@solongate/proxy 0.81.26 → 0.81.28

package/dist/index.js

@@ -8877,6 +8877,9 @@ var init_Dlp = __esm({
 // src/tui/panels/Audit.tsx
 import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
 import TextInput4 from "ink-text-input";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
 import { useState as useState6 } from "react";
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function loadLocalRows() {
@@ -8916,6 +8919,7 @@ function AuditPanel({ active: active2, focused }) {
   const [sessSel, setSessSel] = useState6(0);
   const [confirm, setConfirm] = useState6(null);
   const [msg, setMsg] = useState6(null);
+  const [showHelp, setShowHelp] = useState6(false);
   const toTop = () => setSel(0);
   const statsQ = useLoader(() => source === "cloud" ? api.stats.get() : Promise.resolve(null), [source]);
   const tsQ = useLoader(() => source === "cloud" ? api.stats.timeseries({ period: "24h" }) : Promise.resolve(null), [source]);
@@ -8940,26 +8944,25 @@ function AuditPanel({ active: active2, focused }) {
   usePoll(cloudQ.reloadQuiet, 6e3, active2 && source === "cloud" && view === "logs" && !editing && page === 0);
   const localQ = useLoader(() => source === "local" ? Promise.resolve(loadLocalRows()) : Promise.resolve(null), [source]);
   usePoll(localQ.reloadQuiet, 6e3, active2 && source === "local" && view === "logs" && !editing && page === 0);
+  const q = search.trim().toLowerCase();
+  const localFiltered = (localQ.data ?? []).filter((r) => {
+    if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
+    if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
+    if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
+    if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
+    if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
+    if (sessFilter && r.session !== sessFilter) return false;
+    if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
+    return true;
+  });
   let pageRows = [];
   let total = 0;
   if (source === "cloud") {
     pageRows = (cloudQ.data?.entries ?? []).map(cloudRow).sort((a, b) => b.at - a.at);
     total = cloudQ.data?.total ?? 0;
   } else {
-    const all = localQ.data ?? [];
-    const q = search.trim().toLowerCase();
-    const filtered = all.filter((r) => {
-      if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
-      if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
-      if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
-      if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
-      if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
-      if (sessFilter && r.session !== sessFilter) return false;
-      if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
-      return true;
-    });
-    total = filtered.length;
-    pageRows = filtered.slice(page * PAGE, page * PAGE + PAGE);
+    total = localFiltered.length;
+    pageRows = localFiltered.slice(page * PAGE, page * PAGE + PAGE);
   }
   const pages = Math.max(1, Math.ceil(total / PAGE));
   const current = pageRows[Math.min(sel, Math.max(0, pageRows.length - 1))];
@@ -9026,8 +9029,33 @@ function AuditPanel({ active: active2, focused }) {
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
+  const doExport = (kind) => {
+    setMsg({ text: "exporting\u2026", level: "ok" });
+    const run12 = async () => {
+      const dir = join8(homedir6(), ".solongate");
+      const file = join8(dir, `audit-export-${source}.jsonl`);
+      let rows2;
+      if (kind === "page") rows2 = pageRows;
+      else if (source === "cloud") {
+        const r = await api.audit.list({ ...query, limit: 1e4, offset: 0 });
+        rows2 = r.entries.map(cloudRow).sort((a, b) => b.at - a.at);
+      } else rows2 = localFiltered;
+      mkdirSync4(dir, { recursive: true });
+      writeFileSync5(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
+      return { n: rows2.length, file };
+    };
+    run12().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+  };
   useInput5(
     (input, key) => {
+      if (showHelp) {
+        setShowHelp(false);
+        return;
+      }
+      if (input === "?") {
+        setShowHelp(true);
+        return;
+      }
       if (view === "detail") {
         if (key.leftArrow || key.escape) setView("logs");
         else if (key.upArrow) setDetailScroll((n) => Math.max(0, n - 1));
@@ -9106,7 +9134,7 @@ function AuditPanel({ active: active2, focused }) {
         if (!current) return;
         if (confirm?.kind !== "one" || confirm.key !== current.id) {
           setConfirm({ kind: "one", key: current.id });
-          setMsg({ text: `delete ${current.decision} ${current.tool} (${ago(current.at)} ago)? press x again`, level: "bad" });
+          setMsg({ text: `x = delete ONLY the selected entry: ${current.decision} ${current.tool} (${ago(current.at)} ago) \u2014 press x again`, level: "bad" });
           return;
         }
         setConfirm(null);
@@ -9114,12 +9142,14 @@ function AuditPanel({ active: active2, focused }) {
       } else if (input === "X") {
         if (confirm?.kind !== "all") {
           setConfirm({ kind: "all", key: "all" });
-          setMsg({ text: `DELETE ALL ${source} logs (${total} entries)? press X again`, level: "bad" });
+          setMsg({ text: `\u26A0 X = delete ALL ${source} logs \u2014 every one of the ${total} matched entries! press X again`, level: "bad" });
           return;
         }
         setConfirm(null);
         doDelete("all");
-      } else if (input === "t") setEditing("tool");
+      } else if (input === "e") doExport("page");
+      else if (input === "E") doExport("all");
+      else if (input === "t") setEditing("tool");
       else if (input === "n") setEditing("agent");
       else if (input === "/") setEditing("search");
       else if (input === "c") {
@@ -9175,6 +9205,19 @@ function AuditPanel({ active: active2, focused }) {
     /* @__PURE__ */ jsx6(Text6, { color: source === "local" ? theme.ok : "#4f6db8", bold: true, children: source }),
     /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " (s) " })
   ] });
+  if (showHelp) {
+    return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx6(Text6, { bold: true, color: theme.accentBright, children: "AUDIT \u2014 all keys" }),
+      AUDIT_HELP.map(([group, keys]) => /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx6(Text6, { bold: true, color: theme.accent, children: group }),
+        keys.map(([k, desc]) => /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, children: ("  " + k).padEnd(20) }),
+          /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: desc })
+        ] }, k))
+      ] }, group)),
+      /* @__PURE__ */ jsx6(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "press any key to close" }) })
+    ] });
+  }
   if (view === "detail" && current) {
     const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
     const bodyW = Math.max(20, cols - 2);
@@ -9254,7 +9297,7 @@ function AuditPanel({ active: active2, focused }) {
         chip("status", SESS_STATUS[si] ?? "all", si !== 0),
         chip("search", sessSearch || "\xB7", !!sessSearch)
       ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 f status \xB7 / search \xB7 s source \xB7 v logs \xB7 c clear" : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 v logs \xB7 ? all keys" : "press \u2192 to browse" }),
       editing === "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
         /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "search: " }),
         /* @__PURE__ */ jsx6(
@@ -9328,7 +9371,7 @@ function AuditPanel({ active: active2, focused }) {
       chip("search", search || "\xB7", !!search),
       sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
     ] }),
-    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 x del \xB7 X del ALL \xB7 s source \xB7 v sessions \xB7 c clear" : "press \u2192 to browse" }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 v sessions \xB7 ? all keys" : "press \u2192 to browse" }),
     msg ? /* @__PURE__ */ jsx6(Text6, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, cols) }) : null,
     editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
       /* @__PURE__ */ jsxs6(Text6, { color: theme.warn, children: [
@@ -9388,7 +9431,7 @@ function Detail({ label, value, color }) {
     /* @__PURE__ */ jsx6(Text6, { color, wrap: "truncate", children: value })
   ] });
 }
-var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, cloudRow, sessStatus2, STATUS_DOT;
+var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
 var init_Audit = __esm({
   "src/tui/panels/Audit.tsx"() {
     "use strict";
@@ -9418,6 +9461,45 @@ var init_Audit = __esm({
       burst: !!e.rate_limit_burst,
       args: e.arguments_summary ? JSON.stringify(e.arguments_summary) : null
     });
+    AUDIT_HELP = [
+      [
+        "Logs",
+        [
+          ["\u2191\u2193 / PgUp PgDn", "select a row (window follows)"],
+          ["enter", "open the FULL entry (reason + arguments)"],
+          ["\u2190 \u2192", "previous / next page (500 per page, jumps to top)"],
+          ["f", "decision filter: all \u2192 DENY \u2192 ALLOW"],
+          ["g", "signal filter: all \u2192 dlp \u2192 ratelimit"],
+          ["t / n", "tool / agent filter (type, enter done)"],
+          ["/", "free-text search"],
+          ["x", "delete ONLY the selected entry (press x twice)"],
+          ["X", "delete ALL matched logs of the source (press X twice)"],
+          ["e", "export this page \u2192 ~/.solongate/audit-export-<src>.jsonl"],
+          ["E", "export ALL matched rows (cloud: up to 10k)"],
+          ["c", "clear every filter (incl. session)"]
+        ]
+      ],
+      [
+        "Sessions",
+        [
+          ["\u2191\u2193", "select a session"],
+          ["enter", "open that session's logs"],
+          ["f", "status filter: all \u2192 active \u2192 idle \u2192 ended"],
+          ["/", "search agent / session id"],
+          ["c", "clear session filters"]
+        ]
+      ],
+      [
+        "Anywhere in Audit",
+        [
+          ["v", "switch logs \u2194 sessions"],
+          ["s", "switch source cloud \u2194 local file"],
+          ["?", "this help \xB7 any key closes"],
+          ["esc", "back to the menu"]
+        ]
+      ],
+      ["Entry detail", [["\u2191\u2193 / PgUp PgDn", "scroll the arguments"], ["\u2190 / esc", "back to the list"]]]
+    ];
     sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
     STATUS_DOT = {
       active: { ch: "\u25CF", color: theme.ok },
@@ -10481,8 +10563,8 @@ var init_agents2 = __esm({
 
 // src/commands/doctor.ts
 import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join9 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -10542,14 +10624,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join9(homedir7(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join10 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -10656,7 +10738,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join9(homedir7(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join10(homedir8(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -10958,9 +11040,9 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
-import { resolve as resolve4, join as join10, dirname } from "path";
-import { homedir as homedir8 } from "os";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
+import { resolve as resolve4, join as join11, dirname } from "path";
+import { homedir as homedir9 } from "os";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
@@ -11023,10 +11105,10 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join10(p.hooksDir, "guard.mjs"),
-    join10(p.hooksDir, "audit.mjs"),
-    join10(p.hooksDir, "stop.mjs"),
-    join10(p.hooksDir, "shield.mjs"),
+    join11(p.hooksDir, "guard.mjs"),
+    join11(p.hooksDir, "audit.mjs"),
+    join11(p.hooksDir, "stop.mjs"),
+    join11(p.hooksDir, "shield.mjs"),
     p.configPath,
     p.settingsPath
   ];
@@ -11038,25 +11120,25 @@ function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
 function globalPaths() {
-  const home = homedir8();
-  const sgDir = join10(home, ".solongate");
-  const hooksDir = join10(sgDir, "hooks");
-  const claudeDir = join10(home, ".claude");
+  const home = homedir9();
+  const sgDir = join11(home, ".solongate");
+  const hooksDir = join11(sgDir, "hooks");
+  const claudeDir = join11(home, ".claude");
   return {
     home,
     sgDir,
     hooksDir,
     claudeDir,
-    settingsPath: join10(claudeDir, "settings.json"),
-    backupPath: join10(claudeDir, "settings.solongate.bak"),
-    configPath: join10(sgDir, "cloud-guard.json")
+    settingsPath: join11(claudeDir, "settings.json"),
+    backupPath: join11(claudeDir, "settings.solongate.bak"),
+    configPath: join11(sgDir, "cloud-guard.json")
   };
 }
 function readHook(filename) {
-  return readFileSync8(join10(HOOKS_DIR, filename), "utf-8");
+  return readFileSync8(join11(HOOKS_DIR, filename), "utf-8");
 }
 function readGuard() {
-  const bundled = join10(HOOKS_DIR, "guard.bundled.mjs");
+  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
   return existsSync6(bundled) ? readFileSync8(bundled, "utf-8") : readHook("guard.mjs");
 }
 function ask(question) {
@@ -11071,13 +11153,13 @@ function runGlobalRestore() {
   unlockProtected();
   removeClaudeShim();
   if (existsSync6(p.backupPath)) {
-    writeFileSync5(p.settingsPath, readFileSync8(p.backupPath, "utf-8"));
+    writeFileSync6(p.settingsPath, readFileSync8(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
   } else if (existsSync6(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync8(p.settingsPath, "utf-8"));
       delete s.hooks;
-      writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      writeFileSync6(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
     } catch {
     }
@@ -11111,7 +11193,7 @@ function shimTargets() {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join10(homedir8(), f)).filter((f) => existsSync6(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join11(homedir9(), f)).filter((f) => existsSync6(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
@@ -11121,8 +11203,8 @@ function writeShimBlock(file, block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block2 + "\n";
   }
-  mkdirSync4(dirname(file), { recursive: true });
-  writeFileSync5(file, content);
+  mkdirSync5(dirname(file), { recursive: true });
+  writeFileSync6(file, content);
 }
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
@@ -11173,22 +11255,22 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync4(p.hooksDir, { recursive: true });
-  mkdirSync4(p.claudeDir, { recursive: true });
+  mkdirSync5(p.hooksDir, { recursive: true });
+  mkdirSync5(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync5(join10(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync5(join10(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync5(join10(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync5(join10(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync6(join11(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync6(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync6(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync6(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join10(p.hooksDir, "shield.mjs"));
-  writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  installClaudeShim(join11(p.hooksDir, "shield.mjs"));
+  writeFileSync6(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
   if (existsSync6(p.settingsPath)) {
     const raw = readFileSync8(p.settingsPath, "utf-8");
     if (!existsSync6(p.backupPath)) {
-      writeFileSync5(p.backupPath, raw);
+      writeFileSync6(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
     try {
@@ -11197,9 +11279,9 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join10(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join10(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join10(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const guardAbs = join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join11(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join11(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
   const nodeBin = process.execPath.replace(/\\/g, "/");
   const call = process.platform === "win32" ? "& " : "";
   const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
@@ -11211,7 +11293,7 @@ async function runGlobalInstall(opts = {}) {
       Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
     }
   };
-  writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync6(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
   console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   if (process.env["SOLONGATE_OS_LOCK"] === "1") {
     lockProtected();
@@ -11393,9 +11475,9 @@ import { spawn as spawn3 } from "child_process";
 import { URL as URL2 } from "url";
 import { readFileSync as readFileSync9, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 function findCacheFile() {
-  const dir = resolve5(homedir9(), ".solongate");
+  const dir = resolve5(homedir10(), ".solongate");
   const envSel = process.env.SOLONGATE_AGENT_ID;
   if (envSel) {
     const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
@@ -11710,8 +11792,8 @@ __export(logs_server_exports, {
 });
 import { createServer as createServer2 } from "http";
 import { readFileSync as readFileSync10, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join11, isAbsolute } from "path";
-import { homedir as homedir10 } from "os";
+import { resolve as resolve6, join as join12, isAbsolute } from "path";
+import { homedir as homedir11 } from "os";
 import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -11728,15 +11810,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir10(), ".solongate", "local-logs");
+  return resolve6(homedir11(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir10(), ".solongate");
+  const base = resolve6(homedir11(), ".solongate");
   try {
     const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync10(join11(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync10(join12(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -11745,7 +11827,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync10(join11(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync10(join12(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -11774,7 +11856,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join11(dir, LOG_FILENAME);
+  const file = join12(dir, LOG_FILENAME);
   try {
     const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -11887,7 +11969,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync6, existsSync as existsSync8, copyFileSync } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -12195,7 +12277,7 @@ async function main2() {
     log3("");
     log3(`  Backup: ${backupPath}`);
   }
-  writeFileSync6(entryFile, result.modified);
+  writeFileSync7(entryFile, result.modified);
   log3("");
   log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
   log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
@@ -12224,8 +12306,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync7, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join12 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join13 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -12304,8 +12386,8 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync7(
-    join12(dir, "package.json"),
+  writeFileSync8(
+    join13(dir, "package.json"),
     JSON.stringify(
       {
         name,
@@ -12334,8 +12416,8 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync7(
-    join12(dir, "tsconfig.json"),
+  writeFileSync8(
+    join13(dir, "tsconfig.json"),
     JSON.stringify(
       {
         compilerOptions: {
@@ -12355,9 +12437,9 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync5(join12(dir, "src"), { recursive: true });
-  writeFileSync7(
-    join12(dir, "src", "index.ts"),
+  mkdirSync6(join13(dir, "src"), { recursive: true });
+  writeFileSync8(
+    join13(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
 console.log = (...args: unknown[]) => {
@@ -12398,8 +12480,8 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync7(
-    join12(dir, ".mcp.json"),
+  writeFileSync8(
+    join13(dir, ".mcp.json"),
     JSON.stringify(
       {
         mcpServers: {
@@ -12416,13 +12498,13 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync7(
-    join12(dir, ".env"),
+  writeFileSync8(
+    join13(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync7(
-    join12(dir, ".gitignore"),
+  writeFileSync8(
+    join13(dir, ".gitignore"),
     `node_modules/
 dist/
 *.solongate-backup
@@ -12441,7 +12523,7 @@ async function main3() {
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync6(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -12515,7 +12597,7 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync8, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
@@ -12710,7 +12792,7 @@ async function pull(apiKey, file, policyId) {
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync8(file, json, "utf-8");
+  writeFileSync9(file, json, "utf-8");
   log5("");
   log5(green2("  Saved to: ") + file);
   log5(`  ${dim2("Name:")}    ${policy.name}`);

package/dist/tui/index.js

@@ -2214,6 +2214,9 @@ function RegexTest({ re }) {
 // src/tui/panels/Audit.tsx
 import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
 import TextInput4 from "ink-text-input";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 import { useState as useState6 } from "react";
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 var DECISIONS = [void 0, "DENY", "ALLOW"];
@@ -2255,6 +2258,45 @@ function loadLocalRows() {
     args: j.arguments ? JSON.stringify(j.arguments) : null
   })).sort((a, b) => b.at - a.at);
 }
+var AUDIT_HELP = [
+  [
+    "Logs",
+    [
+      ["\u2191\u2193 / PgUp PgDn", "select a row (window follows)"],
+      ["enter", "open the FULL entry (reason + arguments)"],
+      ["\u2190 \u2192", "previous / next page (500 per page, jumps to top)"],
+      ["f", "decision filter: all \u2192 DENY \u2192 ALLOW"],
+      ["g", "signal filter: all \u2192 dlp \u2192 ratelimit"],
+      ["t / n", "tool / agent filter (type, enter done)"],
+      ["/", "free-text search"],
+      ["x", "delete ONLY the selected entry (press x twice)"],
+      ["X", "delete ALL matched logs of the source (press X twice)"],
+      ["e", "export this page \u2192 ~/.solongate/audit-export-<src>.jsonl"],
+      ["E", "export ALL matched rows (cloud: up to 10k)"],
+      ["c", "clear every filter (incl. session)"]
+    ]
+  ],
+  [
+    "Sessions",
+    [
+      ["\u2191\u2193", "select a session"],
+      ["enter", "open that session's logs"],
+      ["f", "status filter: all \u2192 active \u2192 idle \u2192 ended"],
+      ["/", "search agent / session id"],
+      ["c", "clear session filters"]
+    ]
+  ],
+  [
+    "Anywhere in Audit",
+    [
+      ["v", "switch logs \u2194 sessions"],
+      ["s", "switch source cloud \u2194 local file"],
+      ["?", "this help \xB7 any key closes"],
+      ["esc", "back to the menu"]
+    ]
+  ],
+  ["Entry detail", [["\u2191\u2193 / PgUp PgDn", "scroll the arguments"], ["\u2190 / esc", "back to the list"]]]
+];
 var sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
 var STATUS_DOT = {
   active: { ch: "\u25CF", color: theme.ok },
@@ -2280,6 +2322,7 @@ function AuditPanel({ active: active2, focused }) {
   const [sessSel, setSessSel] = useState6(0);
   const [confirm, setConfirm] = useState6(null);
   const [msg, setMsg] = useState6(null);
+  const [showHelp, setShowHelp] = useState6(false);
   const toTop = () => setSel(0);
   const statsQ = useLoader(() => source === "cloud" ? api.stats.get() : Promise.resolve(null), [source]);
   const tsQ = useLoader(() => source === "cloud" ? api.stats.timeseries({ period: "24h" }) : Promise.resolve(null), [source]);
@@ -2304,26 +2347,25 @@ function AuditPanel({ active: active2, focused }) {
   usePoll(cloudQ.reloadQuiet, 6e3, active2 && source === "cloud" && view === "logs" && !editing && page === 0);
   const localQ = useLoader(() => source === "local" ? Promise.resolve(loadLocalRows()) : Promise.resolve(null), [source]);
   usePoll(localQ.reloadQuiet, 6e3, active2 && source === "local" && view === "logs" && !editing && page === 0);
+  const q = search.trim().toLowerCase();
+  const localFiltered = (localQ.data ?? []).filter((r) => {
+    if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
+    if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
+    if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
+    if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
+    if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
+    if (sessFilter && r.session !== sessFilter) return false;
+    if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
+    return true;
+  });
   let pageRows = [];
   let total = 0;
   if (source === "cloud") {
     pageRows = (cloudQ.data?.entries ?? []).map(cloudRow).sort((a, b) => b.at - a.at);
     total = cloudQ.data?.total ?? 0;
   } else {
-    const all = localQ.data ?? [];
-    const q = search.trim().toLowerCase();
-    const filtered = all.filter((r) => {
-      if (DECISIONS[di] && r.decision !== DECISIONS[di]) return false;
-      if (SIGNALS[gi] === "dlp" && r.dlp.length === 0) return false;
-      if (SIGNALS[gi] === "ratelimit" && !r.burst) return false;
-      if (tool && !r.tool.toLowerCase().includes(tool.toLowerCase())) return false;
-      if (agent && (r.agent ?? "").toLowerCase() !== agent.toLowerCase()) return false;
-      if (sessFilter && r.session !== sessFilter) return false;
-      if (q && !`${r.tool} ${r.agent ?? ""} ${r.reason ?? ""} ${r.args ?? ""}`.toLowerCase().includes(q)) return false;
-      return true;
-    });
-    total = filtered.length;
-    pageRows = filtered.slice(page * PAGE, page * PAGE + PAGE);
+    total = localFiltered.length;
+    pageRows = localFiltered.slice(page * PAGE, page * PAGE + PAGE);
   }
   const pages = Math.max(1, Math.ceil(total / PAGE));
   const current = pageRows[Math.min(sel, Math.max(0, pageRows.length - 1))];
@@ -2390,8 +2432,33 @@ function AuditPanel({ active: active2, focused }) {
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
+  const doExport = (kind) => {
+    setMsg({ text: "exporting\u2026", level: "ok" });
+    const run = async () => {
+      const dir = join5(homedir5(), ".solongate");
+      const file = join5(dir, `audit-export-${source}.jsonl`);
+      let rows2;
+      if (kind === "page") rows2 = pageRows;
+      else if (source === "cloud") {
+        const r = await api.audit.list({ ...query, limit: 1e4, offset: 0 });
+        rows2 = r.entries.map(cloudRow).sort((a, b) => b.at - a.at);
+      } else rows2 = localFiltered;
+      mkdirSync2(dir, { recursive: true });
+      writeFileSync3(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
+      return { n: rows2.length, file };
+    };
+    run().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+  };
   useInput5(
     (input, key) => {
+      if (showHelp) {
+        setShowHelp(false);
+        return;
+      }
+      if (input === "?") {
+        setShowHelp(true);
+        return;
+      }
       if (view === "detail") {
         if (key.leftArrow || key.escape) setView("logs");
         else if (key.upArrow) setDetailScroll((n) => Math.max(0, n - 1));
@@ -2470,7 +2537,7 @@ function AuditPanel({ active: active2, focused }) {
         if (!current) return;
         if (confirm?.kind !== "one" || confirm.key !== current.id) {
           setConfirm({ kind: "one", key: current.id });
-          setMsg({ text: `delete ${current.decision} ${current.tool} (${ago(current.at)} ago)? press x again`, level: "bad" });
+          setMsg({ text: `x = delete ONLY the selected entry: ${current.decision} ${current.tool} (${ago(current.at)} ago) \u2014 press x again`, level: "bad" });
           return;
         }
         setConfirm(null);
@@ -2478,12 +2545,14 @@ function AuditPanel({ active: active2, focused }) {
       } else if (input === "X") {
         if (confirm?.kind !== "all") {
           setConfirm({ kind: "all", key: "all" });
-          setMsg({ text: `DELETE ALL ${source} logs (${total} entries)? press X again`, level: "bad" });
+          setMsg({ text: `\u26A0 X = delete ALL ${source} logs \u2014 every one of the ${total} matched entries! press X again`, level: "bad" });
           return;
         }
         setConfirm(null);
         doDelete("all");
-      } else if (input === "t") setEditing("tool");
+      } else if (input === "e") doExport("page");
+      else if (input === "E") doExport("all");
+      else if (input === "t") setEditing("tool");
       else if (input === "n") setEditing("agent");
       else if (input === "/") setEditing("search");
       else if (input === "c") {
@@ -2539,6 +2608,19 @@ function AuditPanel({ active: active2, focused }) {
     /* @__PURE__ */ jsx6(Text6, { color: source === "local" ? theme.ok : "#4f6db8", bold: true, children: source }),
     /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " (s) " })
   ] });
+  if (showHelp) {
+    return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx6(Text6, { bold: true, color: theme.accentBright, children: "AUDIT \u2014 all keys" }),
+      AUDIT_HELP.map(([group, keys]) => /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx6(Text6, { bold: true, color: theme.accent, children: group }),
+        keys.map(([k, desc]) => /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx6(Text6, { color: theme.accentBright, children: ("  " + k).padEnd(20) }),
+          /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: desc })
+        ] }, k))
+      ] }, group)),
+      /* @__PURE__ */ jsx6(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "press any key to close" }) })
+    ] });
+  }
   if (view === "detail" && current) {
     const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
     const bodyW = Math.max(20, cols - 2);
@@ -2618,7 +2700,7 @@ function AuditPanel({ active: active2, focused }) {
         chip("status", SESS_STATUS[si] ?? "all", si !== 0),
         chip("search", sessSearch || "\xB7", !!sessSearch)
       ] }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 f status \xB7 / search \xB7 s source \xB7 v logs \xB7 c clear" : "press \u2192 to browse" }),
+      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 v logs \xB7 ? all keys" : "press \u2192 to browse" }),
       editing === "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
         /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "search: " }),
         /* @__PURE__ */ jsx6(
@@ -2692,7 +2774,7 @@ function AuditPanel({ active: active2, focused }) {
       chip("search", search || "\xB7", !!search),
       sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
     ] }),
-    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 f dec \xB7 g sig \xB7 t tool \xB7 n agent \xB7 / search \xB7 x del \xB7 X del ALL \xB7 s source \xB7 v sessions \xB7 c clear" : "press \u2192 to browse" }),
+    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 v sessions \xB7 ? all keys" : "press \u2192 to browse" }),
     msg ? /* @__PURE__ */ jsx6(Text6, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : null,
     editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs6(Box6, { children: [
       /* @__PURE__ */ jsxs6(Text6, { color: theme.warn, children: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.26",
+  "version": "0.81.28",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {