@solongate/proxy 0.81.55 → 0.81.57

package/dist/tui/index.js

@@ -283,6 +283,20 @@ function saveAccount(acc) {
   } catch {
   }
 }
+function removeAccount(apiKey) {
+  try {
+    const list5 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    writeFileSync2(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+  } catch {
+  }
+}
 var viewOverride = null;
 function setViewCredentials(creds) {
   viewOverride = creds;
@@ -550,11 +564,13 @@ __export(settings_exports, {
   getSecurityLayers: () => getSecurityLayers,
   getSelfProtection: () => getSelfProtection,
   getWebhooks: () => getWebhooks,
+  sendTestAlert: () => sendTestAlert,
   sendTestWebhook: () => sendTestWebhook,
   setAlertEnabled: () => setAlertEnabled,
   setLocalLogs: () => setLocalLogs,
   setSecurityLayers: () => setSecurityLayers,
   setSelfProtection: () => setSelfProtection,
+  updateAlert: () => updateAlert,
   updateWebhook: () => updateWebhook
 });
 function getSecurityLayers() {
@@ -596,6 +612,12 @@ function deleteAlert(id) {
 function setAlertEnabled(id, enabled) {
   return request("PATCH", "/settings/denial-alerts", { query: { id }, body: { enabled } });
 }
+function updateAlert(id, patch) {
+  return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
+}
+function sendTestAlert(id) {
+  return request("POST", "/settings/denial-alerts/send-test", { body: { id } });
+}
 function getWebhooks() {
   return request("GET", "/settings/denial-webhook");
 }
@@ -3175,8 +3197,20 @@ function stopLogsServerDaemon() {
 import { Fragment as Fragment5, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 var EVENTS = ["denials", "allowed", "all"];
 var SPIN2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var ALERT_BASE = { name: "dataroom alert", threshold: 5, windowSeconds: 60, signal: "any" };
+var SIGNALS2 = ["any", "deny", "dlp", "ratelimit"];
+var SIGNAL_LABEL = { any: "any signal", deny: "denials", dlp: "dlp secrets", ratelimit: "rate-limit" };
+var WINDOWS = [30, 60, 300, 3600, 86400];
+var winLabel = (s) => s < 60 ? `${s}s` : s < 3600 ? `${s / 60}m` : s < 86400 ? `${s / 3600}h` : `${s / 86400}d`;
+var THRESH_MIN = 5;
+var THRESH_MAX = 100;
+var nearestWindowIdx = (s) => {
+  let best = 0;
+  for (let i = 1; i < WINDOWS.length; i++) if (Math.abs(WINDOWS[i] - s) < Math.abs(WINDOWS[best] - s)) best = i;
+  return best;
+};
+var EDITOR_FIELDS = 4;
 var acctLabel = (a) => a.email || a.user || "account \u2026" + a.apiKey.slice(-4);
+var alertChannel = (r) => r.emails && r.emails.length ? "email" : r.telegram && r.telegram.length ? "telegram" : null;
 function SettingsPanel({
   active: active2,
   focused,
@@ -3191,6 +3225,7 @@ function SettingsPanel({
   const [confirmDel, setConfirmDel] = useState7(null);
   const [msg, setMsg] = useState7(null);
   const [busy, setBusy] = useState7(false);
+  const [editor, setEditor] = useState7(null);
   const [accounts, setAccounts] = useState7(() => listAccounts());
   const [login, setLogin] = useState7(null);
   const [tick, setTick] = useState7(0);
@@ -3210,22 +3245,30 @@ function SettingsPanel({
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
+  const guardQ = useLoader(() => listAccounts().length ? api.settings.getGuardStatus() : Promise.resolve(null));
+  const selfQ = useLoader(() => listAccounts().length ? api.settings.getSelfProtection() : Promise.resolve(null));
   const local = localQ.data;
+  const guard = guardQ.data;
+  const selfProt = selfQ.data;
   const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
   const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
   const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
+  const hasEmailAlert = alerts.some((r) => alertChannel(r) === "email");
+  const hasTgAlert = alerts.some((r) => alertChannel(r) === "telegram");
   const rowsAll = [
     ...accounts.map((acc) => ({ kind: "acct", acc })),
     { kind: "acct-add" },
     ...locked ? [] : [
+      { kind: "guard" },
+      { kind: "self" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
       ...webhooks.map((wh) => ({ kind: "wh", wh })),
       { kind: "wh-add" },
       ...alerts.map((rule) => ({ kind: "alert", rule })),
-      { kind: "alert-add-email" },
-      { kind: "alert-add-tg" }
+      ...hasEmailAlert ? [] : [{ kind: "alert-add-email" }],
+      ...hasTgAlert ? [] : [{ kind: "alert-add-tg" }]
     ]
   ];
   const selClamped = Math.min(sel, rowsAll.length - 1);
@@ -3236,6 +3279,8 @@ function SettingsPanel({
     localQ.reload();
     whQ.reload();
     alertQ.reload();
+    guardQ.reload();
+    selfQ.reload();
   };
   const run = (label, fn, reload) => {
     if (busy) return;
@@ -3251,19 +3296,19 @@ function SettingsPanel({
     abort.current = false;
     setLogin({ phase: "starting" });
     void (async () => {
-      let start2;
+      let start;
       try {
-        start2 = await startDeviceLogin(DEFAULT_API_URL);
+        start = await startDeviceLogin(DEFAULT_API_URL);
       } catch (e) {
         setLogin({ phase: "error", msg: "could not reach SolonGate: " + (e instanceof Error ? e.message : String(e)) });
         return;
       }
-      setLogin({ phase: "waiting", url: start2.verifyUrl });
-      openBrowser(start2.verifyUrl);
-      while (Date.now() < start2.expiresAt && !abort.current) {
-        await new Promise((r) => setTimeout(r, start2.intervalMs));
+      setLogin({ phase: "waiting", url: start.verifyUrl });
+      openBrowser(start.verifyUrl);
+      while (Date.now() < start.expiresAt && !abort.current) {
+        await new Promise((r) => setTimeout(r, start.intervalMs));
         if (abort.current) return;
-        const res = await pollDeviceLogin(DEFAULT_API_URL, start2.deviceCode);
+        const res = await pollDeviceLogin(DEFAULT_API_URL, start.deviceCode);
         if (res.status === "approved" && res.apiKey) {
           saveAccount({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL, project: res.project, user: res.user, email: res.email });
           setLogin({ phase: "done", msg: `\u2713 added ${res.email || res.user || res.project || "account"}` });
@@ -3280,6 +3325,57 @@ function SettingsPanel({
       if (!abort.current) setLogin({ phase: "error", msg: "timed out \u2014 press n to retry" });
     })();
   };
+  const openAlertEditor = (channel, rule) => {
+    setEditor({
+      id: rule?.id,
+      channel,
+      target: (channel === "email" ? rule?.emails?.[0] : rule?.telegram?.[0]) ?? "",
+      signal: rule?.signal ?? "any",
+      threshold: rule?.threshold ?? THRESH_MIN,
+      windowSeconds: rule?.windowSeconds ?? 300,
+      field: rule ? 1 : 0
+      // new rule starts on the target; existing on signal
+    });
+    if (!rule) {
+      setInput("");
+      setEditing("alert-target");
+    }
+  };
+  const normTarget = (channel, raw) => {
+    const v = raw.trim();
+    if (channel === "email") {
+      const email = v.replace(/^mailto:/i, "").replace(/^["'<]+|["'>]+$/g, "").replace(/[.,;:]+$/, "").replace(/\s+/g, "");
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return { value: email, error: "that does not look like an e-mail address" };
+      return { value: email };
+    }
+    const tg = v.replace(/^@/, "").replace(/^(chat[\s_-]*)?id[:=\s]*/i, "").replace(/\s+/g, "");
+    if (!/^-?\d{5,}$/.test(tg)) return { value: tg, error: "a telegram chat id is a number \u2014 get yours from @userinfobot" };
+    return { value: tg };
+  };
+  const saveEditor = () => {
+    if (!editor) return;
+    const t = normTarget(editor.channel, editor.target);
+    if (t.error) {
+      setMsg({ text: "\u2717 " + t.error, level: "bad" });
+      return;
+    }
+    const channels = editor.channel === "email" ? { emails: [t.value], telegram: [] } : { telegram: [t.value], emails: [] };
+    const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, ...channels };
+    const id = editor.id;
+    setEditor(null);
+    if (id) run("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "dataroom alert", ...body }), alertQ.reload);
+  };
+  const testAlert = (rule) => {
+    run(
+      "alert test sent \u2014 check your " + (alertChannel(rule) ?? "channel"),
+      () => api.settings.sendTestAlert(rule.id).then((r) => {
+        if (!r.delivered.telegram && !r.delivered.email) throw new Error("no channel on this rule");
+      }),
+      () => {
+      }
+    );
+  };
   const activate = (r) => {
     if (r.kind === "acct") {
       setViewCredentials({ apiKey: r.acc.apiKey, apiUrl: r.acc.apiUrl });
@@ -3287,6 +3383,9 @@ function SettingsPanel({
       setMsg({ text: `viewing ${acctLabel(r.acc)}`, level: "ok" });
     } else if (r.kind === "acct-add") {
       beginLogin();
+    } else if (r.kind === "self") {
+      if (!selfProt) return;
+      run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
@@ -3309,13 +3408,12 @@ function SettingsPanel({
       setInput("");
       setEditing("wh-url");
     } else if (r.kind === "alert") {
-      run(r.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(r.rule.id, !r.rule.enabled), alertQ.reload);
+      const ch = alertChannel(r.rule);
+      if (ch) openAlertEditor(ch, r.rule);
     } else if (r.kind === "alert-add-email") {
-      setInput("");
-      setEditing("alert-email");
-    } else {
-      setInput("");
-      setEditing("alert-tg");
+      openAlertEditor("email");
+    } else if (r.kind === "alert-add-tg") {
+      openAlertEditor("telegram");
     }
   };
   const submitInput = () => {
@@ -3333,22 +3431,8 @@ function SettingsPanel({
         return;
       }
       run("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
-    } else if (which === "alert-email") {
-      if (!v) return;
-      const email = v.replace(/^mailto:/i, "").replace(/^["'<]+|["'>]+$/g, "").replace(/[.,;:]+$/, "").replace(/\s+/g, "").trim();
-      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-        setMsg({ text: "\u2717 that does not look like an e-mail address", level: "bad" });
-        return;
-      }
-      run("email alert added", () => api.settings.createAlert({ ...ALERT_BASE, emails: [email] }), alertQ.reload);
-    } else if (which === "alert-tg") {
-      if (!v) return;
-      const tg = v.replace(/^@/, "").replace(/^(chat[\s_-]*)?id[:=\s]*/i, "").replace(/\s+/g, "").trim();
-      if (!/^-?\d{5,}$/.test(tg)) {
-        setMsg({ text: "\u2717 a telegram chat id is a number \u2014 get yours from @userinfobot", level: "bad" });
-        return;
-      }
-      run("telegram alert added", () => api.settings.createAlert({ ...ALERT_BASE, telegram: [tg] }), alertQ.reload);
+    } else if (which === "alert-target" && editor) {
+      setEditor({ ...editor, target: v, field: 1 });
     }
   };
   useInput6(
@@ -3360,6 +3444,35 @@ function SettingsPanel({
         }
         return;
       }
+      if (editor) {
+        if (key.escape) {
+          setEditor(null);
+          return;
+        }
+        if (inp === "e" || key.return && editor.field === 0) {
+          setInput(editor.target);
+          setEditing("alert-target");
+          return;
+        }
+        if (inp === "t" && editor.id) {
+          const rule = alerts.find((a) => a.id === editor.id);
+          if (rule) testAlert(rule);
+          return;
+        }
+        if (key.return) {
+          saveEditor();
+          return;
+        }
+        if (key.upArrow) setEditor({ ...editor, field: (editor.field + EDITOR_FIELDS - 1) % EDITOR_FIELDS });
+        else if (key.downArrow) setEditor({ ...editor, field: (editor.field + 1) % EDITOR_FIELDS });
+        else if (key.leftArrow || key.rightArrow) {
+          const d = key.rightArrow ? 1 : -1;
+          if (editor.field === 1) setEditor({ ...editor, signal: SIGNALS2[(SIGNALS2.indexOf(editor.signal) + d + SIGNALS2.length) % SIGNALS2.length] });
+          else if (editor.field === 2) setEditor({ ...editor, threshold: Math.max(THRESH_MIN, Math.min(THRESH_MAX, editor.threshold + d * 5)) });
+          else if (editor.field === 3) setEditor({ ...editor, windowSeconds: WINDOWS[Math.max(0, Math.min(WINDOWS.length - 1, nearestWindowIdx(editor.windowSeconds) + d))] });
+        }
+        return;
+      }
       setMsg(null);
       if (key.upArrow) {
         setSel((n) => Math.max(0, n - 1));
@@ -3373,28 +3486,41 @@ function SettingsPanel({
           const ok = setActiveAccount({ apiKey: cur.acc.apiKey, apiUrl: cur.acc.apiUrl });
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
-        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "ll-enabled" || cur.kind === "ll-server") activate(cur);
+        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
+          if (cur.kind === "alert") run(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
+          else activate(cur);
+        }
+      } else if (inp === "x" && cur.kind === "acct") {
+        const k = "acct:" + cur.acc.apiKey;
+        if (confirmDel !== k) {
+          setConfirmDel(k);
+          setMsg({ text: `press x again to remove ${acctLabel(cur.acc)} from this device (the cloud account is untouched)`, level: "bad" });
+          return;
+        }
+        setConfirmDel(null);
+        removeAccount(cur.acc.apiKey);
+        setMsg({ text: `\u2713 removed ${acctLabel(cur.acc)} from this device`, level: "ok" });
+        refreshAccounts();
       } else if (inp === "t" && cur.kind === "wh") {
-        run(
-          "test event sent \u2014 check your endpoint",
-          () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
-            if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx response)");
-          }),
-          whQ.reload
-        );
-      } else if (inp === "n") beginLogin();
+        run("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
+          if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
+        }), whQ.reload);
+      } else if (inp === "t" && cur.kind === "alert") {
+        testAlert(cur.rule);
+      } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
         run(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
-      } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
+      } else if (inp === "e" && cur.kind === "alert") {
+        const ch = alertChannel(cur.rule);
+        if (ch) openAlertEditor(ch, cur.rule);
+      } else if (inp === "n") beginLogin();
       else if (inp === "a") {
         if (cur.kind === "wh" || cur.kind === "wh-add") {
           setInput("");
           setEditing("wh-url");
-        } else if (cur.kind === "alert" || cur.kind === "alert-add-email" || cur.kind === "alert-add-tg") {
-          setInput("");
-          setEditing("alert-email");
-        }
+        } else if (cur.kind === "alert-add-email") openAlertEditor("email");
+        else if (cur.kind === "alert-add-tg") openAlertEditor("telegram");
       } else if (inp === "d" && (cur.kind === "wh" || cur.kind === "alert")) {
         const k = keyOf(cur);
         if (confirmDel !== k) {
@@ -3434,123 +3560,186 @@ function SettingsPanel({
       ] })
     ] });
   }
-  const loading = !locked && (localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data);
-  const error = locked ? null : localQ.error ?? whQ.error ?? alertQ.error;
-  const mark = (r) => keyOf(r) === keyOf(cur) && focused ? "\u25B8 " : "  ";
-  const onOff = (on) => on ? /* @__PURE__ */ jsx7(Text7, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "off" });
-  const chanOf = (rule) => [...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
-  const listBudget = Math.max(4, rows - 10);
-  const start = Math.min(Math.max(0, selClamped - Math.floor(listBudget / 2)), Math.max(0, rowsAll.length - listBudget));
-  const inWindow = (r) => {
-    const i = rowsAll.findIndex((x) => keyOf(x) === keyOf(r));
-    return i >= start && i < start + listBudget;
-  };
-  return /* @__PURE__ */ jsx7(DataView, { loading, error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: focused ? "\u2191\u2193 move \xB7 enter/m act \xB7 t test webhook \xB7 n add account \xB7 e events \xB7 d delete \xB7 r refresh" : "press \u2192 to configure" }),
-    editing ? /* @__PURE__ */ jsxs7(Box7, { children: [
-      /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: editing === "path" ? "local log path: " : editing === "wh-url" ? "webhook url: " : editing === "alert-email" ? "e-mail address: " : "telegram chat id (from @userinfobot): " }),
-      /* @__PURE__ */ jsx7(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
-    ] }) : msg ? /* @__PURE__ */ jsx7(Text7, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : login?.msg ? /* @__PURE__ */ jsx7(Text7, { color: login.phase === "error" ? theme.bad : theme.ok, children: login.msg }) : /* @__PURE__ */ jsx7(Text7, { children: " " }),
-    /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+  if (editor) {
+    const fieldRow = (idx, label, value, hint) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+      /* @__PURE__ */ jsx7(Text7, { color: editor.field === idx ? theme.accentBright : theme.dim, children: editor.field === idx ? "\u25B8 " : "  " }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: label.padEnd(11) }),
+      value,
+      editor.field === idx && hint ? /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "   " + hint }) : null
+    ] });
+    return /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
       /* @__PURE__ */ jsxs7(Text7, { bold: true, color: theme.accentBright, children: [
-        "ACCOUNTS ",
-        /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-          "\u2014 logged in on this device (",
-          accounts.length,
-          ") \xB7 \u25CF viewing = shown here \xB7 ACTIVE = key the guard uses"
-        ] })
+        editor.id ? "Edit" : "New",
+        " ",
+        editor.channel,
+        " alert"
       ] }),
-      accounts.length === 0 ? /* @__PURE__ */ jsxs7(Text7, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  no accounts yet \u2014 " }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: "n" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " (or enter) logs in, pairs this device and unlocks the dataroom" })
-      ] }) : null,
-      accounts.filter((acc) => inWindow({ kind: "acct", acc })).map((a) => {
+      /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+        "\u2191\u2193 field \xB7 \u2190\u2192 change \xB7 e edit target \xB7 enter save",
+        editor.id ? " \xB7 t test" : "",
+        " \xB7 esc cancel"
+      ] }),
+      editing === "alert-target" ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: editor.channel === "email" ? "e-mail address: " : "telegram chat id (from @userinfobot): " }),
+        /* @__PURE__ */ jsx7(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
+      ] }) : msg ? /* @__PURE__ */ jsx7(Text7, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : /* @__PURE__ */ jsx7(Text7, { children: " " }),
+      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+        fieldRow(0, "target", editor.target ? /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(editor.target, cols - 16) }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "empty \u2014 press e" }), "press e to edit"),
+        fieldRow(1, "signal", /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: SIGNAL_LABEL[editor.signal] }), "\u2190\u2192 change"),
+        fieldRow(2, "threshold", /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: `\u2265 ${editor.threshold}` }), "\u2190\u2192 \xB15"),
+        fieldRow(3, "window", /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: winLabel(editor.windowSeconds) }), "\u2190\u2192 change")
+      ] }),
+      /* @__PURE__ */ jsx7(Box7, { marginTop: 1, children: /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+        "fires when ",
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: SIGNAL_LABEL[editor.signal] }),
+        " reach ",
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: editor.threshold }),
+        " within",
+        " ",
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: winLabel(editor.windowSeconds) })
+      ] }) })
+    ] });
+  }
+  const loading = !locked && (localQ.loading && !localQ.data || whQ.loading && !whQ.data || alertQ.loading && !alertQ.data || guardQ.loading && !guardQ.data || selfQ.loading && !selfQ.data);
+  const error = locked ? null : localQ.error ?? whQ.error ?? alertQ.error ?? guardQ.error ?? selfQ.error;
+  const onOff = (on) => on ? /* @__PURE__ */ jsx7(Text7, { color: theme.ok, children: "on " }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "off" });
+  const chanOf = (rule) => [...rule.emails ?? [], ...(rule.telegram ?? []).map((t) => "tg " + t)].join(", ") || "\u2014";
+  const isCur = (r) => keyOf(r) === keyOf(cur) && focused;
+  const cursor = (r) => /* @__PURE__ */ jsx7(Text7, { color: isCur(r) ? theme.accentBright : theme.dim, children: isCur(r) ? "\u25B8 " : "  " });
+  const rowLine = (r) => {
+    switch (r.kind) {
+      case "acct": {
+        const a = r.acc;
         const isView = viewApiKey ? a.apiKey === viewApiKey : accounts[0]?.apiKey === a.apiKey;
         const isActive = isActiveAccount(a.apiKey);
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "acct:" + a.apiKey && focused ? theme.accentBright : theme.dim, children: mark({ kind: "acct", acc: a }) }),
+          cursor(r),
           /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(acctLabel(a), 30).padEnd(31) }),
           isView ? /* @__PURE__ */ jsx7(Text7, { color: theme.ok, children: "\u25CF viewing " }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "          " }),
           isActive ? /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: "ACTIVE " }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "       " }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: a.project ? truncate(a.project, 24) : "" })
-        ] }, a.apiKey);
-      }),
-      inWindow({ kind: "acct-add" }) ? /* @__PURE__ */ jsxs7(Text7, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: cur.kind === "acct-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "acct-add" }) }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
-      ] }) : null
-    ] }),
-    locked ? null : /* @__PURE__ */ jsxs7(Fragment5, { children: [
-      inWindow({ kind: "ll-enabled" }) || inWindow({ kind: "ll-path" }) || inWindow({ kind: "ll-server" }) ? /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs7(Text7, { bold: true, color: theme.accentBright, children: [
-          "LOCAL LOGS ",
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2014 hooks mirror every decision to a file on the agent machine" })
-        ] }),
-        /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "ll-enabled" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "ll-enabled" }) }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "enabled ".padEnd(10) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: a.project ? truncate(a.project, 20) : "" })
+        ] });
+      }
+      case "acct-add":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
+        ] });
+      case "guard":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
+          guard ? /* @__PURE__ */ jsxs7(Fragment5, { children: [
+            /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""}` })
+          ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
+        ] });
+      case "self":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "self-prot".padEnd(11) }),
+          selfProt ? onOff(selfProt.enabled) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2026" }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "   blocks agents editing SolonGate\u2019s own hooks/config \xB7 enter toggles" })
+        ] });
+      case "ll-enabled":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "enabled ".padEnd(11) }),
           onOff(!!local?.enabled),
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "   enter toggles" })
-        ] }),
-        /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "ll-path" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "ll-path" }) }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "path ".padEnd(10) }),
+        ] });
+      case "ll-path":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "path ".padEnd(11) }),
           local?.path ? /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(local.path, cols - 14) }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "not set \u2014 enter to edit" })
-        ] }),
-        /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "ll-server" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "ll-server" }) }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "dashboard".padEnd(10) }),
+        ] });
+      case "ll-server":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "dashboard".padEnd(11) }),
           srv.running ? /* @__PURE__ */ jsx7(Text7, { color: theme.ok, children: `running 127.0.0.1:${srv.port}` }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "stopped" }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: srv.running ? "   serves local logs to the dashboard \xB7 survives closing the dataroom \xB7 enter stops" : "   enter starts the local-logs link for the dashboard" })
-        ] })
-      ] }) : null,
-      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs7(Text7, { bold: true, color: theme.accentBright, children: [
-          "WEBHOOKS ",
-          /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-            "\u2014 POST every matching event to your endpoint (",
-            webhooks.length,
-            ")"
-          ] })
-        ] }),
-        webhooks.filter((wh) => inWindow({ kind: "wh", wh })).map((wh) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "wh:" + wh.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh", wh }) }),
-          onOff(wh.enabled),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: (" " + wh.events).padEnd(9) }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(wh.url, cols - 16) })
-        ] }, wh.id)),
-        inWindow({ kind: "wh-add" }) ? /* @__PURE__ */ jsxs7(Text7, { children: [
-          /* @__PURE__ */ jsx7(Text7, { color: cur.kind === "wh-add" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "wh-add" }) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: srv.running ? "   survives closing the dataroom \xB7 enter stops" : "   enter starts the dashboard local-logs link" })
+        ] });
+      case "wh":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          onOff(r.wh.enabled),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: (" " + r.wh.events).padEnd(9) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(r.wh.url, cols - 16) })
+        ] });
+      case "wh-add":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add webhook (enter)" })
-        ] }) : null
-      ] }),
-      /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs7(Text7, { bold: true, color: theme.accentBright, children: [
-          "ALERTS ",
-          /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-            "\u2014 notify on a signal spike (",
-            alerts.length,
-            ")"
-          ] })
-        ] }),
-        alerts.filter((rule) => inWindow({ kind: "alert", rule })).map((rule) => /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-          /* @__PURE__ */ jsx7(Text7, { color: keyOf(cur) === "alert:" + rule.id && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert", rule }) }),
-          onOff(rule.enabled),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: (" " + rule.signal).padEnd(11) }),
-          /* @__PURE__ */ jsx7(Text7, { children: `\u2265${rule.threshold}/${rule.windowSeconds}s ` }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(chanOf(rule), cols - 26) })
-        ] }, rule.id)),
-        inWindow({ kind: "alert-add-email" }) ? /* @__PURE__ */ jsxs7(Text7, { children: [
-          /* @__PURE__ */ jsx7(Text7, { color: cur.kind === "alert-add-email" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add-email" }) }),
+        ] });
+      case "alert":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          onOff(r.rule.enabled),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: (" " + SIGNAL_LABEL[r.rule.signal]).padEnd(13) }),
+          /* @__PURE__ */ jsx7(Text7, { children: `\u2265${r.rule.threshold}/${winLabel(r.rule.windowSeconds)} `.padEnd(11) }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.accent, children: truncate(chanOf(r.rule), cols - 34) })
+        ] });
+      case "alert-add-email":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add email alert (enter)" })
-        ] }) : null,
-        inWindow({ kind: "alert-add-tg" }) ? /* @__PURE__ */ jsxs7(Text7, { children: [
-          /* @__PURE__ */ jsx7(Text7, { color: cur.kind === "alert-add-tg" && focused ? theme.accentBright : theme.dim, children: mark({ kind: "alert-add-tg" }) }),
-          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add telegram alert (enter \u2014 numeric chat id, get it from @userinfobot)" })
-        ] }) : null
-      ] })
-    ] })
+        ] });
+      case "alert-add-tg":
+        return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "+ add telegram alert (enter \u2014 numeric chat id from @userinfobot)" })
+        ] });
+    }
+  };
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const SECTION_DESC = {
+    ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
+    PROTECTION: "guard hook version + self-protection toggle",
+    "LOCAL LOGS": "mirror every decision to a file + dashboard link",
+    WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
+    ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 t tests`
+  };
+  const lineEls = [];
+  const lineKey = [];
+  let lastSec = "";
+  rowsAll.forEach((r) => {
+    const sec = sectionOf(r);
+    if (sec !== lastSec) {
+      lastSec = sec;
+      lineEls.push(
+        /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx7(Text7, { bold: true, color: theme.accentBright, children: sec }),
+          /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  \u2014 " + SECTION_DESC[sec] })
+        ] }, "h:" + sec)
+      );
+      lineKey.push("");
+    }
+    lineEls.push(/* @__PURE__ */ jsx7(Box7, { children: rowLine(r) }, keyOf(r)));
+    lineKey.push(keyOf(r));
+  });
+  if (hasEmailAlert && hasTgAlert) {
+    lineEls.push(
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "  both channels in use \u2014 remove one (d) to change it" }, "both-note")
+    );
+    lineKey.push("");
+  }
+  const budget = Math.max(4, rows - 2);
+  const selLine = Math.max(0, lineKey.indexOf(keyOf(cur)));
+  const maxStart = Math.max(0, lineEls.length - budget);
+  const startL = Math.min(Math.max(0, selLine - Math.floor(budget / 2)), maxStart);
+  const win = lineEls.slice(startL, startL + budget);
+  const moreAbove = startL;
+  const moreBelow = Math.max(0, lineEls.length - (startL + budget));
+  return /* @__PURE__ */ jsx7(DataView, { loading, error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: theme.dim, children: focused ? `\u2191\u2193 move \xB7 enter act \xB7 m toggle \xB7 t test \xB7 e edit \xB7 x remove \xB7 d delete \xB7 n add${moreAbove ? ` \xB7 \u25B2${moreAbove}` : ""}${moreBelow ? ` \xB7 \u25BC${moreBelow}` : ""}` : "press \u2192 to configure" }),
+    editing ? /* @__PURE__ */ jsxs7(Box7, { children: [
+      /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: editing === "path" ? "local log path: " : "webhook url: " }),
+      /* @__PURE__ */ jsx7(TextInput5, { value: input, onChange: setInput, onSubmit: submitInput })
+    ] }) : msg ? /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate(msg.text, cols) }) : login?.msg ? /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", color: login.phase === "error" ? theme.bad : theme.ok, children: login.msg }) : /* @__PURE__ */ jsx7(Text7, { children: " " }),
+    /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", height: budget, overflow: "hidden", children: win })
   ] }) });
 }
 
@@ -3796,24 +3985,29 @@ function App() {
   }
   const Panel = current.Panel;
   const panelBody = current.label === "Settings" ? /* @__PURE__ */ jsx8(SettingsPanel, { active: true, focused: focus === "panel", viewApiKey: viewKey, onView: viewAccount }) : /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" });
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows, paddingX: 1, paddingTop: 1, children: [
-    /* @__PURE__ */ jsx8(Banner, { cols }),
-    /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-      /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
-      /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
-      locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-      update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
-    ] }),
-    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
-      /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {
-        const isCur = i === effectiveSection;
-        const disabled = locked && s.label !== "Settings";
-        return /* @__PURE__ */ jsx8(Text8, { color: isCur ? theme.accentBright : disabled ? theme.dim : void 0, bold: isCur, dimColor: disabled, children: (isCur ? "\u25B8 " : disabled ? "\u2298 " : "  ") + s.label }, s.label);
-      }) }),
-      /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, children: panelBody })
-    ] }, viewNonce),
-    /* @__PURE__ */ jsx8(Box8, { children: locked ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2192/enter", "open Settings"], ["n", "log in"], ["q", "quit"]] }) : focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ...accounts.length > 1 ? [["a", "account"]] : [], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
-  ] });
+  return (
+    // height rows-1 (not rows): once total output reaches stdout.rows ink stops
+    // diffing and clearTerminal-repaints every frame, which slides the banner.
+    // overflow hidden makes it a hard guarantee even if a panel over-renders.
+    /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", width: cols, height: rows - 1, paddingX: 1, paddingTop: 1, overflow: "hidden", children: [
+      /* @__PURE__ */ jsx8(Banner, { cols }),
+      /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "account: " }),
+        /* @__PURE__ */ jsx8(Text8, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
+        locked ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "  \xB7 Settings to add another" }),
+        update2.kind === "updating" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx8(Text8, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \u2014 restart (q, then solongate) to apply` }) : update2.kind === "manual" ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \u2191 v${update2.version} available \u2014 npm i -g @solongate/proxy@latest` }) : null
+      ] }),
+      /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexGrow: 1, children: [
+        /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {
+          const isCur = i === effectiveSection;
+          const disabled = locked && s.label !== "Settings";
+          return /* @__PURE__ */ jsx8(Text8, { color: isCur ? theme.accentBright : disabled ? theme.dim : void 0, bold: isCur, dimColor: disabled, children: (isCur ? "\u25B8 " : disabled ? "\u2298 " : "  ") + s.label }, s.label);
+        }) }),
+        /* @__PURE__ */ jsx8(Box8, { flexGrow: 1, borderStyle: "round", borderColor: focus === "panel" ? theme.accent : "gray", paddingX: 1, paddingY: 0, overflow: "hidden", children: panelBody })
+      ] }, viewNonce),
+      /* @__PURE__ */ jsx8(Box8, { children: locked ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2192/enter", "open Settings"], ["n", "log in"], ["q", "quit"]] }) : focus === "nav" ? /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2191\u2193", "section"], ["\u2192/enter", "open"], ...accounts.length > 1 ? [["a", "account"]] : [], ["?", "help"], ["q", "quit"]] }) : /* @__PURE__ */ jsx8(KeyHints, { hints: [["\u2190/esc", "back"], ["\u2191\u2193", "in-panel"], ["space/s", "act"]] }) })
+    ] })
+  );
 }
 var HELP = [
   ["Global", [["\u2191\u2193", "move between sections"], ["\u2192 / enter", "open a section"], ["\u2190 / esc", "back to the menu"], ["?", "this help"], ["q", "quit"]]],