@solongate/proxy 0.82.19 → 0.82.21

package/dist/index.js

@@ -3398,12 +3398,12 @@ ${ctx.indent}`;
       for (const {
         format,
         test,
-        resolve: resolve10
+        resolve: resolve9
       } of tags) {
         if (test) {
           const match = str.match(test);
           if (match) {
-            let res = resolve10.apply(null, match);
+            let res = resolve9.apply(null, match);
             if (!(res instanceof Scalar)) res = new Scalar(res);
             if (format) res.format = format;
             return res;
@@ -6622,9 +6622,9 @@ async function fetchLatest() {
 function spawnGlobalInstall(version) {
   try {
     mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-    const log6 = openSync(LOG_FILE, "a");
+    const log5 = openSync(LOG_FILE, "a");
     const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
-      stdio: ["ignore", log6, log6],
+      stdio: ["ignore", log5, log5],
       detached: true,
       windowsHide: true,
       shell: process.platform === "win32"
@@ -6638,7 +6638,7 @@ function spawnGlobalInstall(version) {
   }
 }
 function runGlobalInstall(version) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve9) => {
     try {
       mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
       execFile(
@@ -6653,11 +6653,11 @@ ${stderr}
 `, { flag: "a" });
           } catch {
           }
-          resolve10(!err2);
+          resolve9(!err2);
         }
       );
     } catch {
-      resolve10(false);
+      resolve9(false);
     }
   });
 }
@@ -6772,11 +6772,11 @@ function startLogsServerDaemon() {
   }
   try {
     mkdirSync4(DIR, { recursive: true });
-    const log6 = openSync2(LOG_FILE2, "a");
+    const log5 = openSync2(LOG_FILE2, "a");
     const cli = join5(dirname2(fileURLToPath2(import.meta.url)), "index.js");
     const p = spawn2(process.execPath, [cli, "logs-server"], {
       detached: true,
-      stdio: ["ignore", log6, log6],
+      stdio: ["ignore", log5, log5],
       windowsHide: true
     });
     p.on("error", () => {
@@ -7854,7 +7854,7 @@ function LivePanel({ active: active2 }) {
   const [localBuf, setLocalBuf] = useState2([]);
   const [localOn, setLocalOn] = useState2(null);
   const [ring, setRing] = useState2(null);
-  const [log6, setLog] = useState2([]);
+  const [log5, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
   const [signal, setSignal] = useState2("none");
   const [search, setSearch] = useState2("");
@@ -8698,7 +8698,7 @@ function LivePanel({ active: active2 }) {
       ] }),
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
-        log6.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        log5.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
             hhmmss(l.ts),
             " "
@@ -9635,7 +9635,7 @@ function AuditPanel({ active: active2, focused }) {
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
     setMsg({ text: "deleting\u2026", level: "ok" });
-    const run12 = async () => {
+    const run10 = async () => {
       if (source === "cloud") {
         if (kind === "one") {
           if (!current) throw new Error("nothing selected");
@@ -9651,14 +9651,14 @@ function AuditPanel({ active: active2, focused }) {
         localQ.reload();
       }
     };
-    run12().then(() => {
+    run10().then(() => {
       setMsg({ text: kind === "one" ? "\u2713 entry deleted" : `\u2713 ALL ${source} logs deleted`, level: "ok" });
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
-    const run12 = async () => {
+    const run10 = async () => {
       const dir = join10(homedir8(), ".solongate");
       const file = join10(dir, `audit-export-${source}.jsonl`);
       let rows2;
@@ -9671,7 +9671,7 @@ function AuditPanel({ active: active2, focused }) {
       writeFileSync8(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
-    run12().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+    run10().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   useInput5(
     (input, key) => {
@@ -10554,7 +10554,7 @@ function SettingsPanel({
     guardQ.reload();
     selfQ.reload();
   };
-  const run12 = (label, fn, reload) => {
+  const run10 = (label, fn, reload) => {
     if (busy) return;
     setBusy(true);
     setMsg({ text: label + "\u2026", level: "ok" });
@@ -10636,8 +10636,8 @@ function SettingsPanel({
     const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
     const id = editor.id;
     setEditor(null);
-    if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
-    else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
+    if (id) run10("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run10(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
   };
   const activate = (r) => {
     if (r.kind === "acct") {
@@ -10653,14 +10653,14 @@ function SettingsPanel({
       guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
-      run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+      run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
         setMsg({ text: "set a path first (\u2193 then enter)", level: "bad" });
         return;
       }
-      run12(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
+      run10(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
     } else if (r.kind === "ll-path") {
       setInput(local?.path ?? "");
       setEditing("path");
@@ -10671,7 +10671,7 @@ function SettingsPanel({
         next.running ? { text: `\u2713 dashboard link running on 127.0.0.1:${next.port} \u2014 keeps running after you close the dataroom`, level: "ok" } : { text: "\u2713 dashboard link stopped (disabled until you start it again)", level: "ok" }
       );
     } else if (r.kind === "wh") {
-      run12(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
+      run10(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
     } else if (r.kind === "wh-add") {
       setInput("");
       setEditing("wh-url");
@@ -10690,7 +10690,7 @@ function SettingsPanel({
     setEditing(null);
     if (which === "path") {
       const enabled = (local?.enabled ?? false) && v.length > 0;
-      run12(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
+      run10(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
     } else if (which === "wh-url") {
       const url = v.replace(/^["'<]+|["'>]+$/g, "").trim();
       if (!url) return;
@@ -10698,7 +10698,7 @@ function SettingsPanel({
         setMsg({ text: "\u2717 webhook url must start with http:// or https://", level: "bad" });
         return;
       }
-      run12("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
+      run10("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
     } else if (which === "alert-target" && editor) {
       setEditor({ ...editor, target: v, field: 1 });
     }
@@ -10752,7 +10752,7 @@ function SettingsPanel({
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
-          if (cur.kind === "alert") run12(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
+          if (cur.kind === "alert") run10(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
       } else if (inp === "x" && cur.kind === "acct") {
@@ -10782,13 +10782,13 @@ function SettingsPanel({
         refreshAccounts();
         onAccountsChanged?.();
       } else if (inp === "t" && cur.kind === "wh") {
-        run12("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
+        run10("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
-        run12(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
+        run10(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
       } else if (inp === "e" && cur.kind === "alert") {
         const ch = alertChannel(cur.rule);
         if (ch) openAlertEditor(ch, cur.rule);
@@ -10825,10 +10825,10 @@ function SettingsPanel({
         setConfirmDel(null);
         if (cur.kind === "wh") {
           const id = cur.wh.id;
-          run12("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
+          run10("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
         } else {
           const id = cur.rule.id;
-          run12("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
+          run10("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
         }
       } else if (inp === "r") reloadAll();
     },
@@ -11128,9 +11128,9 @@ function App() {
   const [update2, setUpdate] = useState8({ kind: "idle" });
   useEffect7(() => {
     let alive = true;
-    const run12 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
-    run12();
-    const t = setInterval(run12, 30 * 6e4);
+    const run10 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
+    run10();
+    const t = setInterval(run10, 30 * 6e4);
     return () => {
       alive = false;
       clearInterval(t);
@@ -12204,7 +12204,7 @@ var init_watch = __esm({
   }
 });
 
-// src/commands/keys.ts
+// src/commands/alerts.ts
 async function run8(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
@@ -12212,89 +12212,6 @@ async function run8(argv) {
   switch (sub) {
     case "help":
       return err(USAGE6), 0;
-    case "list": {
-      const { keys } = await api.keys.list();
-      if (json) return printJson(keys), 0;
-      if (!keys.length) return err(dim("  No API keys.")), 0;
-      table(
-        ["ID", "NAME", "PREFIX", "CREATED"],
-        keys.map((k) => [dim(truncate3(k.id, 10)), truncate3(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
-      );
-      return 0;
-    }
-    case "create": {
-      const name = flagStr(flags, "name");
-      if (!name) return err("  Usage: keys create --name <name>"), 1;
-      const res = await api.keys.create(name, !flagBool(flags, "test"));
-      if (json) return printJson(res), 0;
-      err(green(`  \u2713 Created "${res.name}"`));
-      err("");
-      err("  " + bold(res.key));
-      err(dim("  \u2191 shown only once \u2014 copy it now."));
-      return 0;
-    }
-    case "revoke": {
-      const id = positionals[1];
-      if (!id) return err("  Usage: keys revoke <id>"), 1;
-      await api.keys.revoke(id);
-      if (json) return printJson({ ok: true, id }), 0;
-      return err(green(`  \u2713 Revoked ${id}`)), 0;
-    }
-    default:
-      return err(USAGE6), 1;
-  }
-}
-var USAGE6;
-var init_keys2 = __esm({
-  "src/commands/keys.ts"() {
-    "use strict";
-    init_api_client();
-    init_args();
-    init_format();
-    USAGE6 = `${bold("solongate keys")} \u2014 API keys
-
-  keys list                 List keys (prefix only)
-  keys create --name <n>    Create a key (secret shown once)
-  keys revoke <id>          Revoke a key
-
-  Add --json for machine-readable output.`;
-  }
-});
-
-// src/commands/mcp.ts
-async function run9(argv) {
-  const { flags } = parse(argv);
-  const json = flagBool(flags, "json");
-  const { servers } = await api.mcp.list();
-  if (json) return printJson(servers), 0;
-  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
-  table(
-    ["STATUS", "NAME", "TARGET"],
-    servers.map((s) => [
-      s.status === "active" ? green(s.status) : yellow(s.status),
-      cyan(truncate3(s.name, 24)),
-      dim(truncate3(s.url || s.command || "\u2014", 46))
-    ])
-  );
-  return 0;
-}
-var init_mcp2 = __esm({
-  "src/commands/mcp.ts"() {
-    "use strict";
-    init_api_client();
-    init_args();
-    init_format();
-  }
-});
-
-// src/commands/alerts.ts
-async function run10(argv) {
-  const { positionals, flags } = parse(argv);
-  const sub = positionals[0] ?? "list";
-  const json = flagBool(flags, "json");
-  switch (sub) {
-    case "help":
-      return err(USAGE7), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -12336,17 +12253,17 @@ async function run10(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return err(USAGE6), 1;
   }
 }
-var USAGE7;
+var USAGE6;
 var init_alerts = __esm({
   "src/commands/alerts.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+    USAGE6 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
 
   alerts list
   alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
@@ -12358,13 +12275,13 @@ var init_alerts = __esm({
 });
 
 // src/commands/webhooks.ts
-async function run11(argv) {
+async function run9(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE8), 0;
+      return err(USAGE7), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -12390,17 +12307,17 @@ async function run11(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE8), 1;
+      return err(USAGE7), 1;
   }
 }
-var USAGE8;
+var USAGE7;
 var init_webhooks = __esm({
   "src/commands/webhooks.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+    USAGE7 = `${bold("solongate webhooks")} \u2014 event webhooks
 
   webhooks list
   webhooks add --url <https://\u2026> [--events denials|allowed|all]
@@ -12436,14 +12353,10 @@ async function dispatch(command, argv) {
       return run6(argv);
     case "watch":
       return run7(argv);
-    case "keys":
-      return run8(argv);
-    case "mcp":
-      return run9(argv);
     case "alerts":
-      return run10(argv);
+      return run8(argv);
     case "webhooks":
-      return run11(argv);
+      return run9(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -12480,333 +12393,9 @@ var init_commands = __esm({
     init_agents2();
     init_doctor();
     init_watch();
-    init_keys2();
-    init_mcp2();
     init_alerts();
     init_webhooks();
-    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
-  }
-});
-
-// src/shield.ts
-var shield_exports = {};
-__export(shield_exports, {
-  runShield: () => runShield
-});
-import { createServer, request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-import { spawn as spawn5 } from "child_process";
-import { URL as URL2 } from "url";
-import { readFileSync as readFileSync11, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
-import { resolve as resolve5 } from "path";
-import { homedir as homedir13 } from "os";
-function findCacheFile() {
-  const dir = resolve5(homedir13(), ".solongate");
-  const envSel = process.env.SOLONGATE_AGENT_ID;
-  if (envSel) {
-    const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync7(f)) return f;
-  }
-  let best = null, bestTs = -1;
-  try {
-    for (const name of readdirSync(dir)) {
-      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
-        const full = resolve5(dir, name);
-        const ts = statSync4(full).mtimeMs;
-        if (ts > bestTs) {
-          bestTs = ts;
-          best = full;
-        }
-      }
-    }
-  } catch {
-  }
-  return best;
-}
-function loadCfg() {
-  try {
-    const f = findCacheFile();
-    if (f && existsSync7(f)) {
-      const c2 = JSON.parse(readFileSync11(f, "utf-8"));
-      const d = c2?.security?.dlpRedact;
-      const g = c2?.security?.ghost;
-      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
-      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
-    }
-  } catch {
-  }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
-}
-function ghostGlobToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c2 = glob[i];
-    if (c2 === "*") {
-      if (glob[i + 1] === "*") {
-        re += ".*";
-        i++;
-      } else re += "[^/]*";
-    } else if (c2 === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c2) !== -1) re += "\\" + c2;
-    else re += c2;
-  }
-  try {
-    return new RegExp("^" + re + "$");
-  } catch {
-    return null;
-  }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, "/").replace(/\/+$/, "");
-  if (!norm) return false;
-  const segments = norm.split("/").filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || "").trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith("/")) {
-      dirOnly = true;
-      pat = pat.slice(0, -1);
-    }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf("/") !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) {
-        if (segments.indexOf(pat) !== -1) return true;
-        continue;
-      }
-      let acc = "";
-      for (const s of segments) {
-        acc = acc ? acc + "/" + s : s;
-        if (re.test(acc) || re.test(s)) return true;
-      }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || "").trim();
-  t = t.replace(/^[<>|;&(]+/, "").replace(/[);&|]+$/, "");
-  t = t.replace(/^['"]+/, "").replace(/['"]+$/, "");
-  t = t.replace(/^\d*>>?/, "");
-  return t.trim();
-}
-function ghostStripLines(text, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return text;
-  const lines = String(text).split("\n");
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      kept.push(line);
-      continue;
-    }
-    if (ghostMatch(trimmed, pats)) continue;
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) {
-      kept.push(line);
-      continue;
-    }
-    if (toks.length > 3) continue;
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join("  "));
-  }
-  return kept.join("\n");
-}
-function dlpGlobToRe(glob, flags) {
-  let re = "";
-  for (const ch of String(glob || "")) {
-    if (ch === "*") re += "[^\\s]*";
-    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
-    else re += ch;
-  }
-  return new RegExp(re, flags);
-}
-function redactString(s, cfg) {
-  if (!cfg || typeof s !== "string" || !s) return s;
-  const allow = new Set(cfg.patterns);
-  const NUL = String.fromCharCode(0);
-  const labels = [];
-  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
-  let out2 = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
-  for (const c2 of cfg.custom) {
-    try {
-      out2 = out2.replace(dlpGlobToRe(c2.re, "gi"), () => stash(`[REDACTED: ${c2.name || "custom"}]`));
-    } catch {
-    }
-  }
-  return out2.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
-}
-function redactDeep(value, cfg) {
-  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
-  if (typeof value === "string") {
-    let out2 = redactString(value, cfg);
-    if (ghost && ghost.length) out2 = ghostStripLines(out2, ghost);
-    if (out2 === "" && value !== "") out2 = "\n";
-    return out2;
-  }
-  if (Array.isArray(value)) {
-    const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
-    return arr.map((v) => redactDeep(v, cfg));
-  }
-  if (value && typeof value === "object") {
-    const out2 = {};
-    for (const [k, v] of Object.entries(value)) out2[k] = redactDeep(v, cfg);
-    return out2;
-  }
-  return value;
-}
-function pickUpstream() {
-  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
-  try {
-    return new URL2(raw);
-  } catch {
-    return new URL2("https://api.anthropic.com");
-  }
-}
-function startProxy(upstream) {
-  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
-  const server = createServer((req, res) => {
-    const cfg = loadCfg();
-    const chunks = [];
-    req.on("data", (c2) => chunks.push(c2));
-    req.on("end", () => {
-      let body = Buffer.concat(chunks);
-      try {
-        if (body.length && (req.headers["content-type"] || "").includes("json")) {
-          const parsed = JSON.parse(body.toString("utf-8"));
-          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
-            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
-            const msgs = parsed["messages"];
-            for (let i = 0; i < msgs.length; i++) {
-              const m = msgs[i];
-              if (m && m["role"] !== "assistant") msgs[i] = redactDeep(m, cfg);
-            }
-            body = Buffer.from(JSON.stringify(parsed), "utf-8");
-          } else {
-            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
-          }
-        }
-      } catch {
-      }
-      const headers = { ...req.headers };
-      delete headers["host"];
-      delete headers["content-length"];
-      delete headers["accept-encoding"];
-      headers["content-length"] = String(body.length);
-      const upstreamReq = forward(
-        {
-          protocol: upstream.protocol,
-          hostname: upstream.hostname,
-          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
-          method: req.method,
-          path: req.url,
-          headers: { ...headers, host: upstream.host }
-        },
-        (upRes) => {
-          res.writeHead(upRes.statusCode || 502, upRes.headers);
-          upRes.pipe(res);
-        }
-      );
-      upstreamReq.on("error", (e) => {
-        log4("upstream error:", e.message);
-        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
-        res.end("shield upstream error");
-      });
-      upstreamReq.end(body);
-    });
-    req.on("error", () => {
-      try {
-        res.destroy();
-      } catch {
-      }
-    });
-  });
-  return new Promise((resolveP) => {
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveP({ port, close: () => server.close() });
-    });
-  });
-}
-async function runShield() {
-  const sep = process.argv.indexOf("--");
-  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
-  if (cmd.length === 0) {
-    log4("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
-    process.exit(1);
-  }
-  const upstream = pickUpstream();
-  const { port, close } = await startProxy(upstream);
-  log4(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn5(cmd[0], cmd.slice(1), {
-    stdio: "inherit",
-    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
-    shell: process.platform === "win32"
-    // resolve `claude.cmd` etc. on Windows
-  });
-  const shutdown = () => {
-    try {
-      close();
-    } catch {
-    }
-  };
-  child.on("exit", (code, signal) => {
-    shutdown();
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
-  });
-  child.on("error", (e) => {
-    log4("failed to launch command:", e.message);
-    shutdown();
-    process.exit(1);
-  });
-  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
-    try {
-      child.kill(sig);
-    } catch {
-    }
-  });
-}
-var log4, DLP_PATTERNS;
-var init_shield = __esm({
-  "src/shield.ts"() {
-    "use strict";
-    log4 = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
-`);
-    DLP_PATTERNS = [
-      { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-      { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-      { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-      { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
-      { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-      { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
-      { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
-      { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-      { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
-      { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
-      { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
-      { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
-      { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-      { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi }
-    ];
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks"];
   }
 });
 
@@ -12815,11 +12404,11 @@ var logs_server_exports = {};
 __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
-import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join15, isAbsolute } from "path";
-import { homedir as homedir14 } from "os";
-import { readdirSync as readdirSync2 } from "fs";
+import { createServer } from "http";
+import { readFileSync as readFileSync11, statSync as statSync4 } from "fs";
+import { resolve as resolve5, join as join15, isAbsolute } from "path";
+import { homedir as homedir13 } from "os";
+import { readdirSync } from "fs";
 function allowedOrigins() {
   const base = [
     "https://dashboard.solongate.com",
@@ -12835,15 +12424,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir14(), ".solongate", "local-logs");
+  return resolve5(homedir13(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir14(), ".solongate");
+  const base = resolve5(homedir13(), ".solongate");
   try {
-    const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    const files = readdirSync(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync12(join15(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync11(join15(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -12852,7 +12441,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync12(join15(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync11(join15(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -12883,7 +12472,7 @@ function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
   const file = join15(dir, LOG_FILENAME);
   try {
-    const st = statSync5(file);
+    const st = statSync4(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -12915,7 +12504,7 @@ async function runLogsServer() {
   }
   const portArg = argv[argv.indexOf("--port") + 1];
   const port = Number(process.env.SOLONGATE_LOGS_PORT || (argv.includes("--port") ? portArg : "") || DEFAULT_PORT) || DEFAULT_PORT;
-  const server = createServer2(async (req, res) => {
+  const server = createServer(async (req, res) => {
     setCors(req, res);
     if (req.method === "OPTIONS") {
       res.writeHead(204);
@@ -12964,7 +12553,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync12(info.file, "utf-8");
+        const text = readFileSync11(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -13018,8 +12607,8 @@ var init_logs_server = __esm({
 
 // src/inject.ts
 var inject_exports = {};
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync8, copyFileSync } from "fs";
-import { resolve as resolve7 } from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync7, copyFileSync } from "fs";
+import { resolve as resolve6 } from "path";
 import { execSync } from "child_process";
 function parseInjectArgs(argv) {
   const args = argv.slice(2);
@@ -13076,9 +12665,9 @@ WHAT IT DOES
 `);
 }
 function detectProject() {
-  if (!existsSync8(resolve7("package.json"))) return false;
+  if (!existsSync7(resolve6("package.json"))) return false;
   try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync12(resolve6("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
   } catch {
@@ -13087,18 +12676,18 @@ function detectProject() {
 }
 function findTsEntryFile() {
   try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync12(resolve6("package.json"), "utf-8"));
     if (pkg.bin) {
       const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
       if (typeof binPath === "string") {
         const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
+        if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
+        if (existsSync7(resolve6(binPath))) return resolve6(binPath);
       }
     }
     if (pkg.main) {
       const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
+      if (existsSync7(resolve6(srcPath))) return resolve6(srcPath);
     }
   } catch {
   }
@@ -13111,10 +12700,10 @@ function findTsEntryFile() {
     "main.ts"
   ];
   for (const c2 of candidates) {
-    const full = resolve7(c2);
-    if (existsSync8(full)) {
+    const full = resolve6(c2);
+    if (existsSync7(full)) {
       try {
-        const content = readFileSync13(full, "utf-8");
+        const content = readFileSync12(full, "utf-8");
         if (content.includes("McpServer") || content.includes("McpServer")) {
           return full;
         }
@@ -13123,18 +12712,18 @@ function findTsEntryFile() {
     }
   }
   for (const c2 of candidates) {
-    if (existsSync8(resolve7(c2))) return resolve7(c2);
+    if (existsSync7(resolve6(c2))) return resolve6(c2);
   }
   return null;
 }
 function detectPackageManager() {
-  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
+  if (existsSync7(resolve6("pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(resolve6("yarn.lock"))) return "yarn";
   return "npm";
 }
 function installSdk() {
   try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync12(resolve6("package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if (allDeps["@solongate/proxy"]) {
       log3("  @solongate/proxy already installed");
@@ -13155,7 +12744,7 @@ function installSdk() {
   }
 }
 function injectTypeScript(filePath) {
-  const original = readFileSync13(filePath, "utf-8");
+  const original = readFileSync12(filePath, "utf-8");
   const changes = [];
   let modified = original;
   if (modified.includes("SecureMcpServer")) {
@@ -13271,8 +12860,8 @@ async function main() {
     process.exit(1);
   }
   log3("  Language: TypeScript");
-  const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync8(entryFile)) {
+  const entryFile = opts.file ? resolve6(opts.file) : findTsEntryFile();
+  if (!entryFile || !existsSync7(entryFile)) {
     log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
     log3("");
     log3("  Specify it manually: --file <path>");
@@ -13285,7 +12874,7 @@ async function main() {
   log3("");
   const backupPath = entryFile + ".solongate-backup";
   if (opts.restore) {
-    if (!existsSync8(backupPath)) {
+    if (!existsSync7(backupPath)) {
       log3("  No backup found. Nothing to restore.");
       process.exit(1);
     }
@@ -13321,7 +12910,7 @@ async function main() {
     log3("  To apply: npx @solongate/proxy inject");
     process.exit(0);
   }
-  if (!existsSync8(backupPath)) {
+  if (!existsSync7(backupPath)) {
     copyFileSync(entryFile, backupPath);
     log3("");
     log3(`  Backup: ${backupPath}`);
@@ -13355,8 +12944,8 @@ var init_inject = __esm({
 
 // src/create.ts
 var create_exports = {};
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join16 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, existsSync as existsSync8 } from "fs";
+import { resolve as resolve7, join as join16 } from "path";
 import { execSync as execSync2 } from "child_process";
 function withSpinner(message, fn) {
   const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
@@ -13565,9 +13154,9 @@ dist/
 }
 async function main2() {
   const opts = parseCreateArgs(process.argv);
-  const dir = resolve8(opts.name);
+  const dir = resolve7(opts.name);
   printBanner("Create MCP Server");
-  if (existsSync9(dir)) {
+  if (existsSync8(dir)) {
     log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
     process.exit(1);
   }
@@ -13646,14 +13235,14 @@ var init_create = __esm({
 
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync12, existsSync as existsSync10 } from "fs";
-import { resolve as resolve9 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync12, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
-  const envPath = resolve9(".env");
-  if (!existsSync10(envPath)) return;
+  const envPath = resolve8(".env");
+  if (!existsSync9(envPath)) return;
   try {
-    const content = readFileSync14(envPath, "utf-8");
+    const content = readFileSync13(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -13695,20 +13284,20 @@ function parseCliArgs() {
     }
   }
   if (!apiKey) {
-    log5(red2("ERROR: API key not found."));
-    log5("");
-    log5("Set it in .env file:");
-    log5("  SOLONGATE_API_KEY=sg_live_...");
-    log5("");
-    log5("Or pass via environment:");
-    log5(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
+    log4(red2("ERROR: API key not found."));
+    log4("");
+    log4("Set it in .env file:");
+    log4("  SOLONGATE_API_KEY=sg_live_...");
+    log4("");
+    log4("Or pass via environment:");
+    log4(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
     process.exit(1);
   }
   if (!apiKey.startsWith("sg_live_")) {
-    log5(red2("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
+    log4(red2("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
     process.exit(1);
   }
-  return { command, apiKey, file: resolve9(file), policyId };
+  return { command, apiKey, file: resolve8(file), policyId };
 }
 async function listPolicies(apiKey) {
   const res = await fetch(`${API_URL}/api/v1/policies`, {
@@ -13721,18 +13310,18 @@ async function listPolicies(apiKey) {
 async function list5(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
-    log5(yellow2("No policies found. Create one in the dashboard first."));
-    log5(dim2("  https://dashboard.solongate.com/policies"));
+    log4(yellow2("No policies found. Create one in the dashboard first."));
+    log4(dim2("  https://dashboard.solongate.com/policies"));
     return;
   }
   if (policyId) {
     const match = policies.find((p) => p.id === policyId);
     if (!match) {
-      log5(red2(`Policy not found: ${policyId}`));
-      log5("");
-      log5("Available policies:");
+      log4(red2(`Policy not found: ${policyId}`));
+      log4("");
+      log4("Available policies:");
       for (const p of policies) {
-        log5(`  ${dim2("\u2022")} ${p.id}`);
+        log4(`  ${dim2("\u2022")} ${p.id}`);
       }
       process.exit(1);
     }
@@ -13740,10 +13329,10 @@ async function list5(apiKey, policyId) {
     printPolicyDetail(full);
     return;
   }
-  log5("");
-  log5(bold2(`  Policies (${policies.length})`));
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
+  log4("");
+  log4(bold2(`  Policies (${policies.length})`));
+  log4(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log4("");
   const fullPolicies = await Promise.all(
     policies.map(
       (p) => fetchCloudPolicy(apiKey, API_URL, p.id).then((full) => ({ policy: p, rules: full.rules })).catch(() => ({ policy: p, rules: [] }))
@@ -13752,136 +13341,136 @@ async function list5(apiKey, policyId) {
   for (const { policy, rules } of fullPolicies) {
     printPolicySummary(policy, [...rules]);
   }
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
-  log5(`  ${dim2("View details:")}  solongate-proxy list --policy-id <ID>`);
-  log5(`  ${dim2("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
-  log5(`  ${dim2("Push policy:")}   solongate-proxy push --policy-id <ID>`);
-  log5("");
+  log4(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log4("");
+  log4(`  ${dim2("View details:")}  solongate-proxy list --policy-id <ID>`);
+  log4(`  ${dim2("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
+  log4(`  ${dim2("Push policy:")}   solongate-proxy push --policy-id <ID>`);
+  log4("");
 }
 function printPolicySummary(p, rules) {
   const ruleCount = rules.length;
   const allowCount = rules.filter((r) => r.effect === "ALLOW").length;
   const denyCount = rules.filter((r) => r.effect === "DENY").length;
-  log5(`  ${cyan2(p.id)}`);
-  log5(`    ${bold2(p.name)}  ${dim2(`v${p.version ?? "?"}`)}`);
-  log5(`    ${dim2("Rules:")} ${ruleCount}  ${green2(`${allowCount} ALLOW`)}  ${red2(`${denyCount} DENY`)}`);
+  log4(`  ${cyan2(p.id)}`);
+  log4(`    ${bold2(p.name)}  ${dim2(`v${p.version ?? "?"}`)}`);
+  log4(`    ${dim2("Rules:")} ${ruleCount}  ${green2(`${allowCount} ALLOW`)}  ${red2(`${denyCount} DENY`)}`);
   if (p.created_at) {
-    log5(`    ${dim2("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
+    log4(`    ${dim2("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
   }
-  log5("");
+  log4("");
 }
 function printPolicyDetail(policy) {
-  log5("");
-  log5(bold2(`  ${policy.name}`));
-  log5(`  ${dim2("ID:")} ${cyan2(policy.id)}  ${dim2("Version:")} ${policy.version}  ${dim2("Rules:")} ${policy.rules.length}`);
-  log5("");
+  log4("");
+  log4(bold2(`  ${policy.name}`));
+  log4(`  ${dim2("ID:")} ${cyan2(policy.id)}  ${dim2("Version:")} ${policy.version}  ${dim2("Rules:")} ${policy.rules.length}`);
+  log4("");
   if (policy.rules.length === 0) {
-    log5(yellow2("  No rules defined."));
-    log5("");
+    log4(yellow2("  No rules defined."));
+    log4("");
     return;
   }
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log4(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   for (const rule of policy.rules) {
     const effectColor = rule.effect === "ALLOW" ? green2 : red2;
-    log5("");
-    log5(`  ${effectColor(rule.effect.padEnd(5))}  ${bold2(rule.toolPattern)}  ${dim2(`P:${rule.priority}`)}`);
+    log4("");
+    log4(`  ${effectColor(rule.effect.padEnd(5))}  ${bold2(rule.toolPattern)}  ${dim2(`P:${rule.priority}`)}`);
     if (rule.description) {
-      log5(`         ${dim2(rule.description)}`);
+      log4(`         ${dim2(rule.description)}`);
     }
-    log5(`         ${dim2(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
+    log4(`         ${dim2(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
     if (rule.pathConstraints) {
       const pc = rule.pathConstraints;
-      if (pc.rootDirectory) log5(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
-      if (pc.allowed?.length) log5(`         ${green2("PATHS")} ${pc.allowed.join(", ")}`);
-      if (pc.denied?.length) log5(`         ${red2("DENY")}  ${pc.denied.join(", ")}`);
+      if (pc.rootDirectory) log4(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
+      if (pc.allowed?.length) log4(`         ${green2("PATHS")} ${pc.allowed.join(", ")}`);
+      if (pc.denied?.length) log4(`         ${red2("DENY")}  ${pc.denied.join(", ")}`);
     }
     if (rule.commandConstraints) {
       const cc = rule.commandConstraints;
-      if (cc.allowed?.length) log5(`         ${green2("CMDS")}  ${cc.allowed.join(", ")}`);
-      if (cc.denied?.length) log5(`         ${red2("DENY")}  ${cc.denied.join(", ")}`);
+      if (cc.allowed?.length) log4(`         ${green2("CMDS")}  ${cc.allowed.join(", ")}`);
+      if (cc.denied?.length) log4(`         ${red2("DENY")}  ${cc.denied.join(", ")}`);
     }
     if (rule.filenameConstraints) {
       const fc = rule.filenameConstraints;
-      if (fc.allowed?.length) log5(`         ${green2("FILES")} ${fc.allowed.join(", ")}`);
-      if (fc.denied?.length) log5(`         ${red2("DENY")}  ${fc.denied.join(", ")}`);
+      if (fc.allowed?.length) log4(`         ${green2("FILES")} ${fc.allowed.join(", ")}`);
+      if (fc.denied?.length) log4(`         ${red2("DENY")}  ${fc.denied.join(", ")}`);
     }
     if (rule.urlConstraints) {
       const uc = rule.urlConstraints;
-      if (uc.allowed?.length) log5(`         ${green2("URLS")}  ${uc.allowed.join(", ")}`);
-      if (uc.denied?.length) log5(`         ${red2("DENY")}  ${uc.denied.join(", ")}`);
+      if (uc.allowed?.length) log4(`         ${green2("URLS")}  ${uc.allowed.join(", ")}`);
+      if (uc.denied?.length) log4(`         ${red2("DENY")}  ${uc.denied.join(", ")}`);
     }
   }
-  log5("");
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
+  log4("");
+  log4(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log4("");
 }
 async function pull(apiKey, file, policyId) {
   if (!policyId) {
     const policies = await listPolicies(apiKey);
     if (policies.length === 0) {
-      log5(red2("No policies found. Create one in the dashboard first."));
+      log4(red2("No policies found. Create one in the dashboard first."));
       process.exit(1);
     }
     if (policies.length === 1) {
       policyId = policies[0].id;
-      log5(dim2(`Auto-selecting only policy: ${policyId}`));
+      log4(dim2(`Auto-selecting only policy: ${policyId}`));
     } else {
-      log5(yellow2(`Found ${policies.length} policies:`));
-      log5("");
+      log4(yellow2(`Found ${policies.length} policies:`));
+      log4("");
       for (const p of policies) {
-        log5(`  ${cyan2(p.id)}  ${p.name}  ${dim2(`v${p.version ?? "?"}`)}`);
+        log4(`  ${cyan2(p.id)}  ${p.name}  ${dim2(`v${p.version ?? "?"}`)}`);
       }
-      log5("");
-      log5("Use --policy-id <ID> to specify which one to pull.");
+      log4("");
+      log4("Use --policy-id <ID> to specify which one to pull.");
       process.exit(1);
     }
   }
-  log5(`Pulling ${cyan2(policyId)} from dashboard...`);
+  log4(`Pulling ${cyan2(policyId)} from dashboard...`);
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
   writeFileSync12(file, json, "utf-8");
-  log5("");
-  log5(green2("  Saved to: ") + file);
-  log5(`  ${dim2("Name:")}    ${policy.name}`);
-  log5(`  ${dim2("Version:")} ${policy.version}`);
-  log5(`  ${dim2("Rules:")}   ${policy.rules.length}`);
-  log5("");
-  log5(dim2("The policy file does not contain an ID."));
-  log5(dim2("Use --policy-id to specify the target when pushing/pulling."));
-  log5("");
+  log4("");
+  log4(green2("  Saved to: ") + file);
+  log4(`  ${dim2("Name:")}    ${policy.name}`);
+  log4(`  ${dim2("Version:")} ${policy.version}`);
+  log4(`  ${dim2("Rules:")}   ${policy.rules.length}`);
+  log4("");
+  log4(dim2("The policy file does not contain an ID."));
+  log4(dim2("Use --policy-id to specify the target when pushing/pulling."));
+  log4("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync10(file)) {
-    log5(red2(`ERROR: File not found: ${file}`));
+  if (!existsSync9(file)) {
+    log4(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
   if (!policyId) {
-    log5(red2("ERROR: --policy-id is required for push."));
-    log5("");
-    log5("This determines which cloud policy to update.");
-    log5("");
-    log5("Usage:");
-    log5("  solongate-proxy push --policy-id my-policy");
-    log5("  solongate-proxy push --policy-id my-policy --file custom.json");
-    log5("");
-    log5("List your policies:");
-    log5("  solongate-proxy list");
+    log4(red2("ERROR: --policy-id is required for push."));
+    log4("");
+    log4("This determines which cloud policy to update.");
+    log4("");
+    log4("Usage:");
+    log4("  solongate-proxy push --policy-id my-policy");
+    log4("  solongate-proxy push --policy-id my-policy --file custom.json");
+    log4("");
+    log4("List your policies:");
+    log4("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync14(file, "utf-8");
+  const content = readFileSync13(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);
   } catch {
-    log5(red2(`ERROR: Invalid JSON in ${file}`));
+    log4(red2(`ERROR: Invalid JSON in ${file}`));
     process.exit(1);
   }
-  log5(`Pushing to ${cyan2(policyId)}...`);
-  log5(`  ${dim2("File:")}  ${file}`);
-  log5(`  ${dim2("Name:")}  ${policy.name || "Unnamed"}`);
-  log5(`  ${dim2("Rules:")} ${(policy.rules || []).length}`);
+  log4(`Pushing to ${cyan2(policyId)}...`);
+  log4(`  ${dim2("File:")}  ${file}`);
+  log4(`  ${dim2("Name:")}  ${policy.name || "Unnamed"}`);
+  log4(`  ${dim2("Rules:")} ${(policy.rules || []).length}`);
   const checkRes = await fetch(`${API_URL}/api/v1/policies/${policyId}`, {
     headers: { "Authorization": `Bearer ${apiKey}` }
   });
@@ -13903,15 +13492,15 @@ async function push(apiKey, file, policyId) {
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
-    log5(red2(`ERROR: Push failed (${res.status}): ${body}`));
+    log4(red2(`ERROR: Push failed (${res.status}): ${body}`));
     process.exit(1);
   }
   const data = await res.json();
-  log5("");
-  log5(green2(`  Pushed to cloud: v${data._version ?? "created"}`));
-  log5(`  ${dim2("Policy ID:")} ${policyId}`);
-  log5(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
-  log5("");
+  log4("");
+  log4(green2(`  Pushed to cloud: v${data._version ?? "created"}`));
+  log4(`  ${dim2("Policy ID:")} ${policyId}`);
+  log4(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
+  log4("");
 }
 async function main3() {
   const { command, apiKey, file, policyId } = parseCliArgs();
@@ -13923,32 +13512,32 @@ async function main3() {
     } else if (command === "list" || command === "ls") {
       await list5(apiKey, policyId);
     } else {
-      log5(red2(`Unknown command: ${command}`));
-      log5("");
-      log5(bold2("Usage:"));
-      log5("  solongate-proxy list                          List all policies");
-      log5("  solongate-proxy list --policy-id <ID>         Show policy details");
-      log5("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
-      log5("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
-      log5("");
-      log5(bold2("Flags:"));
-      log5("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
-      log5("  --file, -f <path>         Local file path (default: policy.json)");
-      log5("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
-      log5("");
+      log4(red2(`Unknown command: ${command}`));
+      log4("");
+      log4(bold2("Usage:"));
+      log4("  solongate-proxy list                          List all policies");
+      log4("  solongate-proxy list --policy-id <ID>         Show policy details");
+      log4("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
+      log4("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
+      log4("");
+      log4(bold2("Flags:"));
+      log4("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
+      log4("  --file, -f <path>         Local file path (default: policy.json)");
+      log4("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
+      log4("");
       process.exit(1);
     }
   } catch (err2) {
-    log5(red2(`ERROR: ${err2 instanceof Error ? err2.message : String(err2)}`));
+    log4(red2(`ERROR: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 }
-var log5, dim2, bold2, green2, red2, yellow2, cyan2, magenta, API_URL;
+var log4, dim2, bold2, green2, red2, yellow2, cyan2, magenta, API_URL;
 var init_pull_push = __esm({
   "src/pull-push.ts"() {
     "use strict";
     init_config();
-    log5 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
+    log4 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
 `);
     dim2 = (s) => `\x1B[2m${s}\x1B[0m`;
     bold2 = (s) => `\x1B[1m${s}\x1B[0m`;
@@ -13964,7 +13553,7 @@ var init_pull_push = __esm({
 
 // src/index.ts
 init_config();
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname4, join as join17 } from "path";
 
@@ -16390,7 +15979,7 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         const idx = this.queue.indexOf(onReady);
         if (idx !== -1) this.queue.splice(idx, 1);
@@ -16398,7 +15987,7 @@ var Mutex = class {
       }, timeoutMs);
       const onReady = () => {
         clearTimeout(timer);
-        resolve10();
+        resolve9();
       };
       this.queue.push(onReady);
     });
@@ -16989,7 +16578,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -17009,7 +16598,7 @@ if (!IS_HUMAN_CLI) {
 var PKG_VERSION = (() => {
   try {
     const p = join17(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync15(p, "utf-8")).version || "unknown";
+    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }
@@ -17029,41 +16618,73 @@ function printWelcome() {
   console.log("");
 }
 function printHelp3() {
-  const row = (name, desc) => console.log(`    ${c.cyan}${name.padEnd(13)}${c.reset}${c.dim}${desc}${c.reset}`);
-  console.log("");
-  console.log(`  ${c.bold}${c.blue4}SolonGate${c.reset} ${c.dim}secure gateway for your AI agents${c.reset}`);
-  console.log("");
-  console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}`);
-  console.log(`  ${c.dim}With no command, opens the dataroom: accounts, policies, rate limits,${c.reset}`);
-  console.log(`  ${c.dim}DLP, audit and settings in one terminal UI.${c.reset}`);
-  console.log("");
-  console.log(`  ${c.bold}Setup & status${c.reset}`);
-  row("doctor", "health check: login, active policy, guard, local logs");
-  row("create", "scaffold a guarded MCP server in the current folder");
-  row("logs-server", "serve local audit logs to the dashboard");
-  console.log("");
-  console.log(`  ${c.bold}Security config${c.reset}`);
-  row("policy", "view and manage policies");
-  row("ratelimit", "view and manage rate limits");
-  row("dlp", "view and manage DLP (secret) rules");
-  row("alerts", "view and manage alerts");
-  row("webhooks", "view and manage webhooks");
+  const W = 46;
+  const head = (t) => console.log(`
+  ${c.bold}${t}${c.reset}`);
+  const cmd = (syntax, desc = "") => {
+    if (!desc) {
+      console.log(`    ${c.cyan}${syntax}${c.reset}`);
+      return;
+    }
+    if (syntax.length <= W) {
+      console.log(`    ${c.cyan}${syntax}${c.reset}${" ".repeat(W - syntax.length)}${c.dim}${desc}${c.reset}`);
+    } else {
+      console.log(`    ${c.cyan}${syntax}${c.reset}`);
+      console.log(`    ${" ".repeat(W)}${c.dim}${desc}${c.reset}`);
+    }
+  };
   console.log("");
-  console.log(`  ${c.bold}Monitoring${c.reset}`);
-  row("audit", "browse the audit log of tool-call decisions");
-  row("stats", "usage statistics");
-  row("watch", "live-tail tool calls as they happen");
-  row("agents", "list agents and sessions");
+  console.log(`  ${c.bold}${c.blue4}SolonGate${c.reset} ${c.dim}secure gateway for your AI agents${c.reset}  ${c.dim}v${PKG_VERSION}${c.reset}`);
   console.log("");
-  console.log(`  ${c.bold}Advanced${c.reset}`);
-  row("keys", "manage API keys");
-  row("mcp", "manage MCP servers");
-  row("shield", "wrap a command with LLM-path secret redaction: shield -- <cmd>");
-  row("pull", "pull a cloud policy to a local file");
-  row("push", "push a local policy file to the cloud");
-  row("list", "list cloud policies");
+  console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
+  head("Setup & status");
+  cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
+  cmd("doctor [--json]", "health check: login, policy, guard, local logs");
+  cmd("create", "scaffold a guarded MCP server in this folder");
+  cmd("logs-server", "serve local audit logs to the dashboard");
+  head("Policies");
+  cmd("policy list", "list all policies");
+  cmd("policy show <id> [--version N]", "show one policy (rules, mode)");
+  cmd("policy rules <id>", "list a policy's rules");
+  cmd("policy allow <id> --tool <p> [--command|--path|--url <val>]", "add an ALLOW rule");
+  cmd("policy revoke <id> <ruleId>", "remove a rule");
+  cmd("policy activate <id> | --clear", "pin / unpin the active policy");
+  cmd("policy rollback <id> <version>", "roll back to a version");
+  cmd("policy versions <id>", "version history");
+  cmd("policy active", "show the resolved active policy");
+  cmd("policy dry-run <id|file.json> [--mode denylist|whitelist]", "replay recent traffic against rules");
+  head("Rate limits");
+  cmd("ratelimit show", "current limits + change history");
+  cmd("ratelimit set --minute N [--hour N] [--day N] [--mode off|detect|block]", "edit limits (unset fields kept)");
+  cmd("ratelimit history", "recent limit changes");
+  head("DLP (secrets)");
+  cmd("dlp show", "current mode + enabled patterns");
+  cmd("dlp mode <off|detect|block>", "set enforcement mode");
+  cmd("dlp enable <pattern>", "enable a built-in pattern");
+  cmd("dlp disable <pattern>", "disable a built-in pattern");
+  cmd("dlp add-custom --name X --re <regex>", "add a custom pattern");
+  cmd("dlp remove-custom <name>", "remove a custom pattern");
+  head("Monitoring");
+  cmd("audit [--filter ALLOW|DENY] [--tool <s>] [--signal dlp|ratelimit] [--limit N]", "browse the audit log");
+  cmd("audit whitelist <logId> [--scope exact|tool]", "turn a denial into an ALLOW rule");
+  cmd("audit block <logId> [--scope exact|tool]", "turn a call into a DENY rule");
+  cmd("stats [timeseries|drift]", "traffic & security statistics");
+  cmd("watch [--filter DENY] [--tool <s>]", "live-tail tool calls (Ctrl+C to stop)");
+  cmd("agents [--all]", "live agent feed");
+  cmd("agent <agent_id>", "one-agent detail");
+  head("Alerts & webhooks");
+  cmd("alerts list");
+  cmd("alerts add --signal deny|dlp|ratelimit|any --threshold N --window S (--email <a> | --telegram <id> | --slack <url>)", "spike alert");
+  cmd("alerts remove <id>");
+  cmd("webhooks list");
+  cmd("webhooks add --url <https://\u2026> [--events denials|allowed|all]", "event webhook");
+  cmd("webhooks remove <id>");
+  head("Policy sync");
+  cmd("pull --policy-id <ID> [--file f]", "pull a cloud policy to a local file");
+  cmd("push --policy-id <ID> [--file f]", "push a local policy file to the cloud");
   console.log("");
-  console.log(`  ${c.dim}Dashboard: ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
+  console.log(`  ${c.dim}Add ${c.reset}${c.cyan}--json${c.reset}${c.dim} to most read commands for machine output.${c.reset}`);
+  console.log(`  ${c.dim}Details for a command: ${c.reset}${c.cyan}solongate <command> help${c.reset}${c.dim}  \xB7  Dashboard: ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
   console.log("");
 }
 async function main4() {
@@ -17101,7 +16722,7 @@ async function main4() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
@@ -17114,11 +16735,6 @@ async function main4() {
     console.log("");
     return;
   }
-  if (subcommand === "shield") {
-    const { runShield: runShield2 } = await Promise.resolve().then(() => (init_shield(), shield_exports));
-    await runShield2();
-    return;
-  }
   if (subcommand === "logs-server" || subcommand === "local-logs") {
     const { runLogsServer: runLogsServer2 } = await Promise.resolve().then(() => (init_logs_server(), logs_server_exports));
     await runLogsServer2();
@@ -17138,6 +16754,17 @@ async function main4() {
     await Promise.resolve().then(() => (init_pull_push(), pull_push_exports));
     return;
   }
+  const hasProxySeparator = process.argv.includes("--");
+  const looksLikeProxyFlag = (subcommand ?? "").startsWith("-");
+  if (subcommand && !hasProxySeparator && !looksLikeProxyFlag) {
+    process.stdout.write(`
+  Unknown command: ${subcommand}
+`);
+    process.stdout.write(`  Run \`solongate --help\` to see every command, or \`solongate\` for the dataroom.
+
+`);
+    process.exit(1);
+  }
   try {
     const config = parseArgs(process.argv);
     const proxy = new SolonGateProxy(config);