@solongate/proxy 0.81.69 → 0.81.70

package/dist/index.js

@@ -6934,6 +6934,39 @@ var init_theme = __esm({
 // src/tui/components.tsx
 import { Box, Text } from "ink";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function PaneTitle({ label, extra, width: width2 }) {
+  const tail = extra ? ` ${extra} ` : " ";
+  const used = 2 + 1 + label.length + tail.length;
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
+      "\u258E",
+      label
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
+  ] });
+}
+function StreamLine({ e, loc, selected }) {
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+      "[",
+      hhmmss(e.at),
+      " "
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
+    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
+    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
+    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
+    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
+    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
+  ] });
+}
 function DataView({
   loading,
   error,
@@ -6968,10 +7001,15 @@ function KeyHints({ hints }) {
     i < hints.length - 1 ? "   " : ""
   ] }, i)) });
 }
+var hhmmss;
 var init_components = __esm({
   "src/tui/components.tsx"() {
     "use strict";
     init_theme();
+    hhmmss = (ts) => {
+      const d = new Date(ts);
+      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
+    };
   }
 });
 
@@ -7804,39 +7842,6 @@ function HBar({ label, value, max, width: width2, color }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " " + value })
   ] });
 }
-function PaneTitle({ label, extra, width: width2 }) {
-  const tail = extra ? ` ${extra} ` : " ";
-  const used = 2 + 1 + label.length + tail.length;
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "\u2500 " }),
-    /* @__PURE__ */ jsxs2(Text2, { color: theme.accentBright, bold: true, children: [
-      "\u258E",
-      label
-    ] }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
-  ] });
-}
-function StreamLine({ e, loc, selected }) {
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
-    /* @__PURE__ */ jsx2(Text2, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
-    /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-      "[",
-      hhmmss(e.at),
-      " "
-    ] }),
-    /* @__PURE__ */ jsx2(Text2, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
-    /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
-    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
-  ] });
-}
 function LivePanel({ active: active2 }) {
   const [s, setS] = useState2(null);
   const [lat, setLat] = useState2([]);
@@ -8725,7 +8730,7 @@ function LivePanel({ active: active2 }) {
     ] })
   ] });
 }
-var CONFIG, SPIN, BG, DIM_FLOOR, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
+var CONFIG, SPIN, BG, DIM_FLOOR, RING, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
 var init_Live = __esm({
   "src/tui/panels/Live.tsx"() {
     "use strict";
@@ -8734,16 +8739,13 @@ var init_Live = __esm({
     init_config2();
     init_notify();
     init_hooks();
+    init_components();
     init_theme();
     CONFIG = loadConfig();
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
     RING = join9(process.cwd(), ".solongate", ".eval-ring.jsonl");
-    hhmmss = (ts) => {
-      const d = new Date(ts);
-      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
-    };
     fmtUp = (ms) => {
       const s = Math.floor(ms / 1e3);
       const p = (n) => String(n).padStart(2, "0");
@@ -9433,7 +9435,7 @@ import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir8 } from "os";
 import { join as join10 } from "path";
 import { useState as useState6 } from "react";
-import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function loadLocalRows() {
   return parseLocalLines(tailLines(LOCAL_LOG, LOCAL_MAX_BYTES)).map((j, i) => {
     const rs = reasonSignals(j.reason);
@@ -9553,10 +9555,6 @@ function AuditPanel({ active: active2, focused }) {
   const sq = sessSearch.trim().toLowerCase();
   const sessionsFiltered = sessions.map((s) => ({ ...s, status: source === "cloud" ? s.status : sessStatus2(s.lastAt) })).filter((s) => SESS_STATUS[si] ? s.status === SESS_STATUS[si] : true).filter((s) => !sq || `${s.agent} ${s.id}`.toLowerCase().includes(sq)).sort((a, b) => b.lastAt - a.lastAt);
   const currentSess = sessionsFiltered[Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1))];
-  const sessionQ = useLoader(
-    () => view === "detail" && current?.session && source === "cloud" ? api.audit.list({ session_id: current.session, limit: 40 }) : Promise.resolve(null),
-    [view, current?.session, source]
-  );
   const logsLoading = (source === "cloud" ? cloudQ.loading : localQ.loading) && !editing;
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
@@ -9782,61 +9780,56 @@ function AuditPanel({ active: active2, focused }) {
     ] });
   }
   if (view === "detail" && current) {
-    const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
-    const bodyW = Math.max(20, cols - 2);
-    const reasonLines = wrapLines("reason: " + (current.reason ?? "\u2014"), bodyW);
-    const argLines = current.args ? wrapLines(prettyJson(current.args), bodyW) : ["(no arguments recorded)"];
-    const sessionRows = current.session ? Math.min(4, sessionCalls.length) + 2 : 1;
-    const reasonShown = reasonLines.slice(0, 4);
-    const argBudget = Math.max(3, rows - 2 - 5 - reasonShown.length - 1 - sessionRows - 1 - (frozen ? 1 : 0));
-    const maxScroll = Math.max(0, argLines.length - argBudget);
+    const e = current;
+    const loc = source === "local";
+    const bodyW = Math.max(20, cols - 4);
+    const innerW = cols - 2;
+    const contentLines = [];
+    if (e.reason && e.decision !== "ALLOW") contentLines.push(...wrapLines("reason: " + e.reason, bodyW), "");
+    const argsText = e.args ? prettyJson(e.args) : e.reason && e.decision === "ALLOW" ? e.reason : "(no arguments recorded)";
+    contentLines.push(...wrapLines(argsText, bodyW));
+    const bodyRows = Math.max(4, rows - 7 - (frozen ? 1 : 0));
+    const maxScroll = Math.max(0, contentLines.length - bodyRows);
     const off = Math.min(detailScroll, maxScroll);
-    const argWin = argLines.slice(off, off + argBudget);
+    const win = contentLines.slice(off, off + bodyRows);
     return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
       copyBanner,
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(current.decision), bold: true, children: current.decision }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: "  " + current.tool }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust + "  " }),
-        srcChip
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
+        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(e.decision), bold: true, children: "  " + e.decision }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, bold: true, children: "  " + e.tool }),
+        /* @__PURE__ */ jsx6(Text6, { color: loc ? theme.ok : "white", children: "  " + (loc ? "LOC" : "CLD") }),
+        e.dlp.length ? /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: "  DLP!" }) : null,
+        e.burst ? /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "  BURST" }) : null,
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  \u2190 back" })
       ] }),
-      reasonShown.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs6(Fragment4, { children: [
-        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "reason   " }),
-        /* @__PURE__ */ jsx6(Text6, { children: l.slice("reason: ".length) })
-      ] }) : /* @__PURE__ */ jsx6(Text6, { children: "         " + l }) }, "r" + i)),
-      /* @__PURE__ */ jsx6(Detail, { label: "rule", value: current.rule ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "agent", value: current.agent ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "session", value: current.session ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "dlp", value: current.dlp.length ? current.dlp.join(", ") : "none", color: current.dlp.length ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx6(Detail, { label: "ratelimit", value: current.burst ? "BURST \u2014 over the limit for this agent" : "no", color: current.burst ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx6(Detail, { label: "when", value: new Date(current.at).toLocaleString() + (current.evalMs != null ? ` \xB7 eval ${current.evalMs}ms` : "") }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
-      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
-      current.session ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-          "Session \xB7 ",
-          sessionCalls.length,
-          " calls"
-        ] }),
-        /* @__PURE__ */ jsx6(
-          Table,
-          {
-            columns: [
-              { header: "DECISION", width: 9 },
-              { header: "TOOL", width: 20 },
-              { header: "REASON", width: Math.max(16, cols - 48) },
-              { header: "WHEN", width: 6 }
-            ],
-            rows: sessionCalls.slice(0, Math.max(1, sessionRows - 2)).map((e) => [
-              { value: e.decision, color: decisionColor(e.decision) },
-              { value: truncate2(e.tool, 20), color: theme.accent },
-              { value: truncate2(e.reason ?? "\u2014", Math.max(16, cols - 48)) },
-              { value: ago(e.at), dim: true }
-            ])
-          }
-        )
-      ] }) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "(no session id)" }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to logs" })
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2502 when " }),
+        /* @__PURE__ */ jsx6(Text6, { children: new Date(e.at).toLocaleString() }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 perm " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.permission || "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 trust " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.trust || "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 eval " }),
+        /* @__PURE__ */ jsx6(Text6, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : void 0, children: e.evalMs != null ? `${e.evalMs}ms` : "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 agent " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.agent ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2502 session " }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: e.session ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 rule " }),
+        /* @__PURE__ */ jsx6(Text6, { color: e.rule && e.decision !== "ALLOW" ? theme.bad : theme.dim, children: e.rule ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsx6(PaneTitle, { label: "FULL CONTENT", extra: `${contentLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""} \xB7 space copy \xB7 \u2190 back`, width: innerW }),
+      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: bodyRows, overflow: "hidden", children: win.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: "#0b1530", color: "white", children: ` ${e.id} ` }),
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", children: " \u2191\u2193 scroll \xB7 space copy \xB7 ? all keys \xB7 \u2190 back \xB7 esc menu " })
+      ] })
     ] });
   }
   const chip = (label, val, on) => /* @__PURE__ */ jsxs6(Text6, { children: [
@@ -9923,7 +9916,6 @@ function AuditPanel({ active: active2, focused }) {
   const maxStart = Math.max(0, pageRows.length - listRows);
   const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
   const windowed = pageRows.slice(start, start + listRows);
-  const reasonW = Math.min(58, Math.max(12, cols - 71));
   return /* @__PURE__ */ jsx6(DataView, { loading: logsLoading && !frozen, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
     strip,
     copyBanner,
@@ -9959,21 +9951,7 @@ function AuditPanel({ active: active2, focused }) {
       )
     ] }) : null,
     /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
-    /* @__PURE__ */ jsx6(
-      Table,
-      {
-        columns: [
-          { header: "", width: 2 },
-          { header: "DECISION", width: 9 },
-          { header: "TOOL", width: 18 },
-          { header: "AGENT", width: 14 },
-          { header: "REASON", width: reasonW },
-          { header: "SIGNAL", width: 8 },
-          { header: "WHEN", width: 6 }
-        ],
-        rows: windowed.map((e, i) => rowFor(e, start + i === selClamped && focused, reasonW))
-      }
-    ),
+    /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", overflow: "hidden", children: windowed.map((e, i) => /* @__PURE__ */ jsx6(StreamLine, { e: toStream(e), loc: source === "local", selected: start + i === selClamped && focused }, e.id)) }),
     pageRows.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
       "(no entries",
       source === "local" ? " in the local file" : "",
@@ -9981,25 +9959,7 @@ function AuditPanel({ active: active2, focused }) {
     ] }) : null
   ] }) });
 }
-function rowFor(e, active2, reasonW) {
-  const sig = [e.dlp.length ? `DLP${e.dlp.length > 1 ? e.dlp.length : ""}` : "", e.burst ? "RL" : ""].filter(Boolean).join(" ");
-  return [
-    { value: active2 ? "\u25B8" : "", color: theme.accentBright },
-    { value: e.decision, color: decisionColor(e.decision) },
-    { value: truncate2(e.tool, 18), color: theme.accent },
-    { value: truncate2(e.agent ?? "\u2014", 14), dim: true },
-    { value: truncate2(e.reason ?? e.args ?? "\u2014", reasonW) },
-    { value: sig || "\xB7", color: sig ? theme.bad : void 0, dim: !sig },
-    { value: ago(e.at), dim: true }
-  ];
-}
-function Detail({ label, value, color }) {
-  return /* @__PURE__ */ jsxs6(Box6, { children: [
-    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx6(Text6, { color, wrap: "truncate", children: value })
-  ] });
-}
-var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
+var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, BG2, toStream, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
 var init_Audit = __esm({
   "src/tui/panels/Audit.tsx"() {
     "use strict";
@@ -10013,6 +9973,19 @@ var init_Audit = __esm({
     SESS_STATUS = [void 0, "active", "idle", "ended"];
     PAGE = 500;
     LOCAL_MAX_BYTES = 16 * 1024 * 1024;
+    BG2 = "#12234f";
+    toStream = (e) => ({
+      at: e.at,
+      tool: e.tool,
+      decision: e.decision,
+      permission: (e.permission ?? "").slice(0, 4),
+      detail: (e.args ?? e.reason ?? "").replace(/\s+/g, " "),
+      dlp: e.dlp.length > 0,
+      burst: e.burst,
+      agent: e.agent,
+      evalMs: e.evalMs,
+      rule: e.rule
+    });
     cloudRow = (e) => {
       const rs = reasonSignals(e.reason);
       return {
@@ -10070,7 +10043,7 @@ var init_Audit = __esm({
           ["esc", "back to the menu"]
         ]
       ],
-      ["Entry detail", [["\u2191\u2193 / PgUp PgDn", "scroll the arguments"], ["\u2190 / esc", "back to the list"]]]
+      ["Entry (full content)", [["\u2191\u2193 / PgUp PgDn", "scroll the reason + arguments"], ["space", "copy mode (freeze, then select)"], ["\u2190 / esc", "back to the list"]]]
     ];
     sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
     STATUS_DOT = {
@@ -10081,11 +10054,263 @@ var init_Audit = __esm({
   }
 });
 
+// src/global-install.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync4, mkdirSync as mkdirSync8, rmSync as rmSync2 } from "fs";
+import { resolve as resolve4, join as join11, dirname as dirname3 } from "path";
+import { homedir as homedir9 } from "os";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { createInterface } from "readline";
+import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function unlockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join11(p.hooksDir, "guard.mjs"),
+    join11(p.hooksDir, "audit.mjs"),
+    join11(p.hooksDir, "stop.mjs"),
+    join11(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath
+  ];
+}
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
+}
+function globalPaths() {
+  const home = homedir9();
+  const sgDir = join11(home, ".solongate");
+  const hooksDir = join11(sgDir, "hooks");
+  const claudeDir = join11(home, ".claude");
+  return {
+    home,
+    sgDir,
+    hooksDir,
+    claudeDir,
+    settingsPath: join11(claudeDir, "settings.json"),
+    backupPath: join11(claudeDir, "settings.solongate.bak"),
+    configPath: join11(sgDir, "cloud-guard.json")
+  };
+}
+function clearGuardUpdateCheck() {
+  try {
+    rmSync2(join11(globalPaths().sgDir, ".hook-update-check"), { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readHook(filename) {
+  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
+}
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((res) => rl.question(question, (a) => {
+    rl.close();
+    res(a.trim());
+  }));
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    if (process.platform === "win32") {
+      const low = (s) => s.toLowerCase();
+      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
+    }
+    return out2[0] || null;
+  } catch {
+    return null;
+  }
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join11(homedir9(), f)).filter((f) => existsSync4(f));
+}
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync4(file) ? readFileSync9(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
+  }
+  mkdirSync8(dirname3(file), { recursive: true });
+  writeFileSync9(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block2 = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) return;
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block2);
+    } catch {
+    }
+  }
+}
+async function runGlobalInstall2(opts = {}) {
+  const p = globalPaths();
+  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    try {
+      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
+    } catch {
+    }
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
+  }
+  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
+    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
+    process.exit(1);
+  }
+  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+  mkdirSync8(p.hooksDir, { recursive: true });
+  mkdirSync8(p.claudeDir, { recursive: true });
+  unlockProtected();
+  writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join11(p.hooksDir, "shield.mjs"));
+  writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  console.log(`  Wrote ${p.configPath}`);
+  let existing = {};
+  if (existsSync4(p.settingsPath)) {
+    const raw = readFileSync9(p.settingsPath, "utf-8");
+    if (!existsSync4(p.backupPath)) {
+      writeFileSync9(p.backupPath, raw);
+      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
+    }
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+  }
+  const guardAbs = join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join11(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join11(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
+  const merged = {
+    ...existing,
+    hooks: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
+      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
+    }
+  };
+  writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
+  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+    lockProtected();
+    console.log("  Locked protection files (OS-level read-only/immutable).");
+  }
+}
+var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
+var init_global_install = __esm({
+  "src/global-install.ts"() {
+    "use strict";
+    __dirname = dirname3(fileURLToPath3(import.meta.url));
+    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
+  }
+});
+
 // src/tui/panels/Settings.tsx
 import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import TextInput5 from "ink-text-input";
 import { useEffect as useEffect6, useRef as useRef3, useState as useState7 } from "react";
-import { Fragment as Fragment5, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 function SettingsPanel({
   active: active2,
   focused,
@@ -10249,6 +10474,16 @@ function SettingsPanel({
       setMsg({ text: `viewing ${acctLabel(r.acc)}`, level: "ok" });
     } else if (r.kind === "acct-add") {
       beginLogin();
+    } else if (r.kind === "guard") {
+      if (!guard) return;
+      if (guard.up_to_date) {
+        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
+        return;
+      }
+      const armed = clearGuardUpdateCheck();
+      setMsg(
+        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
+      );
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -10487,9 +10722,9 @@ function SettingsPanel({
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
           cursor(r),
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
-          guard ? /* @__PURE__ */ jsxs7(Fragment5, { children: [
+          guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter to update` }),
             /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""}` })
           ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
         ] });
@@ -10555,7 +10790,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook version + self-protection toggle",
+    PROTECTION: "guard hook version (enter to update) + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -10617,6 +10852,7 @@ var init_Settings = __esm({
     init_api_client();
     init_client();
     init_device_login();
+    init_global_install();
     init_logs_server_daemon();
     init_components();
     init_hooks();
@@ -10834,9 +11070,9 @@ var tui_exports = {};
 __export(tui_exports, {
   launchTui: () => launchTui
 });
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync8 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join11 } from "path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join12 } from "path";
 import { render } from "ink";
 import { jsx as jsx9 } from "react/jsx-runtime";
 async function launchTui() {
@@ -10847,11 +11083,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join11(homedir9(), ".solongate", "dataroom-debug.log");
+  const debugLog = join12(homedir10(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync8(join11(homedir9(), ".solongate"), { recursive: true });
+      mkdirSync9(join12(homedir10(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -10975,7 +11211,7 @@ var init_args = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 async function run(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -11150,7 +11386,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync9(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -11565,9 +11801,9 @@ var init_agents2 = __esm({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -11597,7 +11833,7 @@ async function run6(argv) {
     } catch {
     }
   }
-  if (existsSync4(LOCAL_LOG2)) {
+  if (existsSync5(LOCAL_LOG2)) {
     const st = statSync2(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
@@ -11627,14 +11863,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join12(homedir10(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join13(homedir11(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync4, readSync as readSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync6, openSync as openSync4, readSync as readSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join14 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -11678,7 +11914,7 @@ async function run7(argv) {
     for (const r of rows) if (keep(r)) print(r, json);
   };
   const pollLocal = () => {
-    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    if (cloudOnly || !existsSync6(LOCAL_LOG3)) return;
     const rows = [];
     for (const line of tailLocal(LOCAL_LOG3)) {
       try {
@@ -11741,7 +11977,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join13(homedir11(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join14(homedir12(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -12031,250 +12267,6 @@ var init_commands = __esm({
   }
 });
 
-// src/global-install.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync9, existsSync as existsSync6, mkdirSync as mkdirSync9 } from "fs";
-import { resolve as resolve4, join as join14, dirname as dirname3 } from "path";
-import { homedir as homedir12 } from "os";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
-function lockFile(file) {
-  if (!existsSync6(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync6(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join14(p.hooksDir, "guard.mjs"),
-    join14(p.hooksDir, "audit.mjs"),
-    join14(p.hooksDir, "stop.mjs"),
-    join14(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir12();
-  const sgDir = join14(home, ".solongate");
-  const hooksDir = join14(sgDir, "hooks");
-  const claudeDir = join14(home, ".claude");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    settingsPath: join14(claudeDir, "settings.json"),
-    backupPath: join14(claudeDir, "settings.solongate.bak"),
-    configPath: join14(sgDir, "cloud-guard.json")
-  };
-}
-function readHook(filename) {
-  return readFileSync10(join14(HOOKS_DIR, filename), "utf-8");
-}
-function readGuard() {
-  const bundled = join14(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync6(bundled) ? readFileSync10(bundled, "utf-8") : readHook("guard.mjs");
-}
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => rl.question(question, (a) => {
-    rl.close();
-    res(a.trim());
-  }));
-}
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function resolveRealClaude() {
-  try {
-    const finder = process.platform === "win32" ? "where" : "which";
-    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    if (process.platform === "win32") {
-      const low = (s) => s.toLowerCase();
-      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
-    }
-    return out2[0] || null;
-  } catch {
-    return null;
-  }
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join14(homedir12(), f)).filter((f) => existsSync6(f));
-}
-function writeShimBlock(file, block2) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync6(file) ? readFileSync10(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block2) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block2 + "\n";
-  }
-  mkdirSync9(dirname3(file), { recursive: true });
-  writeFileSync9(file, content);
-}
-function installClaudeShim(shieldPath) {
-  const real = resolveRealClaude();
-  if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
-    return;
-  }
-  const node = process.execPath.replace(/\\/g, "/");
-  const shield = shieldPath.replace(/\\/g, "/");
-  const win = process.platform === "win32";
-  const block2 = win ? `${SHIM_BEGIN}
-function claude { & "${node}" "${shield}" -- "${real}" @args }
-${SHIM_END}` : `${SHIM_BEGIN}
-claude() { "${node}" "${shield}" -- "${real}" "$@"; }
-${SHIM_END}`;
-  const targets = shimTargets();
-  if (targets.length === 0) return;
-  for (const file of targets) {
-    try {
-      writeShimBlock(file, block2);
-    } catch {
-    }
-  }
-}
-async function runGlobalInstall2(opts = {}) {
-  const p = globalPaths();
-  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    try {
-      const cfg = JSON.parse(readFileSync10(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
-    } catch {
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync9(p.hooksDir, { recursive: true });
-  mkdirSync9(p.claudeDir, { recursive: true });
-  unlockProtected();
-  writeFileSync9(join14(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync9(join14(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync9(join14(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync9(join14(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join14(p.hooksDir, "shield.mjs"));
-  writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-  console.log(`  Wrote ${p.configPath}`);
-  let existing = {};
-  if (existsSync6(p.settingsPath)) {
-    const raw = readFileSync10(p.settingsPath, "utf-8");
-    if (!existsSync6(p.backupPath)) {
-      writeFileSync9(p.backupPath, raw);
-      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
-    }
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const guardAbs = join14(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join14(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join14(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
-  const merged = {
-    ...existing,
-    hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
-      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
-    }
-  };
-  writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
-    lockProtected();
-    console.log("  Locked protection files (OS-level read-only/immutable).");
-  }
-}
-var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
-var init_global_install = __esm({
-  "src/global-install.ts"() {
-    "use strict";
-    __dirname = dirname3(fileURLToPath3(import.meta.url));
-    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
-    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-    SHIM_END = "# <<< SolonGate shield <<<";
-  }
-});
-
 // src/login.ts
 var login_exports = {};
 import { spawn as spawn5 } from "child_process";