@solongate/proxy 0.78.0 → 0.79.0

package/dist/api-client/index.d.ts

@@ -9,10 +9,14 @@ import * as settings from './settings.js';
 import * as stats from './stats.js';
 import * as audit from './audit.js';
 import * as agents from './agents.js';
+import * as keys from './keys.js';
+import * as mcp from './mcp.js';
 export declare const api: {
     policies: typeof policies;
     settings: typeof settings;
     stats: typeof stats;
     audit: typeof audit;
     agents: typeof agents;
+    keys: typeof keys;
+    mcp: typeof mcp;
 };

package/dist/api-client/keys.d.ts

@@ -0,0 +1,17 @@
+export interface ApiKey {
+    id: string;
+    name: string;
+    key_prefix: string;
+    is_live?: boolean;
+    created_at: string;
+}
+export declare function list(): Promise<{
+    keys: ApiKey[];
+}>;
+export declare function create(name: string, isLive?: boolean): Promise<{
+    id: string;
+    name: string;
+    key: string;
+    key_prefix: string;
+}>;
+export declare function revoke(id: string): Promise<unknown>;

package/dist/api-client/mcp.d.ts

@@ -0,0 +1,10 @@
+export interface McpServer {
+    id: string;
+    name: string;
+    url?: string;
+    command?: string;
+    status: string;
+}
+export declare function list(): Promise<{
+    servers: McpServer[];
+}>;

package/dist/api-client/settings.d.ts

@@ -20,3 +20,49 @@ export interface GuardStatus {
     outdated_count: number;
 }
 export declare function getGuardStatus(): Promise<GuardStatus>;
+export interface AlertRule {
+    id: string;
+    name: string;
+    enabled: boolean;
+    threshold: number;
+    windowSeconds: number;
+    signal: 'any' | 'deny' | 'dlp' | 'ratelimit';
+    slackUrls?: string[];
+    emails?: string[];
+    telegram?: string[];
+    createdAt: string;
+}
+export declare function getAlerts(): Promise<{
+    rules: AlertRule[];
+}>;
+export declare function createAlert(body: Partial<AlertRule> & {
+    emails?: string[];
+    telegram?: string[];
+    slackUrl?: string;
+}): Promise<{
+    rule: AlertRule;
+}>;
+export declare function deleteAlert(id: string): Promise<{
+    ok: true;
+}>;
+export interface DenialWebhook {
+    id: string;
+    url: string;
+    enabled: boolean;
+    events: 'denials' | 'allowed' | 'all';
+    headers?: Record<string, string>;
+    createdAt: string;
+}
+export declare function getWebhooks(): Promise<{
+    webhooks: DenialWebhook[];
+}>;
+export declare function createWebhook(body: {
+    url: string;
+    events?: 'denials' | 'allowed' | 'all';
+    headers?: Record<string, string>;
+}): Promise<{
+    webhook: DenialWebhook;
+}>;
+export declare function deleteWebhook(id: string): Promise<{
+    ok: true;
+}>;

package/dist/commands/alerts.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/doctor.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/index.d.ts

@@ -4,4 +4,4 @@
  */
 export declare function runCommand(command: string, argv: string[]): Promise<number>;
 /** The subcommand names this router owns (used by src/index.ts to route). */
-export declare const COMMAND_NAMES: readonly ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+export declare const COMMAND_NAMES: readonly ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];

package/dist/commands/index.js

@@ -53,6 +53,14 @@ function dotenvApiKey() {
   return void 0;
 }
 var cached = null;
+function isAuthenticated() {
+  try {
+    resolveCredentials();
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveCredentials(apiUrlOverride) {
   if (cached && !apiUrlOverride) return cached;
   const file = loginCredentialFile();
@@ -188,9 +196,15 @@ function dryRun(body) {
 var settings_exports = {};
 __export(settings_exports, {
   clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
   getGuardStatus: () => getGuardStatus,
   getRateLimitHistory: () => getRateLimitHistory,
   getSecurityLayers: () => getSecurityLayers,
+  getWebhooks: () => getWebhooks,
   setSecurityLayers: () => setSecurityLayers
 });
 function getSecurityLayers() {
@@ -208,6 +222,24 @@ function clearRateLimitHistory() {
 function getGuardStatus() {
   return request("GET", "/settings/guard-status");
 }
+function getAlerts() {
+  return request("GET", "/settings/denial-alerts");
+}
+function createAlert(body) {
+  return request("POST", "/settings/denial-alerts", { body });
+}
+function deleteAlert(id) {
+  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+}
+function getWebhooks() {
+  return request("GET", "/settings/denial-webhook");
+}
+function createWebhook(body) {
+  return request("POST", "/settings/denial-webhook", { body });
+}
+function deleteWebhook(id) {
+  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+}
 
 // src/api-client/stats.ts
 var stats_exports = {};
@@ -268,8 +300,34 @@ function anomalies(id, limit) {
   });
 }
 
+// src/api-client/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  create: () => create2,
+  list: () => list3,
+  revoke: () => revoke
+});
+function list3() {
+  return request("GET", "/keys");
+}
+function create2(name, isLive = true) {
+  return request("POST", "/keys", { body: { name, is_live: isLive } });
+}
+function revoke(id) {
+  return request("DELETE", `/keys/${encodeURIComponent(id)}`);
+}
+
+// src/api-client/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  list: () => list4
+});
+function list4() {
+  return request("GET", "/mcp-servers");
+}
+
 // src/api-client/index.ts
-var api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+var api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
 
 // src/cli-utils.ts
 var c = {
@@ -825,6 +883,16 @@ async function run5(argv) {
     else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
     return 0;
   }
+  if (positionals[0] === "block") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit block <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.block(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent DENY already present."));
+    else err(green(`  \u2713 Blocked (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
   const query = {
     filter: flagStr(flags, "filter"),
     tool: flagStr(flags, "tool"),
@@ -906,6 +974,341 @@ async function runAgent(argv) {
   return 0;
 }
 
+// src/commands/doctor.ts
+import { existsSync as existsSync2, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
+async function run6(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves \u2014 every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+    } catch {
+    }
+  }
+  if (existsSync2(LOCAL_LOG)) {
+    const st = statSync(LOCAL_LOG);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) \u2014 enable in dashboard \u2192 Settings" });
+  }
+  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
+  err("");
+  err(`  ${bold("SolonGate doctor")}`);
+  err("");
+  for (const c2 of checks) {
+    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
+    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
+  }
+  err("");
+  const bad = checks.filter((c2) => c2.ok === false).length;
+  const warn = checks.filter((c2) => c2.ok === "warn").length;
+  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
+  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("\u2014 guard is working")}`);
+  else err(`  ${green("all good")}`);
+  return bad ? 1 : 0;
+}
+
+// src/commands/watch.ts
+import { closeSync, existsSync as existsSync3, openSync, readSync, statSync as statSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var LOCAL_LOG2 = join3(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
+var trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
+var time = (ms) => new Date(ms).toTimeString().slice(0, 8);
+function tailLocal(file, maxBytes = 131072) {
+  try {
+    const size = statSync2(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function print(r, json) {
+  if (json) return out(JSON.stringify(r));
+  const dec = r.decision === "ALLOW" ? c.green : c.red;
+  const src = r.source === "local" ? c.green + "LOC" : c.blue4 + "CLD";
+  out(
+    `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
+  );
+}
+async function run7(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
+  const toolFilter = (flagStr(flags, "tool") || "").toLowerCase();
+  const localOnly = flagBool(flags, "local-only");
+  const cloudOnly = flagBool(flags, "cloud-only");
+  const keep = (r) => {
+    if (decisionFilter && r.decision.toUpperCase() !== decisionFilter && !(decisionFilter === "DENY" && r.decision === "DENIED")) return false;
+    if (toolFilter && !r.tool.toLowerCase().includes(toolFilter)) return false;
+    return true;
+  };
+  const seen = /* @__PURE__ */ new Set();
+  let lastLocalTs = 0;
+  let first = true;
+  const emit = (rows) => {
+    rows.sort((a, b) => a.at - b.at);
+    for (const r of rows) if (keep(r)) print(r, json);
+  };
+  const pollLocal = () => {
+    if (cloudOnly || !existsSync3(LOCAL_LOG2)) return;
+    const rows = [];
+    for (const line of tailLocal(LOCAL_LOG2)) {
+      try {
+        const j = JSON.parse(line);
+        const at = Date.parse(String(j.ts ?? ""));
+        if (!Number.isFinite(at) || at <= lastLocalTs) continue;
+        rows.push({
+          at,
+          tool: String(j.tool ?? "?"),
+          decision: String(j.decision ?? "ALLOW"),
+          permission: String(j.permission ?? ""),
+          detail: (j.arguments ? JSON.stringify(j.arguments) : String(j.reason ?? "")).replace(/\s+/g, " "),
+          agent: String(j.agent_name ?? ""),
+          source: "local",
+          dlp: !!j.dlp
+        });
+      } catch {
+      }
+    }
+    if (rows.length) lastLocalTs = rows[rows.length - 1].at;
+    if (!first) emit(rows);
+  };
+  const pollCloud = async () => {
+    if (localOnly) return;
+    try {
+      const res = await api.audit.list({ limit: 50 });
+      const rows = [];
+      for (const e of res.entries) {
+        if (seen.has(e.id)) continue;
+        seen.add(e.id);
+        rows.push({
+          at: Date.parse(e.created_at),
+          tool: e.tool_name,
+          decision: e.decision,
+          permission: e.permission ?? "",
+          detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
+          agent: e.agent_name ?? "",
+          source: "cloud",
+          dlp: !!e.dlp_matches?.length
+        });
+      }
+      if (!first) emit(rows);
+    } catch {
+    }
+  };
+  if (!json) err(`  ${c.dim}watching guard stream \u2014 Ctrl+C to stop${c.reset}`);
+  pollLocal();
+  await pollCloud();
+  first = false;
+  return new Promise(() => {
+    setInterval(pollLocal, 2e3);
+    setInterval(() => void pollCloud(), 4e3);
+  });
+}
+
+// src/commands/keys.ts
+var USAGE6 = `${bold("solongate keys")} \u2014 API keys
+
+  keys list                 List keys (prefix only)
+  keys create --name <n>    Create a key (secret shown once)
+  keys revoke <id>          Revoke a key
+
+  Add --json for machine-readable output.`;
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE6), 0;
+    case "list": {
+      const { keys } = await api.keys.list();
+      if (json) return printJson(keys), 0;
+      if (!keys.length) return err(dim("  No API keys.")), 0;
+      table(
+        ["ID", "NAME", "PREFIX", "CREATED"],
+        keys.map((k) => [dim(truncate(k.id, 10)), truncate(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
+      );
+      return 0;
+    }
+    case "create": {
+      const name = flagStr(flags, "name");
+      if (!name) return err("  Usage: keys create --name <name>"), 1;
+      const res = await api.keys.create(name, !flagBool(flags, "test"));
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Created "${res.name}"`));
+      err("");
+      err("  " + bold(res.key));
+      err(dim("  \u2191 shown only once \u2014 copy it now."));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: keys revoke <id>"), 1;
+      await api.keys.revoke(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Revoked ${id}`)), 0;
+    }
+    default:
+      return err(USAGE6), 1;
+  }
+}
+
+// src/commands/mcp.ts
+async function run9(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const { servers } = await api.mcp.list();
+  if (json) return printJson(servers), 0;
+  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
+  table(
+    ["STATUS", "NAME", "TARGET"],
+    servers.map((s) => [
+      s.status === "active" ? green(s.status) : yellow(s.status),
+      cyan(truncate(s.name, 24)),
+      dim(truncate(s.url || s.command || "\u2014", 46))
+    ])
+  );
+  return 0;
+}
+
+// src/commands/alerts.ts
+var USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+
+  alerts list
+  alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
+             (--email <a> | --telegram <chatId> | --slack <url>)
+  alerts remove <id>
+
+  Add --json for machine-readable output.`;
+async function run10(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE7), 0;
+    case "list": {
+      const { rules } = await api.settings.getAlerts();
+      if (json) return printJson(rules), 0;
+      if (!rules.length) return err(dim("  No alert rules.")), 0;
+      table(
+        ["ID", "ON", "SIGNAL", "THRESH", "WINDOW", "CHANNELS"],
+        rules.map((r) => [
+          dim(truncate(r.id, 10)),
+          r.enabled ? green("\u25CF") : dim("\u25CB"),
+          cyan(r.signal),
+          `${r.threshold}`,
+          `${r.windowSeconds}s`,
+          dim([...r.emails ?? [], ...(r.telegram ?? []).map((t) => "tg:" + t), ...(r.slackUrls ?? []).map(() => "slack")].join(" ") || "\u2014")
+        ])
+      );
+      return 0;
+    }
+    case "add": {
+      const email = flagStr(flags, "email");
+      const telegram = flagStr(flags, "telegram");
+      const slack = flagStr(flags, "slack");
+      if (!email && !telegram && !slack) return err("  Need a channel: --email / --telegram / --slack"), 1;
+      const res = await api.settings.createAlert({
+        signal: flagStr(flags, "signal") ?? "deny",
+        threshold: flagNum(flags, "threshold") ?? 5,
+        windowSeconds: flagNum(flags, "window") ?? 300,
+        emails: email ? [email] : void 0,
+        telegram: telegram ? [telegram] : void 0,
+        slackUrl: slack
+      });
+      if (json) return printJson(res.rule), 0;
+      return err(green(`  \u2713 Alert added (${res.rule.signal}, ${res.rule.threshold}/${res.rule.windowSeconds}s)`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: alerts remove <id>"), 1;
+      await api.settings.deleteAlert(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE7), 1;
+  }
+}
+
+// src/commands/webhooks.ts
+var USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+
+  webhooks list
+  webhooks add --url <https://\u2026> [--events denials|allowed|all]
+  webhooks remove <id>
+
+  Add --json for machine-readable output.`;
+async function run11(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE8), 0;
+    case "list": {
+      const { webhooks } = await api.settings.getWebhooks();
+      if (json) return printJson(webhooks), 0;
+      if (!webhooks.length) return err(dim("  No webhooks.")), 0;
+      table(
+        ["ID", "ON", "EVENTS", "URL"],
+        webhooks.map((w) => [dim(truncate(w.id, 10)), w.enabled ? green("\u25CF") : dim("\u25CB"), cyan(w.events), dim(truncate(w.url, 46))])
+      );
+      return 0;
+    }
+    case "add": {
+      const url = flagStr(flags, "url");
+      if (!url) return err("  Usage: webhooks add --url <https://\u2026> [--events denials|allowed|all]"), 1;
+      const res = await api.settings.createWebhook({ url, events: flagStr(flags, "events") ?? "denials" });
+      if (json) return printJson(res.webhook), 0;
+      return err(green(`  \u2713 Webhook added (${res.webhook.events}) \u2192 ${res.webhook.url}`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: webhooks remove <id>"), 1;
+      await api.settings.deleteWebhook(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE8), 1;
+  }
+}
+
 // src/commands/index.ts
 async function dispatch(command, argv) {
   switch (command) {
@@ -923,6 +1326,18 @@ async function dispatch(command, argv) {
       return runAgents(argv);
     case "agent":
       return runAgent(argv);
+    case "doctor":
+      return run6(argv);
+    case "watch":
+      return run7(argv);
+    case "keys":
+      return run8(argv);
+    case "mcp":
+      return run9(argv);
+    case "alerts":
+      return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -945,7 +1360,7 @@ async function runCommand(command, argv) {
     return 1;
   }
 }
-var COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+var COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
 export {
   COMMAND_NAMES,
   runCommand

package/dist/commands/keys.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/mcp.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/watch.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/webhooks.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;