@solongate/proxy 0.82.20 → 0.82.22

package/dist/index.js

@@ -3398,12 +3398,12 @@ ${ctx.indent}`;
       for (const {
         format,
         test,
-        resolve: resolve10
+        resolve: resolve7
       } of tags) {
         if (test) {
           const match = str.match(test);
           if (match) {
-            let res = resolve10.apply(null, match);
+            let res = resolve7.apply(null, match);
             if (!(res instanceof Scalar)) res = new Scalar(res);
             if (format) res.format = format;
             return res;
@@ -6507,18 +6507,6 @@ var init_src = __esm({
 });
 
 // src/cli-utils.ts
-function log3(msg) {
-  process.stderr.write(msg + "\n");
-}
-function printBanner(subtitle) {
-  log3("");
-  for (let i = 0; i < BANNER_FULL.length; i++) {
-    log3(`${c.bold}${BANNER_COLORS[i]}${BANNER_FULL[i]}${c.reset}`);
-  }
-  log3("");
-  log3(`  ${c.dim}${c.italic}${subtitle}${c.reset}`);
-  log3("");
-}
 var c, BANNER_FULL, BANNER_COLORS;
 var init_cli_utils = __esm({
   "src/cli-utils.ts"() {
@@ -6622,9 +6610,9 @@ async function fetchLatest() {
 function spawnGlobalInstall(version) {
   try {
     mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-    const log6 = openSync(LOG_FILE, "a");
+    const log4 = openSync(LOG_FILE, "a");
     const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
-      stdio: ["ignore", log6, log6],
+      stdio: ["ignore", log4, log4],
       detached: true,
       windowsHide: true,
       shell: process.platform === "win32"
@@ -6638,7 +6626,7 @@ function spawnGlobalInstall(version) {
   }
 }
 function runGlobalInstall(version) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve7) => {
     try {
       mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
       execFile(
@@ -6653,11 +6641,11 @@ ${stderr}
 `, { flag: "a" });
           } catch {
           }
-          resolve10(!err2);
+          resolve7(!err2);
         }
       );
     } catch {
-      resolve10(false);
+      resolve7(false);
     }
   });
 }
@@ -6772,11 +6760,11 @@ function startLogsServerDaemon() {
   }
   try {
     mkdirSync4(DIR, { recursive: true });
-    const log6 = openSync2(LOG_FILE2, "a");
+    const log4 = openSync2(LOG_FILE2, "a");
     const cli = join5(dirname2(fileURLToPath2(import.meta.url)), "index.js");
     const p = spawn2(process.execPath, [cli, "logs-server"], {
       detached: true,
-      stdio: ["ignore", log6, log6],
+      stdio: ["ignore", log4, log4],
       windowsHide: true
     });
     p.on("error", () => {
@@ -7854,7 +7842,7 @@ function LivePanel({ active: active2 }) {
   const [localBuf, setLocalBuf] = useState2([]);
   const [localOn, setLocalOn] = useState2(null);
   const [ring, setRing] = useState2(null);
-  const [log6, setLog] = useState2([]);
+  const [log4, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
   const [signal, setSignal] = useState2("none");
   const [search, setSearch] = useState2("");
@@ -8698,7 +8686,7 @@ function LivePanel({ active: active2 }) {
       ] }),
       /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
-        log6.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        log4.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
             hhmmss(l.ts),
             " "
@@ -9635,7 +9623,7 @@ function AuditPanel({ active: active2, focused }) {
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
     setMsg({ text: "deleting\u2026", level: "ok" });
-    const run12 = async () => {
+    const run10 = async () => {
       if (source === "cloud") {
         if (kind === "one") {
           if (!current) throw new Error("nothing selected");
@@ -9651,14 +9639,14 @@ function AuditPanel({ active: active2, focused }) {
         localQ.reload();
       }
     };
-    run12().then(() => {
+    run10().then(() => {
       setMsg({ text: kind === "one" ? "\u2713 entry deleted" : `\u2713 ALL ${source} logs deleted`, level: "ok" });
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
-    const run12 = async () => {
+    const run10 = async () => {
       const dir = join10(homedir8(), ".solongate");
       const file = join10(dir, `audit-export-${source}.jsonl`);
       let rows2;
@@ -9671,7 +9659,7 @@ function AuditPanel({ active: active2, focused }) {
       writeFileSync8(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
-    run12().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+    run10().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   useInput5(
     (input, key) => {
@@ -10554,7 +10542,7 @@ function SettingsPanel({
     guardQ.reload();
     selfQ.reload();
   };
-  const run12 = (label, fn, reload) => {
+  const run10 = (label, fn, reload) => {
     if (busy) return;
     setBusy(true);
     setMsg({ text: label + "\u2026", level: "ok" });
@@ -10636,8 +10624,8 @@ function SettingsPanel({
     const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
     const id = editor.id;
     setEditor(null);
-    if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
-    else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
+    if (id) run10("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run10(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
   };
   const activate = (r) => {
     if (r.kind === "acct") {
@@ -10653,14 +10641,14 @@ function SettingsPanel({
       guardQ.reload();
     } else if (r.kind === "self") {
       if (!selfProt) return;
-      run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+      run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
         setMsg({ text: "set a path first (\u2193 then enter)", level: "bad" });
         return;
       }
-      run12(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
+      run10(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
     } else if (r.kind === "ll-path") {
       setInput(local?.path ?? "");
       setEditing("path");
@@ -10671,7 +10659,7 @@ function SettingsPanel({
         next.running ? { text: `\u2713 dashboard link running on 127.0.0.1:${next.port} \u2014 keeps running after you close the dataroom`, level: "ok" } : { text: "\u2713 dashboard link stopped (disabled until you start it again)", level: "ok" }
       );
     } else if (r.kind === "wh") {
-      run12(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
+      run10(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
     } else if (r.kind === "wh-add") {
       setInput("");
       setEditing("wh-url");
@@ -10690,7 +10678,7 @@ function SettingsPanel({
     setEditing(null);
     if (which === "path") {
       const enabled = (local?.enabled ?? false) && v.length > 0;
-      run12(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
+      run10(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
     } else if (which === "wh-url") {
       const url = v.replace(/^["'<]+|["'>]+$/g, "").trim();
       if (!url) return;
@@ -10698,7 +10686,7 @@ function SettingsPanel({
         setMsg({ text: "\u2717 webhook url must start with http:// or https://", level: "bad" });
         return;
       }
-      run12("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
+      run10("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
     } else if (which === "alert-target" && editor) {
       setEditor({ ...editor, target: v, field: 1 });
     }
@@ -10752,7 +10740,7 @@ function SettingsPanel({
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
-          if (cur.kind === "alert") run12(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
+          if (cur.kind === "alert") run10(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
       } else if (inp === "x" && cur.kind === "acct") {
@@ -10782,13 +10770,13 @@ function SettingsPanel({
         refreshAccounts();
         onAccountsChanged?.();
       } else if (inp === "t" && cur.kind === "wh") {
-        run12("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
+        run10("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
-        run12(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
+        run10(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
       } else if (inp === "e" && cur.kind === "alert") {
         const ch = alertChannel(cur.rule);
         if (ch) openAlertEditor(ch, cur.rule);
@@ -10825,10 +10813,10 @@ function SettingsPanel({
         setConfirmDel(null);
         if (cur.kind === "wh") {
           const id = cur.wh.id;
-          run12("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
+          run10("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
         } else {
           const id = cur.rule.id;
-          run12("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
+          run10("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
         }
       } else if (inp === "r") reloadAll();
     },
@@ -11128,9 +11116,9 @@ function App() {
   const [update2, setUpdate] = useState8({ kind: "idle" });
   useEffect7(() => {
     let alive = true;
-    const run12 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
-    run12();
-    const t = setInterval(run12, 30 * 6e4);
+    const run10 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
+    run10();
+    const t = setInterval(run10, 30 * 6e4);
     return () => {
       alive = false;
       clearInterval(t);
@@ -12204,7 +12192,7 @@ var init_watch = __esm({
   }
 });
 
-// src/commands/keys.ts
+// src/commands/alerts.ts
 async function run8(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
@@ -12212,89 +12200,6 @@ async function run8(argv) {
   switch (sub) {
     case "help":
       return err(USAGE6), 0;
-    case "list": {
-      const { keys } = await api.keys.list();
-      if (json) return printJson(keys), 0;
-      if (!keys.length) return err(dim("  No API keys.")), 0;
-      table(
-        ["ID", "NAME", "PREFIX", "CREATED"],
-        keys.map((k) => [dim(truncate3(k.id, 10)), truncate3(k.name, 24), cyan(k.key_prefix), dim(k.created_at)])
-      );
-      return 0;
-    }
-    case "create": {
-      const name = flagStr(flags, "name");
-      if (!name) return err("  Usage: keys create --name <name>"), 1;
-      const res = await api.keys.create(name, !flagBool(flags, "test"));
-      if (json) return printJson(res), 0;
-      err(green(`  \u2713 Created "${res.name}"`));
-      err("");
-      err("  " + bold(res.key));
-      err(dim("  \u2191 shown only once \u2014 copy it now."));
-      return 0;
-    }
-    case "revoke": {
-      const id = positionals[1];
-      if (!id) return err("  Usage: keys revoke <id>"), 1;
-      await api.keys.revoke(id);
-      if (json) return printJson({ ok: true, id }), 0;
-      return err(green(`  \u2713 Revoked ${id}`)), 0;
-    }
-    default:
-      return err(USAGE6), 1;
-  }
-}
-var USAGE6;
-var init_keys2 = __esm({
-  "src/commands/keys.ts"() {
-    "use strict";
-    init_api_client();
-    init_args();
-    init_format();
-    USAGE6 = `${bold("solongate keys")} \u2014 API keys
-
-  keys list                 List keys (prefix only)
-  keys create --name <n>    Create a key (secret shown once)
-  keys revoke <id>          Revoke a key
-
-  Add --json for machine-readable output.`;
-  }
-});
-
-// src/commands/mcp.ts
-async function run9(argv) {
-  const { flags } = parse(argv);
-  const json = flagBool(flags, "json");
-  const { servers } = await api.mcp.list();
-  if (json) return printJson(servers), 0;
-  if (!servers.length) return err(dim("  No MCP servers registered.")), 0;
-  table(
-    ["STATUS", "NAME", "TARGET"],
-    servers.map((s) => [
-      s.status === "active" ? green(s.status) : yellow(s.status),
-      cyan(truncate3(s.name, 24)),
-      dim(truncate3(s.url || s.command || "\u2014", 46))
-    ])
-  );
-  return 0;
-}
-var init_mcp2 = __esm({
-  "src/commands/mcp.ts"() {
-    "use strict";
-    init_api_client();
-    init_args();
-    init_format();
-  }
-});
-
-// src/commands/alerts.ts
-async function run10(argv) {
-  const { positionals, flags } = parse(argv);
-  const sub = positionals[0] ?? "list";
-  const json = flagBool(flags, "json");
-  switch (sub) {
-    case "help":
-      return err(USAGE7), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -12336,17 +12241,17 @@ async function run10(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return err(USAGE6), 1;
   }
 }
-var USAGE7;
+var USAGE6;
 var init_alerts = __esm({
   "src/commands/alerts.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE7 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
+    USAGE6 = `${bold("solongate alerts")} \u2014 spike alerts (Telegram / email)
 
   alerts list
   alerts add --signal deny|dlp|ratelimit|any --threshold N --window S
@@ -12358,13 +12263,13 @@ var init_alerts = __esm({
 });
 
 // src/commands/webhooks.ts
-async function run11(argv) {
+async function run9(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE8), 0;
+      return err(USAGE7), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -12390,17 +12295,17 @@ async function run11(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE8), 1;
+      return err(USAGE7), 1;
   }
 }
-var USAGE8;
+var USAGE7;
 var init_webhooks = __esm({
   "src/commands/webhooks.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE8 = `${bold("solongate webhooks")} \u2014 event webhooks
+    USAGE7 = `${bold("solongate webhooks")} \u2014 event webhooks
 
   webhooks list
   webhooks add --url <https://\u2026> [--events denials|allowed|all]
@@ -12436,14 +12341,10 @@ async function dispatch(command, argv) {
       return run6(argv);
     case "watch":
       return run7(argv);
-    case "keys":
-      return run8(argv);
-    case "mcp":
-      return run9(argv);
     case "alerts":
-      return run10(argv);
+      return run8(argv);
     case "webhooks":
-      return run11(argv);
+      return run9(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -12480,333 +12381,9 @@ var init_commands = __esm({
     init_agents2();
     init_doctor();
     init_watch();
-    init_keys2();
-    init_mcp2();
     init_alerts();
     init_webhooks();
-    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"];
-  }
-});
-
-// src/shield.ts
-var shield_exports = {};
-__export(shield_exports, {
-  runShield: () => runShield
-});
-import { createServer, request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-import { spawn as spawn5 } from "child_process";
-import { URL as URL2 } from "url";
-import { readFileSync as readFileSync11, existsSync as existsSync7, readdirSync, statSync as statSync4 } from "fs";
-import { resolve as resolve5 } from "path";
-import { homedir as homedir13 } from "os";
-function findCacheFile() {
-  const dir = resolve5(homedir13(), ".solongate");
-  const envSel = process.env.SOLONGATE_AGENT_ID;
-  if (envSel) {
-    const f = resolve5(dir, ".policy-cache-" + envSel.replace(/[^a-zA-Z0-9_-]/g, "_") + ".json");
-    if (existsSync7(f)) return f;
-  }
-  let best = null, bestTs = -1;
-  try {
-    for (const name of readdirSync(dir)) {
-      if (name.startsWith(".policy-cache-") && name.endsWith(".json")) {
-        const full = resolve5(dir, name);
-        const ts = statSync4(full).mtimeMs;
-        if (ts > bestTs) {
-          bestTs = ts;
-          best = full;
-        }
-      }
-    }
-  } catch {
-  }
-  return best;
-}
-function loadCfg() {
-  try {
-    const f = findCacheFile();
-    if (f && existsSync7(f)) {
-      const c2 = JSON.parse(readFileSync11(f, "utf-8"));
-      const d = c2?.security?.dlpRedact;
-      const g = c2?.security?.ghost;
-      const ghost = g && Array.isArray(g.patterns) ? g.patterns : [];
-      if (d && Array.isArray(d.patterns)) return { patterns: d.patterns, custom: Array.isArray(d.custom) ? d.custom : [], ghost };
-      return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost };
-    }
-  } catch {
-  }
-  return { patterns: DLP_PATTERNS.map((p) => p.name), custom: [], ghost: [] };
-}
-function ghostGlobToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c2 = glob[i];
-    if (c2 === "*") {
-      if (glob[i + 1] === "*") {
-        re += ".*";
-        i++;
-      } else re += "[^/]*";
-    } else if (c2 === "?") re += "[^/]";
-    else if ("\\^$.|+()[]{}".indexOf(c2) !== -1) re += "\\" + c2;
-    else re += c2;
-  }
-  try {
-    return new RegExp("^" + re + "$");
-  } catch {
-    return null;
-  }
-}
-function ghostMatch(targetPath, patterns) {
-  if (!targetPath || !Array.isArray(patterns) || patterns.length === 0) return false;
-  const norm = String(targetPath).replace(/\\/g, "/").replace(/\/+$/, "");
-  if (!norm) return false;
-  const segments = norm.split("/").filter(Boolean);
-  const base = segments.length ? segments[segments.length - 1] : norm;
-  for (let pat of patterns) {
-    pat = String(pat || "").trim();
-    if (!pat) continue;
-    let dirOnly = false;
-    if (pat.endsWith("/")) {
-      dirOnly = true;
-      pat = pat.slice(0, -1);
-    }
-    if (!pat) continue;
-    const hasSlash = pat.indexOf("/") !== -1;
-    const hasWild = /[*?]/.test(pat);
-    const re = ghostGlobToRegExp(pat);
-    if (!re) continue;
-    if (dirOnly) {
-      if (!hasSlash && !hasWild) {
-        if (segments.indexOf(pat) !== -1) return true;
-        continue;
-      }
-      let acc = "";
-      for (const s of segments) {
-        acc = acc ? acc + "/" + s : s;
-        if (re.test(acc) || re.test(s)) return true;
-      }
-      continue;
-    }
-    if (!hasSlash) {
-      if (re.test(base)) return true;
-      if (segments.some((s) => re.test(s))) return true;
-      continue;
-    }
-    if (re.test(norm)) return true;
-  }
-  return false;
-}
-function ghostCleanToken(tok) {
-  let t = String(tok || "").trim();
-  t = t.replace(/^[<>|;&(]+/, "").replace(/[);&|]+$/, "");
-  t = t.replace(/^['"]+/, "").replace(/['"]+$/, "");
-  t = t.replace(/^\d*>>?/, "");
-  return t.trim();
-}
-function ghostStripLines(text, pats) {
-  if (!Array.isArray(pats) || pats.length === 0) return text;
-  const lines = String(text).split("\n");
-  const kept = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed) {
-      kept.push(line);
-      continue;
-    }
-    if (ghostMatch(trimmed, pats)) continue;
-    const toks = trimmed.split(/\s+/);
-    const anyHit = toks.some((t) => ghostMatch(ghostCleanToken(t), pats));
-    if (!anyHit) {
-      kept.push(line);
-      continue;
-    }
-    if (toks.length > 3) continue;
-    const remaining = toks.filter((t) => !ghostMatch(ghostCleanToken(t), pats));
-    if (remaining.length === 0) continue;
-    kept.push(remaining.join("  "));
-  }
-  return kept.join("\n");
-}
-function dlpGlobToRe(glob, flags) {
-  let re = "";
-  for (const ch of String(glob || "")) {
-    if (ch === "*") re += "[^\\s]*";
-    else if (".+?^${}()|[]\\".indexOf(ch) !== -1) re += "\\" + ch;
-    else re += ch;
-  }
-  return new RegExp(re, flags);
-}
-function redactString(s, cfg) {
-  if (!cfg || typeof s !== "string" || !s) return s;
-  const allow = new Set(cfg.patterns);
-  const NUL = String.fromCharCode(0);
-  const labels = [];
-  const stash = (label) => NUL + (labels.push(label) - 1) + NUL;
-  let out2 = s;
-  for (const p of DLP_PATTERNS) if (allow.has(p.name)) out2 = out2.replace(p.re, () => stash(`[REDACTED: ${p.name}]`));
-  for (const c2 of cfg.custom) {
-    try {
-      out2 = out2.replace(dlpGlobToRe(c2.re, "gi"), () => stash(`[REDACTED: ${c2.name || "custom"}]`));
-    } catch {
-    }
-  }
-  return out2.replace(new RegExp(NUL + "(\\d+)" + NUL, "g"), (_, i) => labels[+i] || "");
-}
-function redactDeep(value, cfg) {
-  const ghost = cfg && Array.isArray(cfg.ghost) ? cfg.ghost : null;
-  if (typeof value === "string") {
-    let out2 = redactString(value, cfg);
-    if (ghost && ghost.length) out2 = ghostStripLines(out2, ghost);
-    if (out2 === "" && value !== "") out2 = "\n";
-    return out2;
-  }
-  if (Array.isArray(value)) {
-    const arr = ghost && ghost.length ? value.filter((v) => !(typeof v === "string" && ghostMatch(v.trim(), ghost))) : value;
-    return arr.map((v) => redactDeep(v, cfg));
-  }
-  if (value && typeof value === "object") {
-    const out2 = {};
-    for (const [k, v] of Object.entries(value)) out2[k] = redactDeep(v, cfg);
-    return out2;
-  }
-  return value;
-}
-function pickUpstream() {
-  const raw = process.env.SOLONGATE_SHIELD_UPSTREAM || process.env.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
-  try {
-    return new URL2(raw);
-  } catch {
-    return new URL2("https://api.anthropic.com");
-  }
-}
-function startProxy(upstream) {
-  const forward = upstream.protocol === "https:" ? httpsRequest : httpRequest;
-  const server = createServer((req, res) => {
-    const cfg = loadCfg();
-    const chunks = [];
-    req.on("data", (c2) => chunks.push(c2));
-    req.on("end", () => {
-      let body = Buffer.concat(chunks);
-      try {
-        if (body.length && (req.headers["content-type"] || "").includes("json")) {
-          const parsed = JSON.parse(body.toString("utf-8"));
-          if (parsed && typeof parsed === "object" && Array.isArray(parsed["messages"])) {
-            if (parsed["system"] !== void 0) parsed["system"] = redactDeep(parsed["system"], cfg);
-            const msgs = parsed["messages"];
-            for (let i = 0; i < msgs.length; i++) {
-              const m = msgs[i];
-              if (m && m["role"] !== "assistant") msgs[i] = redactDeep(m, cfg);
-            }
-            body = Buffer.from(JSON.stringify(parsed), "utf-8");
-          } else {
-            body = Buffer.from(JSON.stringify(redactDeep(parsed, cfg)), "utf-8");
-          }
-        }
-      } catch {
-      }
-      const headers = { ...req.headers };
-      delete headers["host"];
-      delete headers["content-length"];
-      delete headers["accept-encoding"];
-      headers["content-length"] = String(body.length);
-      const upstreamReq = forward(
-        {
-          protocol: upstream.protocol,
-          hostname: upstream.hostname,
-          port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
-          method: req.method,
-          path: req.url,
-          headers: { ...headers, host: upstream.host }
-        },
-        (upRes) => {
-          res.writeHead(upRes.statusCode || 502, upRes.headers);
-          upRes.pipe(res);
-        }
-      );
-      upstreamReq.on("error", (e) => {
-        log4("upstream error:", e.message);
-        if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
-        res.end("shield upstream error");
-      });
-      upstreamReq.end(body);
-    });
-    req.on("error", () => {
-      try {
-        res.destroy();
-      } catch {
-      }
-    });
-  });
-  return new Promise((resolveP) => {
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveP({ port, close: () => server.close() });
-    });
-  });
-}
-async function runShield() {
-  const sep = process.argv.indexOf("--");
-  const cmd = sep !== -1 ? process.argv.slice(sep + 1) : [];
-  if (cmd.length === 0) {
-    log4("usage: npx @solongate/proxy shield -- <command> [args...]   (e.g. shield -- claude)");
-    process.exit(1);
-  }
-  const upstream = pickUpstream();
-  const { port, close } = await startProxy(upstream);
-  log4(`redacting secrets on the LLM path \u2192 masking before ${upstream.host} (127.0.0.1:${port})`);
-  const child = spawn5(cmd[0], cmd.slice(1), {
-    stdio: "inherit",
-    env: { ...process.env, ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}` },
-    shell: process.platform === "win32"
-    // resolve `claude.cmd` etc. on Windows
-  });
-  const shutdown = () => {
-    try {
-      close();
-    } catch {
-    }
-  };
-  child.on("exit", (code, signal) => {
-    shutdown();
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
-  });
-  child.on("error", (e) => {
-    log4("failed to launch command:", e.message);
-    shutdown();
-    process.exit(1);
-  });
-  for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
-    try {
-      child.kill(sig);
-    } catch {
-    }
-  });
-}
-var log4, DLP_PATTERNS;
-var init_shield = __esm({
-  "src/shield.ts"() {
-    "use strict";
-    log4 = (...a) => process.stderr.write(`[SolonGate shield] ${a.map(String).join(" ")}
-`);
-    DLP_PATTERNS = [
-      { name: "AWS access key", re: /AKIA[0-9A-Z]{16}/g },
-      { name: "Private key block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----|-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-      { name: "Anthropic key", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-      { name: "OpenAI key", re: /sk-(proj-)?[A-Za-z0-9_-]{20,}/g },
-      { name: "GitHub token", re: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-      { name: "GitHub fine-grained PAT", re: /github_pat_[A-Za-z0-9_]{20,}/g },
-      { name: "GitLab token", re: /glpat-[A-Za-z0-9_-]{20,}/g },
-      { name: "Slack token", re: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-      { name: "Stripe key", re: /[sr]k_(live|test)_[A-Za-z0-9]{20,}/g },
-      { name: "SendGrid key", re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g },
-      { name: "Twilio key", re: /SK[0-9a-fA-F]{32}/g },
-      { name: "npm token", re: /npm_[A-Za-z0-9]{36}/g },
-      { name: "JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
-      { name: "Bearer token", re: /bearer\s+[A-Za-z0-9._-]{20,}/gi }
-    ];
+    COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks"];
   }
 });
 
@@ -12815,11 +12392,11 @@ var logs_server_exports = {};
 __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
-import { createServer as createServer2 } from "http";
-import { readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join15, isAbsolute } from "path";
-import { homedir as homedir14 } from "os";
-import { readdirSync as readdirSync2 } from "fs";
+import { createServer } from "http";
+import { readFileSync as readFileSync11, statSync as statSync4 } from "fs";
+import { resolve as resolve5, join as join15, isAbsolute } from "path";
+import { homedir as homedir13 } from "os";
+import { readdirSync } from "fs";
 function allowedOrigins() {
   const base = [
     "https://dashboard.solongate.com",
@@ -12835,15 +12412,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute(dir)) return dir;
-  return resolve6(homedir14(), ".solongate", "local-logs");
+  return resolve5(homedir13(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir14(), ".solongate");
+  const base = resolve5(homedir13(), ".solongate");
   try {
-    const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    const files = readdirSync(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync12(join15(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync11(join15(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -12852,7 +12429,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync12(join15(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync11(join15(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -12883,7 +12460,7 @@ function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
   const file = join15(dir, LOG_FILENAME);
   try {
-    const st = statSync5(file);
+    const st = statSync4(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -12915,7 +12492,7 @@ async function runLogsServer() {
   }
   const portArg = argv[argv.indexOf("--port") + 1];
   const port = Number(process.env.SOLONGATE_LOGS_PORT || (argv.includes("--port") ? portArg : "") || DEFAULT_PORT) || DEFAULT_PORT;
-  const server = createServer2(async (req, res) => {
+  const server = createServer(async (req, res) => {
     setCors(req, res);
     if (req.method === "OPTIONS") {
       res.writeHead(204);
@@ -12964,7 +12541,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync12(info.file, "utf-8");
+        const text = readFileSync11(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -13016,644 +12593,16 @@ var init_logs_server = __esm({
   }
 });
 
-// src/inject.ts
-var inject_exports = {};
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync8, copyFileSync } from "fs";
-import { resolve as resolve7 } from "path";
-import { execSync } from "child_process";
-function parseInjectArgs(argv) {
-  const args = argv.slice(2);
-  const opts = {
-    dryRun: false,
-    restore: false,
-    skipInstall: false
-  };
-  for (let i = 0; i < args.length; i++) {
-    switch (args[i]) {
-      case "--file":
-        opts.file = args[++i];
-        break;
-      case "--dry-run":
-        opts.dryRun = true;
-        break;
-      case "--restore":
-        opts.restore = true;
-        break;
-      case "--skip-install":
-        opts.skipInstall = true;
-        break;
-      case "--help":
-      case "-h":
-        printHelp();
-        process.exit(0);
-    }
-  }
-  return opts;
-}
-function printHelp() {
-  log3(`
-SolonGate Inject \u2014 Add security to your MCP server in seconds
-
-USAGE
-  npx @solongate/proxy inject [options]
-
-OPTIONS
-  --file <path>       Entry file to modify (default: auto-detect)
-  --dry-run           Preview changes without writing
-  --restore           Restore original file from backup
-  --skip-install      Don't install SDK package
-  -h, --help          Show this help message
-
-EXAMPLES
-  npx @solongate/proxy inject                    # Auto-detect and inject
-  npx @solongate/proxy inject --file src/main.ts # Specify entry file
-  npx @solongate/proxy inject --dry-run          # Preview changes
-  npx @solongate/proxy inject --restore          # Undo injection
-
-WHAT IT DOES
-  Replaces McpServer with SecureMcpServer (2 lines changed)
-  All tool() calls are automatically protected by SolonGate.
-`);
-}
-function detectProject() {
-  if (!existsSync8(resolve7("package.json"))) return false;
-  try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
-    const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    return !!(allDeps["@modelcontextprotocol/sdk"] || allDeps["@modelcontextprotocol/server"]);
-  } catch {
-    return false;
-  }
-}
-function findTsEntryFile() {
-  try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
-    if (pkg.bin) {
-      const binPath = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin)[0];
-      if (typeof binPath === "string") {
-        const srcPath = binPath.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-        if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
-        if (existsSync8(resolve7(binPath))) return resolve7(binPath);
-      }
-    }
-    if (pkg.main) {
-      const srcPath = pkg.main.replace(/^\.\/dist\//, "./src/").replace(/\.js$/, ".ts");
-      if (existsSync8(resolve7(srcPath))) return resolve7(srcPath);
-    }
-  } catch {
-  }
-  const candidates = [
-    "src/index.ts",
-    "src/server.ts",
-    "src/main.ts",
-    "index.ts",
-    "server.ts",
-    "main.ts"
-  ];
-  for (const c2 of candidates) {
-    const full = resolve7(c2);
-    if (existsSync8(full)) {
-      try {
-        const content = readFileSync13(full, "utf-8");
-        if (content.includes("McpServer") || content.includes("McpServer")) {
-          return full;
-        }
-      } catch {
-      }
-    }
-  }
-  for (const c2 of candidates) {
-    if (existsSync8(resolve7(c2))) return resolve7(c2);
-  }
-  return null;
-}
-function detectPackageManager() {
-  if (existsSync8(resolve7("pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(resolve7("yarn.lock"))) return "yarn";
-  return "npm";
-}
-function installSdk() {
-  try {
-    const pkg = JSON.parse(readFileSync13(resolve7("package.json"), "utf-8"));
-    const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    if (allDeps["@solongate/proxy"]) {
-      log3("  @solongate/proxy already installed");
-      return true;
-    }
-  } catch {
-  }
-  const pm = detectPackageManager();
-  const cmd = pm === "yarn" ? "yarn add @solongate/proxy" : `${pm} install @solongate/proxy`;
-  log3(`  Installing @solongate/proxy via ${pm}...`);
-  try {
-    execSync(cmd, { stdio: "pipe", cwd: process.cwd() });
-    return true;
-  } catch (err2) {
-    log3(`  Failed to install: ${err2 instanceof Error ? err2.message : String(err2)}`);
-    log3("  You can install manually: npm install @solongate/proxy");
-    return false;
-  }
-}
-function injectTypeScript(filePath) {
-  const original = readFileSync13(filePath, "utf-8");
-  const changes = [];
-  let modified = original;
-  if (modified.includes("SecureMcpServer")) {
-    return { file: filePath, changes: ["Already injected \u2014 skipping"], original, modified };
-  }
-  const mcpImportPatterns = [
-    // Solo import: import { McpServer } from '...'
-    /import\s*\{\s*McpServer\s*\}\s*from\s*['"][^'"]+['"]/,
-    // Import with others: import { McpServer, ... } from '...'
-    /import\s*\{[^}]*McpServer[^}]*\}\s*from\s*['"][^'"]+['"]/
-  ];
-  let importReplaced = false;
-  for (const pattern of mcpImportPatterns) {
-    const match = modified.match(pattern);
-    if (match) {
-      const importLine = match[0];
-      const namedImports = importLine.match(/\{([^}]+)\}/)?.[1] ?? "";
-      const importNames = namedImports.split(",").map((s) => s.trim()).filter(Boolean);
-      if (importNames.length === 1 && importNames[0] === "McpServer") {
-        modified = modified.replace(
-          importLine,
-          `import { SecureMcpServer } from '@solongate/proxy'`
-        );
-        changes.push("Replaced McpServer import with SecureMcpServer from @solongate/proxy");
-      } else {
-        const otherImports = importNames.filter((n) => n !== "McpServer");
-        const fromModule = importLine.match(/from\s*['"]([^'"]+)['"]/)?.[1] ?? "";
-        modified = modified.replace(
-          importLine,
-          `import { ${otherImports.join(", ")} } from '${fromModule}';
-import { SecureMcpServer } from '@solongate/proxy'`
-        );
-        changes.push("Removed McpServer from existing import, added SecureMcpServer import from @solongate/proxy");
-      }
-      importReplaced = true;
-      break;
-    }
-  }
-  if (!importReplaced) {
-    const insertPos = findImportInsertPosition(modified);
-    modified = modified.slice(0, insertPos) + `import { SecureMcpServer } from '@solongate/proxy';
-` + modified.slice(insertPos);
-    changes.push("Added SecureMcpServer import from @solongate/proxy");
-  }
-  const constructorPattern = /new\s+McpServer\s*\(/g;
-  const constructorCount = (modified.match(constructorPattern) || []).length;
-  if (constructorCount > 0) {
-    modified = modified.replace(constructorPattern, "new SecureMcpServer(");
-    changes.push(`Replaced ${constructorCount} McpServer constructor(s) with SecureMcpServer`);
-  }
-  return { file: filePath, changes, original, modified };
-}
-function findImportInsertPosition(content) {
-  let pos = 0;
-  if (content.startsWith("#!")) {
-    pos = content.indexOf("\n") + 1;
-  }
-  const lines = content.slice(pos).split("\n");
-  let offset = pos;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed === "" || trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*") || trimmed.startsWith("*/")) {
-      offset += line.length + 1;
-    } else {
-      break;
-    }
-  }
-  const importRegex = /^import\s+.+$/gm;
-  let lastImportEnd = offset;
-  let importMatch;
-  while ((importMatch = importRegex.exec(content)) !== null) {
-    lastImportEnd = importMatch.index + importMatch[0].length + 1;
-  }
-  return lastImportEnd > offset ? lastImportEnd : offset;
-}
-function showDiff(result) {
-  if (result.original === result.modified) {
-    log3("  No changes needed.");
-    return;
-  }
-  const origLines = result.original.split("\n");
-  const modLines = result.modified.split("\n");
-  log3("");
-  log3(`  File: ${result.file}`);
-  log3("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  const maxLines = Math.max(origLines.length, modLines.length);
-  let diffCount = 0;
-  for (let i = 0; i < maxLines; i++) {
-    const orig = origLines[i];
-    const mod = modLines[i];
-    if (orig !== mod) {
-      if (diffCount < 30) {
-        if (orig !== void 0) log3(`  - ${orig}`);
-        if (mod !== void 0) log3(`  + ${mod}`);
-      }
-      diffCount++;
-    }
-  }
-  if (diffCount > 30) {
-    log3(`  ... and ${diffCount - 30} more line changes`);
-  }
-  log3("");
-}
-async function main() {
-  const opts = parseInjectArgs(process.argv);
-  printBanner("Inject SDK");
-  if (!detectProject()) {
-    log3("  Could not detect a TypeScript MCP server project.");
-    log3("  Make sure you are in a project directory with:");
-    log3("    package.json + @modelcontextprotocol/sdk in dependencies");
-    log3("");
-    log3("  To create a new MCP server: npx @solongate/proxy create <name>");
-    process.exit(1);
-  }
-  log3("  Language: TypeScript");
-  const entryFile = opts.file ? resolve7(opts.file) : findTsEntryFile();
-  if (!entryFile || !existsSync8(entryFile)) {
-    log3(`  Could not find entry file.${opts.file ? ` File not found: ${opts.file}` : ""}`);
-    log3("");
-    log3("  Specify it manually: --file <path>");
-    log3("");
-    log3("  Common entry points:");
-    log3("    src/index.ts, src/server.ts, index.ts");
-    process.exit(1);
-  }
-  log3(`  Entry:    ${entryFile}`);
-  log3("");
-  const backupPath = entryFile + ".solongate-backup";
-  if (opts.restore) {
-    if (!existsSync8(backupPath)) {
-      log3("  No backup found. Nothing to restore.");
-      process.exit(1);
-    }
-    copyFileSync(backupPath, entryFile);
-    log3(`  Restored original file from backup.`);
-    log3(`  Backup: ${backupPath}`);
-    process.exit(0);
-  }
-  if (!opts.skipInstall && !opts.dryRun) {
-    installSdk();
-    log3("");
-  }
-  const result = injectTypeScript(entryFile);
-  log3(`  Changes (${result.changes.length}):`);
-  for (const change of result.changes) {
-    log3(`    - ${change}`);
-  }
-  if (result.changes.length === 1 && result.changes[0].includes("Already injected")) {
-    log3("");
-    log3("  Your MCP server is already protected by SolonGate!");
-    process.exit(0);
-  }
-  if (result.original === result.modified) {
-    log3("");
-    log3("  No changes were made. The file may not contain recognizable MCP patterns.");
-    log3("  See docs: https://solongate.com/docs/integration");
-    process.exit(0);
-  }
-  if (opts.dryRun) {
-    log3("");
-    log3("  --- DRY RUN (no changes written) ---");
-    showDiff(result);
-    log3("  To apply: npx @solongate/proxy inject");
-    process.exit(0);
-  }
-  if (!existsSync8(backupPath)) {
-    copyFileSync(entryFile, backupPath);
-    log3("");
-    log3(`  Backup: ${backupPath}`);
-  }
-  writeFileSync10(entryFile, result.modified);
-  log3("");
-  log3("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  log3("  \u2502  SolonGate SDK injected successfully!         \u2502");
-  log3("  \u2502                                               \u2502");
-  log3("  \u2502  McpServer \u2192 SecureMcpServer                  \u2502");
-  log3("  \u2502  All tool() calls are now auto-protected.     \u2502");
-  log3("  \u2502                                               \u2502");
-  log3("  \u2502  Set your API key:                             \u2502");
-  log3("  \u2502    export SOLONGATE_API_KEY=sg_live_xxx        \u2502");
-  log3("  \u2502                                               \u2502");
-  log3("  \u2502  To undo:                                     \u2502");
-  log3("  \u2502    npx @solongate/proxy inject --restore       \u2502");
-  log3("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  log3("");
-}
-var init_inject = __esm({
-  "src/inject.ts"() {
-    "use strict";
-    init_cli_utils();
-    main().catch((err2) => {
-      log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
-      process.exit(1);
-    });
-  }
-});
-
-// src/create.ts
-var create_exports = {};
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join16 } from "path";
-import { execSync as execSync2 } from "child_process";
-function withSpinner(message, fn) {
-  const frames = ["\u28FE", "\u28FD", "\u28FB", "\u28BF", "\u287F", "\u28DF", "\u28EF", "\u28F7"];
-  let i = 0;
-  const id = setInterval(() => {
-    const color = i % 2 === 0 ? c.blue3 : c.blue5;
-    process.stderr.write(`\r  ${color}${frames[i++ % frames.length]}${c.reset} ${c.dim}${message}${c.reset}`);
-  }, 80);
-  try {
-    const result = fn();
-    clearInterval(id);
-    process.stderr.write(`\r  ${c.green}\u2713${c.reset} ${message}${" ".repeat(20)}
-`);
-    return result;
-  } catch (err2) {
-    clearInterval(id);
-    process.stderr.write(`\r  ${c.red}\u2717${c.reset} ${message} \u2014 failed${" ".repeat(10)}
-`);
-    throw err2;
-  }
-}
-function parseCreateArgs(argv) {
-  const args = argv.slice(2);
-  const opts = {
-    name: "",
-    policy: "",
-    noInstall: false
-  };
-  for (let i = 0; i < args.length; i++) {
-    switch (args[i]) {
-      case "--policy":
-        opts.policy = args[++i];
-        break;
-      case "--no-install":
-        opts.noInstall = true;
-        break;
-      case "--help":
-      case "-h":
-        printHelp2();
-        process.exit(0);
-        break;
-      default:
-        if (!args[i].startsWith("-") && !opts.name) {
-          opts.name = args[i];
-        }
-    }
-  }
-  if (!opts.name) {
-    log3("");
-    log3("  Error: Project name required.");
-    log3("");
-    log3("  Usage: npx @solongate/proxy create <name>");
-    log3("");
-    log3("  Examples:");
-    log3("    npx @solongate/proxy create my-mcp-server");
-    log3("    npx @solongate/proxy create weather-api");
-    process.exit(1);
-  }
-  return opts;
-}
-function printHelp2() {
-  log3(`
-SolonGate Create \u2014 Scaffold a secure MCP server in seconds
-
-USAGE
-  npx @solongate/proxy create <name> [options]
-
-OPTIONS
-  --policy <file>     Policy JSON file (default: cloud-managed)
-  --no-install        Skip dependency installation
-  -h, --help          Show this help message
-
-EXAMPLES
-  npx @solongate/proxy create my-server
-  npx @solongate/proxy create db-tools --policy ./policy.json
-`);
-}
-function createProject(dir, name, _policy) {
-  writeFileSync11(
-    join16(dir, "package.json"),
-    JSON.stringify(
-      {
-        name,
-        version: "0.1.0",
-        type: "module",
-        private: true,
-        bin: { [name]: "./dist/index.js" },
-        scripts: {
-          build: "tsup src/index.ts --format esm",
-          dev: "tsx --env-file=.env src/index.ts",
-          start: "node --env-file=.env dist/index.js"
-        },
-        dependencies: {
-          "@modelcontextprotocol/sdk": "^1.26.0",
-          "@solongate/proxy": "latest",
-          zod: "^3.25.0"
-        },
-        devDependencies: {
-          "@types/node": "^22.0.0",
-          tsup: "^8.3.0",
-          tsx: "^4.19.0",
-          typescript: "^5.7.0"
-        }
-      },
-      null,
-      2
-    ) + "\n"
-  );
-  writeFileSync11(
-    join16(dir, "tsconfig.json"),
-    JSON.stringify(
-      {
-        compilerOptions: {
-          target: "ES2022",
-          module: "ESNext",
-          moduleResolution: "bundler",
-          esModuleInterop: true,
-          strict: true,
-          outDir: "dist",
-          rootDir: "src",
-          declaration: true,
-          skipLibCheck: true
-        },
-        include: ["src"]
-      },
-      null,
-      2
-    ) + "\n"
-  );
-  mkdirSync10(join16(dir, "src"), { recursive: true });
-  writeFileSync11(
-    join16(dir, "src", "index.ts"),
-    `#!/usr/bin/env node
-
-console.log = (...args: unknown[]) => {
-  process.stderr.write(args.map(String).join(' ') + '\\n');
-};
-
-import { SecureMcpServer } from '@solongate/proxy';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { z } from 'zod';
-
-// Policy is managed from the SolonGate Dashboard (https://solongate.com)
-// No local policySet needed \u2014 it's fetched from the cloud via your API key.
-const server = new SecureMcpServer(
-  { name: '${name}', version: '0.1.0' },
-);
-
-server.tool(
-  'hello',
-  'Say hello to someone',
-  { name: z.string().describe('Name of the person to greet') },
-  async ({ name }: { name: string }) => ({
-    content: [{ type: 'text', text: \`Hello, \${name}! Welcome to ${name}.\` }],
-  }),
-);
-
-const transport = new StdioServerTransport();
-await server.connect(transport);
-console.log('');
-console.log('${name} is running (stdio mode)');
-console.log('');
-console.log('MCP servers communicate over stdin/stdout \u2014 not HTTP.');
-console.log('You need an MCP client to connect:');
-console.log('');
-console.log('  Claude Code    Open this folder, .mcp.json is auto-detected');
-console.log('  Antigravity    .agents/mcp_config.json (or ~/.gemini/config/mcp_config.json)');
-console.log('  OpenClaw       Uses openclaw.plugin.json config');
-console.log('');
-console.log('Press Ctrl+C to stop.');
-`
-  );
-  writeFileSync11(
-    join16(dir, ".mcp.json"),
-    JSON.stringify(
-      {
-        mcpServers: {
-          [name]: {
-            command: "node",
-            args: ["dist/index.js"],
-            env: {
-              SOLONGATE_API_KEY: "sg_live_YOUR_KEY_HERE"
-            }
-          }
-        }
-      },
-      null,
-      2
-    ) + "\n"
-  );
-  writeFileSync11(
-    join16(dir, ".env"),
-    `SOLONGATE_API_KEY=sg_live_YOUR_KEY_HERE
-`
-  );
-  writeFileSync11(
-    join16(dir, ".gitignore"),
-    `node_modules/
-dist/
-*.solongate-backup
-.env
-.env.local
-.mcp.json
-`
-  );
-}
-async function main2() {
-  const opts = parseCreateArgs(process.argv);
-  const dir = resolve8(opts.name);
-  printBanner("Create MCP Server");
-  if (existsSync9(dir)) {
-    log3(`  ${c.red}Error:${c.reset} Directory "${opts.name}" already exists.`);
-    process.exit(1);
-  }
-  withSpinner(`Setting up ${opts.name}...`, () => {
-    mkdirSync10(dir, { recursive: true });
-    createProject(dir, opts.name, opts.policy);
-  });
-  if (!opts.noInstall) {
-    withSpinner("Installing dependencies...", () => {
-      execSync2("npm install", { cwd: dir, stdio: "pipe" });
-    });
-  }
-  log3("");
-  const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
-  const W = 52;
-  const hr = "\u2500".repeat(W + 2);
-  const bLine = (text) => {
-    const visible = stripAnsi(text);
-    const padding = W - visible.length;
-    log3(`  ${c.dim}\u2502${c.reset} ${text}${" ".repeat(Math.max(0, padding))} ${c.dim}\u2502${c.reset}`);
-  };
-  const bEmpty = () => log3(`  ${c.dim}\u2502${c.reset} ${" ".repeat(W)} ${c.dim}\u2502${c.reset}`);
-  log3(`  ${c.dim}\u256D${hr}\u256E${c.reset}`);
-  log3(`  ${c.dim}\u2502${c.reset} ${c.green}${c.bold}\u2714  MCP Server created successfully!${c.reset}${" ".repeat(W - 35)} ${c.dim}\u2502${c.reset}`);
-  log3(`  ${c.dim}\u251C${hr}\u2524${c.reset}`);
-  bEmpty();
-  bLine(`${c.yellow}Next steps:${c.reset}`);
-  bEmpty();
-  bLine(`  ${c.cyan}$${c.reset} cd ${c.bold}${opts.name}${c.reset}`);
-  bLine(`  ${c.cyan}$${c.reset} npm run build`);
-  bLine(`  ${c.cyan}$${c.reset} npm run dev          ${c.dim}# dev mode${c.reset}`);
-  bLine(`  ${c.cyan}$${c.reset} npm start            ${c.dim}# production${c.reset}`);
-  bEmpty();
-  log3(`  ${c.dim}\u251C${hr}\u2524${c.reset}`);
-  bEmpty();
-  bLine(`${c.yellow}Set your API key:${c.reset}`);
-  bEmpty();
-  bLine(`  ${c.cyan}$${c.reset} export SOLONGATE_API_KEY=${c.blue3}sg_live_xxx${c.reset}`);
-  bEmpty();
-  bLine(`${c.dim}https://dashboard.solongate.com/api-keys/${c.reset}`);
-  bEmpty();
-  log3(`  ${c.dim}\u251C${hr}\u2524${c.reset}`);
-  bEmpty();
-  bLine(`${c.yellow}Use with any MCP server:${c.reset}`);
-  bEmpty();
-  bLine(`  ${c.cyan}$${c.reset} solongate-proxy -- npx @modelcontextprotocol/server-filesystem .`);
-  bLine(`  ${c.cyan}$${c.reset} solongate-proxy -- npx @playwright/mcp@latest`);
-  bLine(`  ${c.dim}Wraps any MCP server or AI tool with SolonGate protection${c.reset}`);
-  bEmpty();
-  log3(`  ${c.dim}\u251C${hr}\u2524${c.reset}`);
-  bEmpty();
-  bLine(`${c.yellow}Use with Claude Code / MCP client:${c.reset}`);
-  bEmpty();
-  bLine(`  ${c.dim}1.${c.reset} Replace ${c.blue3}sg_live_YOUR_KEY_HERE${c.reset} in .mcp.json`);
-  bLine(`  ${c.dim}2.${c.reset} Open this folder in your MCP client`);
-  bLine(`  ${c.dim}3.${c.reset} .mcp.json is auto-detected on startup`);
-  bEmpty();
-  bLine(`${c.yellow}Direct test (without MCP client):${c.reset}`);
-  bEmpty();
-  bLine(`  ${c.dim}1.${c.reset} Replace ${c.blue3}sg_live_YOUR_KEY_HERE${c.reset} in .env`);
-  bLine(`  ${c.dim}2.${c.reset} ${c.cyan}$${c.reset} npm run build && npm start`);
-  bEmpty();
-  log3(`  ${c.dim}\u2570${hr}\u256F${c.reset}`);
-  log3("");
-}
-var init_create = __esm({
-  "src/create.ts"() {
-    "use strict";
-    init_cli_utils();
-    main2().catch((err2) => {
-      log3(`Fatal: ${err2 instanceof Error ? err2.message : String(err2)}`);
-      process.exit(1);
-    });
-  }
-});
-
 // src/pull-push.ts
 var pull_push_exports = {};
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync12, existsSync as existsSync10 } from "fs";
-import { resolve as resolve9 } from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync10, existsSync as existsSync7 } from "fs";
+import { resolve as resolve6 } from "path";
 function loadEnv() {
   if (process.env.SOLONGATE_API_KEY) return;
-  const envPath = resolve9(".env");
-  if (!existsSync10(envPath)) return;
+  const envPath = resolve6(".env");
+  if (!existsSync7(envPath)) return;
   try {
-    const content = readFileSync14(envPath, "utf-8");
+    const content = readFileSync12(envPath, "utf-8");
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
@@ -13695,20 +12644,20 @@ function parseCliArgs() {
     }
   }
   if (!apiKey) {
-    log5(red2("ERROR: API key not found."));
-    log5("");
-    log5("Set it in .env file:");
-    log5("  SOLONGATE_API_KEY=sg_live_...");
-    log5("");
-    log5("Or pass via environment:");
-    log5(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
+    log3(red2("ERROR: API key not found."));
+    log3("");
+    log3("Set it in .env file:");
+    log3("  SOLONGATE_API_KEY=sg_live_...");
+    log3("");
+    log3("Or pass via environment:");
+    log3(`  SOLONGATE_API_KEY=sg_live_... solongate-proxy ${command}`);
     process.exit(1);
   }
   if (!apiKey.startsWith("sg_live_")) {
-    log5(red2("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
+    log3(red2("ERROR: Pull/push/list requires a live API key (sg_live_...)."));
     process.exit(1);
   }
-  return { command, apiKey, file: resolve9(file), policyId };
+  return { command, apiKey, file: resolve6(file), policyId };
 }
 async function listPolicies(apiKey) {
   const res = await fetch(`${API_URL}/api/v1/policies`, {
@@ -13721,18 +12670,18 @@ async function listPolicies(apiKey) {
 async function list5(apiKey, policyId) {
   const policies = await listPolicies(apiKey);
   if (policies.length === 0) {
-    log5(yellow2("No policies found. Create one in the dashboard first."));
-    log5(dim2("  https://dashboard.solongate.com/policies"));
+    log3(yellow2("No policies found. Create one in the dashboard first."));
+    log3(dim2("  https://dashboard.solongate.com/policies"));
     return;
   }
   if (policyId) {
     const match = policies.find((p) => p.id === policyId);
     if (!match) {
-      log5(red2(`Policy not found: ${policyId}`));
-      log5("");
-      log5("Available policies:");
+      log3(red2(`Policy not found: ${policyId}`));
+      log3("");
+      log3("Available policies:");
       for (const p of policies) {
-        log5(`  ${dim2("\u2022")} ${p.id}`);
+        log3(`  ${dim2("\u2022")} ${p.id}`);
       }
       process.exit(1);
     }
@@ -13740,10 +12689,10 @@ async function list5(apiKey, policyId) {
     printPolicyDetail(full);
     return;
   }
-  log5("");
-  log5(bold2(`  Policies (${policies.length})`));
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
+  log3("");
+  log3(bold2(`  Policies (${policies.length})`));
+  log3(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log3("");
   const fullPolicies = await Promise.all(
     policies.map(
       (p) => fetchCloudPolicy(apiKey, API_URL, p.id).then((full) => ({ policy: p, rules: full.rules })).catch(() => ({ policy: p, rules: [] }))
@@ -13752,136 +12701,136 @@ async function list5(apiKey, policyId) {
   for (const { policy, rules } of fullPolicies) {
     printPolicySummary(policy, [...rules]);
   }
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
-  log5(`  ${dim2("View details:")}  solongate-proxy list --policy-id <ID>`);
-  log5(`  ${dim2("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
-  log5(`  ${dim2("Push policy:")}   solongate-proxy push --policy-id <ID>`);
-  log5("");
+  log3(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log3("");
+  log3(`  ${dim2("View details:")}  solongate-proxy list --policy-id <ID>`);
+  log3(`  ${dim2("Pull policy:")}   solongate-proxy pull --policy-id <ID>`);
+  log3(`  ${dim2("Push policy:")}   solongate-proxy push --policy-id <ID>`);
+  log3("");
 }
 function printPolicySummary(p, rules) {
   const ruleCount = rules.length;
   const allowCount = rules.filter((r) => r.effect === "ALLOW").length;
   const denyCount = rules.filter((r) => r.effect === "DENY").length;
-  log5(`  ${cyan2(p.id)}`);
-  log5(`    ${bold2(p.name)}  ${dim2(`v${p.version ?? "?"}`)}`);
-  log5(`    ${dim2("Rules:")} ${ruleCount}  ${green2(`${allowCount} ALLOW`)}  ${red2(`${denyCount} DENY`)}`);
+  log3(`  ${cyan2(p.id)}`);
+  log3(`    ${bold2(p.name)}  ${dim2(`v${p.version ?? "?"}`)}`);
+  log3(`    ${dim2("Rules:")} ${ruleCount}  ${green2(`${allowCount} ALLOW`)}  ${red2(`${denyCount} DENY`)}`);
   if (p.created_at) {
-    log5(`    ${dim2("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
+    log3(`    ${dim2("Updated:")} ${new Date(p.created_at).toLocaleString()}`);
   }
-  log5("");
+  log3("");
 }
 function printPolicyDetail(policy) {
-  log5("");
-  log5(bold2(`  ${policy.name}`));
-  log5(`  ${dim2("ID:")} ${cyan2(policy.id)}  ${dim2("Version:")} ${policy.version}  ${dim2("Rules:")} ${policy.rules.length}`);
-  log5("");
+  log3("");
+  log3(bold2(`  ${policy.name}`));
+  log3(`  ${dim2("ID:")} ${cyan2(policy.id)}  ${dim2("Version:")} ${policy.version}  ${dim2("Rules:")} ${policy.rules.length}`);
+  log3("");
   if (policy.rules.length === 0) {
-    log5(yellow2("  No rules defined."));
-    log5("");
+    log3(yellow2("  No rules defined."));
+    log3("");
     return;
   }
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log3(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   for (const rule of policy.rules) {
     const effectColor = rule.effect === "ALLOW" ? green2 : red2;
-    log5("");
-    log5(`  ${effectColor(rule.effect.padEnd(5))}  ${bold2(rule.toolPattern)}  ${dim2(`P:${rule.priority}`)}`);
+    log3("");
+    log3(`  ${effectColor(rule.effect.padEnd(5))}  ${bold2(rule.toolPattern)}  ${dim2(`P:${rule.priority}`)}`);
     if (rule.description) {
-      log5(`         ${dim2(rule.description)}`);
+      log3(`         ${dim2(rule.description)}`);
     }
-    log5(`         ${dim2(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
+    log3(`         ${dim2(`${rule.permission}  trust:${rule.minimumTrustLevel || "UNTRUSTED"}`)}`);
     if (rule.pathConstraints) {
       const pc = rule.pathConstraints;
-      if (pc.rootDirectory) log5(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
-      if (pc.allowed?.length) log5(`         ${green2("PATHS")} ${pc.allowed.join(", ")}`);
-      if (pc.denied?.length) log5(`         ${red2("DENY")}  ${pc.denied.join(", ")}`);
+      if (pc.rootDirectory) log3(`         ${magenta("ROOT")} ${pc.rootDirectory}`);
+      if (pc.allowed?.length) log3(`         ${green2("PATHS")} ${pc.allowed.join(", ")}`);
+      if (pc.denied?.length) log3(`         ${red2("DENY")}  ${pc.denied.join(", ")}`);
     }
     if (rule.commandConstraints) {
       const cc = rule.commandConstraints;
-      if (cc.allowed?.length) log5(`         ${green2("CMDS")}  ${cc.allowed.join(", ")}`);
-      if (cc.denied?.length) log5(`         ${red2("DENY")}  ${cc.denied.join(", ")}`);
+      if (cc.allowed?.length) log3(`         ${green2("CMDS")}  ${cc.allowed.join(", ")}`);
+      if (cc.denied?.length) log3(`         ${red2("DENY")}  ${cc.denied.join(", ")}`);
     }
     if (rule.filenameConstraints) {
       const fc = rule.filenameConstraints;
-      if (fc.allowed?.length) log5(`         ${green2("FILES")} ${fc.allowed.join(", ")}`);
-      if (fc.denied?.length) log5(`         ${red2("DENY")}  ${fc.denied.join(", ")}`);
+      if (fc.allowed?.length) log3(`         ${green2("FILES")} ${fc.allowed.join(", ")}`);
+      if (fc.denied?.length) log3(`         ${red2("DENY")}  ${fc.denied.join(", ")}`);
     }
     if (rule.urlConstraints) {
       const uc = rule.urlConstraints;
-      if (uc.allowed?.length) log5(`         ${green2("URLS")}  ${uc.allowed.join(", ")}`);
-      if (uc.denied?.length) log5(`         ${red2("DENY")}  ${uc.denied.join(", ")}`);
+      if (uc.allowed?.length) log3(`         ${green2("URLS")}  ${uc.allowed.join(", ")}`);
+      if (uc.denied?.length) log3(`         ${red2("DENY")}  ${uc.denied.join(", ")}`);
     }
   }
-  log5("");
-  log5(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  log5("");
+  log3("");
+  log3(dim2("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log3("");
 }
 async function pull(apiKey, file, policyId) {
   if (!policyId) {
     const policies = await listPolicies(apiKey);
     if (policies.length === 0) {
-      log5(red2("No policies found. Create one in the dashboard first."));
+      log3(red2("No policies found. Create one in the dashboard first."));
       process.exit(1);
     }
     if (policies.length === 1) {
       policyId = policies[0].id;
-      log5(dim2(`Auto-selecting only policy: ${policyId}`));
+      log3(dim2(`Auto-selecting only policy: ${policyId}`));
     } else {
-      log5(yellow2(`Found ${policies.length} policies:`));
-      log5("");
+      log3(yellow2(`Found ${policies.length} policies:`));
+      log3("");
       for (const p of policies) {
-        log5(`  ${cyan2(p.id)}  ${p.name}  ${dim2(`v${p.version ?? "?"}`)}`);
+        log3(`  ${cyan2(p.id)}  ${p.name}  ${dim2(`v${p.version ?? "?"}`)}`);
       }
-      log5("");
-      log5("Use --policy-id <ID> to specify which one to pull.");
+      log3("");
+      log3("Use --policy-id <ID> to specify which one to pull.");
       process.exit(1);
     }
   }
-  log5(`Pulling ${cyan2(policyId)} from dashboard...`);
+  log3(`Pulling ${cyan2(policyId)} from dashboard...`);
   const policy = await fetchCloudPolicy(apiKey, API_URL, policyId);
   const { id: _id, ...policyWithoutId } = policy;
   const json = JSON.stringify(policyWithoutId, null, 2) + "\n";
-  writeFileSync12(file, json, "utf-8");
-  log5("");
-  log5(green2("  Saved to: ") + file);
-  log5(`  ${dim2("Name:")}    ${policy.name}`);
-  log5(`  ${dim2("Version:")} ${policy.version}`);
-  log5(`  ${dim2("Rules:")}   ${policy.rules.length}`);
-  log5("");
-  log5(dim2("The policy file does not contain an ID."));
-  log5(dim2("Use --policy-id to specify the target when pushing/pulling."));
-  log5("");
+  writeFileSync10(file, json, "utf-8");
+  log3("");
+  log3(green2("  Saved to: ") + file);
+  log3(`  ${dim2("Name:")}    ${policy.name}`);
+  log3(`  ${dim2("Version:")} ${policy.version}`);
+  log3(`  ${dim2("Rules:")}   ${policy.rules.length}`);
+  log3("");
+  log3(dim2("The policy file does not contain an ID."));
+  log3(dim2("Use --policy-id to specify the target when pushing/pulling."));
+  log3("");
 }
 async function push(apiKey, file, policyId) {
-  if (!existsSync10(file)) {
-    log5(red2(`ERROR: File not found: ${file}`));
+  if (!existsSync7(file)) {
+    log3(red2(`ERROR: File not found: ${file}`));
     process.exit(1);
   }
   if (!policyId) {
-    log5(red2("ERROR: --policy-id is required for push."));
-    log5("");
-    log5("This determines which cloud policy to update.");
-    log5("");
-    log5("Usage:");
-    log5("  solongate-proxy push --policy-id my-policy");
-    log5("  solongate-proxy push --policy-id my-policy --file custom.json");
-    log5("");
-    log5("List your policies:");
-    log5("  solongate-proxy list");
+    log3(red2("ERROR: --policy-id is required for push."));
+    log3("");
+    log3("This determines which cloud policy to update.");
+    log3("");
+    log3("Usage:");
+    log3("  solongate-proxy push --policy-id my-policy");
+    log3("  solongate-proxy push --policy-id my-policy --file custom.json");
+    log3("");
+    log3("List your policies:");
+    log3("  solongate-proxy list");
     process.exit(1);
   }
-  const content = readFileSync14(file, "utf-8");
+  const content = readFileSync12(file, "utf-8");
   let policy;
   try {
     policy = JSON.parse(content);
   } catch {
-    log5(red2(`ERROR: Invalid JSON in ${file}`));
+    log3(red2(`ERROR: Invalid JSON in ${file}`));
     process.exit(1);
   }
-  log5(`Pushing to ${cyan2(policyId)}...`);
-  log5(`  ${dim2("File:")}  ${file}`);
-  log5(`  ${dim2("Name:")}  ${policy.name || "Unnamed"}`);
-  log5(`  ${dim2("Rules:")} ${(policy.rules || []).length}`);
+  log3(`Pushing to ${cyan2(policyId)}...`);
+  log3(`  ${dim2("File:")}  ${file}`);
+  log3(`  ${dim2("Name:")}  ${policy.name || "Unnamed"}`);
+  log3(`  ${dim2("Rules:")} ${(policy.rules || []).length}`);
   const checkRes = await fetch(`${API_URL}/api/v1/policies/${policyId}`, {
     headers: { "Authorization": `Bearer ${apiKey}` }
   });
@@ -13903,17 +12852,17 @@ async function push(apiKey, file, policyId) {
   });
   if (!res.ok) {
     const body = await res.text().catch(() => "");
-    log5(red2(`ERROR: Push failed (${res.status}): ${body}`));
+    log3(red2(`ERROR: Push failed (${res.status}): ${body}`));
     process.exit(1);
   }
   const data = await res.json();
-  log5("");
-  log5(green2(`  Pushed to cloud: v${data._version ?? "created"}`));
-  log5(`  ${dim2("Policy ID:")} ${policyId}`);
-  log5(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
-  log5("");
+  log3("");
+  log3(green2(`  Pushed to cloud: v${data._version ?? "created"}`));
+  log3(`  ${dim2("Policy ID:")} ${policyId}`);
+  log3(`  ${dim2("Method:")}    ${method === "PUT" ? "Updated existing" : "Created new"}`);
+  log3("");
 }
-async function main3() {
+async function main() {
   const { command, apiKey, file, policyId } = parseCliArgs();
   try {
     if (command === "pull") {
@@ -13923,32 +12872,32 @@ async function main3() {
     } else if (command === "list" || command === "ls") {
       await list5(apiKey, policyId);
     } else {
-      log5(red2(`Unknown command: ${command}`));
-      log5("");
-      log5(bold2("Usage:"));
-      log5("  solongate-proxy list                          List all policies");
-      log5("  solongate-proxy list --policy-id <ID>         Show policy details");
-      log5("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
-      log5("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
-      log5("");
-      log5(bold2("Flags:"));
-      log5("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
-      log5("  --file, -f <path>         Local file path (default: policy.json)");
-      log5("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
-      log5("");
+      log3(red2(`Unknown command: ${command}`));
+      log3("");
+      log3(bold2("Usage:"));
+      log3("  solongate-proxy list                          List all policies");
+      log3("  solongate-proxy list --policy-id <ID>         Show policy details");
+      log3("  solongate-proxy pull --policy-id <ID>         Pull policy to local file");
+      log3("  solongate-proxy push --policy-id <ID>         Push local file to cloud");
+      log3("");
+      log3(bold2("Flags:"));
+      log3("  --policy-id, --id <ID>    Cloud policy ID (required for push)");
+      log3("  --file, -f <path>         Local file path (default: policy.json)");
+      log3("  --api-key <key>           API key (or set SOLONGATE_API_KEY)");
+      log3("");
       process.exit(1);
     }
   } catch (err2) {
-    log5(red2(`ERROR: ${err2 instanceof Error ? err2.message : String(err2)}`));
+    log3(red2(`ERROR: ${err2 instanceof Error ? err2.message : String(err2)}`));
     process.exit(1);
   }
 }
-var log5, dim2, bold2, green2, red2, yellow2, cyan2, magenta, API_URL;
+var log3, dim2, bold2, green2, red2, yellow2, cyan2, magenta, API_URL;
 var init_pull_push = __esm({
   "src/pull-push.ts"() {
     "use strict";
     init_config();
-    log5 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
+    log3 = (...args) => process.stderr.write(`${args.map(String).join(" ")}
 `);
     dim2 = (s) => `\x1B[2m${s}\x1B[0m`;
     bold2 = (s) => `\x1B[1m${s}\x1B[0m`;
@@ -13958,15 +12907,15 @@ var init_pull_push = __esm({
     cyan2 = (s) => `\x1B[36m${s}\x1B[0m`;
     magenta = (s) => `\x1B[35m${s}\x1B[0m`;
     API_URL = "https://api.solongate.com";
-    main3();
+    main();
   }
 });
 
 // src/index.ts
 init_config();
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join17 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 
 // src/proxy.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -16390,7 +15339,7 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         const idx = this.queue.indexOf(onReady);
         if (idx !== -1) this.queue.splice(idx, 1);
@@ -16398,7 +15347,7 @@ var Mutex = class {
       }, timeoutMs);
       const onReady = () => {
         clearTimeout(timer);
-        resolve10();
+        resolve7();
       };
       this.queue.push(onReady);
     });
@@ -16989,7 +15938,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["shield", "create", "inject", "pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["pull", "push", "list", "ls", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -17008,8 +15957,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join17(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync15(p, "utf-8")).version || "unknown";
+    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync13(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }
@@ -17028,7 +15977,7 @@ function printWelcome() {
   console.log(`  ${c.dim}Manage it at ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
   console.log("");
 }
-function printHelp3() {
+function printHelp() {
   const W = 46;
   const head = (t) => console.log(`
   ${c.bold}${t}${c.reset}`);
@@ -17051,7 +16000,6 @@ function printHelp3() {
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
   cmd("doctor [--json]", "health check: login, policy, guard, local logs");
-  cmd("create", "scaffold a guarded MCP server in this folder");
   cmd("logs-server", "serve local audit logs to the dashboard");
   head("Policies");
   cmd("policy list", "list all policies");
@@ -17090,12 +16038,7 @@ function printHelp3() {
   cmd("webhooks list");
   cmd("webhooks add --url <https://\u2026> [--events denials|allowed|all]", "event webhook");
   cmd("webhooks remove <id>");
-  head("Keys, MCP & advanced");
-  cmd("keys list", "list API keys (prefix only)");
-  cmd("keys create --name <name>", "create a key (secret shown once)");
-  cmd("keys revoke <id>", "revoke a key");
-  cmd("mcp", "list protected MCP servers");
-  cmd("shield -- <command>", "wrap a command with LLM-path secret redaction");
+  head("Policy sync");
   cmd("pull --policy-id <ID> [--file f]", "pull a cloud policy to a local file");
   cmd("push --policy-id <ID> [--file f]", "push a local policy file to the cloud");
   console.log("");
@@ -17103,10 +16046,10 @@ function printHelp3() {
   console.log(`  ${c.dim}Details for a command: ${c.reset}${c.cyan}solongate <command> help${c.reset}${c.dim}  \xB7  Dashboard: ${c.reset}${c.cyan}https://dashboard.solongate.com${c.reset}`);
   console.log("");
 }
-async function main4() {
+async function main2() {
   const subcommand = process.argv[2];
   if (subcommand === "--help" || subcommand === "-h" || subcommand === "help") {
-    printHelp3();
+    printHelp();
     return;
   }
   if (subcommand === "--version" || subcommand === "-v" || subcommand === "version") {
@@ -17138,7 +16081,7 @@ async function main4() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "keys", "mcp", "alerts", "webhooks"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
@@ -17151,26 +16094,11 @@ async function main4() {
     console.log("");
     return;
   }
-  if (subcommand === "shield") {
-    const { runShield: runShield2 } = await Promise.resolve().then(() => (init_shield(), shield_exports));
-    await runShield2();
-    return;
-  }
   if (subcommand === "logs-server" || subcommand === "local-logs") {
     const { runLogsServer: runLogsServer2 } = await Promise.resolve().then(() => (init_logs_server(), logs_server_exports));
     await runLogsServer2();
     return;
   }
-  if (subcommand === "inject") {
-    process.argv.splice(2, 1);
-    await Promise.resolve().then(() => (init_inject(), inject_exports));
-    return;
-  }
-  if (subcommand === "create") {
-    process.argv.splice(2, 1);
-    await Promise.resolve().then(() => (init_create(), create_exports));
-    return;
-  }
   if (subcommand === "pull" || subcommand === "push" || subcommand === "list" || subcommand === "ls") {
     await Promise.resolve().then(() => (init_pull_push(), pull_push_exports));
     return;
@@ -17197,4 +16125,4 @@ async function main4() {
     process.exit(1);
   }
 }
-main4();
+main2();