@solongate/proxy 0.77.2 → 0.79.0

package/dist/index.js

@@ -6867,9 +6867,15 @@ var init_policies = __esm({
 var settings_exports = {};
 __export(settings_exports, {
   clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
   getGuardStatus: () => getGuardStatus,
   getRateLimitHistory: () => getRateLimitHistory,
   getSecurityLayers: () => getSecurityLayers,
+  getWebhooks: () => getWebhooks,
   setSecurityLayers: () => setSecurityLayers
 });
 function getSecurityLayers() {
@@ -6887,6 +6893,24 @@ function clearRateLimitHistory() {
 function getGuardStatus() {
   return request("GET", "/settings/guard-status");
 }
+function getAlerts() {
+  return request("GET", "/settings/denial-alerts");
+}
+function createAlert(body) {
+  return request("POST", "/settings/denial-alerts", { body });
+}
+function deleteAlert(id) {
+  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+}
+function getWebhooks() {
+  return request("GET", "/settings/denial-webhook");
+}
+function createWebhook(body) {
+  return request("POST", "/settings/denial-webhook", { body });
+}
+function deleteWebhook(id) {
+  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+}
 var init_settings = __esm({
   "src/api-client/settings.ts"() {
     "use strict";
@@ -6924,6 +6948,7 @@ var init_stats = __esm({
 // src/api-client/audit.ts
 var audit_exports = {};
 __export(audit_exports, {
+  block: () => block,
   list: () => list2,
   whitelist: () => whitelist
 });
@@ -6933,6 +6958,9 @@ function list2(query = {}) {
 function whitelist(id, scope = "exact") {
   return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
 }
+function block(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/block`, { body: { scope } });
+}
 var init_audit = __esm({
   "src/api-client/audit.ts"() {
     "use strict";
@@ -6967,6 +6995,44 @@ var init_agents = __esm({
   }
 });
 
+// src/api-client/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  create: () => create2,
+  list: () => list3,
+  revoke: () => revoke
+});
+function list3() {
+  return request("GET", "/keys");
+}
+function create2(name, isLive = true) {
+  return request("POST", "/keys", { body: { name, is_live: isLive } });
+}
+function revoke(id) {
+  return request("DELETE", `/keys/${encodeURIComponent(id)}`);
+}
+var init_keys = __esm({
+  "src/api-client/keys.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  list: () => list4
+});
+function list4() {
+  return request("GET", "/mcp-servers");
+}
+var init_mcp = __esm({
+  "src/api-client/mcp.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
 // src/api-client/index.ts
 var api;
 var init_api_client = __esm({
@@ -6979,7 +7045,9 @@ var init_api_client = __esm({
     init_stats();
     init_audit();
     init_agents();
-    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+    init_keys();
+    init_mcp();
+    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
   }
 });
 
@@ -7052,6 +7120,19 @@ function tailLines(file, maxBytes = 131072) {
     return [];
   }
 }
+function extractTarget(detail) {
+  try {
+    const j = JSON.parse(detail);
+    const cmd = String(j.command ?? j.cmd ?? "").trim();
+    if (cmd) return { kind: "command", value: cmd };
+    const fp = String(j.file_path ?? j.path ?? "").trim();
+    if (fp) return { kind: "path", value: fp.split(/[\\/]/).pop() || fp };
+    const url = String(j.url ?? "").trim();
+    if (url) return { kind: "url", value: url };
+  } catch {
+  }
+  return null;
+}
 function cloudItem(e) {
   return {
     id: "c:" + e.id,
@@ -7061,6 +7142,7 @@ function cloudItem(e) {
     permission: (e.permission ?? "").slice(0, 4),
     detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
     dlp: !!e.dlp_matches?.length,
+    burst: !!e.rate_limit_burst,
     source: "cloud",
     session: e.session_id ?? void 0,
     agent: e.agent_name ?? void 0,
@@ -7116,8 +7198,9 @@ function PaneTitle({ label, extra, width: width2 }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
   ] });
 }
-function StreamLine({ e, loc }) {
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+function StreamLine({ e, loc, selected }) {
+  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx2(Text2, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
     /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
       "[",
       hhmmss(e.at),
@@ -7144,9 +7227,14 @@ function LivePanel({ active: active2 }) {
   const [ring, setRing] = useState2(null);
   const [log6, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
+  const [signal, setSignal] = useState2("none");
   const [search, setSearch] = useState2("");
   const [editingSearch, setEditingSearch] = useState2(false);
-  const [scroll, setScroll] = useState2(0);
+  const [sel, setSel] = useState2(0);
+  const [actionMsg, setActionMsg] = useState2(null);
+  const notifiedRef = useRef2(/* @__PURE__ */ new Set());
+  const notifyReady = useRef2(false);
+  const activePolicyRef = useRef2(null);
   const [mode, setMode] = useState2("stream");
   const [pickIdx, setPickIdx] = useState2(0);
   const [detail, setDetail] = useState2(null);
@@ -7156,6 +7244,7 @@ function LivePanel({ active: active2 }) {
   const lastLocalTs = useRef2(0);
   const pausedUntil = useRef2(0);
   const sessRef = useRef2([]);
+  const mergedRef = useRef2([]);
   const prevStatus = useRef2(/* @__PURE__ */ new Map());
   const [alerts, setAlerts] = useState2([]);
   const [frozen, setFrozen] = useState2(false);
@@ -7204,6 +7293,7 @@ function LivePanel({ active: active2 }) {
           permission: (j.permission ?? "").slice(0, 4),
           detail: (j.arguments ? JSON.stringify(j.arguments) : j.reason ?? "").replace(/\s+/g, " "),
           dlp: !!j.dlp,
+          burst: !!j.rate_limit_burst,
           source: "local",
           session: j.session_id,
           agent: j.agent_name,
@@ -7318,30 +7408,52 @@ function LivePanel({ active: active2 }) {
     return () => clearInterval(t);
   }, [active2, frozen]);
   const startRef = useRef2(Date.now());
+  const fireAlert = useCallback2(
+    (id, title, msg, level = "warn") => {
+      pushLog(`${level === "bad" ? "\u26D4" : "\u23F8"} ${msg}`, level);
+      setAlerts((a) => [...a.filter((x) => x.id !== id), { id, msg, level, until: Date.now() + 15e3 }].slice(-4));
+      try {
+        process.stdout.write("\x07");
+      } catch {
+      }
+      try {
+        const child = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+        child.on("error", () => {
+        });
+        child.unref();
+      } catch {
+      }
+    },
+    [pushLog]
+  );
   useEffect2(() => {
     if (!active2) return;
     for (const r of sessRef.current) {
       const prev = prevStatus.current.get(r.id);
       if (prev && prev === "active" && r.status === "idle") {
         const name = r.isMe ? `${r.agent} (this machine)` : r.agent;
-        const msg = `${name} went IDLE, no tool call for 60s`;
-        pushLog(`\u23F8 ${msg}`, "warn");
-        setAlerts((a) => [...a.filter((x) => x.id !== r.id), { id: r.id, msg, until: Date.now() + 15e3 }].slice(-4));
-        try {
-          process.stdout.write("\x07");
-        } catch {
-        }
-        try {
-          const child = spawn("notify-send", ["-a", "SolonGate", "Agent idle", msg], { stdio: "ignore", detached: true });
-          child.on("error", () => {
-          });
-          child.unref();
-        } catch {
-        }
+        fireAlert("idle:" + r.id, "Agent idle", `${name} went IDLE, no tool call for 60s`, "warn");
       }
       prevStatus.current.set(r.id, r.status);
     }
-  }, [tick, active2, pushLog]);
+  }, [tick, active2, fireAlert]);
+  useEffect2(() => {
+    if (!active2) return;
+    const notable = mergedRef.current.filter((e) => e.decision !== "ALLOW" || e.dlp || e.burst);
+    if (!notifyReady.current) {
+      for (const e of notable) notifiedRef.current.add(e.id);
+      notifyReady.current = true;
+      return;
+    }
+    for (const e of notable) {
+      if (notifiedRef.current.has(e.id)) continue;
+      notifiedRef.current.add(e.id);
+      const who = e.agent ? ` \xB7 ${truncate2(e.agent, 20)}` : "";
+      if (e.dlp) fireAlert("sec:" + e.id, "DLP hit", `SECRET in ${e.tool}${who}: ${truncate2(e.detail, 60)}`, "bad");
+      else if (e.decision !== "ALLOW") fireAlert("sec:" + e.id, "Call denied", `DENY ${e.tool}${who}: ${truncate2(e.rule ?? e.detail, 60)}`, "bad");
+      else if (e.burst) fireAlert("sec:" + e.id, "Rate-limit burst", `BURST ${e.tool}${who}`, "warn");
+    }
+  }, [tick, active2, fireAlert]);
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const ins = insights.data ?? {};
@@ -7354,6 +7466,7 @@ function LivePanel({ active: active2 }) {
   }
   const cloudDeduped = cloudBuf.filter((e) => !localKeys.has(`${e.tool}|${e.decision}|${Math.round(e.at / 6e4)}`));
   const mergedAll = [...cloudDeduped, ...localBuf].sort((a, b) => a.at - b.at);
+  mergedRef.current = mergedAll;
   const nowSlot = Math.floor(nowMs / 1e4);
   const traffic = new Array(60).fill(0);
   const trafficHot = new Array(60).fill(false);
@@ -7413,7 +7526,8 @@ function LivePanel({ active: active2 }) {
   const isLoc = (e) => e.source === "local" || !!e.session && localSessIds.has(e.session);
   const q = search.trim().toLowerCase();
   const matches = (e) => !q || `${e.tool} ${e.agent ?? ""} ${e.decision} ${e.permission} ${e.rule ?? ""} ${e.detail}`.toLowerCase().includes(q);
-  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches);
+  const signalOk = (e) => signal === "none" ? true : signal === "deny" ? e.decision !== "ALLOW" : signal === "dlp" ? e.dlp : e.burst;
+  const filtered = (filter === "all" ? mergedAll : mergedAll.filter((e) => filter === "local" ? isLoc(e) : !isLoc(e))).filter(matches).filter(signalOk);
   const visibleDesc = filtered.slice().reverse();
   const chartH = rows >= 36 ? 6 : 4;
   const colH = rows >= 32 ? 7 : 5;
@@ -7424,9 +7538,11 @@ function LivePanel({ active: active2 }) {
   const colW = Math.max(20, Math.floor((innerW - 4) / 3));
   const pickable = combinedSess.slice(0, colH - 1);
   const streamBodyRows = Math.max(3, streamRows - 1);
+  const selClamped = Math.min(Math.max(0, sel), Math.max(0, visibleDesc.length - 1));
   const maxScroll = Math.max(0, visibleDesc.length - streamBodyRows);
-  const clampedScroll = Math.min(scroll, maxScroll);
+  const clampedScroll = Math.min(Math.max(0, selClamped - Math.floor((streamBodyRows - 1) / 2)), maxScroll);
   const windowed = visibleDesc.slice(clampedScroll, clampedScroll + streamBodyRows);
+  const selEntry = visibleDesc[selClamped];
   const detailEntries = detail ? (() => {
     const seen = /* @__PURE__ */ new Set();
     const all = [];
@@ -7438,6 +7554,42 @@ function LivePanel({ active: active2 }) {
     }
     return all.sort((a, b) => b.at - a.at);
   })() : [];
+  const doAction = async (act) => {
+    const e = selEntry;
+    if (!e) return;
+    const ok = act === "whitelist" ? e.decision !== "ALLOW" : e.decision === "ALLOW";
+    if (!ok) {
+      setActionMsg({ text: act === "whitelist" ? "select a DENY to whitelist (w)" : "select an ALLOW to block (b)", level: "bad", until: Date.now() + 4e3 });
+      return;
+    }
+    setActionMsg({ text: act === "whitelist" ? "whitelisting\u2026" : "blocking\u2026", level: "ok", until: Date.now() + 4e3 });
+    try {
+      let res;
+      if (e.source === "cloud") {
+        const realId = e.id.slice(2);
+        res = act === "whitelist" ? await api.audit.whitelist(realId) : await api.audit.block(realId);
+      } else {
+        let pid = activePolicyRef.current;
+        if (!pid) {
+          const a = await api.policies.active();
+          pid = a.policy?.id ?? null;
+          activePolicyRef.current = pid;
+        }
+        if (!pid) throw new Error("no active policy resolves for this machine");
+        const t = extractTarget(e.detail);
+        res = await api.policies.addRule(pid, { toolPattern: e.tool, kind: t?.kind ?? "tool", value: t?.value, effect: act === "whitelist" ? "ALLOW" : "DENY" });
+      }
+      const verb = act === "whitelist" ? "ALLOW" : "DENY";
+      setActionMsg({
+        text: res.deduped ? `${verb} rule already present` : `${verb} rule added \u2192 ${res.policy_id ?? "?"}${res.policy_version ? " v" + res.policy_version : ""} \xB7 reaches agents in ~30s`,
+        level: "ok",
+        until: Date.now() + 7e3
+      });
+      pushLog(`${act === "whitelist" ? "\u2713 whitelisted" : "\u26D4 blocked"} ${e.tool}`, act === "whitelist" ? "ok" : "warn");
+    } catch (err2) {
+      setActionMsg({ text: "\u2717 " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 7e3 });
+    }
+  };
   useInput(
     (input, key) => {
       if (input === " ") {
@@ -7472,16 +7624,25 @@ function LivePanel({ active: active2 }) {
         } else if (input === "s" || key.leftArrow) setMode("stream");
         return;
       }
+      const toggleSignal = (s2) => {
+        setSignal((cur) => cur === s2 ? "none" : s2);
+        setSel(0);
+      };
       if (input === "f") {
         setFilter((f) => FILTERS[(FILTERS.indexOf(f) + 1) % FILTERS.length]);
-        setScroll(0);
+        setSel(0);
       } else if (input === "s") {
         setPickIdx(0);
         setMode("pick");
-      } else if (key.downArrow) setScroll((n) => Math.min(maxScroll, n + 1));
-      else if (key.upArrow) setScroll((n) => Math.max(0, n - 1));
-      else if (key.pageDown) setScroll((n) => Math.min(maxScroll, n + streamRows));
-      else if (key.pageUp) setScroll((n) => Math.max(0, n - streamRows));
+      } else if (input === "w") void doAction("whitelist");
+      else if (input === "b") void doAction("block");
+      else if (input === "d") toggleSignal("deny");
+      else if (input === "x") toggleSignal("dlp");
+      else if (input === "r") toggleSignal("ratelimit");
+      else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
+      else if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.pageDown) setSel((n) => Math.min(visibleDesc.length - 1, n + streamBodyRows));
+      else if (key.pageUp) setSel((n) => Math.max(0, n - streamBodyRows));
     },
     { isActive: active2 && !editingSearch }
   );
@@ -7498,7 +7659,7 @@ function LivePanel({ active: active2 }) {
               return;
             }
             setSearch(v);
-            setScroll(0);
+            setSel(0);
             setDetailScroll(0);
           },
           onSubmit: () => setEditingSearch(false)
@@ -7618,7 +7779,18 @@ function LivePanel({ active: active2 }) {
       /* @__PURE__ */ jsx2(Text2, { color: guard.data?.up_to_date ? theme.ok : theme.warn, children: guard.data ? `v${guard.data.installed ?? "?"}${guard.data.up_to_date ? "" : "\u2192v" + guard.data.latest} ${guard.data.device_count}dev` : "\xB7" }),
       /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2502" })
     ] }),
-    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: "#3d2a12", color: "#ffb454", bold: true, children: ` \u23F8 IDLE \xB7 ${truncate2(a.msg, innerW - 12)} ` }, a.id)),
+    alerts.filter((a) => nowMs < a.until).slice(-1).map((a) => /* @__PURE__ */ jsx2(
+      Text2,
+      {
+        wrap: "truncate",
+        backgroundColor: a.level === "bad" ? "#3d1220" : "#3d2a12",
+        color: a.level === "bad" ? "#ff6b6b" : "#ffb454",
+        bold: true,
+        children: ` ${a.level === "bad" ? "\u26D4 ALERT" : "\u23F8 IDLE"} \xB7 ${truncate2(a.msg, innerW - 14)} `
+      },
+      a.id
+    )),
+    actionMsg && nowMs < actionMsg.until ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: actionMsg.level === "bad" ? "#3d1220" : "#123d1f", color: actionMsg.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate2(actionMsg.text, innerW - 4)} ` }) : null,
     /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
@@ -7656,11 +7828,11 @@ function LivePanel({ active: active2 }) {
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
-          const sel = mode === "pick" && i === pickIdx;
+          const sel2 = mode === "pick" && i === pickIdx;
           const st = STATUS_STYLE[r.status];
-          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel ? "#1c2f63" : void 0, bold: sel || r.isMe, children: [
-            /* @__PURE__ */ jsxs2(Text2, { color: sel ? theme.accentBright : st.color, children: [
-              sel ? "\u25B8" : st.dot,
+          return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: sel2 ? "#1c2f63" : void 0, bold: sel2 || r.isMe, children: [
+            /* @__PURE__ */ jsxs2(Text2, { color: sel2 ? theme.accentBright : st.color, children: [
+              sel2 ? "\u25B8" : st.dot,
               " "
             ] }),
             /* @__PURE__ */ jsx2(Text2, { color: st.color, children: st.label.padEnd(7) }),
@@ -7693,7 +7865,7 @@ function LivePanel({ active: active2 }) {
       PaneTitle,
       {
         label: "TOOL STREAM",
-        extra: `${visibleDesc.length} entries${q ? " matched" : ""} \xB7 newest first \xB7 filter ${filter}${clampedScroll > 0 ? ` \xB7 \u25BC${clampedScroll} older` : ""} \xB7 f \xB7 / \xB7 \u2191\u2193 \xB7 s`,
+        extra: `${selClamped + 1}/${visibleDesc.length}${signal !== "none" ? ` \xB7 ${signal}` : ""}${q ? " \xB7 search" : ""} \xB7 \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r ${filter} \xB7 s`,
         width: innerW
       }
     ),
@@ -7707,12 +7879,12 @@ function LivePanel({ active: active2 }) {
         spin,
         " awaiting traffic\u2026"
       ] }) : null,
-      windowed.map((e) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e) }, e.id))
+      windowed.map((e, i) => /* @__PURE__ */ jsx2(StreamLine, { e, loc: isLoc(e), selected: clampedScroll + i === selClamped }, e.id))
     ] }),
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", bold: true, children: " LIVE " }),
       /* @__PURE__ */ jsx2(Text2, { backgroundColor: "#0b1530", color: "#4f6db8", children: ` local ${localOn ? "on" : "off"} \xB7 ${localBuf.length} loc/${cloudBuf.length} cld \xB7 top ${topTools.map(([t, c2]) => `${t}\xD7${c2}`).join(" ") || "\u2014"} ` }),
-      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " space copy-mode \xB7 / search \xB7 f filter \xB7 s sessions \xB7 esc menu \xB7 q quit " })
+      /* @__PURE__ */ jsx2(Text2, { backgroundColor: BG, color: "#82AAF0", children: " \u2191\u2193 select \xB7 w allow \xB7 b block \xB7 d/x/r \xB7 / search \xB7 f \xB7 s \xB7 space copy \xB7 esc \xB7 q " })
     ] })
   ] });
 }
@@ -7762,8 +7934,8 @@ function ruleSummary(r) {
   return bits.join(" ");
 }
 function PoliciesPanel({ focused }) {
-  const list4 = useLoader(() => api.policies.list());
-  const policies = list4.data?.policies ?? [];
+  const list6 = useLoader(() => api.policies.list());
+  const policies = list6.data?.policies ?? [];
   const [view, setView] = useState3("list");
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
@@ -7805,7 +7977,7 @@ function PoliciesPanel({ focused }) {
       setRules(res.rules);
       setDirty(false);
       setStatus("\u2713 Saved v" + res._version);
-      list4.reload();
+      list6.reload();
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
@@ -7875,7 +8047,7 @@ function PoliciesPanel({ focused }) {
     { isActive: focused && !editing }
   );
   if (view === "list") {
-    return /* @__PURE__ */ jsx3(DataView, { loading: list4.loading && !list4.data, error: list4.error, empty: !!list4.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+    return /* @__PURE__ */ jsx3(DataView, { loading: list6.loading && !list6.data, error: list6.error, empty: !!list6.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter open" : "press \u2192 to browse" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs3(Text3, { color: i === pi ? theme.accentBright : void 0, bold: i === pi, children: [
         (i === pi ? "\u25B8 " : "  ") + truncate2(p.name, 26).padEnd(27),
@@ -9226,6 +9398,16 @@ async function run5(argv) {
     else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
     return 0;
   }
+  if (positionals[0] === "block") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit block <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.block(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent DENY already present."));
+    else err(green(`  \u2713 Blocked (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
   const query = {
     filter: flagStr(flags, "filter"),
     tool: flagStr(flags, "tool"),
@@ -9333,6 +9515,395 @@ var init_agents2 = __esm({
   }
 });
 
+// src/commands/doctor.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
+async function run6(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves \u2014 every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+    } catch {
+    }
+  }
+  if (existsSync4(LOCAL_LOG2)) {
+    const st = statSync2(LOCAL_LOG2);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) \u2014 enable in dashboard \u2192 Settings" });
+  }
+  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
+  err("");
+  err(`  ${bold("SolonGate doctor")}`);
+  err("");
+  for (const c2 of checks) {
+    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
+    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
+  }
+  err("");
+  const bad = checks.filter((c2) => c2.ok === false).length;
+  const warn = checks.filter((c2) => c2.ok === "warn").length;
+  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
+  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("\u2014 guard is working")}`);
+  else err(`  ${green("all good")}`);
+  return bad ? 1 : 0;
+}
+var LOCAL_LOG2;
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    init_api_client();
+    init_format();
+    init_args();
+    LOCAL_LOG2 = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+  }
+});
+
+// src/commands/watch.ts
+import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function tailLocal(file, maxBytes = 131072) {
+  try {
+    const size = statSync3(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync2(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync2(fd, buf, 0, buf.length, start);
+    closeSync2(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function print(r, json) {
+  if (json) return out(JSON.stringify(r));
+  const dec = r.decision === "ALLOW" ? c.green : c.red;
+  const src = r.source === "local" ? c.green + "LOC" : c.blue4 + "CLD";
+  out(
+    `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
+  );
+}
+async function run7(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
+  const toolFilter = (flagStr(flags, "tool") || "").toLowerCase();
+  const localOnly = flagBool(flags, "local-only");
+  const cloudOnly = flagBool(flags, "cloud-only");
+  const keep = (r) => {
+    if (decisionFilter && r.decision.toUpperCase() !== decisionFilter && !(decisionFilter === "DENY" && r.decision === "DENIED")) return false;
+    if (toolFilter && !r.tool.toLowerCase().includes(toolFilter)) return false;
+    return true;
+  };
+  const seen = /* @__PURE__ */ new Set();
+  let lastLocalTs = 0;
+  let first = true;
+  const emit = (rows) => {
+    rows.sort((a, b) => a.at - b.at);
+    for (const r of rows) if (keep(r)) print(r, json);
+  };
+  const pollLocal = () => {
+    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    const rows = [];
+    for (const line of tailLocal(LOCAL_LOG3)) {
+      try {
+        const j = JSON.parse(line);
+        const at = Date.parse(String(j.ts ?? ""));
+        if (!Number.isFinite(at) || at <= lastLocalTs) continue;
+        rows.push({
+          at,
+          tool: String(j.tool ?? "?"),
+          decision: String(j.decision ?? "ALLOW"),
+          permission: String(j.permission ?? ""),
+          detail: (j.arguments ? JSON.stringify(j.arguments) : String(j.reason ?? "")).replace(/\s+/g, " "),
+          agent: String(j.agent_name ?? ""),
+          source: "local",
+          dlp: !!j.dlp
+        });
+      } catch {
+      }
+    }
+    if (rows.length) lastLocalTs = rows[rows.length - 1].at;
+    if (!first) emit(rows);
+  };
+  const pollCloud = async () => {
+    if (localOnly) return;
+    try {
+      const res = await api.audit.list({ limit: 50 });
+      const rows = [];
+      for (const e of res.entries) {
+        if (seen.has(e.id)) continue;
+        seen.add(e.id);
+        rows.push({
+          at: Date.parse(e.created_at),
+          tool: e.tool_name,
+          decision: e.decision,
+          permission: e.permission ?? "",
+          detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
+          agent: e.agent_name ?? "",
+          source: "cloud",
+          dlp: !!e.dlp_matches?.length
+        });
+      }
+      if (!first) emit(rows);
+    } catch {
+    }
+  };
+  if (!json) err(`  ${c.dim}watching guard stream \u2014 Ctrl+C to stop${c.reset}`);
+  pollLocal();
+  await pollCloud();
+  first = false;
+  return new Promise(() => {
+    setInterval(pollLocal, 2e3);
+    setInterval(() => void pollCloud(), 4e3);
+  });
+}
+var LOCAL_LOG3, trunc, time;
+var init_watch = __esm({
+  "src/commands/watch.ts"() {
+    "use strict";
+    init_api_client();
+    init_cli_utils();
+    init_args();
+    init_format();
+    LOCAL_LOG3 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
+    time = (ms) => new Date(ms).toTimeString().slice(0, 8);
+  }
+});
+
+// src/commands/keys.ts
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE6), 0;
+    case "list": {
+      const { keys } = await api.keys.list();
+      if (json) return printJson(keys), 0;
+      if (!keys.length) return err(dim("  No API keys.")), 0;
+      table(
+        ["ID", "NAME", "PREFIX", "CREATED"],
+        keys.map((k) => [dim(truncate3(k.id, 10)), truncate3(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
+      );
+      return 0;
+    }
+    case "create": {
+      const name = flagStr(flags, "name");
+      if (!name) return err("  Usage: keys create --name <name>"), 1;
+      const res = await api.keys.create(name, !flagBool(flags, "test"));
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Created "${res.name}"`));
+      err("");
+      err("  " + bold(res.key));
+      err(dim("  \u2191 shown only once \u2014 copy it now."));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: keys revoke <id>"), 1;
+      await api.keys.revoke(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Revoked ${id}`)), 0;
+    }
+    default:
+      return err(USAGE6), 1;
+  }
+}
+var USAGE6;
+var init_keys2 = __esm({
+  "src/commands/keys.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE6 = `${bold("solongate keys")} \u2014 API keys
+
+  keys list                 List keys (prefix only)
+  keys create --name <n>    Create a key (secret shown once)
+  keys revoke <id>          Revoke a key
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/mcp.ts
+async function run9(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const { servers } = await api.mcp.list();
+  if (json) return printJson(servers), 0;
+  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
+  table(
+    ["STATUS", "NAME", "TARGET"],
+    servers.map((s) => [
+      s.status === "active" ? green(s.status) : yellow(s.status),
+      cyan(truncate3(s.name, 24)),
+      dim(truncate3(s.url || s.command || "\u2014", 46))
+    ])
+  );
+  return 0;
+}
+var init_mcp2 = __esm({
+  "src/commands/mcp.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+  }
+});
+
+// src/commands/alerts.ts
+async function run10(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE7), 0;
+    case "list": {
+      const { rules } = await api.settings.getAlerts();
+      if (json) return printJson(rules), 0;
+      if (!rules.length) return err(dim("  No alert rules.")), 0;
+      table(
+        ["ID", "ON", "SIGNAL", "THRESH", "WINDOW", "CHANNELS"],
+        rules.map((r) => [
+          dim(truncate3(r.id, 10)),
+          r.enabled ? green("\u25CF") : dim("\u25CB"),
+          cyan(r.signal),
+          `${r.threshold}`,
+          `${r.windowSeconds}s`,
+          dim([...r.emails ?? [], ...(r.telegram ?? []).map((t) => "tg:" + t), ...(r.slackUrls ?? []).map(() => "slack")].join(" ") || "\u2014")
+        ])
+      );
+      return 0;
+    }
+    case "add": {
+      const email = flagStr(flags, "email");
+      const telegram = flagStr(flags, "telegram");
+      const slack = flagStr(flags, "slack");
+      if (!email && !telegram && !slack) return err("  Need a channel: --email / --telegram / --slack"), 1;
+      const res = await api.settings.createAlert({
+        signal: flagStr(flags, "signal") ?? "deny",
+        threshold: flagNum(flags, "threshold") ?? 5,
+        windowSeconds: flagNum(flags, "window") ?? 300,
+        emails: email ? [email] : void 0,
+        telegram: telegram ? [telegram] : void 0,
+        slackUrl: slack
+      });
+      if (json) return printJson(res.rule), 0;
+      return err(green(`  \u2713 Alert added (${res.rule.signal}, ${res.rule.threshold}/${res.rule.windowSeconds}s)`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: alerts remove <id>"), 1;
+      await api.settings.deleteAlert(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE7), 1;
+  }
+}
+var USAGE7;
+var init_alerts = __esm({
+  "src/commands/alerts.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+
+  alerts list
+  alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
+             (--email <a> | --telegram <chatId> | --slack <url>)
+  alerts remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/webhooks.ts
+async function run11(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE8), 0;
+    case "list": {
+      const { webhooks } = await api.settings.getWebhooks();
+      if (json) return printJson(webhooks), 0;
+      if (!webhooks.length) return err(dim("  No webhooks.")), 0;
+      table(
+        ["ID", "ON", "EVENTS", "URL"],
+        webhooks.map((w) => [dim(truncate3(w.id, 10)), w.enabled ? green("\u25CF") : dim("\u25CB"), cyan(w.events), dim(truncate3(w.url, 46))])
+      );
+      return 0;
+    }
+    case "add": {
+      const url = flagStr(flags, "url");
+      if (!url) return err("  Usage: webhooks add --url <https://\u2026> [--events denials|allowed|all]"), 1;
+      const res = await api.settings.createWebhook({ url, events: flagStr(flags, "events") ?? "denials" });
+      if (json) return printJson(res.webhook), 0;
+      return err(green(`  \u2713 Webhook added (${res.webhook.events}) \u2192 ${res.webhook.url}`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: webhooks remove <id>"), 1;
+      await api.settings.deleteWebhook(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE8), 1;
+  }
+}
+var USAGE8;
+var init_webhooks = __esm({
+  "src/commands/webhooks.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+
+  webhooks list
+  webhooks add --url <https://\u2026> [--events denials|allowed|all]
+  webhooks remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -9355,6 +9926,18 @@ async function dispatch(command, argv) {
       return runAgents(argv);
     case "agent":
       return runAgent(argv);
+    case "doctor":
+      return run6(argv);
+    case "watch":
+      return run7(argv);
+    case "keys":
+      return run8(argv);
+    case "mcp":
+      return run9(argv);
+    case "alerts":
+      return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -9389,7 +9972,13 @@ var init_commands = __esm({
     init_stats2();
     init_audit2();
     init_agents2();
-    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+    init_doctor();
+    init_watch();
+    init_keys2();
+    init_mcp2();
+    init_alerts();
+    init_webhooks();
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
   }
 });
 
@@ -9405,14 +9994,14 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve4, join as join6, dirname } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { resolve as resolve4, join as join8, dirname } from "path";
+import { homedir as homedir6 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
 function lockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9438,7 +10027,7 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9470,10 +10059,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join6(p.hooksDir, "guard.mjs"),
-    join6(p.hooksDir, "audit.mjs"),
-    join6(p.hooksDir, "stop.mjs"),
-    join6(p.hooksDir, "shield.mjs"),
+    join8(p.hooksDir, "guard.mjs"),
+    join8(p.hooksDir, "audit.mjs"),
+    join8(p.hooksDir, "stop.mjs"),
+    join8(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -9485,26 +10074,26 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir4();
-  const sgDir = join6(home, ".solongate");
-  const hooksDir = join6(sgDir, "hooks");
-  const claudeDir = join6(home, ".claude");
+  const home = homedir6();
+  const sgDir = join8(home, ".solongate");
+  const hooksDir = join8(sgDir, "hooks");
+  const claudeDir = join8(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join6(claudeDir, "settings.json"),
-    backupPath: join6(claudeDir, "settings.solongate.bak"),
-    configPath: join6(sgDir, "cloud-guard.json")
+    settingsPath: join8(claudeDir, "settings.json"),
+    backupPath: join8(claudeDir, "settings.solongate.bak"),
+    configPath: join8(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync6(join6(HOOKS_DIR, filename), "utf-8");
+  return readFileSync6(join8(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join8(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync6(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -9517,10 +10106,10 @@ function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
   removeClaudeShim();
-  if (existsSync4(p.backupPath)) {
+  if (existsSync6(p.backupPath)) {
     writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync4(p.settingsPath)) {
+  } else if (existsSync6(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
       delete s.hooks;
@@ -9558,15 +10147,15 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir4(), f)).filter((f) => existsSync4(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join8(homedir6(), f)).filter((f) => existsSync6(f));
 }
-function writeShimBlock(file, block) {
+function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync6(file, "utf-8") : "";
+  let content = existsSync6(file) ? readFileSync6(file, "utf-8") : "";
   content = content.replace(re, "");
-  if (block) {
+  if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block + "\n";
+    content += block2 + "\n";
   }
   mkdirSync3(dirname(file), { recursive: true });
   writeFileSync3(file, content);
@@ -9580,7 +10169,7 @@ function installClaudeShim(shieldPath) {
   const node = process.execPath.replace(/\\/g, "/");
   const shield = shieldPath.replace(/\\/g, "/");
   const win = process.platform === "win32";
-  const block = win ? `${SHIM_BEGIN}
+  const block2 = win ? `${SHIM_BEGIN}
 function claude { & "${node}" "${shield}" -- "${real}" @args }
 ${SHIM_END}` : `${SHIM_BEGIN}
 claude() { "${node}" "${shield}" -- "${real}" "$@"; }
@@ -9592,7 +10181,7 @@ ${SHIM_END}`;
   }
   for (const file of targets) {
     try {
-      writeShimBlock(file, block);
+      writeShimBlock(file, block2);
       console.log(`  Auto-shield on: \`claude\` now masks secrets (${file})`);
     } catch (e) {
       console.log(`  (Could not enable auto-shield in ${file}: ${e.message})`);
@@ -9629,18 +10218,18 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync3(p.hooksDir, { recursive: true });
   mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join6(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync3(join8(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join8(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join8(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join8(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync4(p.settingsPath)) {
+  if (existsSync6(p.settingsPath)) {
     const raw = readFileSync6(p.settingsPath, "utf-8");
-    if (!existsSync4(p.backupPath)) {
+    if (!existsSync6(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
@@ -9650,9 +10239,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join6(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join6(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join8(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join8(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join8(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const merged = {
     ...existing,
@@ -9842,22 +10431,22 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync7, existsSync as existsSync5, readdirSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir7 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir5(), ".solongate");
+  const dir = resolve5(homedir7(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync5(f)) return f;
+    if (existsSync7(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
     for (const name of readdirSync(dir)) {
       if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
         const full = resolve5(dir, name);
-        const ts = statSync2(full).mtimeMs;
+        const ts = statSync4(full).mtimeMs;
         if (ts > bestTs) {
           bestTs = ts;
           best = full;
@@ -9871,7 +10460,7 @@ function findCacheFile() {
 function loadCfg() {
   try {
     const f = findCacheFile();
-    if (f && existsSync5(f)) {
+    if (f && existsSync7(f)) {
       const c2 = JSON.parse(readFileSync7(f, "utf-8"));
       const d = c2?.security?.dlpRedact;
       const g = c2?.security?.ghost;
@@ -10148,9 +10737,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync8, statSync as statSync3 } from "fs";
-import { resolve as resolve6, join as join7, isAbsolute } from "path";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync8, statSync as statSync5 } from "fs";
+import { resolve as resolve6, join as join9, isAbsolute } from "path";
+import { homedir as homedir8 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -10167,15 +10756,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir6(), ".solongate", "local-logs");
+  return resolve6(homedir8(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir6(), ".solongate");
+  const base = resolve6(homedir8(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync8(join7(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync8(join9(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -10184,7 +10773,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync8(join7(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync8(join9(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -10213,9 +10802,9 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join7(dir, LOG_FILENAME);
+  const file = join9(dir, LOG_FILENAME);
   try {
-    const st = statSync3(file);
+    const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -10326,7 +10915,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -10384,7 +10973,7 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync6(resolve7("package.json"))) return false;
+  if (!existsSync8(resolve7("package.json"))) return false;
   try {
     const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -10400,13 +10989,13 @@ function findTsEntryFile() {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync6(resolve7(binPath))) return resolve7(binPath);
+        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
+        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
+      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
     }
   } catch {
   }
@@ -10420,7 +11009,7 @@ function findTsEntryFile() {
   ];
   for (const c2 of candidates) {
     const full = resolve7(c2);
-    if (existsSync6(full)) {
+    if (existsSync8(full)) {
       try {
         const content = readFileSync9(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
@@ -10431,13 +11020,13 @@ function findTsEntryFile() {
     }
   }
   for (const c2 of candidates) {
-    if (existsSync6(resolve7(c2))) return resolve7(c2);
+    if (existsSync8(resolve7(c2))) return resolve7(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync6(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync6(resolve7("yarn.lock"))) return "yarn";
+  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
@@ -10580,7 +11169,7 @@ async function main2() {
   }
   log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync6(entryFile)) {
+  if (!entryFile || !existsSync8(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -10593,7 +11182,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync6(backupPath)) {
+    if (!existsSync8(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -10629,7 +11218,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync6(backupPath)) {
+  if (!existsSync8(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -10663,8 +11252,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join10 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -10744,7 +11333,7 @@ EXAMPLES
 }
 function createProject(dir, name, _policy) {
   writeFileSync5(
-    join8(dir, "package.json"),
+    join10(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -10774,7 +11363,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, "tsconfig.json"),
+    join10(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -10794,9 +11383,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync4(join8(dir, "src"), { recursive: true });
+  mkdirSync4(join10(dir, "src"), { recursive: true });
   writeFileSync5(
-    join8(dir, "src", "index.ts"),
+    join10(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -10838,7 +11427,7 @@ console.log('Press Ctrl+C to stop.');
 `
   );
   writeFileSync5(
-    join8(dir, ".mcp.json"),
+    join10(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -10856,12 +11445,12 @@ console.log('Press Ctrl+C to stop.');
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, ".env"),
+    join10(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
   writeFileSync5(
-    join8(dir, ".gitignore"),
+    join10(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -10875,7 +11464,7 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync7(dir)) {
+  if (existsSync9(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -10954,12 +11543,12 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve9(".env");
-  if (!existsSync8(envPath)) return;
+  if (!existsSync10(envPath)) return;
   try {
     const content = readFileSync10(envPath, "utf-8");
     for (const line of content.split("\n")) {
@@ -11026,7 +11615,7 @@ async function listPolicies(apiKey) {
   const data = await res.json();
   return data.policies ?? [];
 }
-async function list3(apiKey, policyId) {
+async function list5(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
     log5(yellow2("No policies found. Create one in the dashboard first."));
@@ -11161,7 +11750,7 @@ async function pull(apiKey, file, policyId) {
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync8(file)) {
+  if (!existsSync10(file)) {
     log5(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
@@ -11229,7 +11818,7 @@ async function main4() {
     } else if (command === "push") {
       await push(apiKey, file, policyId);
     } else if (command === "list" || command === "ls") {
-      await list3(apiKey, policyId);
+      await list5(apiKey, policyId);
     } else {
       log5(red2(`Unknown command: ${command}`));
       log5("");
@@ -14294,7 +14883,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "ui", "dashboard", "tui"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "ui", "dashboard", "tui"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -14343,7 +14932,7 @@ async function main5() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));