@solongate/proxy 0.79.0 → 0.81.0

package/dist/index.js

@@ -6702,6 +6702,34 @@ var init_client = __esm({
   }
 });
 
+// src/tui/config.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+function loadConfig() {
+  if (cached2) return cached2;
+  const defaults = { notifications: true };
+  try {
+    const raw = readFileSync5(join5(homedir3(), ".solongate", "tui-config.json"), "utf-8");
+    const j = JSON.parse(raw);
+    cached2 = {
+      notifications: j.notifications !== false,
+      accent: typeof j.accent === "string" ? j.accent : void 0,
+      pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
+    };
+  } catch {
+    cached2 = defaults;
+  }
+  return cached2;
+}
+var cached2;
+var init_config2 = __esm({
+  "src/tui/config.ts"() {
+    "use strict";
+    cached2 = null;
+  }
+});
+
 // src/tui/theme.ts
 function decisionColor(decision) {
   const d = (decision || "").toUpperCase();
@@ -6735,13 +6763,15 @@ function ago(ts) {
   if (s < 86400) return `${Math.floor(s / 3600)}h`;
   return `${Math.floor(s / 86400)}d`;
 }
-var theme, BLOCKS;
+var accent, theme, BLOCKS;
 var init_theme = __esm({
   "src/tui/theme.ts"() {
     "use strict";
+    init_config2();
+    accent = loadConfig().accent;
     theme = {
-      accent: "cyan",
-      accentBright: "#5a8ce6",
+      accent: accent || "cyan",
+      accentBright: accent || "#5a8ce6",
       ok: "green",
       warn: "yellow",
       bad: "red",
@@ -6875,8 +6905,10 @@ __export(settings_exports, {
   getGuardStatus: () => getGuardStatus,
   getRateLimitHistory: () => getRateLimitHistory,
   getSecurityLayers: () => getSecurityLayers,
+  getSelfProtection: () => getSelfProtection,
   getWebhooks: () => getWebhooks,
-  setSecurityLayers: () => setSecurityLayers
+  setSecurityLayers: () => setSecurityLayers,
+  setSelfProtection: () => setSelfProtection
 });
 function getSecurityLayers() {
   return request("GET", "/settings/security-layers");
@@ -6893,6 +6925,12 @@ function clearRateLimitHistory() {
 function getGuardStatus() {
   return request("GET", "/settings/guard-status");
 }
+function getSelfProtection() {
+  return request("GET", "/settings/self-protection");
+}
+function setSelfProtection(enabled) {
+  return request("PUT", "/settings/self-protection", { body: { enabled } });
+}
 function getAlerts() {
   return request("GET", "/settings/denial-alerts");
 }
@@ -7100,9 +7138,9 @@ var init_hooks = __esm({
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
 import { spawn } from "child_process";
-import { closeSync, openSync, readSync, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { closeSync, mkdirSync as mkdirSync3, openSync, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function tailLines(file, maxBytes = 131072) {
@@ -7412,6 +7450,7 @@ function LivePanel({ active: active2 }) {
     (id, title, msg, level = "warn") => {
       pushLog(`${level === "bad" ? "\u26D4" : "\u23F8"} ${msg}`, level);
       setAlerts((a) => [...a.filter((x) => x.id !== id), { id, msg, level, until: Date.now() + 15e3 }].slice(-4));
+      if (!CONFIG.notifications) return;
       try {
         process.stdout.write("\x07");
       } catch {
@@ -7639,7 +7678,16 @@ function LivePanel({ active: active2 }) {
       else if (input === "d") toggleSignal("deny");
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
-      else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
+      else if (input === "e") {
+        const file = join6(homedir4(), ".solongate", "live-export.jsonl");
+        try {
+          mkdirSync3(join6(homedir4(), ".solongate"), { recursive: true });
+          writeFileSync3(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
+        } catch (err2) {
+          setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
+        }
+      } else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
       else if (key.upArrow) setSel((n) => Math.max(0, n - 1));
       else if (key.pageDown) setSel((n) => Math.min(visibleDesc.length - 1, n + streamBodyRows));
       else if (key.pageUp) setSel((n) => Math.max(0, n - streamBodyRows));
@@ -7888,18 +7936,20 @@ function LivePanel({ active: active2 }) {
     ] })
   ] });
 }
-var SPIN, BG, DIM_FLOOR, LOCAL_LOG, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE;
+var CONFIG, SPIN, BG, DIM_FLOOR, LOCAL_LOG, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE;
 var init_Live = __esm({
   "src/tui/panels/Live.tsx"() {
     "use strict";
     init_api_client();
+    init_config2();
     init_hooks();
     init_theme();
+    CONFIG = loadConfig();
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
-    LOCAL_LOG = join5(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
-    RING = join5(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    LOCAL_LOG = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    RING = join6(process.cwd(), ".solongate", ".eval-ring.jsonl");
     hhmmss = (ts) => {
       const d = new Date(ts);
       return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -7923,7 +7973,7 @@ var init_Live = __esm({
 import { Box as Box3, Text as Text3, useInput as useInput2 } from "ink";
 import TextInput2 from "ink-text-input";
 import { useEffect as useEffect3, useState as useState3 } from "react";
-import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+import { Fragment as Fragment3, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 function ruleSummary(r) {
   const bits = [];
   for (const [g, tag] of [["commandConstraints", "cmd"], ["pathConstraints", "path"], ["filenameConstraints", "file"], ["urlConstraints", "url"]]) {
@@ -7940,6 +7990,7 @@ function PoliciesPanel({ focused }) {
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
   const [fi, setFi] = useState3(0);
+  const [vi, setVi] = useState3(0);
   const [rules, setRules] = useState3([]);
   const [mode, setMode] = useState3("denylist");
   const [dirty, setDirty] = useState3(false);
@@ -7948,6 +7999,15 @@ function PoliciesPanel({ focused }) {
   const [status, setStatus] = useState3(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
+  const versionsQ = useLoader(
+    () => view === "versions" && selected ? api.policies.versions(selected.id, { limit: 50 }) : Promise.resolve(null),
+    [view, selected?.id]
+  );
+  const diffVer = versionsQ.data?.versions[vi]?.version;
+  const diffQ = useLoader(
+    () => view === "versions" && selected && diffVer !== void 0 ? api.policies.get(selected.id, diffVer) : Promise.resolve(null),
+    [view, selected?.id, diffVer]
+  );
   useEffect3(() => {
     if (detail.data) {
       setRules(detail.data.rules);
@@ -8022,10 +8082,41 @@ function PoliciesPanel({ focused }) {
           }
         } else if (input === "m") {
           mutate(rules, mode === "denylist" ? "whitelist" : "denylist");
+        } else if (input === "n") {
+          const nr = { id: `rule-${Date.now()}`, description: "", effect: "DENY", priority: 100, toolPattern: "*", minimumTrustLevel: "UNTRUSTED", enabled: true };
+          mutate([nr, ...rules]);
+          setRi(0);
+          setFi(0);
+          setView("rule");
+        } else if (input === "D") {
+          setStatus("Dry-running\u2026");
+          void api.policies.dryRun({ rules, mode }).then((res) => setStatus(`dry-run ${res.evaluated} calls \xB7 allow ${res.would_allow} / deny ${res.would_deny} \xB7 newly blocked ${res.newly_blocked} \xB7 newly allowed ${res.newly_allowed}`)).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+        } else if (input === "v") {
+          setVi(0);
+          setView("versions");
         } else if (input === "s") void save();
         else if (input === "x") discard();
         return;
       }
+      if (view === "versions") {
+        const vers = versionsQ.data?.versions ?? [];
+        if (key.leftArrow) return void setView("rules");
+        if (key.upArrow) setVi((n) => Math.max(0, n - 1));
+        else if (key.downArrow) setVi((n) => Math.min(vers.length - 1, n + 1));
+        else if (key.return) {
+          const v = vers[vi];
+          if (v && selected) {
+            setStatus("Rolling back\u2026");
+            void api.policies.rollback(selected.id, v.version).then((r) => {
+              setStatus(`\u2713 rolled back to v${v.version} \u2192 new v${r.version}`);
+              detail.reload();
+              list6.reload();
+              setView("rules");
+            }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
+          }
+        }
+        return;
+      }
       const rule2 = rules[ri];
       if (!rule2) return setView("rules");
       const field = FIELDS[fi];
@@ -8070,7 +8161,7 @@ function PoliciesPanel({ focused }) {
         /* @__PURE__ */ jsx3(Text3, { color: mode === "whitelist" ? theme.warn : void 0, children: mode }),
         dirtyTag
       ] }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 rule \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 d delete \xB7 m mode \xB7 s save \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 v versions \xB7 s save \xB7 \u2190 back" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
         Table,
         {
@@ -8096,6 +8187,50 @@ function PoliciesPanel({ focused }) {
       status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
     ] }) });
   }
+  if (view === "versions") {
+    const vers = versionsQ.data?.versions ?? [];
+    return /* @__PURE__ */ jsx3(DataView, { loading: versionsQ.loading && !versionsQ.data, error: versionsQ.error, empty: !!versionsQ.data && vers.length === 0, emptyText: "No versions.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: truncate2(selected?.name ?? "", 28) }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 select \xB7 enter roll back to that version \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "VER", width: 5 },
+            { header: "RULES", width: 5 },
+            { header: "REASON", width: 34 },
+            { header: "WHEN", width: 16 }
+          ],
+          rows: vers.map((v, i) => [
+            { value: i === vi ? "\u25B8" : "", color: theme.accentBright },
+            { value: `v${v.version}`, bold: i === vi },
+            { value: String(v.rules_count), dim: true },
+            { value: truncate2(v.reason || "\u2014", 34) },
+            { value: truncate2(v.created_at, 16), dim: true }
+          ])
+        }
+      ) }),
+      /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: `Diff v${diffVer ?? "?"} vs current draft` }),
+        (() => {
+          const old = diffQ.data?.rules ?? [];
+          const cur = rules;
+          const oldIds = new Set(old.map((r) => r.id));
+          const curIds = new Set(cur.map((r) => r.id));
+          const added = cur.filter((r) => !oldIds.has(r.id));
+          const removed = old.filter((r) => !curIds.has(r.id));
+          if (diffQ.loading && !diffQ.data) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  loading\u2026" });
+          if (!added.length && !removed.length) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  identical rule set" });
+          return /* @__PURE__ */ jsxs3(Fragment3, { children: [
+            added.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.ok, children: `  + ${r.effect} ${truncate2(r.toolPattern, 18)} ${truncate2(r.description || r.id, 30)}` }, "a" + r.id)),
+            removed.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.bad, children: `  - ${r.effect} ${truncate2(r.toolPattern, 18)} ${truncate2(r.description || r.id, 30)}` }, "r" + r.id))
+          ] });
+        })()
+      ] }),
+      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
+    ] }) });
+  }
   const rule = rules[ri];
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs3(Box3, { children: [
@@ -8237,6 +8372,20 @@ function RateLimitPanel({ focused }) {
       /* @__PURE__ */ jsx4(FieldRow, { label: "Per hour", active: focused && fi === 2, children: /* @__PURE__ */ jsx4(Text4, { bold: true, children: draft.perHour === 0 ? "off" : draft.perHour }) }),
       /* @__PURE__ */ jsx4(FieldRow, { label: "Per day", active: focused && fi === 3, children: /* @__PURE__ */ jsx4(Text4, { bold: true, children: draft.perDay === 0 ? "off" : draft.perDay }) })
     ] }),
+    draft.perMinute > 0 ? (() => {
+      const now = minuteSeries.slice(-1)[0] ?? 0;
+      const pct = Math.min(100, Math.round(now / draft.perMinute * 100));
+      const width2 = 30;
+      const filled = Math.min(width2, Math.round(now / draft.perMinute * width2));
+      const col = pct >= 100 ? theme.bad : pct >= 80 ? theme.warn : theme.ok;
+      return /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, children: [
+        /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: "load  " }),
+        /* @__PURE__ */ jsx4(Text4, { color: col, children: "\u2588".repeat(filled) }),
+        /* @__PURE__ */ jsx4(Text4, { color: "#233457", children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
+        /* @__PURE__ */ jsx4(Text4, { color: col, children: `  ${now}/${draft.perMinute} ` }),
+        /* @__PURE__ */ jsx4(Text4, { color: theme.dim, children: `(${pct}% this min)` })
+      ] });
+    })() : null,
     dirty || status ? /* @__PURE__ */ jsxs4(Box4, { marginTop: 1, children: [
       dirty ? /* @__PURE__ */ jsx4(Text4, { color: theme.warn, children: "\u25CF unsaved \u2014 press s to apply   " }) : null,
       status ? /* @__PURE__ */ jsx4(Text4, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
@@ -8319,12 +8468,19 @@ function DlpPanel({ focused }) {
   const [adding, setAdding] = useState5(null);
   const [newName, setNewName] = useState5("");
   const [newRe, setNewRe] = useState5("");
+  const [ghostOn, setGhostOn] = useState5(false);
+  const spQ = useLoader(() => api.settings.getSelfProtection());
+  const [selfProt, setSelfProt] = useState5(null);
   useEffect5(() => {
     if (q.data && !dlp) {
       setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
       setAvailable(q.data.availablePatterns);
+      setGhostOn(q.data.layers.ghost.mode === "on");
     }
   }, [q.data, dlp]);
+  useEffect5(() => {
+    if (spQ.data && selfProt === null) setSelfProt(spQ.data.enabled);
+  }, [spQ.data, selfProt]);
   const mutate = (next) => {
     setDlp(next);
     setDirty(true);
@@ -8334,14 +8490,27 @@ function DlpPanel({ focused }) {
     if (!dlp || !q.data) return;
     setStatus("Saving\u2026");
     try {
-      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp });
+      const ghost = { ...q.data.layers.ghost, mode: ghostOn ? "on" : "off" };
+      const res = await api.settings.setSecurityLayers({ ...q.data.layers, dlp, ghost });
       setDlp({ ...res.layers.dlp, patterns: [...res.layers.dlp.patterns], custom: [...res.layers.dlp.custom] });
+      setGhostOn(res.layers.ghost.mode === "on");
       setDirty(false);
       setStatus("\u2713 Saved");
     } catch (e) {
       setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
     }
   };
+  const toggleSelfProt = async () => {
+    const next = !(selfProt ?? false);
+    setSelfProt(next);
+    try {
+      await api.settings.setSelfProtection(next);
+      setStatus(`\u2713 self-protection ${next ? "on" : "off"}`);
+    } catch (e) {
+      setSelfProt(!next);
+      setStatus("\u2717 " + (e instanceof Error ? e.message : String(e)));
+    }
+  };
   const discard = () => {
     if (q.data) setDlp({ ...q.data.layers.dlp, patterns: [...q.data.layers.dlp.patterns], custom: [...q.data.layers.dlp.custom] });
     setDirty(false);
@@ -8371,7 +8540,12 @@ function DlpPanel({ focused }) {
         const ci = sel - available.length;
         mutate({ ...dlp, custom: dlp.custom.filter((_, i) => i !== ci) });
         setSel((n) => Math.max(0, n - 1));
-      } else if (input === "s") void save();
+      } else if (input === "g") {
+        setGhostOn((v) => !v);
+        setDirty(true);
+        setStatus(null);
+      } else if (input === "P") void toggleSelfProt();
+      else if (input === "s") void save();
       else if (input === "x") discard();
     },
     { isActive: focused && !adding }
@@ -8383,7 +8557,13 @@ function DlpPanel({ focused }) {
       /* @__PURE__ */ jsx5(Text5, { color: modeColor(dlp.mode), children: dlp.mode }),
       dirty ? /* @__PURE__ */ jsx5(Text5, { color: theme.warn, children: "   \u25CF unsaved (s save \xB7 x discard)" }) : null
     ] }),
-    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 space toggle \xB7 m mode \xB7 a add \xB7 d remove \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: focused ? "\u2191\u2193 \xB7 space toggle \xB7 m mode \xB7 a add \xB7 d remove \xB7 g ghost \xB7 P self-protect \xB7 s save" : "press \u2192 to edit" }),
+    /* @__PURE__ */ jsxs5(Box5, { children: [
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "ghost: " }),
+      /* @__PURE__ */ jsx5(Text5, { color: ghostOn ? theme.ok : theme.dim, children: ghostOn ? "on" : "off" }),
+      /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "   self-protection: " }),
+      /* @__PURE__ */ jsx5(Text5, { color: selfProt ? theme.ok : theme.dim, children: selfProt === null ? "\u2026" : selfProt ? "on" : "off" })
+    ] }),
     /* @__PURE__ */ jsx5(Box5, { marginTop: 1, flexDirection: "column", children: available.map((p, i) => {
       const on = enabled.has(p);
       const active2 = focused && sel === i;
@@ -8430,10 +8610,27 @@ function DlpPanel({ focused }) {
         }
       )
     ] }) : null,
+    adding === "re" ? /* @__PURE__ */ jsx5(RegexTest, { re: newRe }) : null,
     status ? /* @__PURE__ */ jsx5(Box5, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text5, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) }) : null
   ] }) : null });
 }
-var MODES2;
+function RegexTest({ re }) {
+  if (!re.trim()) return /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: "  regex: type a pattern\u2026" });
+  let rx = null;
+  let err2 = "";
+  try {
+    rx = new RegExp(re);
+  } catch (e) {
+    err2 = e instanceof Error ? e.message : String(e);
+  }
+  if (!rx) return /* @__PURE__ */ jsx5(Text5, { color: theme.bad, children: `  \u2717 invalid: ${err2.slice(0, 50)}` });
+  const hits = SAMPLES.filter((s) => rx.test(s));
+  return /* @__PURE__ */ jsxs5(Text5, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx5(Text5, { color: theme.ok, children: "  \u2713 valid" }),
+    /* @__PURE__ */ jsx5(Text5, { color: theme.dim, children: hits.length ? `  matches ${hits.length}/${SAMPLES.length} samples: ${hits.map((h) => h.slice(0, 8)).join(", ")}` : "  (no sample match \u2014 will only catch your custom secrets)" })
+  ] });
+}
+var MODES2, SAMPLES;
 var init_Dlp = __esm({
   "src/tui/panels/Dlp.tsx"() {
     "use strict";
@@ -8442,6 +8639,7 @@ var init_Dlp = __esm({
     init_hooks();
     init_theme();
     MODES2 = ["off", "detect", "block"];
+    SAMPLES = ["AKIA1234567890ABCD00", "sk-ant-api03-xxxxxxxx", "ghp_16chars0000000000000000000000000000", "password=hunter2", "Bearer eyJhbGciOi"];
   }
 });
 
@@ -8451,12 +8649,15 @@ import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function StatsPanel({ active: active2 }) {
   const stats = useLoader(() => api.stats.get());
   const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
+  const drift2 = useLoader(() => api.stats.drift(7));
   usePoll(() => {
     stats.reload();
     ts.reload();
   }, 5e3, active2);
+  usePoll(drift2.reload, 3e4, active2);
   const s = stats.data;
   const points = ts.data?.timeseries ?? [];
+  const driftRules = (drift2.data?.rules ?? []).slice(0, 5);
   return /* @__PURE__ */ jsx6(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs6(Box6, { children: [
       /* @__PURE__ */ jsxs6(Text6, { bold: true, children: [
@@ -8509,7 +8710,7 @@ function StatsPanel({ active: active2 }) {
             { header: "MS", width: 5 },
             { header: "WHEN", width: 6 }
           ],
-          rows: (s.recent_activity ?? []).slice(0, 8).map((a) => [
+          rows: (s.recent_activity ?? []).slice(0, 6).map((a) => [
             { value: a.decision, color: decisionColor(a.decision) },
             { value: truncate2(a.tool_name, 20), color: theme.accent },
             { value: String(a.evaluation_time_ms ?? "\u2014"), dim: true },
@@ -8517,6 +8718,31 @@ function StatsPanel({ active: active2 }) {
           ])
         }
       )
+    ] }),
+    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+        "Denial drift ",
+        drift2.data ? `(7d: ${drift2.data.total_current} now vs ${drift2.data.total_previous} prev)` : ""
+      ] }),
+      driftRules.length ? /* @__PURE__ */ jsx6(
+        Table,
+        {
+          columns: [
+            { header: "NOW", width: 5 },
+            { header: "PREV", width: 5 },
+            { header: "\u0394", width: 6 },
+            { header: "RULE", width: 22 },
+            { header: "REASON", width: 26 }
+          ],
+          rows: driftRules.map((r) => [
+            { value: String(r.current), bold: true },
+            { value: String(r.previous), dim: true },
+            { value: r.is_new ? "NEW" : r.spike ? `+${r.delta}` : String(r.delta), color: r.is_new ? theme.ok : r.spike ? theme.bad : void 0 },
+            { value: truncate2(r.rule_id ?? "\u2014", 22), color: theme.accent },
+            { value: truncate2(r.reason ?? r.last_tool ?? "\u2014", 26), dim: true }
+          ])
+        }
+      ) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  no denials in window" })
     ] })
   ] }) : null });
 }
@@ -8709,18 +8935,114 @@ var init_Audit = __esm({
   }
 });
 
-// src/tui/App.tsx
-import { Box as Box8, Text as Text8, useApp, useInput as useInput6 } from "ink";
+// src/tui/panels/Agents.tsx
+import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
 import { useState as useState7 } from "react";
-import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+function Bar({ label, value, max = 100, width: width2 = 16, color = theme.accent }) {
+  const filled = max > 0 ? Math.round(Math.min(value, max) / max * width2) : 0;
+  return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx8(Text8, { color, children: "\u2588".repeat(filled) }),
+    /* @__PURE__ */ jsx8(Text8, { color: "#233457", children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " " + value })
+  ] });
+}
+function AgentsPanel({ focused }) {
+  const live2 = useLoader(() => api.agents.live({ limit: 30, includeDeactivated: true }));
+  usePoll(live2.reload, 6e3, focused ? false : true);
+  const [sel, setSel] = useState7(0);
+  const agents = (live2.data?.agents ?? []).filter((a) => a.agent_id);
+  const selected = agents[Math.min(sel, Math.max(0, agents.length - 1))];
+  const detail = useLoader(() => selected?.agent_id ? api.agents.get(selected.agent_id) : Promise.resolve(null), [selected?.agent_id]);
+  useInput6(
+    (_input, key) => {
+      if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.downArrow) setSel((n) => Math.min(agents.length - 1, n + 1));
+    },
+    { isActive: focused }
+  );
+  const d = detail.data;
+  const base = d?.baseline;
+  const radar = base?.radar;
+  const anomalies2 = d?.anomalies ?? [];
+  const tmap = d?.trust_map;
+  const tools = tmap?.tools ?? [];
+  const resources = tmap?.resources ?? [];
+  const listW = 30;
+  return /* @__PURE__ */ jsx8(DataView, { loading: live2.loading && !live2.data, error: live2.error, empty: !!live2.data && agents.length === 0, emptyText: "No identified agents yet.", children: /* @__PURE__ */ jsxs8(Box8, { children: [
+    /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: listW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 select agent" : "press \u2192 to browse" }),
+      agents.slice(0, 16).map((a, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", backgroundColor: focused && i === sel ? "#1c2f63" : void 0, bold: i === sel, children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: statusColor(a.status), children: [
+          a.status === "active" ? "\u25CF" : a.status === "idle" ? "\u25D0" : "\u25CB",
+          " "
+        ] }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(a.agent_name ?? a.agent_id ?? "?", 16).padEnd(17) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `t${a.trust_score}` })
+      ] }, a.session_id))
+    ] }),
+    /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexGrow: 1, overflow: "hidden", children: !selected ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "select an agent" }) : detail.loading && !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "loading profile\u2026" }) : !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "no profile (agent has no calls yet)" }) : /* @__PURE__ */ jsxs8(Fragment4, { children: [
+      /* @__PURE__ */ jsxs8(Box8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: truncate2(selected.agent_name ?? selected.agent_id ?? "?", 22) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   trust ${base?.trustScore ?? "\u2014"}/100 \xB7 ${base?.character ?? ""}` })
+      ] }),
+      base?.characterBlurb ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate2(String(base.characterBlurb), 70) }) : null,
+      radar ? /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Behaviour radar (0\u2013100)" }),
+        /* @__PURE__ */ jsx8(Bar, { label: "read", value: Math.round((radar.read ?? 0) * 100) }),
+        /* @__PURE__ */ jsx8(Bar, { label: "write", value: Math.round((radar.write ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx8(Bar, { label: "execute", value: Math.round((radar.execute ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx8(Bar, { label: "network", value: Math.round((radar.network ?? 0) * 100) }),
+        /* @__PURE__ */ jsx8(Bar, { label: "complian.", value: Math.round((radar.compliance ?? 0) * 100), color: theme.ok })
+      ] }) : null,
+      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
+          "Anomalies ",
+          anomalies2.length ? `(${anomalies2.length})` : ""
+        ] }),
+        anomalies2.length === 0 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  none" }) : anomalies2.slice(0, 4).map((an, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx8(Text8, { color: sevColor(String(an.severity)), children: `  ${String(an.severity).toUpperCase().slice(0, 4).padEnd(5)}` }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: String(an.kind).padEnd(12) }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate2(String(an.description ?? ""), 44) })
+        ] }, i))
+      ] }),
+      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Trust map \xB7 top tools" }),
+        tools.slice(0, 4).map((t, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx8(Text8, { color: t.anomalous ? theme.bad : theme.accent, children: `  ${truncate2(String(t.name), 16).padEnd(17)}` }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `${t.count}\xD7 ${t.permission ?? ""}` })
+        ] }, i)),
+        resources.slice(0, 3).map((r, i) => /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: r.anomalous ? theme.bad : theme.dim, children: `  ${r.type === "domain" ? "\u{1F310}" : "\u{1F4C1}"} ${truncate2(String(r.value), 40)} ${r.count}\xD7` }, "r" + i))
+      ] })
+    ] }) })
+  ] }) });
+}
+var statusColor, sevColor;
+var init_Agents = __esm({
+  "src/tui/panels/Agents.tsx"() {
+    "use strict";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_theme();
+    statusColor = (s) => s === "active" ? theme.ok : s === "idle" ? theme.warn : theme.dim;
+    sevColor = (s) => s === "high" ? theme.bad : s === "medium" ? theme.warn : theme.dim;
+  }
+});
+
+// src/tui/App.tsx
+import { Box as Box9, Text as Text9, useApp, useInput as useInput7 } from "ink";
+import { useState as useState8 } from "react";
+import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
 function LiveHint() {
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
-    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, children: /* @__PURE__ */ jsxs8(Text8, { children: [
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, children: /* @__PURE__ */ jsxs9(Text9, { children: [
       "press ",
-      /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: "enter" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: "enter" }),
       " to go live"
     ] }) })
   ] });
@@ -8728,21 +9050,30 @@ function LiveHint() {
 function Banner() {
   const wide = (process.stdout.columns ?? 80) >= 82;
   if (!wide) {
-    return /* @__PURE__ */ jsxs8(Box8, { children: [
-      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "SolonGate" }),
-      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " \u2014 security control center" })
+    return /* @__PURE__ */ jsxs9(Box9, { children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " \u2014 security control center" })
     ] });
   }
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
-    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx8(Text8, { bold: true, color: BANNER_HEX[i], children: line }, i)),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx9(Text9, { bold: true, color: BANNER_HEX[i], children: line }, i)),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
   ] });
 }
 function App() {
   const { exit } = useApp();
-  const [section, setSection] = useState7(0);
-  const [focus, setFocus] = useState7("nav");
-  useInput6((input, key) => {
+  const [section, setSection] = useState8(0);
+  const [focus, setFocus] = useState8("nav");
+  const [help, setHelp] = useState8(false);
+  useInput7((input, key) => {
+    if (help) {
+      setHelp(false);
+      return;
+    }
+    if (input === "?" && focus === "nav") {
+      setHelp(true);
+      return;
+    }
     if (focus === "nav") {
       if (key.upArrow) setSection((n) => (n - 1 + SECTIONS.length) % SECTIONS.length);
       else if (key.downArrow) setSection((n) => (n + 1) % SECTIONS.length);
@@ -8756,20 +9087,34 @@ function App() {
   const cols = process.stdout.columns ?? 100;
   const rows = process.stdout.rows ?? 30;
   const current = SECTIONS[section];
+  if (help) return /* @__PURE__ */ jsx9(HelpOverlay, { cols, rows });
   if (current.label === "Live" && focus === "panel") {
-    return /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx8(LivePanel, { active: true, focused: true }) });
+    return /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx9(LivePanel, { active: true, focused: true }) });
   }
   const Panel = current.Panel;
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx8(Banner, {}),
-    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
-      /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx8(Text8, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
-      /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Banner, {}),
+    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
+      /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx9(Text9, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
+      /* @__PURE__ */ jsx9(Box9, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx9(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
     ] }),
-    /* @__PURE__ */ jsx8(Box8, { children: focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    /* @__PURE__ */ jsx9(Box9, { children: focus === "nav" ? /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+  ] });
+}
+function HelpOverlay({ cols, rows }) {
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accent, children: group }),
+      keys.map(([k, desc]) => /* @__PURE__ */ jsxs9(Text9, { children: [
+        /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
+        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: desc })
+      ] }, k))
+    ] }, group)) }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "press any key to close" })
   ] });
 }
-var SECTIONS, BANNER_HEX;
+var SECTIONS, BANNER_HEX, HELP;
 var init_App = __esm({
   "src/tui/App.tsx"() {
     "use strict";
@@ -8782,8 +9127,10 @@ var init_App = __esm({
     init_Dlp();
     init_Stats();
     init_Audit();
+    init_Agents();
     SECTIONS = [
       { label: "Live", Panel: LiveHint },
+      { label: "Agents", Panel: AgentsPanel },
       { label: "Policies", Panel: PoliciesPanel },
       { label: "Rate Limit", Panel: RateLimitPanel },
       { label: "DLP", Panel: DlpPanel },
@@ -8791,6 +9138,12 @@ var init_App = __esm({
       { label: "Audit", Panel: AuditPanel }
     ];
     BANNER_HEX = ["#1432A0", "#2850BE", "#3C6ED7", "#5A8CE6", "#82AAF0", "#AAC8FA"];
+    HELP = [
+      ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],
+      ["Live", [["\u2191\u2193", "select a stream row"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
+      ["Policies", [["\u2191\u2193", "browse / select"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["v", "versions / rollback"], ["s", "save"], ["x", "discard"]]],
+      ["Rate limit / DLP", [["\u2191\u2193", "field / pattern"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["space", "toggle pattern"], ["m", "mode"], ["a / d", "add / remove custom"], ["g", "ghost mode"], ["P", "self-protection"], ["s", "save"]]]
+    ];
   }
 });
 
@@ -8800,7 +9153,7 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { render } from "ink";
-import { jsx as jsx9 } from "react/jsx-runtime";
+import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stderr.write(
@@ -8814,7 +9167,7 @@ async function launchTui() {
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
-    const { waitUntilExit } = render(/* @__PURE__ */ jsx9(App, {}));
+    const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));
     await waitUntilExit();
   } finally {
     process.stdout.write("\x1B[?1049l");
@@ -8926,7 +9279,7 @@ var init_args = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 async function run(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -9101,7 +9454,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync5(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -9465,7 +9818,7 @@ async function runAgents(argv) {
   table(
     ["STATUS", "AGENT", "CALLS", "DENY", "DLP", "TRUST", "CHARACTER"],
     res.agents.map((a) => [
-      statusColor(a.status),
+      statusColor2(a.status),
       cyan(truncate3(a.agent_name ?? a.agent_id ?? a.session_id, 20)),
       String(a.total_calls),
       a.denied_calls ? red(String(a.denied_calls)) : dim("0"),
@@ -9484,7 +9837,7 @@ async function runAgent(argv) {
   const a = await api.agents.get(id);
   if (json) return printJson(a), 0;
   err("");
-  err(`  ${bold(a.agent_id)}   status: ${statusColor(String(a.status))}`);
+  err(`  ${bold(a.agent_id)}   status: ${statusColor2(String(a.status))}`);
   const base = a.baseline;
   if (base) {
     err(`  ${dim(base.character ?? "")}   trust ${bold(String(base.trustScore ?? "\u2014"))}/100   deny-rate ${(Number(base.denyRate ?? 0) * 100).toFixed(0)}%`);
@@ -9504,21 +9857,21 @@ async function runAgent(argv) {
   }
   return 0;
 }
-var statusColor;
+var statusColor2;
 var init_agents2 = __esm({
   "src/commands/agents.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    statusColor = (s) => s === "active" ? green(s) : s === "idle" ? yellow(s) : dim(s);
+    statusColor2 = (s) => s === "active" ? green(s) : s === "idle" ? yellow(s) : dim(s);
   }
 });
 
 // src/commands/doctor.ts
 import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -9578,14 +9931,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -9692,7 +10045,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -9994,9 +10347,9 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
-import { resolve as resolve4, join as join8, dirname } from "path";
-import { homedir as homedir6 } from "os";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { resolve as resolve4, join as join9, dirname } from "path";
+import { homedir as homedir7 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -10059,10 +10412,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join8(p.hooksDir, "guard.mjs"),
-    join8(p.hooksDir, "audit.mjs"),
-    join8(p.hooksDir, "stop.mjs"),
-    join8(p.hooksDir, "shield.mjs"),
+    join9(p.hooksDir, "guard.mjs"),
+    join9(p.hooksDir, "audit.mjs"),
+    join9(p.hooksDir, "stop.mjs"),
+    join9(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -10074,26 +10427,26 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir6();
-  const sgDir = join8(home, ".solongate");
-  const hooksDir = join8(sgDir, "hooks");
-  const claudeDir = join8(home, ".claude");
+  const home = homedir7();
+  const sgDir = join9(home, ".solongate");
+  const hooksDir = join9(sgDir, "hooks");
+  const claudeDir = join9(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join8(claudeDir, "settings.json"),
-    backupPath: join8(claudeDir, "settings.solongate.bak"),
-    configPath: join8(sgDir, "cloud-guard.json")
+    settingsPath: join9(claudeDir, "settings.json"),
+    backupPath: join9(claudeDir, "settings.solongate.bak"),
+    configPath: join9(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync6(join8(HOOKS_DIR, filename), "utf-8");
+  return readFileSync7(join9(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join8(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync6(bundled) ? readFileSync6(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join9(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync6(bundled) ? readFileSync7(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -10107,13 +10460,13 @@ function runGlobalRestore() {
   unlockProtected();
   removeClaudeShim();
   if (existsSync6(p.backupPath)) {
-    writeFileSync3(p.settingsPath, readFileSync6(p.backupPath, "utf-8"));
+    writeFileSync4(p.settingsPath, readFileSync7(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
   } else if (existsSync6(p.settingsPath)) {
     try {
-      const s = JSON.parse(readFileSync6(p.settingsPath, "utf-8"));
+      const s = JSON.parse(readFileSync7(p.settingsPath, "utf-8"));
       delete s.hooks;
-      writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      writeFileSync4(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
     } catch {
     }
@@ -10147,18 +10500,18 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join8(homedir6(), f)).filter((f) => existsSync6(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join9(homedir7(), f)).filter((f) => existsSync6(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync6(file) ? readFileSync6(file, "utf-8") : "";
+  let content = existsSync6(file) ? readFileSync7(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block2 + "\n";
   }
-  mkdirSync3(dirname(file), { recursive: true });
-  writeFileSync3(file, content);
+  mkdirSync4(dirname(file), { recursive: true });
+  writeFileSync4(file, content);
 }
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
@@ -10202,7 +10555,7 @@ async function runGlobalInstall(opts = {}) {
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
   if (!apiKey || apiKey === "sg_live_your_key_here") {
     try {
-      const cfg = JSON.parse(readFileSync6(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync7(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
     } catch {
     }
@@ -10215,22 +10568,22 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync3(p.hooksDir, { recursive: true });
-  mkdirSync3(p.claudeDir, { recursive: true });
+  mkdirSync4(p.hooksDir, { recursive: true });
+  mkdirSync4(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join8(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join8(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join8(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join8(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync4(join9(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync4(join9(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync4(join9(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync4(join9(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   removeClaudeShim();
-  writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  writeFileSync4(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
   if (existsSync6(p.settingsPath)) {
-    const raw = readFileSync6(p.settingsPath, "utf-8");
+    const raw = readFileSync7(p.settingsPath, "utf-8");
     if (!existsSync6(p.backupPath)) {
-      writeFileSync3(p.backupPath, raw);
+      writeFileSync4(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
     try {
@@ -10239,9 +10592,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join8(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join8(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join8(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join9(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join9(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join9(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const merged = {
     ...existing,
@@ -10251,7 +10604,7 @@ async function runGlobalInstall(opts = {}) {
       Stop: [{ matcher: "", hooks: [{ type: "command", command: `"${nodeBin}" "${stopAbs}" claude-code "Claude Code"` }] }]
     }
   };
-  writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync4(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
   console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   if (process.env["SOLONGATE_OS_LOCK"] === "1") {
     lockProtected();
@@ -10431,11 +10784,11 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync7, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir7(), ".solongate");
+  const dir = resolve5(homedir8(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
@@ -10461,7 +10814,7 @@ function loadCfg() {
   try {
     const f = findCacheFile();
     if (f && existsSync7(f)) {
-      const c2 = JSON.parse(readFileSync7(f, "utf-8"));
+      const c2 = JSON.parse(readFileSync8(f, "utf-8"));
       const d = c2?.security?.dlpRedact;
       const g = c2?.security?.ghost;
       const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
@@ -10737,9 +11090,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync8, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join9, isAbsolute } from "path";
-import { homedir as homedir8 } from "os";
+import { readFileSync as readFileSync9, statSync as statSync5 } from "fs";
+import { resolve as resolve6, join as join10, isAbsolute } from "path";
+import { homedir as homedir9 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -10756,15 +11109,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir8(), ".solongate", "local-logs");
+  return resolve6(homedir9(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir8(), ".solongate");
+  const base = resolve6(homedir9(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync8(join9(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync9(join10(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -10773,7 +11126,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync8(join9(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync9(join10(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -10802,7 +11155,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join9(dir, LOG_FILENAME);
+  const file = join10(dir, LOG_FILENAME);
   try {
     const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -10863,7 +11216,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync8(info.file, "utf-8");
+        const text = readFileSync9(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -10915,7 +11268,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, existsSync as existsSync8, copyFileSync } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync5, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -10975,7 +11328,7 @@ WHAT IT DOES
 function detectProject() {
   if (!existsSync8(resolve7("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync10(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -10984,7 +11337,7 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync10(resolve7("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
@@ -11011,7 +11364,7 @@ function findTsEntryFile() {
     const full = resolve7(c2);
     if (existsSync8(full)) {
       try {
-        const content = readFileSync9(full, "utf-8");
+        const content = readFileSync10(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -11031,7 +11384,7 @@ function detectPackageManager() {
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync9(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync10(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/proxy"]) {
       log3("  @solongate/proxy already installed");
@@ -11052,7 +11405,7 @@ function installSdk() {
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync9(filePath, "utf-8");
+  const original = readFileSync10(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -11223,7 +11576,7 @@ async function main2() {
     log3("");
     log3(`  Backup: ${backupPath}`);
   }
-  writeFileSync4(entryFile, result.modified);
+  writeFileSync5(entryFile, result.modified);
   log3("");
   log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
   log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
@@ -11252,8 +11605,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join10 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join11 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -11332,8 +11685,8 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync5(
-    join10(dir, "package.json"),
+  writeFileSync6(
+    join11(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -11362,8 +11715,8 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync5(
-    join10(dir, "tsconfig.json"),
+  writeFileSync6(
+    join11(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -11383,9 +11736,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync4(join10(dir, "src"), { recursive: true });
-  writeFileSync5(
-    join10(dir, "src", "index.ts"),
+  mkdirSync5(join11(dir, "src"), { recursive: true });
+  writeFileSync6(
+    join11(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -11426,8 +11779,8 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync5(
-    join10(dir, ".mcp.json"),
+  writeFileSync6(
+    join11(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -11444,13 +11797,13 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync5(
-    join10(dir, ".env"),
+  writeFileSync6(
+    join11(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync5(
-    join10(dir, ".gitignore"),
+  writeFileSync6(
+    join11(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -11469,7 +11822,7 @@ async function main3() {
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -11543,14 +11896,14 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve9(".env");
   if (!existsSync10(envPath)) return;
   try {
-    const content = readFileSync10(envPath, "utf-8");
+    const content = readFileSync11(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -11738,7 +12091,7 @@ async function pull(apiKey, file, policyId) {
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync6(file, json, "utf-8");
+  writeFileSync7(file, json, "utf-8");
   log5("");
   log5(green2("  Saved to: ") + file);
   log5(`  ${dim2("Name:")}    ${policy.name}`);
@@ -11767,7 +12120,7 @@ async function push(apiKey, file, policyId) {
     log5("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync10(file, "utf-8");
+  const content = readFileSync11(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);