@solongate/proxy 0.81.15 → 0.81.17

package/dist/index.js

@@ -7089,6 +7089,145 @@ var init_api_client = __esm({
   }
 });
 
+// src/tui/notify.ts
+import { spawn, execFileSync as execFileSync2 } from "child_process";
+import { writeFileSync as writeFileSync3, existsSync as existsSync4 } from "fs";
+import { join as join6 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+function captureFocusTarget() {
+  try {
+    if (process.platform === "linux") {
+      focusToken = (process.env.WINDOWID || "").trim() || null;
+      if (!focusToken) {
+        try {
+          focusToken = execFileSync2("xdotool", ["getactivewindow"], { encoding: "utf-8", timeout: 1500, stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+        } catch {
+          focusToken = null;
+        }
+      }
+    } else if (process.platform === "win32") {
+      const ps = `Add-Type -Name W -Namespace N -MemberDefinition '[DllImport("user32.dll")]public static extern System.IntPtr GetForegroundWindow();' | Out-Null; [N.W]::GetForegroundWindow().ToInt64()`;
+      try {
+        focusToken = execFileSync2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { encoding: "utf-8", timeout: 4e3, stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+      } catch {
+        focusToken = null;
+      }
+    }
+  } catch {
+    focusToken = null;
+  }
+}
+function desktopNotify(title, msg) {
+  try {
+    if (process.platform === "linux") linuxNotify(title, msg);
+    else if (process.platform === "win32") winNotify(title, msg);
+    else if (process.platform === "darwin") macNotify(title, msg);
+  } catch {
+  }
+}
+function linuxNotify(title, msg) {
+  let p;
+  try {
+    p = spawn("notify-send", ["--wait", "--action=default=Open", "-a", "SolonGate", title, msg], { stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return;
+  }
+  p.on("error", () => {
+  });
+  p.stdout?.on("data", (d) => {
+    if (String(d).trim() === "default") raiseLinuxWindow();
+  });
+  p.unref();
+}
+function raiseLinuxWindow() {
+  if (!focusToken) return;
+  try {
+    const x = spawn("xdotool", ["windowactivate", focusToken], { stdio: "ignore" });
+    x.on("error", () => {
+      try {
+        const hex = "0x" + Number(focusToken).toString(16);
+        const w = spawn("wmctrl", ["-ia", hex], { stdio: "ignore" });
+        w.on("error", () => {
+        });
+        w.unref();
+      } catch {
+      }
+    });
+    x.unref();
+  } catch {
+  }
+}
+function ensureWinScript() {
+  if (winScriptPath && existsSync4(winScriptPath)) return winScriptPath;
+  const p = join6(tmpdir2(), "solongate-toast.ps1");
+  const script = [
+    "param([string]$Title,[string]$Msg,[string]$Hwnd)",
+    "Add-Type -AssemblyName System.Windows.Forms",
+    "Add-Type -AssemblyName System.Drawing",
+    `Add-Type -Name Win -Namespace Sg -MemberDefinition '[DllImport("user32.dll")]public static extern bool SetForegroundWindow(System.IntPtr h);[DllImport("user32.dll")]public static extern bool ShowWindow(System.IntPtr h,int c);'`,
+    "$ni=New-Object System.Windows.Forms.NotifyIcon",
+    "$ni.Icon=[System.Drawing.SystemIcons]::Information",
+    "$ni.Visible=$true",
+    "$script:clicked=$false",
+    "$ni.add_BalloonTipClicked({$script:clicked=$true})",
+    "$ni.ShowBalloonTip(8000,$Title,$Msg,[System.Windows.Forms.ToolTipIcon]::Warning)",
+    "$sw=[System.Diagnostics.Stopwatch]::StartNew()",
+    "while($sw.Elapsed.TotalSeconds -lt 9 -and -not $script:clicked){[System.Windows.Forms.Application]::DoEvents();Start-Sleep -Milliseconds 100}",
+    "if($script:clicked -and $Hwnd){try{$h=[System.IntPtr][int64]$Hwnd;[Sg.Win]::ShowWindow($h,9)|Out-Null;[Sg.Win]::SetForegroundWindow($h)|Out-Null}catch{}}",
+    "$ni.Visible=$false;$ni.Dispose()"
+  ].join("\n");
+  try {
+    writeFileSync3(p, script);
+    winScriptPath = p;
+    return p;
+  } catch {
+    return null;
+  }
+}
+function winNotify(title, msg) {
+  const script = ensureWinScript();
+  if (!script) return;
+  try {
+    const p = spawn("powershell", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script, "-Title", title, "-Msg", msg, "-Hwnd", focusToken || ""], { stdio: "ignore", detached: true, windowsHide: true });
+    p.on("error", () => {
+    });
+    p.unref();
+  } catch {
+  }
+}
+function macBundleId() {
+  const prog = (process.env.TERM_PROGRAM || "").toLowerCase();
+  if (prog.includes("iterm")) return "com.googlecode.iterm2";
+  if (prog.includes("apple_terminal")) return "com.apple.Terminal";
+  if (prog.includes("vscode")) return "com.microsoft.VSCode";
+  return "com.apple.Terminal";
+}
+function macNotify(title, msg) {
+  try {
+    const p = spawn("terminal-notifier", ["-title", title, "-message", msg, "-activate", macBundleId(), "-sender", macBundleId()], { stdio: "ignore", detached: true });
+    p.on("error", () => {
+      try {
+        const esc = (s) => s.replace(/"/g, '\\"');
+        const a = spawn("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
+        a.on("error", () => {
+        });
+        a.unref();
+      } catch {
+      }
+    });
+    p.unref();
+  } catch {
+  }
+}
+var focusToken, winScriptPath;
+var init_notify = __esm({
+  "src/tui/notify.ts"() {
+    "use strict";
+    focusToken = null;
+    winScriptPath = null;
+  }
+});
+
 // src/tui/hooks.ts
 import { useCallback, useEffect, useRef, useState } from "react";
 function useLoader(fn, deps = []) {
@@ -7137,10 +7276,9 @@ var init_hooks = __esm({
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { spawn } from "child_process";
-import { closeSync, mkdirSync as mkdirSync3, openSync, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { closeSync, mkdirSync as mkdirSync3, openSync, readSync, statSync, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function tailLines(file, maxBytes = 131072) {
@@ -7271,7 +7409,7 @@ function LivePanel({ active: active2 }) {
   const [sel, setSel] = useState2(0);
   const [actionMsg, setActionMsg] = useState2(null);
   const notifiedRef = useRef2(/* @__PURE__ */ new Set());
-  const notifyReady = useRef2(false);
+  const openedAtRef = useRef2(Date.now());
   const activePolicyRef = useRef2(null);
   const [mode, setMode] = useState2("stream");
   const [pickIdx, setPickIdx] = useState2(0);
@@ -7455,13 +7593,7 @@ function LivePanel({ active: active2 }) {
         process.stdout.write("\x07");
       } catch {
       }
-      try {
-        const child = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
-        child.on("error", () => {
-        });
-        child.unref();
-      } catch {
-      }
+      desktopNotify(title, msg);
     },
     [pushLog]
   );
@@ -7479,14 +7611,10 @@ function LivePanel({ active: active2 }) {
   useEffect2(() => {
     if (!active2) return;
     const notable = mergedRef.current.filter((e) => e.decision !== "ALLOW" || e.dlp || e.burst);
-    if (!notifyReady.current) {
-      for (const e of notable) notifiedRef.current.add(e.id);
-      notifyReady.current = true;
-      return;
-    }
     for (const e of notable) {
       if (notifiedRef.current.has(e.id)) continue;
       notifiedRef.current.add(e.id);
+      if (!(e.at > openedAtRef.current)) continue;
       const who = e.agent ? ` \xB7 ${truncate2(e.agent, 20)}` : "";
       if (e.dlp) fireAlert("sec:" + e.id, "DLP hit", `SECRET in ${e.tool}${who}: ${truncate2(e.detail, 60)}`, "bad");
       else if (e.decision !== "ALLOW") fireAlert("sec:" + e.id, "Call denied", `DENY ${e.tool}${who}: ${truncate2(e.rule ?? e.detail, 60)}`, "bad");
@@ -7679,10 +7807,10 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join6(homedir4(), ".solongate", "live-export.jsonl");
+        const file = join7(homedir4(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync3(join6(homedir4(), ".solongate"), { recursive: true });
-          writeFileSync3(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          mkdirSync3(join7(homedir4(), ".solongate"), { recursive: true });
+          writeFileSync4(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
           setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
@@ -7942,14 +8070,15 @@ var init_Live = __esm({
     "use strict";
     init_api_client();
     init_config2();
+    init_notify();
     init_hooks();
     init_theme();
     CONFIG = loadConfig();
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
-    LOCAL_LOG = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
-    RING = join6(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    LOCAL_LOG = join7(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    RING = join7(process.cwd(), ".solongate", ".eval-ring.jsonl");
     hhmmss = (ts) => {
       const d = new Date(ts);
       return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -9165,6 +9294,7 @@ async function launchTui() {
     process.stderr.write("Not logged in. Run `solongate login` first.\n");
     return;
   }
+  captureFocusTarget();
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
     const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));
@@ -9178,6 +9308,7 @@ var init_tui = __esm({
     "use strict";
     init_App();
     init_client();
+    init_notify();
   }
 });
 
@@ -9869,9 +10000,9 @@ var init_agents2 = __esm({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -9901,7 +10032,7 @@ async function run6(argv) {
     } catch {
     }
   }
-  if (existsSync4(LOCAL_LOG2)) {
+  if (existsSync5(LOCAL_LOG2)) {
     const st = statSync2(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
@@ -9931,14 +10062,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join8(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync6, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -9982,7 +10113,7 @@ async function run7(argv) {
     for (const r of rows) if (keep(r)) print(r, json);
   };
   const pollLocal = () => {
-    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    if (cloudOnly || !existsSync6(LOCAL_LOG3)) return;
     const rows = [];
     for (const line of tailLocal(LOCAL_LOG3)) {
       try {
@@ -10045,7 +10176,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join9(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -10347,32 +10478,32 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
-import { resolve as resolve4, join as join9, dirname } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7, mkdirSync as mkdirSync4 } from "fs";
+import { resolve as resolve4, join as join10, dirname } from "path";
 import { homedir as homedir7 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 function lockFile(file) {
-  if (!existsSync6(file)) return;
+  if (!existsSync7(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+        execFileSync3("attrib", ["+R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+        execFileSync3("chflags", ["uchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+        execFileSync3("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
     }
@@ -10380,29 +10511,29 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync6(file)) return;
+  if (!existsSync7(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/reset"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+        execFileSync3("attrib", ["-R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+        execFileSync3("chflags", ["nouchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+        execFileSync3("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
     }
@@ -10412,10 +10543,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join9(p.hooksDir, "guard.mjs"),
-    join9(p.hooksDir, "audit.mjs"),
-    join9(p.hooksDir, "stop.mjs"),
-    join9(p.hooksDir, "shield.mjs"),
+    join10(p.hooksDir, "guard.mjs"),
+    join10(p.hooksDir, "audit.mjs"),
+    join10(p.hooksDir, "stop.mjs"),
+    join10(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -10428,25 +10559,25 @@ function unlockProtected() {
 }
 function globalPaths() {
   const home = homedir7();
-  const sgDir = join9(home, ".solongate");
-  const hooksDir = join9(sgDir, "hooks");
-  const claudeDir = join9(home, ".claude");
+  const sgDir = join10(home, ".solongate");
+  const hooksDir = join10(sgDir, "hooks");
+  const claudeDir = join10(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join9(claudeDir, "settings.json"),
-    backupPath: join9(claudeDir, "settings.solongate.bak"),
-    configPath: join9(sgDir, "cloud-guard.json")
+    settingsPath: join10(claudeDir, "settings.json"),
+    backupPath: join10(claudeDir, "settings.solongate.bak"),
+    configPath: join10(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync7(join9(HOOKS_DIR, filename), "utf-8");
+  return readFileSync7(join10(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join9(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync6(bundled) ? readFileSync7(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join10(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync7(bundled) ? readFileSync7(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -10459,14 +10590,14 @@ function runGlobalRestore() {
   const p = globalPaths();
   unlockProtected();
   removeClaudeShim();
-  if (existsSync6(p.backupPath)) {
-    writeFileSync4(p.settingsPath, readFileSync7(p.backupPath, "utf-8"));
+  if (existsSync7(p.backupPath)) {
+    writeFileSync5(p.settingsPath, readFileSync7(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync6(p.settingsPath)) {
+  } else if (existsSync7(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync7(p.settingsPath, "utf-8"));
       delete s.hooks;
-      writeFileSync4(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
     } catch {
     }
@@ -10481,7 +10612,7 @@ function escapeRe(s) {
 function resolveRealClaude() {
   try {
     const finder = process.platform === "win32" ? "where" : "which";
-    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    const out2 = execFileSync3(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
     if (process.platform === "win32") {
       const low = (s) => s.toLowerCase();
       return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
@@ -10494,24 +10625,24 @@ function resolveRealClaude() {
 function shimTargets() {
   if (process.platform === "win32") {
     try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      const prof = execFileSync3("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
       return prof ? [prof] : [];
     } catch {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join9(homedir7(), f)).filter((f) => existsSync6(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join10(homedir7(), f)).filter((f) => existsSync7(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync6(file) ? readFileSync7(file, "utf-8") : "";
+  let content = existsSync7(file) ? readFileSync7(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block2 + "\n";
   }
   mkdirSync4(dirname(file), { recursive: true });
-  writeFileSync4(file, content);
+  writeFileSync5(file, content);
 }
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
@@ -10565,19 +10696,19 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync4(p.hooksDir, { recursive: true });
   mkdirSync4(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync4(join9(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync4(join9(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync4(join9(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync4(join9(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync5(join10(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync5(join10(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync5(join10(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync5(join10(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join9(p.hooksDir, "shield.mjs"));
-  writeFileSync4(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  installClaudeShim(join10(p.hooksDir, "shield.mjs"));
+  writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync6(p.settingsPath)) {
+  if (existsSync7(p.settingsPath)) {
     const raw = readFileSync7(p.settingsPath, "utf-8");
-    if (!existsSync6(p.backupPath)) {
-      writeFileSync4(p.backupPath, raw);
+    if (!existsSync7(p.backupPath)) {
+      writeFileSync5(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
     try {
@@ -10586,9 +10717,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join9(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join9(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join9(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join10(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join10(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join10(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const call = process.platform === "win32" ? "& " : "";
   const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
@@ -10600,7 +10731,7 @@ async function runGlobalInstall(opts = {}) {
       Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
     }
   };
-  writeFileSync4(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
   console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   if (process.env["SOLONGATE_OS_LOCK"] === "1") {
     lockProtected();
@@ -10780,7 +10911,7 @@ import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
-import { readFileSync as readFileSync8, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync8, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
 import { homedir as homedir8 } from "os";
 function findCacheFile() {
@@ -10788,7 +10919,7 @@ function findCacheFile() {
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync7(f)) return f;
+    if (existsSync8(f)) return f;
   }
   let best = null, bestTs = -1;
   try {
@@ -10809,7 +10940,7 @@ function findCacheFile() {
 function loadCfg() {
   try {
     const f = findCacheFile();
-    if (f && existsSync7(f)) {
+    if (f && existsSync8(f)) {
       const c2 = JSON.parse(readFileSync8(f, "utf-8"));
       const d = c2?.security?.dlpRedact;
       const g = c2?.security?.ghost;
@@ -11099,7 +11230,7 @@ __export(logs_server_exports, {
 });
 import { createServer as createServer2 } from "http";
 import { readFileSync as readFileSync9, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join10, isAbsolute } from "path";
+import { resolve as resolve6, join as join11, isAbsolute } from "path";
 import { homedir as homedir9 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
@@ -11125,7 +11256,7 @@ async function findLogDir() {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync9(join10(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync9(join11(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -11134,7 +11265,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync9(join10(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync9(join11(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -11163,7 +11294,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join10(dir, LOG_FILENAME);
+  const file = join11(dir, LOG_FILENAME);
   try {
     const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -11276,7 +11407,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync5, existsSync as existsSync8, copyFileSync } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, existsSync as existsSync9, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -11334,7 +11465,7 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync8(resolve7("package.json"))) return false;
+  if (!existsSync9(resolve7("package.json"))) return false;
   try {
     const pkg = JSON.parse(readFileSync10(resolve7("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -11350,13 +11481,13 @@ function findTsEntryFile() {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
+        if (existsSync9(resolve7(srcPath))) return resolve7(srcPath);
+        if (existsSync9(resolve7(binPath))) return resolve7(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
+      if (existsSync9(resolve7(srcPath))) return resolve7(srcPath);
     }
   } catch {
   }
@@ -11370,7 +11501,7 @@ function findTsEntryFile() {
   ];
   for (const c2 of candidates) {
     const full = resolve7(c2);
-    if (existsSync8(full)) {
+    if (existsSync9(full)) {
       try {
         const content = readFileSync10(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
@@ -11381,13 +11512,13 @@ function findTsEntryFile() {
     }
   }
   for (const c2 of candidates) {
-    if (existsSync8(resolve7(c2))) return resolve7(c2);
+    if (existsSync9(resolve7(c2))) return resolve7(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
+  if (existsSync9(resolve7("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync9(resolve7("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
@@ -11530,7 +11661,7 @@ async function main2() {
   }
   log3("  Language: TypeScript");
   const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync8(entryFile)) {
+  if (!entryFile || !existsSync9(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -11543,7 +11674,7 @@ async function main2() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync8(backupPath)) {
+    if (!existsSync9(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -11579,12 +11710,12 @@ async function main2() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync8(backupPath)) {
+  if (!existsSync9(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
   }
-  writeFileSync5(entryFile, result.modified);
+  writeFileSync6(entryFile, result.modified);
   log3("");
   log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
   log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
@@ -11613,8 +11744,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join11 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync7, existsSync as existsSync10 } from "fs";
+import { resolve as resolve8, join as join12 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -11693,8 +11824,8 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync6(
-    join11(dir, "package.json"),
+  writeFileSync7(
+    join12(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -11723,8 +11854,8 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync6(
-    join11(dir, "tsconfig.json"),
+  writeFileSync7(
+    join12(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -11744,9 +11875,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync5(join11(dir, "src"), { recursive: true });
-  writeFileSync6(
-    join11(dir, "src", "index.ts"),
+  mkdirSync5(join12(dir, "src"), { recursive: true });
+  writeFileSync7(
+    join12(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -11787,8 +11918,8 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync6(
-    join11(dir, ".mcp.json"),
+  writeFileSync7(
+    join12(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -11805,13 +11936,13 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync6(
-    join11(dir, ".env"),
+  writeFileSync7(
+    join12(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync6(
-    join11(dir, ".gitignore"),
+  writeFileSync7(
+    join12(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -11825,7 +11956,7 @@ async function main3() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync9(dir)) {
+  if (existsSync10(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -11904,12 +12035,12 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync11 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
   const envPath = resolve9(".env");
-  if (!existsSync10(envPath)) return;
+  if (!existsSync11(envPath)) return;
   try {
     const content = readFileSync11(envPath, "utf-8");
     for (const line of content.split("\n")) {
@@ -12099,7 +12230,7 @@ async function pull(apiKey, file, policyId) {
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync7(file, json, "utf-8");
+  writeFileSync8(file, json, "utf-8");
   log5("");
   log5(green2("  Saved to: ") + file);
   log5(`  ${dim2("Name:")}    ${policy.name}`);
@@ -12111,7 +12242,7 @@ async function pull(apiKey, file, policyId) {
   log5("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync10(file)) {
+  if (!existsSync11(file)) {
     log5(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }

package/dist/tui/index.js

@@ -150,10 +150,9 @@ function KeyHints({ hints }) {
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { spawn } from "child_process";
-import { closeSync, mkdirSync, openSync, readSync, statSync, writeFileSync } from "fs";
+import { closeSync, mkdirSync, openSync, readSync, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 
 // src/api-client/client.ts
@@ -489,6 +488,139 @@ function list4() {
 // src/api-client/index.ts
 var api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports, keys: keys_exports, mcp: mcp_exports };
 
+// src/tui/notify.ts
+import { spawn, execFileSync } from "child_process";
+import { writeFileSync, existsSync as existsSync2 } from "fs";
+import { join as join3 } from "path";
+import { tmpdir } from "os";
+var focusToken = null;
+function captureFocusTarget() {
+  try {
+    if (process.platform === "linux") {
+      focusToken = (process.env.WINDOWID || "").trim() || null;
+      if (!focusToken) {
+        try {
+          focusToken = execFileSync("xdotool", ["getactivewindow"], { encoding: "utf-8", timeout: 1500, stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+        } catch {
+          focusToken = null;
+        }
+      }
+    } else if (process.platform === "win32") {
+      const ps = `Add-Type -Name W -Namespace N -MemberDefinition '[DllImport("user32.dll")]public static extern System.IntPtr GetForegroundWindow();' | Out-Null; [N.W]::GetForegroundWindow().ToInt64()`;
+      try {
+        focusToken = execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { encoding: "utf-8", timeout: 4e3, stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+      } catch {
+        focusToken = null;
+      }
+    }
+  } catch {
+    focusToken = null;
+  }
+}
+function desktopNotify(title, msg) {
+  try {
+    if (process.platform === "linux") linuxNotify(title, msg);
+    else if (process.platform === "win32") winNotify(title, msg);
+    else if (process.platform === "darwin") macNotify(title, msg);
+  } catch {
+  }
+}
+function linuxNotify(title, msg) {
+  let p;
+  try {
+    p = spawn("notify-send", ["--wait", "--action=default=Open", "-a", "SolonGate", title, msg], { stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return;
+  }
+  p.on("error", () => {
+  });
+  p.stdout?.on("data", (d) => {
+    if (String(d).trim() === "default") raiseLinuxWindow();
+  });
+  p.unref();
+}
+function raiseLinuxWindow() {
+  if (!focusToken) return;
+  try {
+    const x = spawn("xdotool", ["windowactivate", focusToken], { stdio: "ignore" });
+    x.on("error", () => {
+      try {
+        const hex = "0x" + Number(focusToken).toString(16);
+        const w = spawn("wmctrl", ["-ia", hex], { stdio: "ignore" });
+        w.on("error", () => {
+        });
+        w.unref();
+      } catch {
+      }
+    });
+    x.unref();
+  } catch {
+  }
+}
+var winScriptPath = null;
+function ensureWinScript() {
+  if (winScriptPath && existsSync2(winScriptPath)) return winScriptPath;
+  const p = join3(tmpdir(), "solongate-toast.ps1");
+  const script = [
+    "param([string]$Title,[string]$Msg,[string]$Hwnd)",
+    "Add-Type -AssemblyName System.Windows.Forms",
+    "Add-Type -AssemblyName System.Drawing",
+    `Add-Type -Name Win -Namespace Sg -MemberDefinition '[DllImport("user32.dll")]public static extern bool SetForegroundWindow(System.IntPtr h);[DllImport("user32.dll")]public static extern bool ShowWindow(System.IntPtr h,int c);'`,
+    "$ni=New-Object System.Windows.Forms.NotifyIcon",
+    "$ni.Icon=[System.Drawing.SystemIcons]::Information",
+    "$ni.Visible=$true",
+    "$script:clicked=$false",
+    "$ni.add_BalloonTipClicked({$script:clicked=$true})",
+    "$ni.ShowBalloonTip(8000,$Title,$Msg,[System.Windows.Forms.ToolTipIcon]::Warning)",
+    "$sw=[System.Diagnostics.Stopwatch]::StartNew()",
+    "while($sw.Elapsed.TotalSeconds -lt 9 -and -not $script:clicked){[System.Windows.Forms.Application]::DoEvents();Start-Sleep -Milliseconds 100}",
+    "if($script:clicked -and $Hwnd){try{$h=[System.IntPtr][int64]$Hwnd;[Sg.Win]::ShowWindow($h,9)|Out-Null;[Sg.Win]::SetForegroundWindow($h)|Out-Null}catch{}}",
+    "$ni.Visible=$false;$ni.Dispose()"
+  ].join("\n");
+  try {
+    writeFileSync(p, script);
+    winScriptPath = p;
+    return p;
+  } catch {
+    return null;
+  }
+}
+function winNotify(title, msg) {
+  const script = ensureWinScript();
+  if (!script) return;
+  try {
+    const p = spawn("powershell", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script, "-Title", title, "-Msg", msg, "-Hwnd", focusToken || ""], { stdio: "ignore", detached: true, windowsHide: true });
+    p.on("error", () => {
+    });
+    p.unref();
+  } catch {
+  }
+}
+function macBundleId() {
+  const prog = (process.env.TERM_PROGRAM || "").toLowerCase();
+  if (prog.includes("iterm")) return "com.googlecode.iterm2";
+  if (prog.includes("apple_terminal")) return "com.apple.Terminal";
+  if (prog.includes("vscode")) return "com.microsoft.VSCode";
+  return "com.apple.Terminal";
+}
+function macNotify(title, msg) {
+  try {
+    const p = spawn("terminal-notifier", ["-title", title, "-message", msg, "-activate", macBundleId(), "-sender", macBundleId()], { stdio: "ignore", detached: true });
+    p.on("error", () => {
+      try {
+        const esc = (s) => s.replace(/"/g, '\\"');
+        const a = spawn("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
+        a.on("error", () => {
+        });
+        a.unref();
+      } catch {
+      }
+    });
+    p.unref();
+  } catch {
+  }
+}
+
 // src/tui/hooks.ts
 import { useCallback, useEffect, useRef, useState } from "react";
 function useLoader(fn, deps = []) {
@@ -535,8 +667,8 @@ var CONFIG = loadConfig();
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var BG = "#12234f";
 var DIM_FLOOR = "#233457";
-var LOCAL_LOG = join3(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
-var RING = join3(process.cwd(), ".solongate", ".eval-ring.jsonl");
+var LOCAL_LOG = join4(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
+var RING = join4(process.cwd(), ".solongate", ".eval-ring.jsonl");
 var hhmmss = (ts) => {
   const d = new Date(ts);
   return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -681,7 +813,7 @@ function LivePanel({ active: active2 }) {
   const [sel, setSel] = useState2(0);
   const [actionMsg, setActionMsg] = useState2(null);
   const notifiedRef = useRef2(/* @__PURE__ */ new Set());
-  const notifyReady = useRef2(false);
+  const openedAtRef = useRef2(Date.now());
   const activePolicyRef = useRef2(null);
   const [mode, setMode] = useState2("stream");
   const [pickIdx, setPickIdx] = useState2(0);
@@ -865,13 +997,7 @@ function LivePanel({ active: active2 }) {
         process.stdout.write("\x07");
       } catch {
       }
-      try {
-        const child = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
-        child.on("error", () => {
-        });
-        child.unref();
-      } catch {
-      }
+      desktopNotify(title, msg);
     },
     [pushLog]
   );
@@ -889,14 +1015,10 @@ function LivePanel({ active: active2 }) {
   useEffect2(() => {
     if (!active2) return;
     const notable = mergedRef.current.filter((e) => e.decision !== "ALLOW" || e.dlp || e.burst);
-    if (!notifyReady.current) {
-      for (const e of notable) notifiedRef.current.add(e.id);
-      notifyReady.current = true;
-      return;
-    }
     for (const e of notable) {
       if (notifiedRef.current.has(e.id)) continue;
       notifiedRef.current.add(e.id);
+      if (!(e.at > openedAtRef.current)) continue;
       const who = e.agent ? ` \xB7 ${truncate(e.agent, 20)}` : "";
       if (e.dlp) fireAlert("sec:" + e.id, "DLP hit", `SECRET in ${e.tool}${who}: ${truncate(e.detail, 60)}`, "bad");
       else if (e.decision !== "ALLOW") fireAlert("sec:" + e.id, "Call denied", `DENY ${e.tool}${who}: ${truncate(e.rule ?? e.detail, 60)}`, "bad");
@@ -1089,10 +1211,10 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join3(homedir3(), ".solongate", "live-export.jsonl");
+        const file = join4(homedir3(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync(join3(homedir3(), ".solongate"), { recursive: true });
-          writeFileSync(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          mkdirSync(join4(homedir3(), ".solongate"), { recursive: true });
+          writeFileSync2(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err) {
           setActionMsg({ text: "\u2717 export failed: " + (err instanceof Error ? err.message : String(err)), level: "bad", until: Date.now() + 6e3 });
@@ -2461,6 +2583,7 @@ async function launchTui() {
     process.stderr.write("Not logged in. Run `solongate login` first.\n");
     return;
   }
+  captureFocusTarget();
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
     const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));

package/dist/tui/notify.d.ts

@@ -0,0 +1,4 @@
+/** Capture the current terminal window once, at TUI startup. Cheap + best-effort. */
+export declare function captureFocusTarget(): void;
+/** Fire a desktop toast; clicking it raises the dataroom terminal. */
+export declare function desktopNotify(title: string, msg: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.15",
+  "version": "0.81.17",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {