW = Math.floor(innerW * 0.55);
   const rightW = innerW - leftW - 2;
   const colW = Math.max(20, Math.floor((innerW - 4) / 3));
+  const maxScroll = Math.max(0, visible.length - streamRows);
+  const clampedScroll = Math.min(scroll, maxScroll);
+  const start = Math.max(0, visible.length - streamRows - clampedScroll);
+  const windowed = visible.slice(start, start + streamRows);
+  useInput(
+    (input, key) => {
+      if (input === "f") {
+        setFilter((f) => FILTERS[(FILTERS.indexOf(f) + 1) % FILTERS.length]);
+        setScroll(0);
+      } else if (key.upArrow) setScroll((n) => Math.min(maxScroll, n + 1));
+      else if (key.downArrow) setScroll((n) => Math.max(0, n - 1));
+      else if (key.pageUp) setScroll((n) => Math.min(maxScroll, n + streamRows));
+      else if (key.pageDown) setScroll((n) => Math.max(0, n - streamRows));
+      else if (input === "c") {
+        const dump = visible.map(
+          (e) => `[${new Date(e.at).toISOString()}] ${e.source.toUpperCase().padEnd(5)} ${e.decision.padEnd(6)} ${e.tool.padEnd(16)} ${e.permission.padEnd(5)} ${e.evalMs != null ? String(e.evalMs).padStart(5) + "ms " : "        "}${(e.agent ?? "-").padEnd(14)} ${e.session ? e.session.slice(0, 8) : "-       "} ${e.detail}`
+        ).join("\n");
+        try {
+          mkdirSync3(dirname(DUMP), { recursive: true });
+          writeFileSync3(DUMP, dump + "\n");
+        } catch {
+        }
+        oscCopy(dump);
+        setToast({ msg: `copied ${visible.length} lines \u2192 clipboard + ${DUMP}`, until: Date.now() + 4e3 });
+      }
+    },
+    { isActive: active2 }
+  );
   const sessionDot = (st) => st === "active" ? { ch: "\u25CF", color: theme.ok } : st === "idle" ? { ch: "\u25CC", color: theme.warn } : { ch: "\u25CB", color: theme.dim };
+  if (s === null && localOn === null) {
+    return /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+      spin,
+      " connecting\u2026"
+    ] });
+  }
   return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", paddingX: 1, children: [
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#1432A0", color: "#AAC8FA", bold: true, children: " SOLONGATE LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: ` ${spin} up ${fmtUp(Date.now() - startRef.current)} \xB7 ${hhmmss(Date.now())} \xB7 api ${latNow}ms ` }),
-      frozen ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " PAUSED \xB7 copy freely \xB7 p resume " }) : backingOff ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " RATE LIMITED \xB7 backing off " }) : lastDeny ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d1220", color: "#ff6b6b", bold: true, children: ` \u26A0 ${hhmmss(lastDeny.at)} ${lastDeny.tool} DENIED ` }) : /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#4f6db8", children: " \u2713 clean " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: ` ${spin} up ${fmtUp(nowMs - startRef.current)} \xB7 ${hhmmss(nowMs)} \xB7 api ${latNow}ms ` }),
+      backingOff ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " RATE LIMITED \xB7 backing off " }) : lastDeny ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d1220", color: "#ff6b6b", bold: true, children: ` \u26A0 ${hhmmss(lastDeny.at)} ${lastDeny.tool} DENIED ` }) : /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#4f6db8", children: " \u2713 clean " }),
+      toast && nowMs < toast.until ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#123d1f", color: "#7bd88f", bold: true, children: ` ${toast.msg} ` }) : null
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "\u2502 calls " }),
@@ -7336,16 +7374,20 @@ function LivePanel({ active: active2 }) {
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 deny " }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.bad, bold: true, children: s ? s.denied : "\xB7\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 local " }),
-      localOn ? /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "\u2713 streaming" }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "off" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 ratelimit " }),
+      localOn ? /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "\u2713" }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "off" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 rl " }),
       /* @__PURE__ */ jsx2(Text2, { color: rl?.mode === "block" ? theme.ok : rl?.mode === "detect" ? theme.warn : theme.dim, children: rl?.mode ?? "?" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 dlp " }),
       /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: dl?.mode ?? "?" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 sessions " }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: sessCounts ? `${sessCounts.active}\u25B2 ${sessCounts.idle}\u25CC ${sessCounts.deactivated}\u25CB` : "\xB7" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 ghost " }),
+      /* @__PURE__ */ jsx2(Text2, { color: gh?.mode === "on" ? theme.ok : theme.dim, children: gh?.mode ?? "?" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 sess " }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: `${localSessList.length}loc ${sessCounts?.active ?? 0}\u25B2${sessCounts?.idle ?? 0}\u25CC` }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 hooks " }),
+      /* @__PURE__ */ jsx2(Text2, { color: guard.data?.up_to_date ? theme.ok : theme.warn, children: guard.data ? `v${guard.data.installed ?? "?"}${guard.data.up_to_date ? "" : "\u2192v" + guard.data.latest} ${guard.data.device_count}dev` : "\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502" })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: traffic, hot: trafficHot, height: chartH, width: leftW, color: theme.accent })
@@ -7355,39 +7397,38 @@ function LivePanel({ active: active2 }) {
         /* @__PURE__ */ jsx2(ColumnChart, { series: lat, hot: lat.map((v) => v > latHotAt), height: chartH, width: rightW, color: "#82AAF0", hotColor: "#ffb454" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: colH, children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "LAYERS", width: colW }),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "RATELIMIT ".padEnd(10) }),
           /* @__PURE__ */ jsx2(Text2, { color: rl?.mode === "block" ? theme.ok : rl?.mode === "detect" ? theme.warn : theme.dim, children: (rl?.mode ?? "?").padEnd(7) }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: rl?.perMinute ? `${minuteNow}/${rl.perMinute} per min` : "no limit set" })
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: rl?.perMinute ? `${minuteNow}/${rl.perMinute}m ${rl.perHour || "\u2014"}h ${rl.perDay || "\u2014"}d` : "no limits set" })
         ] }),
-        rl?.perMinute ? /* @__PURE__ */ jsx2(HBar, { label: "load", value: minuteNow, max: rl.perMinute, width: Math.max(6, colW - 16), color: minuteNow > rl.perMinute ? theme.bad : theme.accent }) : null,
+        rl?.perMinute ? /* @__PURE__ */ jsx2(HBar, { label: "load/min", value: minuteNow, max: rl.perMinute, width: Math.max(6, colW - 16), color: minuteNow > rl.perMinute ? theme.bad : theme.accent }) : null,
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "DLP".padEnd(10) }),
           /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: (dl?.mode ?? "?").padEnd(7) }),
-          /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-            (dl?.patterns ?? []).length,
-            " patterns armed"
-          ] })
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${(dl?.patterns ?? []).length} builtin \xB7 ${(dl?.custom ?? []).length} custom` })
         ] }),
         dlpBars.length ? dlpBars.map((d) => /* @__PURE__ */ jsx2(HBar, { label: truncate2(d.pattern, 10), value: d.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d.pattern)) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "          no dlp hits in last 7 days" }),
-        ring ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "GUARD".padEnd(10) }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "local \u2713" }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` eval avg ${ring.avgMs}ms \xB7 ${ring.count} recent` })
-        ] }) : null
+          ring ? /* @__PURE__ */ jsxs2(Text2, { color: theme.ok, children: [
+            "local \u2713 ",
+            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `eval avg ${ring.avgMs}ms` })
+          ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "no local ring in cwd" })
+        ] })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, children: [
-        /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: `${localSessList.length} local \xB7 ${sessCounts?.active ?? 0} cloud live`, width: colW }),
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+        /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: `${localSessList.length} local \xB7 ${sessCounts?.active ?? 0} cloud`, width: colW }),
         localSessList.length === 0 && sess.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         localSessList.slice(0, Math.max(1, colH - 2)).map(([id, v]) => {
-          const fresh = nowMs - v.lastAt < 9e4;
+          const freshDot = nowMs - v.lastAt < 9e4;
           const isMe = ring?.session === id;
           return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-            /* @__PURE__ */ jsxs2(Text2, { color: fresh ? theme.ok : theme.dim, children: [
-              fresh ? "\u25CF" : "\u25CB",
+            /* @__PURE__ */ jsxs2(Text2, { color: freshDot ? theme.ok : theme.dim, children: [
+              freshDot ? "\u25CF" : "\u25CB",
               " "
             ] }),
             /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "LOC " }),
@@ -7420,12 +7461,12 @@ function LivePanel({ active: active2 }) {
               String(a.denied_calls).padStart(3),
               "d "
             ] }),
-            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ago(a.last_seen_at) })
+            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `t${a.trust_score} ` + ago(a.last_seen_at) })
           ] }, a.session_id);
         })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, children: [
-        /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "streaming", width: colW }),
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
+        /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
         log6.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
             hhmmss(l.ts),
@@ -7436,37 +7477,49 @@ function LivePanel({ active: active2 }) {
         ] }, l.ts + ":" + i))
       ] })
     ] }),
-    /* @__PURE__ */ jsx2(PaneTitle, { label: "TOOL STREAM", extra: `local+cloud tail \xB7 ${merged.length} buffered`, width: innerW }),
-    localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-      /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable in dashboard \u2192 Settings \u2192 Local logs; hooks then write ~/.solongate/local-logs (view them there with `solongate logs-server`)" })
-    ] }) : null,
-    tail.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-      spin,
-      " awaiting traffic\u2026"
-    ] }) : null,
-    tail.map((e) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-      /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-        "[",
-        hhmmss(e.at),
-        " "
-      ] }),
-      /* @__PURE__ */ jsx2(Text2, { color: e.source === "local" ? theme.ok : "#4f6db8", children: e.source === "local" ? "LOC" : "CLD" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
-      /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate2(e.tool, 14).padEnd(15) }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
-      e.dlp ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "DLP! " }) : null,
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
-    ] }, e.id)),
+    /* @__PURE__ */ jsx2(
+      PaneTitle,
+      {
+        label: "TOOL STREAM",
+        extra: `last ${STREAM_KEEP} \xB7 filter ${filter}${clampedScroll > 0 ? ` \xB7 \u25B2${clampedScroll} scrolled` : " \xB7 following"} \xB7 f filter \xB7 \u2191\u2193 scroll \xB7 c copy`,
+        width: innerW
+      }
+    ),
+    /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", height: streamRows, overflow: "hidden", children: [
+      localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable: dashboard \u2192 Settings \u2192 Local logs \xB7 hooks write ~/.solongate/local-logs \xB7 view: `solongate logs-server`" })
+      ] }) : null,
+      windowed.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+        spin,
+        " awaiting traffic\u2026"
+      ] }) : null,
+      windowed.map((e) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+          "[",
+          hhmmss(e.at),
+          " "
+        ] }),
+        /* @__PURE__ */ jsx2(Text2, { color: e.source === "local" ? theme.ok : "#4f6db8", children: e.source === "local" ? "LOC" : "CLD" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
+        /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
+        /* @__PURE__ */ jsx2(Text2, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
+        e.dlp ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "DLP! " }) : null,
+        e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
+      ] }, e.id))
+    ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", bold: true, children: " LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} \xB7 buf ${merged.length} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " p pause/copy \xB7 esc menu \xB7 q quit " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld buffered \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " f filter \xB7 \u2191\u2193 scroll \xB7 c copy \xB7 esc menu \xB7 q quit " })
     ] })
   ] });
 }
-var SPIN, BG, LOCAL_LOG, RING, hhmmss, fmtUp;
+var SPIN, BG, DIM_FLOOR, LOCAL_LOG, RING, DUMP, STREAM_KEEP, hhmmss, fmtUp, FILTERS;
 var init_Live = __esm({
   "src/tui/panels/Live.tsx"() {
     "use strict";
@@ -7475,8 +7528,11 @@ var init_Live = __esm({
     init_theme();
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
+    DIM_FLOOR = "#233457";
     LOCAL_LOG = join5(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
     RING = join5(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    DUMP = join5(homedir3(), ".solongate", "live-stream.log");
+    STREAM_KEEP = 100;
     hhmmss = (ts) => {
       const d = new Date(ts);
       return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -7486,6 +7542,7 @@ var init_Live = __esm({
       const p = (n) => String(n).padStart(2, "0");
       return `${p(Math.floor(s / 3600))}:${p(Math.floor(s % 3600 / 60))}:${p(s % 60)}`;
     };
+    FILTERS = ["all", "local", "cloud"];
   }
 });
 
@@ -9147,8 +9204,8 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve4, join as join6, dirname } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4, mkdirSync as mkdirSync4 } from "fs";
+import { resolve as resolve4, join as join6, dirname as dirname2 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
@@ -9260,13 +9317,13 @@ function runGlobalRestore() {
   unlockProtected();
   removeClaudeShim();
   if (existsSync4(p.backupPath)) {
-    writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
+    writeFileSync4(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
   } else if (existsSync4(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
       delete s.hooks;
-      writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      writeFileSync4(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
     } catch {
     }
@@ -9310,8 +9367,8 @@ function writeShimBlock(file, block) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block + "\n";
   }
-  mkdirSync3(dirname(file), { recursive: true });
-  writeFileSync3(file, content);
+  mkdirSync4(dirname2(file), { recursive: true });
+  writeFileSync4(file, content);
 }
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
@@ -9368,22 +9425,22 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync3(p.hooksDir, { recursive: true });
-  mkdirSync3(p.claudeDir, { recursive: true });
+  mkdirSync4(p.hooksDir, { recursive: true });
+  mkdirSync4(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join6(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync4(join6(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync4(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync4(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync4(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
-  writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  writeFileSync4(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
   if (existsSync4(p.settingsPath)) {
     const raw = readFileSync6(p.settingsPath, "utf-8");
     if (!existsSync4(p.backupPath)) {
-      writeFileSync3(p.backupPath, raw);
+      writeFileSync4(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
     try {
@@ -9404,7 +9461,7 @@ async function runGlobalInstall(opts = {}) {
       Stop: [{ matcher: "", hooks: [{ type: "command", command: `"${nodeBin}" "${stopAbs}" claude-code "Claude Code"` }] }]
     }
   };
-  writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync4(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
   console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   if (process.env["SOLONGATE_OS_LOCK"] === "1") {
     lockProtected();
@@ -9418,7 +9475,7 @@ var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
-    __dirname = dirname(fileURLToPath(import.meta.url));
+    __dirname = dirname2(fileURLToPath(import.meta.url));
     HOOKS_DIR = resolve4(__dirname, "..", "hooks");
     SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
     SHIM_END = "# <<< SolonGate shield <<<";
@@ -10068,7 +10125,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, existsSync as existsSync6, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -10376,7 +10433,7 @@ async function main2() {
     log3("");
     log3(`  Backup: ${backupPath}`);
   }
-  writeFileSync4(entryFile, result.modified);
+  writeFileSync5(entryFile, result.modified);
   log3("");
   log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
   log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
@@ -10405,7 +10462,7 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, existsSync as existsSync7 } from "fs";
 import { resolve as resolve8, join as join8 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
@@ -10485,7 +10542,7 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync5(
+  writeFileSync6(
     join8(dir, "package.json"),
     JSON.stringify(
       {
@@ -10515,7 +10572,7 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync5(
+  writeFileSync6(
     join8(dir, "tsconfig.json"),
     JSON.stringify(
       {
@@ -10536,8 +10593,8 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync4(join8(dir, "src"), { recursive: true });
-  writeFileSync5(
+  mkdirSync5(join8(dir, "src"), { recursive: true });
+  writeFileSync6(
     join8(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
@@ -10579,7 +10636,7 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync5(
+  writeFileSync6(
     join8(dir, ".mcp.json"),
     JSON.stringify(
       {
@@ -10597,12 +10654,12 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync5(
+  writeFileSync6(
     join8(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync5(
+  writeFileSync6(
     join8(dir, ".gitignore"),
     `node_modules/
 dist/
@@ -10622,7 +10679,7 @@ async function main3() {
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -10696,7 +10753,7 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync8 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
@@ -10891,7 +10948,7 @@ async function pull(apiKey, file, policyId) {
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync6(file, json, "utf-8");
+  writeFileSync7(file, json, "utf-8");
   log5("");
   log5(green2("  Saved to: ") + file);
   log5(`  ${dim2("Name:")}    ${policy.name}`);

package/dist/tui/index.js

@@ -126,9 +126,9 @@ function KeyHints({ hints }) {
 
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
-import { closeSync, openSync, readSync, statSync } from "fs";
+import { closeSync, mkdirSync, openSync, readSync, statSync, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { dirname, join as join2 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 
 // src/api-client/client.ts
@@ -436,8 +436,11 @@ function usePoll(reload, intervalMs, enabled = true) {
 import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var BG = "#12234f";
+var DIM_FLOOR = "#233457";
 var LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
 var RING = join2(process.cwd(), ".solongate", ".eval-ring.jsonl");
+var DUMP = join2(homedir2(), ".solongate", "live-stream.log");
+var STREAM_KEEP = 100;
 var hhmmss = (ts) => {
   const d = new Date(ts);
   return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -447,7 +450,7 @@ var fmtUp = (ms) => {
   const p = (n) => String(n).padStart(2, "0");
   return `${p(Math.floor(s / 3600))}:${p(Math.floor(s % 3600 / 60))}:${p(s % 60)}`;
 };
-function tailLines(file, maxBytes = 65536) {
+function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
     const start = Math.max(0, size - maxBytes);
@@ -462,6 +465,9 @@ function tailLines(file, maxBytes = 65536) {
     return [];
   }
 }
+function oscCopy(text) {
+  process.stdout.write(`\x1B]52;c;${Buffer.from(text, "utf-8").toString("base64")}\x07`);
+}
 function cloudItem(e) {
   return {
     id: "c:" + e.id,
@@ -471,7 +477,11 @@ function cloudItem(e) {
     permission: (e.permission ?? "").slice(0, 4),
     detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
     dlp: !!e.dlp_matches?.length,
-    source: "cloud"
+    source: "cloud",
+    session: e.session_id ?? void 0,
+    agent: e.agent_name ?? void 0,
+    evalMs: e.evaluation_time_ms ?? void 0,
+    rule: e.matched_rule_id ?? void 0
   };
 }
 function ColumnChart({ series, hot, height, width, color, hotColor = theme.bad }) {
@@ -490,7 +500,7 @@ function ColumnChart({ series, hot, height, width, color, hotColor = theme.bad }
       else if (frac >= (r - 0.5) / height) ch = "\u2584";
       else if (r === 1) ch = "\u2581";
       else ch = " ";
-      const c2 = r === 1 && v === 0 ? "#233457" : hotPad?.[i] ? hotColor : color;
+      const c2 = r === 1 && v === 0 ? DIM_FLOOR : hotPad?.[i] ? hotColor : color;
       const last = segs[segs.length - 1];
       if (last && last.color === c2) last.text += ch;
       else segs.push({ text: ch, color: c2 });
@@ -506,7 +516,7 @@ function HBar({ label, value, max, width, color }) {
   return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: label.padEnd(10) }),
     /* @__PURE__ */ jsx2(Text2, { color, children: "\u2588".repeat(Math.min(width, filled)) }),
-    /* @__PURE__ */ jsx2(Text2, { color: "#233457", children: "\u2591".repeat(Math.max(0, width - filled)) }),
+    /* @__PURE__ */ jsx2(Text2, { color: DIM_FLOOR, children: "\u2591".repeat(Math.max(0, width - filled)) }),
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " " + value })
   ] });
 }
@@ -522,6 +532,7 @@ function PaneTitle({ label, extra, width }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width - used)) })
   ] });
 }
+var FILTERS = ["all", "local", "cloud"];
 function LivePanel({ active: active2 }) {
   const [s, setS] = useState2(null);
   const [tsData, setTsData] = useState2(null);
@@ -531,18 +542,12 @@ function LivePanel({ active: active2 }) {
   const [localOn, setLocalOn] = useState2(null);
   const [ring, setRing] = useState2(null);
   const [log, setLog] = useState2([]);
+  const [filter, setFilter] = useState2("all");
+  const [scroll, setScroll] = useState2(0);
+  const [toast, setToast] = useState2(null);
   const seenRef = useRef2(/* @__PURE__ */ new Set());
   const lastLocalTs = useRef2(0);
   const pausedUntil = useRef2(0);
-  const [frozen, setFrozen] = useState2(false);
-  const frozenRef = useRef2(false);
-  frozenRef.current = frozen;
-  useInput(
-    (input) => {
-      if (input === "p") setFrozen((f) => !f);
-    },
-    { isActive: active2 }
-  );
   const pushLog = useCallback2((msg, level = "ok") => {
     setLog((prev) => [...prev.slice(-59), { ts: Date.now(), msg, level }]);
   }, []);
@@ -558,9 +563,8 @@ function LivePanel({ active: active2 }) {
     },
     [pushLog]
   );
-  const paused = () => frozenRef.current || Date.now() < pausedUntil.current;
+  const paused = () => Date.now() < pausedUntil.current;
   const pollLocal = useCallback2(() => {
-    if (frozenRef.current) return;
     const lines = tailLines(LOCAL_LOG);
     if (!lines.length) {
       setLocalOn((prev) => prev === null ? false : prev);
@@ -583,7 +587,9 @@ function LivePanel({ active: active2 }) {
           dlp: !!j.dlp,
           source: "local",
           session: j.session_id,
-          agent: j.agent_name
+          agent: j.agent_name,
+          evalMs: j.evaluation_time_ms,
+          rule: j.matched_rule_id
         });
       } catch {
       }
@@ -592,9 +598,7 @@ function LivePanel({ active: active2 }) {
       lastLocalTs.current = fresh[fresh.length - 1].at;
       setLocalBuf((prev) => [...prev, ...fresh].slice(-400));
       const denies = fresh.filter((f) => f.decision !== "ALLOW").length;
-      if (lastLocalTs.current !== fresh[0].at || fresh.length < 10) {
-        pushLog(`local +${fresh.length} calls${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : "warn");
-      }
+      if (fresh.length < 10) pushLog(`local +${fresh.length} calls${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : "warn");
     }
     const ringLines = tailLines(RING, 8192).slice(-30);
     if (ringLines.length) {
@@ -631,9 +635,7 @@ function LivePanel({ active: active2 }) {
       const fresh = fd.entries.filter((e) => !seenRef.current.has(e.id));
       const firstLoad = seenRef.current.size === 0 && fresh.length > 1;
       for (const e of fresh) seenRef.current.add(e.id);
-      if (fresh.length) {
-        setCloudBuf((prev) => [...prev, ...fresh.map(cloudItem).sort((a, b) => a.at - b.at)].slice(-400));
-      }
+      if (fresh.length) setCloudBuf((prev) => [...prev, ...fresh.map(cloudItem).sort((a, b) => a.at - b.at)].slice(-400));
       const denies = fresh.filter((e) => e.decision !== "ALLOW").length;
       if (firstLoad) pushLog(`cloud link up \xB7 api ${ms}ms \xB7 ${fresh.length} calls`);
       else pushLog(`api ${ms}ms \xB7 +${fresh.length} cloud${denies ? ` \xB7 ${denies} DENIED` : ""}`, denies ? "bad" : fresh.length ? "warn" : "ok");
@@ -673,26 +675,32 @@ function LivePanel({ active: active2 }) {
   }, [active2, pollFeed, pollMedium, pollSlow]);
   const sessions = useLoader(() => api.agents.live({ limit: 30, includeDeactivated: true }));
   const insights = useLoader(() => api.stats.securityInsights(7));
+  const guard = useLoader(() => api.settings.getGuardStatus());
   usePoll(() => {
     if (!paused()) sessions.reload();
   }, 1e4, active2);
   usePoll(() => {
     if (!paused()) insights.reload();
   }, 3e4, active2);
+  usePoll(() => {
+    if (!paused()) guard.reload();
+  }, 6e4, active2);
   const [tick, setTick] = useState2(0);
   useEffect2(() => {
-    if (!active2 || frozen) return;
-    const t = setInterval(() => setTick((n) => n + 1), 200);
+    if (!active2) return;
+    const t = setInterval(() => setTick((n) => n + 1), 500);
     return () => clearInterval(t);
-  }, [active2, frozen]);
+  }, [active2]);
   const startRef = useRef2(Date.now());
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const ins = insights.data ?? {};
   const spin = SPIN[tick % SPIN.length];
-  const points = tsData?.timeseries ?? [];
-  const mergedAll = [...cloudBuf, ...localBuf].sort((a, b) => a.at - b.at);
   const nowMs = Date.now();
+  const mergedAll = [...cloudBuf, ...localBuf].sort((a, b) => a.at - b.at);
+  const filtered = filter === "all" ? mergedAll : mergedAll.filter((e) => e.source === filter);
+  const visible = filtered.slice(-STREAM_KEEP);
+  const points = tsData?.timeseries ?? [];
   const minuteCounts = new Array(60).fill(0);
   const minuteHot = new Array(60).fill(false);
   for (const e of mergedAll) {
@@ -708,14 +716,14 @@ function LivePanel({ active: active2 }) {
   const trafficLabel = localTraffic ? "calls/min \xB7 60m \xB7 local+cloud" : "24h \xB7 cloud";
   const rl = ins.layers?.rateLimit;
   const dl = ins.layers?.dlp;
-  const minuteNow = (ins.activity?.minute ?? []).slice(-1)[0]?.count ?? 0;
+  const gh = ins.layers?.ghost;
+  const minuteNow = minuteCounts[59] ?? 0;
   const dlpBars = (ins.dlpByPattern ?? []).slice(0, 2);
   const maxDlpBar = dlpBars[0]?.count ?? 1;
-  const merged = mergedAll;
-  const denials = merged.filter((e) => e.decision !== "ALLOW");
+  const denials = mergedAll.filter((e) => e.decision !== "ALLOW");
   const lastDeny = denials[denials.length - 1];
   const toolCounts = /* @__PURE__ */ new Map();
-  for (const e of merged) toolCounts.set(e.tool, (toolCounts.get(e.tool) ?? 0) + 1);
+  for (const e of mergedAll) toolCounts.set(e.tool, (toolCounts.get(e.tool) ?? 0) + 1);
   const topTools = [...toolCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3);
   const latNow = lat[lat.length - 1] ?? 0;
   const sortedLat = [...lat].sort((a, b) => a - b);
@@ -736,19 +744,53 @@ function LivePanel({ active: active2 }) {
   }
   const localSessList = [...localSess.entries()].sort((a, b) => b[1].lastAt - a[1].lastAt);
   const chartH = rows >= 36 ? 6 : 4;
-  const colH = rows >= 32 ? 6 : 5;
-  const streamRows = Math.max(4, rows - 6 - chartH - colH - (localOn === false ? 1 : 0));
-  const tail = merged.slice(-streamRows);
+  const colH = rows >= 32 ? 7 : 5;
+  const streamRows = Math.max(4, rows - 5 - (1 + chartH) - colH);
   const innerW = cols - 2;
   const leftW = Math.floor(innerW * 0.55);
   const rightW = innerW - leftW - 2;
   const colW = Math.max(20, Math.floor((innerW - 4) / 3));
+  const maxScroll = Math.max(0, visible.length - streamRows);
+  const clampedScroll = Math.min(scroll, maxScroll);
+  const start = Math.max(0, visible.length - streamRows - clampedScroll);
+  const windowed = visible.slice(start, start + streamRows);
+  useInput(
+    (input, key) => {
+      if (input === "f") {
+        setFilter((f) => FILTERS[(FILTERS.indexOf(f) + 1) % FILTERS.length]);
+        setScroll(0);
+      } else if (key.upArrow) setScroll((n) => Math.min(maxScroll, n + 1));
+      else if (key.downArrow) setScroll((n) => Math.max(0, n - 1));
+      else if (key.pageUp) setScroll((n) => Math.min(maxScroll, n + streamRows));
+      else if (key.pageDown) setScroll((n) => Math.max(0, n - streamRows));
+      else if (input === "c") {
+        const dump = visible.map(
+          (e) => `[${new Date(e.at).toISOString()}] ${e.source.toUpperCase().padEnd(5)} ${e.decision.padEnd(6)} ${e.tool.padEnd(16)} ${e.permission.padEnd(5)} ${e.evalMs != null ? String(e.evalMs).padStart(5) + "ms " : "        "}${(e.agent ?? "-").padEnd(14)} ${e.session ? e.session.slice(0, 8) : "-       "} ${e.detail}`
+        ).join("\n");
+        try {
+          mkdirSync(dirname(DUMP), { recursive: true });
+          writeFileSync(DUMP, dump + "\n");
+        } catch {
+        }
+        oscCopy(dump);
+        setToast({ msg: `copied ${visible.length} lines \u2192 clipboard + ${DUMP}`, until: Date.now() + 4e3 });
+      }
+    },
+    { isActive: active2 }
+  );
   const sessionDot = (st) => st === "active" ? { ch: "\u25CF", color: theme.ok } : st === "idle" ? { ch: "\u25CC", color: theme.warn } : { ch: "\u25CB", color: theme.dim };
+  if (s === null && localOn === null) {
+    return /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+      spin,
+      " connecting\u2026"
+    ] });
+  }
   return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", paddingX: 1, children: [
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#1432A0", color: "#AAC8FA", bold: true, children: " SOLONGATE LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: ` ${spin} up ${fmtUp(Date.now() - startRef.current)} \xB7 ${hhmmss(Date.now())} \xB7 api ${latNow}ms ` }),
-      frozen ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " PAUSED \xB7 copy freely \xB7 p resume " }) : backingOff ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " RATE LIMITED \xB7 backing off " }) : lastDeny ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d1220", color: "#ff6b6b", bold: true, children: ` \u26A0 ${hhmmss(lastDeny.at)} ${lastDeny.tool} DENIED ` }) : /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#4f6db8", children: " \u2713 clean " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: ` ${spin} up ${fmtUp(nowMs - startRef.current)} \xB7 ${hhmmss(nowMs)} \xB7 api ${latNow}ms ` }),
+      backingOff ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: " RATE LIMITED \xB7 backing off " }) : lastDeny ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#3d1220", color: "#ff6b6b", bold: true, children: ` \u26A0 ${hhmmss(lastDeny.at)} ${lastDeny.tool} DENIED ` }) : /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#4f6db8", children: " \u2713 clean " }),
+      toast && nowMs < toast.until ? /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#123d1f", color: "#7bd88f", bold: true, children: ` ${toast.msg} ` }) : null
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "\u2502 calls " }),
@@ -758,16 +800,20 @@ function LivePanel({ active: active2 }) {
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 deny " }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.bad, bold: true, children: s ? s.denied : "\xB7\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 local " }),
-      localOn ? /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "\u2713 streaming" }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "off" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 ratelimit " }),
+      localOn ? /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "\u2713" }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "off" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 rl " }),
       /* @__PURE__ */ jsx2(Text2, { color: rl?.mode === "block" ? theme.ok : rl?.mode === "detect" ? theme.warn : theme.dim, children: rl?.mode ?? "?" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 dlp " }),
       /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: dl?.mode ?? "?" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 sessions " }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: sessCounts ? `${sessCounts.active}\u25B2 ${sessCounts.idle}\u25CC ${sessCounts.deactivated}\u25CB` : "\xB7" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 ghost " }),
+      /* @__PURE__ */ jsx2(Text2, { color: gh?.mode === "on" ? theme.ok : theme.dim, children: gh?.mode ?? "?" }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 sess " }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: `${localSessList.length}loc ${sessCounts?.active ?? 0}\u25B2${sessCounts?.idle ?? 0}\u25CC` }),
+      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502 hooks " }),
+      /* @__PURE__ */ jsx2(Text2, { color: guard.data?.up_to_date ? theme.ok : theme.warn, children: guard.data ? `v${guard.data.installed ?? "?"}${guard.data.up_to_date ? "" : "\u2192v" + guard.data.latest} ${guard.data.device_count}dev` : "\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502" })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: traffic, hot: trafficHot, height: chartH, width: leftW, color: theme.accent })
@@ -777,39 +823,38 @@ function LivePanel({ active: active2 }) {
         /* @__PURE__ */ jsx2(ColumnChart, { series: lat, hot: lat.map((v) => v > latHotAt), height: chartH, width: rightW, color: "#82AAF0", hotColor: "#ffb454" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: colH, children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "LAYERS", width: colW }),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "RATELIMIT ".padEnd(10) }),
           /* @__PURE__ */ jsx2(Text2, { color: rl?.mode === "block" ? theme.ok : rl?.mode === "detect" ? theme.warn : theme.dim, children: (rl?.mode ?? "?").padEnd(7) }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: rl?.perMinute ? `${minuteNow}/${rl.perMinute} per min` : "no limit set" })
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: rl?.perMinute ? `${minuteNow}/${rl.perMinute}m ${rl.perHour || "\u2014"}h ${rl.perDay || "\u2014"}d` : "no limits set" })
         ] }),
-        rl?.perMinute ? /* @__PURE__ */ jsx2(HBar, { label: "load", value: minuteNow, max: rl.perMinute, width: Math.max(6, colW - 16), color: minuteNow > rl.perMinute ? theme.bad : theme.accent }) : null,
+        rl?.perMinute ? /* @__PURE__ */ jsx2(HBar, { label: "load/min", value: minuteNow, max: rl.perMinute, width: Math.max(6, colW - 16), color: minuteNow > rl.perMinute ? theme.bad : theme.accent }) : null,
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "DLP".padEnd(10) }),
           /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: (dl?.mode ?? "?").padEnd(7) }),
-          /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-            (dl?.patterns ?? []).length,
-            " patterns armed"
-          ] })
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${(dl?.patterns ?? []).length} builtin \xB7 ${(dl?.custom ?? []).length} custom` })
         ] }),
         dlpBars.length ? dlpBars.map((d) => /* @__PURE__ */ jsx2(HBar, { label: truncate(d.pattern, 10), value: d.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d.pattern)) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "          no dlp hits in last 7 days" }),
-        ring ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "GUARD".padEnd(10) }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "local \u2713" }),
-          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` eval avg ${ring.avgMs}ms \xB7 ${ring.count} recent` })
-        ] }) : null
+          ring ? /* @__PURE__ */ jsxs2(Text2, { color: theme.ok, children: [
+            "local \u2713 ",
+            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `eval avg ${ring.avgMs}ms` })
+          ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "no local ring in cwd" })
+        ] })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, children: [
-        /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: `${localSessList.length} local \xB7 ${sessCounts?.active ?? 0} cloud live`, width: colW }),
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+        /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: `${localSessList.length} local \xB7 ${sessCounts?.active ?? 0} cloud`, width: colW }),
         localSessList.length === 0 && sess.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         localSessList.slice(0, Math.max(1, colH - 2)).map(([id, v]) => {
-          const fresh = nowMs - v.lastAt < 9e4;
+          const freshDot = nowMs - v.lastAt < 9e4;
           const isMe = ring?.session === id;
           return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-            /* @__PURE__ */ jsxs2(Text2, { color: fresh ? theme.ok : theme.dim, children: [
-              fresh ? "\u25CF" : "\u25CB",
+            /* @__PURE__ */ jsxs2(Text2, { color: freshDot ? theme.ok : theme.dim, children: [
+              freshDot ? "\u25CF" : "\u25CB",
               " "
             ] }),
             /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "LOC " }),
@@ -842,12 +887,12 @@ function LivePanel({ active: active2 }) {
               String(a.denied_calls).padStart(3),
               "d "
             ] }),
-            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ago(a.last_seen_at) })
+            /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `t${a.trust_score} ` + ago(a.last_seen_at) })
           ] }, a.session_id);
         })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, children: [
-        /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "streaming", width: colW }),
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
+        /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
         log.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
             hhmmss(l.ts),
@@ -858,33 +903,45 @@ function LivePanel({ active: active2 }) {
         ] }, l.ts + ":" + i))
       ] })
     ] }),
-    /* @__PURE__ */ jsx2(PaneTitle, { label: "TOOL STREAM", extra: `local+cloud tail \xB7 ${merged.length} buffered`, width: innerW }),
-    localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-      /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable in dashboard \u2192 Settings \u2192 Local logs; hooks then write ~/.solongate/local-logs (view them there with `solongate logs-server`)" })
-    ] }) : null,
-    tail.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-      spin,
-      " awaiting traffic\u2026"
-    ] }) : null,
-    tail.map((e) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-      /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-        "[",
-        hhmmss(e.at),
-        " "
-      ] }),
-      /* @__PURE__ */ jsx2(Text2, { color: e.source === "local" ? theme.ok : "#4f6db8", children: e.source === "local" ? "LOC" : "CLD" }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
-      /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate(e.tool, 14).padEnd(15) }),
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
-      e.dlp ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "DLP! " }) : null,
-      /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
-    ] }, e.id)),
+    /* @__PURE__ */ jsx2(
+      PaneTitle,
+      {
+        label: "TOOL STREAM",
+        extra: `last ${STREAM_KEEP} \xB7 filter ${filter}${clampedScroll > 0 ? ` \xB7 \u25B2${clampedScroll} scrolled` : " \xB7 following"} \xB7 f filter \xB7 \u2191\u2193 scroll \xB7 c copy`,
+        width: innerW
+      }
+    ),
+    /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", height: streamRows, overflow: "hidden", children: [
+      localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable: dashboard \u2192 Settings \u2192 Local logs \xB7 hooks write ~/.solongate/local-logs \xB7 view: `solongate logs-server`" })
+      ] }) : null,
+      windowed.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+        spin,
+        " awaiting traffic\u2026"
+      ] }) : null,
+      windowed.map((e) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
+          "[",
+          hhmmss(e.at),
+          " "
+        ] }),
+        /* @__PURE__ */ jsx2(Text2, { color: e.source === "local" ? theme.ok : "#4f6db8", children: e.source === "local" ? "LOC" : "CLD" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
+        /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate(e.tool, 12).padEnd(13) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
+        /* @__PURE__ */ jsx2(Text2, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: truncate(e.agent ?? "-", 11).padEnd(12) }),
+        e.dlp ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: "DLP! " }) : null,
+        e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: truncate(e.rule, 14) + " " }) : null,
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
+      ] }, e.id))
+    ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", bold: true, children: " LIVE " }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} \xB7 buf ${merged.length} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " p pause/copy \xB7 esc menu \xB7 q quit " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld buffered \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " f filter \xB7 \u2191\u2193 scroll \xB7 c copy \xB7 esc menu \xB7 q quit " })
     ] })
   ] });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.68.0",
+  "version": "0.69.0",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {