@solongate/proxy 0.81.36 → 0.81.38

package/dist/index.js

@@ -6554,179 +6554,31 @@ var init_cli_utils = __esm({
   }
 });
 
-// src/api-client/client.ts
-var client_exports = {};
-__export(client_exports, {
-  ApiError: () => ApiError,
-  DEFAULT_API_URL: () => DEFAULT_API_URL2,
-  NotAuthenticatedError: () => NotAuthenticatedError,
-  isAuthenticated: () => isAuthenticated,
-  request: () => request,
-  resolveCredentials: () => resolveCredentials
-});
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { resolve as resolve3, join as join4 } from "path";
-import { homedir as homedir2 } from "os";
-function loginCredentialFile() {
-  try {
-    const p = join4(homedir2(), ".solongate", "cloud-guard.json");
-    if (!existsSync3(p)) return {};
-    const c2 = JSON.parse(readFileSync4(p, "utf-8"));
-    return c2 && typeof c2 === "object" ? c2 : {};
-  } catch {
-    return {};
-  }
-}
-function dotenvApiKey() {
-  try {
-    const envPath = resolve3(".env");
-    if (!existsSync3(envPath)) return void 0;
-    for (const line of readFileSync4(envPath, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq === -1) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (key !== "SOLONGATE_API_KEY") continue;
-      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
-    }
-  } catch {
-  }
-  return void 0;
-}
-function isAuthenticated() {
-  try {
-    resolveCredentials();
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolveCredentials(apiUrlOverride) {
-  if (cached && !apiUrlOverride) return cached;
-  const file = loginCredentialFile();
-  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
-  if (!apiKey) throw new NotAuthenticatedError();
-  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL2;
-  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
-  if (!apiUrlOverride) cached = creds;
-  return creds;
-}
-function buildUrl(base, path, query) {
-  const url = new URL(`${base}/api/v1${path}`);
-  if (query) {
-    for (const [k, v] of Object.entries(query)) {
-      if (v === void 0) continue;
-      url.searchParams.set(k, String(v));
-    }
-  }
-  return url.toString();
-}
-async function request(method, path, opts = {}) {
-  const creds = resolveCredentials(opts.apiUrl);
-  const url = buildUrl(creds.apiUrl, path, opts.query);
-  const headers = {
-    Authorization: `Bearer ${creds.apiKey}`
-  };
-  let bodyInit;
-  if (opts.body !== void 0) {
-    headers["Content-Type"] = "application/json";
-    bodyInit = JSON.stringify(opts.body);
-  }
-  const attempt = () => fetch(url, {
-    method,
-    headers: { ...headers, Connection: "close" },
-    body: bodyInit,
-    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
-  });
-  const maxTries = method === "GET" ? 3 : 1;
-  let res;
-  let lastErr;
-  for (let i = 0; i < maxTries; i++) {
-    try {
-      res = await attempt();
-      break;
-    } catch (err2) {
-      lastErr = err2;
-      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
-    }
-  }
-  if (!res) {
-    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
-    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
-  }
-  const text = await res.text().catch(() => "");
-  let json = void 0;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-  }
-  if (!res.ok) {
-    const envelope = json?.error;
-    if (envelope && typeof envelope === "object") {
-      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
-    }
-    if (typeof envelope === "string") {
-      throw new ApiError(res.status, "ERROR", envelope);
-    }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
-    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
-    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
-  }
-  return json;
-}
-var DEFAULT_API_URL2, ApiError, NotAuthenticatedError, cached;
-var init_client = __esm({
-  "src/api-client/client.ts"() {
-    "use strict";
-    DEFAULT_API_URL2 = "https://api.solongate.com";
-    ApiError = class extends Error {
-      status;
-      code;
-      constructor(status, code, message) {
-        super(message);
-        this.name = "ApiError";
-        this.status = status;
-        this.code = code;
-      }
-    };
-    NotAuthenticatedError = class extends Error {
-      constructor() {
-        super("Not logged in. Run `solongate login` first.");
-        this.name = "NotAuthenticatedError";
-      }
-    };
-    cached = null;
-  }
-});
-
 // src/tui/config.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
 function loadConfig() {
-  if (cached2) return cached2;
+  if (cached) return cached;
   const defaults = { notifications: true };
   try {
-    const raw = readFileSync5(join5(homedir3(), ".solongate", "tui-config.json"), "utf-8");
+    const raw = readFileSync4(join4(homedir2(), ".solongate", "tui-config.json"), "utf-8");
     const j = JSON.parse(raw);
-    cached2 = {
+    cached = {
       notifications: j.notifications !== false,
       accent: typeof j.accent === "string" ? j.accent : void 0,
       pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
     };
   } catch {
-    cached2 = defaults;
+    cached = defaults;
   }
-  return cached2;
+  return cached;
 }
-var cached2;
+var cached;
 var init_config2 = __esm({
   "src/tui/config.ts"() {
     "use strict";
-    cached2 = null;
+    cached = null;
   }
 });
 
@@ -6836,9 +6688,9 @@ var init_components = __esm({
 });
 
 // src/tui/local-log.ts
-import { closeSync, openSync, readFileSync as readFileSync6, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { closeSync, openSync, readFileSync as readFileSync5, readSync, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
 function tailLines(file, maxBytes = 131072) {
   try {
     const size = statSync(file).size;
@@ -6856,7 +6708,7 @@ function tailLines(file, maxBytes = 131072) {
 }
 function deleteLocalEntry(at, tool, session) {
   try {
-    const lines = readFileSync6(LOCAL_LOG, "utf-8").split("\n");
+    const lines = readFileSync5(LOCAL_LOG, "utf-8").split("\n");
     let removed = 0;
     const kept = lines.filter((line) => {
       if (!line.trim()) return false;
@@ -6880,7 +6732,7 @@ function deleteLocalEntry(at, tool, session) {
 }
 function clearLocalLog() {
   try {
-    const n = readFileSync6(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
+    const n = readFileSync5(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
     writeFileSync3(LOCAL_LOG, "");
     return n;
   } catch {
@@ -6912,12 +6764,208 @@ var LOCAL_LOG, DLP_REASON, RL_REASON;
 var init_local_log = __esm({
   "src/tui/local-log.ts"() {
     "use strict";
-    LOCAL_LOG = join6(homedir4(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG = join5(homedir3(), ".solongate", "local-logs", "solongate-audit.jsonl");
     DLP_REASON = /security layer \(dlp\)/i;
     RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
   }
 });
 
+// src/api-client/client.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync3 } from "fs";
+import { resolve as resolve3, join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+function listAccounts() {
+  let list6 = [];
+  try {
+    const raw = JSON.parse(readFileSync6(accountsFile(), "utf-8"));
+    if (Array.isArray(raw)) list6 = raw.filter((a) => a && typeof a.apiKey === "string");
+  } catch {
+  }
+  const active2 = loginCredentialFile();
+  if (active2.apiKey && !list6.some((a) => a.apiKey === active2.apiKey)) {
+    list6.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL2 });
+  }
+  return list6;
+}
+function saveAccount(acc) {
+  try {
+    const list6 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync6(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    const next = list6.filter((a) => a.apiKey !== acc.apiKey);
+    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
+    mkdirSync3(join6(homedir4(), ".solongate"), { recursive: true });
+    writeFileSync4(accountsFile(), JSON.stringify(next, null, 2));
+  } catch {
+  }
+}
+function setViewCredentials(creds) {
+  viewOverride = creds;
+  cached2 = null;
+}
+function isActiveAccount(apiKey) {
+  return loginCredentialFile().apiKey === apiKey;
+}
+function setActiveAccount(creds) {
+  try {
+    const dir = join6(homedir4(), ".solongate");
+    mkdirSync3(dir, { recursive: true });
+    const p = join6(dir, ["cloud", "guard.json"].join("-"));
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync6(p, "utf-8"));
+    } catch {
+    }
+    writeFileSync4(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
+    cached2 = null;
+    return true;
+  } catch {
+    return false;
+  }
+}
+function loginCredentialFile() {
+  try {
+    const p = join6(homedir4(), ".solongate", "cloud-guard.json");
+    if (!existsSync3(p)) return {};
+    const c2 = JSON.parse(readFileSync6(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
+  } catch {
+    return {};
+  }
+}
+function dotenvApiKey() {
+  try {
+    const envPath = resolve3(".env");
+    if (!existsSync3(envPath)) return void 0;
+    for (const line of readFileSync6(envPath, "utf-8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (key !== "SOLONGATE_API_KEY") continue;
+      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isAuthenticated() {
+  try {
+    resolveCredentials();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveCredentials(apiUrlOverride) {
+  if (viewOverride && !apiUrlOverride) return viewOverride;
+  if (cached2 && !apiUrlOverride) return cached2;
+  const file = loginCredentialFile();
+  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
+  if (!apiKey) throw new NotAuthenticatedError();
+  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL2;
+  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
+  if (!apiUrlOverride) cached2 = creds;
+  return creds;
+}
+function buildUrl(base, path, query) {
+  const url = new URL(`${base}/api/v1${path}`);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v === void 0) continue;
+      url.searchParams.set(k, String(v));
+    }
+  }
+  return url.toString();
+}
+async function request(method, path, opts = {}) {
+  const creds = resolveCredentials(opts.apiUrl);
+  const url = buildUrl(creds.apiUrl, path, opts.query);
+  const headers = {
+    Authorization: `Bearer ${creds.apiKey}`
+  };
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  const attempt = () => fetch(url, {
+    method,
+    headers: { ...headers, Connection: "close" },
+    body: bodyInit,
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+  });
+  const maxTries = method === "GET" ? 3 : 1;
+  let res;
+  let lastErr;
+  for (let i = 0; i < maxTries; i++) {
+    try {
+      res = await attempt();
+      break;
+    } catch (err2) {
+      lastErr = err2;
+      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
+    }
+  }
+  if (!res) {
+    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
+    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
+  }
+  const text = await res.text().catch(() => "");
+  let json = void 0;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const envelope = json?.error;
+    if (envelope && typeof envelope === "object") {
+      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
+    }
+    if (typeof envelope === "string") {
+      throw new ApiError(res.status, "ERROR", envelope);
+    }
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
+    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
+  }
+  return json;
+}
+var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
+var init_client = __esm({
+  "src/api-client/client.ts"() {
+    "use strict";
+    DEFAULT_API_URL2 = "https://api.solongate.com";
+    accountsFile = () => join6(homedir4(), ".solongate", "accounts.json");
+    viewOverride = null;
+    ApiError = class extends Error {
+      status;
+      code;
+      constructor(status, code, message) {
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.code = code;
+      }
+    };
+    NotAuthenticatedError = class extends Error {
+      constructor() {
+        super("Not logged in. Run `solongate login` first.");
+        this.name = "NotAuthenticatedError";
+      }
+    };
+    cached2 = null;
+  }
+});
+
 // src/api-client/types.ts
 var init_types = __esm({
   "src/api-client/types.ts"() {
@@ -6925,6 +6973,54 @@ var init_types = __esm({
   }
 });
 
+// src/api-client/device-login.ts
+import { spawn } from "child_process";
+function openBrowser(url) {
+  try {
+    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function startDeviceLogin(apiUrl = DEFAULT_API_URL2) {
+  const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const j = await res.json();
+  return {
+    deviceCode: j.device_code,
+    verifyUrl: j.verification_uri_complete || j.verification_uri || "",
+    intervalMs: Math.max(2, Number(j.interval) || 3) * 1e3,
+    expiresAt: Date.now() + (Number(j.expires_in) || 600) * 1e3
+  };
+}
+async function pollDeviceLogin(apiUrl, deviceCode) {
+  try {
+    const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (j.status === "approved" && j.api_key) {
+      return { status: "approved", apiKey: j.api_key, project: j.project?.name, user: j.user?.name || j.user?.email };
+    }
+    if (j.status === "expired" || j.status === "not_found") return { status: j.status };
+    return { status: "pending" };
+  } catch {
+    return { status: "pending" };
+  }
+}
+var init_device_login = __esm({
+  "src/api-client/device-login.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
 // src/api-client/policies.ts
 var policies_exports = {};
 __export(policies_exports, {
@@ -7195,6 +7291,7 @@ var init_api_client = __esm({
     "use strict";
     init_client();
     init_types();
+    init_device_login();
     init_policies();
     init_settings();
     init_stats();
@@ -7207,24 +7304,24 @@ var init_api_client = __esm({
 });
 
 // src/tui/notify.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function desktopNotify(title, msg) {
   try {
     if (process.platform === "linux") {
-      const p = spawn("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
+      const p = spawn2("notify-send", ["-a", "SolonGate", title, msg], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "win32") {
       const q = (s) => s.replace(/'/g, "''");
       const ps = `Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;$n.ShowBalloonTip(6000,'${q(title)}','${q(msg)}',[System.Windows.Forms.ToolTipIcon]::Warning);Start-Sleep -Milliseconds 6500;$n.Dispose()`;
-      const p = spawn("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
+      const p = spawn2("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", detached: true, windowsHide: true });
       p.on("error", () => {
       });
       p.unref();
     } else if (process.platform === "darwin") {
       const esc = (s) => s.replace(/"/g, '\\"');
-      const p = spawn("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
+      const p = spawn2("osascript", ["-e", `display notification "${esc(msg)}" with title "${esc(title)}"`], { stdio: "ignore", detached: true });
       p.on("error", () => {
       });
       p.unref();
@@ -7310,7 +7407,7 @@ var init_hooks = __esm({
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
@@ -7861,8 +7958,8 @@ function LivePanel({ active: active2 }) {
       else if (input === "e") {
         const file = join7(homedir5(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync3(join7(homedir5(), ".solongate"), { recursive: true });
-          writeFileSync4(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          mkdirSync4(join7(homedir5(), ".solongate"), { recursive: true });
+          writeFileSync5(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
           setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
@@ -8880,7 +8977,7 @@ var init_Dlp = __esm({
 // src/tui/panels/Audit.tsx
 import { Box as Box6, Text as Text6, useInput as useInput5 } from "ink";
 import TextInput4 from "ink-text-input";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join8 } from "path";
 import { useState as useState6 } from "react";
@@ -9044,8 +9141,8 @@ function AuditPanel({ active: active2, focused }) {
         const r = await api.audit.list({ ...query, limit: 1e4, offset: 0 });
         rows2 = r.entries.map(cloudRow).sort((a, b) => b.at - a.at);
       } else rows2 = localFiltered;
-      mkdirSync4(dir, { recursive: true });
-      writeFileSync5(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
+      mkdirSync5(dir, { recursive: true });
+      writeFileSync6(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
     run12().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
@@ -9747,18 +9844,158 @@ var init_Settings = __esm({
   }
 });
 
-// src/tui/App.tsx
-import { Box as Box8, Text as Text8, useApp, useInput as useInput7 } from "ink";
-import { useState as useState8 } from "react";
+// src/tui/panels/Accounts.tsx
+import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
+import { useEffect as useEffect6, useRef as useRef3, useState as useState8 } from "react";
 import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
-function LiveHint() {
+function AccountsPanel({
+  focused,
+  viewApiKey,
+  onView
+}) {
+  const [accounts, setAccounts] = useState8(() => listAccounts());
+  const [sel, setSel] = useState8(0);
+  const [msg, setMsg] = useState8(null);
+  const [login, setLogin] = useState8(null);
+  const [tick, setTick] = useState8(0);
+  const abort = useRef3(false);
+  const refresh = () => setAccounts(listAccounts());
+  useEffect6(() => {
+    if (!login || login.phase === "done" || login.phase === "error") return;
+    const t = setInterval(() => setTick((n) => n + 1), 120);
+    return () => clearInterval(t);
+  }, [login]);
+  const beginLogin = () => {
+    if (login && (login.phase === "starting" || login.phase === "waiting")) return;
+    abort.current = false;
+    setLogin({ phase: "starting" });
+    void (async () => {
+      let start;
+      try {
+        start = await startDeviceLogin(DEFAULT_API_URL2);
+      } catch (e) {
+        setLogin({ phase: "error", msg: "could not reach SolonGate: " + (e instanceof Error ? e.message : String(e)) });
+        return;
+      }
+      setLogin({ phase: "waiting", url: start.verifyUrl });
+      openBrowser(start.verifyUrl);
+      while (Date.now() < start.expiresAt && !abort.current) {
+        await new Promise((r) => setTimeout(r, start.intervalMs));
+        if (abort.current) return;
+        const res = await pollDeviceLogin(DEFAULT_API_URL2, start.deviceCode);
+        if (res.status === "approved" && res.apiKey) {
+          saveAccount({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user });
+          setLogin({ phase: "done", msg: `\u2713 added ${res.project || res.user || "account"}` });
+          refresh();
+          setViewCredentials({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2 });
+          onView?.({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user });
+          return;
+        }
+        if (res.status === "expired" || res.status === "not_found") {
+          setLogin({ phase: "error", msg: "code expired \u2014 press n to retry" });
+          return;
+        }
+      }
+      if (!abort.current) setLogin({ phase: "error", msg: "timed out \u2014 press n to retry" });
+    })();
+  };
+  useInput7(
+    (input, key) => {
+      if (login && (login.phase === "starting" || login.phase === "waiting")) {
+        if (key.escape) {
+          abort.current = true;
+          setLogin(null);
+        }
+        return;
+      }
+      if (key.upArrow) setSel((n) => Math.max(0, n - 1));
+      else if (key.downArrow) setSel((n) => Math.min(accounts.length - 1, n + 1));
+      else if (key.return) {
+        const a = accounts[sel];
+        if (a) {
+          setViewCredentials({ apiKey: a.apiKey, apiUrl: a.apiUrl });
+          onView?.(a);
+          setMsg({ text: `viewing ${a.project || a.user || a.apiKey.slice(0, 8)}`, level: "ok" });
+        }
+      } else if (input === "m") {
+        const a = accounts[sel];
+        if (a) {
+          const ok = setActiveAccount({ apiKey: a.apiKey, apiUrl: a.apiUrl });
+          setMsg(ok ? { text: `\u2713 ${a.project || a.user || "account"} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
+          refresh();
+        }
+      } else if (input === "n") beginLogin();
+      else if (input === "r") refresh();
+    },
+    { isActive: focused }
+  );
+  const spin = SPIN2[tick % SPIN2.length];
+  if (login && (login.phase === "starting" || login.phase === "waiting")) {
+    return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "Add an account" }),
+      login.phase === "starting" ? /* @__PURE__ */ jsxs8(Text8, { color: theme.dim, children: [
+        spin,
+        " starting device pairing\u2026"
+      ] }) : /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Opening your browser to authorize. If it didn't open, visit:" }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, bold: true, wrap: "truncate", children: login.url }),
+        /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, children: [
+          /* @__PURE__ */ jsxs8(Text8, { color: theme.warn, children: [
+            spin,
+            " waiting for authorization\u2026 "
+          ] }),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "esc to cancel" })
+        ] })
+      ] })
+    ] });
+  }
   return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
-    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, children: /* @__PURE__ */ jsxs8(Text8, { children: [
+    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: focused ? "\u2191\u2193 select \xB7 enter view \xB7 m make active \xB7 n add account \xB7 r refresh" : "press \u2192 to manage accounts" }),
+    msg ? /* @__PURE__ */ jsx8(Text8, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, 70) }) : login?.msg ? /* @__PURE__ */ jsx8(Text8, { color: login.phase === "error" ? theme.bad : theme.ok, children: login.msg }) : /* @__PURE__ */ jsx8(Text8, { children: " " }),
+    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexDirection: "column", children: accounts.length === 0 ? /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "No accounts on this device yet." }),
+      /* @__PURE__ */ jsxs8(Text8, { children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: "n" }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " to log in \u2014 pairs this device and starts protecting your Claude Code sessions." })
+      ] })
+    ] }) : accounts.map((a, i) => {
+      const isSel = i === sel && focused;
+      const isView = viewApiKey ? a.apiKey === viewApiKey : i === 0;
+      const isActive = isActiveAccount(a.apiKey);
+      return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", backgroundColor: isSel ? "#333333" : void 0, bold: isSel, children: [
+        /* @__PURE__ */ jsx8(Text8, { color: isSel ? theme.accentBright : theme.dim, children: isSel ? "\u25B8 " : "  " }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(a.project || a.user || a.apiKey.slice(0, 12), 30).padEnd(31) }),
+        isView ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "\u25CF viewing " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "          " }),
+        isActive ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: "ACTIVE " }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "       " }),
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: a.user && a.project ? truncate2(a.user, 24) : "" })
+      ] }, a.apiKey);
+    }) }),
+    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexDirection: "column", children: /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "\u25CF viewing = the account the dataroom is showing \xB7 ACTIVE = the key the guard hooks + logging use" }) })
+  ] });
+}
+var SPIN2;
+var init_Accounts = __esm({
+  "src/tui/panels/Accounts.tsx"() {
+    "use strict";
+    init_client();
+    init_device_login();
+    init_theme();
+    SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  }
+});
+
+// src/tui/App.tsx
+import { Box as Box9, Text as Text9, useApp, useInput as useInput8 } from "ink";
+import { useState as useState9 } from "react";
+import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+function LiveHint() {
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, bold: true, children: "\u25B6 REALTIME CONSOLE" }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "Fullscreen live monitor \u2014 streaming tool calls, active charts," }),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "counters, DLP hits and denial alerts. Updates every 2s." }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, children: /* @__PURE__ */ jsxs9(Text9, { children: [
       "press ",
-      /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: "enter" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.accent, children: "enter" }),
       " to go live"
     ] }) })
   ] });
@@ -9766,22 +10003,38 @@ function LiveHint() {
 function Banner({ cols }) {
   const wide = cols >= 82;
   if (!wide) {
-    return /* @__PURE__ */ jsxs8(Box8, { children: [
-      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "SolonGate" }),
-      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " \u2014 security control center" })
+    return /* @__PURE__ */ jsxs9(Box9, { children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate" }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " \u2014 security control center" })
     ] });
   }
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", children: [
-    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx8(Text8, { bold: true, color: BANNER_HEX[i], children: line }, i)),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", children: [
+    BANNER_FULL.map((line, i) => /* @__PURE__ */ jsx9(Text9, { bold: true, color: BANNER_HEX[i], children: line }, i)),
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: " security control center \xB7 manage policies, rate limits, DLP & more" })
   ] });
 }
 function App() {
   const { exit } = useApp();
-  const [section, setSection] = useState8(0);
-  const [focus, setFocus] = useState8("nav");
-  const [help, setHelp] = useState8(false);
-  useInput7((input, key) => {
+  const [accounts, setAccounts] = useState9(() => listAccounts());
+  const [viewKey, setViewKey] = useState9(() => accounts[0]?.apiKey);
+  const [viewNonce, setViewNonce] = useState9(0);
+  const [section, setSection] = useState9(accounts.length === 0 ? ACCOUNTS_SECTION : 0);
+  const [focus, setFocus] = useState9("nav");
+  const [help, setHelp] = useState9(false);
+  const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
+  const cur = accounts[acctIdx];
+  const acctLabel = cur ? cur.project || cur.user || cur.apiKey.slice(0, 8) : "not logged in";
+  const viewAccount = (a) => {
+    setViewCredentials({ apiKey: a.apiKey, apiUrl: a.apiUrl });
+    setAccounts(listAccounts());
+    setViewKey(a.apiKey);
+    setViewNonce((n) => n + 1);
+  };
+  const switchAccount = () => {
+    if (accounts.length < 2) return;
+    viewAccount(accounts[(acctIdx + 1) % accounts.length]);
+  };
+  useInput8((input, key) => {
     if (help) {
       setHelp(false);
       return;
@@ -9794,6 +10047,7 @@ function App() {
       if (key.upArrow) setSection((n) => (n - 1 + SECTIONS.length) % SECTIONS.length);
       else if (key.downArrow) setSection((n) => (n + 1) % SECTIONS.length);
       else if (key.rightArrow || key.return || key.tab) setFocus("panel");
+      else if (input === "a") switchAccount();
       else if (input === "q") exit();
     } else {
       if (key.escape || key.tab) setFocus("nav");
@@ -9802,34 +10056,40 @@ function App() {
   });
   const { cols, rows } = useTermSize();
   const current = SECTIONS[section];
-  if (help) return /* @__PURE__ */ jsx8(HelpOverlay, { cols, rows });
+  if (help) return /* @__PURE__ */ jsx9(HelpOverlay, { cols, rows });
   if (current.label === "Live" && focus === "panel") {
-    return /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx8(LivePanel, { active: true, focused: true }) });
+    return /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: cols, height: rows, children: /* @__PURE__ */ jsx9(LivePanel, { active: true, focused: true }, viewNonce) });
   }
   const Panel = current.Panel;
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx8(Banner, { cols }),
-    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
-      /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx8(Text8, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
-      /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" }) })
+  const panelBody = current.label === "Accounts" ? /* @__PURE__ */ jsx9(AccountsPanel, { active: true, focused: focus === "panel", viewApiKey: viewKey, onView: viewAccount }) : /* @__PURE__ */ jsx9(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" });
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Banner, { cols }),
+    /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
+      /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "account: " }),
+      /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, bold: true, children: acctLabel }),
+      accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Accounts to manage)` }) : accounts.length === 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Accounts to add another" }) : null
     ] }),
-    /* @__PURE__ */ jsx8(Box8, { children: focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
+      /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => /* @__PURE__ */ jsx9(Text9, { color: i === section ? theme.accentBright : void 0, bold: i === section, children: (i === section ? "\u25B8 " : "  ") + s.label }, s.label)) }),
+      /* @__PURE__ */ jsx9(Box9, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: panelBody })
+    ] }, viewNonce),
+    /* @__PURE__ */ jsx9(Box9, { children: focus === "nav" ? /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ...accounts.length > 1 ? [["a", "account"]] : [], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx9(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
   ] });
 }
 function HelpOverlay({ cols, rows }) {
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
-    /* @__PURE__ */ jsx8(Box8, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginBottom: 1, children: [
-      /* @__PURE__ */ jsx8(Text8, { bold: true, color: theme.accent, children: group }),
-      keys.map(([k, desc]) => /* @__PURE__ */ jsxs8(Text8, { children: [
-        /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
-        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: desc })
+  return /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", width: cols, height: rows, paddingX: 2, paddingTop: 1, children: [
+    /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accentBright, children: "SolonGate \u2014 keyboard shortcuts" }),
+    /* @__PURE__ */ jsx9(Box9, { marginTop: 1, flexDirection: "column", children: HELP.map(([group, keys]) => /* @__PURE__ */ jsxs9(Box9, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx9(Text9, { bold: true, color: theme.accent, children: group }),
+      keys.map(([k, desc]) => /* @__PURE__ */ jsxs9(Text9, { children: [
+        /* @__PURE__ */ jsx9(Text9, { color: theme.accentBright, children: ("  " + k).padEnd(16) }),
+        /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: desc })
       ] }, k))
     ] }, group)) }),
-    /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "press any key to close" })
+    /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "press any key to close" })
   ] });
 }
-var SECTIONS, BANNER_HEX, HELP;
+var SECTIONS, BANNER_HEX, ACCOUNTS_SECTION, HELP;
 var init_App = __esm({
   "src/tui/App.tsx"() {
     "use strict";
@@ -9842,23 +10102,28 @@ var init_App = __esm({
     init_Dlp();
     init_Audit();
     init_Settings();
+    init_Accounts();
     init_hooks();
+    init_client();
     SECTIONS = [
       { label: "Live", Panel: LiveHint },
       { label: "Policies", Panel: PoliciesPanel },
       { label: "Rate Limit", Panel: RateLimitPanel },
       { label: "DLP", Panel: DlpPanel },
       { label: "Audit", Panel: AuditPanel },
-      { label: "Settings", Panel: SettingsPanel }
+      { label: "Settings", Panel: SettingsPanel },
+      { label: "Accounts", Panel: AccountsPanel }
     ];
     BANNER_HEX = ["white", "white", "white", "white", "white", "white"];
+    ACCOUNTS_SECTION = SECTIONS.findIndex((s) => s.label === "Accounts");
     HELP = [
       ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],
       ["Live", [["\u2191\u2193", "select a stream row"], ["enter", "full entry content"], ["w", "whitelist the selected DENY"], ["b", "block the selected ALLOW"], ["d / x / r", "filter denies / dlp / rate-limit"], ["f", "local / cloud filter"], ["/", "search"], ["s", "sessions (\u2191\u2193 pick, enter open)"], ["space", "copy mode (freeze)"]]],
       ["Policies", [["\u2191\u2193", "browse / select"], ["a", "activate (pin) selected policy"], ["x", "deactivate \u2014 no active policy"], ["enter", "open rules \u2192 open a rule"], ["space", "toggle a rule on/off"], ["e", "flip effect"], ["n", "new rule"], ["d", "delete rule"], ["m", "flip mode"], ["D", "dry-run the draft"], ["s", "save"], ["x", "discard"]]],
       ["Rate limit / DLP", [["\u2191\u2193", "field / pattern"], ["\u2190\u2192", "adjust (shift = \xB110)"], ["space", "toggle pattern"], ["m", "mode"], ["a / d", "add / remove custom"], ["g", "ghost mode"], ["P", "self-protection"], ["s", "save"]]],
       ["Audit", [["v", "logs \u2194 sessions"], ["s", "source: cloud \u2194 local"], ["\u2190 \u2192", "prev / next page (500 each)"], ["\u2191\u2193", "select (list scrolls)"], ["enter", "full entry / session logs"], ["f / g", "decision / signal filter"], ["t / n / /", "tool / agent / search"], ["x / X", "delete entry / ALL (press twice)"], ["c", "clear filters"]]],
-      ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]]
+      ["Settings", [["\u2191\u2193", "move"], ["enter / space", "toggle \xB7 edit \xB7 add"], ["e", "webhook events"], ["d d", "delete"], ["r", "refresh"]]],
+      ["Accounts", [["a", "switch account (view another account logged in on this device)"], ["", "the header shows which account you are viewing; guard/logging keep the active key"]]]
     ];
   }
 });
@@ -9869,7 +10134,7 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { render } from "ink";
-import { jsx as jsx9 } from "react/jsx-runtime";
+import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stderr.write(
@@ -9877,13 +10142,9 @@ async function launchTui() {
     );
     return;
   }
-  if (!isAuthenticated()) {
-    process.stderr.write("Not logged in. Run `solongate login` first.\n");
-    return;
-  }
   process.stdout.write("\x1B[?1049h\x1B[H");
   try {
-    const { waitUntilExit } = render(/* @__PURE__ */ jsx9(App, {}));
+    const { waitUntilExit } = render(/* @__PURE__ */ jsx10(App, {}));
     await waitUntilExit();
   } finally {
     process.stdout.write("\x1B[?1049l");
@@ -9893,7 +10154,6 @@ var init_tui = __esm({
   "src/tui/index.tsx"() {
     "use strict";
     init_App();
-    init_client();
   }
 });
 
@@ -11063,7 +11323,7 @@ __export(global_install_exports, {
   runGlobalRestore: () => runGlobalRestore,
   unlockProtected: () => unlockProtected
 });
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync7, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
 import { resolve as resolve4, join as join11, dirname } from "path";
 import { homedir as homedir9 } from "os";
 import { fileURLToPath } from "url";
@@ -11176,13 +11436,13 @@ function runGlobalRestore() {
   unlockProtected();
   removeClaudeShim();
   if (existsSync6(p.backupPath)) {
-    writeFileSync6(p.settingsPath, readFileSync8(p.backupPath, "utf-8"));
+    writeFileSync7(p.settingsPath, readFileSync8(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
   } else if (existsSync6(p.settingsPath)) {
     try {
       const s = JSON.parse(readFileSync8(p.settingsPath, "utf-8"));
       delete s.hooks;
-      writeFileSync6(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      writeFileSync7(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
     } catch {
     }
@@ -11226,8 +11486,8 @@ function writeShimBlock(file, block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
     content += block2 + "\n";
   }
-  mkdirSync5(dirname(file), { recursive: true });
-  writeFileSync6(file, content);
+  mkdirSync6(dirname(file), { recursive: true });
+  writeFileSync7(file, content);
 }
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
@@ -11278,22 +11538,22 @@ async function runGlobalInstall(opts = {}) {
     process.exit(1);
   }
   const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync5(p.hooksDir, { recursive: true });
-  mkdirSync5(p.claudeDir, { recursive: true });
+  mkdirSync6(p.hooksDir, { recursive: true });
+  mkdirSync6(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync6(join11(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync6(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync6(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync6(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync7(join11(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync7(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync7(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync7(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
   installClaudeShim(join11(p.hooksDir, "shield.mjs"));
-  writeFileSync6(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  writeFileSync7(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
   if (existsSync6(p.settingsPath)) {
     const raw = readFileSync8(p.settingsPath, "utf-8");
     if (!existsSync6(p.backupPath)) {
-      writeFileSync6(p.backupPath, raw);
+      writeFileSync7(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
     try {
@@ -11316,7 +11576,7 @@ async function runGlobalInstall(opts = {}) {
       Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
     }
   };
-  writeFileSync6(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  writeFileSync7(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
   console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   if (process.env["SOLONGATE_OS_LOCK"] === "1") {
     lockProtected();
@@ -11339,7 +11599,7 @@ var init_global_install = __esm({
 
 // src/login.ts
 var login_exports = {};
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function startSpinner(text) {
   if (!process.stderr.isTTY) {
     process.stderr.write(`  ${text}
@@ -11371,11 +11631,11 @@ function parseArgs2(argv) {
   }
   return { apiUrl, install };
 }
-function openBrowser(url) {
+function openBrowser2(url) {
   try {
     const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
+    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -11405,7 +11665,7 @@ async function main() {
   console.log(`  ${c.cyan}${verifyUrl}${c.reset}`);
   console.log("");
   void user_code;
-  openBrowser(verifyUrl);
+  openBrowser2(verifyUrl);
   const pollMs = Math.max(2, Number(interval) || 3) * 1e3;
   const deadline = Date.now() + (Number(expires_in) || 600) * 1e3;
   let apiKey = "";
@@ -11434,6 +11694,7 @@ async function main() {
         if (data?.project?.name) {
           console.log(`  ${c.dim}Project:${c.reset} ${c.cyan}${data.project.name}${c.reset}`);
         }
+        saveAccount({ apiKey, apiUrl, project: data?.project?.name, user: data?.user?.name || data?.user?.email });
         break;
       }
       if (data?.status === "expired" || data?.status === "not_found") {
@@ -11478,6 +11739,7 @@ var init_login = __esm({
     "use strict";
     init_cli_utils();
     init_global_install();
+    init_client();
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
     SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     main().catch((err2) => {
@@ -11494,7 +11756,7 @@ __export(shield_exports, {
 });
 import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { URL as URL2 } from "url";
 import { readFileSync as readFileSync9, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
@@ -11754,7 +12016,7 @@ async function runShield() {
   const upstream = pickUpstream();
   const { port, close } = await startProxy(upstream);
   log4(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn3(cmd[0], cmd.slice(1), {
+  const child = spawn4(cmd[0], cmd.slice(1), {
     stdio: "inherit",
     env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
     shell: process.platform === "win32"
@@ -11992,7 +12254,7 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, existsSync as existsSync8, copyFileSync } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync8, copyFileSync } from "fs";
 import { resolve as resolve7 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
@@ -12300,7 +12562,7 @@ async function main2() {
     log3("");
     log3(`  Backup: ${backupPath}`);
   }
-  writeFileSync7(entryFile, result.modified);
+  writeFileSync8(entryFile, result.modified);
   log3("");
   log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
   log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
@@ -12329,7 +12591,7 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync8, existsSync as existsSync9 } from "fs";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join13 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
@@ -12409,7 +12671,7 @@ EXAMPLES
 `);
 }
 function createProject(dir, name, _policy) {
-  writeFileSync8(
+  writeFileSync9(
     join13(dir, "package.json"),
     JSON.stringify(
       {
@@ -12439,7 +12701,7 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  writeFileSync8(
+  writeFileSync9(
     join13(dir, "tsconfig.json"),
     JSON.stringify(
       {
@@ -12460,8 +12722,8 @@ function createProject(dir, name, _policy) {
       2
     ) + "\n"
   );
-  mkdirSync6(join13(dir, "src"), { recursive: true });
-  writeFileSync8(
+  mkdirSync7(join13(dir, "src"), { recursive: true });
+  writeFileSync9(
     join13(dir, "src", "index.ts"),
     `#!/usr/bin/env node
 
@@ -12503,7 +12765,7 @@ console.log('');
 console.log('Press Ctrl+C to stop.');
 `
   );
-  writeFileSync8(
+  writeFileSync9(
     join13(dir, ".mcp.json"),
     JSON.stringify(
       {
@@ -12521,12 +12783,12 @@ console.log('Press Ctrl+C to stop.');
       2
     ) + "\n"
   );
-  writeFileSync8(
+  writeFileSync9(
     join13(dir, ".env"),
     `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
 `
   );
-  writeFileSync8(
+  writeFileSync9(
     join13(dir, ".gitignore"),
     `node_modules/
 dist/
@@ -12546,7 +12808,7 @@ async function main3() {
     process.exit(1);
   }
   withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync6(dir, { recursive: true });
+    mkdirSync7(dir, { recursive: true });
     createProject(dir, opts.name, opts.policy);
   });
   if (!opts.noInstall) {
@@ -12620,7 +12882,7 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
@@ -12815,7 +13077,7 @@ async function pull(apiKey, file, policyId) {
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync9(file, json, "utf-8");
+  writeFileSync10(file, json, "utf-8");
   log5("");
   log5(green2("  Saved to: ") + file);
   log5(`  ${dim2("Name:")}    ${policy.name}`);
@@ -15995,8 +16257,7 @@ function printWelcome() {
 async function main5() {
   const subcommand = process.argv[2];
   if (process.argv.length <= 2) {
-    const { isAuthenticated: isAuthenticated2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-    if (process.stdout.isTTY && isAuthenticated2()) {
+    if (process.stdout.isTTY && process.stdin.isTTY) {
       const { launchTui: launchTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
       await launchTui2();
       return;