@solongate/proxy 0.81.23 → 0.81.24

package/dist/index.js

@@ -6844,6 +6844,45 @@ var init_components = __esm({
   }
 });
 
+// src/tui/local-log.ts
+import { closeSync, openSync, readSync, statSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
+function tailLines(file, maxBytes = 131072) {
+  try {
+    const size = statSync(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function parseLocalLines(lines) {
+  const out2 = [];
+  for (const line of lines) {
+    try {
+      const j = JSON.parse(line);
+      const at = Date.parse(j.ts ?? "");
+      if (Number.isFinite(at)) out2.push({ ...j, at });
+    } catch {
+    }
+  }
+  return out2;
+}
+var LOCAL_LOG;
+var init_local_log = __esm({
+  "src/tui/local-log.ts"() {
+    "use strict";
+    LOCAL_LOG = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+  }
+});
+
 // src/api-client/types.ts
 var init_types = __esm({
   "src/api-client/types.ts"() {
@@ -7222,26 +7261,11 @@ var init_hooks = __esm({
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { closeSync, mkdirSync as mkdirSync3, openSync, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
-function tailLines(file, maxBytes = 131072) {
-  try {
-    const size = statSync(file).size;
-    const start = Math.max(0, size - maxBytes);
-    const fd = openSync(file, "r");
-    const buf = Buffer.alloc(size - start);
-    readSync(fd, buf, 0, buf.length, start);
-    closeSync(fd);
-    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
-    if (start > 0) lines.shift();
-    return lines;
-  } catch {
-    return [];
-  }
-}
 function extractTarget(detail) {
   try {
     const j = JSON.parse(detail);
@@ -7785,9 +7809,9 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join6(homedir4(), ".solongate", "live-export.jsonl");
+        const file = join7(homedir5(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync3(join6(homedir4(), ".solongate"), { recursive: true });
+          mkdirSync3(join7(homedir5(), ".solongate"), { recursive: true });
           writeFileSync3(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
@@ -8103,10 +8127,11 @@ function LivePanel({ active: active2 }) {
     ] })
   ] });
 }
-var CONFIG, SPIN, BG, DIM_FLOOR, LOCAL_LOG, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
+var CONFIG, SPIN, BG, DIM_FLOOR, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
 var init_Live = __esm({
   "src/tui/panels/Live.tsx"() {
     "use strict";
+    init_local_log();
     init_api_client();
     init_config2();
     init_notify();
@@ -8116,8 +8141,7 @@ var init_Live = __esm({
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
-    LOCAL_LOG = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
-    RING = join6(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    RING = join7(process.cwd(), ".solongate", ".eval-ring.jsonl");
     hhmmss = (ts) => {
       const d = new Date(ts);
       return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -8200,7 +8224,6 @@ function PoliciesPanel({ focused }) {
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
   const [fi, setFi] = useState3(0);
-  const [vi, setVi] = useState3(0);
   const [rules, setRules] = useState3([]);
   const [mode, setMode] = useState3("denylist");
   const [dirty, setDirty] = useState3(false);
@@ -8209,15 +8232,6 @@ function PoliciesPanel({ focused }) {
   const [status, setStatus] = useState3(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
-  const versionsQ = useLoader(
-    () => view === "versions" && selected ? api.policies.versions(selected.id, { limit: 50 }) : Promise.resolve(null),
-    [view, selected?.id]
-  );
-  const diffVer = versionsQ.data?.versions[vi]?.version;
-  const diffQ = useLoader(
-    () => view === "versions" && selected && diffVer !== void 0 ? api.policies.get(selected.id, diffVer) : Promise.resolve(null),
-    [view, selected?.id, diffVer]
-  );
   useEffect3(() => {
     if (detail.data) {
       setRules(detail.data.rules);
@@ -8315,32 +8329,10 @@ function PoliciesPanel({ focused }) {
         } else if (input === "D") {
           setStatus("Dry-running\u2026");
           void api.policies.dryRun({ rules, mode }).then((res) => setStatus(`dry-run ${res.evaluated} calls \xB7 allow ${res.would_allow} / deny ${res.would_deny} \xB7 newly blocked ${res.newly_blocked} \xB7 newly allowed ${res.newly_allowed}`)).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
-        } else if (input === "v") {
-          setVi(0);
-          setView("versions");
         } else if (input === "s") void save();
         else if (input === "x") discard();
         return;
       }
-      if (view === "versions") {
-        const vers = versionsQ.data?.versions ?? [];
-        if (key.leftArrow) return void setView("rules");
-        if (key.upArrow) setVi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setVi((n) => Math.min(vers.length - 1, n + 1));
-        else if (key.return) {
-          const v = vers[vi];
-          if (v && selected) {
-            setStatus("Rolling back\u2026");
-            void api.policies.rollback(selected.id, v.version).then((r) => {
-              setStatus(`\u2713 rolled back to v${v.version} \u2192 new v${r.version}`);
-              detail.reload();
-              list6.reload();
-              setView("rules");
-            }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
-          }
-        }
-        return;
-      }
       const rule2 = rules[ri];
       if (!rule2) return setView("rules");
       const field = FIELDS[fi];
@@ -8381,8 +8373,7 @@ function PoliciesPanel({ focused }) {
           p.mode.padEnd(10),
           " ",
           p.rules.length,
-          " rules \xB7 v",
-          p.version
+          " rules"
         ] }),
         p.id === activeId ? /* @__PURE__ */ jsx3(Text3, { color: theme.ok, bold: true, children: "  \u25CF ACTIVE" }) : null
       ] }, p.id)) }),
@@ -8398,7 +8389,7 @@ function PoliciesPanel({ focused }) {
         /* @__PURE__ */ jsx3(Text3, { color: mode === "whitelist" ? theme.warn : void 0, children: mode }),
         dirtyTag
       ] }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 v versions \xB7 s save \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 s save \xB7 \u2190 back" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
         Table,
         {
@@ -8424,50 +8415,6 @@ function PoliciesPanel({ focused }) {
       status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
     ] }) });
   }
-  if (view === "versions") {
-    const vers = versionsQ.data?.versions ?? [];
-    return /* @__PURE__ */ jsx3(DataView, { loading: versionsQ.loading && !versionsQ.data, error: versionsQ.error, empty: !!versionsQ.data && vers.length === 0, emptyText: "No versions.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: truncate2(selected?.name ?? "", 28) }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 select \xB7 enter roll back to that version \xB7 \u2190 back" }),
-      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
-        Table,
-        {
-          columns: [
-            { header: "", width: 2 },
-            { header: "VER", width: 5 },
-            { header: "RULES", width: 5 },
-            { header: "REASON", width: 34 },
-            { header: "WHEN", width: 16 }
-          ],
-          rows: vers.map((v, i) => [
-            { value: i === vi ? "\u25B8" : "", color: theme.accentBright },
-            { value: `v${v.version}`, bold: i === vi },
-            { value: String(v.rules_count), dim: true },
-            { value: truncate2(v.reason || "\u2014", 34) },
-            { value: truncate2(v.created_at, 16), dim: true }
-          ])
-        }
-      ) }),
-      /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: `Diff v${diffVer ?? "?"} vs current draft` }),
-        (() => {
-          const old = diffQ.data?.rules ?? [];
-          const cur = rules;
-          const oldIds = new Set(old.map((r) => r.id));
-          const curIds = new Set(cur.map((r) => r.id));
-          const added = cur.filter((r) => !oldIds.has(r.id));
-          const removed = old.filter((r) => !curIds.has(r.id));
-          if (diffQ.loading && !diffQ.data) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  loading\u2026" });
-          if (!added.length && !removed.length) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  identical rule set" });
-          return /* @__PURE__ */ jsxs3(Fragment3, { children: [
-            added.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.ok, children: `  + ${r.effect} ${truncate2(r.toolPattern, 18)} ${truncate2(r.description || r.id, 30)}` }, "a" + r.id)),
-            removed.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.bad, children: `  - ${r.effect} ${truncate2(r.toolPattern, 18)} ${truncate2(r.description || r.id, 30)}` }, "r" + r.id))
-          ] });
-        })()
-      ] }),
-      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
-    ] }) });
-  }
   const rule = rules[ri];
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs3(Box3, { children: [
@@ -8880,177 +8827,202 @@ var init_Dlp = __esm({
   }
 });
 
-// src/tui/panels/Stats.tsx
-import { Box as Box6, Text as Text6 } from "ink";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
-function StatsPanel({ active: active2 }) {
-  const stats = useLoader(() => api.stats.get());
-  const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
-  const drift2 = useLoader(() => api.stats.drift(7));
-  usePoll(() => {
-    stats.reload();
-    ts.reload();
-  }, 5e3, active2);
-  usePoll(drift2.reload, 3e4, active2);
-  const s = stats.data;
-  const points = ts.data?.timeseries ?? [];
-  const driftRules = (drift2.data?.rules ?? []).slice(0, 5);
-  return /* @__PURE__ */ jsx6(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs6(Box6, { children: [
-      /* @__PURE__ */ jsxs6(Text6, { bold: true, children: [
-        s.total_calls,
-        " "
-      ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "calls    " }),
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
-        s.allowed,
-        " allowed"
-      ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "    " }),
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
-        s.denied,
-        " denied"
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-      s.active_policies,
-      " policies \xB7 ",
-      s.registered_tools,
-      " tools"
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-        "Last 24h ",
-        ts.data ? `(per ${ts.data.granularity})` : ""
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "total   " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: sparkline(points.map((p) => p.total), 64) })
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "allowed " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.ok, children: sparkline(points.map((p) => p.allowed), 64) })
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "denied  " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 64) })
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "Recent" }),
-      /* @__PURE__ */ jsx6(
-        Table,
-        {
-          columns: [
-            { header: "DECISION", width: 9 },
-            { header: "TOOL", width: 20 },
-            { header: "MS", width: 5 },
-            { header: "WHEN", width: 6 }
-          ],
-          rows: (s.recent_activity ?? []).slice(0, 6).map((a) => [
-            { value: a.decision, color: decisionColor(a.decision) },
-            { value: truncate2(a.tool_name, 20), color: theme.accent },
-            { value: String(a.evaluation_time_ms ?? "\u2014"), dim: true },
-            { value: ago(a.created_at), dim: true }
-          ])
-        }
-      )
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-        "Denial drift ",
-        drift2.data ? `(7d: ${drift2.data.total_current} now vs ${drift2.data.total_previous} prev)` : ""
-      ] }),
-      driftRules.length ? /* @__PURE__ */ jsx6(
-        Table,
-        {
-          columns: [
-            { header: "NOW", width: 5 },
-            { header: "PREV", width: 5 },
-            { header: "\u0394", width: 6 },
-            { header: "RULE", width: 22 },
-            { header: "REASON", width: 26 }
-          ],
-          rows: driftRules.map((r) => [
-            { value: String(r.current), bold: true },
-            { value: String(r.previous), dim: true },
-            { value: r.is_new ? "NEW" : r.spike ? `+${r.delta}` : String(r.delta), color: r.is_new ? theme.ok : r.spike ? theme.bad : void 0 },
-            { value: truncate2(r.rule_id ?? "\u2014", 22), color: theme.accent },
-            { value: truncate2(r.reason ?? r.last_tool ?? "\u2014", 26), dim: true }
-          ])
-        }
-      ) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  no denials in window" })
-    ] })
-  ] }) : null });
-}
-var init_Stats = __esm({
-  "src/tui/panels/Stats.tsx"() {
-    "use strict";
-    init_api_client();
-    init_components();
-    init_hooks();
-    init_theme();
-  }
-});
-
 // src/tui/panels/Audit.tsx
-import { Box as Box7, Text as Text7, useInput as useInput5 } from "ink";
+import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
 import TextInput4 from "ink-text-input";
 import { useState as useState6 } from "react";
-import { Fragment as Fragment4, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function loadLocalRows() {
+  return parseLocalLines(tailLines(LOCAL_LOG, LOCAL_MAX_BYTES)).map((j, i) => ({
+    id: "l:" + j.at + ":" + i,
+    at: j.at,
+    tool: j.tool ?? "?",
+    decision: j.decision ?? "ALLOW",
+    permission: j.permission ?? "\u2014",
+    trust: j.trust_level ?? "\u2014",
+    agent: j.agent_name ?? null,
+    session: j.session_id ?? null,
+    reason: j.reason ?? null,
+    rule: j.matched_rule_id ?? null,
+    evalMs: j.evaluation_time_ms ?? null,
+    dlp: j.dlp ? Array.isArray(j.dlp) ? j.dlp.map(String) : ["dlp"] : [],
+    burst: !!j.rate_limit_burst,
+    args: j.arguments ? JSON.stringify(j.arguments) : null
+  })).sort((a, b) => b.at - a.at);
+}
 function AuditPanel({ active: active2, focused }) {
   const { cols, rows } = usePanelSize();
+  const [source, setSource] = useState6("cloud");
+  const [view, setView] = useState6("logs");
   const [di, setDi] = useState6(0);
   const [gi, setGi] = useState6(0);
   const [tool, setTool] = useState6("");
   const [agent, setAgent] = useState6("");
   const [search, setSearch] = useState6("");
+  const [sessFilter, setSessFilter] = useState6("");
+  const [page, setPage] = useState6(0);
   const [sel, setSel] = useState6(0);
-  const [view, setView] = useState6("list");
   const [detailScroll, setDetailScroll] = useState6(0);
   const [editing, setEditing] = useState6(null);
+  const [si, setSi] = useState6(0);
+  const [sessSearch, setSessSearch] = useState6("");
+  const [sessSel, setSessSel] = useState6(0);
+  const toTop = () => setSel(0);
+  const statsQ = useLoader(() => source === "cloud" ? api.stats.get() : Promise.resolve(null), [source]);
+  const tsQ = useLoader(() => source === "cloud" ? api.stats.timeseries({ period: "24h" }) : Promise.resolve(null), [source]);
+  usePoll(() => {
+    statsQ.reload();
+    tsQ.reload();
+  }, 15e3, active2 && source === "cloud");
   const query = {
     filter: DECISIONS[di],
     signal: SIGNALS[gi],
     tool: tool || void 0,
     agent_name: agent || void 0,
     search: search || void 0,
-    limit: FETCH_LIMIT
+    session_id: sessFilter || void 0,
+    limit: PAGE,
+    offset: page * PAGE
   };
-  const auditQ = useLoader(() => api.audit.list(query), [di, gi, tool, agent, search]);
-  usePoll(auditQ.reload, 6e3, active2 && view === "list" && !editing);
-  const entries = auditQ.data?.entries ?? [];
-  const current = entries[Math.min(sel, Math.max(0, entries.length - 1))];
+  const cloudQ = useLoader(
+    () => source === "cloud" ? api.audit.list(query) : Promise.resolve(null),
+    [source, di, gi, tool, agent, search, sessFilter, page]
+  );
+  usePoll(cloudQ.reload, 6e3, active2 && source === "cloud" && view === "logs" && !editing && page === 0);
+  const localQ = useLoader(() => source === "local" ? Promise.resolve(loadLocalRows()) : Promise.resolve(null), [source]);
+  usePoll(localQ.reload, 6e3, active2 && source === "local" && view === "logs" && !editing && page === 0);
+  let pageRows = [];
+  let total = 0;
+  if (source === "cloud") {
+    pageRows = (cloudQ.data?.entries ?? []).map(cloudRow).sort((a, b) => b.at - a.at);
+    total = cloudQ.data?.total ?? 0;
+  } else {
+    const all = localQ.data ?? [];
+    const q = search.trim().toLowerCase();
+    const filtered = all.filter((r) => {
+      if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
+      if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
+      if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
+      if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
+      if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
+      if (sessFilter && r.session !== sessFilter) return false;
+      if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
+      return true;
+    });
+    total = filtered.length;
+    pageRows = filtered.slice(page * PAGE, page * PAGE + PAGE);
+  }
+  const pages = Math.max(1, Math.ceil(total / PAGE));
+  const current = pageRows[Math.min(sel, Math.max(0, pageRows.length - 1))];
+  const agentsQ = useLoader(
+    () => source === "cloud" ? api.agents.live({ limit: 100, includeDeactivated: true }) : Promise.resolve(null),
+    [source]
+  );
+  usePoll(agentsQ.reload, 8e3, active2 && source === "cloud" && view === "sessions");
+  let sessions = [];
+  if (source === "cloud") {
+    sessions = (agentsQ.data?.agents ?? []).map((a) => ({
+      id: a.session_id,
+      agent: a.agent_name ?? a.session_id,
+      status: a.status === "deactivated" ? "ended" : a.status,
+      calls: a.total_calls,
+      denies: a.denied_calls,
+      dlp: a.dlp_events,
+      trust: a.trust_score,
+      lastAt: Date.parse(a.last_seen_at)
+    }));
+  } else {
+    const bySess = /* @__PURE__ */ new Map();
+    for (const r of localQ.data ?? []) {
+      if (!r.session) continue;
+      const cur = bySess.get(r.session) ?? { id: r.session, agent: r.agent ?? "local agent", status: "ended", calls: 0, denies: 0, dlp: 0, trust: null, lastAt: 0 };
+      cur.calls++;
+      if (r.decision !== "ALLOW") cur.denies++;
+      if (r.dlp.length) cur.dlp++;
+      cur.lastAt = Math.max(cur.lastAt, r.at);
+      if (r.agent) cur.agent = r.agent;
+      bySess.set(r.session, cur);
+    }
+    sessions = [...bySess.values()];
+  }
+  const sq = sessSearch.trim().toLowerCase();
+  const sessionsFiltered = sessions.map((s) => ({ ...s, status: source === "cloud" ? s.status : sessStatus2(s.lastAt) })).filter((s) => SESS_STATUS[si] ? s.status === SESS_STATUS[si] : true).filter((s) => !sq || `${s.agent} ${s.id}`.toLowerCase().includes(sq)).sort((a, b) => b.lastAt - a.lastAt);
+  const currentSess = sessionsFiltered[Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1))];
   const sessionQ = useLoader(
-    () => view === "detail" && current?.session_id ? api.audit.list({ session_id: current.session_id, limit: 40 }) : Promise.resolve(null),
-    [view, current?.session_id]
+    () => view === "detail" && current?.session && source === "cloud" ? api.audit.list({ session_id: current.session, limit: 40 }) : Promise.resolve(null),
+    [view, current?.session, source]
   );
   useInput5(
     (input, key) => {
       if (view === "detail") {
-        if (key.leftArrow || key.escape) setView("list");
+        if (key.leftArrow || key.escape) setView("logs");
         else if (key.upArrow) setDetailScroll((n) => Math.max(0, n - 1));
         else if (key.downArrow) setDetailScroll((n) => n + 1);
         else if (key.pageUp) setDetailScroll((n) => Math.max(0, n - 10));
         else if (key.pageDown) setDetailScroll((n) => n + 10);
         return;
       }
-      const clearSel = () => setSel(0);
+      if (input === "s") {
+        setSource((s) => s === "cloud" ? "local" : "cloud");
+        setPage(0);
+        toTop();
+        setSessSel(0);
+        return;
+      }
+      if (input === "v") {
+        setView((v) => v === "logs" ? "sessions" : "logs");
+        return;
+      }
+      if (view === "sessions") {
+        if (key.upArrow) setSessSel((n) => Math.max(0, n - 1));
+        else if (key.downArrow) setSessSel((n) => Math.min(sessionsFiltered.length - 1, n + 1));
+        else if (key.pageUp) setSessSel((n) => Math.max(0, n - 10));
+        else if (key.pageDown) setSessSel((n) => Math.min(sessionsFiltered.length - 1, n + 10));
+        else if (key.return || key.rightArrow) {
+          if (currentSess) {
+            setSessFilter(currentSess.id);
+            setPage(0);
+            toTop();
+            setView("logs");
+          }
+        } else if (input === "f") {
+          setSi((n) => (n + 1) % SESS_STATUS.length);
+          setSessSel(0);
+        } else if (input === "/") setEditing("sess-search");
+        else if (input === "c") {
+          setSi(0);
+          setSessSearch("");
+          setSessSel(0);
+        }
+        return;
+      }
       if (key.upArrow) setSel((n) => Math.max(0, n - 1));
-      else if (key.downArrow) setSel((n) => Math.min(entries.length - 1, n + 1));
+      else if (key.downArrow) setSel((n) => Math.min(pageRows.length - 1, n + 1));
       else if (key.pageUp) setSel((n) => Math.max(0, n - 10));
-      else if (key.pageDown) setSel((n) => Math.min(entries.length - 1, n + 10));
+      else if (key.pageDown) setSel((n) => Math.min(pageRows.length - 1, n + 10));
       else if (key.return || key.rightArrow) {
         if (current) {
           setDetailScroll(0);
           setView("detail");
         }
+      } else if (input === "]") {
+        if (page < pages - 1) {
+          setPage(page + 1);
+          toTop();
+        }
+      } else if (input === "[") {
+        if (page > 0) {
+          setPage(page - 1);
+          toTop();
+        }
       } else if (input === "f") {
         setDi((n) => (n + 1) % DECISIONS.length);
-        clearSel();
+        setPage(0);
+        toTop();
       } else if (input === "g") {
         setGi((n) => (n + 1) % SIGNALS.length);
-        clearSel();
+        setPage(0);
+        toTop();
       } else if (input === "t") setEditing("tool");
       else if (input === "n") setEditing("agent");
       else if (input === "/") setEditing("search");
@@ -9060,46 +9032,89 @@ function AuditPanel({ active: active2, focused }) {
         setTool("");
         setAgent("");
         setSearch("");
-        clearSel();
+        setSessFilter("");
+        setPage(0);
+        toTop();
       }
     },
     { isActive: focused && !editing }
   );
+  const points = tsQ.data?.timeseries ?? [];
+  const localAll = localQ.data ?? [];
+  const strip = source === "cloud" ? /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx6(Text6, { bold: true, children: statsQ.data ? statsQ.data.total_calls : "\xB7\xB7\xB7\xB7" }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " calls \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
+      statsQ.data?.allowed ?? "\xB7\xB7\xB7",
+      " allow"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
+      statsQ.data?.denied ?? "\xB7\xB7",
+      " deny"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: ` \xB7 ${statsQ.data?.active_policies ?? "\xB7"} policies \xB7 ${statsQ.data?.registered_tools ?? "\xB7"} tools \xB7 24h ` }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: sparkline(points.map((p) => p.total), 24) }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " deny " }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 24) })
+  ] }) : /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx6(Text6, { bold: true, children: localAll.length }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " calls in local file \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
+      localAll.filter((r) => r.decision === "ALLOW").length,
+      " allow"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
+      localAll.filter((r) => r.decision !== "ALLOW").length,
+      " deny"
+    ] }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+      " \xB7 ",
+      LOCAL_LOG
+    ] })
+  ] });
+  const srcChip = /* @__PURE__ */ jsxs6(Text6, { children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "src:" }),
+    /* @__PURE__ */ jsx6(Text6, { color: source === "local" ? theme.ok : "#4f6db8", bold: true, children: source }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " (s) " })
+  ] });
   if (view === "detail" && current) {
-    const sessionCalls = sessionQ.data?.entries ?? [];
+    const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
     const bodyW = Math.max(20, cols - 2);
     const reasonLines = wrapLines("reason: " + (current.reason ?? "\u2014"), bodyW);
-    const argLines = current.arguments_summary ? wrapLines(prettyJson(JSON.stringify(current.arguments_summary)), bodyW) : ["(no arguments recorded)"];
-    const sessionRows = current.session_id ? Math.min(4, sessionCalls.length) + 2 : 1;
+    const argLines = current.args ? wrapLines(prettyJson(current.args), bodyW) : ["(no arguments recorded)"];
+    const sessionRows = current.session ? Math.min(4, sessionCalls.length) + 2 : 1;
     const reasonShown = reasonLines.slice(0, 4);
     const argBudget = Math.max(3, rows - 2 - 5 - reasonShown.length - 1 - sessionRows - 1);
     const maxScroll = Math.max(0, argLines.length - argBudget);
     const off = Math.min(detailScroll, maxScroll);
     const argWin = argLines.slice(off, off + argBudget);
-    return /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs7(Box7, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: decisionColor(current.decision), bold: true, children: current.decision }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: "  " + current.tool_name }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust_level })
+    return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(current.decision), bold: true, children: current.decision }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: "  " + current.tool }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust + "  " }),
+        srcChip
       ] }),
-      reasonShown.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "reason   " }),
-        /* @__PURE__ */ jsx7(Text7, { children: l.slice("reason: ".length) })
-      ] }) : /* @__PURE__ */ jsx7(Text7, { children: "         " + l }) }, "r" + i)),
-      /* @__PURE__ */ jsx7(Detail, { label: "rule", value: current.matched_rule_id ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "agent", value: current.agent_name ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "session", value: current.session_id ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "dlp", value: current.dlp_matches?.length ? current.dlp_matches.join(", ") : "none", color: current.dlp_matches?.length ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx7(Detail, { label: "when", value: new Date(current.created_at).toLocaleString() + (current.evaluation_time_ms != null ? ` \xB7 eval ${current.evaluation_time_ms}ms` : "") }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
-      /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: l || " " }, off + i)) }),
-      current.session_id ? /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      reasonShown.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs6(Fragment4, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "reason   " }),
+        /* @__PURE__ */ jsx6(Text6, { children: l.slice("reason: ".length) })
+      ] }) : /* @__PURE__ */ jsx6(Text6, { children: "         " + l }) }, "r" + i)),
+      /* @__PURE__ */ jsx6(Detail, { label: "rule", value: current.rule ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "agent", value: current.agent ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "session", value: current.session ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "dlp", value: current.dlp.length ? current.dlp.join(", ") : "none", color: current.dlp.length ? theme.bad : void 0 }),
+      /* @__PURE__ */ jsx6(Detail, { label: "when", value: new Date(current.at).toLocaleString() + (current.evalMs != null ? ` \xB7 eval ${current.evalMs}ms` : "") }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
+      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
+      current.session ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
           "Session \xB7 ",
           sessionCalls.length,
           " calls"
         ] }),
-        /* @__PURE__ */ jsx7(
+        /* @__PURE__ */ jsx6(
           Table,
           {
             columns: [
@@ -9110,59 +9125,136 @@ function AuditPanel({ active: active2, focused }) {
             ],
             rows: sessionCalls.slice(0, Math.max(1, sessionRows - 2)).map((e) => [
               { value: e.decision, color: decisionColor(e.decision) },
-              { value: truncate2(e.tool_name, 20), color: theme.accent },
+              { value: truncate2(e.tool, 20), color: theme.accent },
               { value: truncate2(e.reason ?? "\u2014", Math.max(16, cols - 48)) },
-              { value: ago(e.created_at), dim: true }
+              { value: ago(e.at), dim: true }
             ])
           }
         )
-      ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "(no session id)" }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to list" })
+      ] }) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "(no session id)" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to logs" })
     ] });
   }
-  const chip = (label, val, on) => /* @__PURE__ */ jsxs7(Text7, { children: [
-    /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+  const chip = (label, val, on) => /* @__PURE__ */ jsxs6(Text6, { children: [
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
       label,
       ":"
     ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: on ? theme.accentBright : theme.dim, children: val }),
-    /* @__PURE__ */ jsx7(Text7, { children: " " })
+    /* @__PURE__ */ jsx6(Text6, { color: on ? theme.accentBright : theme.dim, children: val }),
+    /* @__PURE__ */ jsx6(Text6, { children: " " })
   ] });
-  const headerRows = 4 + (editing ? 1 : 0);
+  if (view === "sessions") {
+    const headerRows2 = 5 + (editing ? 1 : 0);
+    const listRows2 = Math.max(4, rows - headerRows2);
+    const selC = Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1));
+    const start2 = Math.min(Math.max(0, selC - Math.floor((listRows2 - 1) / 2)), Math.max(0, sessionsFiltered.length - listRows2));
+    const win = sessionsFiltered.slice(start2, start2 + listRows2);
+    const loading2 = source === "cloud" ? agentsQ.loading && !agentsQ.data : localQ.loading && !localQ.data;
+    return /* @__PURE__ */ jsx6(DataView, { loading: loading2, error: source === "cloud" ? agentsQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      strip,
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        srcChip,
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, bold: true, children: "SESSIONS" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 logs (v) " }),
+        chip("status", SESS_STATUS[si] ?? "all", si !== 0),
+        chip("search", sessSearch || "\xB7", !!sessSearch)
+      ] }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 f status \xB7 / search \xB7 s source \xB7 v logs \xB7 c clear" : "press \u2192 to browse" }),
+      editing === "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "search: " }),
+        /* @__PURE__ */ jsx6(
+          TextInput4,
+          {
+            value: sessSearch,
+            onChange: (v) => {
+              setSessSearch(v);
+              setSessSel(0);
+            },
+            onSubmit: () => setEditing(null)
+          }
+        )
+      ] }) : null,
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${sessionsFiltered.length} sessions \xB7 ${selC + 1}/${sessionsFiltered.length}${start2 ? ` \xB7 \u25B2${start2}` : ""}${start2 + listRows2 < sessionsFiltered.length ? ` \xB7 \u25BC${sessionsFiltered.length - start2 - listRows2}` : ""}` }),
+      /* @__PURE__ */ jsx6(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "STATUS", width: 8 },
+            { header: "AGENT", width: 18 },
+            { header: "SESSION", width: 10 },
+            { header: "CALLS", width: 6 },
+            { header: "DENY", width: 5 },
+            { header: "DLP", width: 4 },
+            { header: "TRUST", width: 5 },
+            { header: "LAST", width: 6 }
+          ],
+          rows: win.map((r, i) => {
+            const st = STATUS_DOT[r.status];
+            const isSel = start2 + i === selC && focused;
+            return [
+              { value: isSel ? "\u25B8" : "", color: theme.accentBright },
+              { value: `${st.ch} ${r.status}`, color: st.color },
+              { value: truncate2(r.agent, 18), color: theme.accent, bold: isSel },
+              { value: r.id.slice(0, 8), dim: true },
+              { value: String(r.calls) },
+              { value: String(r.denies), color: r.denies ? theme.bad : void 0, dim: !r.denies },
+              { value: String(r.dlp), color: r.dlp ? theme.bad : void 0, dim: !r.dlp },
+              { value: r.trust != null ? String(r.trust) : "\u2014", dim: true },
+              { value: ago(r.lastAt), dim: true }
+            ];
+          })
+        }
+      ),
+      sessionsFiltered.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+        "(no sessions",
+        source === "local" ? " in the local file" : "",
+        ")"
+      ] }) : null
+    ] }) });
+  }
+  const headerRows = 6 + (editing && editing !== "sess-search" ? 1 : 0);
   const listRows = Math.max(4, rows - headerRows);
-  const selClamped = Math.min(sel, Math.max(0, entries.length - 1));
-  const maxStart = Math.max(0, entries.length - listRows);
+  const selClamped = Math.min(sel, Math.max(0, pageRows.length - 1));
+  const maxStart = Math.max(0, pageRows.length - listRows);
   const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
-  const windowed = entries.slice(start, start + listRows);
+  const windowed = pageRows.slice(start, start + listRows);
   const reasonW = Math.min(60, Math.max(12, cols - 67));
-  return /* @__PURE__ */ jsx7(DataView, { loading: auditQ.loading && !auditQ.data, error: auditQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs7(Box7, { children: [
+  const loading = source === "cloud" ? cloudQ.loading && !cloudQ.data : localQ.loading && !localQ.data;
+  return /* @__PURE__ */ jsx6(DataView, { loading, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+    strip,
+    /* @__PURE__ */ jsxs6(Box6, { children: [
+      srcChip,
+      /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, bold: true, children: "LOGS" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 sessions (v) " }),
       chip("dec", DECISIONS[di] ?? "all", di !== 0),
       chip("sig", SIGNALS[gi] ?? "all", gi !== 0),
       chip("tool", tool || "\xB7", !!tool),
       chip("agent", agent || "\xB7", !!agent),
-      chip("search", search || "\xB7", !!search)
+      chip("search", search || "\xB7", !!search),
+      sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
     ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 c clear" : "press \u2192 to browse" }),
-    editing ? /* @__PURE__ */ jsxs7(Box7, { children: [
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 [ ] page \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 s source \xB7 v sessions \xB7 c clear" : "press \u2192 to browse" }),
+    editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.warn, children: [
         editing,
         ": "
       ] }),
-      /* @__PURE__ */ jsx7(
+      /* @__PURE__ */ jsx6(
         TextInput4,
         {
           value: editing === "tool" ? tool : editing === "agent" ? agent : search,
           onChange: (v) => {
             (editing === "tool" ? setTool : editing === "agent" ? setAgent : setSearch)(v);
-            setSel(0);
+            setPage(0);
+            toTop();
           },
           onSubmit: () => setEditing(null)
         }
       )
     ] }) : null,
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${auditQ.data?.total ?? 0} matched \xB7 ${entries.length} loaded \xB7 ${selClamped + 1}/${entries.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < entries.length ? ` \xB7 \u25BC${entries.length - start - listRows} older` : ""}` }),
-    /* @__PURE__ */ jsx7(
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
+    /* @__PURE__ */ jsx6(
       Table,
       {
         columns: [
@@ -9176,51 +9268,81 @@ function AuditPanel({ active: active2, focused }) {
         ],
         rows: windowed.map((e, i) => rowFor(e, start + i === selClamped && focused, reasonW))
       }
-    )
+    ),
+    pageRows.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+      "(no entries",
+      source === "local" ? " in the local file" : "",
+      " \u2014 c clears filters)"
+    ] }) : null
   ] }) });
 }
 function rowFor(e, active2, reasonW) {
   return [
     { value: active2 ? "\u25B8" : "", color: theme.accentBright },
     { value: e.decision, color: decisionColor(e.decision) },
-    { value: truncate2(e.tool_name, 18), color: theme.accent },
-    { value: truncate2(e.agent_name ?? "\u2014", 14), dim: true },
-    { value: truncate2(e.reason ?? "\u2014", reasonW) },
-    { value: e.dlp_matches?.length ? String(e.dlp_matches.length) : "0", color: e.dlp_matches?.length ? theme.bad : void 0, dim: !e.dlp_matches?.length },
-    { value: ago(e.created_at), dim: true }
+    { value: truncate2(e.tool, 18), color: theme.accent },
+    { value: truncate2(e.agent ?? "\u2014", 14), dim: true },
+    { value: truncate2(e.reason ?? e.args ?? "\u2014", reasonW) },
+    { value: e.dlp.length ? String(e.dlp.length) : "0", color: e.dlp.length ? theme.bad : void 0, dim: !e.dlp.length },
+    { value: ago(e.at), dim: true }
   ];
 }
 function Detail({ label, value, color }) {
-  return /* @__PURE__ */ jsxs7(Box7, { children: [
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx7(Text7, { color, wrap: "truncate", children: value })
+  return /* @__PURE__ */ jsxs6(Box6, { children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx6(Text6, { color, wrap: "truncate", children: value })
   ] });
 }
-var DECISIONS, SIGNALS, FETCH_LIMIT;
+var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, cloudRow, sessStatus2, STATUS_DOT;
 var init_Audit = __esm({
   "src/tui/panels/Audit.tsx"() {
     "use strict";
     init_api_client();
     init_components();
     init_hooks();
+    init_local_log();
     init_theme();
     DECISIONS = [void 0, "DENY", "ALLOW"];
     SIGNALS = [void 0, "dlp", "ratelimit"];
-    FETCH_LIMIT = 500;
+    SESS_STATUS = [void 0, "active", "idle", "ended"];
+    PAGE = 500;
+    LOCAL_MAX_BYTES = 16 * 1024 * 1024;
+    cloudRow = (e) => ({
+      id: e.id,
+      at: Date.parse(e.created_at),
+      tool: e.tool_name,
+      decision: e.decision,
+      permission: e.permission,
+      trust: e.trust_level,
+      agent: e.agent_name,
+      session: e.session_id,
+      reason: e.reason,
+      rule: e.matched_rule_id,
+      evalMs: e.evaluation_time_ms,
+      dlp: e.dlp_matches ?? [],
+      burst: !!e.rate_limit_burst,
+      args: e.arguments_summary ? JSON.stringify(e.arguments_summary) : null
+    });
+    sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
+    STATUS_DOT = {
+      active: { ch: "\u25CF", color: theme.ok },
+      idle: { ch: "\u25D0", color: theme.warn },
+      ended: { ch: "\u25CB", color: theme.dim }
+    };
   }
 });
 
 // src/tui/panels/Agents.tsx
-import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
+import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import { useState as useState7 } from "react";
-import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { Fragment as Fragment5, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 function Bar({ label, value, max = 100, width: width2 = 16, color = theme.accent }) {
   const filled = max > 0 ? Math.round(Math.min(value, max) / max * width2) : 0;
-  return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx8(Text8, { color, children: "\u2588".repeat(filled) }),
-    /* @__PURE__ */ jsx8(Text8, { color: "#233457", children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " " + value })
+  return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx7(Text7, { color, children: "\u2588".repeat(filled) }),
+    /* @__PURE__ */ jsx7(Text7, { color: "#233457", children: "\u2591".repeat(Math.max(0, width2 - filled)) }),
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " " + value })
   ] });
 }
 function AgentsPanel({ focused }) {
@@ -9245,50 +9367,50 @@ function AgentsPanel({ focused }) {
   const tools = tmap?.tools ?? [];
   const resources = tmap?.resources ?? [];
   const listW = 30;
-  return /* @__PURE__ */ jsx8(DataView, { loading: live2.loading && !live2.data, error: live2.error, empty: !!live2.data && agents.length === 0, emptyText: "No identified agents yet.", children: /* @__PURE__ */ jsxs8(Box8, { children: [
-    /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: listW, marginRight: 2, overflow: "hidden", children: [
-      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 select agent" : "press \u2192 to browse" }),
-      agents.slice(0, 16).map((a, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", backgroundColor: focused && i === sel ? "#1c2f63" : void 0, bold: i === sel, children: [
-        /* @__PURE__ */ jsxs8(Text8, { color: statusColor(a.status), children: [
+  return /* @__PURE__ */ jsx7(DataView, { loading: live2.loading && !live2.data, error: live2.error, empty: !!live2.data && agents.length === 0, emptyText: "No identified agents yet.", children: /* @__PURE__ */ jsxs7(Box7, { children: [
+    /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", width: listW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: focused ? "\u2191\u2193 select agent" : "press \u2192 to browse" }),
+      agents.slice(0, 16).map((a, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", backgroundColor: focused && i === sel ? "#1c2f63" : void 0, bold: i === sel, children: [
+        /* @__PURE__ */ jsxs7(Text7, { color: statusColor(a.status), children: [
           a.status === "active" ? "\u25CF" : a.status === "idle" ? "\u25D0" : "\u25CB",
           " "
         ] }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(a.agent_name ?? a.agent_id ?? "?", 16).padEnd(17) }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `t${a.trust_score}` })
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate2(a.agent_name ?? a.agent_id ?? "?", 16).padEnd(17) }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `t${a.trust_score}` })
       ] }, a.session_id))
     ] }),
-    /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexGrow: 1, overflow: "hidden", children: !selected ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "select an agent" }) : detail.loading && !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "loading profile\u2026" }) : !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "no profile (agent has no calls yet)" }) : /* @__PURE__ */ jsxs8(Fragment5, { children: [
-      /* @__PURE__ */ jsxs8(Box8, { children: [
-        /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: truncate2(selected.agent_name ?? selected.agent_id ?? "?", 22) }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   trust ${base?.trustScore ?? "\u2014"}/100 \xB7 ${base?.character ?? ""}` })
+    /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", flexGrow: 1, overflow: "hidden", children: !selected ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "select an agent" }) : detail.loading && !d ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading profile\u2026" }) : !d ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "no profile (agent has no calls yet)" }) : /* @__PURE__ */ jsxs7(Fragment5, { children: [
+      /* @__PURE__ */ jsxs7(Box7, { children: [
+        /* @__PURE__ */ jsx7(Text7, { bold: true, color: theme.accentBright, children: truncate2(selected.agent_name ?? selected.agent_id ?? "?", 22) }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `   trust ${base?.trustScore ?? "\u2014"}/100 \xB7 ${base?.character ?? ""}` })
       ] }),
-      base?.characterBlurb ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate2(String(base.characterBlurb), 70) }) : null,
-      radar ? /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Behaviour radar (0\u2013100)" }),
-        /* @__PURE__ */ jsx8(Bar, { label: "read", value: Math.round((radar.read ?? 0) * 100) }),
-        /* @__PURE__ */ jsx8(Bar, { label: "write", value: Math.round((radar.write ?? 0) * 100), color: theme.warn }),
-        /* @__PURE__ */ jsx8(Bar, { label: "execute", value: Math.round((radar.execute ?? 0) * 100), color: theme.warn }),
-        /* @__PURE__ */ jsx8(Bar, { label: "network", value: Math.round((radar.network ?? 0) * 100) }),
-        /* @__PURE__ */ jsx8(Bar, { label: "complian.", value: Math.round((radar.compliance ?? 0) * 100), color: theme.ok })
+      base?.characterBlurb ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: truncate2(String(base.characterBlurb), 70) }) : null,
+      radar ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "Behaviour radar (0\u2013100)" }),
+        /* @__PURE__ */ jsx7(Bar, { label: "read", value: Math.round((radar.read ?? 0) * 100) }),
+        /* @__PURE__ */ jsx7(Bar, { label: "write", value: Math.round((radar.write ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx7(Bar, { label: "execute", value: Math.round((radar.execute ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx7(Bar, { label: "network", value: Math.round((radar.network ?? 0) * 100) }),
+        /* @__PURE__ */ jsx7(Bar, { label: "complian.", value: Math.round((radar.compliance ?? 0) * 100), color: theme.ok })
       ] }) : null,
-      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
           "Anomalies ",
           anomalies2.length ? `(${anomalies2.length})` : ""
         ] }),
-        anomalies2.length === 0 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  none" }) : anomalies2.slice(0, 4).map((an, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx8(Text8, { color: sevColor(String(an.severity)), children: `  ${String(an.severity).toUpperCase().slice(0, 4).padEnd(5)}` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: String(an.kind).padEnd(12) }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate2(String(an.description ?? ""), 44) })
+        anomalies2.length === 0 ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  none" }) : anomalies2.slice(0, 4).map((an, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx7(Text7, { color: sevColor(String(an.severity)), children: `  ${String(an.severity).toUpperCase().slice(0, 4).padEnd(5)}` }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: String(an.kind).padEnd(12) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: truncate2(String(an.description ?? ""), 44) })
         ] }, i))
       ] }),
-      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Trust map \xB7 top tools" }),
-        tools.slice(0, 4).map((t, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx8(Text8, { color: t.anomalous ? theme.bad : theme.accent, children: `  ${truncate2(String(t.name), 16).padEnd(17)}` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `${t.count}\xD7 ${t.permission ?? ""}` })
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "Trust map \xB7 top tools" }),
+        tools.slice(0, 4).map((t, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx7(Text7, { color: t.anomalous ? theme.bad : theme.accent, children: `  ${truncate2(String(t.name), 16).padEnd(17)}` }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `${t.count}\xD7 ${t.permission ?? ""}` })
         ] }, i)),
-        resources.slice(0, 3).map((r, i) => /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: r.anomalous ? theme.bad : theme.dim, children: `  ${r.type === "domain" ? "\u{1F310}" : "\u{1F4C1}"} ${truncate2(String(r.value), 40)} ${r.count}\xD7` }, "r" + i))
+        resources.slice(0, 3).map((r, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: r.anomalous ? theme.bad : theme.dim, children: `  ${r.type === "domain" ? "\u{1F310}" : "\u{1F4C1}"} ${truncate2(String(r.value), 40)} ${r.count}\xD7` }, "r" + i))
       ] })
     ] }) })
   ] }) });
@@ -9307,10 +9429,10 @@ var init_Agents = __esm({
 });
 
 // src/tui/panels/Settings.tsx
-import { Box as Box9, Text as Text9, useInput as useInput7 } from "ink";
+import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput5 from "ink-text-input";
 import { useState as useState8 } from "react";
-import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
 function alertBodyFor(channel) {
   const c2 = channel.trim();
   const base = { name: "dataroom alert", threshold: 5, windowSeconds: 60, signal: "any" };
@@ -9435,7 +9557,7 @@ function SettingsPanel({ active: active2, focused }) {
   const loading = localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data;
   const error = localQ.error ?? whQ.error ?? alertQ.error;
   const mark = (r) => keyOf(r) === keyOf(cur) && focused ? "\u25B8 " : "  ";
-  const onOff = (on) => on ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "off" });
+  const onOff = (on) => on ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "off" });
   const chanOf = (rule) => [...(rule.slackUrls ?? []).map((u) => "slack " + u), ...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
   const listBudget = Math.max(4, rows - 8);
   const start = Math.min(Math.max(0, selClamped - Math.floor(listBudget / 2)), Math.max(0, rowsAll.length - listBudget));
@@ -9443,68 +9565,68 @@ function SettingsPanel({ active: active2, focused }) {
     const i = rowsAll.findIndex((x) => keyOf(x) === keyOf(r));
     return i >= start && i < start + listBudget;
   };
-  return /* @__PURE__ */ jsx9(DataView, { loading, error, children: /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 enter/space toggle-edit-add \xB7 e events \xB7 d delete \xB7  r refresh" : "press \u2192 to configure" }),
-    editing ? /* @__PURE__ */ jsxs9(Box9, { children: [
-      /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: editing === "path" ? "local log path: " : editing === "wh-url" ? "webhook url: " : "channel (slack url / email / telegram id): " }),
-      /* @__PURE__ */ jsx9(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
-    ] }) : msg ? /* @__PURE__ */ jsx9(Text9, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, cols) }) : /* @__PURE__ */ jsx9(Text9, { children: " " }),
-    inWindow(rowsAll[0]) || inWindow(rowsAll[1]) ? /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+  return /* @__PURE__ */ jsx8(DataView, { loading, error, children: /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 enter/space toggle-edit-add \xB7 e events \xB7 d delete \xB7  r refresh" : "press \u2192 to configure" }),
+    editing ? /* @__PURE__ */ jsxs8(Box8, { children: [
+      /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: editing === "path" ? "local log path: " : editing === "wh-url" ? "webhook url: " : "channel (slack url / email / telegram id): " }),
+      /* @__PURE__ */ jsx8(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
+    ] }) : msg ? /* @__PURE__ */ jsx8(Text8, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, cols) }) : /* @__PURE__ */ jsx8(Text8, { children: " " }),
+    inWindow(rowsAll[0]) || inWindow(rowsAll[1]) ? /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "LOCAL LOGS ",
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "\u2014 hooks mirror every decision to a file on the agent machine" })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "\u2014 hooks mirror every decision to a file on the agent machine" })
       ] }),
-      /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "ll-enabled" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[0]) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "enabled ".padEnd(10) }),
+      /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "ll-enabled" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[0]) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "enabled ".padEnd(10) }),
         onOff(!!local?.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "   enter toggles" })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "   enter toggles" })
       ] }),
-      /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "ll-path" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[1]) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "path ".padEnd(10) }),
-        local?.path ? /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate2(local.path, cols - 14) }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "not set \u2014 enter to edit" })
+      /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "ll-path" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[1]) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "path ".padEnd(10) }),
+        local?.path ? /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(local.path, cols - 14) }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
       ] })
     ] }) : null,
-    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "WEBHOOKS ",
-        /* @__PURE__ */ jsxs9(Text9, { color: theme.dim, children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
           "\u2014 POST every matching event to your endpoint (",
           webhooks.length,
           ")"
         ] })
       ] }),
-      webhooks.filter((wh) => inWindow({ kind: "wh", wh })).map((wh) => /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "wh:" + wh.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh", wh }) }),
+      webhooks.filter((wh) => inWindow({ kind: "wh", wh })).map((wh) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "wh:" + wh.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh", wh }) }),
         onOff(wh.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: (" " + wh.events).padEnd(9) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate2(wh.url, cols - 16) })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: (" " + wh.events).padEnd(9) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(wh.url, cols - 16) })
       ] }, wh.id)),
-      inWindow(rowsAll.find((r) => r.kind === "wh-add")) ? /* @__PURE__ */ jsxs9(Text9, { children: [
-        /* @__PURE__ */ jsx9(Text9, { color: cur.kind === "wh-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh-add" }) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "+ add webhook (enter)" })
+      inWindow(rowsAll.find((r) => r.kind === "wh-add")) ? /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: cur.kind === "wh-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh-add" }) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add webhook (enter)" })
       ] }) : null
     ] }),
-    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "ALERTS ",
-        /* @__PURE__ */ jsxs9(Text9, { color: theme.dim, children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
           "\u2014 notify on a signal spike (",
           alerts.length,
           ")"
         ] })
       ] }),
-      alerts.filter((rule) => inWindow({ kind: "alert", rule })).map((rule) => /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "alert:" + rule.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert", rule }) }),
+      alerts.filter((rule) => inWindow({ kind: "alert", rule })).map((rule) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "alert:" + rule.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert", rule }) }),
         onOff(rule.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: (" " + rule.signal).padEnd(11) }),
-        /* @__PURE__ */ jsx9(Text9, { children: `\u2265${rule.threshold}/${rule.windowSeconds}s ` }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate2(chanOf(rule), cols - 26) })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: (" " + rule.signal).padEnd(11) }),
+        /* @__PURE__ */ jsx8(Text8, { children: `\u2265${rule.threshold}/${rule.windowSeconds}s ` }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(chanOf(rule), cols - 26) })
       ] }, rule.id)),
-      inWindow(rowsAll[rowsAll.length - 1]) ? /* @__PURE__ */ jsxs9(Text9, { children: [
-        /* @__PURE__ */ jsx9(Text9, { color: cur.kind === "alert-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add" }) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "+ add alert (enter \u2014 one channel: slack url, email or telegram chat id)" })
+      inWindow(rowsAll[rowsAll.length - 1]) ? /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: cur.kind === "alert-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add" }) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add alert (enter \u2014 one channel: slack url, email or telegram chat id)" })
       ] }) : null
     ] })
   ] }) });
@@ -9522,17 +9644,17 @@ var init_Settings = __esm({
 });
 
 // src/tui/App.tsx
-import { Box as Box10, Text as Text10, useApp, useInput as useInput8 } from "ink";
+import { Box as Box9, Text as Text9, useApp, useInput as useInput8 } from "ink";
 import { useState as useState9 } from "react";
-import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
 function LiveHint() {
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx10(Text10, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
-    /* @__PURE__ */ jsx10(Box10, { marginTop: 1, children: /* @__PURE__ */ jsxs10(Text10, { children: [
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, children: /* @__PURE__ */ jsxs9(Text9, { children: [
       "press ",
-      /* @__PURE__ */ jsx10(Text10, { color: theme.accent, children: "enter" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: "enter" }),
       " to go live"
     ] }) })
   ] });
@@ -9540,14 +9662,14 @@ function LiveHint() {
 function Banner({ cols }) {
   const wide = cols >= 82;
   if (!wide) {
-    return /* @__PURE__ */ jsxs10(Box10, { children: [
-      /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accentBright, children: "SolonGate" }),
-      /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: " \u2014 security control center" })
+    return /* @__PURE__ */ jsxs9(Box9, { children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " \u2014 security control center" })
     ] });
   }
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", children: [
-    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx10(Text10, { bold: true, color: BANNER_HEX[i], children: line }, i)),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx9(Text9, { bold: true, color: BANNER_HEX[i], children: line }, i)),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
   ] });
 }
 function App() {
@@ -9576,31 +9698,31 @@ function App() {
   });
   const { cols, rows } = useTermSize();
   const current = SECTIONS[section];
-  if (help) return /* @__PURE__ */ jsx10(HelpOverlay, { cols, rows });
+  if (help) return /* @__PURE__ */ jsx9(HelpOverlay, { cols, rows });
   if (current.label === "Live" && focus === "panel") {
-    return /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx10(LivePanel, { active: true, focused: true }) });
+    return /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx9(LivePanel, { active: true, focused: true }) });
   }
   const Panel = current.Panel;
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx10(Banner, { cols }),
-    /* @__PURE__ */ jsxs10(Box10, { marginTop: 1, flexGrow: 1, children: [
-      /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx10(Text10, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
-      /* @__PURE__ */ jsx10(Box10, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx10(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Banner, { cols }),
+    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
+      /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx9(Text9, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
+      /* @__PURE__ */ jsx9(Box9, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx9(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
     ] }),
-    /* @__PURE__ */ jsx10(Box10, { children: focus === "nav" ? /* @__PURE__ */ jsx10(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx10(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    /* @__PURE__ */ jsx9(Box9, { children: focus === "nav" ? /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
   ] });
 }
 function HelpOverlay({ cols, rows }) {
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
-    /* @__PURE__ */ jsx10(Box10, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", marginBottom: 1, children: [
-      /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accent, children: group }),
-      keys.map(([k, desc]) => /* @__PURE__ */ jsxs10(Text10, { children: [
-        /* @__PURE__ */ jsx10(Text10, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
-        /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: desc })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accent, children: group }),
+      keys.map(([k, desc]) => /* @__PURE__ */ jsxs9(Text9, { children: [
+        /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
+        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: desc })
       ] }, k))
     ] }, group)) }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "press any key to close" })
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "press any key to close" })
   ] });
 }
 var SECTIONS, BANNER_HEX, HELP;
@@ -9614,7 +9736,6 @@ var init_App = __esm({
     init_Policies();
     init_RateLimit();
     init_Dlp();
-    init_Stats();
     init_Audit();
     init_Agents();
     init_Settings();
@@ -9625,7 +9746,6 @@ var init_App = __esm({
       { label: "Policies", Panel: PoliciesPanel },
       { label: "Rate Limit", Panel: RateLimitPanel },
       { label: "DLP", Panel: DlpPanel },
-      { label: "Stats", Panel: StatsPanel },
       { label: "Audit", Panel: AuditPanel },
       { label: "Settings", Panel: SettingsPanel }
     ];
@@ -9633,9 +9753,9 @@ var init_App = __esm({
     HELP = [
       ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],
       ["Live", [["\u2191\u2193", "select a stream row"], ["enter", "full entry content"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
-      ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["v", "versions / rollback"], ["s", "save"], ["x", "discard"]]],
+      ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["s", "save"], ["x", "discard"]]],
       ["Rate limit / DLP", [["\u2191\u2193", "field / pattern"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["space", "toggle pattern"], ["m", "mode"], ["a / d", "add / remove custom"], ["g", "ghost mode"], ["P", "self-protection"], ["s", "save"]]],
-      ["Audit", [["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry detail"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["c", "clear filters"]]],
+      ["Audit", [["v", "logs \u2194 sessions"], ["s", "source: cloud \u2194 local"], ["[ / ]", "prev / next page (500 each)"], ["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry / session logs"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["c", "clear filters"]]],
       ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]]
     ];
   }
@@ -9647,7 +9767,7 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { render } from "ink";
-import { jsx as jsx11 } from "react/jsx-runtime";
+import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stderr.write(
@@ -9661,7 +9781,7 @@ async function launchTui() {
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
-    const { waitUntilExit } = render(/* @__PURE__ */ jsx11(App, {}));
+    const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));
     await waitUntilExit();
   } finally {
     process.stdout.write("\x1B[?1049l");
@@ -10364,8 +10484,8 @@ var init_agents2 = __esm({
 
 // src/commands/doctor.ts
 import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -10425,14 +10545,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join9 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -10539,7 +10659,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join9(homedir7(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -10842,8 +10962,8 @@ __export(global_install_exports, {
   unlockProtected: () => unlockProtected
 });
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
-import { resolve as resolve4, join as join9, dirname } from "path";
-import { homedir as homedir7 } from "os";
+import { resolve as resolve4, join as join10, dirname } from "path";
+import { homedir as homedir8 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -10906,10 +11026,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join9(p.hooksDir, "guard.mjs"),
-    join9(p.hooksDir, "audit.mjs"),
-    join9(p.hooksDir, "stop.mjs"),
-    join9(p.hooksDir, "shield.mjs"),
+    join10(p.hooksDir, "guard.mjs"),
+    join10(p.hooksDir, "audit.mjs"),
+    join10(p.hooksDir, "stop.mjs"),
+    join10(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -10921,25 +11041,25 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir7();
-  const sgDir = join9(home, ".solongate");
-  const hooksDir = join9(sgDir, "hooks");
-  const claudeDir = join9(home, ".claude");
+  const home = homedir8();
+  const sgDir = join10(home, ".solongate");
+  const hooksDir = join10(sgDir, "hooks");
+  const claudeDir = join10(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join9(claudeDir, "settings.json"),
-    backupPath: join9(claudeDir, "settings.solongate.bak"),
-    configPath: join9(sgDir, "cloud-guard.json")
+    settingsPath: join10(claudeDir, "settings.json"),
+    backupPath: join10(claudeDir, "settings.solongate.bak"),
+    configPath: join10(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync7(join9(HOOKS_DIR, filename), "utf-8");
+  return readFileSync7(join10(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join9(HOOKS_DIR, "guard.bundled.mjs");
+  const bundled = join10(HOOKS_DIR, "guard.bundled.mjs");
   return existsSync6(bundled) ? readFileSync7(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
@@ -10994,7 +11114,7 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join9(homedir7(), f)).filter((f) => existsSync6(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join10(homedir8(), f)).filter((f) => existsSync6(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
@@ -11059,12 +11179,12 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync4(p.hooksDir, { recursive: true });
   mkdirSync4(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync4(join9(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync4(join9(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync4(join9(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync4(join9(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync4(join10(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync4(join10(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync4(join10(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync4(join10(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join9(p.hooksDir, "shield.mjs"));
+  installClaudeShim(join10(p.hooksDir, "shield.mjs"));
   writeFileSync4(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
@@ -11080,9 +11200,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join9(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join9(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join9(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join10(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join10(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join10(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const call = process.platform === "win32" ? "& " : "";
   const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
@@ -11276,9 +11396,9 @@ import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
 import { readFileSync as readFileSync8, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir8(), ".solongate");
+  const dir = resolve5(homedir9(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
@@ -11593,8 +11713,8 @@ __export(logs_server_exports, {
 });
 import { createServer as createServer2 } from "http";
 import { readFileSync as readFileSync9, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join10, isAbsolute } from "path";
-import { homedir as homedir9 } from "os";
+import { resolve as resolve6, join as join11, isAbsolute } from "path";
+import { homedir as homedir10 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -11611,15 +11731,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir9(), ".solongate", "local-logs");
+  return resolve6(homedir10(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir9(), ".solongate");
+  const base = resolve6(homedir10(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync9(join10(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync9(join11(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -11628,7 +11748,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync9(join10(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync9(join11(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -11657,7 +11777,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join10(dir, LOG_FILENAME);
+  const file = join11(dir, LOG_FILENAME);
   try {
     const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -12108,7 +12228,7 @@ var init_inject = __esm({
 // src/create.ts
 var create_exports = {};
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join11 } from "path";
+import { resolve as resolve8, join as join12 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -12188,7 +12308,7 @@ EXAMPLES
 }
 function createProject(dir, name, _policy) {
   writeFileSync6(
-    join11(dir, "package.json"),
+    join12(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -12218,7 +12338,7 @@ function createProject(dir, name, _policy) {
     ) + "\n"
   );
   writeFileSync6(
-    join11(dir, "tsconfig.json"),
+    join12(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -12238,9 +12358,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync5(join11(dir, "src"), { recursive: true });
+  mkdirSync5(join12(dir, "src"), { recursive: true });
   writeFileSync6(
-    join11(dir, "src", "index.ts"),
+    join12(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -12282,7 +12402,7 @@ console.log('Press Ctrl+C to stop.');
 `
   );
   writeFileSync6(
-    join11(dir, ".mcp.json"),
+    join12(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -12300,12 +12420,12 @@ console.log('Press Ctrl+C to stop.');
     ) + "\n"
   );
   writeFileSync6(
-    join11(dir, ".env"),
+    join12(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
   writeFileSync6(
-    join11(dir, ".gitignore"),
+    join12(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup