@solongate/proxy 0.82.13 → 0.82.15

package/README.md

@@ -61,7 +61,7 @@ Manage everything from the **Policies**, **Audit**, and **Settings** pages in th
 <table cellspacing="0" cellpadding="0" border="0" align="center">
   <tr>
     <td><a href="https://claude.com/claude-code"><img src="https://solongate.com/cells/claude.png" width="200" alt="Claude Code" /></a></td>
-    <td><a href="https://antigravity.google"><img src="https://solongate.com/cells/antigravity.png" width="200" alt="Antigravity CLI" /></a></td>
+    <td><a href="https://antigravity.google"><img src="https://solongate.com/cells/antigravity.png?v=2" width="200" alt="Antigravity CLI" /></a></td>
     <td><a href="https://openclaw.ai"><img src="https://solongate.com/cells/openclaw.png" width="200" alt="OpenClaw (soon)" /></a></td>
     <td><a href="https://openai.com/codex"><img src="https://solongate.com/cells/codex.png" width="200" alt="Codex (soon)" /></a></td>
   </tr>

package/dist/api-client/client.d.ts

@@ -44,7 +44,7 @@ export declare class ApiError extends Error {
     readonly code: string;
     constructor(status: number, code: string, message: string);
 }
-/** Raised when no API key can be found — tells the user to run `solongate login`. */
+/** Raised when no API key can be found — tells the user to run `solongate` and pair. */
 export declare class NotAuthenticatedError extends Error {
     constructor();
 }

package/dist/commands/index.js

@@ -1039,7 +1039,7 @@ async function run6(argv) {
   const json = flagBool(flags, "json");
   const checks = [];
   if (!isAuthenticated()) {
-    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate`, add your account in the Accounts panel" });
   } else {
     const { apiUrl } = resolveCredentials();
     checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
@@ -1059,7 +1059,7 @@ async function run6(argv) {
     }
     try {
       const g = await api.settings.getGuardStatus();
-      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 update from \`solongate\` \u2192 Settings \u2192 guard` });
     } catch {
     }
   }

package/dist/global-install.js

@@ -323,7 +323,7 @@ function writeShimBlock(file, block) {
 function installClaudeShim(shieldPath) {
   const real = resolveRealClaude();
   if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-open `solongate` \u2192 Settings \u2192 guard.)");
     return;
   }
   const node = process.execPath.replace(/\\/g, "/");

package/dist/index.js

@@ -271,7 +271,7 @@ function parseArgs(argv) {
   }
   if (!apiKey) {
     throw new Error(
-      "Not logged in. Run this once to get started:\n\n  solongate login\n"
+      "Not logged in. Run this once to get started:\n\n  solongate\n\n  then add your account from the Accounts panel.\n"
     );
   }
   if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
@@ -327,7 +327,7 @@ function parseArgs(argv) {
   }
   if (upstreamArgs.length === 0) {
     throw new Error(
-      "No upstream server command provided.\n\nIf you just want to get started, run:\n  solongate login\n"
+      "No upstream server command provided.\n\nIf you just want to get started, run:\n  solongate\n"
     );
   }
   const [command, ...commandArgs] = upstreamArgs;
@@ -12012,7 +12012,7 @@ async function run6(argv) {
   const json = flagBool(flags, "json");
   const checks = [];
   if (!isAuthenticated()) {
-    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate login`" });
+    checks.push({ name: "login", ok: false, detail: "not logged in \u2014 run `solongate`, add your account in the Accounts panel" });
   } else {
     const { apiUrl } = resolveCredentials();
     checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
@@ -12032,7 +12032,7 @@ async function run6(argv) {
     }
     try {
       const g = await api.settings.getGuardStatus();
-      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 run \`solongate login\`` });
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 update from \`solongate\` \u2192 Settings \u2192 guard` });
     } catch {
     }
   }
@@ -16968,7 +16968,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["login", "shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "dataroom"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
   console.log = (...args) => {
@@ -17034,8 +17034,10 @@ async function main4() {
     process.exit(code);
   }
   if (subcommand === "login") {
-    const { launchTui: launchTui2 } = await Promise.resolve().then(() => (init_tui(), tui_exports));
-    await launchTui2();
+    console.log("");
+    console.log(`  ${c.dim}\`solongate login\` was removed.${c.reset} Run ${c.cyan}solongate${c.reset} and add your`);
+    console.log(`  account from the Accounts panel \u2014 the guard installs and updates from there.`);
+    console.log("");
     return;
   }
   if (subcommand === "shield") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.13",
+  "version": "0.82.15",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {

package/dist/login.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/dist/login.js

@@ -1,466 +0,0 @@
-#!/usr/bin/env node
-
-// src/login.ts
-import { spawn } from "child_process";
-
-// src/cli-utils.ts
-var c = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  italic: "\x1B[3m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m",
-  blue1: "\x1B[38;2;20;50;160m",
-  blue2: "\x1B[38;2;40;80;190m",
-  blue3: "\x1B[38;2;60;110;215m",
-  blue4: "\x1B[38;2;90;140;230m",
-  blue5: "\x1B[38;2;130;170;240m",
-  blue6: "\x1B[38;2;170;200;250m",
-  green: "\x1B[38;2;80;200;120m",
-  red: "\x1B[38;2;220;80;80m",
-  cyan: "\x1B[38;2;100;200;220m",
-  yellow: "\x1B[38;2;220;200;80m",
-  bgBlue: "\x1B[48;2;20;50;160m"
-};
-var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
-
-// src/global-install.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "fs";
-import { resolve, join, dirname } from "path";
-import { homedir } from "os";
-import { fileURLToPath } from "url";
-import { createInterface } from "readline";
-import { execFileSync } from "child_process";
-var __dirname = dirname(fileURLToPath(import.meta.url));
-var HOOKS_DIR = resolve(__dirname, "..", "hooks");
-function lockFile(file) {
-  if (!existsSync(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join(p.hooksDir, "guard.mjs"),
-    join(p.hooksDir, "audit.mjs"),
-    join(p.hooksDir, "stop.mjs"),
-    join(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath,
-    p.antigravityHooksPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir();
-  const sgDir = join(home, ".solongate");
-  const hooksDir = join(sgDir, "hooks");
-  const claudeDir = join(home, ".claude");
-  const antigravityDir = join(home, ".gemini", "config");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    antigravityDir,
-    settingsPath: join(claudeDir, "settings.json"),
-    backupPath: join(claudeDir, "settings.solongate.bak"),
-    configPath: join(sgDir, "cloud-guard.json"),
-    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
-    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
-    // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join(antigravityDir, "hooks.solongate.bak")
-  };
-}
-function readHook(filename) {
-  return readFileSync(join(HOOKS_DIR, filename), "utf-8");
-}
-function readGuard() {
-  const bundled = join(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync(bundled) ? readFileSync(bundled, "utf-8") : readHook("guard.mjs");
-}
-var ANTIGRAVITY_GROUP = "solongate-guard";
-function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
-}
-function installAntigravityGuard(p, guardAbs) {
-  mkdirSync(p.antigravityDir, { recursive: true });
-  let existing = {};
-  if (existsSync(p.antigravityHooksPath)) {
-    const raw = readFileSync(p.antigravityHooksPath, "utf-8");
-    if (!existsSync(p.antigravityBackupPath)) writeFileSync(p.antigravityBackupPath, raw);
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const merged = {
-    ...existing,
-    [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
-    }
-  };
-  writeFileSync(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
-}
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((res) => rl.question(question, (a) => {
-    rl.close();
-    res(a.trim());
-  }));
-}
-var SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-var SHIM_END = "# <<< SolonGate shield <<<";
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function resolveRealClaude() {
-  try {
-    const finder = process.platform === "win32" ? "where" : "which";
-    const out = execFileSync(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-    if (process.platform === "win32") {
-      const low = (s) => s.toLowerCase();
-      return out.find((l) => low(l).endsWith(".cmd")) || out.find((l) => low(l).endsWith(".exe")) || out.find((l) => low(l).endsWith(".bat")) || out[0] || null;
-    }
-    return out[0] || null;
-  } catch {
-    return null;
-  }
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join(homedir(), f)).filter((f) => existsSync(f));
-}
-function writeShimBlock(file, block) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync(file) ? readFileSync(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block + "\n";
-  }
-  mkdirSync(dirname(file), { recursive: true });
-  writeFileSync(file, content);
-}
-function installClaudeShim(shieldPath) {
-  const real = resolveRealClaude();
-  if (!real) {
-    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-run `login`.)");
-    return;
-  }
-  const node = process.execPath.replace(/\\/g, "/");
-  const shield = shieldPath.replace(/\\/g, "/");
-  const win = process.platform === "win32";
-  const block = win ? `${SHIM_BEGIN}
-function claude { & "${node}" "${shield}" -- "${real}" @args }
-${SHIM_END}` : `${SHIM_BEGIN}
-claude() { "${node}" "${shield}" -- "${real}" "$@"; }
-${SHIM_END}`;
-  const targets = shimTargets();
-  if (targets.length === 0) return;
-  for (const file of targets) {
-    try {
-      writeShimBlock(file, block);
-    } catch {
-    }
-  }
-}
-async function runGlobalInstall(opts = {}) {
-  const p = globalPaths();
-  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    try {
-      const cfg = JSON.parse(readFileSync(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
-    } catch {
-    }
-  }
-  if (!apiKey || apiKey === "sg_live_your_key_here") {
-    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
-  }
-  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
-    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
-    process.exit(1);
-  }
-  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  mkdirSync(p.hooksDir, { recursive: true });
-  mkdirSync(p.claudeDir, { recursive: true });
-  unlockProtected();
-  writeFileSync(join(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync(join(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync(join(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync(join(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join(p.hooksDir, "shield.mjs"));
-  writeFileSync(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-  console.log(`  Wrote ${p.configPath}`);
-  let existing = {};
-  if (existsSync(p.settingsPath)) {
-    const raw = readFileSync(p.settingsPath, "utf-8");
-    if (!existsSync(p.backupPath)) {
-      writeFileSync(p.backupPath, raw);
-      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
-    }
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const guardAbs = join(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
-  const merged = {
-    ...existing,
-    hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
-      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
-    }
-  };
-  writeFileSync(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
-  try {
-    installAntigravityGuard(p, guardAbs);
-    console.log(`  Registered Antigravity CLI guard \u2192 ${p.antigravityHooksPath}`);
-  } catch {
-  }
-  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
-    lockProtected();
-    console.log("  Locked protection files (OS-level read-only/immutable).");
-  }
-}
-
-// src/api-client/client.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "fs";
-import { resolve as resolve2, join as join2 } from "path";
-import { homedir as homedir2 } from "os";
-var accountsFile = () => join2(homedir2(), ".solongate", "accounts.json");
-function saveAccount(acc) {
-  try {
-    const list = (() => {
-      try {
-        const raw = JSON.parse(readFileSync2(accountsFile(), "utf-8"));
-        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
-      } catch {
-        return [];
-      }
-    })();
-    const next = list.filter((a) => a.apiKey !== acc.apiKey);
-    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync2(join2(homedir2(), ".solongate"), { recursive: true });
-    writeFileSync2(accountsFile(), JSON.stringify(next, null, 2));
-  } catch {
-  }
-}
-
-// src/login.ts
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-function startSpinner(text) {
-  if (!process.stderr.isTTY) {
-    process.stderr.write(`  ${text}
-`);
-    return (finalLine) => {
-      if (finalLine) process.stderr.write(finalLine + "\n");
-    };
-  }
-  let i = 0;
-  const draw = () => {
-    const frame = SPINNER_FRAMES[i = (i + 1) % SPINNER_FRAMES.length];
-    process.stderr.write(`\r  ${c.cyan}${frame}${c.reset} ${c.dim}${text}${c.reset}\x1B[K`);
-  };
-  draw();
-  const timer = setInterval(draw, 80);
-  return (finalLine) => {
-    clearInterval(timer);
-    process.stderr.write("\r\x1B[K");
-    if (finalLine) process.stderr.write(finalLine + "\n");
-  };
-}
-function parseArgs(argv) {
-  const args = argv.slice(3);
-  let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-  let install = true;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--api-url") apiUrl = args[++i] || apiUrl;
-    else if (args[i] === "--no-install") install = false;
-  }
-  return { apiUrl, install };
-}
-function openBrowser(url) {
-  try {
-    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function main() {
-  const { apiUrl, install } = parseArgs(process.argv);
-  console.log("");
-  console.log(`  ${c.bold}${c.blue4}SolonGate${c.reset} ${c.dim}\u2014 Login${c.reset}`);
-  console.log("");
-  let start;
-  try {
-    const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    start = await res.json();
-  } catch (e) {
-    console.log(`  Could not reach SolonGate (${apiUrl}).`);
-    console.log(`  ${e instanceof Error ? e.message : String(e)}`);
-    process.exit(1);
-  }
-  const { device_code, user_code, verification_uri_complete, verification_uri, interval, expires_in } = start;
-  const verifyUrl = verification_uri_complete || verification_uri;
-  console.log(`  ${c.blue5}\u2192${c.reset} Opening your browser to authorize this device\u2026`);
-  console.log("");
-  console.log(`  ${c.dim}If it doesn't open, visit this link:${c.reset}`);
-  console.log(`  ${c.cyan}${verifyUrl}${c.reset}`);
-  console.log("");
-  void user_code;
-  openBrowser(verifyUrl);
-  const pollMs = Math.max(2, Number(interval) || 3) * 1e3;
-  const deadline = Date.now() + (Number(expires_in) || 600) * 1e3;
-  let apiKey = "";
-  const stopSpinner = startSpinner("Waiting for authorization\u2026");
-  while (Date.now() < deadline) {
-    await sleep(pollMs);
-    try {
-      const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ device_code })
-      });
-      const data = await res.json().catch(() => ({}));
-      if (data?.status === "approved" && data?.api_key) {
-        apiKey = data.api_key;
-        stopSpinner();
-        console.log("");
-        const who = data?.user?.name || data?.user?.email;
-        const mail = data?.user?.email;
-        if (who) {
-          const suffix = mail && mail !== who ? ` ${c.dim}(${mail})${c.reset}` : "";
-          console.log(`  ${c.green}\u2713${c.reset} ${c.bold}Logged in as ${c.white}${who}${c.reset}${suffix}`);
-        } else {
-          console.log(`  ${c.green}\u2713${c.reset} ${c.bold}Logged in${c.reset}`);
-        }
-        if (data?.project?.name) {
-          console.log(`  ${c.dim}Project:${c.reset} ${c.cyan}${data.project.name}${c.reset}`);
-        }
-        saveAccount({ apiKey, apiUrl, project: data?.project?.name, user: data?.user?.name || data?.user?.email, email: data?.user?.email });
-        break;
-      }
-      if (data?.status === "expired" || data?.status === "not_found") {
-        stopSpinner(`  ${c.red}\u2717${c.reset} Code expired. Run \`login\` again.`);
-        process.exit(1);
-      }
-    } catch {
-    }
-  }
-  if (!apiKey) {
-    stopSpinner(`  ${c.red}\u2717${c.reset} Timed out waiting for authorization. Run \`login\` again.`);
-    process.exit(1);
-  }
-  if (!install) {
-    console.log("");
-    console.log("  Logged in. Re-run `login` to enable system-wide enforcement.");
-    return;
-  }
-  console.log("");
-  await runGlobalInstall({ apiKey, apiUrl });
-  console.log("");
-  console.log("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  console.log("  \u2502  You are logged in and protected.               \u2502");
-  console.log("  \u2502  Every Claude Code session on this machine is   \u2502");
-  console.log("  \u2502  now guarded by your cloud policy (OPA WASM).   \u2502");
-  console.log("  \u2502                                                 \u2502");
-  console.log("  \u2502  Manage policy: https://dashboard.solongate.com \u2502");
-  console.log("  \u2502  Restart Claude Code to apply.                  \u2502");
-  console.log("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  console.log("");
-  console.log(`  ${c.bold}${c.yellow}!  Already-open terminals are NOT protected yet.${c.reset}`);
-  console.log(`  ${c.dim}   Hooks load only when a session starts, so any terminal`);
-  console.log(`     (and the Claude Code running in it) that was already open`);
-  console.log(`     won't be caught. Open a NEW terminal and start Claude Code`);
-  console.log(`     there for the guard + audit logging to take effect.${c.reset}`);
-  console.log("");
-}
-main().catch((err) => {
-  console.log(`Fatal: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
-});