@solongate/proxy 0.81.23 → 0.81.24

package/dist/tui/index.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 import { render } from "ink";
 
 // src/tui/App.tsx
-import { Box as Box10, Text as Text10, useApp, useInput as useInput8 } from "ink";
+import { Box as Box9, Text as Text9, useApp, useInput as useInput8 } from "ink";
 import { useState as useState9 } from "react";
 
 // src/cli-utils.ts
@@ -169,15 +169,50 @@ function KeyHints({ hints }) {
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { closeSync, mkdirSync, openSync, readSync, statSync, writeFileSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { mkdirSync, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+
+// src/tui/local-log.ts
+import { closeSync, openSync, readSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
+function tailLines(file, maxBytes = 131072) {
+  try {
+    const size = statSync(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return [];
+  }
+}
+function parseLocalLines(lines) {
+  const out = [];
+  for (const line of lines) {
+    try {
+      const j = JSON.parse(line);
+      const at = Date.parse(j.ts ?? "");
+      if (Number.isFinite(at)) out.push({ ...j, at });
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/tui/panels/Live.tsx
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 
 // src/api-client/client.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { resolve, join as join3 } from "path";
+import { homedir as homedir3 } from "os";
 var DEFAULT_API_URL = "https://api.solongate.com";
 var ApiError = class extends Error {
   status;
@@ -197,7 +232,7 @@ var NotAuthenticatedError = class extends Error {
 };
 function loginCredentialFile() {
   try {
-    const p = join2(homedir2(), ".solongate", "cloud-guard.json");
+    const p = join3(homedir3(), ".solongate", "cloud-guard.json");
     if (!existsSync(p)) return {};
     const c2 = JSON.parse(readFileSync2(p, "utf-8"));
     return c2 && typeof c2 === "object" ? c2 : {};
@@ -614,8 +649,7 @@ var CONFIG = loadConfig();
 var SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var BG = "#12234f";
 var DIM_FLOOR = "#233457";
-var LOCAL_LOG = join3(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
-var RING = join3(process.cwd(), ".solongate", ".eval-ring.jsonl");
+var RING = join4(process.cwd(), ".solongate", ".eval-ring.jsonl");
 var hhmmss = (ts) => {
   const d = new Date(ts);
   return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
@@ -625,21 +659,6 @@ var fmtUp = (ms) => {
   const p = (n) => String(n).padStart(2, "0");
   return `${p(Math.floor(s / 3600))}:${p(Math.floor(s % 3600 / 60))}:${p(s % 60)}`;
 };
-function tailLines(file, maxBytes = 131072) {
-  try {
-    const size = statSync(file).size;
-    const start = Math.max(0, size - maxBytes);
-    const fd = openSync(file, "r");
-    const buf = Buffer.alloc(size - start);
-    readSync(fd, buf, 0, buf.length, start);
-    closeSync(fd);
-    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
-    if (start > 0) lines.shift();
-    return lines;
-  } catch {
-    return [];
-  }
-}
 function extractTarget(detail) {
   try {
     const j = JSON.parse(detail);
@@ -1229,9 +1248,9 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join3(homedir3(), ".solongate", "live-export.jsonl");
+        const file = join4(homedir4(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync(join3(homedir3(), ".solongate"), { recursive: true });
+          mkdirSync(join4(homedir4(), ".solongate"), { recursive: true });
           writeFileSync(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err) {
@@ -1593,7 +1612,6 @@ function PoliciesPanel({ focused }) {
   const [pi, setPi] = useState3(0);
   const [ri, setRi] = useState3(0);
   const [fi, setFi] = useState3(0);
-  const [vi, setVi] = useState3(0);
   const [rules, setRules] = useState3([]);
   const [mode, setMode] = useState3("denylist");
   const [dirty, setDirty] = useState3(false);
@@ -1602,15 +1620,6 @@ function PoliciesPanel({ focused }) {
   const [status, setStatus] = useState3(null);
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
   const detail = useLoader(() => selected ? api.policies.get(selected.id) : Promise.resolve(null), [selected?.id]);
-  const versionsQ = useLoader(
-    () => view === "versions" && selected ? api.policies.versions(selected.id, { limit: 50 }) : Promise.resolve(null),
-    [view, selected?.id]
-  );
-  const diffVer = versionsQ.data?.versions[vi]?.version;
-  const diffQ = useLoader(
-    () => view === "versions" && selected && diffVer !== void 0 ? api.policies.get(selected.id, diffVer) : Promise.resolve(null),
-    [view, selected?.id, diffVer]
-  );
   useEffect3(() => {
     if (detail.data) {
       setRules(detail.data.rules);
@@ -1708,32 +1717,10 @@ function PoliciesPanel({ focused }) {
         } else if (input === "D") {
           setStatus("Dry-running\u2026");
           void api.policies.dryRun({ rules, mode }).then((res) => setStatus(`dry-run ${res.evaluated} calls \xB7 allow ${res.would_allow} / deny ${res.would_deny} \xB7 newly blocked ${res.newly_blocked} \xB7 newly allowed ${res.newly_allowed}`)).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
-        } else if (input === "v") {
-          setVi(0);
-          setView("versions");
         } else if (input === "s") void save();
         else if (input === "x") discard();
         return;
       }
-      if (view === "versions") {
-        const vers = versionsQ.data?.versions ?? [];
-        if (key.leftArrow) return void setView("rules");
-        if (key.upArrow) setVi((n) => Math.max(0, n - 1));
-        else if (key.downArrow) setVi((n) => Math.min(vers.length - 1, n + 1));
-        else if (key.return) {
-          const v = vers[vi];
-          if (v && selected) {
-            setStatus("Rolling back\u2026");
-            void api.policies.rollback(selected.id, v.version).then((r) => {
-              setStatus(`\u2713 rolled back to v${v.version} \u2192 new v${r.version}`);
-              detail.reload();
-              list5.reload();
-              setView("rules");
-            }).catch((e) => setStatus("\u2717 " + (e instanceof Error ? e.message : String(e))));
-          }
-        }
-        return;
-      }
       const rule2 = rules[ri];
       if (!rule2) return setView("rules");
       const field = FIELDS[fi];
@@ -1774,8 +1761,7 @@ function PoliciesPanel({ focused }) {
           p.mode.padEnd(10),
           " ",
           p.rules.length,
-          " rules \xB7 v",
-          p.version
+          " rules"
         ] }),
         p.id === activeId ? /* @__PURE__ */ jsx3(Text3, { color: theme.ok, bold: true, children: "  \u25CF ACTIVE" }) : null
       ] }, p.id)) }),
@@ -1791,7 +1777,7 @@ function PoliciesPanel({ focused }) {
         /* @__PURE__ */ jsx3(Text3, { color: mode === "whitelist" ? theme.warn : void 0, children: mode }),
         dirtyTag
       ] }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 v versions \xB7 s save \xB7 \u2190 back" }),
+      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 \xB7 enter edit \xB7 space on/off \xB7 e effect \xB7 n new \xB7 d del \xB7 m mode \xB7 D dry-run \xB7 s save \xB7 \u2190 back" }),
       /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
         Table,
         {
@@ -1817,50 +1803,6 @@ function PoliciesPanel({ focused }) {
       status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
     ] }) });
   }
-  if (view === "versions") {
-    const vers = versionsQ.data?.versions ?? [];
-    return /* @__PURE__ */ jsx3(DataView, { loading: versionsQ.loading && !versionsQ.data, error: versionsQ.error, empty: !!versionsQ.data && vers.length === 0, emptyText: "No versions.", children: /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: truncate(selected?.name ?? "", 28) }),
-      /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "\u2191\u2193 select \xB7 enter roll back to that version \xB7 \u2190 back" }),
-      /* @__PURE__ */ jsx3(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx3(
-        Table,
-        {
-          columns: [
-            { header: "", width: 2 },
-            { header: "VER", width: 5 },
-            { header: "RULES", width: 5 },
-            { header: "REASON", width: 34 },
-            { header: "WHEN", width: 16 }
-          ],
-          rows: vers.map((v, i) => [
-            { value: i === vi ? "\u25B8" : "", color: theme.accentBright },
-            { value: `v${v.version}`, bold: i === vi },
-            { value: String(v.rules_count), dim: true },
-            { value: truncate(v.reason || "\u2014", 34) },
-            { value: truncate(v.created_at, 16), dim: true }
-          ])
-        }
-      ) }),
-      /* @__PURE__ */ jsxs3(Box3, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: `Diff v${diffVer ?? "?"} vs current draft` }),
-        (() => {
-          const old = diffQ.data?.rules ?? [];
-          const cur = rules;
-          const oldIds = new Set(old.map((r) => r.id));
-          const curIds = new Set(cur.map((r) => r.id));
-          const added = cur.filter((r) => !oldIds.has(r.id));
-          const removed = old.filter((r) => !curIds.has(r.id));
-          if (diffQ.loading && !diffQ.data) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  loading\u2026" });
-          if (!added.length && !removed.length) return /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "  identical rule set" });
-          return /* @__PURE__ */ jsxs3(Fragment3, { children: [
-            added.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.ok, children: `  + ${r.effect} ${truncate(r.toolPattern, 18)} ${truncate(r.description || r.id, 30)}` }, "a" + r.id)),
-            removed.slice(0, 4).map((r) => /* @__PURE__ */ jsx3(Text3, { wrap: "truncate", color: theme.bad, children: `  - ${r.effect} ${truncate(r.toolPattern, 18)} ${truncate(r.description || r.id, 30)}` }, "r" + r.id))
-          ] });
-        })()
-      ] }),
-      status ? /* @__PURE__ */ jsx3(Text3, { color: status.startsWith("\u2717") ? theme.bad : theme.ok, children: status }) : null
-    ] }) });
-  }
   const rule = rules[ri];
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
     /* @__PURE__ */ jsxs3(Box3, { children: [
@@ -2222,171 +2164,229 @@ function RegexTest({ re }) {
   ] });
 }
 
-// src/tui/panels/Stats.tsx
-import { Box as Box6, Text as Text6 } from "ink";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
-function StatsPanel({ active: active2 }) {
-  const stats = useLoader(() => api.stats.get());
-  const ts = useLoader(() => api.stats.timeseries({ period: "24h" }));
-  const drift2 = useLoader(() => api.stats.drift(7));
-  usePoll(() => {
-    stats.reload();
-    ts.reload();
-  }, 5e3, active2);
-  usePoll(drift2.reload, 3e4, active2);
-  const s = stats.data;
-  const points = ts.data?.timeseries ?? [];
-  const driftRules = (drift2.data?.rules ?? []).slice(0, 5);
-  return /* @__PURE__ */ jsx6(DataView, { loading: stats.loading && !s, error: stats.error, children: s ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs6(Box6, { children: [
-      /* @__PURE__ */ jsxs6(Text6, { bold: true, children: [
-        s.total_calls,
-        " "
-      ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "calls    " }),
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
-        s.allowed,
-        " allowed"
-      ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "    " }),
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
-        s.denied,
-        " denied"
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-      s.active_policies,
-      " policies \xB7 ",
-      s.registered_tools,
-      " tools"
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-        "Last 24h ",
-        ts.data ? `(per ${ts.data.granularity})` : ""
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "total   " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: sparkline(points.map((p) => p.total), 64) })
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "allowed " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.ok, children: sparkline(points.map((p) => p.allowed), 64) })
-      ] }),
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { children: "denied  " }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 64) })
-      ] })
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "Recent" }),
-      /* @__PURE__ */ jsx6(
-        Table,
-        {
-          columns: [
-            { header: "DECISION", width: 9 },
-            { header: "TOOL", width: 20 },
-            { header: "MS", width: 5 },
-            { header: "WHEN", width: 6 }
-          ],
-          rows: (s.recent_activity ?? []).slice(0, 6).map((a) => [
-            { value: a.decision, color: decisionColor(a.decision) },
-            { value: truncate(a.tool_name, 20), color: theme.accent },
-            { value: String(a.evaluation_time_ms ?? "\u2014"), dim: true },
-            { value: ago(a.created_at), dim: true }
-          ])
-        }
-      )
-    ] }),
-    /* @__PURE__ */ jsxs6(Box6, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-        "Denial drift ",
-        drift2.data ? `(7d: ${drift2.data.total_current} now vs ${drift2.data.total_previous} prev)` : ""
-      ] }),
-      driftRules.length ? /* @__PURE__ */ jsx6(
-        Table,
-        {
-          columns: [
-            { header: "NOW", width: 5 },
-            { header: "PREV", width: 5 },
-            { header: "\u0394", width: 6 },
-            { header: "RULE", width: 22 },
-            { header: "REASON", width: 26 }
-          ],
-          rows: driftRules.map((r) => [
-            { value: String(r.current), bold: true },
-            { value: String(r.previous), dim: true },
-            { value: r.is_new ? "NEW" : r.spike ? `+${r.delta}` : String(r.delta), color: r.is_new ? theme.ok : r.spike ? theme.bad : void 0 },
-            { value: truncate(r.rule_id ?? "\u2014", 22), color: theme.accent },
-            { value: truncate(r.reason ?? r.last_tool ?? "\u2014", 26), dim: true }
-          ])
-        }
-      ) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  no denials in window" })
-    ] })
-  ] }) : null });
-}
-
 // src/tui/panels/Audit.tsx
-import { Box as Box7, Text as Text7, useInput as useInput5 } from "ink";
+import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
 import TextInput4 from "ink-text-input";
 import { useState as useState6 } from "react";
-import { Fragment as Fragment4, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 var DECISIONS = [void 0, "DENY", "ALLOW"];
 var SIGNALS = [void 0, "dlp", "ratelimit"];
-var FETCH_LIMIT = 500;
+var SESS_STATUS = [void 0, "active", "idle", "ended"];
+var PAGE = 500;
+var LOCAL_MAX_BYTES = 16 * 1024 * 1024;
+var cloudRow = (e) => ({
+  id: e.id,
+  at: Date.parse(e.created_at),
+  tool: e.tool_name,
+  decision: e.decision,
+  permission: e.permission,
+  trust: e.trust_level,
+  agent: e.agent_name,
+  session: e.session_id,
+  reason: e.reason,
+  rule: e.matched_rule_id,
+  evalMs: e.evaluation_time_ms,
+  dlp: e.dlp_matches ?? [],
+  burst: !!e.rate_limit_burst,
+  args: e.arguments_summary ? JSON.stringify(e.arguments_summary) : null
+});
+function loadLocalRows() {
+  return parseLocalLines(tailLines(LOCAL_LOG, LOCAL_MAX_BYTES)).map((j, i) => ({
+    id: "l:" + j.at + ":" + i,
+    at: j.at,
+    tool: j.tool ?? "?",
+    decision: j.decision ?? "ALLOW",
+    permission: j.permission ?? "\u2014",
+    trust: j.trust_level ?? "\u2014",
+    agent: j.agent_name ?? null,
+    session: j.session_id ?? null,
+    reason: j.reason ?? null,
+    rule: j.matched_rule_id ?? null,
+    evalMs: j.evaluation_time_ms ?? null,
+    dlp: j.dlp ? Array.isArray(j.dlp) ? j.dlp.map(String) : ["dlp"] : [],
+    burst: !!j.rate_limit_burst,
+    args: j.arguments ? JSON.stringify(j.arguments) : null
+  })).sort((a, b) => b.at - a.at);
+}
+var sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
+var STATUS_DOT = {
+  active: { ch: "\u25CF", color: theme.ok },
+  idle: { ch: "\u25D0", color: theme.warn },
+  ended: { ch: "\u25CB", color: theme.dim }
+};
 function AuditPanel({ active: active2, focused }) {
   const { cols, rows } = usePanelSize();
+  const [source, setSource] = useState6("cloud");
+  const [view, setView] = useState6("logs");
   const [di, setDi] = useState6(0);
   const [gi, setGi] = useState6(0);
   const [tool, setTool] = useState6("");
   const [agent, setAgent] = useState6("");
   const [search, setSearch] = useState6("");
+  const [sessFilter, setSessFilter] = useState6("");
+  const [page, setPage] = useState6(0);
   const [sel, setSel] = useState6(0);
-  const [view, setView] = useState6("list");
   const [detailScroll, setDetailScroll] = useState6(0);
   const [editing, setEditing] = useState6(null);
+  const [si, setSi] = useState6(0);
+  const [sessSearch, setSessSearch] = useState6("");
+  const [sessSel, setSessSel] = useState6(0);
+  const toTop = () => setSel(0);
+  const statsQ = useLoader(() => source === "cloud" ? api.stats.get() : Promise.resolve(null), [source]);
+  const tsQ = useLoader(() => source === "cloud" ? api.stats.timeseries({ period: "24h" }) : Promise.resolve(null), [source]);
+  usePoll(() => {
+    statsQ.reload();
+    tsQ.reload();
+  }, 15e3, active2 && source === "cloud");
   const query = {
     filter: DECISIONS[di],
     signal: SIGNALS[gi],
     tool: tool || void 0,
     agent_name: agent || void 0,
     search: search || void 0,
-    limit: FETCH_LIMIT
+    session_id: sessFilter || void 0,
+    limit: PAGE,
+    offset: page * PAGE
   };
-  const auditQ = useLoader(() => api.audit.list(query), [di, gi, tool, agent, search]);
-  usePoll(auditQ.reload, 6e3, active2 && view === "list" && !editing);
-  const entries = auditQ.data?.entries ?? [];
-  const current = entries[Math.min(sel, Math.max(0, entries.length - 1))];
+  const cloudQ = useLoader(
+    () => source === "cloud" ? api.audit.list(query) : Promise.resolve(null),
+    [source, di, gi, tool, agent, search, sessFilter, page]
+  );
+  usePoll(cloudQ.reload, 6e3, active2 && source === "cloud" && view === "logs" && !editing && page === 0);
+  const localQ = useLoader(() => source === "local" ? Promise.resolve(loadLocalRows()) : Promise.resolve(null), [source]);
+  usePoll(localQ.reload, 6e3, active2 && source === "local" && view === "logs" && !editing && page === 0);
+  let pageRows = [];
+  let total = 0;
+  if (source === "cloud") {
+    pageRows = (cloudQ.data?.entries ?? []).map(cloudRow).sort((a, b) => b.at - a.at);
+    total = cloudQ.data?.total ?? 0;
+  } else {
+    const all = localQ.data ?? [];
+    const q = search.trim().toLowerCase();
+    const filtered = all.filter((r) => {
+      if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
+      if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
+      if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
+      if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
+      if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
+      if (sessFilter && r.session !== sessFilter) return false;
+      if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
+      return true;
+    });
+    total = filtered.length;
+    pageRows = filtered.slice(page * PAGE, page * PAGE + PAGE);
+  }
+  const pages = Math.max(1, Math.ceil(total / PAGE));
+  const current = pageRows[Math.min(sel, Math.max(0, pageRows.length - 1))];
+  const agentsQ = useLoader(
+    () => source === "cloud" ? api.agents.live({ limit: 100, includeDeactivated: true }) : Promise.resolve(null),
+    [source]
+  );
+  usePoll(agentsQ.reload, 8e3, active2 && source === "cloud" && view === "sessions");
+  let sessions = [];
+  if (source === "cloud") {
+    sessions = (agentsQ.data?.agents ?? []).map((a) => ({
+      id: a.session_id,
+      agent: a.agent_name ?? a.session_id,
+      status: a.status === "deactivated" ? "ended" : a.status,
+      calls: a.total_calls,
+      denies: a.denied_calls,
+      dlp: a.dlp_events,
+      trust: a.trust_score,
+      lastAt: Date.parse(a.last_seen_at)
+    }));
+  } else {
+    const bySess = /* @__PURE__ */ new Map();
+    for (const r of localQ.data ?? []) {
+      if (!r.session) continue;
+      const cur = bySess.get(r.session) ?? { id: r.session, agent: r.agent ?? "local agent", status: "ended", calls: 0, denies: 0, dlp: 0, trust: null, lastAt: 0 };
+      cur.calls++;
+      if (r.decision !== "ALLOW") cur.denies++;
+      if (r.dlp.length) cur.dlp++;
+      cur.lastAt = Math.max(cur.lastAt, r.at);
+      if (r.agent) cur.agent = r.agent;
+      bySess.set(r.session, cur);
+    }
+    sessions = [...bySess.values()];
+  }
+  const sq = sessSearch.trim().toLowerCase();
+  const sessionsFiltered = sessions.map((s) => ({ ...s, status: source === "cloud" ? s.status : sessStatus2(s.lastAt) })).filter((s) => SESS_STATUS[si] ? s.status === SESS_STATUS[si] : true).filter((s) => !sq || `${s.agent} ${s.id}`.toLowerCase().includes(sq)).sort((a, b) => b.lastAt - a.lastAt);
+  const currentSess = sessionsFiltered[Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1))];
   const sessionQ = useLoader(
-    () => view === "detail" && current?.session_id ? api.audit.list({ session_id: current.session_id, limit: 40 }) : Promise.resolve(null),
-    [view, current?.session_id]
+    () => view === "detail" && current?.session && source === "cloud" ? api.audit.list({ session_id: current.session, limit: 40 }) : Promise.resolve(null),
+    [view, current?.session, source]
   );
   useInput5(
     (input, key) => {
       if (view === "detail") {
-        if (key.leftArrow || key.escape) setView("list");
+        if (key.leftArrow || key.escape) setView("logs");
         else if (key.upArrow) setDetailScroll((n) => Math.max(0, n - 1));
         else if (key.downArrow) setDetailScroll((n) => n + 1);
         else if (key.pageUp) setDetailScroll((n) => Math.max(0, n - 10));
         else if (key.pageDown) setDetailScroll((n) => n + 10);
         return;
       }
-      const clearSel = () => setSel(0);
+      if (input === "s") {
+        setSource((s) => s === "cloud" ? "local" : "cloud");
+        setPage(0);
+        toTop();
+        setSessSel(0);
+        return;
+      }
+      if (input === "v") {
+        setView((v) => v === "logs" ? "sessions" : "logs");
+        return;
+      }
+      if (view === "sessions") {
+        if (key.upArrow) setSessSel((n) => Math.max(0, n - 1));
+        else if (key.downArrow) setSessSel((n) => Math.min(sessionsFiltered.length - 1, n + 1));
+        else if (key.pageUp) setSessSel((n) => Math.max(0, n - 10));
+        else if (key.pageDown) setSessSel((n) => Math.min(sessionsFiltered.length - 1, n + 10));
+        else if (key.return || key.rightArrow) {
+          if (currentSess) {
+            setSessFilter(currentSess.id);
+            setPage(0);
+            toTop();
+            setView("logs");
+          }
+        } else if (input === "f") {
+          setSi((n) => (n + 1) % SESS_STATUS.length);
+          setSessSel(0);
+        } else if (input === "/") setEditing("sess-search");
+        else if (input === "c") {
+          setSi(0);
+          setSessSearch("");
+          setSessSel(0);
+        }
+        return;
+      }
       if (key.upArrow) setSel((n) => Math.max(0, n - 1));
-      else if (key.downArrow) setSel((n) => Math.min(entries.length - 1, n + 1));
+      else if (key.downArrow) setSel((n) => Math.min(pageRows.length - 1, n + 1));
       else if (key.pageUp) setSel((n) => Math.max(0, n - 10));
-      else if (key.pageDown) setSel((n) => Math.min(entries.length - 1, n + 10));
+      else if (key.pageDown) setSel((n) => Math.min(pageRows.length - 1, n + 10));
       else if (key.return || key.rightArrow) {
         if (current) {
           setDetailScroll(0);
           setView("detail");
         }
+      } else if (input === "]") {
+        if (page < pages - 1) {
+          setPage(page + 1);
+          toTop();
+        }
+      } else if (input === "[") {
+        if (page > 0) {
+          setPage(page - 1);
+          toTop();
+        }
       } else if (input === "f") {
         setDi((n) => (n + 1) % DECISIONS.length);
-        clearSel();
+        setPage(0);
+        toTop();
       } else if (input === "g") {
         setGi((n) => (n + 1) % SIGNALS.length);
-        clearSel();
+        setPage(0);
+        toTop();
       } else if (input === "t") setEditing("tool");
       else if (input === "n") setEditing("agent");
       else if (input === "/") setEditing("search");
@@ -2396,46 +2396,89 @@ function AuditPanel({ active: active2, focused }) {
         setTool("");
         setAgent("");
         setSearch("");
-        clearSel();
+        setSessFilter("");
+        setPage(0);
+        toTop();
       }
     },
     { isActive: focused && !editing }
   );
+  const points = tsQ.data?.timeseries ?? [];
+  const localAll = localQ.data ?? [];
+  const strip = source === "cloud" ? /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx6(Text6, { bold: true, children: statsQ.data ? statsQ.data.total_calls : "\xB7\xB7\xB7\xB7" }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " calls \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
+      statsQ.data?.allowed ?? "\xB7\xB7\xB7",
+      " allow"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
+      statsQ.data?.denied ?? "\xB7\xB7",
+      " deny"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: ` \xB7 ${statsQ.data?.active_policies ?? "\xB7"} policies \xB7 ${statsQ.data?.registered_tools ?? "\xB7"} tools \xB7 24h ` }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: sparkline(points.map((p) => p.total), 24) }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " deny " }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: sparkline(points.map((p) => p.denied), 24) })
+  ] }) : /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx6(Text6, { bold: true, children: localAll.length }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " calls in local file \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.ok, children: [
+      localAll.filter((r) => r.decision === "ALLOW").length,
+      " allow"
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 " }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.bad, children: [
+      localAll.filter((r) => r.decision !== "ALLOW").length,
+      " deny"
+    ] }),
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+      " \xB7 ",
+      LOCAL_LOG
+    ] })
+  ] });
+  const srcChip = /* @__PURE__ */ jsxs6(Text6, { children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "src:" }),
+    /* @__PURE__ */ jsx6(Text6, { color: source === "local" ? theme.ok : "#4f6db8", bold: true, children: source }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " (s) " })
+  ] });
   if (view === "detail" && current) {
-    const sessionCalls = sessionQ.data?.entries ?? [];
+    const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
     const bodyW = Math.max(20, cols - 2);
     const reasonLines = wrapLines("reason: " + (current.reason ?? "\u2014"), bodyW);
-    const argLines = current.arguments_summary ? wrapLines(prettyJson(JSON.stringify(current.arguments_summary)), bodyW) : ["(no arguments recorded)"];
-    const sessionRows = current.session_id ? Math.min(4, sessionCalls.length) + 2 : 1;
+    const argLines = current.args ? wrapLines(prettyJson(current.args), bodyW) : ["(no arguments recorded)"];
+    const sessionRows = current.session ? Math.min(4, sessionCalls.length) + 2 : 1;
     const reasonShown = reasonLines.slice(0, 4);
     const argBudget = Math.max(3, rows - 2 - 5 - reasonShown.length - 1 - sessionRows - 1);
     const maxScroll = Math.max(0, argLines.length - argBudget);
     const off = Math.min(detailScroll, maxScroll);
     const argWin = argLines.slice(off, off + argBudget);
-    return /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs7(Box7, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: decisionColor(current.decision), bold: true, children: current.decision }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: "  " + current.tool_name }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust_level })
+    return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(current.decision), bold: true, children: current.decision }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: "  " + current.tool }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust + "  " }),
+        srcChip
       ] }),
-      reasonShown.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "reason   " }),
-        /* @__PURE__ */ jsx7(Text7, { children: l.slice("reason: ".length) })
-      ] }) : /* @__PURE__ */ jsx7(Text7, { children: "         " + l }) }, "r" + i)),
-      /* @__PURE__ */ jsx7(Detail, { label: "rule", value: current.matched_rule_id ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "agent", value: current.agent_name ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "session", value: current.session_id ?? "\u2014" }),
-      /* @__PURE__ */ jsx7(Detail, { label: "dlp", value: current.dlp_matches?.length ? current.dlp_matches.join(", ") : "none", color: current.dlp_matches?.length ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx7(Detail, { label: "when", value: new Date(current.created_at).toLocaleString() + (current.evaluation_time_ms != null ? ` \xB7 eval ${current.evaluation_time_ms}ms` : "") }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
-      /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: l || " " }, off + i)) }),
-      current.session_id ? /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      reasonShown.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs6(Fragment4, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "reason   " }),
+        /* @__PURE__ */ jsx6(Text6, { children: l.slice("reason: ".length) })
+      ] }) : /* @__PURE__ */ jsx6(Text6, { children: "         " + l }) }, "r" + i)),
+      /* @__PURE__ */ jsx6(Detail, { label: "rule", value: current.rule ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "agent", value: current.agent ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "session", value: current.session ?? "\u2014" }),
+      /* @__PURE__ */ jsx6(Detail, { label: "dlp", value: current.dlp.length ? current.dlp.join(", ") : "none", color: current.dlp.length ? theme.bad : void 0 }),
+      /* @__PURE__ */ jsx6(Detail, { label: "when", value: new Date(current.at).toLocaleString() + (current.evalMs != null ? ` \xB7 eval ${current.evalMs}ms` : "") }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
+      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
+      current.session ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
           "Session \xB7 ",
           sessionCalls.length,
           " calls"
         ] }),
-        /* @__PURE__ */ jsx7(
+        /* @__PURE__ */ jsx6(
           Table,
           {
             columns: [
@@ -2446,59 +2489,136 @@ function AuditPanel({ active: active2, focused }) {
             ],
             rows: sessionCalls.slice(0, Math.max(1, sessionRows - 2)).map((e) => [
               { value: e.decision, color: decisionColor(e.decision) },
-              { value: truncate(e.tool_name, 20), color: theme.accent },
+              { value: truncate(e.tool, 20), color: theme.accent },
               { value: truncate(e.reason ?? "\u2014", Math.max(16, cols - 48)) },
-              { value: ago(e.created_at), dim: true }
+              { value: ago(e.at), dim: true }
             ])
           }
         )
-      ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "(no session id)" }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to list" })
+      ] }) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "(no session id)" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to logs" })
     ] });
   }
-  const chip = (label, val, on) => /* @__PURE__ */ jsxs7(Text7, { children: [
-    /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+  const chip = (label, val, on) => /* @__PURE__ */ jsxs6(Text6, { children: [
+    /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
       label,
       ":"
     ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: on ? theme.accentBright : theme.dim, children: val }),
-    /* @__PURE__ */ jsx7(Text7, { children: " " })
+    /* @__PURE__ */ jsx6(Text6, { color: on ? theme.accentBright : theme.dim, children: val }),
+    /* @__PURE__ */ jsx6(Text6, { children: " " })
   ] });
-  const headerRows = 4 + (editing ? 1 : 0);
+  if (view === "sessions") {
+    const headerRows2 = 5 + (editing ? 1 : 0);
+    const listRows2 = Math.max(4, rows - headerRows2);
+    const selC = Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1));
+    const start2 = Math.min(Math.max(0, selC - Math.floor((listRows2 - 1) / 2)), Math.max(0, sessionsFiltered.length - listRows2));
+    const win = sessionsFiltered.slice(start2, start2 + listRows2);
+    const loading2 = source === "cloud" ? agentsQ.loading && !agentsQ.data : localQ.loading && !localQ.data;
+    return /* @__PURE__ */ jsx6(DataView, { loading: loading2, error: source === "cloud" ? agentsQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      strip,
+      /* @__PURE__ */ jsxs6(Box6, { children: [
+        srcChip,
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, bold: true, children: "SESSIONS" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 logs (v) " }),
+        chip("status", SESS_STATUS[si] ?? "all", si !== 0),
+        chip("search", sessSearch || "\xB7", !!sessSearch)
+      ] }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 f status \xB7 / search \xB7 s source \xB7 v logs \xB7 c clear" : "press \u2192 to browse" }),
+      editing === "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "search: " }),
+        /* @__PURE__ */ jsx6(
+          TextInput4,
+          {
+            value: sessSearch,
+            onChange: (v) => {
+              setSessSearch(v);
+              setSessSel(0);
+            },
+            onSubmit: () => setEditing(null)
+          }
+        )
+      ] }) : null,
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${sessionsFiltered.length} sessions \xB7 ${selC + 1}/${sessionsFiltered.length}${start2 ? ` \xB7 \u25B2${start2}` : ""}${start2 + listRows2 < sessionsFiltered.length ? ` \xB7 \u25BC${sessionsFiltered.length - start2 - listRows2}` : ""}` }),
+      /* @__PURE__ */ jsx6(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "STATUS", width: 8 },
+            { header: "AGENT", width: 18 },
+            { header: "SESSION", width: 10 },
+            { header: "CALLS", width: 6 },
+            { header: "DENY", width: 5 },
+            { header: "DLP", width: 4 },
+            { header: "TRUST", width: 5 },
+            { header: "LAST", width: 6 }
+          ],
+          rows: win.map((r, i) => {
+            const st = STATUS_DOT[r.status];
+            const isSel = start2 + i === selC && focused;
+            return [
+              { value: isSel ? "\u25B8" : "", color: theme.accentBright },
+              { value: `${st.ch} ${r.status}`, color: st.color },
+              { value: truncate(r.agent, 18), color: theme.accent, bold: isSel },
+              { value: r.id.slice(0, 8), dim: true },
+              { value: String(r.calls) },
+              { value: String(r.denies), color: r.denies ? theme.bad : void 0, dim: !r.denies },
+              { value: String(r.dlp), color: r.dlp ? theme.bad : void 0, dim: !r.dlp },
+              { value: r.trust != null ? String(r.trust) : "\u2014", dim: true },
+              { value: ago(r.lastAt), dim: true }
+            ];
+          })
+        }
+      ),
+      sessionsFiltered.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+        "(no sessions",
+        source === "local" ? " in the local file" : "",
+        ")"
+      ] }) : null
+    ] }) });
+  }
+  const headerRows = 6 + (editing && editing !== "sess-search" ? 1 : 0);
   const listRows = Math.max(4, rows - headerRows);
-  const selClamped = Math.min(sel, Math.max(0, entries.length - 1));
-  const maxStart = Math.max(0, entries.length - listRows);
+  const selClamped = Math.min(sel, Math.max(0, pageRows.length - 1));
+  const maxStart = Math.max(0, pageRows.length - listRows);
   const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
-  const windowed = entries.slice(start, start + listRows);
+  const windowed = pageRows.slice(start, start + listRows);
   const reasonW = Math.min(60, Math.max(12, cols - 67));
-  return /* @__PURE__ */ jsx7(DataView, { loading: auditQ.loading && !auditQ.data, error: auditQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs7(Box7, { children: [
+  const loading = source === "cloud" ? cloudQ.loading && !cloudQ.data : localQ.loading && !localQ.data;
+  return /* @__PURE__ */ jsx6(DataView, { loading, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+    strip,
+    /* @__PURE__ */ jsxs6(Box6, { children: [
+      srcChip,
+      /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, bold: true, children: "LOGS" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \xB7 sessions (v) " }),
       chip("dec", DECISIONS[di] ?? "all", di !== 0),
       chip("sig", SIGNALS[gi] ?? "all", gi !== 0),
       chip("tool", tool || "\xB7", !!tool),
       chip("agent", agent || "\xB7", !!agent),
-      chip("search", search || "\xB7", !!search)
+      chip("search", search || "\xB7", !!search),
+      sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
     ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 c clear" : "press \u2192 to browse" }),
-    editing ? /* @__PURE__ */ jsxs7(Box7, { children: [
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 [ ] page \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 s source \xB7 v sessions \xB7 c clear" : "press \u2192 to browse" }),
+    editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
+      /* @__PURE__ */ jsxs6(Text6, { color: theme.warn, children: [
         editing,
         ": "
       ] }),
-      /* @__PURE__ */ jsx7(
+      /* @__PURE__ */ jsx6(
         TextInput4,
         {
           value: editing === "tool" ? tool : editing === "agent" ? agent : search,
           onChange: (v) => {
             (editing === "tool" ? setTool : editing === "agent" ? setAgent : setSearch)(v);
-            setSel(0);
+            setPage(0);
+            toTop();
           },
           onSubmit: () => setEditing(null)
         }
       )
     ] }) : null,
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${auditQ.data?.total ?? 0} matched \xB7 ${entries.length} loaded \xB7 ${selClamped + 1}/${entries.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < entries.length ? ` \xB7 \u25BC${entries.length - start - listRows} older` : ""}` }),
-    /* @__PURE__ */ jsx7(
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
+    /* @__PURE__ */ jsx6(
       Table,
       {
         columns: [
@@ -2512,40 +2632,45 @@ function AuditPanel({ active: active2, focused }) {
         ],
         rows: windowed.map((e, i) => rowFor(e, start + i === selClamped && focused, reasonW))
       }
-    )
+    ),
+    pageRows.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
+      "(no entries",
+      source === "local" ? " in the local file" : "",
+      " \u2014 c clears filters)"
+    ] }) : null
   ] }) });
 }
 function rowFor(e, active2, reasonW) {
   return [
     { value: active2 ? "\u25B8" : "", color: theme.accentBright },
     { value: e.decision, color: decisionColor(e.decision) },
-    { value: truncate(e.tool_name, 18), color: theme.accent },
-    { value: truncate(e.agent_name ?? "\u2014", 14), dim: true },
-    { value: truncate(e.reason ?? "\u2014", reasonW) },
-    { value: e.dlp_matches?.length ? String(e.dlp_matches.length) : "0", color: e.dlp_matches?.length ? theme.bad : void 0, dim: !e.dlp_matches?.length },
-    { value: ago(e.created_at), dim: true }
+    { value: truncate(e.tool, 18), color: theme.accent },
+    { value: truncate(e.agent ?? "\u2014", 14), dim: true },
+    { value: truncate(e.reason ?? e.args ?? "\u2014", reasonW) },
+    { value: e.dlp.length ? String(e.dlp.length) : "0", color: e.dlp.length ? theme.bad : void 0, dim: !e.dlp.length },
+    { value: ago(e.at), dim: true }
   ];
 }
 function Detail({ label, value, color }) {
-  return /* @__PURE__ */ jsxs7(Box7, { children: [
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx7(Text7, { color, wrap: "truncate", children: value })
+  return /* @__PURE__ */ jsxs6(Box6, { children: [
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx6(Text6, { color, wrap: "truncate", children: value })
   ] });
 }
 
 // src/tui/panels/Agents.tsx
-import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
+import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import { useState as useState7 } from "react";
-import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { Fragment as Fragment5, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 var statusColor = (s) => s === "active" ? theme.ok : s === "idle" ? theme.warn : theme.dim;
 var sevColor = (s) => s === "high" ? theme.bad : s === "medium" ? theme.warn : theme.dim;
 function Bar({ label, value, max = 100, width = 16, color = theme.accent }) {
   const filled = max > 0 ? Math.round(Math.min(value, max) / max * width) : 0;
-  return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx8(Text8, { color, children: "\u2588".repeat(filled) }),
-    /* @__PURE__ */ jsx8(Text8, { color: "#233457", children: "\u2591".repeat(Math.max(0, width - filled)) }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " " + value })
+  return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(9) }),
+    /* @__PURE__ */ jsx7(Text7, { color, children: "\u2588".repeat(filled) }),
+    /* @__PURE__ */ jsx7(Text7, { color: "#233457", children: "\u2591".repeat(Math.max(0, width - filled)) }),
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " " + value })
   ] });
 }
 function AgentsPanel({ focused }) {
@@ -2570,60 +2695,60 @@ function AgentsPanel({ focused }) {
   const tools = tmap?.tools ?? [];
   const resources = tmap?.resources ?? [];
   const listW = 30;
-  return /* @__PURE__ */ jsx8(DataView, { loading: live2.loading && !live2.data, error: live2.error, empty: !!live2.data && agents.length === 0, emptyText: "No identified agents yet.", children: /* @__PURE__ */ jsxs8(Box8, { children: [
-    /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: listW, marginRight: 2, overflow: "hidden", children: [
-      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 select agent" : "press \u2192 to browse" }),
-      agents.slice(0, 16).map((a, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", backgroundColor: focused && i === sel ? "#1c2f63" : void 0, bold: i === sel, children: [
-        /* @__PURE__ */ jsxs8(Text8, { color: statusColor(a.status), children: [
+  return /* @__PURE__ */ jsx7(DataView, { loading: live2.loading && !live2.data, error: live2.error, empty: !!live2.data && agents.length === 0, emptyText: "No identified agents yet.", children: /* @__PURE__ */ jsxs7(Box7, { children: [
+    /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", width: listW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: focused ? "\u2191\u2193 select agent" : "press \u2192 to browse" }),
+      agents.slice(0, 16).map((a, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", backgroundColor: focused && i === sel ? "#1c2f63" : void 0, bold: i === sel, children: [
+        /* @__PURE__ */ jsxs7(Text7, { color: statusColor(a.status), children: [
           a.status === "active" ? "\u25CF" : a.status === "idle" ? "\u25D0" : "\u25CB",
           " "
         ] }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(a.agent_name ?? a.agent_id ?? "?", 16).padEnd(17) }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `t${a.trust_score}` })
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(a.agent_name ?? a.agent_id ?? "?", 16).padEnd(17) }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `t${a.trust_score}` })
       ] }, a.session_id))
     ] }),
-    /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", flexGrow: 1, overflow: "hidden", children: !selected ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "select an agent" }) : detail.loading && !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "loading profile\u2026" }) : !d ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "no profile (agent has no calls yet)" }) : /* @__PURE__ */ jsxs8(Fragment5, { children: [
-      /* @__PURE__ */ jsxs8(Box8, { children: [
-        /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: truncate(selected.agent_name ?? selected.agent_id ?? "?", 22) }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   trust ${base?.trustScore ?? "\u2014"}/100 \xB7 ${base?.character ?? ""}` })
+    /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", flexGrow: 1, overflow: "hidden", children: !selected ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "select an agent" }) : detail.loading && !d ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading profile\u2026" }) : !d ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "no profile (agent has no calls yet)" }) : /* @__PURE__ */ jsxs7(Fragment5, { children: [
+      /* @__PURE__ */ jsxs7(Box7, { children: [
+        /* @__PURE__ */ jsx7(Text7, { bold: true, color: theme.accentBright, children: truncate(selected.agent_name ?? selected.agent_id ?? "?", 22) }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `   trust ${base?.trustScore ?? "\u2014"}/100 \xB7 ${base?.character ?? ""}` })
       ] }),
-      base?.characterBlurb ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate(String(base.characterBlurb), 70) }) : null,
-      radar ? /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Behaviour radar (0\u2013100)" }),
-        /* @__PURE__ */ jsx8(Bar, { label: "read", value: Math.round((radar.read ?? 0) * 100) }),
-        /* @__PURE__ */ jsx8(Bar, { label: "write", value: Math.round((radar.write ?? 0) * 100), color: theme.warn }),
-        /* @__PURE__ */ jsx8(Bar, { label: "execute", value: Math.round((radar.execute ?? 0) * 100), color: theme.warn }),
-        /* @__PURE__ */ jsx8(Bar, { label: "network", value: Math.round((radar.network ?? 0) * 100) }),
-        /* @__PURE__ */ jsx8(Bar, { label: "complian.", value: Math.round((radar.compliance ?? 0) * 100), color: theme.ok })
+      base?.characterBlurb ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: truncate(String(base.characterBlurb), 70) }) : null,
+      radar ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "Behaviour radar (0\u2013100)" }),
+        /* @__PURE__ */ jsx7(Bar, { label: "read", value: Math.round((radar.read ?? 0) * 100) }),
+        /* @__PURE__ */ jsx7(Bar, { label: "write", value: Math.round((radar.write ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx7(Bar, { label: "execute", value: Math.round((radar.execute ?? 0) * 100), color: theme.warn }),
+        /* @__PURE__ */ jsx7(Bar, { label: "network", value: Math.round((radar.network ?? 0) * 100) }),
+        /* @__PURE__ */ jsx7(Bar, { label: "complian.", value: Math.round((radar.compliance ?? 0) * 100), color: theme.ok })
       ] }) : null,
-      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
           "Anomalies ",
           anomalies2.length ? `(${anomalies2.length})` : ""
         ] }),
-        anomalies2.length === 0 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  none" }) : anomalies2.slice(0, 4).map((an, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx8(Text8, { color: sevColor(String(an.severity)), children: `  ${String(an.severity).toUpperCase().slice(0, 4).padEnd(5)}` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: String(an.kind).padEnd(12) }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: truncate(String(an.description ?? ""), 44) })
+        anomalies2.length === 0 ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  none" }) : anomalies2.slice(0, 4).map((an, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx7(Text7, { color: sevColor(String(an.severity)), children: `  ${String(an.severity).toUpperCase().slice(0, 4).padEnd(5)}` }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: String(an.kind).padEnd(12) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: truncate(String(an.description ?? ""), 44) })
         ] }, i))
       ] }),
-      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Trust map \xB7 top tools" }),
-        tools.slice(0, 4).map((t, i) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx8(Text8, { color: t.anomalous ? theme.bad : theme.accent, children: `  ${truncate(String(t.name), 16).padEnd(17)}` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `${t.count}\xD7 ${t.permission ?? ""}` })
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "Trust map \xB7 top tools" }),
+        tools.slice(0, 4).map((t, i) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx7(Text7, { color: t.anomalous ? theme.bad : theme.accent, children: `  ${truncate(String(t.name), 16).padEnd(17)}` }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `${t.count}\xD7 ${t.permission ?? ""}` })
         ] }, i)),
-        resources.slice(0, 3).map((r, i) => /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: r.anomalous ? theme.bad : theme.dim, children: `  ${r.type === "domain" ? "\u{1F310}" : "\u{1F4C1}"} ${truncate(String(r.value), 40)} ${r.count}\xD7` }, "r" + i))
+        resources.slice(0, 3).map((r, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: r.anomalous ? theme.bad : theme.dim, children: `  ${r.type === "domain" ? "\u{1F310}" : "\u{1F4C1}"} ${truncate(String(r.value), 40)} ${r.count}\xD7` }, "r" + i))
       ] })
     ] }) })
   ] }) });
 }
 
 // src/tui/panels/Settings.tsx
-import { Box as Box9, Text as Text9, useInput as useInput7 } from "ink";
+import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput5 from "ink-text-input";
 import { useState as useState8 } from "react";
-import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
 var EVENTS = ["denials", "allowed", "all"];
 function alertBodyFor(channel) {
   const c2 = channel.trim();
@@ -2749,7 +2874,7 @@ function SettingsPanel({ active: active2, focused }) {
   const loading = localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data;
   const error = localQ.error ?? whQ.error ?? alertQ.error;
   const mark = (r) => keyOf(r) === keyOf(cur) && focused ? "\u25B8 " : "  ";
-  const onOff = (on) => on ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "off" });
+  const onOff = (on) => on ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "off" });
   const chanOf = (rule) => [...(rule.slackUrls ?? []).map((u) => "slack " + u), ...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
   const listBudget = Math.max(4, rows - 8);
   const start = Math.min(Math.max(0, selClamped - Math.floor(listBudget / 2)), Math.max(0, rowsAll.length - listBudget));
@@ -2757,83 +2882,83 @@ function SettingsPanel({ active: active2, focused }) {
     const i = rowsAll.findIndex((x) => keyOf(x) === keyOf(r));
     return i >= start && i < start + listBudget;
   };
-  return /* @__PURE__ */ jsx9(DataView, { loading, error, children: /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 enter/space toggle-edit-add \xB7 e events \xB7 d delete \xB7  r refresh" : "press \u2192 to configure" }),
-    editing ? /* @__PURE__ */ jsxs9(Box9, { children: [
-      /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: editing === "path" ? "local log path: " : editing === "wh-url" ? "webhook url: " : "channel (slack url / email / telegram id): " }),
-      /* @__PURE__ */ jsx9(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
-    ] }) : msg ? /* @__PURE__ */ jsx9(Text9, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : /* @__PURE__ */ jsx9(Text9, { children: " " }),
-    inWindow(rowsAll[0]) || inWindow(rowsAll[1]) ? /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+  return /* @__PURE__ */ jsx8(DataView, { loading, error, children: /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 enter/space toggle-edit-add \xB7 e events \xB7 d delete \xB7  r refresh" : "press \u2192 to configure" }),
+    editing ? /* @__PURE__ */ jsxs8(Box8, { children: [
+      /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: editing === "path" ? "local log path: " : editing === "wh-url" ? "webhook url: " : "channel (slack url / email / telegram id): " }),
+      /* @__PURE__ */ jsx8(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
+    ] }) : msg ? /* @__PURE__ */ jsx8(Text8, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : /* @__PURE__ */ jsx8(Text8, { children: " " }),
+    inWindow(rowsAll[0]) || inWindow(rowsAll[1]) ? /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "LOCAL LOGS ",
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "\u2014 hooks mirror every decision to a file on the agent machine" })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "\u2014 hooks mirror every decision to a file on the agent machine" })
       ] }),
-      /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "ll-enabled" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[0]) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "enabled ".padEnd(10) }),
+      /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "ll-enabled" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[0]) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "enabled ".padEnd(10) }),
         onOff(!!local?.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "   enter toggles" })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "   enter toggles" })
       ] }),
-      /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "ll-path" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[1]) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "path ".padEnd(10) }),
-        local?.path ? /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate(local.path, cols - 14) }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "not set \u2014 enter to edit" })
+      /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "ll-path" && focused ? theme.accentBright : theme.dim, children: mark(rowsAll[1]) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "path ".padEnd(10) }),
+        local?.path ? /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(local.path, cols - 14) }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
       ] })
     ] }) : null,
-    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "WEBHOOKS ",
-        /* @__PURE__ */ jsxs9(Text9, { color: theme.dim, children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
           "\u2014 POST every matching event to your endpoint (",
           webhooks.length,
           ")"
         ] })
       ] }),
-      webhooks.filter((wh) => inWindow({ kind: "wh", wh })).map((wh) => /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "wh:" + wh.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh", wh }) }),
+      webhooks.filter((wh) => inWindow({ kind: "wh", wh })).map((wh) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "wh:" + wh.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh", wh }) }),
         onOff(wh.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: (" " + wh.events).padEnd(9) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate(wh.url, cols - 16) })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: (" " + wh.events).padEnd(9) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(wh.url, cols - 16) })
       ] }, wh.id)),
-      inWindow(rowsAll.find((r) => r.kind === "wh-add")) ? /* @__PURE__ */ jsxs9(Text9, { children: [
-        /* @__PURE__ */ jsx9(Text9, { color: cur.kind === "wh-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh-add" }) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "+ add webhook (enter)" })
+      inWindow(rowsAll.find((r) => r.kind === "wh-add")) ? /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: cur.kind === "wh-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh-add" }) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add webhook (enter)" })
       ] }) : null
     ] }),
-    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs9(Text9, { bold: true, color: theme.accentBright, children: [
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs8(Text8, { bold: true, color: theme.accentBright, children: [
         "ALERTS ",
-        /* @__PURE__ */ jsxs9(Text9, { color: theme.dim, children: [
+        /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
           "\u2014 notify on a signal spike (",
           alerts.length,
           ")"
         ] })
       ] }),
-      alerts.filter((rule) => inWindow({ kind: "alert", rule })).map((rule) => /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx9(Text9, { color: keyOf(cur) === "alert:" + rule.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert", rule }) }),
+      alerts.filter((rule) => inWindow({ kind: "alert", rule })).map((rule) => /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: keyOf(cur) === "alert:" + rule.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert", rule }) }),
         onOff(rule.enabled),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: (" " + rule.signal).padEnd(11) }),
-        /* @__PURE__ */ jsx9(Text9, { children: `\u2265${rule.threshold}/${rule.windowSeconds}s ` }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: truncate(chanOf(rule), cols - 26) })
+        /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: (" " + rule.signal).padEnd(11) }),
+        /* @__PURE__ */ jsx8(Text8, { children: `\u2265${rule.threshold}/${rule.windowSeconds}s ` }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(chanOf(rule), cols - 26) })
       ] }, rule.id)),
-      inWindow(rowsAll[rowsAll.length - 1]) ? /* @__PURE__ */ jsxs9(Text9, { children: [
-        /* @__PURE__ */ jsx9(Text9, { color: cur.kind === "alert-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add" }) }),
-        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "+ add alert (enter \u2014 one channel: slack url, email or telegram chat id)" })
+      inWindow(rowsAll[rowsAll.length - 1]) ? /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: cur.kind === "alert-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add" }) }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add alert (enter \u2014 one channel: slack url, email or telegram chat id)" })
       ] }) : null
     ] })
   ] }) });
 }
 
 // src/tui/App.tsx
-import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
 function LiveHint() {
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx10(Text10, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
-    /* @__PURE__ */ jsx10(Box10, { marginTop: 1, children: /* @__PURE__ */ jsxs10(Text10, { children: [
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, children: /* @__PURE__ */ jsxs9(Text9, { children: [
       "press ",
-      /* @__PURE__ */ jsx10(Text10, { color: theme.accent, children: "enter" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: "enter" }),
       " to go live"
     ] }) })
   ] });
@@ -2844,7 +2969,6 @@ var SECTIONS = [
   { label: "Policies", Panel: PoliciesPanel },
   { label: "Rate Limit", Panel: RateLimitPanel },
   { label: "DLP", Panel: DlpPanel },
-  { label: "Stats", Panel: StatsPanel },
   { label: "Audit", Panel: AuditPanel },
   { label: "Settings", Panel: SettingsPanel }
 ];
@@ -2852,14 +2976,14 @@ var BANNER_HEX = ["#1432A0", "#2850BE", "#3C6ED7", "#5A8CE6", "#82AAF0", "#AAC8F
 function Banner({ cols }) {
   const wide = cols >= 82;
   if (!wide) {
-    return /* @__PURE__ */ jsxs10(Box10, { children: [
-      /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accentBright, children: "SolonGate" }),
-      /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: " \u2014 security control center" })
+    return /* @__PURE__ */ jsxs9(Box9, { children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " \u2014 security control center" })
     ] });
   }
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", children: [
-    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx10(Text10, { bold: true, color: BANNER_HEX[i], children: line }, i)),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx9(Text9, { bold: true, color: BANNER_HEX[i], children: line }, i)),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
   ] });
 }
 function App() {
@@ -2888,44 +3012,44 @@ function App() {
   });
   const { cols, rows } = useTermSize();
   const current = SECTIONS[section];
-  if (help) return /* @__PURE__ */ jsx10(HelpOverlay, { cols, rows });
+  if (help) return /* @__PURE__ */ jsx9(HelpOverlay, { cols, rows });
   if (current.label === "Live" && focus === "panel") {
-    return /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx10(LivePanel, { active: true, focused: true }) });
+    return /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx9(LivePanel, { active: true, focused: true }) });
   }
   const Panel = current.Panel;
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx10(Banner, { cols }),
-    /* @__PURE__ */ jsxs10(Box10, { marginTop: 1, flexGrow: 1, children: [
-      /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx10(Text10, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
-      /* @__PURE__ */ jsx10(Box10, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx10(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Banner, { cols }),
+    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
+      /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx9(Text9, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
+      /* @__PURE__ */ jsx9(Box9, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx9(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
     ] }),
-    /* @__PURE__ */ jsx10(Box10, { children: focus === "nav" ? /* @__PURE__ */ jsx10(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx10(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    /* @__PURE__ */ jsx9(Box9, { children: focus === "nav" ? /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
   ] });
 }
 var HELP = [
   ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],
   ["Live", [["\u2191\u2193", "select a stream row"], ["enter", "full entry content"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
-  ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["v", "versions / rollback"], ["s", "save"], ["x", "discard"]]],
+  ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["s", "save"], ["x", "discard"]]],
   ["Rate limit / DLP", [["\u2191\u2193", "field / pattern"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["space", "toggle pattern"], ["m", "mode"], ["a / d", "add / remove custom"], ["g", "ghost mode"], ["P", "self-protection"], ["s", "save"]]],
-  ["Audit", [["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry detail"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["c", "clear filters"]]],
+  ["Audit", [["v", "logs \u2194 sessions"], ["s", "source: cloud \u2194 local"], ["[ / ]", "prev / next page (500 each)"], ["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry / session logs"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["c", "clear filters"]]],
   ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]]
 ];
 function HelpOverlay({ cols, rows }) {
-  return /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
-    /* @__PURE__ */ jsx10(Box10, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", marginBottom: 1, children: [
-      /* @__PURE__ */ jsx10(Text10, { bold: true, color: theme.accent, children: group }),
-      keys.map(([k, desc]) => /* @__PURE__ */ jsxs10(Text10, { children: [
-        /* @__PURE__ */ jsx10(Text10, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
-        /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: desc })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accent, children: group }),
+      keys.map(([k, desc]) => /* @__PURE__ */ jsxs9(Text9, { children: [
+        /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
+        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: desc })
       ] }, k))
     ] }, group)) }),
-    /* @__PURE__ */ jsx10(Text10, { color: theme.dim, children: "press any key to close" })
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "press any key to close" })
   ] });
 }
 
 // src/tui/index.tsx
-import { jsx as jsx11 } from "react/jsx-runtime";
+import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stderr.write(
@@ -2939,7 +3063,7 @@ async function launchTui() {
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
-    const { waitUntilExit } = render(/* @__PURE__ */ jsx11(App, {}));
+    const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));
     await waitUntilExit();
   } finally {
     process.stdout.write("\x1B[?1049l");