@solongate/proxy 0.78.0 → 0.80.0

package/dist/index.js

@@ -6867,10 +6867,18 @@ var init_policies = __esm({
 var settings_exports = {};
 __export(settings_exports, {
   clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
   getGuardStatus: () => getGuardStatus,
   getRateLimitHistory: () => getRateLimitHistory,
   getSecurityLayers: () => getSecurityLayers,
-  setSecurityLayers: () => setSecurityLayers
+  getSelfProtection: () => getSelfProtection,
+  getWebhooks: () => getWebhooks,
+  setSecurityLayers: () => setSecurityLayers,
+  setSelfProtection: () => setSelfProtection
 });
 function getSecurityLayers() {
   return request("GET", "/settings/security-layers");
@@ -6887,6 +6895,30 @@ function clearRateLimitHistory() {
 function getGuardStatus() {
   return request("GET", "/settings/guard-status");
 }
+function getSelfProtection() {
+  return request("GET", "/settings/self-protection");
+}
+function setSelfProtection(enabled) {
+  return request("PUT", "/settings/self-protection", { body: { enabled } });
+}
+function getAlerts() {
+  return request("GET", "/settings/denial-alerts");
+}
+function createAlert(body) {
+  return request("POST", "/settings/denial-alerts", { body });
+}
+function deleteAlert(id) {
+  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+}
+function getWebhooks() {
+  return request("GET", "/settings/denial-webhook");
+}
+function createWebhook(body) {
+  return request("POST", "/settings/denial-webhook", { body });
+}
+function deleteWebhook(id) {
+  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+}
 var init_settings = __esm({
   "src/api-client/settings.ts"() {
     "use strict";
@@ -6971,6 +7003,44 @@ var init_agents = __esm({
   }
 });
 
+// src/api-client/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  create: () => create2,
+  list: () => list3,
+  revoke: () => revoke
+});
+function list3() {
+  return request("GET", "/keys");
+}
+function create2(name, isLive = true) {
+  return request("POST", "/keys", { body: { name, is_live: isLive } });
+}
+function revoke(id) {
+  return request("DELETE", `/keys/${encodeURIComponent(id)}`);
+}
+var init_keys = __esm({
+  "src/api-client/keys.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  list: () => list4
+});
+function list4() {
+  return request("GET", "/mcp-servers");
+}
+var init_mcp = __esm({
+  "src/api-client/mcp.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
 // src/api-client/index.ts
 var api;
 var init_api_client = __esm({
@@ -6983,7 +7053,9 @@ var init_api_client = __esm({
     init_stats();
     init_audit();
     init_agents();
-    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+    init_keys();
+    init_mcp();
+    api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
   }
 });
 
@@ -7870,12 +7942,13 @@ function ruleSummary(r) {
   return bits.join(" ");
 }
 function PoliciesPanel({ focused }) {
-  const list4 = useLoader(() => api.policies.list());
-  const policies = list4.data?.policies ?? [];
+  const list6 = useLoader(() => api.policies.list());
+  const policies = list6.data?.policies ?? [];
   const [view, setView] = useState3("list");
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
   const [fi, setFi] = useState3(0);
+  const [vi, setVi] = useState3(0);
   const [rules, setRules] = useState3([]);
   const [mode, setMode] = useState3("denylist");
   const [dirty, setDirty] = useState3(false);
@@ -7884,6 +7957,10 @@ function PoliciesPanel({ focused }) {
   const [status, setStatus] = useState3(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
+  const versionsQ = useLoader(
+    () => view === "versions" && selected ? api.policies.versions(selected.id, { limit: 50 }) : Promise.resolve(null),
+    [view, selected?.id]
+  );
   useEffect3(() => {
     if (detail.data) {
       setRules(detail.data.rules);
@@ -7913,7 +7990,7 @@ function PoliciesPanel({ focused }) {
       setRules(res.rules);
       setDirty(false);
       setStatus("\u2713 Saved v" + res._version);
-      list4.reload();
+      list6.reload();
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
@@ -7958,10 +8035,41 @@ function PoliciesPanel({ focused }) {
           }
         } else if (input === "m") {
           mutate(rules, mode === "denylist" ? "whitelist" : "denylist");
+        } else if (input === "n") {
+          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true };
+          mutate([nr, ...rules]);
+          setRi(0);
+          setFi(0);
+          setView("rule");
+        } else if (input === "D") {
+          setStatus("Dry-running\u2026");
+          void api.policies.dryRun({ rules, mode }).then((res) => setStatus(`dry-run ${res.evaluated} calls \xB7 allow ${res.would_allow} / deny ${res.would_deny} \xB7 newly blocked ${res.newly_blocked} \xB7 newly allowed ${res.newly_allowed}`)).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "v") {
+          setVi(0);
+          setView("versions");
         } else if (input === "s") void save();
         else if (input === "x") discard();
         return;
       }
+      if (view === "versions") {
+        const vers = versionsQ.data?.versions ?? [];
+        if (key.leftArrow) return void setView("rules");
+        if (key.upArrow) setVi((n) => Math.max(0, n - 1));
+        else if (key.downArrow) setVi((n) => Math.min(vers.length - 1, n + 1));
+        else if (key.return) {
+          const v = vers[vi];
+          if (v && selected) {
+            setStatus("Rolling back\u2026");
+            void api.policies.rollback(selected.id, v.version).then((r) => {
+              setStatus(`\u2713 rolled back to v${v.version} \u2192 new v${r.version}`);
+              detail.reload();
+              list6.reload();
+              setView("rules");
+            }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+          }
+        }
+        return;
+      }
       const rule2 = rules[ri];
       if (!rule2) return setView("rules");
       const field = FIELDS[fi];
@@ -7983,7 +8091,7 @@ function PoliciesPanel({ focused }) {
     { isActive: focused && !editing }
   );
   if (view === "list") {
-    return /* @__PURE__ */ jsx3(DataView, { loading: list4.loading && !list4.data, error: list4.error, empty: !!list4.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+    return /* @__PURE__ */ jsx3(DataView, { loading: list6.loading && !list6.data, error: list6.error, empty: !!list6.data && policies.length === 0, emptyText: "No policies.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter open" : "press \u2192 to browse" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: policies.map((p, i) => /* @__PURE__ */ jsxs3(Text3, { color: i === pi ? theme.accentBright : void 0, bold: i === pi, children: [
         (i === pi ? "\u25B8 " : "  ") + truncate2(p.name, 26).padEnd(27),
@@ -8006,7 +8114,7 @@ function PoliciesPanel({ focused }) {
         /* @__PURE__ */ jsx3(Text3, { color: mode === "whitelist" ? theme.warn : void 0, children: mode }),
         dirtyTag
       ] }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 rule \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 d delete \xB7 m mode \xB7 s save \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 v versions \xB7 s save \xB7 \u2190 back" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
         Table,
         {
@@ -8032,6 +8140,33 @@ function PoliciesPanel({ focused }) {
       status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
     ] }) });
   }
+  if (view === "versions") {
+    const vers = versionsQ.data?.versions ?? [];
+    return /* @__PURE__ */ jsx3(DataView, { loading: versionsQ.loading && !versionsQ.data, error: versionsQ.error, empty: !!versionsQ.data && vers.length === 0, emptyText: "No versions.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: truncate2(selected?.name ?? "", 28) }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 select \xB7 enter roll back to that version \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "VER", width: 5 },
+            { header: "RULES", width: 5 },
+            { header: "REASON", width: 34 },
+            { header: "WHEN", width: 16 }
+          ],
+          rows: vers.map((v, i) => [
+            { value: i === vi ? "\u25B8" : "", color: theme.accentBright },
+            { value: `v${v.version}`, bold: i === vi },
+            { value: String(v.rules_count), dim: true },
+            { value: truncate2(v.reason || "\u2014", 34) },
+            { value: truncate2(v.created_at, 16), dim: true }
+          ])
+        }
+      ) }),
+      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+    ] }) });
+  }
   const rule = rules[ri];
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs3(Box3, { children: [
@@ -8255,12 +8390,19 @@ function DlpPanel({ focused }) {
   const [adding, setAdding] = useState5(null);
   const [newName, setNewName] = useState5("");
   const [newRe, setNewRe] = useState5("");
+  const [ghostOn, setGhostOn] = useState5(false);
+  const spQ = useLoader(() => api.settings.getSelfProtection());
+  const [selfProt, setSelfProt] = useState5(null);
   useEffect5(() => {
     if (q.data && !dlp) {
       setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
       setAvailable(q.data.availablePatterns);
+      setGhostOn(q.data.layers.ghost.mode === "on");
     }
   }, [q.data, dlp]);
+  useEffect5(() => {
+    if (spQ.data && selfProt === null) setSelfProt(spQ.data.enabled);
+  }, [spQ.data, selfProt]);
   const mutate = (next) => {
     setDlp(next);
     setDirty(true);
@@ -8270,14 +8412,27 @@ function DlpPanel({ focused }) {
     if (!dlp || !q.data) return;
     setStatus("Saving\u2026");
     try {
-      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp });
+      const ghost = { ...q.data.layers.ghost, mode: ghostOn ? "on" : "off" };
+      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp, ghost });
       setDlp({ ...res.layers.dlp, patterns: [...res.layers.dlp.patterns], custom: [...res.layers.dlp.custom] });
+      setGhostOn(res.layers.ghost.mode === "on");
       setDirty(false);
       setStatus("\u2713 Saved");
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
   };
+  const toggleSelfProt = async () => {
+    const next = !(selfProt ?? false);
+    setSelfProt(next);
+    try {
+      await api.settings.setSelfProtection(next);
+      setStatus(`\u2713 self-protection ${next ? "on" : "off"}`);
+    } catch (e) {
+      setSelfProt(!next);
+      setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
+    }
+  };
   const discard = () => {
     if (q.data) setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
     setDirty(false);
@@ -8307,7 +8462,12 @@ function DlpPanel({ focused }) {
         const ci = sel - available.length;
         mutate({ ...dlp, custom: dlp.custom.filter((_, i) => i !== ci) });
         setSel((n) => Math.max(0, n - 1));
-      } else if (input === "s") void save();
+      } else if (input === "g") {
+        setGhostOn((v) => !v);
+        setDirty(true);
+        setStatus(null);
+      } else if (input === "P") void toggleSelfProt();
+      else if (input === "s") void save();
       else if (input === "x") discard();
     },
     { isActive: focused && !adding }
@@ -8319,7 +8479,13 @@ function DlpPanel({ focused }) {
       /* @__PURE__ */ jsx5(Text5, { color: modeColor(dlp.mode), children: dlp.mode }),
       dirty ? /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: "   \u25CF unsaved (s save \xB7 x discard)" }) : null
     ] }),
-    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 space toggle \xB7 m mode \xB7 a add \xB7 d remove \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: focused ? "\u2191\u2193 \xB7 space toggle \xB7 m mode \xB7 a add \xB7 d remove \xB7 g ghost \xB7 P self-protect \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "ghost: " }),
+      /* @__PURE__ */ jsx5(Text5, { color: ghostOn ? theme.ok : theme.dim, children: ghostOn ? "on" : "off" }),
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "   self-protection: " }),
+      /* @__PURE__ */ jsx5(Text5, { color: selfProt ? theme.ok : theme.dim, children: selfProt === null ? "\u2026" : selfProt ? "on" : "off" })
+    ] }),
     /* @__PURE__ */ jsx5(Box5, { marginTop: 1, flexDirection: "column", children: available.map((p, i) => {
       const on = enabled.has(p);
       const active2 = focused && sel === i;
@@ -8387,12 +8553,15 @@ import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function StatsPanel({ active: active2 }) {
   const stats = useLoader(() => api.stats.get());
   const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
+  const drift2 = useLoader(() => api.stats.drift(7));
   usePoll(() => {
     stats.reload();
     ts.reload();
   }, 5e3, active2);
+  usePoll(drift2.reload, 3e4, active2);
   const s = stats.data;
   const points = ts.data?.timeseries ?? [];
+  const driftRules = (drift2.data?.rules ?? []).slice(0, 5);
   return /* @__PURE__ */ jsx6(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs6(Box6, { children: [
       /* @__PURE__ */ jsxs6(Text6, { bold: true, children: [
@@ -8445,7 +8614,7 @@ function StatsPanel({ active: active2 }) {
             { header: "MS", width: 5 },
             { header: "WHEN", width: 6 }
           ],
-          rows: (s.recent_activity ?? []).slice(0, 8).map((a) => [
+          rows: (s.recent_activity ?? []).slice(0, 6).map((a) => [
             { value: a.decision, color: decisionColor(a.decision) },
             { value: truncate2(a.tool_name, 20), color: theme.accent },
             { value: String(a.evaluation_time_ms ?? "\u2014"), dim: true },
@@ -8453,6 +8622,31 @@ function StatsPanel({ active: active2 }) {
           ])
         }
       )
+    ] }),
+    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+        "Denial drift ",
+        drift2.data ? `(7d: ${drift2.data.total_current} now vs ${drift2.data.total_previous} prev)` : ""
+      ] }),
+      driftRules.length ? /* @__PURE__ */ jsx6(
+        Table,
+        {
+          columns: [
+            { header: "NOW", width: 5 },
+            { header: "PREV", width: 5 },
+            { header: "\u0394", width: 6 },
+            { header: "RULE", width: 22 },
+            { header: "REASON", width: 26 }
+          ],
+          rows: driftRules.map((r) => [
+            { value: String(r.current), bold: true },
+            { value: String(r.previous), dim: true },
+            { value: r.is_new ? "NEW" : r.spike ? `+${r.delta}` : String(r.delta), color: r.is_new ? theme.ok : r.spike ? theme.bad : void 0 },
+            { value: truncate2(r.rule_id ?? "\u2014", 22), color: theme.accent },
+            { value: truncate2(r.reason ?? r.last_tool ?? "\u2014", 26), dim: true }
+          ])
+        }
+      ) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  no denials in window" })
     ] })
   ] }) : null });
 }
@@ -8678,7 +8872,16 @@ function App() {
   const { exit } = useApp();
   const [section, setSection] = useState7(0);
   const [focus, setFocus] = useState7("nav");
+  const [help, setHelp] = useState7(false);
   useInput6((input, key) => {
+    if (help) {
+      setHelp(false);
+      return;
+    }
+    if (input === "?" && focus === "nav") {
+      setHelp(true);
+      return;
+    }
     if (focus === "nav") {
       if (key.upArrow) setSection((n) => (n - 1 + SECTIONS.length) % SECTIONS.length);
       else if (key.downArrow) setSection((n) => (n + 1) % SECTIONS.length);
@@ -8692,6 +8895,7 @@ function App() {
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const current = SECTIONS[section];
+  if (help) return /* @__PURE__ */ jsx8(HelpOverlay, { cols, rows });
   if (current.label === "Live" && focus === "panel") {
     return /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx8(LivePanel, { active: true, focused: true }) });
   }
@@ -8702,10 +8906,23 @@ function App() {
       /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx8(Text8, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
       /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
     ] }),
-    /* @__PURE__ */ jsx8(Box8, { children: focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    /* @__PURE__ */ jsx8(Box8, { children: focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
   ] });
 }
-var SECTIONS, BANNER_HEX;
+function HelpOverlay({ cols, rows }) {
+  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
+    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accent, children: group }),
+      keys.map(([k, desc]) => /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: desc })
+      ] }, k))
+    ] }, group)) }),
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "press any key to close" })
+  ] });
+}
+var SECTIONS, BANNER_HEX, HELP;
 var init_App = __esm({
   "src/tui/App.tsx"() {
     "use strict";
@@ -8727,6 +8944,12 @@ var init_App = __esm({
       { label: "Audit", Panel: AuditPanel }
     ];
     BANNER_HEX = ["#1432A0", "#2850BE", "#3C6ED7", "#5A8CE6", "#82AAF0", "#AAC8FA"];
+    HELP = [
+      ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],
+      ["Live", [["\u2191\u2193", "select a stream row"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
+      ["Policies", [["\u2191\u2193", "browse / select"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["v", "versions / rollback"], ["s", "save"], ["x", "discard"]]],
+      ["Rate limit / DLP", [["\u2191\u2193", "field / pattern"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["space", "toggle pattern"], ["m", "mode"], ["a / d", "add / remove custom"], ["g", "ghost mode"], ["P", "self-protection"], ["s", "save"]]]
+    ];
   }
 });
 
@@ -9334,6 +9557,16 @@ async function run5(argv) {
     else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
     return 0;
   }
+  if (positionals[0] === "block") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit block <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.block(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent DENY already present."));
+    else err(green(`  \u2713 Blocked (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
   const query = {
     filter: flagStr(flags, "filter"),
     tool: flagStr(flags, "tool"),
@@ -9441,6 +9674,395 @@ var init_agents2 = __esm({
   }
 });
 
+// src/commands/doctor.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
+async function run6(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves \u2014 every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+    } catch {
+    }
+  }
+  if (existsSync4(LOCAL_LOG2)) {
+    const st = statSync2(LOCAL_LOG2);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) \u2014 enable in dashboard \u2192 Settings" });
+  }
+  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
+  err("");
+  err(`  ${bold("SolonGate doctor")}`);
+  err("");
+  for (const c2 of checks) {
+    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
+    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
+  }
+  err("");
+  const bad = checks.filter((c2) => c2.ok === false).length;
+  const warn = checks.filter((c2) => c2.ok === "warn").length;
+  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
+  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("\u2014 guard is working")}`);
+  else err(`  ${green("all good")}`);
+  return bad ? 1 : 0;
+}
+var LOCAL_LOG2;
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    init_api_client();
+    init_format();
+    init_args();
+    LOCAL_LOG2 = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+  }
+});
+
+// src/commands/watch.ts
+import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function tailLocal(file, maxBytes = 131072) {
+  try {
+    const size = statSync3(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync2(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync2(fd, buf, 0, buf.length, start);
+    closeSync2(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function print(r, json) {
+  if (json) return out(JSON.stringify(r));
+  const dec = r.decision === "ALLOW" ? c.green : c.red;
+  const src = r.source === "local" ? c.green + "LOC" : c.blue4 + "CLD";
+  out(
+    `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
+  );
+}
+async function run7(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
+  const toolFilter = (flagStr(flags, "tool") || "").toLowerCase();
+  const localOnly = flagBool(flags, "local-only");
+  const cloudOnly = flagBool(flags, "cloud-only");
+  const keep = (r) => {
+    if (decisionFilter && r.decision.toUpperCase() !== decisionFilter && !(decisionFilter === "DENY" && r.decision === "DENIED")) return false;
+    if (toolFilter && !r.tool.toLowerCase().includes(toolFilter)) return false;
+    return true;
+  };
+  const seen = /* @__PURE__ */ new Set();
+  let lastLocalTs = 0;
+  let first = true;
+  const emit = (rows) => {
+    rows.sort((a, b) => a.at - b.at);
+    for (const r of rows) if (keep(r)) print(r, json);
+  };
+  const pollLocal = () => {
+    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    const rows = [];
+    for (const line of tailLocal(LOCAL_LOG3)) {
+      try {
+        const j = JSON.parse(line);
+        const at = Date.parse(String(j.ts ?? ""));
+        if (!Number.isFinite(at) || at <= lastLocalTs) continue;
+        rows.push({
+          at,
+          tool: String(j.tool ?? "?"),
+          decision: String(j.decision ?? "ALLOW"),
+          permission: String(j.permission ?? ""),
+          detail: (j.arguments ? JSON.stringify(j.arguments) : String(j.reason ?? "")).replace(/\s+/g, " "),
+          agent: String(j.agent_name ?? ""),
+          source: "local",
+          dlp: !!j.dlp
+        });
+      } catch {
+      }
+    }
+    if (rows.length) lastLocalTs = rows[rows.length - 1].at;
+    if (!first) emit(rows);
+  };
+  const pollCloud = async () => {
+    if (localOnly) return;
+    try {
+      const res = await api.audit.list({ limit: 50 });
+      const rows = [];
+      for (const e of res.entries) {
+        if (seen.has(e.id)) continue;
+        seen.add(e.id);
+        rows.push({
+          at: Date.parse(e.created_at),
+          tool: e.tool_name,
+          decision: e.decision,
+          permission: e.permission ?? "",
+          detail: (e.arguments_summary ? JSON.stringify(e.arguments_summary) : e.reason ?? "").replace(/\s+/g, " "),
+          agent: e.agent_name ?? "",
+          source: "cloud",
+          dlp: !!e.dlp_matches?.length
+        });
+      }
+      if (!first) emit(rows);
+    } catch {
+    }
+  };
+  if (!json) err(`  ${c.dim}watching guard stream \u2014 Ctrl+C to stop${c.reset}`);
+  pollLocal();
+  await pollCloud();
+  first = false;
+  return new Promise(() => {
+    setInterval(pollLocal, 2e3);
+    setInterval(() => void pollCloud(), 4e3);
+  });
+}
+var LOCAL_LOG3, trunc, time;
+var init_watch = __esm({
+  "src/commands/watch.ts"() {
+    "use strict";
+    init_api_client();
+    init_cli_utils();
+    init_args();
+    init_format();
+    LOCAL_LOG3 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
+    time = (ms) => new Date(ms).toTimeString().slice(0, 8);
+  }
+});
+
+// src/commands/keys.ts
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE6), 0;
+    case "list": {
+      const { keys } = await api.keys.list();
+      if (json) return printJson(keys), 0;
+      if (!keys.length) return err(dim("  No API keys.")), 0;
+      table(
+        ["ID", "NAME", "PREFIX", "CREATED"],
+        keys.map((k) => [dim(truncate3(k.id, 10)), truncate3(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
+      );
+      return 0;
+    }
+    case "create": {
+      const name = flagStr(flags, "name");
+      if (!name) return err("  Usage: keys create --name <name>"), 1;
+      const res = await api.keys.create(name, !flagBool(flags, "test"));
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Created "${res.name}"`));
+      err("");
+      err("  " + bold(res.key));
+      err(dim("  \u2191 shown only once \u2014 copy it now."));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: keys revoke <id>"), 1;
+      await api.keys.revoke(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Revoked ${id}`)), 0;
+    }
+    default:
+      return err(USAGE6), 1;
+  }
+}
+var USAGE6;
+var init_keys2 = __esm({
+  "src/commands/keys.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE6 = `${bold("solongate keys")} \u2014 API keys
+
+  keys list                 List keys (prefix only)
+  keys create --name <n>    Create a key (secret shown once)
+  keys revoke <id>          Revoke a key
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/mcp.ts
+async function run9(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const { servers } = await api.mcp.list();
+  if (json) return printJson(servers), 0;
+  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
+  table(
+    ["STATUS", "NAME", "TARGET"],
+    servers.map((s) => [
+      s.status === "active" ? green(s.status) : yellow(s.status),
+      cyan(truncate3(s.name, 24)),
+      dim(truncate3(s.url || s.command || "\u2014", 46))
+    ])
+  );
+  return 0;
+}
+var init_mcp2 = __esm({
+  "src/commands/mcp.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+  }
+});
+
+// src/commands/alerts.ts
+async function run10(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE7), 0;
+    case "list": {
+      const { rules } = await api.settings.getAlerts();
+      if (json) return printJson(rules), 0;
+      if (!rules.length) return err(dim("  No alert rules.")), 0;
+      table(
+        ["ID", "ON", "SIGNAL", "THRESH", "WINDOW", "CHANNELS"],
+        rules.map((r) => [
+          dim(truncate3(r.id, 10)),
+          r.enabled ? green("\u25CF") : dim("\u25CB"),
+          cyan(r.signal),
+          `${r.threshold}`,
+          `${r.windowSeconds}s`,
+          dim([...r.emails ?? [], ...(r.telegram ?? []).map((t) => "tg:" + t), ...(r.slackUrls ?? []).map(() => "slack")].join(" ") || "\u2014")
+        ])
+      );
+      return 0;
+    }
+    case "add": {
+      const email = flagStr(flags, "email");
+      const telegram = flagStr(flags, "telegram");
+      const slack = flagStr(flags, "slack");
+      if (!email && !telegram && !slack) return err("  Need a channel: --email / --telegram / --slack"), 1;
+      const res = await api.settings.createAlert({
+        signal: flagStr(flags, "signal") ?? "deny",
+        threshold: flagNum(flags, "threshold") ?? 5,
+        windowSeconds: flagNum(flags, "window") ?? 300,
+        emails: email ? [email] : void 0,
+        telegram: telegram ? [telegram] : void 0,
+        slackUrl: slack
+      });
+      if (json) return printJson(res.rule), 0;
+      return err(green(`  \u2713 Alert added (${res.rule.signal}, ${res.rule.threshold}/${res.rule.windowSeconds}s)`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: alerts remove <id>"), 1;
+      await api.settings.deleteAlert(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE7), 1;
+  }
+}
+var USAGE7;
+var init_alerts = __esm({
+  "src/commands/alerts.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+
+  alerts list
+  alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
+             (--email <a> | --telegram <chatId> | --slack <url>)
+  alerts remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
+// src/commands/webhooks.ts
+async function run11(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "list";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE8), 0;
+    case "list": {
+      const { webhooks } = await api.settings.getWebhooks();
+      if (json) return printJson(webhooks), 0;
+      if (!webhooks.length) return err(dim("  No webhooks.")), 0;
+      table(
+        ["ID", "ON", "EVENTS", "URL"],
+        webhooks.map((w) => [dim(truncate3(w.id, 10)), w.enabled ? green("\u25CF") : dim("\u25CB"), cyan(w.events), dim(truncate3(w.url, 46))])
+      );
+      return 0;
+    }
+    case "add": {
+      const url = flagStr(flags, "url");
+      if (!url) return err("  Usage: webhooks add --url <https://\u2026> [--events denials|allowed|all]"), 1;
+      const res = await api.settings.createWebhook({ url, events: flagStr(flags, "events") ?? "denials" });
+      if (json) return printJson(res.webhook), 0;
+      return err(green(`  \u2713 Webhook added (${res.webhook.events}) \u2192 ${res.webhook.url}`)), 0;
+    }
+    case "remove": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: webhooks remove <id>"), 1;
+      await api.settings.deleteWebhook(id);
+      if (json) return printJson({ ok: true, id }), 0;
+      return err(green(`  \u2713 Removed ${id}`)), 0;
+    }
+    default:
+      return err(USAGE8), 1;
+  }
+}
+var USAGE8;
+var init_webhooks = __esm({
+  "src/commands/webhooks.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+
+  webhooks list
+  webhooks add --url <https://\u2026> [--events denials|allowed|all]
+  webhooks remove <id>
+
+  Add --json for machine-readable output.`;
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -9463,6 +10085,18 @@ async function dispatch(command, argv) {
       return runAgents(argv);
     case "agent":
       return runAgent(argv);
+    case "doctor":
+      return run6(argv);
+    case "watch":
+      return run7(argv);
+    case "keys":
+      return run8(argv);
+    case "mcp":
+      return run9(argv);
+    case "alerts":
+      return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -9497,7 +10131,13 @@ var init_commands = __esm({
     init_stats2();
     init_audit2();
     init_agents2();
-    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+    init_doctor();
+    init_watch();
+    init_keys2();
+    init_mcp2();
+    init_alerts();
+    init_webhooks();
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
   }
 });
 
@@ -9513,14 +10153,14 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve4, join as join6, dirname } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { resolve as resolve4, join as join8, dirname } from "path";
+import { homedir as homedir6 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
 function lockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9546,7 +10186,7 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync4(file)) return;
+  if (!existsSync6(file)) return;
   try {
     if (process.platform === "win32") {
       try {
@@ -9578,10 +10218,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join6(p.hooksDir, "guard.mjs"),
-    join6(p.hooksDir, "audit.mjs"),
-    join6(p.hooksDir, "stop.mjs"),
-    join6(p.hooksDir, "shield.mjs"),
+    join8(p.hooksDir, "guard.mjs"),
+    join8(p.hooksDir, "audit.mjs"),
+    join8(p.hooksDir, "stop.mjs"),
+    join8(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -9593,26 +10233,26 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir4();
-  const sgDir = join6(home, ".solongate");
-  const hooksDir = join6(sgDir, "hooks");
-  const claudeDir = join6(home, ".claude");
+  const home = homedir6();
+  const sgDir = join8(home, ".solongate");
+  const hooksDir = join8(sgDir, "hooks");
+  const claudeDir = join8(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join6(claudeDir, "settings.json"),
-    backupPath: join6(claudeDir, "settings.solongate.bak"),
-    configPath: join6(sgDir, "cloud-guard.json")
+    settingsPath: join8(claudeDir, "settings.json"),
+    backupPath: join8(claudeDir, "settings.solongate.bak"),
+    configPath: join8(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync6(join6(HOOKS_DIR, filename), "utf-8");
+  return readFileSync6(join8(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join8(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync6(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -9625,10 +10265,10 @@ function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
   removeClaudeShim();
-  if (existsSync4(p.backupPath)) {
+  if (existsSync6(p.backupPath)) {
     writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync4(p.settingsPath)) {
+  } else if (existsSync6(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
       delete s.hooks;
@@ -9666,11 +10306,11 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir4(), f)).filter((f) => existsSync4(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join8(homedir6(), f)).filter((f) => existsSync6(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync6(file, "utf-8") : "";
+  let content = existsSync6(file) ? readFileSync6(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
@@ -9737,18 +10377,18 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync3(p.hooksDir, { recursive: true });
   mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join6(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync3(join8(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join8(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join8(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join8(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync4(p.settingsPath)) {
+  if (existsSync6(p.settingsPath)) {
     const raw = readFileSync6(p.settingsPath, "utf-8");
-    if (!existsSync4(p.backupPath)) {
+    if (!existsSync6(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
@@ -9758,9 +10398,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join6(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join6(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join8(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join8(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join8(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const merged = {
     ...existing,
@@ -9950,22 +10590,22 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync7, existsSync as existsSync5, readdirSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir7 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir5(), ".solongate");
+  const dir = resolve5(homedir7(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync5(f)) return f;
+    if (existsSync7(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
     for (const name of readdirSync(dir)) {
       if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
         const full = resolve5(dir, name);
-        const ts = statSync2(full).mtimeMs;
+        const ts = statSync4(full).mtimeMs;
         if (ts > bestTs) {
           bestTs = ts;
           best = full;
@@ -9979,7 +10619,7 @@ function findCacheFile() {
 function loadCfg() {
   try {
     const f = findCacheFile();
-    if (f && existsSync5(f)) {
+    if (f && existsSync7(f)) {
       const c2 = JSON.parse(readFileSync7(f, "utf-8"));
       const d = c2?.security?.dlpRedact;
       const g = c2?.security?.ghost;
@@ -10256,9 +10896,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync8, statSync as statSync3 } from "fs";
-import { resolve as resolve6, join as join7, isAbsolute } from "path";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync8, statSync as statSync5 } from "fs";
+import { resolve as resolve6, join as join9, isAbsolute } from "path";
+import { homedir as homedir8 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -10275,15 +10915,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir6(), ".solongate", "local-logs");
+  return resolve6(homedir8(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir6(), ".solongate");
+  const base = resolve6(homedir8(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync8(join7(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync8(join9(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -10292,7 +10932,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync8(join7(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync8(join9(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -10321,9 +10961,9 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join7(dir, LOG_FILENAME);
+  const file = join9(dir, LOG_FILENAME);
   try {
-    const st = statSync3(file);
+    const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -10434,7 +11074,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync6, copyFileSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -10492,7 +11132,7 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync6(resolve7("package.json"))) return false;
+  if (!existsSync8(resolve7("package.json"))) return false;
   try {
     const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -10508,13 +11148,13 @@ function findTsEntryFile() {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync6(resolve7(binPath))) return resolve7(binPath);
+        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
+        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync6(resolve7(srcPath))) return resolve7(srcPath);
+      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
     }
   } catch {
   }
@@ -10528,7 +11168,7 @@ function findTsEntryFile() {
   ];
   for (const c2 of candidates) {
     const full = resolve7(c2);
-    if (existsSync6(full)) {
+    if (existsSync8(full)) {
       try {
         const content = readFileSync9(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
@@ -10539,13 +11179,13 @@ function findTsEntryFile() {
     }
   }
   for (const c2 of candidates) {
-    if (existsSync6(resolve7(c2))) return resolve7(c2);
+    if (existsSync8(resolve7(c2))) return resolve7(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync6(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync6(resolve7("yarn.lock"))) return "yarn";
+  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
@@ -10688,7 +11328,7 @@ async function main2() {
   }
   log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync6(entryFile)) {
+  if (!entryFile || !existsSync8(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -10701,7 +11341,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync6(backupPath)) {
+    if (!existsSync8(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -10737,7 +11377,7 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync6(backupPath)) {
+  if (!existsSync8(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -10771,8 +11411,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join10 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -10852,7 +11492,7 @@ EXAMPLES
 }
 function createProject(dir, name, _policy) {
   writeFileSync5(
-    join8(dir, "package.json"),
+    join10(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -10882,7 +11522,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, "tsconfig.json"),
+    join10(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -10902,9 +11542,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync4(join8(dir, "src"), { recursive: true });
+  mkdirSync4(join10(dir, "src"), { recursive: true });
   writeFileSync5(
-    join8(dir, "src", "index.ts"),
+    join10(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -10946,7 +11586,7 @@ console.log('Press Ctrl+C to stop.');
 `
   );
   writeFileSync5(
-    join8(dir, ".mcp.json"),
+    join10(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -10964,12 +11604,12 @@ console.log('Press Ctrl+C to stop.');
     ) + "\n"
   );
   writeFileSync5(
-    join8(dir, ".env"),
+    join10(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
   writeFileSync5(
-    join8(dir, ".gitignore"),
+    join10(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -10983,7 +11623,7 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync7(dir)) {
+  if (existsSync9(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -11062,12 +11702,12 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve9(".env");
-  if (!existsSync8(envPath)) return;
+  if (!existsSync10(envPath)) return;
   try {
     const content = readFileSync10(envPath, "utf-8");
     for (const line of content.split("\n")) {
@@ -11134,7 +11774,7 @@ async function listPolicies(apiKey) {
   const data = await res.json();
   return data.policies ?? [];
 }
-async function list3(apiKey, policyId) {
+async function list5(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
     log5(yellow2("No policies found. Create one in the dashboard first."));
@@ -11269,7 +11909,7 @@ async function pull(apiKey, file, policyId) {
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync8(file)) {
+  if (!existsSync10(file)) {
     log5(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
@@ -11337,7 +11977,7 @@ async function main4() {
     } else if (command === "push") {
       await push(apiKey, file, policyId);
     } else if (command === "list" || command === "ls") {
-      await list3(apiKey, policyId);
+      await list5(apiKey, policyId);
     } else {
       log5(red2(`Unknown command: ${command}`));
       log5("");
@@ -14402,7 +15042,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "ui", "dashboard", "tui"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "logout", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "ui", "dashboard", "tui"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -14451,7 +15091,7 @@ async function main5() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));