@solongate/proxy 0.78.0 → 0.79.0

package/dist/index.js

@@ -6867,9 +6867,15 @@ var init_policies = __esm({
 var settings_exports = {};
 __export(settings_exports, {
   clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
   getGuardStatus: () => getGuardStatus,
   getRateLimitHistory: () => getRateLimitHistory,
   getSecurityLayers: () => getSecurityLayers,
+  getWebhooks: () => getWebhooks,
   setSecurityLayers: () => setSecurityLayers
 });
 function getSecurityLayers() {
@@ -6887,6 +6893,24 @@ function clearRateLimitHistory() {
 function getGuardStatus() {
   return request("GET", "/settings/guard-status");
 }
+function getAlerts() {
+  return request("GET", "/settings/denial-alerts");
+}
+function createAlert(body) {
+  return request("POST", "/settings/denial-alerts", { body });
+}
+function deleteAlert(id) {
+  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+}
+function getWebhooks() {
+  return request("GET", "/settings/denial-webhook");
+}
+function createWebhook(body) {
+  return request("POST", "/settings/denial-webhook", { body });
+}
+function deleteWebhook(id) {
+  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+}
 var init_settings = __esm({
   "src/api-client/settings.ts"() {
     "use strict";
@@ -6971,6 +6995,44 @@ var init_agents = __esm({
   }
 });
 
+// src/api-client/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  create: () => create2,
+  list: () => list3,
+  revoke: () => revoke
+});
+function list3() {
+  return request("GET", "/keys");
+}
+function create2(name, isLive = true) {
+  return request("POST", "/keys", { body: { name, is_live: isLive } });
+}
+function revoke(id) {
+  return request("DELETE", `/keys/${encodeURIComponent(id)}`);
+}
+var init_keys = __esm({
+  "src/api-client/keys.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  list: () => list4
+});
+function list4() {
+  return request("GET", "/mcp-servers");
+}
+var init_mcp = __esm({
+  "src/api-client/mcp.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
 // src/api-client/index.ts
 var api;
 var init_api_client = __esm({
@@ -6983,7 +7045,9 @@ var init_api_client = __esm({
     init_stats();
     init_audit();
     init_agents();
-    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+    init_keys();
+    init_mcp();
+    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
   }
 });
 
@@ -7870,8 +7934,8 @@ function ruleSummary(r) {
   return bits.join(" ");
 }
 function PoliciesPanel({ focused }) {
-  const list4 = useLoader(() => api.policies.list());
-  const policies = list4.data?.policies ?? [];
+  const list6 = useLoader(() => api.policies.list());
+  const policies = list6.data?.policies ?? [];
   const [view, setView] = useState3("list");
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
@@ -7913,7 +7977,7 @@ function PoliciesPanel({ focused }) {
       setRules(res.rules);
       setDirty(false);
       setStatus("\u2713 Saved v" + res._version);
-      list4.reload();
+      list6.reload();
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
@@ -7983,7 +8047,7 @@ function PoliciesPanel({ focused }) {
     { isActive: focused && !editing }
   );
   if (view === "list") {
-    return /* @__PURE__ */ jsx3(DataView, { loading: list4.loading && !list4.data, error: list4.error, empty: !!list4.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+    return /* @__PURE__ */ jsx3(DataView, { loading: list6.loading && !list6.data, error: list6.error, empty: !!list6.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter open" : "press \u2192 to browse" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs3(Text3, { color: i === pi ? theme.accentBright : void 0, bold: i === pi, children: [
         (i === pi ? "\u25B8 " : "  ") + truncate2(p.name, 26).padEnd(27),
@@ -9334,6 +9398,16 @@ async function run5(argv) {
     else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
     return 0;
   }
+  if (positionals[0] === "block") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit block <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.block(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent DENY already present."));
+    else err(green(`  \u2713 Blocked (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
   const query = {
     filter: flagStr(flags, "filter"),
     tool: flagStr(flags, "tool"),
@@ -9441,6 +9515,395 @@ var init_agents2 = __esm({
   }
 });
 
+// src/commands/doctor.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
+async function run6(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves \u2014 every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+    } catch {
+    }
+  }
+  if (existsSync4(LOCAL_LOG2)) {
+    const st = statSync2(LOCAL_LOG2);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) \u2014 enable in dashboard \u2192 Settings" });
+  }
+  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
+  err("");
+  err(`  ${bold("SolonGate doctor")}`);
+  err("");
+  for (const c2 of checks) {
+    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
+    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
+  }
+  err("");
+  const bad = checks.filter((c2) => c2.ok === false).length;
+  const warn = checks.filter((c2) => c2.ok === "warn").length;
+  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
+  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("\u2014 guard is working")}`);
+  else err(`  ${green("all good")}`);
+  return bad ? 1 : 0;
+}
+var LOCAL_LOG2;
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    init_api_client();
+    init_format();
+    init_args();
+    LOCAL_LOG2 = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+  }
+});
+
+// src/commands/watch.ts
+import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function tailLocal(file, maxBytes = 131072) {
+  try {
+    const size = statSync3(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync2(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync2(fd, buf, 0, buf.length, start);
+    closeSync2(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function print(r, json) {
+  if (json) return out(JSON.stringify(r));
+  const dec = r.decision === "ALLOW" ? c.green : c.red;
+  const src = r.source === "local" ? c.green + "LOC" : c.blue4 + "CLD";
+  out(
+    `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
+  );
+}
+async function run7(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
+  const toolFilter = (flagStr(flags, "tool") || "").toLowerCase();
+  const localOnly = flagBool(flags, "local-only");
+  const cloudOnly = flagBool(flags, "cloud-only");
+  const keep = (r) => {
+    if (decisionFilter && r.decision.toUpperCase() !== decisionFilter && !(decisionFilter === "DENY" && r.decision === "DENIED")) return false;
+    if (toolFilter && !r.tool.toLowerCase().includes(toolFilter)) return false;
+    return true;
+  };
+  const seen = /* @__PURE__ */ new Set();
+  let lastLocalTs = 0;
+  let first = true;
+  const emit = (rows) => {
+    rows.sort((a, b) => a.at - b.at);
+    for (const r of rows) if (keep(r)) print(r, json);
+  };
+  const pollLocal = () => {
+    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    const rows = [];
+    for (const line of tailLocal(LOCAL_LOG3)) {
+      try {
+        const j = JSON.parse(line);
+        const at = Date.parse(String(j.ts ?? ""));
+        if (!Number.isFinite(at) || at <= lastLocalTs) continue;
+        rows.push({
+          at,
+          tool: String(j.tool ?? "?"),
+          decision: String(j.decision ?? "ALLOW"),
+          permission: String(j.permission ?? ""),
+          detail: (j.arguments ? JSON.stringify(j.arguments) : String(j.reason ?? "")).replace(/\s+/g, " "),
+          agent: String(j.agent_name ?? ""),
+          source: "local",
+          dlp: !!j.dlp
+        });
+      } catch {
+      }
+    }
+    if (rows.length) lastLocalTs = rows[rows.length - 1].at;
+    if (!first) emit(rows);
+  };
+  const pollCloud = async () => {
+    if (localOnly) return;
+    try {
+      const res = await api.audit.list({ limit: 50 });
+      const rows = [];
+      for (const e of res.entries) {
+        if (seen.has(e.id)) continue;
+        seen.add(e.id);
+        rows.push({
+          at: Date.parse(e.created_at),
+          tool: e.tool_name,
+          decision: e.decision,
+          permission: e.permission ?? "",
+          detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
+          agent: e.agent_name ?? "",
+          source: "cloud",
+          dlp: !!e.dlp_matches?.length
+        });
+      }
+      if (!first) emit(rows);
+    } catch {
+    }
+  };
+  if (!json) err(`  ${c.dim}watching guard stream \u2014 Ctrl+C to stop${c.reset}`);
+  pollLocal();
+  await pollCloud();
+  first = false;
+  return new Promise(() => {
+    setInterval(pollLocal, 2e3);
+    setInterval(() => void pollCloud(), 4e3);
+  });
+}
+var LOCAL_LOG3, trunc, time;
+var init_watch = __esm({
+  "src/commands/watch.ts"() {
+    "use strict";
+    init_api_client();
+    init_cli_utils();
+    init_args();
+    init_format();
+    LOCAL_LOG3 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
+    time = (ms) => new Date(ms).toTimeString().slice(0, 8);
+  }
+});
+
+// src/commands/keys.ts
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE6), 0;
+    case "list": {
+      const { keys } = await api.keys.list();
+      if (json) return printJson(keys), 0;
+      if (!keys.length) return err(dim("  No API keys.")), 0;
+      table(
+        ["ID", "NAME", "PREFIX", "CREATED"],
+        keys.map((k) => [dim(truncate3(k.id, 10)), truncate3(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
+      );
+      return 0;
+    }
+    case "create": {
+      const name = flagStr(flags, "name");
+      if (!name) return err("  Usage: keys create --name <name>"), 1;
+      const res = await api.keys.create(name, !flagBool(flags, "test"));
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Created "${res.name}"`));
+      err("");
+      err("  " + bold(res.key));
+      err(dim("  \u2191 shown only once \u2014 copy it now."));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: keys revoke <id>"), 1;
+      await api.keys.revoke(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Revoked ${id}`)), 0;
+    }
+    default:
+      return err(USAGE6), 1;
+  }
+}
+var USAGE6;
+var init_keys2 = __esm({
+  "src/commands/keys.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE6 = `${bold("solongate keys")} \u2014 API keys
+
+  keys list                 List keys (prefix only)
+  keys create --name <n>    Create a key (secret shown once)
+  keys revoke <id>          Revoke a key
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/mcp.ts
+async function run9(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const { servers } = await api.mcp.list();
+  if (json) return printJson(servers), 0;
+  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
+  table(
+    ["STATUS", "NAME", "TARGET"],
+    servers.map((s) => [
+      s.status === "active" ? green(s.status) : yellow(s.status),
+      cyan(truncate3(s.name, 24)),
+      dim(truncate3(s.url || s.command || "\u2014", 46))
+    ])
+  );
+  return 0;
+}
+var init_mcp2 = __esm({
+  "src/commands/mcp.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+  }
+});
+
+// src/commands/alerts.ts
+async function run10(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE7), 0;
+    case "list": {
+      const { rules } = await api.settings.getAlerts();
+      if (json) return printJson(rules), 0;
+      if (!rules.length) return err(dim("  No alert rules.")), 0;
+      table(
+        ["ID", "ON", "SIGNAL", "THRESH", "WINDOW", "CHANNELS"],
+        rules.map((r) => [
+          dim(truncate3(r.id, 10)),
+          r.enabled ? green("\u25CF") : dim("\u25CB"),
+          cyan(r.signal),
+          `${r.threshold}`,
+          `${r.windowSeconds}s`,
+          dim([...r.emails ?? [], ...(r.telegram ?? []).map((t) => "tg:" + t), ...(r.slackUrls ?? []).map(() => "slack")].join(" ") || "\u2014")
+        ])
+      );
+      return 0;
+    }
+    case "add": {
+      const email = flagStr(flags, "email");
+      const telegram = flagStr(flags, "telegram");
+      const slack = flagStr(flags, "slack");
+      if (!email && !telegram && !slack) return err("  Need a channel: --email / --telegram / --slack"), 1;
+      const res = await api.settings.createAlert({
+        signal: flagStr(flags, "signal") ?? "deny",
+        threshold: flagNum(flags, "threshold") ?? 5,
+        windowSeconds: flagNum(flags, "window") ?? 300,
+        emails: email ? [email] : void 0,
+        telegram: telegram ? [telegram] : void 0,
+        slackUrl: slack
+      });
+      if (json) return printJson(res.rule), 0;
+      return err(green(`  \u2713 Alert added (${res.rule.signal}, ${res.rule.threshold}/${res.rule.windowSeconds}s)`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: alerts remove <id>"), 1;
+      await api.settings.deleteAlert(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE7), 1;
+  }
+}
+var USAGE7;
+var init_alerts = __esm({
+  "src/commands/alerts.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+
+  alerts list
+  alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
+             (--email <a> | --telegram <chatId> | --slack <url>)
+  alerts remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/webhooks.ts
+async function run11(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE8), 0;
+    case "list": {
+      const { webhooks } = await api.settings.getWebhooks();
+      if (json) return printJson(webhooks), 0;
+      if (!webhooks.length) return err(dim("  No webhooks.")), 0;
+      table(
+        ["ID", "ON", "EVENTS", "URL"],
+        webhooks.map((w) => [dim(truncate3(w.id, 10)), w.enabled ? green("\u25CF") : dim("\u25CB"), cyan(w.events), dim(truncate3(w.url, 46))])
+      );
+      return 0;
+    }
+    case "add": {
+      const url = flagStr(flags, "url");
+      if (!url) return err("  Usage: webhooks add --url <https://\u2026> [--events denials|allowed|all]"), 1;
+      const res = await api.settings.createWebhook({ url, events: flagStr(flags, "events") ?? "denials" });
+      if (json) return printJson(res.webhook), 0;
+      return err(green(`  \u2713 Webhook added (${res.webhook.events}) \u2192 ${res.webhook.url}`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: webhooks remove <id>"), 1;
+      await api.settings.deleteWebhook(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE8), 1;
+  }
+}
+var USAGE8;
+var init_webhooks = __esm({
+  "src/commands/webhooks.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+
+  webhooks list
+  webhooks add --url <https://\u2026> [--events denials|allowed|all]
+  webhooks remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -9463,6 +9926,18 @@ async function dispatch(command, argv) {
       return runAgents(argv);
     case "agent":
       return runAgent(argv);
+    case "doctor":
+      return run6(argv);
+    case "watch":
+      return run7(argv);
+    case "keys":
+      return run8(argv);
+    case "mcp":
+      return run9(argv);
+    case "alerts":
+      return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -9497,7 +9972,13 @@ var init_commands = __esm({
     init_stats2();
     init_audit2();
     init_agents2();
-    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+    init_doctor();
+    init_watch();
+    init_keys2();
+    init_mcp2();
+    init_alerts();
+    init_webhooks();
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
   }
 });
 
@@ -9513,14 +9994,14 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve4, join as join6, dirname } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { resolve as resolve4, join as join8, dirname } from "path";
+import { homedir as homedir6 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
 function lockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9546,7 +10027,7 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9578,10 +10059,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join6(p.hooksDir, "guard.mjs"),
-    join6(p.hooksDir, "audit.mjs"),
-    join6(p.hooksDir, "stop.mjs"),
-    join6(p.hooksDir, "shield.mjs"),
+    join8(p.hooksDir, "guard.mjs"),
+    join8(p.hooksDir, "audit.mjs"),
+    join8(p.hooksDir, "stop.mjs"),
+    join8(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -9593,26 +10074,26 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir4();
-  const sgDir = join6(home, ".solongate");
-  const hooksDir = join6(sgDir, "hooks");
-  const claudeDir = join6(home, ".claude");
+  const home = homedir6();
+  const sgDir = join8(home, ".solongate");
+  const hooksDir = join8(sgDir, "hooks");
+  const claudeDir = join8(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join6(claudeDir, "settings.json"),
-    backupPath: join6(claudeDir, "settings.solongate.bak"),
-    configPath: join6(sgDir, "cloud-guard.json")
+    settingsPath: join8(claudeDir, "settings.json"),
+    backupPath: join8(claudeDir, "settings.solongate.bak"),
+    configPath: join8(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync6(join6(HOOKS_DIR, filename), "utf-8");
+  return readFileSync6(join8(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join8(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync6(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -9625,10 +10106,10 @@ function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
   removeClaudeShim();
-  if (existsSync4(p.backupPath)) {
+  if (existsSync6(p.backupPath)) {
     writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync4(p.settingsPath)) {
+  } else if (existsSync6(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
       delete s.hooks;
@@ -9666,11 +10147,11 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir4(), f)).filter((f) => existsSync4(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join8(homedir6(), f)).filter((f) => existsSync6(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync6(file, "utf-8") : "";
+  let content = existsSync6(file) ? readFileSync6(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
@@ -9737,18 +10218,18 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync3(p.hooksDir, { recursive: true });
   mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join6(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync3(join8(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join8(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join8(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join8(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync4(p.settingsPath)) {
+  if (existsSync6(p.settingsPath)) {
     const raw = readFileSync6(p.settingsPath, "utf-8");
-    if (!existsSync4(p.backupPath)) {
+    if (!existsSync6(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
@@ -9758,9 +10239,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join6(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join6(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join8(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join8(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join8(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const merged = {
     ...existing,
@@ -9950,22 +10431,22 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync7, existsSync as existsSync5, readdirSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir7 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir5(), ".solongate");
+  const dir = resolve5(homedir7(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync5(f)) return f;
+    if (existsSync7(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
     for (const name of readdirSync(dir)) {
       if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
         const full = resolve5(dir, name);
-        const ts = statSync2(full).mtimeMs;
+        const ts = statSync4(full).mtimeMs;
         if (ts > bestTs) {
           bestTs = ts;
           best = full;
@@ -9979,7 +10460,7 @@ function findCacheFile() {
 function loadCfg() {
   try {
     const f = findCacheFile();
-    if (f && existsSync5(f)) {
+    if (f && existsSync7(f)) {
       const c2 = JSON.parse(readFileSync7(f, "utf-8"));
       const d = c2?.security?.dlpRedact;
       const g = c2?.security?.ghost;
@@ -10256,9 +10737,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync8, statSync as statSync3 } from "fs";
-import { resolve as resolve6, join as join7, isAbsolute } from "path";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync8, statSync as statSync5 } from "fs";
+import { resolve as resolve6, join as join9, isAbsolute } from "path";
+import { homedir as homedir8 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -10275,15 +10756,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir6(), ".solongate", "local-logs");
+  return resolve6(homedir8(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir6(), ".solongate");
+  const base = resolve6(homedir8(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync8(join7(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync8(join9(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -10292,7 +10773,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync8(join7(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync8(join9(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -10321,9 +10802,9 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join7(dir, LOG_FILENAME);
+  const file = join9(dir, LOG_FILENAME);
   try {
-    const st = statSync3(file);
+    const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -10434,7 +10915,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -10492,7 +10973,7 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync6(resolve7("package.json"))) return false;
+  if (!existsSync8(resolve7("package.json"))) return false;
   try {
     const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -10508,13 +10989,13 @@ function findTsEntryFile() {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync6(resolve7(binPath))) return resolve7(binPath);
+        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
+        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
+      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
     }
   } catch {
   }
@@ -10528,7 +11009,7 @@ function findTsEntryFile() {
   ];
   for (const c2 of candidates) {
     const full = resolve7(c2);
-    if (existsSync6(full)) {
+    if (existsSync8(full)) {
       try {
         const content = readFileSync9(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
@@ -10539,13 +11020,13 @@ function findTsEntryFile() {
     }
   }
   for (const c2 of candidates) {
-    if (existsSync6(resolve7(c2))) return resolve7(c2);
+    if (existsSync8(resolve7(c2))) return resolve7(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync6(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync6(resolve7("yarn.lock"))) return "yarn";
+  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
@@ -10688,7 +11169,7 @@ async function main2() {
   }
   log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync6(entryFile)) {
+  if (!entryFile || !existsSync8(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -10701,7 +11182,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync6(backupPath)) {
+    if (!existsSync8(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -10737,7 +11218,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync6(backupPath)) {
+  if (!existsSync8(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -10771,8 +11252,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join10 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -10852,7 +11333,7 @@ EXAMPLES
 }
 function createProject(dir, name, _policy) {
   writeFileSync5(
-    join8(dir, "package.json"),
+    join10(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -10882,7 +11363,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, "tsconfig.json"),
+    join10(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -10902,9 +11383,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync4(join8(dir, "src"), { recursive: true });
+  mkdirSync4(join10(dir, "src"), { recursive: true });
   writeFileSync5(
-    join8(dir, "src", "index.ts"),
+    join10(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -10946,7 +11427,7 @@ console.log('Press Ctrl+C to stop.');
 `
   );
   writeFileSync5(
-    join8(dir, ".mcp.json"),
+    join10(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -10964,12 +11445,12 @@ console.log('Press Ctrl+C to stop.');
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, ".env"),
+    join10(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
   writeFileSync5(
-    join8(dir, ".gitignore"),
+    join10(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -10983,7 +11464,7 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync7(dir)) {
+  if (existsSync9(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -11062,12 +11543,12 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve9(".env");
-  if (!existsSync8(envPath)) return;
+  if (!existsSync10(envPath)) return;
   try {
     const content = readFileSync10(envPath, "utf-8");
     for (const line of content.split("\n")) {
@@ -11134,7 +11615,7 @@ async function listPolicies(apiKey) {
   const data = await res.json();
   return data.policies ?? [];
 }
-async function list3(apiKey, policyId) {
+async function list5(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
     log5(yellow2("No policies found. Create one in the dashboard first."));
@@ -11269,7 +11750,7 @@ async function pull(apiKey, file, policyId) {
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync8(file)) {
+  if (!existsSync10(file)) {
     log5(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
@@ -11337,7 +11818,7 @@ async function main4() {
     } else if (command === "push") {
       await push(apiKey, file, policyId);
     } else if (command === "list" || command === "ls") {
-      await list3(apiKey, policyId);
+      await list5(apiKey, policyId);
     } else {
       log5(red2(`Unknown command: ${command}`));
       log5("");
@@ -14402,7 +14883,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "ui", "dashboard", "tui"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "ui", "dashboard", "tui"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -14451,7 +14932,7 @@ async function main5() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));