@solongate/proxy 0.77.1 → 0.78.0

package/dist/api-client/audit.d.ts

@@ -20,3 +20,11 @@ export declare function whitelist(id: string, scope?: 'exact' | 'tool'): Promise
     policy_version?: number;
     message?: string;
 }>;
+export declare function block(id: string, scope?: 'exact' | 'tool'): Promise<{
+    ok: true;
+    deduped: boolean;
+    scope: string;
+    policy_id: string;
+    policy_version?: number;
+    message?: string;
+}>;

package/dist/api-client/policies.d.ts

@@ -13,6 +13,7 @@ export interface RuleSpec {
     toolPattern?: string;
     kind?: 'command' | 'path' | 'url' | 'tool';
     value?: string;
+    effect?: 'ALLOW' | 'DENY';
 }
 export declare function addRule(id: string, spec: RuleSpec): Promise<{
     ok: true;

package/dist/commands/index.js

@@ -233,6 +233,7 @@ function securityInsights(days) {
 // src/api-client/audit.ts
 var audit_exports = {};
 __export(audit_exports, {
+  block: () => block,
   list: () => list2,
   whitelist: () => whitelist
 });
@@ -242,6 +243,9 @@ function list2(query = {}) {
 function whitelist(id, scope = "exact") {
   return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
 }
+function block(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/block`, { body: { scope } });
+}
 
 // src/api-client/agents.ts
 var agents_exports = {};

package/dist/index.js

@@ -6924,6 +6924,7 @@ var init_stats = __esm({
 // src/api-client/audit.ts
 var audit_exports = {};
 __export(audit_exports, {
+  block: () => block,
   list: () => list2,
   whitelist: () => whitelist
 });
@@ -6933,6 +6934,9 @@ function list2(query = {}) {
 function whitelist(id, scope = "exact") {
   return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
 }
+function block(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/block`, { body: { scope } });
+}
 var init_audit = __esm({
   "src/api-client/audit.ts"() {
     "use strict";
@@ -7052,6 +7056,19 @@ function tailLines(file, maxBytes = 131072) {
     return [];
   }
 }
+function extractTarget(detail) {
+  try {
+    const j = JSON.parse(detail);
+    const cmd = String(j.command ?? j.cmd ?? "").trim();
+    if (cmd) return { kind: "command", value: cmd };
+    const fp = String(j.file_path ?? j.path ?? "").trim();
+    if (fp) return { kind: "path", value: fp.split(/[\\/]/).pop() || fp };
+    const url = String(j.url ?? "").trim();
+    if (url) return { kind: "url", value: url };
+  } catch {
+  }
+  return null;
+}
 function cloudItem(e) {
   return {
     id: "c:" + e.id,
@@ -7061,6 +7078,7 @@ function cloudItem(e) {
     permission: (e.permission ?? "").slice(0, 4),
     detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
     dlp: !!e.dlp_matches?.length,
+    burst: !!e.rate_limit_burst,
     source: "cloud",
     session: e.session_id ?? void 0,
     agent: e.agent_name ?? void 0,
@@ -7116,8 +7134,9 @@ function PaneTitle({ label, extra, width: width2 }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
   ] });
 }
-function StreamLine({ e, loc }) {
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+function StreamLine({ e, loc, selected }) {
+  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx2(Text2, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
     /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
       "[",
       hhmmss(e.at),
@@ -7144,9 +7163,14 @@ function LivePanel({ active: active2 }) {
   const [ring, setRing] = useState2(null);
   const [log6, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
+  const [signal, setSignal] = useState2("none");
   const [search, setSearch] = useState2("");
   const [editingSearch, setEditingSearch] = useState2(false);
-  const [scroll, setScroll] = useState2(0);
+  const [sel, setSel] = useState2(0);
+  const [actionMsg, setActionMsg] = useState2(null);
+  const notifiedRef = useRef2(/* @__PURE__ */ new Set());
+  const notifyReady = useRef2(false);
+  const activePolicyRef = useRef2(null);
   const [mode, setMode] = useState2("stream");
   const [pickIdx, setPickIdx] = useState2(0);
   const [detail, setDetail] = useState2(null);
@@ -7156,6 +7180,7 @@ function LivePanel({ active: active2 }) {
   const lastLocalTs = useRef2(0);
   const pausedUntil = useRef2(0);
   const sessRef = useRef2([]);
+  const mergedRef = useRef2([]);
   const prevStatus = useRef2(/* @__PURE__ */ new Map());
   const [alerts, setAlerts] = useState2([]);
   const [frozen, setFrozen] = useState2(false);
@@ -7204,6 +7229,7 @@ function LivePanel({ active: active2 }) {
           permission: (j.permission ?? "").slice(0, 4),
           detail: (j.arguments ? JSON.stringify(j.arguments) : j.reason ?? "").replace(/\s+/g, " "),
           dlp: !!j.dlp,
+          burst: !!j.rate_limit_burst,
           source: "local",
           session: j.session_id,
           agent: j.agent_name,
@@ -7318,30 +7344,52 @@ function LivePanel({ active: active2 }) {
     return () => clearInterval(t);
   }, [active2, frozen]);
   const startRef = useRef2(Date.now());
+  const fireAlert = useCallback2(
+    (id, title, msg, level = "warn") => {
+      pushLog(`${level === "bad" ? "\u26D4" : "\u23F8"} ${msg}`, level);
+      setAlerts((a) => [...a.filter((x) => x.id !== id), { id, msg, level, until: Date.now() + 15e3 }].slice(-4));
+      try {
+        process.stdout.write("\x07");
+      } catch {
+      }
+      try {
+        const child = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+        child.on("error", () => {
+        });
+        child.unref();
+      } catch {
+      }
+    },
+    [pushLog]
+  );
   useEffect2(() => {
     if (!active2) return;
     for (const r of sessRef.current) {
       const prev = prevStatus.current.get(r.id);
       if (prev && prev === "active" && r.status === "idle") {
         const name = r.isMe ? `${r.agent} (this machine)` : r.agent;
-        const msg = `${name} went IDLE, no tool call for 60s`;
-        pushLog(`\u23F8 ${msg}`, "warn");
-        setAlerts((a) => [...a.filter((x) => x.id !== r.id), { id: r.id, msg, until: Date.now() + 15e3 }].slice(-4));
-        try {
-          process.stdout.write("\x07");
-        } catch {
-        }
-        try {
-          const child = spawn("notify-send", ["-a", "SolonGate", "Agent idle", msg], { stdio: "ignore", detached: true });
-          child.on("error", () => {
-          });
-          child.unref();
-        } catch {
-        }
+        fireAlert("idle:" + r.id, "Agent idle", `${name} went IDLE, no tool call for 60s`, "warn");
       }
       prevStatus.current.set(r.id, r.status);
     }
-  }, [tick, active2, pushLog]);
+  }, [tick, active2, fireAlert]);
+  useEffect2(() => {
+    if (!active2) return;
+    const notable = mergedRef.current.filter((e) => e.decision !== "ALLOW" || e.dlp || e.burst);
+    if (!notifyReady.current) {
+      for (const e of notable) notifiedRef.current.add(e.id);
+      notifyReady.current = true;
+      return;
+    }
+    for (const e of notable) {
+      if (notifiedRef.current.has(e.id)) continue;
+      notifiedRef.current.add(e.id);
+      const who = e.agent ? ` \xB7 ${truncate2(e.agent, 20)}` : "";
+      if (e.dlp) fireAlert("sec:" + e.id, "DLP hit", `SECRET in ${e.tool}${who}: ${truncate2(e.detail, 60)}`, "bad");
+      else if (e.decision !== "ALLOW") fireAlert("sec:" + e.id, "Call denied", `DENY ${e.tool}${who}: ${truncate2(e.rule ?? e.detail, 60)}`, "bad");
+      else if (e.burst) fireAlert("sec:" + e.id, "Rate-limit burst", `BURST ${e.tool}${who}`, "warn");
+    }
+  }, [tick, active2, fireAlert]);
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const ins = insights.data ?? {};
@@ -7354,6 +7402,7 @@ function LivePanel({ active: active2 }) {
   }
   const cloudDeduped = cloudBuf.filter((e) => !localKeys.has(`${e.tool}|${e.decision}|${Math.round(e.at / 6e4)}`));
   const mergedAll = [...cloudDeduped, ...localBuf].sort((a, b) => a.at - b.at);
+  mergedRef.current = mergedAll;
   const nowSlot = Math.floor(nowMs / 1e4);
   const traffic = new Array(60).fill(0);
   const trafficHot = new Array(60).fill(false);
@@ -7413,7 +7462,8 @@ function LivePanel({ active: active2 }) {
   const isLoc = (e) => e.source === "local" || !!e.session && localSessIds.has(e.session);
   const q = search.trim().toLowerCase();
   const matches = (e) => !q || `${e.tool} ${e.agent ?? ""} ${e.decision} ${e.permission} ${e.rule ?? ""} ${e.detail}`.toLowerCase().includes(q);
-  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches);
+  const signalOk = (e) => signal === "none" ? true : signal === "deny" ? e.decision !== "ALLOW" : signal === "dlp" ? e.dlp : e.burst;
+  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches).filter(signalOk);
   const visibleDesc = filtered.slice().reverse();
   const chartH = rows >= 36 ? 6 : 4;
   const colH = rows >= 32 ? 7 : 5;
@@ -7424,9 +7474,11 @@ function LivePanel({ active: active2 }) {
   const colW = Math.max(20, Math.floor((innerW - 4) / 3));
   const pickable = combinedSess.slice(0, colH - 1);
   const streamBodyRows = Math.max(3, streamRows - 1);
+  const selClamped = Math.min(Math.max(0, sel), Math.max(0, visibleDesc.length - 1));
   const maxScroll = Math.max(0, visibleDesc.length - streamBodyRows);
-  const clampedScroll = Math.min(scroll, maxScroll);
+  const clampedScroll = Math.min(Math.max(0, selClamped - Math.floor((streamBodyRows - 1) / 2)), maxScroll);
   const windowed = visibleDesc.slice(clampedScroll, clampedScroll + streamBodyRows);
+  const selEntry = visibleDesc[selClamped];
   const detailEntries = detail ? (() => {
     const seen = /* @__PURE__ */ new Set();
     const all = [];
@@ -7438,6 +7490,42 @@ function LivePanel({ active: active2 }) {
     }
     return all.sort((a, b) => b.at - a.at);
   })() : [];
+  const doAction = async (act) => {
+    const e = selEntry;
+    if (!e) return;
+    const ok = act === "whitelist" ? e.decision !== "ALLOW" : e.decision === "ALLOW";
+    if (!ok) {
+      setActionMsg({ text: act === "whitelist" ? "select a DENY to whitelist (w)" : "select an ALLOW to block (b)", level: "bad", until: Date.now() + 4e3 });
+      return;
+    }
+    setActionMsg({ text: act === "whitelist" ? "whitelisting\u2026" : "blocking\u2026", level: "ok", until: Date.now() + 4e3 });
+    try {
+      let res;
+      if (e.source === "cloud") {
+        const realId = e.id.slice(2);
+        res = act === "whitelist" ? await api.audit.whitelist(realId) : await api.audit.block(realId);
+      } else {
+        let pid = activePolicyRef.current;
+        if (!pid) {
+          const a = await api.policies.active();
+          pid = a.policy?.id ?? null;
+          activePolicyRef.current = pid;
+        }
+        if (!pid) throw new Error("no active policy resolves for this machine");
+        const t = extractTarget(e.detail);
+        res = await api.policies.addRule(pid, { toolPattern: e.tool, kind: t?.kind ?? "tool", value: t?.value, effect: act === "whitelist" ? "ALLOW" : "DENY" });
+      }
+      const verb = act === "whitelist" ? "ALLOW" : "DENY";
+      setActionMsg({
+        text: res.deduped ? `${verb} rule already present` : `${verb} rule added \u2192 ${res.policy_id ?? "?"}${res.policy_version ? " v" + res.policy_version : ""} \xB7 reaches agents in ~30s`,
+        level: "ok",
+        until: Date.now() + 7e3
+      });
+      pushLog(`${act === "whitelist" ? "\u2713 whitelisted" : "\u26D4 blocked"} ${e.tool}`, act === "whitelist" ? "ok" : "warn");
+    } catch (err2) {
+      setActionMsg({ text: "\u2717 " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 7e3 });
+    }
+  };
   useInput(
     (input, key) => {
       if (input === " ") {
@@ -7472,16 +7560,25 @@ function LivePanel({ active: active2 }) {
         } else if (input === "s" || key.leftArrow) setMode("stream");
         return;
       }
+      const toggleSignal = (s2) => {
+        setSignal((cur) => cur === s2 ? "none" : s2);
+        setSel(0);
+      };
       if (input === "f") {
         setFilter((f) => FILTERS[(FILTERS.indexOf(f) + 1) % FILTERS.length]);
-        setScroll(0);
+        setSel(0);
       } else if (input === "s") {
         setPickIdx(0);
         setMode("pick");
-      } else if (key.downArrow) setScroll((n) => Math.min(maxScroll, n + 1));
-      else if (key.upArrow) setScroll((n) => Math.max(0, n - 1));
-      else if (key.pageDown) setScroll((n) => Math.min(maxScroll, n + streamRows));
-      else if (key.pageUp) setScroll((n) => Math.max(0, n - streamRows));
+      } else if (input === "w") void doAction("whitelist");
+      else if (input === "b") void doAction("block");
+      else if (input === "d") toggleSignal("deny");
+      else if (input === "x") toggleSignal("dlp");
+      else if (input === "r") toggleSignal("ratelimit");
+      else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
+      else if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.pageDown) setSel((n) => Math.min(visibleDesc.length - 1, n + streamBodyRows));
+      else if (key.pageUp) setSel((n) => Math.max(0, n - streamBodyRows));
     },
     { isActive: active2 && !editingSearch }
   );
@@ -7498,7 +7595,7 @@ function LivePanel({ active: active2 }) {
               return;
             }
             setSearch(v);
-            setScroll(0);
+            setSel(0);
             setDetailScroll(0);
           },
           onSubmit: () => setEditingSearch(false)
@@ -7618,7 +7715,18 @@ function LivePanel({ active: active2 }) {
       /* @__PURE__ */ jsx2(Text2, { color: guard.data?.up_to_date ? theme.ok : theme.warn, children: guard.data ? `v${guard.data.installed ?? "?"}${guard.data.up_to_date ? "" : "\u2192v" + guard.data.latest} ${guard.data.device_count}dev` : "\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502" })
     ] }),
-    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: ` \u23F8 IDLE \xB7 ${truncate2(a.msg, innerW - 12)} ` }, a.id)),
+    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(
+      Text2,
+      {
+        wrap: "truncate",
+        backgroundColor: a.level === "bad" ? "#3d1220" : "#3d2a12",
+        color: a.level === "bad" ? "#ff6b6b" : "#ffb454",
+        bold: true,
+        children: ` ${a.level === "bad" ? "\u26D4 ALERT" : "\u23F8 IDLE"} \xB7 ${truncate2(a.msg, innerW - 14)} `
+      },
+      a.id
+    )),
+    actionMsg && nowMs < actionMsg.until ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: actionMsg.level === "bad" ? "#3d1220" : "#123d1f", color: actionMsg.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate2(actionMsg.text, innerW - 4)} ` }) : null,
     /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
@@ -7656,11 +7764,11 @@ function LivePanel({ active: active2 }) {
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
-          const sel = mode === "pick" && i === pickIdx;
+          const sel2 = mode === "pick" && i === pickIdx;
           const st = STATUS_STYLE[r.status];
-          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel ? "#1c2f63" : void 0, bold: sel || r.isMe, children: [
-            /* @__PURE__ */ jsxs2(Text2, { color: sel ? theme.accentBright : st.color, children: [
-              sel ? "\u25B8" : st.dot,
+          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel2 ? "#1c2f63" : void 0, bold: sel2 || r.isMe, children: [
+            /* @__PURE__ */ jsxs2(Text2, { color: sel2 ? theme.accentBright : st.color, children: [
+              sel2 ? "\u25B8" : st.dot,
               " "
             ] }),
             /* @__PURE__ */ jsx2(Text2, { color: st.color, children: st.label.padEnd(7) }),
@@ -7693,7 +7801,7 @@ function LivePanel({ active: active2 }) {
       PaneTitle,
       {
         label: "TOOL STREAM",
-        extra: `${visibleDesc.length} entries${q ? " matched" : ""} \xB7 newest first \xB7 filter ${filter}${clampedScroll > 0 ? ` \xB7 \u25BC${clampedScroll} older` : ""} \xB7 f \xB7 / \xB7 \u2191\u2193 \xB7 s`,
+        extra: `${selClamped + 1}/${visibleDesc.length}${signal !== "none" ? ` \xB7 ${signal}` : ""}${q ? " \xB7 search" : ""} \xB7 \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r ${filter} \xB7 s`,
         width: innerW
       }
     ),
@@ -7707,12 +7815,12 @@ function LivePanel({ active: active2 }) {
         spin,
         " awaiting traffic\u2026"
       ] }) : null,
-      windowed.map((e) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e) }, e.id))
+      windowed.map((e, i) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e), selected: clampedScroll + i === selClamped }, e.id))
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", bold: true, children: " LIVE " }),
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " space copy-mode \xB7 / search \xB7 f filter \xB7 s sessions \xB7 esc menu \xB7 q quit " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r \xB7 / search \xB7 f \xB7 s \xB7 space copy \xB7 esc \xB7 q " })
     ] })
   ] });
 }
@@ -9560,13 +9668,13 @@ function shimTargets() {
   }
   return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir4(), f)).filter((f) => existsSync4(f));
 }
-function writeShimBlock(file, block) {
+function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
   let content = existsSync4(file) ? readFileSync6(file, "utf-8") : "";
   content = content.replace(re, "");
-  if (block) {
+  if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block + "\n";
+    content += block2 + "\n";
   }
   mkdirSync3(dirname(file), { recursive: true });
   writeFileSync3(file, content);
@@ -9580,7 +9688,7 @@ function installClaudeShim(shieldPath) {
   const node = process.execPath.replace(/\\/g, "/");
   const shield = shieldPath.replace(/\\/g, "/");
   const win = process.platform === "win32";
-  const block = win ? `${SHIM_BEGIN}
+  const block2 = win ? `${SHIM_BEGIN}
 function claude { & "${node}" "${shield}" -- "${real}" @args }
 ${SHIM_END}` : `${SHIM_BEGIN}
 claude() { "${node}" "${shield}" -- "${real}" "$@"; }
@@ -9592,7 +9700,7 @@ ${SHIM_END}`;
   }
   for (const file of targets) {
     try {
-      writeShimBlock(file, block);
+      writeShimBlock(file, block2);
       console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
     } catch (e) {
       console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);

package/dist/tui/index.js

@@ -370,6 +370,7 @@ function securityInsights(days) {
 // src/api-client/audit.ts
 var audit_exports = {};
 __export(audit_exports, {
+  block: () => block,
   list: () => list2,
   whitelist: () => whitelist
 });
@@ -379,6 +380,9 @@ function list2(query = {}) {
 function whitelist(id, scope = "exact") {
   return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
 }
+function block(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/block`, { body: { scope } });
+}
 
 // src/api-client/agents.ts
 var agents_exports = {};
@@ -475,6 +479,19 @@ function tailLines(file, maxBytes = 131072) {
     return [];
   }
 }
+function extractTarget(detail) {
+  try {
+    const j = JSON.parse(detail);
+    const cmd = String(j.command ?? j.cmd ?? "").trim();
+    if (cmd) return { kind: "command", value: cmd };
+    const fp = String(j.file_path ?? j.path ?? "").trim();
+    if (fp) return { kind: "path", value: fp.split(/[\\/]/).pop() || fp };
+    const url = String(j.url ?? "").trim();
+    if (url) return { kind: "url", value: url };
+  } catch {
+  }
+  return null;
+}
 function cloudItem(e) {
   return {
     id: "c:" + e.id,
@@ -484,6 +501,7 @@ function cloudItem(e) {
     permission: (e.permission ?? "").slice(0, 4),
     detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
     dlp: !!e.dlp_matches?.length,
+    burst: !!e.rate_limit_burst,
     source: "cloud",
     session: e.session_id ?? void 0,
     agent: e.agent_name ?? void 0,
@@ -539,8 +557,9 @@ function PaneTitle({ label, extra, width }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width - used)) })
   ] });
 }
-function StreamLine({ e, loc }) {
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+function StreamLine({ e, loc, selected }) {
+  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx2(Text2, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
     /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
       "[",
       hhmmss(e.at),
@@ -574,9 +593,14 @@ function LivePanel({ active: active2 }) {
   const [ring, setRing] = useState2(null);
   const [log, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
+  const [signal, setSignal] = useState2("none");
   const [search, setSearch] = useState2("");
   const [editingSearch, setEditingSearch] = useState2(false);
-  const [scroll, setScroll] = useState2(0);
+  const [sel, setSel] = useState2(0);
+  const [actionMsg, setActionMsg] = useState2(null);
+  const notifiedRef = useRef2(/* @__PURE__ */ new Set());
+  const notifyReady = useRef2(false);
+  const activePolicyRef = useRef2(null);
   const [mode, setMode] = useState2("stream");
   const [pickIdx, setPickIdx] = useState2(0);
   const [detail, setDetail] = useState2(null);
@@ -586,6 +610,7 @@ function LivePanel({ active: active2 }) {
   const lastLocalTs = useRef2(0);
   const pausedUntil = useRef2(0);
   const sessRef = useRef2([]);
+  const mergedRef = useRef2([]);
   const prevStatus = useRef2(/* @__PURE__ */ new Map());
   const [alerts, setAlerts] = useState2([]);
   const [frozen, setFrozen] = useState2(false);
@@ -634,6 +659,7 @@ function LivePanel({ active: active2 }) {
           permission: (j.permission ?? "").slice(0, 4),
           detail: (j.arguments ? JSON.stringify(j.arguments) : j.reason ?? "").replace(/\s+/g, " "),
           dlp: !!j.dlp,
+          burst: !!j.rate_limit_burst,
           source: "local",
           session: j.session_id,
           agent: j.agent_name,
@@ -748,30 +774,52 @@ function LivePanel({ active: active2 }) {
     return () => clearInterval(t);
   }, [active2, frozen]);
   const startRef = useRef2(Date.now());
+  const fireAlert = useCallback2(
+    (id, title, msg, level = "warn") => {
+      pushLog(`${level === "bad" ? "\u26D4" : "\u23F8"} ${msg}`, level);
+      setAlerts((a) => [...a.filter((x) => x.id !== id), { id, msg, level, until: Date.now() + 15e3 }].slice(-4));
+      try {
+        process.stdout.write("\x07");
+      } catch {
+      }
+      try {
+        const child = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+        child.on("error", () => {
+        });
+        child.unref();
+      } catch {
+      }
+    },
+    [pushLog]
+  );
   useEffect2(() => {
     if (!active2) return;
     for (const r of sessRef.current) {
       const prev = prevStatus.current.get(r.id);
       if (prev && prev === "active" && r.status === "idle") {
         const name = r.isMe ? `${r.agent} (this machine)` : r.agent;
-        const msg = `${name} went IDLE, no tool call for 60s`;
-        pushLog(`\u23F8 ${msg}`, "warn");
-        setAlerts((a) => [...a.filter((x) => x.id !== r.id), { id: r.id, msg, until: Date.now() + 15e3 }].slice(-4));
-        try {
-          process.stdout.write("\x07");
-        } catch {
-        }
-        try {
-          const child = spawn("notify-send", ["-a", "SolonGate", "Agent idle", msg], { stdio: "ignore", detached: true });
-          child.on("error", () => {
-          });
-          child.unref();
-        } catch {
-        }
+        fireAlert("idle:" + r.id, "Agent idle", `${name} went IDLE, no tool call for 60s`, "warn");
       }
       prevStatus.current.set(r.id, r.status);
     }
-  }, [tick, active2, pushLog]);
+  }, [tick, active2, fireAlert]);
+  useEffect2(() => {
+    if (!active2) return;
+    const notable = mergedRef.current.filter((e) => e.decision !== "ALLOW" || e.dlp || e.burst);
+    if (!notifyReady.current) {
+      for (const e of notable) notifiedRef.current.add(e.id);
+      notifyReady.current = true;
+      return;
+    }
+    for (const e of notable) {
+      if (notifiedRef.current.has(e.id)) continue;
+      notifiedRef.current.add(e.id);
+      const who = e.agent ? ` \xB7 ${truncate(e.agent, 20)}` : "";
+      if (e.dlp) fireAlert("sec:" + e.id, "DLP hit", `SECRET in ${e.tool}${who}: ${truncate(e.detail, 60)}`, "bad");
+      else if (e.decision !== "ALLOW") fireAlert("sec:" + e.id, "Call denied", `DENY ${e.tool}${who}: ${truncate(e.rule ?? e.detail, 60)}`, "bad");
+      else if (e.burst) fireAlert("sec:" + e.id, "Rate-limit burst", `BURST ${e.tool}${who}`, "warn");
+    }
+  }, [tick, active2, fireAlert]);
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const ins = insights.data ?? {};
@@ -784,6 +832,7 @@ function LivePanel({ active: active2 }) {
   }
   const cloudDeduped = cloudBuf.filter((e) => !localKeys.has(`${e.tool}|${e.decision}|${Math.round(e.at / 6e4)}`));
   const mergedAll = [...cloudDeduped, ...localBuf].sort((a, b) => a.at - b.at);
+  mergedRef.current = mergedAll;
   const nowSlot = Math.floor(nowMs / 1e4);
   const traffic = new Array(60).fill(0);
   const trafficHot = new Array(60).fill(false);
@@ -843,7 +892,8 @@ function LivePanel({ active: active2 }) {
   const isLoc = (e) => e.source === "local" || !!e.session && localSessIds.has(e.session);
   const q = search.trim().toLowerCase();
   const matches = (e) => !q || `${e.tool} ${e.agent ?? ""} ${e.decision} ${e.permission} ${e.rule ?? ""} ${e.detail}`.toLowerCase().includes(q);
-  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches);
+  const signalOk = (e) => signal === "none" ? true : signal === "deny" ? e.decision !== "ALLOW" : signal === "dlp" ? e.dlp : e.burst;
+  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches).filter(signalOk);
   const visibleDesc = filtered.slice().reverse();
   const chartH = rows >= 36 ? 6 : 4;
   const colH = rows >= 32 ? 7 : 5;
@@ -854,9 +904,11 @@ function LivePanel({ active: active2 }) {
   const colW = Math.max(20, Math.floor((innerW - 4) / 3));
   const pickable = combinedSess.slice(0, colH - 1);
   const streamBodyRows = Math.max(3, streamRows - 1);
+  const selClamped = Math.min(Math.max(0, sel), Math.max(0, visibleDesc.length - 1));
   const maxScroll = Math.max(0, visibleDesc.length - streamBodyRows);
-  const clampedScroll = Math.min(scroll, maxScroll);
+  const clampedScroll = Math.min(Math.max(0, selClamped - Math.floor((streamBodyRows - 1) / 2)), maxScroll);
   const windowed = visibleDesc.slice(clampedScroll, clampedScroll + streamBodyRows);
+  const selEntry = visibleDesc[selClamped];
   const detailEntries = detail ? (() => {
     const seen = /* @__PURE__ */ new Set();
     const all = [];
@@ -868,6 +920,42 @@ function LivePanel({ active: active2 }) {
     }
     return all.sort((a, b) => b.at - a.at);
   })() : [];
+  const doAction = async (act) => {
+    const e = selEntry;
+    if (!e) return;
+    const ok = act === "whitelist" ? e.decision !== "ALLOW" : e.decision === "ALLOW";
+    if (!ok) {
+      setActionMsg({ text: act === "whitelist" ? "select a DENY to whitelist (w)" : "select an ALLOW to block (b)", level: "bad", until: Date.now() + 4e3 });
+      return;
+    }
+    setActionMsg({ text: act === "whitelist" ? "whitelisting\u2026" : "blocking\u2026", level: "ok", until: Date.now() + 4e3 });
+    try {
+      let res;
+      if (e.source === "cloud") {
+        const realId = e.id.slice(2);
+        res = act === "whitelist" ? await api.audit.whitelist(realId) : await api.audit.block(realId);
+      } else {
+        let pid = activePolicyRef.current;
+        if (!pid) {
+          const a = await api.policies.active();
+          pid = a.policy?.id ?? null;
+          activePolicyRef.current = pid;
+        }
+        if (!pid) throw new Error("no active policy resolves for this machine");
+        const t = extractTarget(e.detail);
+        res = await api.policies.addRule(pid, { toolPattern: e.tool, kind: t?.kind ?? "tool", value: t?.value, effect: act === "whitelist" ? "ALLOW" : "DENY" });
+      }
+      const verb = act === "whitelist" ? "ALLOW" : "DENY";
+      setActionMsg({
+        text: res.deduped ? `${verb} rule already present` : `${verb} rule added \u2192 ${res.policy_id ?? "?"}${res.policy_version ? " v" + res.policy_version : ""} \xB7 reaches agents in ~30s`,
+        level: "ok",
+        until: Date.now() + 7e3
+      });
+      pushLog(`${act === "whitelist" ? "\u2713 whitelisted" : "\u26D4 blocked"} ${e.tool}`, act === "whitelist" ? "ok" : "warn");
+    } catch (err) {
+      setActionMsg({ text: "\u2717 " + (err instanceof Error ? err.message : String(err)), level: "bad", until: Date.now() + 7e3 });
+    }
+  };
   useInput(
     (input, key) => {
       if (input === " ") {
@@ -902,16 +990,25 @@ function LivePanel({ active: active2 }) {
         } else if (input === "s" || key.leftArrow) setMode("stream");
         return;
       }
+      const toggleSignal = (s2) => {
+        setSignal((cur) => cur === s2 ? "none" : s2);
+        setSel(0);
+      };
       if (input === "f") {
         setFilter((f) => FILTERS[(FILTERS.indexOf(f) + 1) % FILTERS.length]);
-        setScroll(0);
+        setSel(0);
       } else if (input === "s") {
         setPickIdx(0);
         setMode("pick");
-      } else if (key.downArrow) setScroll((n) => Math.min(maxScroll, n + 1));
-      else if (key.upArrow) setScroll((n) => Math.max(0, n - 1));
-      else if (key.pageDown) setScroll((n) => Math.min(maxScroll, n + streamRows));
-      else if (key.pageUp) setScroll((n) => Math.max(0, n - streamRows));
+      } else if (input === "w") void doAction("whitelist");
+      else if (input === "b") void doAction("block");
+      else if (input === "d") toggleSignal("deny");
+      else if (input === "x") toggleSignal("dlp");
+      else if (input === "r") toggleSignal("ratelimit");
+      else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
+      else if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.pageDown) setSel((n) => Math.min(visibleDesc.length - 1, n + streamBodyRows));
+      else if (key.pageUp) setSel((n) => Math.max(0, n - streamBodyRows));
     },
     { isActive: active2 && !editingSearch }
   );
@@ -928,7 +1025,7 @@ function LivePanel({ active: active2 }) {
               return;
             }
             setSearch(v);
-            setScroll(0);
+            setSel(0);
             setDetailScroll(0);
           },
           onSubmit: () => setEditingSearch(false)
@@ -1048,7 +1145,18 @@ function LivePanel({ active: active2 }) {
       /* @__PURE__ */ jsx2(Text2, { color: guard.data?.up_to_date ? theme.ok : theme.warn, children: guard.data ? `v${guard.data.installed ?? "?"}${guard.data.up_to_date ? "" : "\u2192v" + guard.data.latest} ${guard.data.device_count}dev` : "\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502" })
     ] }),
-    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: ` \u23F8 IDLE \xB7 ${truncate(a.msg, innerW - 12)} ` }, a.id)),
+    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(
+      Text2,
+      {
+        wrap: "truncate",
+        backgroundColor: a.level === "bad" ? "#3d1220" : "#3d2a12",
+        color: a.level === "bad" ? "#ff6b6b" : "#ffb454",
+        bold: true,
+        children: ` ${a.level === "bad" ? "\u26D4 ALERT" : "\u23F8 IDLE"} \xB7 ${truncate(a.msg, innerW - 14)} `
+      },
+      a.id
+    )),
+    actionMsg && nowMs < actionMsg.until ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: actionMsg.level === "bad" ? "#3d1220" : "#123d1f", color: actionMsg.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate(actionMsg.text, innerW - 4)} ` }) : null,
     /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
@@ -1086,11 +1194,11 @@ function LivePanel({ active: active2 }) {
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
-          const sel = mode === "pick" && i === pickIdx;
+          const sel2 = mode === "pick" && i === pickIdx;
           const st = STATUS_STYLE[r.status];
-          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel ? "#1c2f63" : void 0, bold: sel || r.isMe, children: [
-            /* @__PURE__ */ jsxs2(Text2, { color: sel ? theme.accentBright : st.color, children: [
-              sel ? "\u25B8" : st.dot,
+          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel2 ? "#1c2f63" : void 0, bold: sel2 || r.isMe, children: [
+            /* @__PURE__ */ jsxs2(Text2, { color: sel2 ? theme.accentBright : st.color, children: [
+              sel2 ? "\u25B8" : st.dot,
               " "
             ] }),
             /* @__PURE__ */ jsx2(Text2, { color: st.color, children: st.label.padEnd(7) }),
@@ -1123,7 +1231,7 @@ function LivePanel({ active: active2 }) {
       PaneTitle,
       {
         label: "TOOL STREAM",
-        extra: `${visibleDesc.length} entries${q ? " matched" : ""} \xB7 newest first \xB7 filter ${filter}${clampedScroll > 0 ? ` \xB7 \u25BC${clampedScroll} older` : ""} \xB7 f \xB7 / \xB7 \u2191\u2193 \xB7 s`,
+        extra: `${selClamped + 1}/${visibleDesc.length}${signal !== "none" ? ` \xB7 ${signal}` : ""}${q ? " \xB7 search" : ""} \xB7 \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r ${filter} \xB7 s`,
         width: innerW
       }
     ),
@@ -1137,12 +1245,12 @@ function LivePanel({ active: active2 }) {
         spin,
         " awaiting traffic\u2026"
       ] }) : null,
-      windowed.map((e) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e) }, e.id))
+      windowed.map((e, i) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e), selected: clampedScroll + i === selClamped }, e.id))
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", bold: true, children: " LIVE " }),
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " space copy-mode \xB7 / search \xB7 f filter \xB7 s sessions \xB7 esc menu \xB7 q quit " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r \xB7 / search \xB7 f \xB7 s \xB7 space copy \xB7 esc \xB7 q " })
     ] })
   ] });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.77.1",
+  "version": "0.78.0",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {