@solongate/proxy 0.81.76 → 0.81.78

package/dist/commands/index.js

@@ -22,7 +22,7 @@ var ApiError = class extends Error {
 };
 var NotAuthenticatedError = class extends Error {
   constructor() {
-    super("Not logged in. Run `solongate login` first.");
+    super("Not logged in. Run `solongate` and log in from the Accounts panel.");
     this.name = "NotAuthenticatedError";
   }
 };
@@ -132,7 +132,7 @@ async function request(method, path, opts = {}) {
     if (typeof envelope === "string") {
       throw new ApiError(res.status, "ERROR", envelope);
     }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
     if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
     throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
   }

package/dist/global-install.d.ts

@@ -11,6 +11,17 @@ export declare function globalPaths(): {
 };
 export declare function clearGuardUpdateCheck(): boolean;
 export declare function runGlobalRestore(): void;
+/**
+ * TUI-safe uninstall (dataroom Settings → guard → remove). Same effect as
+ * runGlobalRestore but returns a status string instead of writing to stdout —
+ * any console output would corrupt the Ink render. Unlocks the protected files,
+ * removes the auto-shield shell shim, then strips the SolonGate hooks from the
+ * global Claude settings (restoring the pre-install backup when present).
+ */
+export declare function uninstallGlobalQuiet(): {
+    ok: boolean;
+    message: string;
+};
 export declare function installClaudeShim(shieldPath: string): void;
 export declare function removeClaudeShim(): void;
 export declare function runGlobalInstall(opts?: {

package/dist/global-install.js

@@ -137,6 +137,26 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
+function uninstallGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
+    if (existsSync(p.backupPath)) {
+      writeFileSync(p.settingsPath, readFileSync(p.backupPath, "utf-8"));
+      return { ok: true, message: "guard removed \u2014 restored the pre-install settings (restart Claude Code)" };
+    }
+    if (existsSync(p.settingsPath)) {
+      const s = JSON.parse(readFileSync(p.settingsPath, "utf-8"));
+      delete s.hooks;
+      writeFileSync(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      return { ok: true, message: "guard removed \u2014 SolonGate hooks cleared (restart Claude Code)" };
+    }
+    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
 var SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
 var SHIM_END = "# <<< SolonGate shield <<<";
 function escapeRe(s) {
@@ -283,5 +303,6 @@ export {
   removeClaudeShim,
   runGlobalInstall,
   runGlobalRestore,
+  uninstallGlobalQuiet,
   unlockProtected
 };

package/dist/index.js

@@ -7302,7 +7302,7 @@ async function request(method, path, opts = {}) {
     if (typeof envelope === "string") {
       throw new ApiError(res.status, "ERROR", envelope);
     }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
     if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
     throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
   }
@@ -7327,7 +7327,7 @@ var init_client = __esm({
     };
     NotAuthenticatedError = class extends Error {
       constructor() {
-        super("Not logged in. Run `solongate login` first.");
+        super("Not logged in. Run `solongate` and log in from the Accounts panel.");
         this.name = "NotAuthenticatedError";
       }
     };
@@ -10115,32 +10115,6 @@ import { homedir as homedir9 } from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { createInterface } from "readline";
 import { execFileSync as execFileSync2 } from "child_process";
-function lockFile(file) {
-  if (!existsSync4(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
 function unlockFile(file) {
   if (!existsSync4(file)) return;
   try {
@@ -10182,9 +10156,6 @@ function protectedTargets() {
     p.settingsPath
   ];
 }
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
 function unlockProtected() {
   for (const f of protectedTargets()) unlockFile(f);
 }
@@ -10211,36 +10182,29 @@ function clearGuardUpdateCheck() {
     return false;
   }
 }
-function readHook(filename) {
-  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
-}
-function readGuard() {
-  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
-}
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => rl.question(question, (a) => {
-    rl.close();
-    res(a.trim());
-  }));
+function uninstallGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
+    if (existsSync4(p.backupPath)) {
+      writeFileSync9(p.settingsPath, readFileSync9(p.backupPath, "utf-8"));
+      return { ok: true, message: "guard removed \u2014 restored the pre-install settings (restart Claude Code)" };
+    }
+    if (existsSync4(p.settingsPath)) {
+      const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
+      delete s.hooks;
+      writeFileSync9(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      return { ok: true, message: "guard removed \u2014 SolonGate hooks cleared (restart Claude Code)" };
+    }
+    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
 }
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function resolveRealClaude() {
-  try {
-    const finder = process.platform === "win32" ? "where" : "which";
-    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    if (process.platform === "win32") {
-      const low = (s) => s.toLowerCase();
-      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
-    }
-    return out2[0] || null;
-  } catch {
-    return null;
-  }
-}
 function shimTargets() {
   if (process.platform === "win32") {
     try {
@@ -10263,92 +10227,14 @@ function writeShimBlock(file, block2) {
   mkdirSync8(dirname3(file), { recursive: true });
   writeFileSync9(file, content);
 }
-function installClaudeShim(shieldPath) {
-  const real = resolveRealClaude();
-  if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
-    return;
-  }
-  const node = process.execPath.replace(/\\/g, "/");
-  const shield = shieldPath.replace(/\\/g, "/");
-  const win = process.platform === "win32";
-  const block2 = win ? `${SHIM_BEGIN}
-function claude { & "${node}" "${shield}" -- "${real}" @args }
-${SHIM_END}` : `${SHIM_BEGIN}
-claude() { "${node}" "${shield}" -- "${real}" "$@"; }
-${SHIM_END}`;
-  const targets = shimTargets();
-  if (targets.length === 0) return;
-  for (const file of targets) {
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
     try {
-      writeShimBlock(file, block2);
+      writeShimBlock(file, null);
     } catch {
     }
   }
 }
-async function runGlobalInstall2(opts = {}) {
-  const p = globalPaths();
-  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    try {
-      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
-    } catch {
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync8(p.hooksDir, { recursive: true });
-  mkdirSync8(p.claudeDir, { recursive: true });
-  unlockProtected();
-  writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join11(p.hooksDir, "shield.mjs"));
-  writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-  console.log(`  Wrote ${p.configPath}`);
-  let existing = {};
-  if (existsSync4(p.settingsPath)) {
-    const raw = readFileSync9(p.settingsPath, "utf-8");
-    if (!existsSync4(p.backupPath)) {
-      writeFileSync9(p.backupPath, raw);
-      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
-    }
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const guardAbs = join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join11(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join11(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
-  const merged = {
-    ...existing,
-    hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
-      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
-    }
-  };
-  writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
-    lockProtected();
-    console.log("  Locked protection files (OS-level read-only/immutable).");
-  }
-}
 var __dirname, HOOKS_DIR, SHIM_BEGIN, SHIM_END;
 var init_global_install = __esm({
   "src/global-install.ts"() {
@@ -10687,6 +10573,17 @@ function SettingsPanel({
           setEditing("wh-url");
         } else if (cur.kind === "alert-add-email") openAlertEditor("email");
         else if (cur.kind === "alert-add-tg") openAlertEditor("telegram");
+      } else if (inp === "d" && cur.kind === "guard") {
+        const k = keyOf(cur);
+        if (confirmDel !== k) {
+          setConfirmDel(k);
+          setMsg({ text: "\u26A0 d again REMOVES the guard from this device \u2014 Claude Code sessions stop being protected until you reinstall", level: "bad" });
+          return;
+        }
+        setConfirmDel(null);
+        const res = uninstallGlobalQuiet();
+        setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+        guardQ.reload();
       } else if (inp === "d" && (cur.kind === "wh" || cur.kind === "alert")) {
         const k = keyOf(cur);
         if (confirmDel !== k) {
@@ -10794,8 +10691,8 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter to update` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""}` })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
           ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
         ] });
       case "self":
@@ -10860,7 +10757,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook version (enter to update) + self-protection toggle",
+    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -12346,157 +12243,6 @@ var init_commands = __esm({
   }
 });
 
-// src/login.ts
-var login_exports = {};
-import { spawn as spawn5 } from "child_process";
-function startSpinner(text) {
-  if (!process.stderr.isTTY) {
-    process.stderr.write(`  ${text}
-`);
-    return (finalLine) => {
-      if (finalLine) process.stderr.write(finalLine + "\n");
-    };
-  }
-  let i = 0;
-  const draw = () => {
-    const frame = SPINNER_FRAMES[i = (i + 1) % SPINNER_FRAMES.length];
-    process.stderr.write(`\r  ${c.cyan}${frame}${c.reset} ${c.dim}${text}${c.reset}\x1B[K`);
-  };
-  draw();
-  const timer = setInterval(draw, 80);
-  return (finalLine) => {
-    clearInterval(timer);
-    process.stderr.write("\r\x1B[K");
-    if (finalLine) process.stderr.write(finalLine + "\n");
-  };
-}
-function parseArgs2(argv) {
-  const args = argv.slice(3);
-  let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  let install = true;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--api-url") apiUrl = args[++i] || apiUrl;
-    else if (args[i] === "--no-install") install = false;
-  }
-  return { apiUrl, install };
-}
-function openBrowser2(url) {
-  try {
-    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn5(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function main() {
-  const { apiUrl, install } = parseArgs2(process.argv);
-  console.log("");
-  console.log(`  ${c.bold}${c.blue4}SolonGate${c.reset} ${c.dim}\u2014 Login${c.reset}`);
-  console.log("");
-  let start;
-  try {
-    const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    start = await res.json();
-  } catch (e) {
-    console.log(`  Could not reach SolonGate (${apiUrl}).`);
-    console.log(`  ${e instanceof Error ? e.message : String(e)}`);
-    process.exit(1);
-  }
-  const { device_code, user_code, verification_uri_complete, verification_uri, interval, expires_in } = start;
-  const verifyUrl = verification_uri_complete || verification_uri;
-  console.log(`  ${c.blue5}\u2192${c.reset} Opening your browser to authorize this device\u2026`);
-  console.log("");
-  console.log(`  ${c.dim}If it doesn't open, visit this link:${c.reset}`);
-  console.log(`  ${c.cyan}${verifyUrl}${c.reset}`);
-  console.log("");
-  void user_code;
-  openBrowser2(verifyUrl);
-  const pollMs = Math.max(2, Number(interval) || 3) * 1e3;
-  const deadline = Date.now() + (Number(expires_in) || 600) * 1e3;
-  let apiKey = "";
-  const stopSpinner = startSpinner("Waiting for authorization\u2026");
-  while (Date.now() < deadline) {
-    await sleep(pollMs);
-    try {
-      const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ device_code })
-      });
-      const data = await res.json().catch(() => ({}));
-      if (data?.status === "approved" && data?.api_key) {
-        apiKey = data.api_key;
-        stopSpinner();
-        console.log("");
-        const who = data?.user?.name || data?.user?.email;
-        const mail = data?.user?.email;
-        if (who) {
-          const suffix = mail && mail !== who ? ` ${c.dim}(${mail})${c.reset}` : "";
-          console.log(`  ${c.green}\u2713${c.reset} ${c.bold}Logged in as ${c.white}${who}${c.reset}${suffix}`);
-        } else {
-          console.log(`  ${c.green}\u2713${c.reset} ${c.bold}Logged in${c.reset}`);
-        }
-        if (data?.project?.name) {
-          console.log(`  ${c.dim}Project:${c.reset} ${c.cyan}${data.project.name}${c.reset}`);
-        }
-        saveAccount({ apiKey, apiUrl, project: data?.project?.name, user: data?.user?.name || data?.user?.email, email: data?.user?.email });
-        break;
-      }
-      if (data?.status === "expired" || data?.status === "not_found") {
-        stopSpinner(`  ${c.red}\u2717${c.reset} Code expired. Run \`login\` again.`);
-        process.exit(1);
-      }
-    } catch {
-    }
-  }
-  if (!apiKey) {
-    stopSpinner(`  ${c.red}\u2717${c.reset} Timed out waiting for authorization. Run \`login\` again.`);
-    process.exit(1);
-  }
-  if (!install) {
-    console.log("");
-    console.log("  Logged in. Re-run `login` to enable system-wide enforcement.");
-    return;
-  }
-  console.log("");
-  await runGlobalInstall2({ apiKey, apiUrl });
-  console.log("");
-  console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  console.log("  \u2502  You are logged in and protected.               \u2502");
-  console.log("  \u2502  Every Claude Code session on this machine is   \u2502");
-  console.log("  \u2502  now guarded by your cloud policy (OPA WASM).   \u2502");
-  console.log("  \u2502                                                 \u2502");
-  console.log("  \u2502  Manage policy: https://dashboard.solongate.com \u2502");
-  console.log("  \u2502  Restart Claude Code to apply.                  \u2502");
-  console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  console.log("");
-  console.log(`  ${c.bold}${c.yellow}!  Already-open terminals are NOT protected yet.${c.reset}`);
-  console.log(`  ${c.dim}   Hooks load only when a session starts, so any terminal`);
-  console.log(`     (and the Claude Code running in it) that was already open`);
-  console.log(`     won't be caught. Open a NEW terminal and start Claude Code`);
-  console.log(`     there for the guard + audit logging to take effect.${c.reset}`);
-  console.log("");
-}
-var sleep, SPINNER_FRAMES;
-var init_login = __esm({
-  "src/login.ts"() {
-    "use strict";
-    init_cli_utils();
-    init_global_install();
-    init_client();
-    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-    SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-    main().catch((err2) => {
-      console.log(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
-      process.exit(1);
-    });
-  }
-});
-
 // src/shield.ts
 var shield_exports = {};
 __export(shield_exports, {
@@ -12504,7 +12250,7 @@ __export(shield_exports, {
 });
 import { createServer, request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { URL as URL2 } from "url";
 import { readFileSync as readFileSync11, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
 import { resolve as resolve5 } from "path";
@@ -12765,7 +12511,7 @@ async function runShield() {
   const upstream = pickUpstream();
   const { port, close } = await startProxy(upstream);
   log4(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn6(cmd[0], cmd.slice(1), {
+  const child = spawn5(cmd[0], cmd.slice(1), {
     stdio: "inherit",
     env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
     shell: process.platform === "win32"
@@ -13268,7 +13014,7 @@ function showDiff(result) {
   }
   log3("");
 }
-async function main2() {
+async function main() {
   const opts = parseInjectArgs(process.argv);
   printBanner("Inject SDK");
   if (!detectProject()) {
@@ -13355,7 +13101,7 @@ var init_inject = __esm({
   "src/inject.ts"() {
     "use strict";
     init_cli_utils();
-    main2().catch((err2) => {
+    main().catch((err2) => {
       log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
     });
@@ -13572,7 +13318,7 @@ dist/
 `
   );
 }
-async function main3() {
+async function main2() {
   const opts = parseCreateArgs(process.argv);
   const dir = resolve8(opts.name);
   printBanner("Create MCP Server");
@@ -13646,7 +13392,7 @@ var init_create = __esm({
   "src/create.ts"() {
     "use strict";
     init_cli_utils();
-    main3().catch((err2) => {
+    main2().catch((err2) => {
       log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
       process.exit(1);
     });
@@ -13922,7 +13668,7 @@ async function push(apiKey, file, policyId) {
   log5(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
   log5("");
 }
-async function main4() {
+async function main3() {
   const { command, apiKey, file, policyId } = parseCliArgs();
   try {
     if (command === "pull") {
@@ -13967,7 +13713,7 @@ var init_pull_push = __esm({
     cyan2 = (s) => `\x1B[36m${s}\x1B[0m`;
     magenta = (s) => `\x1B[35m${s}\x1B[0m`;
     API_URL = "https://api.solongate.com";
-    main4();
+    main3();
   }
 });
 
@@ -17017,17 +16763,17 @@ function printWelcome() {
   console.log("");
   console.log("  Get started with one command:");
   console.log("");
-  console.log(`    ${c.cyan}solongate login${c.reset}`);
+  console.log(`    ${c.cyan}solongate${c.reset}`);
   console.log("");
-  console.log(`  ${c.dim}This pairs your device and protects every Claude Code session${c.reset}`);
-  console.log(`  ${c.dim}on this machine with your cloud policy. Manage it at${c.reset}`);
-  console.log(`  ${c.cyan}https://dashboard.solongate.com${c.reset}`);
+  console.log(`  ${c.dim}This opens the dataroom; log in from the Accounts panel to pair this${c.reset}`);
+  console.log(`  ${c.dim}device and protect every Claude Code session with your cloud policy.${c.reset}`);
+  console.log(`  ${c.dim}Manage it at ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
   console.log("");
   console.log(`  ${c.dim}Using local log storage? Show it live in the dashboard with${c.reset}`);
   console.log(`    ${c.cyan}solongate logs-server${c.reset}`);
   console.log("");
 }
-async function main5() {
+async function main4() {
   const subcommand = process.argv[2];
   if (IS_HUMAN_CLI) {
     const tuiBound = subcommand === "dataroom" || process.argv.length <= 2 && process.stdout.isTTY && process.stdin.isTTY;
@@ -17061,7 +16807,8 @@ async function main5() {
     process.exit(code);
   }
   if (subcommand === "login") {
-    await Promise.resolve().then(() => (init_login(), login_exports));
+    const { launchTui: launchTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
+    await launchTui2();
     return;
   }
   if (subcommand === "shield") {
@@ -17099,4 +16846,4 @@ async function main5() {
     process.exit(1);
   }
 }
-main5();
+main4();

package/dist/tui/index.js

@@ -400,7 +400,7 @@ var ApiError = class extends Error {
 };
 var NotAuthenticatedError = class extends Error {
   constructor() {
-    super("Not logged in. Run `solongate login` first.");
+    super("Not logged in. Run `solongate` and log in from the Accounts panel.");
     this.name = "NotAuthenticatedError";
   }
 };
@@ -502,7 +502,7 @@ async function request(method, path, opts = {}) {
     if (typeof envelope === "string") {
       throw new ApiError(res.status, "ERROR", envelope);
     }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
     if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
     throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
   }
@@ -3148,6 +3148,50 @@ import { createInterface } from "readline";
 import { execFileSync } from "child_process";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var HOOKS_DIR = resolve2(__dirname, "..", "hooks");
+function unlockFile(file) {
+  if (!existsSync2(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join6(p.hooksDir, "guard.mjs"),
+    join6(p.hooksDir, "audit.mjs"),
+    join6(p.hooksDir, "stop.mjs"),
+    join6(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath
+  ];
+}
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
+}
 function globalPaths() {
   const home = homedir6();
   const sgDir = join6(home, ".solongate");
@@ -3171,6 +3215,61 @@ function clearGuardUpdateCheck() {
     return false;
   }
 }
+function uninstallGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
+    if (existsSync2(p.backupPath)) {
+      writeFileSync5(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
+      return { ok: true, message: "guard removed \u2014 restored the pre-install settings (restart Claude Code)" };
+    }
+    if (existsSync2(p.settingsPath)) {
+      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+      delete s.hooks;
+      writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      return { ok: true, message: "guard removed \u2014 SolonGate hooks cleared (restart Claude Code)" };
+    }
+    return { ok: true, message: "nothing to remove \u2014 no global Claude Code settings found" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
+}
+var SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+var SHIM_END = "# <<< SolonGate shield <<<";
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
+  }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir6(), f)).filter((f) => existsSync2(f));
+}
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync2(file) ? readFileSync4(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
+  }
+  mkdirSync4(dirname(file), { recursive: true });
+  writeFileSync5(file, content);
+}
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
+    try {
+      writeShimBlock(file, null);
+    } catch {
+    }
+  }
+}
 
 // src/logs-server-daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -3587,6 +3686,17 @@ function SettingsPanel({
           setEditing("wh-url");
         } else if (cur.kind === "alert-add-email") openAlertEditor("email");
         else if (cur.kind === "alert-add-tg") openAlertEditor("telegram");
+      } else if (inp === "d" && cur.kind === "guard") {
+        const k = keyOf(cur);
+        if (confirmDel !== k) {
+          setConfirmDel(k);
+          setMsg({ text: "\u26A0 d again REMOVES the guard from this device \u2014 Claude Code sessions stop being protected until you reinstall", level: "bad" });
+          return;
+        }
+        setConfirmDel(null);
+        const res = uninstallGlobalQuiet();
+        setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
+        guardQ.reload();
       } else if (inp === "d" && (cur.kind === "wh" || cur.kind === "alert")) {
         const k = keyOf(cur);
         if (confirmDel !== k) {
@@ -3694,8 +3804,8 @@ function SettingsPanel({
           /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "guard".padEnd(11) }),
           guard ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
             /* @__PURE__ */ jsx7(Text7, { color: guard.up_to_date ? theme.ok : theme.warn, children: `v${guard.installed ?? "?"}` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter to update` }),
-            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""}` })
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: guard.up_to_date ? " (latest)" : ` \u2192 v${guard.latest} available \xB7 enter update` }),
+            /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: `  \xB7  ${guard.device_count} device${guard.device_count === 1 ? "" : "s"}${guard.outdated_count ? ` \xB7 ${guard.outdated_count} outdated` : ""} \xB7 d remove` })
           ] }) : /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "loading\u2026" })
         ] });
       case "self":
@@ -3760,7 +3870,7 @@ function SettingsPanel({
   const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook version (enter to update) + self-protection toggle",
+    PROTECTION: "guard hook: enter update \xB7 d remove \xB7 + self-protection toggle",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`

package/hooks/guard.bundled.mjs

@@ -6536,7 +6536,7 @@ import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 40;
+var HOOK_VERSION = 41;
 function localLogsOnly(security) {
   if (security && typeof security === "object") {
     const l = security.localLogs;

package/hooks/guard.mjs

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 40;
+const HOOK_VERSION = 41;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.81.76",
+  "version": "0.81.78",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {