@solongate/proxy 0.81.69 → 0.81.71

package/dist/index.js

@@ -6934,6 +6934,39 @@ var init_theme = __esm({
 // src/tui/components.tsx
 import { Box, Text } from "ink";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function PaneTitle({ label, extra, width: width2 }) {
+  const tail = extra ? ` ${extra} ` : " ";
+  const used = 2 + 1 + label.length + tail.length;
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
+      "\u258E",
+      label
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
+  ] });
+}
+function StreamLine({ e, loc, selected }) {
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+      "[",
+      hhmmss(e.at),
+      " "
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
+    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
+    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
+    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
+    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
+    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
+  ] });
+}
 function DataView({
   loading,
   error,
@@ -6968,10 +7001,15 @@ function KeyHints({ hints }) {
     i < hints.length - 1 ? "   " : ""
   ] }, i)) });
 }
+var hhmmss;
 var init_components = __esm({
   "src/tui/components.tsx"() {
     "use strict";
     init_theme();
+    hhmmss = (ts) => {
+      const d = new Date(ts);
+      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
+    };
   }
 });
 
@@ -7130,6 +7168,28 @@ function setActiveAccount(creds) {
     return false;
   }
 }
+function clearActiveCredential() {
+  try {
+    const p = join8(homedir6(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync3(p)) {
+      cached2 = null;
+      return true;
+    }
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync8(p, "utf-8"));
+    } catch {
+    }
+    delete existing.apiKey;
+    delete existing.apiUrl;
+    writeFileSync6(p, JSON.stringify(existing, null, 2));
+    cached2 = null;
+    viewOverride = null;
+    return true;
+  } catch {
+    return false;
+  }
+}
 function loginCredentialFile() {
   try {
     const p = join8(homedir6(), ".solongate", "cloud-guard.json");
@@ -7804,39 +7864,6 @@ function HBar({ label, value, max, width: width2, color }) {
     /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " " + value })
   ] });
 }
-function PaneTitle({ label, extra, width: width2 }) {
-  const tail = extra ? ` ${extra} ` : " ";
-  const used = 2 + 1 + label.length + tail.length;
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "\u2500 " }),
-    /* @__PURE__ */ jsxs2(Text2, { color: theme.accentBright, bold: true, children: [
-      "\u258E",
-      label
-    ] }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
-  ] });
-}
-function StreamLine({ e, loc, selected }) {
-  return /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
-    /* @__PURE__ */ jsx2(Text2, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
-    /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
-      "[",
-      hhmmss(e.at),
-      " "
-    ] }),
-    /* @__PURE__ */ jsx2(Text2, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "] " }),
-    /* @__PURE__ */ jsx2(Text2, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.permission.padEnd(5) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
-    /* @__PURE__ */ jsx2(Text2, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
-    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx2(Text2, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
-    /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: e.detail })
-  ] });
-}
 function LivePanel({ active: active2 }) {
   const [s, setS] = useState2(null);
   const [lat, setLat] = useState2([]);
@@ -8725,7 +8752,7 @@ function LivePanel({ active: active2 }) {
     ] })
   ] });
 }
-var CONFIG, SPIN, BG, DIM_FLOOR, RING, hhmmss, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
+var CONFIG, SPIN, BG, DIM_FLOOR, RING, fmtUp, FILTERS, sessStatus, STATUS_STYLE, LIVE_HELP;
 var init_Live = __esm({
   "src/tui/panels/Live.tsx"() {
     "use strict";
@@ -8734,16 +8761,13 @@ var init_Live = __esm({
     init_config2();
     init_notify();
     init_hooks();
+    init_components();
     init_theme();
     CONFIG = loadConfig();
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
     RING = join9(process.cwd(), ".solongate", ".eval-ring.jsonl");
-    hhmmss = (ts) => {
-      const d = new Date(ts);
-      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
-    };
     fmtUp = (ms) => {
       const s = Math.floor(ms / 1e3);
       const p = (n) => String(n).padStart(2, "0");
@@ -9433,7 +9457,7 @@ import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir8 } from "os";
 import { join as join10 } from "path";
 import { useState as useState6 } from "react";
-import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 function loadLocalRows() {
   return parseLocalLines(tailLines(LOCAL_LOG, LOCAL_MAX_BYTES)).map((j, i) => {
     const rs = reasonSignals(j.reason);
@@ -9553,10 +9577,6 @@ function AuditPanel({ active: active2, focused }) {
   const sq = sessSearch.trim().toLowerCase();
   const sessionsFiltered = sessions.map((s) => ({ ...s, status: source === "cloud" ? s.status : sessStatus2(s.lastAt) })).filter((s) => SESS_STATUS[si] ? s.status === SESS_STATUS[si] : true).filter((s) => !sq || `${s.agent} ${s.id}`.toLowerCase().includes(sq)).sort((a, b) => b.lastAt - a.lastAt);
   const currentSess = sessionsFiltered[Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1))];
-  const sessionQ = useLoader(
-    () => view === "detail" && current?.session && source === "cloud" ? api.audit.list({ session_id: current.session, limit: 40 }) : Promise.resolve(null),
-    [view, current?.session, source]
-  );
   const logsLoading = (source === "cloud" ? cloudQ.loading : localQ.loading) && !editing;
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
@@ -9782,61 +9802,56 @@ function AuditPanel({ active: active2, focused }) {
     ] });
   }
   if (view === "detail" && current) {
-    const sessionCalls = source === "cloud" ? (sessionQ.data?.entries ?? []).map(cloudRow) : localAll.filter((r) => r.session && r.session === current.session).slice(0, 40);
-    const bodyW = Math.max(20, cols - 2);
-    const reasonLines = wrapLines("reason: " + (current.reason ?? "\u2014"), bodyW);
-    const argLines = current.args ? wrapLines(prettyJson(current.args), bodyW) : ["(no arguments recorded)"];
-    const sessionRows = current.session ? Math.min(4, sessionCalls.length) + 2 : 1;
-    const reasonShown = reasonLines.slice(0, 4);
-    const argBudget = Math.max(3, rows - 2 - 5 - reasonShown.length - 1 - sessionRows - 1 - (frozen ? 1 : 0));
-    const maxScroll = Math.max(0, argLines.length - argBudget);
+    const e = current;
+    const loc = source === "local";
+    const bodyW = Math.max(20, cols - 4);
+    const innerW = cols - 2;
+    const contentLines = [];
+    if (e.reason && e.decision !== "ALLOW") contentLines.push(...wrapLines("reason: " + e.reason, bodyW), "");
+    const argsText = e.args ? prettyJson(e.args) : e.reason && e.decision === "ALLOW" ? e.reason : "(no arguments recorded)";
+    contentLines.push(...wrapLines(argsText, bodyW));
+    const bodyRows = Math.max(4, rows - 7 - (frozen ? 1 : 0));
+    const maxScroll = Math.max(0, contentLines.length - bodyRows);
     const off = Math.min(detailScroll, maxScroll);
-    const argWin = argLines.slice(off, off + argBudget);
+    const win = contentLines.slice(off, off + bodyRows);
     return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
       copyBanner,
-      /* @__PURE__ */ jsxs6(Box6, { children: [
-        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(current.decision), bold: true, children: current.decision }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, children: "  " + current.tool }),
-        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  " + current.permission + " \xB7 " + current.trust + "  " }),
-        srcChip
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
+        /* @__PURE__ */ jsx6(Text6, { color: decisionColor(e.decision), bold: true, children: "  " + e.decision }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.accent, bold: true, children: "  " + e.tool }),
+        /* @__PURE__ */ jsx6(Text6, { color: loc ? theme.ok : "white", children: "  " + (loc ? "LOC" : "CLD") }),
+        e.dlp.length ? /* @__PURE__ */ jsx6(Text6, { color: theme.bad, children: "  DLP!" }) : null,
+        e.burst ? /* @__PURE__ */ jsx6(Text6, { color: theme.warn, children: "  BURST" }) : null,
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "  \u2190 back" })
       ] }),
-      reasonShown.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: i === 0 ? /* @__PURE__ */ jsxs6(Fragment4, { children: [
-        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "reason   " }),
-        /* @__PURE__ */ jsx6(Text6, { children: l.slice("reason: ".length) })
-      ] }) : /* @__PURE__ */ jsx6(Text6, { children: "         " + l }) }, "r" + i)),
-      /* @__PURE__ */ jsx6(Detail, { label: "rule", value: current.rule ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "agent", value: current.agent ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "session", value: current.session ?? "\u2014" }),
-      /* @__PURE__ */ jsx6(Detail, { label: "dlp", value: current.dlp.length ? current.dlp.join(", ") : "none", color: current.dlp.length ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx6(Detail, { label: "ratelimit", value: current.burst ? "BURST \u2014 over the limit for this agent" : "no", color: current.burst ? theme.bad : void 0 }),
-      /* @__PURE__ */ jsx6(Detail, { label: "when", value: new Date(current.at).toLocaleString() + (current.evalMs != null ? ` \xB7 eval ${current.evalMs}ms` : "") }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: `arguments \u2014 full \xB7 ${argLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""}` }),
-      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: argBudget, overflow: "hidden", children: argWin.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
-      current.session ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
-        /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
-          "Session \xB7 ",
-          sessionCalls.length,
-          " calls"
-        ] }),
-        /* @__PURE__ */ jsx6(
-          Table,
-          {
-            columns: [
-              { header: "DECISION", width: 9 },
-              { header: "TOOL", width: 20 },
-              { header: "REASON", width: Math.max(16, cols - 48) },
-              { header: "WHEN", width: 6 }
-            ],
-            rows: sessionCalls.slice(0, Math.max(1, sessionRows - 2)).map((e) => [
-              { value: e.decision, color: decisionColor(e.decision) },
-              { value: truncate2(e.tool, 20), color: theme.accent },
-              { value: truncate2(e.reason ?? "\u2014", Math.max(16, cols - 48)) },
-              { value: ago(e.at), dim: true }
-            ])
-          }
-        )
-      ] }) : /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "(no session id)" }),
-      /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2191\u2193 scroll arguments \xB7 \u2190/esc back to logs" })
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2502 when " }),
+        /* @__PURE__ */ jsx6(Text6, { children: new Date(e.at).toLocaleString() }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 perm " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.permission || "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 trust " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.trust || "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 eval " }),
+        /* @__PURE__ */ jsx6(Text6, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : void 0, children: e.evalMs != null ? `${e.evalMs}ms` : "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 agent " }),
+        /* @__PURE__ */ jsx6(Text6, { children: e.agent ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: "\u2502 session " }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: e.session ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502 rule " }),
+        /* @__PURE__ */ jsx6(Text6, { color: e.rule && e.decision !== "ALLOW" ? theme.bad : theme.dim, children: e.rule ?? "\u2014" }),
+        /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsx6(PaneTitle, { label: "FULL CONTENT", extra: `${contentLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""} \xB7 space copy \xB7 \u2190 back`, width: innerW }),
+      /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", height: bodyRows, overflow: "hidden", children: win.map((l, i) => /* @__PURE__ */ jsx6(Text6, { wrap: "truncate", children: l || " " }, off + i)) }),
+      /* @__PURE__ */ jsxs6(Text6, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: "#0b1530", color: "white", children: ` ${e.id} ` }),
+        /* @__PURE__ */ jsx6(Text6, { backgroundColor: BG2, color: "white", children: " \u2191\u2193 scroll \xB7 space copy \xB7 ? all keys \xB7 \u2190 back \xB7 esc menu " })
+      ] })
     ] });
   }
   const chip = (label, val, on) => /* @__PURE__ */ jsxs6(Text6, { children: [
@@ -9923,7 +9938,6 @@ function AuditPanel({ active: active2, focused }) {
   const maxStart = Math.max(0, pageRows.length - listRows);
   const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
   const windowed = pageRows.slice(start, start + listRows);
-  const reasonW = Math.min(58, Math.max(12, cols - 71));
   return /* @__PURE__ */ jsx6(DataView, { loading: logsLoading && !frozen, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
     strip,
     copyBanner,
@@ -9959,21 +9973,7 @@ function AuditPanel({ active: active2, focused }) {
       )
     ] }) : null,
     /* @__PURE__ */ jsx6(Text6, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
-    /* @__PURE__ */ jsx6(
-      Table,
-      {
-        columns: [
-          { header: "", width: 2 },
-          { header: "DECISION", width: 9 },
-          { header: "TOOL", width: 18 },
-          { header: "AGENT", width: 14 },
-          { header: "REASON", width: reasonW },
-          { header: "SIGNAL", width: 8 },
-          { header: "WHEN", width: 6 }
-        ],
-        rows: windowed.map((e, i) => rowFor(e, start + i === selClamped && focused, reasonW))
-      }
-    ),
+    /* @__PURE__ */ jsx6(Box6, { flexDirection: "column", overflow: "hidden", children: windowed.map((e, i) => /* @__PURE__ */ jsx6(StreamLine, { e: toStream(e), loc: source === "local", selected: start + i === selClamped && focused }, e.id)) }),
     pageRows.length === 0 ? /* @__PURE__ */ jsxs6(Text6, { color: theme.dim, children: [
       "(no entries",
       source === "local" ? " in the local file" : "",
@@ -9981,25 +9981,7 @@ function AuditPanel({ active: active2, focused }) {
     ] }) : null
   ] }) });
 }
-function rowFor(e, active2, reasonW) {
-  const sig = [e.dlp.length ? `DLP${e.dlp.length > 1 ? e.dlp.length : ""}` : "", e.burst ? "RL" : ""].filter(Boolean).join(" ");
-  return [
-    { value: active2 ? "\u25B8" : "", color: theme.accentBright },
-    { value: e.decision, color: decisionColor(e.decision) },
-    { value: truncate2(e.tool, 18), color: theme.accent },
-    { value: truncate2(e.agent ?? "\u2014", 14), dim: true },
-    { value: truncate2(e.reason ?? e.args ?? "\u2014", reasonW) },
-    { value: sig || "\xB7", color: sig ? theme.bad : void 0, dim: !sig },
-    { value: ago(e.at), dim: true }
-  ];
-}
-function Detail({ label, value, color }) {
-  return /* @__PURE__ */ jsxs6(Box6, { children: [
-    /* @__PURE__ */ jsx6(Text6, { color: theme.dim, children: label.padEnd(9) }),
-    /* @__PURE__ */ jsx6(Text6, { color, wrap: "truncate", children: value })
-  ] });
-}
-var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
+var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, BG2, toStream, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
 var init_Audit = __esm({
   "src/tui/panels/Audit.tsx"() {
     "use strict";
@@ -10013,6 +9995,19 @@ var init_Audit = __esm({
     SESS_STATUS = [void 0, "active", "idle", "ended"];
     PAGE = 500;
     LOCAL_MAX_BYTES = 16 * 1024 * 1024;
+    BG2 = "#12234f";
+    toStream = (e) => ({
+      at: e.at,
+      tool: e.tool,
+      decision: e.decision,
+      permission: (e.permission ?? "").slice(0, 4),
+      detail: (e.args ?? e.reason ?? "").replace(/\s+/g, " "),
+      dlp: e.dlp.length > 0,
+      burst: e.burst,
+      agent: e.agent,
+      evalMs: e.evalMs,
+      rule: e.rule
+    });
     cloudRow = (e) => {
       const rs = reasonSignals(e.reason);
       return {
@@ -10070,7 +10065,7 @@ var init_Audit = __esm({
           ["esc", "back to the menu"]
         ]
       ],
-      ["Entry detail", [["\u2191\u2193 / PgUp PgDn", "scroll the arguments"], ["\u2190 / esc", "back to the list"]]]
+      ["Entry (full content)", [["\u2191\u2193 / PgUp PgDn", "scroll the reason + arguments"], ["space", "copy mode (freeze, then select)"], ["\u2190 / esc", "back to the list"]]]
     ];
     sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
     STATUS_DOT = {
@@ -10081,174 +10076,437 @@ var init_Audit = __esm({
   }
 });
 
-// src/tui/panels/Settings.tsx
-import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
-import TextInput5 from "ink-text-input";
-import { useEffect as useEffect6, useRef as useRef3, useState as useState7 } from "react";
-import { Fragment as Fragment5, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
-function SettingsPanel({
-  active: active2,
-  focused,
-  viewApiKey,
-  onView
-}) {
-  void active2;
-  const { cols, rows } = usePanelSize();
-  const [sel, setSel] = useState7(0);
-  const [editing, setEditing] = useState7(null);
-  const [input, setInput] = useState7("");
-  const [confirmDel, setConfirmDel] = useState7(null);
-  const [msg, setMsg] = useState7(null);
-  const [busy, setBusy] = useState7(false);
-  const [editor, setEditor] = useState7(null);
-  const [accounts, setAccounts] = useState7(() => listAccounts());
-  const [login, setLogin] = useState7(null);
-  const [tick, setTick] = useState7(0);
-  const abort = useRef3(false);
-  const refreshAccounts = () => setAccounts(listAccounts());
-  const locked = accounts.length === 0;
-  const [srv, setSrv] = useState7(() => logsServerStatus());
-  useEffect6(() => {
-    const t = setInterval(() => setSrv(logsServerStatus()), 3e3);
-    return () => clearInterval(t);
-  }, []);
-  useEffect6(() => {
-    if (!login || login.phase === "done" || login.phase === "error") return;
-    const t = setInterval(() => setTick((n) => n + 1), 120);
-    return () => clearInterval(t);
-  }, [login]);
-  const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
-  const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
-  const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
-  const guardQ = useLoader(() => listAccounts().length ? api.settings.getGuardStatus() : Promise.resolve(null));
-  const selfQ = useLoader(() => listAccounts().length ? api.settings.getSelfProtection() : Promise.resolve(null));
-  const local = localQ.data;
-  const guard = guardQ.data;
-  const selfProt = selfQ.data;
-  const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
-  const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
-  const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
-  const hasEmailAlert = alerts.some((r) => alertChannel(r) === "email");
-  const hasTgAlert = alerts.some((r) => alertChannel(r) === "telegram");
-  const rowsAll = [
-    ...accounts.map((acc) => ({ kind: "acct", acc })),
-    { kind: "acct-add" },
-    ...locked ? [] : [
-      { kind: "guard" },
-      { kind: "self" },
-      { kind: "ll-enabled" },
-      { kind: "ll-path" },
-      { kind: "ll-server" },
-      ...webhooks.map((wh) => ({ kind: "wh", wh })),
-      { kind: "wh-add" },
-      ...alerts.map((rule) => ({ kind: "alert", rule })),
-      ...hasEmailAlert ? [] : [{ kind: "alert-add-email" }],
-      ...hasTgAlert ? [] : [{ kind: "alert-add-tg" }]
-    ]
-  ];
-  const selClamped = Math.min(sel, rowsAll.length - 1);
-  const cur = rowsAll[selClamped];
-  const keyOf = (r) => r.kind === "acct" ? "acct:" + r.acc.apiKey : r.kind === "wh" ? "wh:" + r.wh.id : r.kind === "alert" ? "alert:" + r.rule.id : r.kind;
-  const reloadAll = () => {
-    refreshAccounts();
-    localQ.reload();
-    whQ.reload();
-    alertQ.reload();
-    guardQ.reload();
-    selfQ.reload();
-  };
-  const run12 = (label, fn, reload) => {
-    if (busy) return;
-    setBusy(true);
-    setMsg({ text: label + "\u2026", level: "ok" });
-    fn().then(() => {
-      setMsg({ text: "\u2713 " + label, level: "ok" });
-      reload();
-    }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" })).finally(() => setBusy(false));
-  };
-  const beginLogin = () => {
-    if (login && (login.phase === "starting" || login.phase === "waiting")) return;
-    abort.current = false;
-    setLogin({ phase: "starting" });
-    void (async () => {
-      let start;
+// src/global-install.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync4, mkdirSync as mkdirSync8, rmSync as rmSync2 } from "fs";
+import { resolve as resolve4, join as join11, dirname as dirname3 } from "path";
+import { homedir as homedir9 } from "os";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { createInterface } from "readline";
+import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
       try {
-        start = await startDeviceLogin(DEFAULT_API_URL2);
-      } catch (e) {
-        setLogin({ phase: "error", msg: "could not reach SolonGate: " + (e instanceof Error ? e.message : String(e)) });
-        return;
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
       }
-      setLogin({ phase: "waiting", url: start.verifyUrl });
-      openBrowser(start.verifyUrl);
-      while (Date.now() < start.expiresAt && !abort.current) {
-        await new Promise((r) => setTimeout(r, start.intervalMs));
-        if (abort.current) return;
-        const res = await pollDeviceLogin(DEFAULT_API_URL2, start.deviceCode);
-        if (res.status === "approved" && res.apiKey) {
-          saveAccount({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user, email: res.email });
-          setLogin({ phase: "done", msg: `\u2713 added ${res.email || res.user || res.project || "account"}` });
-          setViewCredentials({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2 });
-          onView?.({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user, email: res.email });
-          reloadAll();
-          return;
-        }
-        if (res.status === "expired" || res.status === "not_found") {
-          setLogin({ phase: "error", msg: "code expired \u2014 press n to retry" });
-          return;
-        }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
       }
-      if (!abort.current) setLogin({ phase: "error", msg: "timed out \u2014 press n to retry" });
-    })();
-  };
-  const openAlertEditor = (channel, rule) => {
-    setEditor({
-      id: rule?.id,
-      channel,
-      target: (channel === "email" ? rule?.emails?.[0] : rule?.telegram?.[0]) ?? "",
-      signal: rule?.signal ?? "any",
-      threshold: rule?.threshold ?? THRESH_MIN,
-      windowSeconds: rule?.windowSeconds ?? 300,
-      enabled: rule?.enabled ?? true,
-      field: rule ? 1 : 0
-      // new rule starts on the target; existing on signal
-    });
-    if (!rule) {
-      setInput("");
-      setEditing("alert-target");
-    }
-  };
-  const normTarget = (channel, raw) => {
-    const v = raw.trim();
-    if (channel === "email") {
-      const email = v.replace(/^mailto:/i, "").replace(/^["'<]+|["'>]+$/g, "").replace(/[.,;:]+$/, "").replace(/\s+/g, "");
-      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return { value: email, error: "that does not look like an e-mail address" };
-      return { value: email };
-    }
-    const tg = v.replace(/^@/, "").replace(/^(chat[\s_-]*)?id[:=\s]*/i, "").replace(/\s+/g, "");
-    if (!/^-?\d{5,}$/.test(tg)) return { value: tg, error: "a telegram chat id is a number \u2014 get yours from @userinfobot" };
-    return { value: tg };
-  };
-  const saveEditor = () => {
-    if (!editor) return;
-    const t = normTarget(editor.channel, editor.target);
-    if (t.error) {
-      setMsg({ text: "\u2717 " + t.error, level: "bad" });
-      return;
     }
-    const channels = editor.channel === "email" ? { emails: [t.value], telegram: [] } : { telegram: [t.value], emails: [] };
-    const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
-    const id = editor.id;
-    setEditor(null);
-    if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
-    else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
-  };
-  const activate = (r) => {
-    if (r.kind === "acct") {
-      setViewCredentials({ apiKey: r.acc.apiKey, apiUrl: r.acc.apiUrl });
+  } catch {
+  }
+}
+function unlockFile(file) {
+  if (!existsSync4(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join11(p.hooksDir, "guard.mjs"),
+    join11(p.hooksDir, "audit.mjs"),
+    join11(p.hooksDir, "stop.mjs"),
+    join11(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath
+  ];
+}
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
+}
+function globalPaths() {
+  const home = homedir9();
+  const sgDir = join11(home, ".solongate");
+  const hooksDir = join11(sgDir, "hooks");
+  const claudeDir = join11(home, ".claude");
+  return {
+    home,
+    sgDir,
+    hooksDir,
+    claudeDir,
+    settingsPath: join11(claudeDir, "settings.json"),
+    backupPath: join11(claudeDir, "settings.solongate.bak"),
+    configPath: join11(sgDir, "cloud-guard.json")
+  };
+}
+function clearGuardUpdateCheck() {
+  try {
+    rmSync2(join11(globalPaths().sgDir, ".hook-update-check"), { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readHook(filename) {
+  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
+}
+function readGuard() {
+  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
+}
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((res) => rl.question(question, (a) => {
+    rl.close();
+    res(a.trim());
+  }));
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
+  try {
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    if (process.platform === "win32") {
+      const low = (s) => s.toLowerCase();
+      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
+    }
+    return out2[0] || null;
+  } catch {
+    return null;
+  }
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join11(homedir9(), f)).filter((f) => existsSync4(f));
+}
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync4(file) ? readFileSync9(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
+  }
+  mkdirSync8(dirname3(file), { recursive: true });
+  writeFileSync9(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block2 = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) return;
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block2);
+    } catch {
+    }
+  }
+}
+async function runGlobalInstall2(opts = {}) {
+  const p = globalPaths();
+  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    try {
+      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
+    } catch {
+    }
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
+  }
+  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
+    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
+    process.exit(1);
+  }
+  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+  mkdirSync8(p.hooksDir, { recursive: true });
+  mkdirSync8(p.claudeDir, { recursive: true });
+  unlockProtected();
+  writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join11(p.hooksDir, "shield.mjs"));
+  writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  console.log(`  Wrote ${p.configPath}`);
+  let existing = {};
+  if (existsSync4(p.settingsPath)) {
+    const raw = readFileSync9(p.settingsPath, "utf-8");
+    if (!existsSync4(p.backupPath)) {
+      writeFileSync9(p.backupPath, raw);
+      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
+    }
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+  }
+  const guardAbs = join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join11(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join11(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
+  const merged = {
+    ...existing,
+    hooks: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
+      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
+    }
+  };
+  writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
+  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+    lockProtected();
+    console.log("  Locked protection files (OS-level read-only/immutable).");
+  }
+}
+var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
+var init_global_install = __esm({
+  "src/global-install.ts"() {
+    "use strict";
+    __dirname = dirname3(fileURLToPath3(import.meta.url));
+    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
+  }
+});
+
+// src/tui/panels/Settings.tsx
+import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
+import TextInput5 from "ink-text-input";
+import { useEffect as useEffect6, useRef as useRef3, useState as useState7 } from "react";
+import { Fragment as Fragment4, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+function SettingsPanel({
+  active: active2,
+  focused,
+  viewApiKey,
+  onView,
+  onAccountsChanged
+}) {
+  void active2;
+  const { cols, rows } = usePanelSize();
+  const [sel, setSel] = useState7(0);
+  const [editing, setEditing] = useState7(null);
+  const [input, setInput] = useState7("");
+  const [confirmDel, setConfirmDel] = useState7(null);
+  const [msg, setMsg] = useState7(null);
+  const [busy, setBusy] = useState7(false);
+  const [editor, setEditor] = useState7(null);
+  const [accounts, setAccounts] = useState7(() => listAccounts());
+  const [login, setLogin] = useState7(null);
+  const [tick, setTick] = useState7(0);
+  const abort = useRef3(false);
+  const refreshAccounts = () => setAccounts(listAccounts());
+  const locked = accounts.length === 0;
+  const [srv, setSrv] = useState7(() => logsServerStatus());
+  useEffect6(() => {
+    const t = setInterval(() => setSrv(logsServerStatus()), 3e3);
+    return () => clearInterval(t);
+  }, []);
+  useEffect6(() => {
+    if (!login || login.phase === "done" || login.phase === "error") return;
+    const t = setInterval(() => setTick((n) => n + 1), 120);
+    return () => clearInterval(t);
+  }, [login]);
+  const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
+  const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
+  const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
+  const guardQ = useLoader(() => listAccounts().length ? api.settings.getGuardStatus() : Promise.resolve(null));
+  const selfQ = useLoader(() => listAccounts().length ? api.settings.getSelfProtection() : Promise.resolve(null));
+  const local = localQ.data;
+  const guard = guardQ.data;
+  const selfProt = selfQ.data;
+  const [hidden, setHidden] = useState7(/* @__PURE__ */ new Set());
+  const webhooks = (whQ.data?.webhooks ?? []).filter((w) => !hidden.has("wh:" + w.id));
+  const alerts = (alertQ.data?.rules ?? []).filter((r) => !hidden.has("alert:" + r.id));
+  const hasEmailAlert = alerts.some((r) => alertChannel(r) === "email");
+  const hasTgAlert = alerts.some((r) => alertChannel(r) === "telegram");
+  const rowsAll = [
+    ...accounts.map((acc) => ({ kind: "acct", acc })),
+    { kind: "acct-add" },
+    ...locked ? [] : [
+      { kind: "guard" },
+      { kind: "self" },
+      { kind: "ll-enabled" },
+      { kind: "ll-path" },
+      { kind: "ll-server" },
+      ...webhooks.map((wh) => ({ kind: "wh", wh })),
+      { kind: "wh-add" },
+      ...alerts.map((rule) => ({ kind: "alert", rule })),
+      ...hasEmailAlert ? [] : [{ kind: "alert-add-email" }],
+      ...hasTgAlert ? [] : [{ kind: "alert-add-tg" }]
+    ]
+  ];
+  const selClamped = Math.min(sel, rowsAll.length - 1);
+  const cur = rowsAll[selClamped];
+  const keyOf = (r) => r.kind === "acct" ? "acct:" + r.acc.apiKey : r.kind === "wh" ? "wh:" + r.wh.id : r.kind === "alert" ? "alert:" + r.rule.id : r.kind;
+  const reloadAll = () => {
+    refreshAccounts();
+    localQ.reload();
+    whQ.reload();
+    alertQ.reload();
+    guardQ.reload();
+    selfQ.reload();
+  };
+  const run12 = (label, fn, reload) => {
+    if (busy) return;
+    setBusy(true);
+    setMsg({ text: label + "\u2026", level: "ok" });
+    fn().then(() => {
+      setMsg({ text: "\u2713 " + label, level: "ok" });
+      reload();
+    }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" })).finally(() => setBusy(false));
+  };
+  const beginLogin = () => {
+    if (login && (login.phase === "starting" || login.phase === "waiting")) return;
+    abort.current = false;
+    setLogin({ phase: "starting" });
+    void (async () => {
+      let start;
+      try {
+        start = await startDeviceLogin(DEFAULT_API_URL2);
+      } catch (e) {
+        setLogin({ phase: "error", msg: "could not reach SolonGate: " + (e instanceof Error ? e.message : String(e)) });
+        return;
+      }
+      setLogin({ phase: "waiting", url: start.verifyUrl });
+      openBrowser(start.verifyUrl);
+      while (Date.now() < start.expiresAt && !abort.current) {
+        await new Promise((r) => setTimeout(r, start.intervalMs));
+        if (abort.current) return;
+        const res = await pollDeviceLogin(DEFAULT_API_URL2, start.deviceCode);
+        if (res.status === "approved" && res.apiKey) {
+          saveAccount({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user, email: res.email });
+          setLogin({ phase: "done", msg: `\u2713 added ${res.email || res.user || res.project || "account"}` });
+          setViewCredentials({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2 });
+          onView?.({ apiKey: res.apiKey, apiUrl: DEFAULT_API_URL2, project: res.project, user: res.user, email: res.email });
+          reloadAll();
+          return;
+        }
+        if (res.status === "expired" || res.status === "not_found") {
+          setLogin({ phase: "error", msg: "code expired \u2014 press n to retry" });
+          return;
+        }
+      }
+      if (!abort.current) setLogin({ phase: "error", msg: "timed out \u2014 press n to retry" });
+    })();
+  };
+  const openAlertEditor = (channel, rule) => {
+    setEditor({
+      id: rule?.id,
+      channel,
+      target: (channel === "email" ? rule?.emails?.[0] : rule?.telegram?.[0]) ?? "",
+      signal: rule?.signal ?? "any",
+      threshold: rule?.threshold ?? THRESH_MIN,
+      windowSeconds: rule?.windowSeconds ?? 300,
+      enabled: rule?.enabled ?? true,
+      field: rule ? 1 : 0
+      // new rule starts on the target; existing on signal
+    });
+    if (!rule) {
+      setInput("");
+      setEditing("alert-target");
+    }
+  };
+  const normTarget = (channel, raw) => {
+    const v = raw.trim();
+    if (channel === "email") {
+      const email = v.replace(/^mailto:/i, "").replace(/^["'<]+|["'>]+$/g, "").replace(/[.,;:]+$/, "").replace(/\s+/g, "");
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return { value: email, error: "that does not look like an e-mail address" };
+      return { value: email };
+    }
+    const tg = v.replace(/^@/, "").replace(/^(chat[\s_-]*)?id[:=\s]*/i, "").replace(/\s+/g, "");
+    if (!/^-?\d{5,}$/.test(tg)) return { value: tg, error: "a telegram chat id is a number \u2014 get yours from @userinfobot" };
+    return { value: tg };
+  };
+  const saveEditor = () => {
+    if (!editor) return;
+    const t = normTarget(editor.channel, editor.target);
+    if (t.error) {
+      setMsg({ text: "\u2717 " + t.error, level: "bad" });
+      return;
+    }
+    const channels = editor.channel === "email" ? { emails: [t.value], telegram: [] } : { telegram: [t.value], emails: [] };
+    const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
+    const id = editor.id;
+    setEditor(null);
+    if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
+  };
+  const activate = (r) => {
+    if (r.kind === "acct") {
+      setViewCredentials({ apiKey: r.acc.apiKey, apiUrl: r.acc.apiUrl });
       onView?.(r.acc);
       setMsg({ text: `viewing ${acctLabel(r.acc)}`, level: "ok" });
     } else if (r.kind === "acct-add") {
       beginLogin();
+    } else if (r.kind === "guard") {
+      if (!guard) return;
+      if (guard.up_to_date) {
+        setMsg({ text: `guard already on the latest hook (v${guard.latest})`, level: "ok" });
+        return;
+      }
+      const armed = clearGuardUpdateCheck();
+      setMsg(
+        armed ? { text: `\u2713 update armed. now make your agent RUN any command (e.g. "echo ok"), not just chat; the guard installs v${guard.latest} on the next executed command`, level: "ok" } : { text: "\u2717 could not arm the update (check ~/.solongate permissions)", level: "bad" }
+      );
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -10354,16 +10612,31 @@ function SettingsPanel({
           else activate(cur);
         }
       } else if (inp === "x" && cur.kind === "acct") {
-        const k = "acct:" + cur.acc.apiKey;
+        const target = cur.acc;
+        const k = "acct:" + target.apiKey;
+        const wasActive = isActiveAccount(target.apiKey);
+        const others = accounts.filter((a) => a.apiKey !== target.apiKey);
         if (confirmDel !== k) {
           setConfirmDel(k);
-          setMsg({ text: `press x again to remove ${acctLabel(cur.acc)} from this device (the cloud account is untouched)`, level: "bad" });
+          const note = wasActive ? others.length ? ` \u2014 the ACTIVE guard key; ${acctLabel(others[0])} takes over` : " \u2014 your ONLY account & the active guard key; this signs the device out (guard has no key until you log in again)" : " (the cloud account is untouched)";
+          setMsg({ text: `press x again to remove ${acctLabel(target)} from this device${note}`, level: "bad" });
           return;
         }
         setConfirmDel(null);
-        removeAccount(cur.acc.apiKey);
-        setMsg({ text: `\u2713 removed ${acctLabel(cur.acc)} from this device`, level: "ok" });
+        removeAccount(target.apiKey);
+        let extra = " from this device";
+        if (wasActive) {
+          if (others.length) {
+            setActiveAccount({ apiKey: others[0].apiKey, apiUrl: others[0].apiUrl });
+            extra = ` \xB7 ${acctLabel(others[0])} is now the active key`;
+          } else {
+            clearActiveCredential();
+            extra = " \xB7 signed out of this device";
+          }
+        }
+        setMsg({ text: `\u2713 removed ${acctLabel(target)}${extra}`, level: "ok" });
         refreshAccounts();
+        onAccountsChanged?.();
       } else if (inp === "t" && cur.kind === "wh") {
         run12("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
@@ -10487,9 +10760,9 @@ function SettingsPanel({
         return /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
           cursor(r),
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
-          guard ? /* @__PURE__ */ jsxs7(Fragment5, { children: [
+          guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter to update` }),
             /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""}` })
           ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
         ] });
@@ -10555,7 +10828,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook version + self-protection toggle",
+    PROTECTION: "guard hook version (enter to update) + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -10617,6 +10890,7 @@ var init_Settings = __esm({
     init_api_client();
     init_client();
     init_device_login();
+    init_global_install();
     init_logs_server_daemon();
     init_components();
     init_hooks();
@@ -10717,6 +10991,14 @@ function App() {
     if (accounts.length < 2) return;
     viewAccount(accounts[(acctIdx + 1) % accounts.length]);
   };
+  const syncAccounts = () => {
+    const list6 = listAccounts();
+    setAccounts(list6);
+    const next = list6.find((a) => a.apiKey === viewKey) ?? list6[0];
+    setViewCredentials(next ? { apiKey: next.apiKey, apiUrl: next.apiUrl } : null);
+    setViewKey(next?.apiKey);
+    setViewNonce((n) => n + 1);
+  };
   const locked = accounts.length === 0;
   const effectiveSection = locked ? SETTINGS_SECTION : section;
   useInput7((input, key) => {
@@ -10752,7 +11034,7 @@ function App() {
     return /* @__PURE__ */ jsx8(Box8, { flexDirection: "column", width: cols, height: rows - 1, overflow: "hidden", children: /* @__PURE__ */ jsx8(LivePanel, { active: true, focused: true }, viewNonce) });
   }
   const Panel = current.Panel;
-  const panelBody = current.label === "Settings" ? /* @__PURE__ */ jsx8(SettingsPanel, { active: true, focused: focus === "panel", viewApiKey: viewKey, onView: viewAccount }) : /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" });
+  const panelBody = current.label === "Settings" ? /* @__PURE__ */ jsx8(SettingsPanel, { active: true, focused: focus === "panel", viewApiKey: viewKey, onView: viewAccount, onAccountsChanged: syncAccounts }) : /* @__PURE__ */ jsx8(Panel, { active: focus === "panel" || current.label !== "Live", focused: focus === "panel" });
   return (
     // height rows-1 (not rows): once total output reaches stdout.rows ink stops
     // diffing and clearTerminal-repaints every frame, which slides the banner.
@@ -10834,9 +11116,9 @@ var tui_exports = {};
 __export(tui_exports, {
   launchTui: () => launchTui
 });
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync8 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join11 } from "path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join12 } from "path";
 import { render } from "ink";
 import { jsx as jsx9 } from "react/jsx-runtime";
 async function launchTui() {
@@ -10847,11 +11129,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join11(homedir9(), ".solongate", "dataroom-debug.log");
+  const debugLog = join12(homedir10(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync8(join11(homedir9(), ".solongate"), { recursive: true });
+      mkdirSync9(join12(homedir10(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -10975,7 +11257,7 @@ var init_args = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 async function run(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -11150,7 +11432,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync9(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -11565,9 +11847,9 @@ var init_agents2 = __esm({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 async function run6(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
@@ -11597,7 +11879,7 @@ async function run6(argv) {
     } catch {
     }
   }
-  if (existsSync4(LOCAL_LOG2)) {
+  if (existsSync5(LOCAL_LOG2)) {
     const st = statSync2(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
@@ -11627,14 +11909,14 @@ var init_doctor = __esm({
     init_api_client();
     init_format();
     init_args();
-    LOCAL_LOG2 = join12(homedir10(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG2 = join13(homedir11(), ".solongate", "local-logs", "solongate-audit.jsonl");
   }
 });
 
 // src/commands/watch.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync4, readSync as readSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync6, openSync as openSync4, readSync as readSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join14 } from "path";
 function tailLocal(file, maxBytes = 131072) {
   try {
     const size = statSync3(file).size;
@@ -11678,7 +11960,7 @@ async function run7(argv) {
     for (const r of rows) if (keep(r)) print(r, json);
   };
   const pollLocal = () => {
-    if (cloudOnly || !existsSync5(LOCAL_LOG3)) return;
+    if (cloudOnly || !existsSync6(LOCAL_LOG3)) return;
     const rows = [];
     for (const line of tailLocal(LOCAL_LOG3)) {
       try {
@@ -11741,7 +12023,7 @@ var init_watch = __esm({
     init_cli_utils();
     init_args();
     init_format();
-    LOCAL_LOG3 = join13(homedir11(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    LOCAL_LOG3 = join14(homedir12(), ".solongate", "local-logs", "solongate-audit.jsonl");
     trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
     time = (ms) => new Date(ms).toTimeString().slice(0, 8);
   }
@@ -12031,250 +12313,6 @@ var init_commands = __esm({
   }
 });
 
-// src/global-install.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync9, existsSync as existsSync6, mkdirSync as mkdirSync9 } from "fs";
-import { resolve as resolve4, join as join14, dirname as dirname3 } from "path";
-import { homedir as homedir12 } from "os";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
-function lockFile(file) {
-  if (!existsSync6(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync6(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join14(p.hooksDir, "guard.mjs"),
-    join14(p.hooksDir, "audit.mjs"),
-    join14(p.hooksDir, "stop.mjs"),
-    join14(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir12();
-  const sgDir = join14(home, ".solongate");
-  const hooksDir = join14(sgDir, "hooks");
-  const claudeDir = join14(home, ".claude");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    settingsPath: join14(claudeDir, "settings.json"),
-    backupPath: join14(claudeDir, "settings.solongate.bak"),
-    configPath: join14(sgDir, "cloud-guard.json")
-  };
-}
-function readHook(filename) {
-  return readFileSync10(join14(HOOKS_DIR, filename), "utf-8");
-}
-function readGuard() {
-  const bundled = join14(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync6(bundled) ? readFileSync10(bundled, "utf-8") : readHook("guard.mjs");
-}
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => rl.question(question, (a) => {
-    rl.close();
-    res(a.trim());
-  }));
-}
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function resolveRealClaude() {
-  try {
-    const finder = process.platform === "win32" ? "where" : "which";
-    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    if (process.platform === "win32") {
-      const low = (s) => s.toLowerCase();
-      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
-    }
-    return out2[0] || null;
-  } catch {
-    return null;
-  }
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join14(homedir12(), f)).filter((f) => existsSync6(f));
-}
-function writeShimBlock(file, block2) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync6(file) ? readFileSync10(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block2) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block2 + "\n";
-  }
-  mkdirSync9(dirname3(file), { recursive: true });
-  writeFileSync9(file, content);
-}
-function installClaudeShim(shieldPath) {
-  const real = resolveRealClaude();
-  if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
-    return;
-  }
-  const node = process.execPath.replace(/\\/g, "/");
-  const shield = shieldPath.replace(/\\/g, "/");
-  const win = process.platform === "win32";
-  const block2 = win ? `${SHIM_BEGIN}
-function claude { & "${node}" "${shield}" -- "${real}" @args }
-${SHIM_END}` : `${SHIM_BEGIN}
-claude() { "${node}" "${shield}" -- "${real}" "$@"; }
-${SHIM_END}`;
-  const targets = shimTargets();
-  if (targets.length === 0) return;
-  for (const file of targets) {
-    try {
-      writeShimBlock(file, block2);
-    } catch {
-    }
-  }
-}
-async function runGlobalInstall2(opts = {}) {
-  const p = globalPaths();
-  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    try {
-      const cfg = JSON.parse(readFileSync10(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
-    } catch {
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync9(p.hooksDir, { recursive: true });
-  mkdirSync9(p.claudeDir, { recursive: true });
-  unlockProtected();
-  writeFileSync9(join14(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync9(join14(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync9(join14(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync9(join14(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join14(p.hooksDir, "shield.mjs"));
-  writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-  console.log(`  Wrote ${p.configPath}`);
-  let existing = {};
-  if (existsSync6(p.settingsPath)) {
-    const raw = readFileSync10(p.settingsPath, "utf-8");
-    if (!existsSync6(p.backupPath)) {
-      writeFileSync9(p.backupPath, raw);
-      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
-    }
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const guardAbs = join14(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join14(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join14(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
-  const merged = {
-    ...existing,
-    hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
-      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
-    }
-  };
-  writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
-    lockProtected();
-    console.log("  Locked protection files (OS-level read-only/immutable).");
-  }
-}
-var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
-var init_global_install = __esm({
-  "src/global-install.ts"() {
-    "use strict";
-    __dirname = dirname3(fileURLToPath3(import.meta.url));
-    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
-    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-    SHIM_END = "# <<< SolonGate shield <<<";
-  }
-});
-
 // src/login.ts
 var login_exports = {};
 import { spawn as spawn5 } from "child_process";