@solongate/proxy 0.82.41 → 0.82.43

package/dist/index.js

@@ -6187,907 +6187,1406 @@ var init_cli_utils = __esm({
   }
 });
 
-// src/self-update.ts
-var self_update_exports = {};
-__export(self_update_exports, {
-  currentVersion: () => currentVersion,
-  latestVersion: () => latestVersion,
-  maybeSelfUpdate: () => maybeSelfUpdate,
-  newerThan: () => newerThan,
-  tuiUpdateFlow: () => tuiUpdateFlow
+// src/global-install.ts
+var global_install_exports = {};
+__export(global_install_exports, {
+  clearGuardUpdateCheck: () => clearGuardUpdateCheck,
+  globalPaths: () => globalPaths,
+  guardHookOutdated: () => guardHookOutdated,
+  installClaudeShim: () => installClaudeShim,
+  installGlobalQuiet: () => installGlobalQuiet,
+  installGlobalWithKey: () => installGlobalWithKey,
+  installedGuardVersion: () => installedGuardVersion,
+  isGuardInstalled: () => isGuardInstalled,
+  lockProtected: () => lockProtected,
+  removeClaudeShim: () => removeClaudeShim,
+  runGlobalInstall: () => runGlobalInstall,
+  runGlobalRestore: () => runGlobalRestore,
+  uninstallGlobalQuiet: () => uninstallGlobalQuiet,
+  unlockProtected: () => unlockProtected
 });
-import { execFile, spawn } from "child_process";
-import { mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "fs";
+import { resolve as resolve3, join as join4, dirname } from "path";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join4 } from "path";
 import { fileURLToPath } from "url";
-function readState() {
+import { createInterface } from "readline";
+import { execFileSync as execFileSync2 } from "child_process";
+function lockFile(file) {
+  if (!existsSync3(file)) return;
   try {
-    const s = JSON.parse(readFileSync4(STATE_FILE, "utf-8"));
-    return s && typeof s === "object" ? s : {};
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
   } catch {
-    return {};
   }
 }
-function writeState(s) {
+function unlockFile(file) {
+  if (!existsSync3(file)) return;
   try {
-    mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-    writeFileSync3(STATE_FILE, JSON.stringify(s));
+    if (process.platform === "win32") {
+      try {
+        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
   } catch {
   }
 }
-function currentVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync4(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join4(p.hooksDir, "guard.mjs"),
+    join4(p.hooksDir, "audit.mjs"),
+    join4(p.hooksDir, "stop.mjs"),
+    join4(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath,
+    p.antigravityHooksPath
+  ];
 }
-function newerThan(b, a) {
-  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
-  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
-  for (let i = 0; i < 3; i++) {
-    if ((pb[i] ?? 0) > (pa[i] ?? 0)) return true;
-    if ((pb[i] ?? 0) < (pa[i] ?? 0)) return false;
-  }
-  return false;
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
 }
-async function latestVersion() {
-  return fetchLatest();
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
 }
-async function fetchLatest() {
-  try {
-    const res = await fetch(`https://registry.npmjs.org/${PKG}`, {
-      headers: { accept: "application/vnd.npm.install-v1+json" },
-      signal: AbortSignal.timeout(3e3)
-    });
-    if (!res.ok) return null;
-    const j = await res.json();
-    const latest = j["dist-tags"]?.latest;
-    if (typeof latest !== "string") return null;
-    if (!j.versions || !(latest in j.versions)) return null;
-    return latest;
-  } catch {
-    return null;
-  }
+function globalPaths() {
+  const home = homedir2();
+  const sgDir = join4(home, ".solongate");
+  const hooksDir = join4(sgDir, "hooks");
+  const claudeDir = join4(home, ".claude");
+  const antigravityDir = join4(home, ".gemini", "config");
+  return {
+    home,
+    sgDir,
+    hooksDir,
+    claudeDir,
+    antigravityDir,
+    settingsPath: join4(claudeDir, "settings.json"),
+    backupPath: join4(claudeDir, "settings.solongate.bak"),
+    configPath: join4(sgDir, "cloud-guard.json"),
+    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
+    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
+    // covered by the passive session-log collector, not a hook.
+    antigravityHooksPath: join4(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join4(antigravityDir, "hooks.solongate.bak")
+  };
 }
-function spawnGlobalInstall(version) {
+function clearGuardUpdateCheck() {
   try {
-    mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-    const log3 = openSync(LOG_FILE, "a");
-    const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
-      stdio: ["ignore", log3, log3],
-      detached: true,
-      windowsHide: true,
-      shell: process.platform === "win32"
-    });
-    p.on("error", () => {
-    });
-    p.unref();
+    rmSync2(join4(globalPaths().sgDir, ".hook-update-check"), { force: true });
     return true;
   } catch {
     return false;
   }
 }
-function runGlobalInstall(version) {
-  return new Promise((resolve6) => {
-    try {
-      mkdirSync3(join4(homedir2(), ".solongate"), { recursive: true });
-      execFile(
-        "npm",
-        ["install", "-g", `${PKG}@${version}`],
-        { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
-        (err2, stdout, stderr) => {
-          try {
-            writeFileSync3(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
-${stdout}
-${stderr}
-`, { flag: "a" });
-          } catch {
-          }
-          resolve6(!err2);
-        }
-      );
-    } catch {
-      resolve6(false);
-    }
-  });
+function readHook(filename) {
+  return readFileSync4(join4(HOOKS_DIR, filename), "utf-8");
 }
-async function tuiUpdateFlow(onStatus) {
+function firstAccountCredential() {
   try {
-    const current = currentVersion();
-    const latest = await fetchLatest();
-    const state = readState();
-    if (latest) writeState({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
-    if (!latest || !newerThan(latest, current)) return;
-    if (readState().installed === latest) {
-      onStatus({ kind: "updated", version: latest });
-      return;
-    }
-    onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall(latest)) {
-      writeState({ ...readState(), installed: latest });
-      onStatus({ kind: "updated", version: latest });
+    const raw = JSON.parse(readFileSync4(join4(homedir2(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
     }
   } catch {
   }
+  return {};
 }
-function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
-  void (async () => {
+function readGuard() {
+  const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync3(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+}
+function antigravityHookCommand(guardAbs) {
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
+}
+function installAntigravityGuard(p, guardAbs) {
+  mkdirSync3(p.antigravityDir, { recursive: true });
+  let existing = {};
+  if (existsSync3(p.antigravityHooksPath)) {
+    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
+    if (!existsSync3(p.antigravityBackupPath)) writeFileSync3(p.antigravityBackupPath, raw);
     try {
-      const state = readState();
-      const now = Date.now();
-      const current = currentVersion();
-      let latest = state.latestSeen ?? null;
-      if (now - (state.lastCheckAt ?? 0) >= CHECK_EVERY_MS) {
-        latest = await fetchLatest();
-        if (latest) writeState({ ...state, lastCheckAt: now, latestSeen: latest });
-        else writeState({ ...state, lastCheckAt: now });
-      }
-      if (!latest || !newerThan(latest, current)) return;
-      const attempts = readState().attempts ?? {};
-      if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
-        writeState({ ...readState(), attempts: { [latest]: now } });
-        if (spawnGlobalInstall(latest)) {
-          notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-        }
-      }
+      existing = JSON.parse(raw);
     } catch {
+      existing = {};
     }
-  })();
-}
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE;
-var init_self_update = __esm({
-  "src/self-update.ts"() {
-    "use strict";
-    init_cli_utils();
-    PKG = "@solongate/proxy";
-    CHECK_EVERY_MS = 30 * 60 * 1e3;
-    ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
-    STATE_FILE = join4(homedir2(), ".solongate", ".self-update.json");
-    LOG_FILE = join4(homedir2(), ".solongate", "self-update.log");
-  }
-});
-
-// src/logs-server-daemon.ts
-var logs_server_daemon_exports = {};
-__export(logs_server_daemon_exports, {
-  LOGS_SERVER_PORT: () => LOGS_SERVER_PORT,
-  ensureLogsServerDaemon: () => ensureLogsServerDaemon,
-  logsServerStatus: () => logsServerStatus,
-  recordLogsServerStarted: () => recordLogsServerStarted,
-  startLogsServerDaemon: () => startLogsServerDaemon,
-  stopLogsServerDaemon: () => stopLogsServerDaemon
-});
-import { spawn as spawn2 } from "child_process";
-import { mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function readState2() {
-  try {
-    const s = JSON.parse(readFileSync5(STATE_FILE2, "utf-8"));
-    return s && typeof s === "object" ? s : {};
-  } catch {
-    return {};
   }
+  const merged = {
+    ...existing,
+    [ANTIGRAVITY_GROUP]: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+    }
+  };
+  writeFileSync3(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
 }
-function writeState2(s) {
+function removeAntigravityGuard(p) {
+  if (!existsSync3(p.antigravityHooksPath)) return;
   try {
-    mkdirSync4(DIR, { recursive: true });
-    writeFileSync4(STATE_FILE2, JSON.stringify(s));
+    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
+    if (!(ANTIGRAVITY_GROUP in s)) return;
+    delete s[ANTIGRAVITY_GROUP];
+    writeFileSync3(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
   } catch {
   }
 }
-function pidAlive(pid) {
-  if (!pid || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return e.code === "EPERM";
-  }
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((res) => rl.question(question, (a) => {
+    rl.close();
+    res(a.trim());
+  }));
 }
-function logsServerStatus() {
-  const s = readState2();
-  const running = pidAlive(s.pid);
-  return { desired: s.desired === "on" ? "on" : "off", running, pid: running ? s.pid : void 0, port: s.port || LOGS_SERVER_PORT };
+function runGlobalRestore() {
+  const p = globalPaths();
+  unlockProtected();
+  removeClaudeShim();
+  removeAntigravityGuard(p);
+  if (existsSync3(p.backupPath)) {
+    writeFileSync3(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
+    console.log(`  Restored ${p.settingsPath} from backup.`);
+  } else if (existsSync3(p.settingsPath)) {
+    try {
+      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+      delete s.hooks;
+      writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+      console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
+    } catch {
+    }
+  } else {
+    console.log("  Nothing to restore \u2014 no global Claude Code settings found.");
+  }
+  console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
-function recordLogsServerStarted(port) {
-  writeState2({ desired: "on", pid: process.pid, port, startedAt: Date.now() });
+function installGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync3(p.hooksDir, { recursive: true });
+    mkdirSync3(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync3(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync3(p.backupPath)) writeFileSync3(p.backupPath, raw);
+      try {
+        existing = JSON.parse(raw);
+      } catch {
+        existing = {};
+      }
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join4(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+    try {
+      installAntigravityGuard(p, join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
+    } catch {
+    }
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
+  }
 }
-function startLogsServerDaemon() {
-  const cur = logsServerStatus();
-  if (cur.running) {
-    writeState2({ ...readState2(), desired: "on" });
-    return { ...cur, desired: "on" };
+function installedGuardVersion() {
+  try {
+    const p = globalPaths();
+    const s = readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
+  } catch {
+    return null;
   }
+}
+function guardHookOutdated() {
   try {
-    mkdirSync4(DIR, { recursive: true });
-    const log3 = openSync2(LOG_FILE2, "a");
-    const cli = join5(dirname2(fileURLToPath2(import.meta.url)), "index.js");
-    const p = spawn2(process.execPath, [cli, "logs-server"], {
-      detached: true,
-      stdio: ["ignore", log3, log3],
-      windowsHide: true
-    });
-    p.on("error", () => {
-    });
-    p.unref();
-    writeState2({ desired: "on", pid: p.pid, port: LOGS_SERVER_PORT, startedAt: Date.now() });
-    return { desired: "on", running: true, pid: p.pid, port: LOGS_SERVER_PORT };
+    const p = globalPaths();
+    return readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
-    return { ...cur, desired: "on", running: false };
+    return false;
   }
 }
-function stopLogsServerDaemon() {
-  const s = readState2();
-  if (pidAlive(s.pid)) {
+function isGuardInstalled() {
+  try {
+    const p = globalPaths();
+    if (!existsSync3(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
+  } catch {
+    return false;
+  }
+}
+function uninstallGlobalQuiet() {
+  try {
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
     try {
-      process.kill(s.pid);
+      removeAntigravityGuard(p);
     } catch {
     }
+    if (!existsSync3(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
-  writeState2({ desired: "off", port: s.port });
-  return { desired: "off", running: false, port: s.port || LOGS_SERVER_PORT };
 }
-function ensureLogsServerDaemon() {
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveRealClaude() {
   try {
-    const s = logsServerStatus();
-    if (s.desired === "on" && !s.running) startLogsServerDaemon();
+    const finder = process.platform === "win32" ? "where" : "which";
+    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    if (process.platform === "win32") {
+      const low = (s) => s.toLowerCase();
+      return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
+    }
+    return out2[0] || null;
   } catch {
+    return null;
   }
 }
-var DIR, STATE_FILE2, LOG_FILE2, LOGS_SERVER_PORT;
-var init_logs_server_daemon = __esm({
-  "src/logs-server-daemon.ts"() {
-    "use strict";
-    DIR = join5(homedir3(), ".solongate");
-    STATE_FILE2 = join5(DIR, ".logs-server.json");
-    LOG_FILE2 = join5(DIR, "logs-server.log");
-    LOGS_SERVER_PORT = 8788;
+function shimTargets() {
+  if (process.platform === "win32") {
+    try {
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
+    } catch {
+      return [];
+    }
   }
-});
-
-// src/tui/config.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
-function loadConfig() {
-  if (cached) return cached;
-  const defaults = { notifications: true };
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync3(f));
+}
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync3(file) ? readFileSync4(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
+  }
+  mkdirSync3(dirname(file), { recursive: true });
+  writeFileSync3(file, content);
+}
+function installClaudeShim(shieldPath) {
+  const real = resolveRealClaude();
+  if (!real) {
+    console.log("  (Claude Code not found on PATH \u2014 skipped auto-shield. Install it, then re-open `solongate` \u2192 Settings \u2192 guard.)");
+    return;
+  }
+  const node = process.execPath.replace(/\\/g, "/");
+  const shield = shieldPath.replace(/\\/g, "/");
+  const win = process.platform === "win32";
+  const block2 = win ? `${SHIM_BEGIN}
+function claude { & "${node}" "${shield}" -- "${real}" @args }
+${SHIM_END}` : `${SHIM_BEGIN}
+claude() { "${node}" "${shield}" -- "${real}" "$@"; }
+${SHIM_END}`;
+  const targets = shimTargets();
+  if (targets.length === 0) return;
+  for (const file of targets) {
+    try {
+      writeShimBlock(file, block2);
+    } catch {
+    }
+  }
+}
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
+    try {
+      writeShimBlock(file, null);
+    } catch {
+    }
+  }
+}
+async function runGlobalInstall(opts = {}) {
+  const p = globalPaths();
+  let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
+    } catch {
+    }
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    const acc = firstAccountCredential();
+    if (acc.apiKey) apiKey = acc.apiKey;
+  }
+  if (!apiKey || apiKey === "sg_live_your_key_here") {
+    apiKey = await ask("  Enter your SolonGate API key (sg_live_\u2026 from https://dashboard.solongate.com): ");
+  }
+  if (!apiKey.startsWith("sg_live_") && !apiKey.startsWith("sg_test_")) {
+    console.log("  Invalid API key. Must start with sg_live_ or sg_test_");
+    process.exit(1);
+  }
+  const apiUrl = opts.apiUrl || process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+  mkdirSync3(p.hooksDir, { recursive: true });
+  mkdirSync3(p.claudeDir, { recursive: true });
+  unlockProtected();
+  writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
+  installClaudeShim(join4(p.hooksDir, "shield.mjs"));
+  writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+  console.log(`  Wrote ${p.configPath}`);
+  let existing = {};
+  if (existsSync3(p.settingsPath)) {
+    const raw = readFileSync4(p.settingsPath, "utf-8");
+    if (!existsSync3(p.backupPath)) {
+      writeFileSync3(p.backupPath, raw);
+      console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
+    }
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+  }
+  const guardAbs = join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const auditAbs = join4(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
+  const stopAbs = join4(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
+  const merged = {
+    ...existing,
+    hooks: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
+      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] }]
+    }
+  };
+  writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
+  console.log(`  Registered global hooks \u2192 ${p.settingsPath}`);
   try {
-    const raw = readFileSync6(join6(homedir4(), ".solongate", "tui-config.json"), "utf-8");
-    const j = JSON.parse(raw);
-    cached = {
-      notifications: j.notifications !== false,
-      accent: typeof j.accent === "string" ? j.accent : void 0,
-      pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
-    };
+    installAntigravityGuard(p, guardAbs);
+    console.log(`  Registered Antigravity CLI guard \u2192 ${p.antigravityHooksPath}`);
   } catch {
-    cached = defaults;
   }
-  return cached;
+  if (process.env["SOLONGATE_OS_LOCK"] === "1") {
+    lockProtected();
+    console.log("  Locked protection files (OS-level read-only/immutable).");
+  }
 }
-var cached;
-var init_config = __esm({
-  "src/tui/config.ts"() {
+async function installGlobalWithKey(apiKey, apiUrl) {
+  await runGlobalInstall({ apiKey, apiUrl });
+}
+var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, SHIM_BEGIN, SHIM_END;
+var init_global_install = __esm({
+  "src/global-install.ts"() {
     "use strict";
-    cached = null;
+    __dirname = dirname(fileURLToPath(import.meta.url));
+    HOOKS_DIR = resolve3(__dirname, "..", "hooks");
+    ANTIGRAVITY_GROUP = "solongate-guard";
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
   }
 });
 
-// src/tui/theme.ts
-function decisionColor(decision) {
-  const d = (decision || "").toUpperCase();
-  if (d === "ALLOW") return theme.ok;
-  if (d === "DENY" || d === "DENIED") return theme.bad;
-  return theme.dim;
+// src/self-update.ts
+var self_update_exports = {};
+__export(self_update_exports, {
+  currentVersion: () => currentVersion,
+  latestVersion: () => latestVersion,
+  maybeSelfUpdate: () => maybeSelfUpdate,
+  newerThan: () => newerThan,
+  runUpdateCommand: () => runUpdateCommand,
+  tuiUpdateFlow: () => tuiUpdateFlow
+});
+import { execFile, spawn } from "child_process";
+import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function readState() {
+  try {
+    const s = JSON.parse(readFileSync5(STATE_FILE, "utf-8"));
+    return s && typeof s === "object" ? s : {};
+  } catch {
+    return {};
+  }
 }
-function modeColor(m) {
-  if (m === "block" || m === "active" || m === "on") return theme.ok;
-  if (m === "detect" || m === "idle") return theme.warn;
-  return theme.dim;
+function writeState(s) {
+  try {
+    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    writeFileSync4(STATE_FILE, JSON.stringify(s));
+  } catch {
+  }
 }
-function prettyJson(s) {
+function currentVersion() {
   try {
-    return JSON.stringify(JSON.parse(s), null, 2);
+    const pkg = JSON.parse(readFileSync5(join5(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
+    return pkg.version ?? "0.0.0";
   } catch {
-    return s;
+    return "0.0.0";
   }
 }
-function wrapLines(s, width2) {
-  const w = Math.max(8, width2);
-  const out2 = [];
-  for (const raw of (s ?? "").split("\n")) {
-    if (raw.length <= w) {
-      out2.push(raw);
-      continue;
-    }
-    for (let i = 0; i < raw.length; i += w) out2.push(raw.slice(i, i + w));
+function newerThan(b, a) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((pb[i] ?? 0) > (pa[i] ?? 0)) return true;
+    if ((pb[i] ?? 0) < (pa[i] ?? 0)) return false;
   }
-  return out2;
+  return false;
 }
-function truncate2(s, n) {
-  if (!s) return "";
-  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+async function latestVersion() {
+  return fetchLatest();
 }
-function ago(ts) {
-  const t = typeof ts === "number" ? ts : Date.parse(ts);
-  if (Number.isNaN(t)) return String(ts ?? "");
-  const s = Math.max(0, (Date.now() - t) / 1e3);
-  if (s < 60) return `${Math.floor(s)}s`;
-  if (s < 3600) return `${Math.floor(s / 60)}m`;
-  if (s < 86400) return `${Math.floor(s / 3600)}h`;
-  return `${Math.floor(s / 86400)}d`;
-}
-var accent, theme;
-var init_theme = __esm({
-  "src/tui/theme.ts"() {
-    "use strict";
-    init_config();
-    accent = loadConfig().accent;
-    theme = {
-      accent: accent || "white",
-      accentBright: accent || "white",
-      ok: "green",
-      warn: "yellow",
-      bad: "red",
-      dim: "gray"
-    };
-  }
-});
-
-// src/tui/components.tsx
-import { Box, Text } from "ink";
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-function PaneTitle({ label, extra, width: width2 }) {
-  const tail = extra ? ` ${extra} ` : " ";
-  const used = 2 + 1 + label.length + tail.length;
-  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
-    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
-      "\u258E",
-      label
-    ] }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
-  ] });
-}
-function StreamLine({ e, loc, selected, date }) {
-  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
-    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
-    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
-      "[",
-      date ? ymd(e.at) + " " : "",
-      hhmmss(e.at),
-      " "
-    ] }),
-    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
-    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
-    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
-    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
-    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
-    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
-  ] });
-}
-function DataView({
-  loading,
-  error,
-  empty,
-  emptyText,
-  children
-}) {
-  if (error) return /* @__PURE__ */ jsxs(Text, { color: theme.bad, children: [
-    "\u2717 ",
-    error
-  ] });
-  if (loading) return /* @__PURE__ */ jsx(Text, { color: theme.warn, children: "\u27F3 loading\u2026" });
-  if (empty) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: emptyText ?? "No data." });
-  return /* @__PURE__ */ jsx(Fragment, { children });
-}
-function Table({ columns, rows }) {
-  const fit = (s, w) => {
-    const v = s ?? "";
-    if (v.length > w) return v.slice(0, Math.max(0, w - 1)) + "\u2026";
-    return v.padEnd(w);
-  };
-  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx(Box, { children: columns.map((c2, i) => /* @__PURE__ */ jsx(Text, { color: theme.dim, children: fit(c2.header, c2.width) + "  " }, i)) }),
-    rows.map((row, ri) => /* @__PURE__ */ jsx(Box, { children: row.map((cell, ci) => /* @__PURE__ */ jsx(Text, { color: cell.color, dimColor: cell.dim, bold: cell.bold, children: fit(cell.value, columns[ci]?.width ?? 10) + "  " }, ci)) }, ri))
-  ] });
-}
-function KeyHints({ hints }) {
-  return /* @__PURE__ */ jsx(Box, { children: hints.map(([key, label], i) => /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
-    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: key }),
-    " ",
-    label,
-    i < hints.length - 1 ? "   " : ""
-  ] }, i)) });
-}
-var hhmmss, ymd;
-var init_components = __esm({
-  "src/tui/components.tsx"() {
-    "use strict";
-    init_theme();
-    hhmmss = (ts) => {
-      const d = new Date(ts);
-      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
-    };
-    ymd = (ts) => {
-      const d = new Date(ts);
-      if (Number.isNaN(d.getTime())) return "----------";
-      const p = (n) => String(n).padStart(2, "0");
-      return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
-    };
-  }
-});
-
-// src/tui/local-log.ts
-import { closeSync, openSync as openSync3, readFileSync as readFileSync7, readSync, statSync, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
-function tailLines(file, maxBytes = 131072) {
+async function fetchLatest() {
   try {
-    const size = statSync(file).size;
-    const start = Math.max(0, size - maxBytes);
-    const fd = openSync3(file, "r");
-    const buf = Buffer.alloc(size - start);
-    readSync(fd, buf, 0, buf.length, start);
-    closeSync(fd);
-    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
-    if (start > 0) lines.shift();
-    return lines;
+    const res = await fetch(`https://registry.npmjs.org/${PKG}`, {
+      headers: { accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (!res.ok) return null;
+    const j = await res.json();
+    const latest = j["dist-tags"]?.latest;
+    if (typeof latest !== "string") return null;
+    if (!j.versions || !(latest in j.versions)) return null;
+    return latest;
   } catch {
-    return [];
+    return null;
   }
 }
-function deleteLocalEntry(at, tool, session) {
+function spawnGlobalInstall(version) {
   try {
-    const lines = readFileSync7(LOCAL_LOG, "utf-8").split("\n");
-    let removed = 0;
-    const kept = lines.filter((line) => {
-      if (!line.trim()) return false;
-      if (removed) return true;
-      try {
-        const j = JSON.parse(line);
-        const hit = Date.parse(j.ts ?? "") === at && (j.tool ?? "?") === tool && (!session || j.session_id === session);
-        if (hit) {
-          removed++;
-          return false;
-        }
-      } catch {
-      }
-      return true;
+    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    const log3 = openSync(LOG_FILE, "a");
+    const p = spawn("npm", ["install", "-g", `${PKG}@${version}`], {
+      stdio: ["ignore", log3, log3],
+      detached: true,
+      windowsHide: true,
+      shell: process.platform === "win32"
     });
-    if (removed) writeFileSync5(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
-    return removed;
+    p.on("error", () => {
+    });
+    p.unref();
+    return true;
   } catch {
-    return 0;
+    return false;
   }
 }
-function clearLocalLog() {
+async function runUpdateCommand() {
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const cur = currentVersion();
+  out2(`  current  ${cur}`);
+  const latest = await latestVersion();
+  if (!latest) {
+    out2("  could not reach the npm registry. Try again, or: npm i -g @solongate/proxy@latest");
+    return 1;
+  }
+  if (newerThan(latest, cur)) {
+    out2(`  updating ${cur} -> ${latest} ...`);
+    const ok = await runGlobalInstall2(latest);
+    if (!ok) {
+      out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+      return 1;
+    }
+    out2(`  \u2713 updated to ${latest}  (open a new session to use it)`);
+  } else {
+    out2(`  \u2713 already up to date`);
+  }
   try {
-    const n = readFileSync7(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
-    writeFileSync5(LOCAL_LOG, "");
-    return n;
+    const { installGlobalQuiet: installGlobalQuiet2, installedGuardVersion: installedGuardVersion2 } = await Promise.resolve().then(() => (init_global_install(), global_install_exports));
+    const r = installGlobalQuiet2();
+    out2(r.ok ? `  \u2713 guard hooks refreshed (v${installedGuardVersion2() ?? "?"})` : `  guard: ${r.message}`);
   } catch {
-    return 0;
-  }
-}
-function reasonSignals(reason) {
-  const r = reason || "";
-  const dlp = [];
-  if (DLP_REASON.test(r)) {
-    const m = r.match(/contain(?:s)? (?:a |an )?(.+?)(?:\.|$)/i);
-    dlp.push(m ? m[1].trim() : "DLP");
   }
-  return { dlp, burst: RL_REASON.test(r) };
+  return 0;
 }
-function parseLocalLines(lines) {
-  const out2 = [];
-  for (const line of lines) {
+function runGlobalInstall2(version) {
+  return new Promise((resolve6) => {
     try {
-      const j = JSON.parse(line);
-      const at = Date.parse(j.ts ?? "");
-      if (Number.isFinite(at)) out2.push({ ...j, at });
+      mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+      execFile(
+        "npm",
+        ["install", "-g", `${PKG}@${version}`],
+        { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
+        (err2, stdout, stderr) => {
+          try {
+            writeFileSync4(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
+${stdout}
+${stderr}
+`, { flag: "a" });
+          } catch {
+          }
+          resolve6(!err2);
+        }
+      );
     } catch {
+      resolve6(false);
     }
-  }
-  return out2;
+  });
 }
-var LOCAL_LOG, DLP_REASON, RL_REASON;
-var init_local_log = __esm({
-  "src/tui/local-log.ts"() {
-    "use strict";
-    LOCAL_LOG = join7(homedir5(), ".solongate", "local-logs", "solongate-audit.jsonl");
-    DLP_REASON = /security layer \(dlp\)/i;
-    RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
-  }
-});
-
-// src/api-client/client.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync3 } from "fs";
-import { resolve as resolve3, join as join8 } from "path";
-import { homedir as homedir6 } from "os";
-function listAccounts() {
-  let list5 = [];
+async function tuiUpdateFlow(onStatus) {
   try {
-    const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
-    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+    const current = currentVersion();
+    const latest = await fetchLatest();
+    const state = readState();
+    if (latest) writeState({ ...state, lastCheckAt: Date.now(), latestSeen: latest });
+    if (!latest || !newerThan(latest, current)) return;
+    if (readState().installed === latest) {
+      onStatus({ kind: "updated", version: latest });
+      return;
+    }
+    onStatus({ kind: "updating", version: latest });
+    if (await runGlobalInstall2(latest)) {
+      writeState({ ...readState(), installed: latest });
+      onStatus({ kind: "updated", version: latest });
+    }
   } catch {
   }
-  const active2 = loginCredentialFile();
-  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
-    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL2 });
-  }
-  return list5;
 }
-function saveAccount(acc) {
-  try {
-    const list5 = (() => {
-      try {
-        const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
-        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
-      } catch {
-        return [];
-      }
-    })();
-    const next = list5.filter((a) => a.apiKey !== acc.apiKey);
-    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync5(join8(homedir6(), ".solongate"), { recursive: true });
-    writeFileSync6(accountsFile(), JSON.stringify(next, null, 2));
+function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
+  void (async () => {
+    try {
+      const state = readState();
+      const now = Date.now();
+      const current = currentVersion();
+      let latest = state.latestSeen ?? null;
+      if (now - (state.lastCheckAt ?? 0) >= CHECK_EVERY_MS) {
+        latest = await fetchLatest();
+        if (latest) writeState({ ...state, lastCheckAt: now, latestSeen: latest });
+        else writeState({ ...state, lastCheckAt: now });
+      }
+      if (!latest || !newerThan(latest, current)) return;
+      const attempts = readState().attempts ?? {};
+      if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
+        writeState({ ...readState(), attempts: { [latest]: now } });
+        if (spawnGlobalInstall(latest)) {
+          notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
+        }
+      }
+    } catch {
+    }
+  })();
+}
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE;
+var init_self_update = __esm({
+  "src/self-update.ts"() {
+    "use strict";
+    init_cli_utils();
+    PKG = "@solongate/proxy";
+    CHECK_EVERY_MS = 30 * 60 * 1e3;
+    ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
+    STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
+    LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
+  }
+});
+
+// src/logs-server-daemon.ts
+var logs_server_daemon_exports = {};
+__export(logs_server_daemon_exports, {
+  LOGS_SERVER_PORT: () => LOGS_SERVER_PORT,
+  ensureLogsServerDaemon: () => ensureLogsServerDaemon,
+  logsServerStatus: () => logsServerStatus,
+  recordLogsServerStarted: () => recordLogsServerStarted,
+  startLogsServerDaemon: () => startLogsServerDaemon,
+  stopLogsServerDaemon: () => stopLogsServerDaemon
+});
+import { spawn as spawn2 } from "child_process";
+import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join6 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function readState2() {
+  try {
+    const s = JSON.parse(readFileSync6(STATE_FILE2, "utf-8"));
+    return s && typeof s === "object" ? s : {};
   } catch {
+    return {};
   }
 }
-function removeAccount(apiKey) {
+function writeState2(s) {
   try {
-    const list5 = (() => {
-      try {
-        const raw = JSON.parse(readFileSync8(accountsFile(), "utf-8"));
-        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
-      } catch {
-        return [];
-      }
-    })();
-    writeFileSync6(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+    mkdirSync5(DIR, { recursive: true });
+    writeFileSync5(STATE_FILE2, JSON.stringify(s));
   } catch {
   }
 }
-function setViewCredentials(creds) {
-  viewOverride = creds;
-  cached2 = null;
+function pidAlive(pid) {
+  if (!pid || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
 }
-function isActiveAccount(apiKey) {
-  return loginCredentialFile().apiKey === apiKey;
+function logsServerStatus() {
+  const s = readState2();
+  const running = pidAlive(s.pid);
+  return { desired: s.desired === "on" ? "on" : "off", running, pid: running ? s.pid : void 0, port: s.port || LOGS_SERVER_PORT };
 }
-function setActiveAccount(creds) {
+function recordLogsServerStarted(port) {
+  writeState2({ desired: "on", pid: process.pid, port, startedAt: Date.now() });
+}
+function startLogsServerDaemon() {
+  const cur = logsServerStatus();
+  if (cur.running) {
+    writeState2({ ...readState2(), desired: "on" });
+    return { ...cur, desired: "on" };
+  }
   try {
-    const dir = join8(homedir6(), ".solongate");
-    mkdirSync5(dir, { recursive: true });
-    const p = join8(dir, ["cloud", "guard.json"].join("-"));
-    let existing = {};
-    try {
-      existing = JSON.parse(readFileSync8(p, "utf-8"));
-    } catch {
-    }
-    writeFileSync6(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
-    cached2 = null;
-    return true;
+    mkdirSync5(DIR, { recursive: true });
+    const log3 = openSync2(LOG_FILE2, "a");
+    const cli = join6(dirname3(fileURLToPath3(import.meta.url)), "index.js");
+    const p = spawn2(process.execPath, [cli, "logs-server"], {
+      detached: true,
+      stdio: ["ignore", log3, log3],
+      windowsHide: true
+    });
+    p.on("error", () => {
+    });
+    p.unref();
+    writeState2({ desired: "on", pid: p.pid, port: LOGS_SERVER_PORT, startedAt: Date.now() });
+    return { desired: "on", running: true, pid: p.pid, port: LOGS_SERVER_PORT };
   } catch {
-    return false;
+    return { ...cur, desired: "on", running: false };
   }
 }
-function clearActiveCredential() {
-  try {
-    const p = join8(homedir6(), ".solongate", ["cloud", "guard.json"].join("-"));
-    if (!existsSync3(p)) {
-      cached2 = null;
-      return true;
-    }
-    let existing = {};
+function stopLogsServerDaemon() {
+  const s = readState2();
+  if (pidAlive(s.pid)) {
     try {
-      existing = JSON.parse(readFileSync8(p, "utf-8"));
+      process.kill(s.pid);
     } catch {
     }
-    delete existing.apiKey;
-    delete existing.apiUrl;
-    writeFileSync6(p, JSON.stringify(existing, null, 2));
-    cached2 = null;
-    viewOverride = null;
-    return true;
-  } catch {
-    return false;
   }
+  writeState2({ desired: "off", port: s.port });
+  return { desired: "off", running: false, port: s.port || LOGS_SERVER_PORT };
 }
-function loginCredentialFile() {
+function ensureLogsServerDaemon() {
   try {
-    const p = join8(homedir6(), ".solongate", "cloud-guard.json");
-    if (!existsSync3(p)) return {};
-    const c2 = JSON.parse(readFileSync8(p, "utf-8"));
-    return c2 && typeof c2 === "object" ? c2 : {};
+    const s = logsServerStatus();
+    if (s.desired === "on" && !s.running) startLogsServerDaemon();
   } catch {
-    return {};
   }
 }
-function dotenvApiKey() {
+var DIR, STATE_FILE2, LOG_FILE2, LOGS_SERVER_PORT;
+var init_logs_server_daemon = __esm({
+  "src/logs-server-daemon.ts"() {
+    "use strict";
+    DIR = join6(homedir4(), ".solongate");
+    STATE_FILE2 = join6(DIR, ".logs-server.json");
+    LOG_FILE2 = join6(DIR, "logs-server.log");
+    LOGS_SERVER_PORT = 8788;
+  }
+});
+
+// src/tui/config.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function loadConfig() {
+  if (cached) return cached;
+  const defaults = { notifications: true };
   try {
-    const envPath = resolve3(".env");
-    if (!existsSync3(envPath)) return void 0;
-    for (const line of readFileSync8(envPath, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq === -1) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (key !== "SOLONGATE_API_KEY") continue;
-      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
-    }
+    const raw = readFileSync7(join7(homedir5(), ".solongate", "tui-config.json"), "utf-8");
+    const j = JSON.parse(raw);
+    cached = {
+      notifications: j.notifications !== false,
+      accent: typeof j.accent === "string" ? j.accent : void 0,
+      pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
+    };
   } catch {
+    cached = defaults;
   }
-  return void 0;
+  return cached;
 }
-function isAuthenticated() {
-  try {
-    resolveCredentials();
-    return true;
-  } catch {
-    return false;
+var cached;
+var init_config = __esm({
+  "src/tui/config.ts"() {
+    "use strict";
+    cached = null;
   }
+});
+
+// src/tui/theme.ts
+function decisionColor(decision) {
+  const d = (decision || "").toUpperCase();
+  if (d === "ALLOW") return theme.ok;
+  if (d === "DENY" || d === "DENIED") return theme.bad;
+  return theme.dim;
 }
-function resolveCredentials(apiUrlOverride) {
-  if (viewOverride && !apiUrlOverride) return viewOverride;
-  if (cached2 && !apiUrlOverride) return cached2;
-  const file = loginCredentialFile();
-  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
-  if (!apiKey) throw new NotAuthenticatedError();
-  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL2;
-  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
-  if (!apiUrlOverride) cached2 = creds;
-  return creds;
+function modeColor(m) {
+  if (m === "block" || m === "active" || m === "on") return theme.ok;
+  if (m === "detect" || m === "idle") return theme.warn;
+  return theme.dim;
 }
-function buildUrl(base, path, query) {
-  const url = new URL(`${base}/api/v1${path}`);
-  if (query) {
-    for (const [k, v] of Object.entries(query)) {
-      if (v === void 0) continue;
-      url.searchParams.set(k, String(v));
-    }
+function prettyJson(s) {
+  try {
+    return JSON.stringify(JSON.parse(s), null, 2);
+  } catch {
+    return s;
   }
-  return url.toString();
 }
-async function request(method, path, opts = {}) {
-  const creds = resolveCredentials(opts.apiUrl);
-  const url = buildUrl(creds.apiUrl, path, opts.query);
-  const headers = {
-    Authorization: `Bearer ${creds.apiKey}`
-  };
-  let bodyInit;
-  if (opts.body !== void 0) {
-    headers["Content-Type"] = "application/json";
-    bodyInit = JSON.stringify(opts.body);
-  }
-  const attempt = () => fetch(url, {
-    method,
-    headers: { ...headers, Connection: "close" },
-    body: bodyInit,
-    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
-  });
-  const maxTries = method === "GET" ? 3 : 1;
-  let res;
-  let lastErr;
-  for (let i = 0; i < maxTries; i++) {
-    try {
-      res = await attempt();
-      break;
-    } catch (err2) {
-      lastErr = err2;
-      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
+function wrapLines(s, width2) {
+  const w = Math.max(8, width2);
+  const out2 = [];
+  for (const raw of (s ?? "").split("\n")) {
+    if (raw.length <= w) {
+      out2.push(raw);
+      continue;
     }
+    for (let i = 0; i < raw.length; i += w) out2.push(raw.slice(i, i + w));
   }
-  if (!res) {
-    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
-    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
-  }
-  const text = await res.text().catch(() => "");
-  let json = void 0;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-  }
-  if (!res.ok) {
-    const envelope = json?.error;
-    if (envelope && typeof envelope === "object") {
-      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
-    }
-    if (typeof envelope === "string") {
-      throw new ApiError(res.status, "ERROR", envelope);
-    }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
-    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
-    if (res.status >= 500) throw new ApiError(res.status, "SERVER_ERROR", text || "SolonGate API had a problem (server error). Please try again in a moment.");
-    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
-  }
-  return json;
+  return out2;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
-var init_client = __esm({
-  "src/api-client/client.ts"() {
+function truncate2(s, n) {
+  if (!s) return "";
+  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+function ago(ts) {
+  const t = typeof ts === "number" ? ts : Date.parse(ts);
+  if (Number.isNaN(t)) return String(ts ?? "");
+  const s = Math.max(0, (Date.now() - t) / 1e3);
+  if (s < 60) return `${Math.floor(s)}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h`;
+  return `${Math.floor(s / 86400)}d`;
+}
+var accent, theme;
+var init_theme = __esm({
+  "src/tui/theme.ts"() {
     "use strict";
-    DEFAULT_API_URL2 = "https://api.solongate.com";
-    accountsFile = () => join8(homedir6(), ".solongate", "accounts.json");
-    viewOverride = null;
-    ApiError = class extends Error {
-      status;
-      code;
-      constructor(status, code, message) {
-        super(message);
-        this.name = "ApiError";
-        this.status = status;
-        this.code = code;
-      }
-    };
-    NotAuthenticatedError = class extends Error {
-      constructor() {
-        super("Not logged in. Run `solongate` and log in from the Accounts panel.");
-        this.name = "NotAuthenticatedError";
-      }
+    init_config();
+    accent = loadConfig().accent;
+    theme = {
+      accent: accent || "white",
+      accentBright: accent || "white",
+      ok: "green",
+      warn: "yellow",
+      bad: "red",
+      dim: "gray"
     };
-    cached2 = null;
   }
 });
 
-// src/api-client/types.ts
-var init_types = __esm({
-  "src/api-client/types.ts"() {
+// src/tui/components.tsx
+import { Box, Text } from "ink";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function PaneTitle({ label, extra, width: width2 }) {
+  const tail = extra ? ` ${extra} ` : " ";
+  const used = 2 + 1 + label.length + tail.length;
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
+      "\u258E",
+      label
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width2 - used)) })
+  ] });
+}
+function StreamLine({ e, loc, selected, date }) {
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+      "[",
+      date ? ymd(e.at) + " " : "",
+      hhmmss(e.at),
+      " "
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
+    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate2(e.tool, 12).padEnd(13) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
+    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate2(e.agent ?? "-", 11).padEnd(12) }),
+    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
+    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
+    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate2(e.rule, 14) + " " }) : null,
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
+  ] });
+}
+function DataView({
+  loading,
+  error,
+  empty,
+  emptyText,
+  children
+}) {
+  if (error) return /* @__PURE__ */ jsxs(Text, { color: theme.bad, children: [
+    "\u2717 ",
+    error
+  ] });
+  if (loading) return /* @__PURE__ */ jsx(Text, { color: theme.warn, children: "\u27F3 loading\u2026" });
+  if (empty) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: emptyText ?? "No data." });
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function Table({ columns, rows }) {
+  const fit = (s, w) => {
+    const v = s ?? "";
+    if (v.length > w) return v.slice(0, Math.max(0, w - 1)) + "\u2026";
+    return v.padEnd(w);
+  };
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx(Box, { children: columns.map((c2, i) => /* @__PURE__ */ jsx(Text, { color: theme.dim, children: fit(c2.header, c2.width) + "  " }, i)) }),
+    rows.map((row, ri) => /* @__PURE__ */ jsx(Box, { children: row.map((cell, ci) => /* @__PURE__ */ jsx(Text, { color: cell.color, dimColor: cell.dim, bold: cell.bold, children: fit(cell.value, columns[ci]?.width ?? 10) + "  " }, ci)) }, ri))
+  ] });
+}
+function KeyHints({ hints }) {
+  return /* @__PURE__ */ jsx(Box, { children: hints.map(([key, label], i) => /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: key }),
+    " ",
+    label,
+    i < hints.length - 1 ? "   " : ""
+  ] }, i)) });
+}
+var hhmmss, ymd;
+var init_components = __esm({
+  "src/tui/components.tsx"() {
     "use strict";
+    init_theme();
+    hhmmss = (ts) => {
+      const d = new Date(ts);
+      return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
+    };
+    ymd = (ts) => {
+      const d = new Date(ts);
+      if (Number.isNaN(d.getTime())) return "----------";
+      const p = (n) => String(n).padStart(2, "0");
+      return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+    };
   }
 });
 
-// src/api-client/device-login.ts
-import { spawn as spawn3 } from "child_process";
-function openBrowser(url) {
+// src/tui/local-log.ts
+import { closeSync, openSync as openSync3, readFileSync as readFileSync8, readSync, statSync, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
+function tailLines(file, maxBytes = 131072) {
   try {
-    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-    });
-    child.unref();
+    const size = statSync(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync3(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
   } catch {
+    return [];
   }
 }
-async function startDeviceLogin(apiUrl = DEFAULT_API_URL2) {
-  const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
-  if (!res.ok) throw new Error(`HTTP ${res.status}`);
-  const j = await res.json();
-  return {
-    deviceCode: j.device_code,
-    verifyUrl: j.verification_uri_complete || j.verification_uri || "",
-    intervalMs: Math.max(2, Number(j.interval) || 3) * 1e3,
-    expiresAt: Date.now() + (Number(j.expires_in) || 600) * 1e3
-  };
-}
-async function pollDeviceLogin(apiUrl, deviceCode) {
+function deleteLocalEntry(at, tool, session) {
   try {
-    const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+    const lines = readFileSync8(LOCAL_LOG, "utf-8").split("\n");
+    let removed = 0;
+    const kept = lines.filter((line) => {
+      if (!line.trim()) return false;
+      if (removed) return true;
+      try {
+        const j = JSON.parse(line);
+        const hit = Date.parse(j.ts ?? "") === at && (j.tool ?? "?") === tool && (!session || j.session_id === session);
+        if (hit) {
+          removed++;
+          return false;
+        }
+      } catch {
+      }
+      return true;
     });
-    const j = await res.json().catch(() => ({}));
-    if (j.status === "approved" && j.api_key) {
-      return { status: "approved", apiKey: j.api_key, project: j.project?.name, user: j.user?.name || j.user?.email, email: j.user?.email };
-    }
-    if (j.status === "expired" || j.status === "not_found") return { status: j.status };
-    return { status: "pending" };
+    if (removed) writeFileSync6(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
+    return removed;
   } catch {
-    return { status: "pending" };
+    return 0;
   }
 }
-var init_device_login = __esm({
-  "src/api-client/device-login.ts"() {
+function clearLocalLog() {
+  try {
+    const n = readFileSync8(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
+    writeFileSync6(LOCAL_LOG, "");
+    return n;
+  } catch {
+    return 0;
+  }
+}
+function reasonSignals(reason) {
+  const r = reason || "";
+  const dlp = [];
+  if (DLP_REASON.test(r)) {
+    const m = r.match(/contain(?:s)? (?:a |an )?(.+?)(?:\.|$)/i);
+    dlp.push(m ? m[1].trim() : "DLP");
+  }
+  return { dlp, burst: RL_REASON.test(r) };
+}
+function parseLocalLines(lines) {
+  const out2 = [];
+  for (const line of lines) {
+    try {
+      const j = JSON.parse(line);
+      const at = Date.parse(j.ts ?? "");
+      if (Number.isFinite(at)) out2.push({ ...j, at });
+    } catch {
+    }
+  }
+  return out2;
+}
+var LOCAL_LOG, DLP_REASON, RL_REASON;
+var init_local_log = __esm({
+  "src/tui/local-log.ts"() {
     "use strict";
-    init_client();
+    LOCAL_LOG = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    DLP_REASON = /security layer \(dlp\)/i;
+    RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
   }
 });
 
-// src/api-client/auth.ts
-var auth_exports = {};
-__export(auth_exports, {
-  me: () => me
-});
-function me() {
-  return request("GET", "/auth/me");
-}
-var init_auth = __esm({
-  "src/api-client/auth.ts"() {
-    "use strict";
-    init_client();
+// src/api-client/client.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync4 } from "fs";
+import { resolve as resolve4, join as join9 } from "path";
+import { homedir as homedir7 } from "os";
+function listAccounts() {
+  let list5 = [];
+  try {
+    const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+  } catch {
   }
-});
-
-// src/api-client/policies.ts
-var policies_exports = {};
-__export(policies_exports, {
-  active: () => active,
-  addRule: () => addRule,
-  backtest: () => backtest,
-  create: () => create,
-  dryRun: () => dryRun,
-  get: () => get,
-  list: () => list,
-  remove: () => remove,
-  revokeRule: () => revokeRule,
-  rollback: () => rollback,
-  setActive: () => setActive,
-  update: () => update,
-  versions: () => versions
-});
-function list() {
-  return request("GET", "/policies");
+  const active2 = loginCredentialFile();
+  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
+    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL2 });
+  }
+  return list5;
 }
-function get(id, version) {
-  return request("GET", `/policies/${encodeURIComponent(id)}`, {
-    query: version !== void 0 ? { version } : void 0
-  });
+function saveAccount(acc) {
+  try {
+    const list5 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    const next = list5.filter((a) => a.apiKey !== acc.apiKey);
+    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
+    mkdirSync6(join9(homedir7(), ".solongate"), { recursive: true });
+    writeFileSync7(accountsFile(), JSON.stringify(next, null, 2));
+  } catch {
+  }
 }
-function create(policy) {
-  return request("POST", "/policies", { body: policy });
+function removeAccount(apiKey) {
+  try {
+    const list5 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    writeFileSync7(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+  } catch {
+  }
 }
-function update(id, policy) {
-  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+function setViewCredentials(creds) {
+  viewOverride = creds;
+  cached2 = null;
 }
-function remove(id) {
-  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
+function isActiveAccount(apiKey) {
+  return loginCredentialFile().apiKey === apiKey;
 }
-function addRule(id, spec) {
-  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
+function setActiveAccount(creds) {
+  try {
+    const dir = join9(homedir7(), ".solongate");
+    mkdirSync6(dir, { recursive: true });
+    const p = join9(dir, ["cloud", "guard.json"].join("-"));
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync9(p, "utf-8"));
+    } catch {
+    }
+    writeFileSync7(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
+    cached2 = null;
+    return true;
+  } catch {
+    return false;
+  }
 }
-function revokeRule(id, ruleId) {
-  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
+function clearActiveCredential() {
+  try {
+    const p = join9(homedir7(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync4(p)) {
+      cached2 = null;
+      return true;
+    }
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync9(p, "utf-8"));
+    } catch {
+    }
+    delete existing.apiKey;
+    delete existing.apiUrl;
+    writeFileSync7(p, JSON.stringify(existing, null, 2));
+    cached2 = null;
+    viewOverride = null;
+    return true;
+  } catch {
+    return false;
+  }
 }
-function versions(id, opts = {}) {
-  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
+function loginCredentialFile() {
+  try {
+    const p = join9(homedir7(), ".solongate", "cloud-guard.json");
+    if (!existsSync4(p)) return {};
+    const c2 = JSON.parse(readFileSync9(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
+  } catch {
+    return {};
+  }
 }
-function rollback(id, version) {
-  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
+function dotenvApiKey() {
+  try {
+    const envPath = resolve4(".env");
+    if (!existsSync4(envPath)) return void 0;
+    for (const line of readFileSync9(envPath, "utf-8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (key !== "SOLONGATE_API_KEY") continue;
+      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  return void 0;
 }
-function active(agentId) {
-  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
+function isAuthenticated() {
+  try {
+    resolveCredentials();
+    return true;
+  } catch {
+    return false;
+  }
 }
-function setActive(policyId) {
-  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
+function resolveCredentials(apiUrlOverride) {
+  if (viewOverride && !apiUrlOverride) return viewOverride;
+  if (cached2 && !apiUrlOverride) return cached2;
+  const file = loginCredentialFile();
+  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
+  if (!apiKey) throw new NotAuthenticatedError();
+  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL2;
+  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
+  if (!apiUrlOverride) cached2 = creds;
+  return creds;
 }
-function dryRun(body) {
-  return request("POST", "/policies/dry-run", { body });
+function buildUrl(base, path, query) {
+  const url = new URL(`${base}/api/v1${path}`);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v === void 0) continue;
+      url.searchParams.set(k, String(v));
+    }
+  }
+  return url.toString();
 }
-function backtest(body) {
-  return request("POST", "/policies/backtest", { body });
+async function request(method, path, opts = {}) {
+  const creds = resolveCredentials(opts.apiUrl);
+  const url = buildUrl(creds.apiUrl, path, opts.query);
+  const headers = {
+    Authorization: `Bearer ${creds.apiKey}`
+  };
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  const attempt = () => fetch(url, {
+    method,
+    headers: { ...headers, Connection: "close" },
+    body: bodyInit,
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+  });
+  const maxTries = method === "GET" ? 3 : 1;
+  let res;
+  let lastErr;
+  for (let i = 0; i < maxTries; i++) {
+    try {
+      res = await attempt();
+      break;
+    } catch (err2) {
+      lastErr = err2;
+      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
+    }
+  }
+  if (!res) {
+    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
+    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
+  }
+  const text = await res.text().catch(() => "");
+  let json = void 0;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const envelope = json?.error;
+    if (envelope && typeof envelope === "object") {
+      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
+    }
+    if (typeof envelope === "string") {
+      throw new ApiError(res.status, "ERROR", envelope);
+    }
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
+    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
+    if (res.status >= 500) throw new ApiError(res.status, "SERVER_ERROR", text || "SolonGate API had a problem (server error). Please try again in a moment.");
+    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
+  }
+  return json;
 }
-var init_policies = __esm({
-  "src/api-client/policies.ts"() {
+var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
+var init_client = __esm({
+  "src/api-client/client.ts"() {
     "use strict";
-    init_client();
+    DEFAULT_API_URL2 = "https://api.solongate.com";
+    accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
+    viewOverride = null;
+    ApiError = class extends Error {
+      status;
+      code;
+      constructor(status, code, message) {
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.code = code;
+      }
+    };
+    NotAuthenticatedError = class extends Error {
+      constructor() {
+        super("Not logged in. Run `solongate` and log in from the Accounts panel.");
+        this.name = "NotAuthenticatedError";
+      }
+    };
+    cached2 = null;
   }
 });
 
-// src/api-client/settings.ts
-var settings_exports = {};
-__export(settings_exports, {
-  clearRateLimitHistory: () => clearRateLimitHistory,
-  createAlert: () => createAlert,
-  createWebhook: () => createWebhook,
-  deleteAlert: () => deleteAlert,
-  deleteWebhook: () => deleteWebhook,
-  getAlerts: () => getAlerts,
+// src/api-client/types.ts
+var init_types = __esm({
+  "src/api-client/types.ts"() {
+    "use strict";
+  }
+});
+
+// src/api-client/device-login.ts
+import { spawn as spawn3 } from "child_process";
+function openBrowser(url) {
+  try {
+    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
+    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function startDeviceLogin(apiUrl = DEFAULT_API_URL2) {
+  const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const j = await res.json();
+  return {
+    deviceCode: j.device_code,
+    verifyUrl: j.verification_uri_complete || j.verification_uri || "",
+    intervalMs: Math.max(2, Number(j.interval) || 3) * 1e3,
+    expiresAt: Date.now() + (Number(j.expires_in) || 600) * 1e3
+  };
+}
+async function pollDeviceLogin(apiUrl, deviceCode) {
+  try {
+    const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (j.status === "approved" && j.api_key) {
+      return { status: "approved", apiKey: j.api_key, project: j.project?.name, user: j.user?.name || j.user?.email, email: j.user?.email };
+    }
+    if (j.status === "expired" || j.status === "not_found") return { status: j.status };
+    return { status: "pending" };
+  } catch {
+    return { status: "pending" };
+  }
+}
+var init_device_login = __esm({
+  "src/api-client/device-login.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  me: () => me
+});
+function me() {
+  return request("GET", "/auth/me");
+}
+var init_auth = __esm({
+  "src/api-client/auth.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/policies.ts
+var policies_exports = {};
+__export(policies_exports, {
+  active: () => active,
+  addRule: () => addRule,
+  backtest: () => backtest,
+  create: () => create,
+  dryRun: () => dryRun,
+  get: () => get,
+  list: () => list,
+  remove: () => remove,
+  revokeRule: () => revokeRule,
+  rollback: () => rollback,
+  setActive: () => setActive,
+  update: () => update,
+  versions: () => versions
+});
+function list() {
+  return request("GET", "/policies");
+}
+function get(id, version) {
+  return request("GET", `/policies/${encodeURIComponent(id)}`, {
+    query: version !== void 0 ? { version } : void 0
+  });
+}
+function create(policy) {
+  return request("POST", "/policies", { body: policy });
+}
+function update(id, policy) {
+  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+}
+function remove(id) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
+}
+function addRule(id, spec) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
+}
+function revokeRule(id, ruleId) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
+}
+function versions(id, opts = {}) {
+  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
+}
+function rollback(id, version) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
+}
+function active(agentId) {
+  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
+}
+function setActive(policyId) {
+  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
+}
+function dryRun(body) {
+  return request("POST", "/policies/dry-run", { body });
+}
+function backtest(body) {
+  return request("POST", "/policies/backtest", { body });
+}
+var init_policies = __esm({
+  "src/api-client/policies.ts"() {
+    "use strict";
+    init_client();
+  }
+});
+
+// src/api-client/settings.ts
+var settings_exports = {};
+__export(settings_exports, {
+  clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
   getGuardStatus: () => getGuardStatus,
   getLocalLogs: () => getLocalLogs,
   getRateLimitHistory: () => getRateLimitHistory,
@@ -7413,9 +7912,9 @@ var init_hooks = __esm({
 // src/tui/panels/Live.tsx
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join10 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function extractTarget(detail) {
@@ -7973,10 +8472,10 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join9(homedir7(), ".solongate", "live-export.jsonl");
+        const file = join10(homedir8(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync6(join9(homedir7(), ".solongate"), { recursive: true });
-          writeFileSync7(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
+          mkdirSync7(join10(homedir8(), ".solongate"), { recursive: true });
+          writeFileSync8(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
           setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
@@ -8387,7 +8886,7 @@ var init_Live = __esm({
     SPIN = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
     BG = "#12234f";
     DIM_FLOOR = "#233457";
-    RING = join9(process.cwd(), ".solongate", ".eval-ring.jsonl");
+    RING = join10(process.cwd(), ".solongate", ".eval-ring.jsonl");
     fmtUp = (ms) => {
       const s = Math.floor(ms / 1e3);
       const p = (n) => String(n).padStart(2, "0");
@@ -9390,9 +9889,9 @@ var init_Dlp = __esm({
 // src/tui/panels/Audit.tsx
 import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import TextInput5 from "ink-text-input";
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join11 } from "path";
 import { useState as useState7 } from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 function loadLocalRows() {
@@ -9542,16 +10041,16 @@ function AuditPanel({ active: active2, focused }) {
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
     const run10 = async () => {
-      const dir = join10(homedir8(), ".solongate");
-      const file = join10(dir, `audit-export-${source}.jsonl`);
+      const dir = join11(homedir9(), ".solongate");
+      const file = join11(dir, `audit-export-${source}.jsonl`);
       let rows2;
       if (kind === "page") rows2 = pageRows;
       else if (source === "cloud") {
         const r = await api.audit.list({ ...query, limit: 1e4, offset: 0 });
         rows2 = r.entries.map(cloudRow).sort((a, b) => b.at - a.at);
       } else rows2 = localFiltered;
-      mkdirSync7(dir, { recursive: true });
-      writeFileSync8(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
+      mkdirSync8(dir, { recursive: true });
+      writeFileSync9(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
     run10().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
@@ -9780,551 +10279,245 @@ function AuditPanel({ active: active2, focused }) {
         /* @__PURE__ */ jsx7(Text7, { children: e.trust || "\u2014" }),
         /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502 eval " }),
         /* @__PURE__ */ jsx7(Text7, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : void 0, children: e.evalMs != null ? `${e.evalMs}ms` : "\u2014" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502 agent " }),
-        /* @__PURE__ */ jsx7(Text7, { children: e.agent ?? "\u2014" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502" })
-      ] }),
-      /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2502 session " }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: e.session ?? "\u2014" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502 rule " }),
-        /* @__PURE__ */ jsx7(Text7, { color: e.rule && e.decision !== "ALLOW" ? theme.bad : theme.dim, children: e.rule ?? "\u2014" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502" })
-      ] }),
-      /* @__PURE__ */ jsx7(PaneTitle, { label: "FULL CONTENT", extra: `${contentLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""} \xB7 space copy \xB7 \u2190 back`, width: innerW }),
-      /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", height: bodyRows, overflow: "hidden", children: win.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: l || " " }, off + i)) }),
-      /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
-        /* @__PURE__ */ jsx7(Text7, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
-        /* @__PURE__ */ jsx7(Text7, { backgroundColor: "#0b1530", color: "white", children: ` ${e.id} ` }),
-        /* @__PURE__ */ jsx7(Text7, { backgroundColor: BG2, color: "white", children: " \u2191\u2193 scroll \xB7 space copy \xB7 ? all keys \xB7 \u2190 back \xB7 esc menu " })
-      ] })
-    ] });
-  }
-  const chip = (label, val, on) => /* @__PURE__ */ jsxs7(Text7, { children: [
-    /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-      label,
-      ":"
-    ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: on ? theme.accentBright : theme.dim, children: val }),
-    /* @__PURE__ */ jsx7(Text7, { children: " " })
-  ] });
-  if (view === "sessions") {
-    const headerRows2 = 5 + (editing ? 1 : 0);
-    const listRows2 = Math.max(4, rows - headerRows2);
-    const selC = Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1));
-    const start2 = Math.min(Math.max(0, selC - Math.floor((listRows2 - 1) / 2)), Math.max(0, sessionsFiltered.length - listRows2));
-    const win = sessionsFiltered.slice(start2, start2 + listRows2);
-    return /* @__PURE__ */ jsx7(DataView, { loading: sessLoading && !frozen, error: source === "cloud" ? agentsQ.error : localQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-      strip,
-      copyBanner,
-      /* @__PURE__ */ jsxs7(Box7, { children: [
-        srcChip,
-        /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, bold: true, children: "SESSIONS" }),
-        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 logs (v) " }),
-        chip("status", SESS_STATUS[si] ?? "all", si !== 0),
-        chip("search", sessSearch || "\xB7", !!sessSearch)
-      ] }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 v logs \xB7 ^R refresh \xB7 ? all keys" : "press \u2192 to browse" }),
-      editing === "sess-search" ? /* @__PURE__ */ jsxs7(Box7, { children: [
-        /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: "search: " }),
-        /* @__PURE__ */ jsx7(
-          TextInput5,
-          {
-            value: sessSearch,
-            onChange: (v) => {
-              setSessSearch(v);
-              setSessSel(0);
-            },
-            onSubmit: () => setEditing(null)
-          }
-        )
-      ] }) : null,
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${sessionsFiltered.length} sessions \xB7 ${selC + 1}/${sessionsFiltered.length}${start2 ? ` \xB7 \u25B2${start2}` : ""}${start2 + listRows2 < sessionsFiltered.length ? ` \xB7 \u25BC${sessionsFiltered.length - start2 - listRows2}` : ""}` }),
-      /* @__PURE__ */ jsx7(
-        Table,
-        {
-          columns: [
-            { header: "", width: 2 },
-            { header: "STATUS", width: 8 },
-            { header: "AGENT", width: 18 },
-            { header: "SESSION", width: 10 },
-            { header: "CALLS", width: 6 },
-            { header: "DENY", width: 5 },
-            { header: "DLP", width: 4 },
-            { header: "TRUST", width: 5 },
-            { header: "LAST", width: 6 }
-          ],
-          rows: win.map((r, i) => {
-            const st = STATUS_DOT[r.status];
-            const isSel = start2 + i === selC && focused;
-            return [
-              { value: isSel ? "\u25B8" : "", color: theme.accentBright },
-              { value: `${st.ch} ${r.status}`, color: st.color },
-              { value: truncate2(r.agent, 18), color: theme.accent, bold: isSel },
-              { value: r.id.slice(0, 8), dim: true },
-              { value: String(r.calls) },
-              { value: String(r.denies), color: r.denies ? theme.bad : void 0, dim: !r.denies },
-              { value: String(r.dlp), color: r.dlp ? theme.bad : void 0, dim: !r.dlp },
-              { value: r.trust != null ? String(r.trust) : "\u2014", dim: true },
-              { value: ago(r.lastAt), dim: true }
-            ];
-          })
-        }
-      ),
-      sessionsFiltered.length === 0 ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-        "(no sessions",
-        source === "local" ? " in the local file" : "",
-        ")"
-      ] }) : null
-    ] }) });
-  }
-  const headerRows = 6 + (editing && editing !== "sess-search" ? 1 : 0) + (msg ? 1 : 0) + (frozen ? 1 : 0);
-  const listRows = Math.max(4, rows - headerRows);
-  const selClamped = Math.min(sel, Math.max(0, pageRows.length - 1));
-  const maxStart = Math.max(0, pageRows.length - listRows);
-  const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
-  const windowed = pageRows.slice(start, start + listRows);
-  return /* @__PURE__ */ jsx7(DataView, { loading: logsLoading && !frozen, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
-    strip,
-    copyBanner,
-    /* @__PURE__ */ jsxs7(Box7, { children: [
-      srcChip,
-      /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, bold: true, children: "LOGS" }),
-      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 sessions (v) " }),
-      chip("dec", DECISIONS[di] ?? "all", di !== 0),
-      chip("sig", SIGNALS[gi] ?? "all", gi !== 0),
-      chip("tool", tool || "\xB7", !!tool),
-      chip("agent", agent || "\xB7", !!agent),
-      chip("search", search || "\xB7", !!search),
-      sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
-    ] }),
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 v sessions \xB7 ^R refresh \xB7 ? all keys" : "press \u2192 to browse" }),
-    msg ? /* @__PURE__ */ jsx7(Text7, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, cols) }) : null,
-    editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs7(Box7, { children: [
-      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
-        editing,
-        ": "
-      ] }),
-      /* @__PURE__ */ jsx7(
-        TextInput5,
-        {
-          value: editing === "tool" ? tool : editing === "agent" ? agent : search,
-          onChange: (v) => {
-            (editing === "tool" ? setTool : editing === "agent" ? setAgent : setSearch)(v);
-            setPage(0);
-            toTop();
-          },
-          onSubmit: () => setEditing(null)
-        }
-      )
-    ] }) : null,
-    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
-    /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", overflow: "hidden", children: windowed.map((e, i) => /* @__PURE__ */ jsx7(StreamLine, { e: toStream(e), loc: source === "local", selected: start + i === selClamped && focused, date: true }, e.id)) }),
-    pageRows.length === 0 ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
-      "(no entries",
-      source === "local" ? " in the local file" : "",
-      " \u2014 c clears filters)"
-    ] }) : null
-  ] }) });
-}
-var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, BG2, toStream, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
-var init_Audit = __esm({
-  "src/tui/panels/Audit.tsx"() {
-    "use strict";
-    init_api_client();
-    init_components();
-    init_hooks();
-    init_local_log();
-    init_theme();
-    DECISIONS = [void 0, "DENY", "ALLOW"];
-    SIGNALS = [void 0, "dlp", "ratelimit"];
-    SESS_STATUS = [void 0, "active", "idle", "ended"];
-    PAGE = 500;
-    LOCAL_MAX_BYTES = 16 * 1024 * 1024;
-    BG2 = "#12234f";
-    toStream = (e) => ({
-      at: e.at,
-      tool: e.tool,
-      decision: e.decision,
-      permission: (e.permission ?? "").slice(0, 4),
-      detail: (e.args ?? e.reason ?? "").replace(/\s+/g, " "),
-      dlp: e.dlp.length > 0,
-      burst: e.burst,
-      agent: e.agent,
-      evalMs: e.evalMs,
-      rule: e.rule
-    });
-    cloudRow = (e) => {
-      const rs = reasonSignals(e.reason);
-      return {
-        id: e.id,
-        at: Date.parse(e.created_at),
-        tool: e.tool_name,
-        decision: e.decision,
-        permission: e.permission,
-        trust: e.trust_level,
-        agent: e.agent_name,
-        session: e.session_id,
-        reason: e.reason,
-        rule: e.matched_rule_id,
-        evalMs: e.evaluation_time_ms,
-        dlp: e.dlp_matches?.length ? e.dlp_matches : rs.dlp,
-        burst: !!e.rate_limit_burst || rs.burst,
-        args: e.arguments_summary ? JSON.stringify(e.arguments_summary) : null
-      };
-    };
-    AUDIT_HELP = [
-      [
-        "Logs",
-        [
-          ["\u2191\u2193 / PgUp PgDn", "select a row (window follows)"],
-          ["enter", "open the FULL entry (reason + arguments)"],
-          ["\u2190 \u2192", "previous / next page (500 per page, jumps to top)"],
-          ["f", "decision filter: all \u2192 DENY \u2192 ALLOW"],
-          ["g", "signal filter: all \u2192 dlp \u2192 ratelimit"],
-          ["t / n", "tool / agent filter (type, enter done)"],
-          ["/", "free-text search"],
-          ["x", "delete ONLY the selected entry (press x twice)"],
-          ["X", "delete ALL matched logs of the source (press X twice)"],
-          ["e", "export this page \u2192 ~/.solongate/audit-export-<src>.jsonl"],
-          ["E", "export ALL matched rows (cloud: up to 10k)"],
-          ["c", "clear every filter (incl. session)"]
-        ]
-      ],
-      [
-        "Sessions",
-        [
-          ["\u2191\u2193", "select a session"],
-          ["enter", "open that session's logs"],
-          ["f", "status filter: all \u2192 active \u2192 idle \u2192 ended"],
-          ["/", "search agent / session id"],
-          ["c", "clear session filters"]
-        ]
-      ],
-      [
-        "Anywhere in Audit",
-        [
-          ["v", "switch logs \u2194 sessions"],
-          ["s", "switch source cloud \u2194 local file"],
-          ["space", "copy mode: freeze screen for mouse selection"],
-          ["?", "this help \xB7 any key closes"],
-          ["esc", "back to the menu"]
-        ]
-      ],
-      ["Entry (full content)", [["\u2191\u2193 / PgUp PgDn", "scroll the reason + arguments"], ["space", "copy mode (freeze, then select)"], ["\u2190 / esc", "back to the list"]]]
-    ];
-    sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
-    STATUS_DOT = {
-      active: { ch: "\u25CF", color: theme.ok },
-      idle: { ch: "\u25D0", color: theme.warn },
-      ended: { ch: "\u25CB", color: theme.dim }
-    };
-  }
-});
-
-// src/global-install.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync4, mkdirSync as mkdirSync8, rmSync as rmSync2 } from "fs";
-import { resolve as resolve4, join as join11, dirname as dirname3 } from "path";
-import { homedir as homedir9 } from "os";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { createInterface } from "readline";
-import { execFileSync as execFileSync2 } from "child_process";
-function lockFile(file) {
-  if (!existsSync4(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync4(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join11(p.hooksDir, "guard.mjs"),
-    join11(p.hooksDir, "audit.mjs"),
-    join11(p.hooksDir, "stop.mjs"),
-    join11(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath,
-    p.antigravityHooksPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir9();
-  const sgDir = join11(home, ".solongate");
-  const hooksDir = join11(sgDir, "hooks");
-  const claudeDir = join11(home, ".claude");
-  const antigravityDir = join11(home, ".gemini", "config");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    antigravityDir,
-    settingsPath: join11(claudeDir, "settings.json"),
-    backupPath: join11(claudeDir, "settings.solongate.bak"),
-    configPath: join11(sgDir, "cloud-guard.json"),
-    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
-    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
-    // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join11(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join11(antigravityDir, "hooks.solongate.bak")
-  };
-}
-function readHook(filename) {
-  return readFileSync9(join11(HOOKS_DIR, filename), "utf-8");
-}
-function firstAccountCredential() {
-  try {
-    const raw = JSON.parse(readFileSync9(join11(homedir9(), ".solongate", "accounts.json"), "utf-8"));
-    if (Array.isArray(raw)) {
-      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
-      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
-    }
-  } catch {
-  }
-  return {};
-}
-function readGuard() {
-  const bundled = join11(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync4(bundled) ? readFileSync9(bundled, "utf-8") : readHook("guard.mjs");
-}
-function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
-}
-function installAntigravityGuard(p, guardAbs) {
-  mkdirSync8(p.antigravityDir, { recursive: true });
-  let existing = {};
-  if (existsSync4(p.antigravityHooksPath)) {
-    const raw = readFileSync9(p.antigravityHooksPath, "utf-8");
-    if (!existsSync4(p.antigravityBackupPath)) writeFileSync9(p.antigravityBackupPath, raw);
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const merged = {
-    ...existing,
-    [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
-    }
-  };
-  writeFileSync9(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
-}
-function removeAntigravityGuard(p) {
-  if (!existsSync4(p.antigravityHooksPath)) return;
-  try {
-    const s = JSON.parse(readFileSync9(p.antigravityHooksPath, "utf-8"));
-    if (!(ANTIGRAVITY_GROUP in s)) return;
-    delete s[ANTIGRAVITY_GROUP];
-    writeFileSync9(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
-  } catch {
-  }
-}
-function installGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
-    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-    try {
-      const cfg = JSON.parse(readFileSync9(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
-      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
-    } catch {
-    }
-    if (!apiKey) {
-      const acc = firstAccountCredential();
-      if (acc.apiKey) {
-        apiKey = acc.apiKey;
-        if (acc.apiUrl) apiUrl = acc.apiUrl;
-      }
-    }
-    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
-    mkdirSync8(p.hooksDir, { recursive: true });
-    mkdirSync8(p.claudeDir, { recursive: true });
-    unlockProtected();
-    writeFileSync9(join11(p.hooksDir, "guard.mjs"), readGuard());
-    writeFileSync9(join11(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-    writeFileSync9(join11(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-    writeFileSync9(join11(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-    writeFileSync9(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-    let existing = {};
-    if (existsSync4(p.settingsPath)) {
-      const raw = readFileSync9(p.settingsPath, "utf-8");
-      if (!existsSync4(p.backupPath)) writeFileSync9(p.backupPath, raw);
-      try {
-        existing = JSON.parse(raw);
-      } catch {
-        existing = {};
-      }
-    }
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const call = process.platform === "win32" ? "& " : "";
-    const hookCmd = (script) => `${call}"${nodeBin}" "${join11(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
-    const merged = {
-      ...existing,
-      hooks: {
-        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
-        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
-        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
-      }
-    };
-    writeFileSync9(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-    try {
-      installAntigravityGuard(p, join11(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
-    } catch {
-    }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
-    return { ok: true, message: "guard installed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-function installedGuardVersion() {
-  try {
-    const p = globalPaths();
-    const s = readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8");
-    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
-    return m ? parseInt(m[1], 10) : null;
-  } catch {
-    return null;
-  }
-}
-function guardHookOutdated() {
-  try {
-    const p = globalPaths();
-    return readFileSync9(join11(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
-  } catch {
-    return false;
-  }
-}
-function isGuardInstalled() {
-  try {
-    const p = globalPaths();
-    if (!existsSync4(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
-    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
-  } catch {
-    return false;
-  }
-}
-function uninstallGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    unlockProtected();
-    removeClaudeShim();
-    try {
-      removeAntigravityGuard(p);
-    } catch {
-    }
-    if (!existsSync4(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
-    const s = JSON.parse(readFileSync9(p.settingsPath, "utf-8"));
-    delete s.hooks;
-    writeFileSync9(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-    return { ok: true, message: "guard removed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join11(homedir9(), f)).filter((f) => existsSync4(f));
-}
-function writeShimBlock(file, block2) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync4(file) ? readFileSync9(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block2) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block2 + "\n";
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502 agent " }),
+        /* @__PURE__ */ jsx7(Text7, { children: e.agent ?? "\u2014" }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: "\u2502 session " }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: e.session ?? "\u2014" }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502 rule " }),
+        /* @__PURE__ */ jsx7(Text7, { color: e.rule && e.decision !== "ALLOW" ? theme.bad : theme.dim, children: e.rule ?? "\u2014" }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \u2502" })
+      ] }),
+      /* @__PURE__ */ jsx7(PaneTitle, { label: "FULL CONTENT", extra: `${contentLines.length} lines${maxScroll ? ` \xB7 \u25BC${maxScroll - off} more \xB7 \u2191\u2193 scroll` : ""} \xB7 space copy \xB7 \u2190 back`, width: innerW }),
+      /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", height: bodyRows, overflow: "hidden", children: win.map((l, i) => /* @__PURE__ */ jsx7(Text7, { wrap: "truncate", children: l || " " }, off + i)) }),
+      /* @__PURE__ */ jsxs7(Text7, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx7(Text7, { backgroundColor: BG2, color: "white", bold: true, children: " ENTRY " }),
+        /* @__PURE__ */ jsx7(Text7, { backgroundColor: "#0b1530", color: "white", children: ` ${e.id} ` }),
+        /* @__PURE__ */ jsx7(Text7, { backgroundColor: BG2, color: "white", children: " \u2191\u2193 scroll \xB7 space copy \xB7 ? all keys \xB7 \u2190 back \xB7 esc menu " })
+      ] })
+    ] });
   }
-  mkdirSync8(dirname3(file), { recursive: true });
-  writeFileSync9(file, content);
-}
-function removeClaudeShim() {
-  for (const file of shimTargets()) {
-    try {
-      writeShimBlock(file, null);
-    } catch {
-    }
+  const chip = (label, val, on) => /* @__PURE__ */ jsxs7(Text7, { children: [
+    /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      label,
+      ":"
+    ] }),
+    /* @__PURE__ */ jsx7(Text7, { color: on ? theme.accentBright : theme.dim, children: val }),
+    /* @__PURE__ */ jsx7(Text7, { children: " " })
+  ] });
+  if (view === "sessions") {
+    const headerRows2 = 5 + (editing ? 1 : 0);
+    const listRows2 = Math.max(4, rows - headerRows2);
+    const selC = Math.min(sessSel, Math.max(0, sessionsFiltered.length - 1));
+    const start2 = Math.min(Math.max(0, selC - Math.floor((listRows2 - 1) / 2)), Math.max(0, sessionsFiltered.length - listRows2));
+    const win = sessionsFiltered.slice(start2, start2 + listRows2);
+    return /* @__PURE__ */ jsx7(DataView, { loading: sessLoading && !frozen, error: source === "cloud" ? agentsQ.error : localQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+      strip,
+      copyBanner,
+      /* @__PURE__ */ jsxs7(Box7, { children: [
+        srcChip,
+        /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, bold: true, children: "SESSIONS" }),
+        /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 logs (v) " }),
+        chip("status", SESS_STATUS[si] ?? "all", si !== 0),
+        chip("search", sessSearch || "\xB7", !!sessSearch)
+      ] }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter \u2192 session logs \xB7 v logs \xB7 ^R refresh \xB7 ? all keys" : "press \u2192 to browse" }),
+      editing === "sess-search" ? /* @__PURE__ */ jsxs7(Box7, { children: [
+        /* @__PURE__ */ jsx7(Text7, { color: theme.warn, children: "search: " }),
+        /* @__PURE__ */ jsx7(
+          TextInput5,
+          {
+            value: sessSearch,
+            onChange: (v) => {
+              setSessSearch(v);
+              setSessSel(0);
+            },
+            onSubmit: () => setEditing(null)
+          }
+        )
+      ] }) : null,
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${sessionsFiltered.length} sessions \xB7 ${selC + 1}/${sessionsFiltered.length}${start2 ? ` \xB7 \u25B2${start2}` : ""}${start2 + listRows2 < sessionsFiltered.length ? ` \xB7 \u25BC${sessionsFiltered.length - start2 - listRows2}` : ""}` }),
+      /* @__PURE__ */ jsx7(
+        Table,
+        {
+          columns: [
+            { header: "", width: 2 },
+            { header: "STATUS", width: 8 },
+            { header: "AGENT", width: 18 },
+            { header: "SESSION", width: 10 },
+            { header: "CALLS", width: 6 },
+            { header: "DENY", width: 5 },
+            { header: "DLP", width: 4 },
+            { header: "TRUST", width: 5 },
+            { header: "LAST", width: 6 }
+          ],
+          rows: win.map((r, i) => {
+            const st = STATUS_DOT[r.status];
+            const isSel = start2 + i === selC && focused;
+            return [
+              { value: isSel ? "\u25B8" : "", color: theme.accentBright },
+              { value: `${st.ch} ${r.status}`, color: st.color },
+              { value: truncate2(r.agent, 18), color: theme.accent, bold: isSel },
+              { value: r.id.slice(0, 8), dim: true },
+              { value: String(r.calls) },
+              { value: String(r.denies), color: r.denies ? theme.bad : void 0, dim: !r.denies },
+              { value: String(r.dlp), color: r.dlp ? theme.bad : void 0, dim: !r.dlp },
+              { value: r.trust != null ? String(r.trust) : "\u2014", dim: true },
+              { value: ago(r.lastAt), dim: true }
+            ];
+          })
+        }
+      ),
+      sessionsFiltered.length === 0 ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+        "(no sessions",
+        source === "local" ? " in the local file" : "",
+        ")"
+      ] }) : null
+    ] }) });
   }
+  const headerRows = 6 + (editing && editing !== "sess-search" ? 1 : 0) + (msg ? 1 : 0) + (frozen ? 1 : 0);
+  const listRows = Math.max(4, rows - headerRows);
+  const selClamped = Math.min(sel, Math.max(0, pageRows.length - 1));
+  const maxStart = Math.max(0, pageRows.length - listRows);
+  const start = Math.min(Math.max(0, selClamped - Math.floor((listRows - 1) / 2)), maxStart);
+  const windowed = pageRows.slice(start, start + listRows);
+  return /* @__PURE__ */ jsx7(DataView, { loading: logsLoading && !frozen, error: source === "cloud" ? cloudQ.error : localQ.error, children: /* @__PURE__ */ jsxs7(Box7, { flexDirection: "column", children: [
+    strip,
+    copyBanner,
+    /* @__PURE__ */ jsxs7(Box7, { children: [
+      srcChip,
+      /* @__PURE__ */ jsx7(Text7, { color: theme.accentBright, bold: true, children: "LOGS" }),
+      /* @__PURE__ */ jsx7(Text7, { color: theme.dim, children: " \xB7 sessions (v) " }),
+      chip("dec", DECISIONS[di] ?? "all", di !== 0),
+      chip("sig", SIGNALS[gi] ?? "all", gi !== 0),
+      chip("tool", tool || "\xB7", !!tool),
+      chip("agent", agent || "\xB7", !!agent),
+      chip("search", search || "\xB7", !!search),
+      sessFilter ? chip("sess", sessFilter.slice(0, 8), true) : null
+    ] }),
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: focused ? "\u2191\u2193 select \xB7 enter full entry \xB7 \u2190\u2192 page \xB7 v sessions \xB7 ^R refresh \xB7 ? all keys" : "press \u2192 to browse" }),
+    msg ? /* @__PURE__ */ jsx7(Text7, { color: msg.level === "bad" ? theme.bad : theme.ok, children: truncate2(msg.text, cols) }) : null,
+    editing && editing !== "sess-search" ? /* @__PURE__ */ jsxs7(Box7, { children: [
+      /* @__PURE__ */ jsxs7(Text7, { color: theme.warn, children: [
+        editing,
+        ": "
+      ] }),
+      /* @__PURE__ */ jsx7(
+        TextInput5,
+        {
+          value: editing === "tool" ? tool : editing === "agent" ? agent : search,
+          onChange: (v) => {
+            (editing === "tool" ? setTool : editing === "agent" ? setAgent : setSearch)(v);
+            setPage(0);
+            toTop();
+          },
+          onSubmit: () => setEditing(null)
+        }
+      )
+    ] }) : null,
+    /* @__PURE__ */ jsx7(Text7, { color: theme.dim, wrap: "truncate", children: `${total} matched \xB7 page ${Math.min(page + 1, pages)}/${pages} \xB7 ${PAGE}/page \xB7 ${pageRows.length ? selClamped + 1 : 0}/${pageRows.length}${start ? ` \xB7 \u25B2${start} newer` : ""}${start + listRows < pageRows.length ? ` \xB7 \u25BC${pageRows.length - start - listRows} older` : ""}` }),
+    /* @__PURE__ */ jsx7(Box7, { flexDirection: "column", overflow: "hidden", children: windowed.map((e, i) => /* @__PURE__ */ jsx7(StreamLine, { e: toStream(e), loc: source === "local", selected: start + i === selClamped && focused, date: true }, e.id)) }),
+    pageRows.length === 0 ? /* @__PURE__ */ jsxs7(Text7, { color: theme.dim, children: [
+      "(no entries",
+      source === "local" ? " in the local file" : "",
+      " \u2014 c clears filters)"
+    ] }) : null
+  ] }) });
 }
-var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, SHIM_BEGIN, SHIM_END;
-var init_global_install = __esm({
-  "src/global-install.ts"() {
+var DECISIONS, SIGNALS, SESS_STATUS, PAGE, LOCAL_MAX_BYTES, BG2, toStream, cloudRow, AUDIT_HELP, sessStatus2, STATUS_DOT;
+var init_Audit = __esm({
+  "src/tui/panels/Audit.tsx"() {
     "use strict";
-    __dirname = dirname3(fileURLToPath3(import.meta.url));
-    HOOKS_DIR = resolve4(__dirname, "..", "hooks");
-    ANTIGRAVITY_GROUP = "solongate-guard";
-    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-    SHIM_END = "# <<< SolonGate shield <<<";
+    init_api_client();
+    init_components();
+    init_hooks();
+    init_local_log();
+    init_theme();
+    DECISIONS = [void 0, "DENY", "ALLOW"];
+    SIGNALS = [void 0, "dlp", "ratelimit"];
+    SESS_STATUS = [void 0, "active", "idle", "ended"];
+    PAGE = 500;
+    LOCAL_MAX_BYTES = 16 * 1024 * 1024;
+    BG2 = "#12234f";
+    toStream = (e) => ({
+      at: e.at,
+      tool: e.tool,
+      decision: e.decision,
+      permission: (e.permission ?? "").slice(0, 4),
+      detail: (e.args ?? e.reason ?? "").replace(/\s+/g, " "),
+      dlp: e.dlp.length > 0,
+      burst: e.burst,
+      agent: e.agent,
+      evalMs: e.evalMs,
+      rule: e.rule
+    });
+    cloudRow = (e) => {
+      const rs = reasonSignals(e.reason);
+      return {
+        id: e.id,
+        at: Date.parse(e.created_at),
+        tool: e.tool_name,
+        decision: e.decision,
+        permission: e.permission,
+        trust: e.trust_level,
+        agent: e.agent_name,
+        session: e.session_id,
+        reason: e.reason,
+        rule: e.matched_rule_id,
+        evalMs: e.evaluation_time_ms,
+        dlp: e.dlp_matches?.length ? e.dlp_matches : rs.dlp,
+        burst: !!e.rate_limit_burst || rs.burst,
+        args: e.arguments_summary ? JSON.stringify(e.arguments_summary) : null
+      };
+    };
+    AUDIT_HELP = [
+      [
+        "Logs",
+        [
+          ["\u2191\u2193 / PgUp PgDn", "select a row (window follows)"],
+          ["enter", "open the FULL entry (reason + arguments)"],
+          ["\u2190 \u2192", "previous / next page (500 per page, jumps to top)"],
+          ["f", "decision filter: all \u2192 DENY \u2192 ALLOW"],
+          ["g", "signal filter: all \u2192 dlp \u2192 ratelimit"],
+          ["t / n", "tool / agent filter (type, enter done)"],
+          ["/", "free-text search"],
+          ["x", "delete ONLY the selected entry (press x twice)"],
+          ["X", "delete ALL matched logs of the source (press X twice)"],
+          ["e", "export this page \u2192 ~/.solongate/audit-export-<src>.jsonl"],
+          ["E", "export ALL matched rows (cloud: up to 10k)"],
+          ["c", "clear every filter (incl. session)"]
+        ]
+      ],
+      [
+        "Sessions",
+        [
+          ["\u2191\u2193", "select a session"],
+          ["enter", "open that session's logs"],
+          ["f", "status filter: all \u2192 active \u2192 idle \u2192 ended"],
+          ["/", "search agent / session id"],
+          ["c", "clear session filters"]
+        ]
+      ],
+      [
+        "Anywhere in Audit",
+        [
+          ["v", "switch logs \u2194 sessions"],
+          ["s", "switch source cloud \u2194 local file"],
+          ["space", "copy mode: freeze screen for mouse selection"],
+          ["?", "this help \xB7 any key closes"],
+          ["esc", "back to the menu"]
+        ]
+      ],
+      ["Entry (full content)", [["\u2191\u2193 / PgUp PgDn", "scroll the reason + arguments"], ["space", "copy mode (freeze, then select)"], ["\u2190 / esc", "back to the list"]]]
+    ];
+    sessStatus2 = (lastAt) => Date.now() - lastAt < 6e4 ? "active" : Date.now() - lastAt < 3e5 ? "idle" : "ended";
+    STATUS_DOT = {
+      active: { ch: "\u25CF", color: theme.ok },
+      idle: { ch: "\u25D0", color: theme.warn },
+      ended: { ch: "\u25CB", color: theme.dim }
+    };
   }
 });
 
@@ -11394,6 +11587,22 @@ async function run(argv) {
       printRules(p.rules);
       return 0;
     }
+    case "create": {
+      const name = positionals.slice(1).join(" ").trim();
+      if (!name) return err("  Usage: policy create <name>"), 1;
+      const res = await api.policies.create({ id: `policy-${Date.now()}`, name, rules: [], mode: "denylist" });
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Created "${name}"`) + dim(` (${res.id})`));
+      return 0;
+    }
+    case "delete": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy delete <id>"), 1;
+      const res = await api.policies.remove(id);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Deleted ${res.policy_id}`));
+      return 0;
+    }
     case "allow":
     case "deny": {
       const effect = sub === "allow" ? "ALLOW" : "DENY";
@@ -11508,6 +11717,8 @@ var init_policy = __esm({
     init_format();
     USAGE = usage("solongate policy", "manage cloud policies", [
       ["policy list", "list all policies"],
+      ["policy create <name>", "create a new empty policy"],
+      ["policy delete <id>", "delete a policy"],
       ["policy show <id>", "show one policy (rules, mode)"],
       ["policy allow <id> [--command|--path|--url <val>]", "append an ALLOW rule"],
       ["policy deny  <id> [--command|--path|--url <val>]", "append a DENY rule"],
@@ -15844,7 +16055,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -15905,6 +16116,7 @@ function printHelp() {
   console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
+  cmd("update", "update SolonGate to the newest version and refresh the guard");
   cmd("doctor", "health check: login, policy, guard, local logs");
   cmd("doctor --json", "the same health check as machine-readable JSON");
   cmd("logs-server start", "start the local audit-log service for the dashboard (background)");
@@ -15912,6 +16124,8 @@ function printHelp() {
   cmd("logs-server status", "show the local audit-log service status");
   head("Policies");
   cmd("policy list", "list all policies");
+  cmd("policy create <name>", "create a new empty policy");
+  cmd("policy delete <id>", "delete a policy");
   cmd("policy show <id>", "show one policy (rules, mode)");
   cmd("policy allow <id> [--command|--path|--url <val>]", "add an ALLOW rule");
   cmd("policy deny <id> [--command|--path|--url <val>]", "add a DENY rule");
@@ -15998,6 +16212,10 @@ async function main() {
     console.log("");
     return;
   }
+  if (subcommand === "update") {
+    const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
+    process.exit(await runUpdateCommand2());
+  }
   if (subcommand === "logs-server" || subcommand === "local-logs") {
     const { runLogsServer: runLogsServer2 } = await Promise.resolve().then(() => (init_logs_server(), logs_server_exports));
     await runLogsServer2();