@solongate/proxy 0.82.42 → 0.82.44

package/dist/tui/index.js

@@ -1,714 +1,1024 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/tui/index.tsx
-import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
-import { render } from "ink";
-
-// src/tui/App.tsx
-import { Box as Box9, Text as Text9, useApp, useInput as useInput8 } from "ink";
-import { useEffect as useEffect8, useState as useState9 } from "react";
-
-// src/cli-utils.ts
-var c = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  italic: "\x1B[3m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m",
-  blue1: "\x1B[38;2;20;50;160m",
-  blue2: "\x1B[38;2;40;80;190m",
-  blue3: "\x1B[38;2;60;110;215m",
-  blue4: "\x1B[38;2;90;140;230m",
-  blue5: "\x1B[38;2;130;170;240m",
-  blue6: "\x1B[38;2;170;200;250m",
-  green: "\x1B[38;2;80;200;120m",
-  red: "\x1B[38;2;220;80;80m",
-  cyan: "\x1B[38;2;100;200;220m",
-  yellow: "\x1B[38;2;220;200;80m",
-  bgBlue: "\x1B[48;2;20;50;160m"
-};
-var BANNER_FULL = [
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  ",
-  " \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  ",
-  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
-  " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
-];
-var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
-
-// src/tui/components.tsx
-import { Box, Text } from "ink";
-
-// src/tui/config.ts
-import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var cached = null;
-function loadConfig() {
-  if (cached) return cached;
-  const defaults = { notifications: true };
+// src/global-install.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync2, mkdirSync as mkdirSync4, rmSync } from "fs";
+import { resolve as resolve2, join as join6, dirname } from "path";
+import { homedir as homedir6 } from "os";
+import { fileURLToPath } from "url";
+import { createInterface } from "readline";
+import { execFileSync } from "child_process";
+function lockFile(file) {
+  if (!existsSync2(file)) return;
   try {
-    const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8");
-    const j = JSON.parse(raw);
-    cached = {
-      notifications: j.notifications !== false,
-      accent: typeof j.accent === "string" ? j.accent : void 0,
-      pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
-    };
+    if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
   } catch {
-    cached = defaults;
   }
-  return cached;
 }
-
-// src/tui/theme.ts
-var accent = loadConfig().accent;
-var theme = {
-  accent: accent || "white",
-  accentBright: accent || "white",
-  ok: "green",
-  warn: "yellow",
-  bad: "red",
-  dim: "gray"
-};
-function decisionColor(decision) {
-  const d = (decision || "").toUpperCase();
-  if (d === "ALLOW") return theme.ok;
-  if (d === "DENY" || d === "DENIED") return theme.bad;
-  return theme.dim;
+function unlockFile(file) {
+  if (!existsSync2(file)) return;
+  try {
+    if (process.platform === "win32") {
+      try {
+        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
+      } catch {
+      }
+      try {
+        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else if (process.platform === "darwin") {
+      try {
+        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
+      } catch {
+      }
+    } else {
+      try {
+        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
+      } catch {
+      }
+    }
+  } catch {
+  }
 }
-function modeColor(m) {
-  if (m === "block" || m === "active" || m === "on") return theme.ok;
-  if (m === "detect" || m === "idle") return theme.warn;
-  return theme.dim;
+function protectedTargets() {
+  const p = globalPaths();
+  return [
+    join6(p.hooksDir, "guard.mjs"),
+    join6(p.hooksDir, "audit.mjs"),
+    join6(p.hooksDir, "stop.mjs"),
+    join6(p.hooksDir, "shield.mjs"),
+    p.configPath,
+    p.settingsPath,
+    p.antigravityHooksPath
+  ];
 }
-function prettyJson(s) {
+function lockProtected() {
+  for (const f of protectedTargets()) lockFile(f);
+}
+function unlockProtected() {
+  for (const f of protectedTargets()) unlockFile(f);
+}
+function globalPaths() {
+  const home = homedir6();
+  const sgDir = join6(home, ".solongate");
+  const hooksDir = join6(sgDir, "hooks");
+  const claudeDir = join6(home, ".claude");
+  const antigravityDir = join6(home, ".gemini", "config");
+  return {
+    home,
+    sgDir,
+    hooksDir,
+    claudeDir,
+    antigravityDir,
+    settingsPath: join6(claudeDir, "settings.json"),
+    backupPath: join6(claudeDir, "settings.solongate.bak"),
+    configPath: join6(sgDir, "cloud-guard.json"),
+    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
+    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
+    // covered by the passive session-log collector, not a hook.
+    antigravityHooksPath: join6(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join6(antigravityDir, "hooks.solongate.bak")
+  };
+}
+function readHook(filename) {
+  return readFileSync4(join6(HOOKS_DIR, filename), "utf-8");
+}
+function firstAccountCredential() {
   try {
-    return JSON.stringify(JSON.parse(s), null, 2);
+    const raw = JSON.parse(readFileSync4(join6(homedir6(), ".solongate", "accounts.json"), "utf-8"));
+    if (Array.isArray(raw)) {
+      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
+      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
+    }
   } catch {
-    return s;
   }
+  return {};
 }
-function wrapLines(s, width) {
-  const w = Math.max(8, width);
-  const out = [];
-  for (const raw of (s ?? "").split("\n")) {
-    if (raw.length <= w) {
-      out.push(raw);
-      continue;
+function readGuard() {
+  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync2(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+}
+function antigravityHookCommand(guardAbs) {
+  const nodeBin = process.execPath.replace(/\\/g, "/");
+  const call = process.platform === "win32" ? "& " : "";
+  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
+}
+function installAntigravityGuard(p, guardAbs) {
+  mkdirSync4(p.antigravityDir, { recursive: true });
+  let existing = {};
+  if (existsSync2(p.antigravityHooksPath)) {
+    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
+    if (!existsSync2(p.antigravityBackupPath)) writeFileSync5(p.antigravityBackupPath, raw);
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      existing = {};
     }
-    for (let i = 0; i < raw.length; i += w) out.push(raw.slice(i, i + w));
   }
-  return out;
-}
-function truncate(s, n) {
-  if (!s) return "";
-  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+  const merged = {
+    ...existing,
+    [ANTIGRAVITY_GROUP]: {
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+    }
+  };
+  writeFileSync5(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
 }
-function ago(ts) {
-  const t = typeof ts === "number" ? ts : Date.parse(ts);
-  if (Number.isNaN(t)) return String(ts ?? "");
-  const s = Math.max(0, (Date.now() - t) / 1e3);
-  if (s < 60) return `${Math.floor(s)}s`;
-  if (s < 3600) return `${Math.floor(s / 60)}m`;
-  if (s < 86400) return `${Math.floor(s / 3600)}h`;
-  return `${Math.floor(s / 86400)}d`;
+function removeAntigravityGuard(p) {
+  if (!existsSync2(p.antigravityHooksPath)) return;
+  try {
+    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
+    if (!(ANTIGRAVITY_GROUP in s)) return;
+    delete s[ANTIGRAVITY_GROUP];
+    writeFileSync5(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
+  } catch {
+  }
 }
-
-// src/tui/components.tsx
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-var hhmmss = (ts) => {
-  const d = new Date(ts);
-  return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
-};
-var ymd = (ts) => {
-  const d = new Date(ts);
-  if (Number.isNaN(d.getTime())) return "----------";
-  const p = (n) => String(n).padStart(2, "0");
-  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
-};
-function PaneTitle({ label, extra, width }) {
-  const tail = extra ? ` ${extra} ` : " ";
-  const used = 2 + 1 + label.length + tail.length;
-  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
-    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
-      "\u258E",
-      label
-    ] }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width - used)) })
-  ] });
-}
-function StreamLine({ e, loc, selected, date }) {
-  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
-    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
-    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
-      "[",
-      date ? ymd(e.at) + " " : "",
-      hhmmss(e.at),
-      " "
-    ] }),
-    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
-    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate(e.tool, 12).padEnd(13) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
-    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate(e.agent ?? "-", 11).padEnd(12) }),
-    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
-    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
-    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate(e.rule, 14) + " " }) : null,
-    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
-  ] });
-}
-function DataView({
-  loading,
-  error,
-  empty,
-  emptyText,
-  children
-}) {
-  if (error) return /* @__PURE__ */ jsxs(Text, { color: theme.bad, children: [
-    "\u2717 ",
-    error
-  ] });
-  if (loading) return /* @__PURE__ */ jsx(Text, { color: theme.warn, children: "\u27F3 loading\u2026" });
-  if (empty) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: emptyText ?? "No data." });
-  return /* @__PURE__ */ jsx(Fragment, { children });
-}
-function Table({ columns, rows }) {
-  const fit = (s, w) => {
-    const v = s ?? "";
-    if (v.length > w) return v.slice(0, Math.max(0, w - 1)) + "\u2026";
-    return v.padEnd(w);
-  };
-  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx(Box, { children: columns.map((c2, i) => /* @__PURE__ */ jsx(Text, { color: theme.dim, children: fit(c2.header, c2.width) + "  " }, i)) }),
-    rows.map((row, ri) => /* @__PURE__ */ jsx(Box, { children: row.map((cell, ci) => /* @__PURE__ */ jsx(Text, { color: cell.color, dimColor: cell.dim, bold: cell.bold, children: fit(cell.value, columns[ci]?.width ?? 10) + "  " }, ci)) }, ri))
-  ] });
-}
-function KeyHints({ hints }) {
-  return /* @__PURE__ */ jsx(Box, { children: hints.map(([key, label], i) => /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
-    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: key }),
-    " ",
-    label,
-    i < hints.length - 1 ? "   " : ""
-  ] }, i)) });
-}
-
-// src/tui/panels/Live.tsx
-import { Box as Box2, Text as Text2, useInput } from "ink";
-import TextInput from "ink-text-input";
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-
-// src/tui/local-log.ts
-import { closeSync, openSync, readFileSync as readFileSync2, readSync, statSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
-function tailLines(file, maxBytes = 131072) {
-  try {
-    const size = statSync(file).size;
-    const start = Math.max(0, size - maxBytes);
-    const fd = openSync(file, "r");
-    const buf = Buffer.alloc(size - start);
-    readSync(fd, buf, 0, buf.length, start);
-    closeSync(fd);
-    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
-    if (start > 0) lines.shift();
-    return lines;
-  } catch {
-    return [];
-  }
-}
-function deleteLocalEntry(at, tool, session) {
+function installGlobalQuiet() {
   try {
-    const lines = readFileSync2(LOCAL_LOG, "utf-8").split("\n");
-    let removed = 0;
-    const kept = lines.filter((line) => {
-      if (!line.trim()) return false;
-      if (removed) return true;
+    const p = globalPaths();
+    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
+    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
+    try {
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
+      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
+    } catch {
+    }
+    if (!apiKey) {
+      const acc = firstAccountCredential();
+      if (acc.apiKey) {
+        apiKey = acc.apiKey;
+        if (acc.apiUrl) apiUrl = acc.apiUrl;
+      }
+    }
+    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
+    mkdirSync4(p.hooksDir, { recursive: true });
+    mkdirSync4(p.claudeDir, { recursive: true });
+    unlockProtected();
+    writeFileSync5(join6(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync5(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync5(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync5(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
+    let existing = {};
+    if (existsSync2(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync2(p.backupPath)) writeFileSync5(p.backupPath, raw);
       try {
-        const j = JSON.parse(line);
-        const hit = Date.parse(j.ts ?? "") === at && (j.tool ?? "?") === tool && (!session || j.session_id === session);
-        if (hit) {
-          removed++;
-          return false;
-        }
+        existing = JSON.parse(raw);
       } catch {
+        existing = {};
       }
-      return true;
-    });
-    if (removed) writeFileSync(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
-    return removed;
-  } catch {
-    return 0;
-  }
-}
-function clearLocalLog() {
-  try {
-    const n = readFileSync2(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
-    writeFileSync(LOCAL_LOG, "");
-    return n;
-  } catch {
-    return 0;
-  }
-}
-var DLP_REASON = /security layer \(dlp\)/i;
-var RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
-function reasonSignals(reason) {
-  const r = reason || "";
-  const dlp = [];
-  if (DLP_REASON.test(r)) {
-    const m = r.match(/contain(?:s)? (?:a |an )?(.+?)(?:\.|$)/i);
-    dlp.push(m ? m[1].trim() : "DLP");
-  }
-  return { dlp, burst: RL_REASON.test(r) };
-}
-function parseLocalLines(lines) {
-  const out = [];
-  for (const line of lines) {
+    }
+    const nodeBin = process.execPath.replace(/\\/g, "/");
+    const call = process.platform === "win32" ? "& " : "";
+    const hookCmd = (script) => `${call}"${nodeBin}" "${join6(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const merged = {
+      ...existing,
+      hooks: {
+        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
+      }
+    };
+    writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
     try {
-      const j = JSON.parse(line);
-      const at = Date.parse(j.ts ?? "");
-      if (Number.isFinite(at)) out.push({ ...j, at });
+      installAntigravityGuard(p, join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
+    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
+    return { ok: true, message: "guard installed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
-  return out;
 }
-
-// src/tui/panels/Live.tsx
-import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
-
-// src/api-client/client.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, existsSync } from "fs";
-import { resolve, join as join3 } from "path";
-import { homedir as homedir3 } from "os";
-var DEFAULT_API_URL = "https://api.solongate.com";
-var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json");
-function listAccounts() {
-  let list5 = [];
+function installedGuardVersion() {
   try {
-    const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
-    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+    const p = globalPaths();
+    const s = readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8");
+    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
+    return m ? parseInt(m[1], 10) : null;
   } catch {
+    return null;
   }
-  const active2 = loginCredentialFile();
-  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
-    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL });
-  }
-  return list5;
 }
-function saveAccount(acc) {
+function guardHookOutdated() {
   try {
-    const list5 = (() => {
-      try {
-        const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
-        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
-      } catch {
-        return [];
-      }
-    })();
-    const next = list5.filter((a) => a.apiKey !== acc.apiKey);
-    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync(join3(homedir3(), ".solongate"), { recursive: true });
-    writeFileSync2(accountsFile(), JSON.stringify(next, null, 2));
+    const p = globalPaths();
+    return readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
+    return false;
   }
 }
-function removeAccount(apiKey) {
+function isGuardInstalled() {
   try {
-    const list5 = (() => {
-      try {
-        const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
-        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
-      } catch {
-        return [];
-      }
-    })();
-    writeFileSync2(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+    const p = globalPaths();
+    if (!existsSync2(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
   } catch {
+    return false;
   }
 }
-var viewOverride = null;
-function setViewCredentials(creds) {
-  viewOverride = creds;
-  cached2 = null;
-}
-function isActiveAccount(apiKey) {
-  return loginCredentialFile().apiKey === apiKey;
-}
-function setActiveAccount(creds) {
+function uninstallGlobalQuiet() {
   try {
-    const dir = join3(homedir3(), ".solongate");
-    mkdirSync(dir, { recursive: true });
-    const p = join3(dir, ["cloud", "guard.json"].join("-"));
-    let existing = {};
+    const p = globalPaths();
+    unlockProtected();
+    removeClaudeShim();
     try {
-      existing = JSON.parse(readFileSync3(p, "utf-8"));
+      removeAntigravityGuard(p);
     } catch {
     }
-    writeFileSync2(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
-    cached2 = null;
-    return true;
-  } catch {
-    return false;
+    if (!existsSync2(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    delete s.hooks;
+    writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
+    return { ok: true, message: "guard removed (open a new session)" };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : String(e) };
   }
 }
-function clearActiveCredential() {
-  try {
-    const p = join3(homedir3(), ".solongate", ["cloud", "guard.json"].join("-"));
-    if (!existsSync(p)) {
-      cached2 = null;
-      return true;
-    }
-    let existing = {};
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function shimTargets() {
+  if (process.platform === "win32") {
     try {
-      existing = JSON.parse(readFileSync3(p, "utf-8"));
+      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      return prof ? [prof] : [];
     } catch {
+      return [];
     }
-    delete existing.apiKey;
-    delete existing.apiUrl;
-    writeFileSync2(p, JSON.stringify(existing, null, 2));
-    cached2 = null;
-    viewOverride = null;
-    return true;
-  } catch {
-    return false;
   }
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir6(), f)).filter((f) => existsSync2(f));
 }
-var ApiError = class extends Error {
-  status;
-  code;
-  constructor(status, code, message) {
-    super(message);
-    this.name = "ApiError";
-    this.status = status;
-    this.code = code;
+function writeShimBlock(file, block2) {
+  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
+  let content = existsSync2(file) ? readFileSync4(file, "utf-8") : "";
+  content = content.replace(re, "");
+  if (block2) {
+    if (content.length && !content.endsWith("\n")) content += "\n";
+    content += block2 + "\n";
   }
-};
-var NotAuthenticatedError = class extends Error {
-  constructor() {
-    super("Not logged in. Run `solongate` and log in from the Accounts panel.");
-    this.name = "NotAuthenticatedError";
+  mkdirSync4(dirname(file), { recursive: true });
+  writeFileSync5(file, content);
+}
+function removeClaudeShim() {
+  for (const file of shimTargets()) {
+    try {
+      writeShimBlock(file, null);
+    } catch {
+    }
+  }
+}
+var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, SHIM_BEGIN, SHIM_END;
+var init_global_install = __esm({
+  "src/global-install.ts"() {
+    "use strict";
+    __dirname = dirname(fileURLToPath(import.meta.url));
+    HOOKS_DIR = resolve2(__dirname, "..", "hooks");
+    ANTIGRAVITY_GROUP = "solongate-guard";
+    SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
+    SHIM_END = "# <<< SolonGate shield <<<";
   }
+});
+
+// src/tui/index.tsx
+import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
+import { render } from "ink";
+
+// src/tui/App.tsx
+import { Box as Box9, Text as Text9, useApp, useInput as useInput8 } from "ink";
+import { useEffect as useEffect8, useState as useState9 } from "react";
+
+// src/cli-utils.ts
+var c = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  italic: "\x1B[3m",
+  white: "\x1B[97m",
+  gray: "\x1B[90m",
+  blue1: "\x1B[38;2;20;50;160m",
+  blue2: "\x1B[38;2;40;80;190m",
+  blue3: "\x1B[38;2;60;110;215m",
+  blue4: "\x1B[38;2;90;140;230m",
+  blue5: "\x1B[38;2;130;170;240m",
+  blue6: "\x1B[38;2;170;200;250m",
+  green: "\x1B[38;2;80;200;120m",
+  red: "\x1B[38;2;220;80;80m",
+  cyan: "\x1B[38;2;100;200;220m",
+  yellow: "\x1B[38;2;220;200;80m",
+  bgBlue: "\x1B[48;2;20;50;160m"
 };
-function loginCredentialFile() {
+var BANNER_FULL = [
+  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557      \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
+  " \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
+  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2557  ",
+  " \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u255D  ",
+  " \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
+  " \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
+];
+var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
+
+// src/tui/components.tsx
+import { Box, Text } from "ink";
+
+// src/tui/config.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var cached = null;
+function loadConfig() {
+  if (cached) return cached;
+  const defaults = { notifications: true };
   try {
-    const p = join3(homedir3(), ".solongate", "cloud-guard.json");
-    if (!existsSync(p)) return {};
-    const c2 = JSON.parse(readFileSync3(p, "utf-8"));
-    return c2 && typeof c2 === "object" ? c2 : {};
+    const raw = readFileSync(join(homedir(), ".solongate", "tui-config.json"), "utf-8");
+    const j = JSON.parse(raw);
+    cached = {
+      notifications: j.notifications !== false,
+      accent: typeof j.accent === "string" ? j.accent : void 0,
+      pollMs: typeof j.pollMs === "number" ? j.pollMs : void 0
+    };
   } catch {
-    return {};
+    cached = defaults;
   }
+  return cached;
 }
-function dotenvApiKey() {
+
+// src/tui/theme.ts
+var accent = loadConfig().accent;
+var theme = {
+  accent: accent || "white",
+  accentBright: accent || "white",
+  ok: "green",
+  warn: "yellow",
+  bad: "red",
+  dim: "gray"
+};
+function decisionColor(decision) {
+  const d = (decision || "").toUpperCase();
+  if (d === "ALLOW") return theme.ok;
+  if (d === "DENY" || d === "DENIED") return theme.bad;
+  return theme.dim;
+}
+function modeColor(m) {
+  if (m === "block" || m === "active" || m === "on") return theme.ok;
+  if (m === "detect" || m === "idle") return theme.warn;
+  return theme.dim;
+}
+function prettyJson(s) {
   try {
-    const envPath = resolve(".env");
-    if (!existsSync(envPath)) return void 0;
-    for (const line of readFileSync3(envPath, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq === -1) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (key !== "SOLONGATE_API_KEY") continue;
-      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
-    }
+    return JSON.stringify(JSON.parse(s), null, 2);
   } catch {
+    return s;
   }
-  return void 0;
 }
-var cached2 = null;
-function resolveCredentials(apiUrlOverride) {
-  if (viewOverride && !apiUrlOverride) return viewOverride;
-  if (cached2 && !apiUrlOverride) return cached2;
-  const file = loginCredentialFile();
-  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
-  if (!apiKey) throw new NotAuthenticatedError();
-  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL;
-  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
-  if (!apiUrlOverride) cached2 = creds;
-  return creds;
-}
-function buildUrl(base, path, query) {
-  const url = new URL(`${base}/api/v1${path}`);
-  if (query) {
-    for (const [k, v] of Object.entries(query)) {
-      if (v === void 0) continue;
-      url.searchParams.set(k, String(v));
+function wrapLines(s, width) {
+  const w = Math.max(8, width);
+  const out = [];
+  for (const raw of (s ?? "").split("\n")) {
+    if (raw.length <= w) {
+      out.push(raw);
+      continue;
     }
+    for (let i = 0; i < raw.length; i += w) out.push(raw.slice(i, i + w));
   }
-  return url.toString();
+  return out;
 }
-async function request(method, path, opts = {}) {
-  const creds = resolveCredentials(opts.apiUrl);
-  const url = buildUrl(creds.apiUrl, path, opts.query);
-  const headers = {
-    Authorization: `Bearer ${creds.apiKey}`
-  };
-  let bodyInit;
-  if (opts.body !== void 0) {
-    headers["Content-Type"] = "application/json";
-    bodyInit = JSON.stringify(opts.body);
-  }
-  const attempt = () => fetch(url, {
-    method,
-    headers: { ...headers, Connection: "close" },
-    body: bodyInit,
-    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
-  });
-  const maxTries = method === "GET" ? 3 : 1;
-  let res;
-  let lastErr;
-  for (let i = 0; i < maxTries; i++) {
-    try {
-      res = await attempt();
-      break;
-    } catch (err) {
-      lastErr = err;
-      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
-    }
-  }
-  if (!res) {
-    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
-    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
-  }
-  const text = await res.text().catch(() => "");
-  let json = void 0;
-  if (text) {
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-  }
-  if (!res.ok) {
-    const envelope = json?.error;
-    if (envelope && typeof envelope === "object") {
-      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
-    }
-    if (typeof envelope === "string") {
-      throw new ApiError(res.status, "ERROR", envelope);
-    }
-    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
-    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
-    if (res.status >= 500) throw new ApiError(res.status, "SERVER_ERROR", text || "SolonGate API had a problem (server error). Please try again in a moment.");
-    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
-  }
-  return json;
+function truncate(s, n) {
+  if (!s) return "";
+  return s.length <= n ? s : s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+function ago(ts) {
+  const t = typeof ts === "number" ? ts : Date.parse(ts);
+  if (Number.isNaN(t)) return String(ts ?? "");
+  const s = Math.max(0, (Date.now() - t) / 1e3);
+  if (s < 60) return `${Math.floor(s)}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h`;
+  return `${Math.floor(s / 86400)}d`;
 }
 
-// src/api-client/device-login.ts
-import { spawn } from "child_process";
-function openBrowser(url) {
+// src/tui/components.tsx
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var hhmmss = (ts) => {
+  const d = new Date(ts);
+  return Number.isNaN(d.getTime()) ? "--:--:--" : d.toTimeString().slice(0, 8);
+};
+var ymd = (ts) => {
+  const d = new Date(ts);
+  if (Number.isNaN(d.getTime())) return "----------";
+  const p = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+};
+function PaneTitle({ label, extra, width }) {
+  const tail = extra ? ` ${extra} ` : " ";
+  const used = 2 + 1 + label.length + tail.length;
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "\u2500 " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.accentBright, bold: true, children: [
+      "\u258E",
+      label
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: tail + "\u2500".repeat(Math.max(0, width - used)) })
+  ] });
+}
+function StreamLine({ e, loc, selected, date }) {
+  return /* @__PURE__ */ jsxs(Text, { wrap: "truncate", backgroundColor: selected ? "#1c2f63" : void 0, children: [
+    /* @__PURE__ */ jsx(Text, { color: selected ? theme.accentBright : theme.dim, children: selected ? "\u25B8" : " " }),
+    /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+      "[",
+      date ? ymd(e.at) + " " : "",
+      hhmmss(e.at),
+      " "
+    ] }),
+    /* @__PURE__ */ jsx(Text, { color: loc ? theme.ok : "white", children: loc ? "LOC" : "CLD" }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: "] " }),
+    /* @__PURE__ */ jsx(Text, { color: decisionColor(e.decision), bold: e.decision !== "ALLOW", children: e.decision.padEnd(6) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: truncate(e.tool, 12).padEnd(13) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: (e.permission ?? "").padEnd(5) }),
+    /* @__PURE__ */ jsx(Text, { color: e.evalMs != null && e.evalMs > 500 ? theme.warn : theme.dim, children: (e.evalMs != null ? `${e.evalMs}ms` : "\u2014").padEnd(7) }),
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: truncate(e.agent ?? "-", 11).padEnd(12) }),
+    /* @__PURE__ */ jsx(Text, { color: e.dlp ? theme.bad : theme.dim, bold: e.dlp, children: ("dlp:" + (e.dlp ? "yes" : "no")).padEnd(8) }),
+    /* @__PURE__ */ jsx(Text, { color: e.burst ? theme.warn : theme.dim, bold: e.burst, children: ("rl:" + (e.burst ? "yes" : "no")).padEnd(7) }),
+    e.rule && e.decision !== "ALLOW" ? /* @__PURE__ */ jsx(Text, { color: theme.bad, children: truncate(e.rule, 14) + " " }) : null,
+    /* @__PURE__ */ jsx(Text, { color: theme.dim, children: e.detail })
+  ] });
+}
+function DataView({
+  loading,
+  error,
+  empty,
+  emptyText,
+  children
+}) {
+  if (error) return /* @__PURE__ */ jsxs(Text, { color: theme.bad, children: [
+    "\u2717 ",
+    error
+  ] });
+  if (loading) return /* @__PURE__ */ jsx(Text, { color: theme.warn, children: "\u27F3 loading\u2026" });
+  if (empty) return /* @__PURE__ */ jsx(Text, { color: theme.dim, children: emptyText ?? "No data." });
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function Table({ columns, rows }) {
+  const fit = (s, w) => {
+    const v = s ?? "";
+    if (v.length > w) return v.slice(0, Math.max(0, w - 1)) + "\u2026";
+    return v.padEnd(w);
+  };
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx(Box, { children: columns.map((c2, i) => /* @__PURE__ */ jsx(Text, { color: theme.dim, children: fit(c2.header, c2.width) + "  " }, i)) }),
+    rows.map((row, ri) => /* @__PURE__ */ jsx(Box, { children: row.map((cell, ci) => /* @__PURE__ */ jsx(Text, { color: cell.color, dimColor: cell.dim, bold: cell.bold, children: fit(cell.value, columns[ci]?.width ?? 10) + "  " }, ci)) }, ri))
+  ] });
+}
+function KeyHints({ hints }) {
+  return /* @__PURE__ */ jsx(Box, { children: hints.map(([key, label], i) => /* @__PURE__ */ jsxs(Text, { color: theme.dim, children: [
+    /* @__PURE__ */ jsx(Text, { color: theme.accent, children: key }),
+    " ",
+    label,
+    i < hints.length - 1 ? "   " : ""
+  ] }, i)) });
+}
+
+// src/tui/panels/Live.tsx
+import { Box as Box2, Text as Text2, useInput } from "ink";
+import TextInput from "ink-text-input";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+
+// src/tui/local-log.ts
+import { closeSync, openSync, readFileSync as readFileSync2, readSync, statSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
+function tailLines(file, maxBytes = 131072) {
   try {
-    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-    });
-    child.unref();
+    const size = statSync(file).size;
+    const start = Math.max(0, size - maxBytes);
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(size - start);
+    readSync(fd, buf, 0, buf.length, start);
+    closeSync(fd);
+    const lines = buf.toString("utf-8").split("\n").filter(Boolean);
+    if (start > 0) lines.shift();
+    return lines;
   } catch {
+    return [];
   }
 }
-async function startDeviceLogin(apiUrl = DEFAULT_API_URL) {
-  const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
-  if (!res.ok) throw new Error(`HTTP ${res.status}`);
-  const j = await res.json();
-  return {
-    deviceCode: j.device_code,
-    verifyUrl: j.verification_uri_complete || j.verification_uri || "",
-    intervalMs: Math.max(2, Number(j.interval) || 3) * 1e3,
-    expiresAt: Date.now() + (Number(j.expires_in) || 600) * 1e3
-  };
-}
-async function pollDeviceLogin(apiUrl, deviceCode) {
+function deleteLocalEntry(at, tool, session) {
   try {
-    const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+    const lines = readFileSync2(LOCAL_LOG, "utf-8").split("\n");
+    let removed = 0;
+    const kept = lines.filter((line) => {
+      if (!line.trim()) return false;
+      if (removed) return true;
+      try {
+        const j = JSON.parse(line);
+        const hit = Date.parse(j.ts ?? "") === at && (j.tool ?? "?") === tool && (!session || j.session_id === session);
+        if (hit) {
+          removed++;
+          return false;
+        }
+      } catch {
+      }
+      return true;
     });
-    const j = await res.json().catch(() => ({}));
-    if (j.status === "approved" && j.api_key) {
-      return { status: "approved", apiKey: j.api_key, project: j.project?.name, user: j.user?.name || j.user?.email, email: j.user?.email };
-    }
-    if (j.status === "expired" || j.status === "not_found") return { status: j.status };
-    return { status: "pending" };
+    if (removed) writeFileSync(LOCAL_LOG, kept.length ? kept.join("\n") + "\n" : "");
+    return removed;
   } catch {
-    return { status: "pending" };
+    return 0;
   }
 }
-
-// src/api-client/auth.ts
-var auth_exports = {};
-__export(auth_exports, {
-  me: () => me
-});
-function me() {
-  return request("GET", "/auth/me");
-}
-
-// src/api-client/policies.ts
-var policies_exports = {};
-__export(policies_exports, {
-  active: () => active,
-  addRule: () => addRule,
-  backtest: () => backtest,
-  create: () => create,
-  dryRun: () => dryRun,
-  get: () => get,
-  list: () => list,
-  remove: () => remove,
-  revokeRule: () => revokeRule,
-  rollback: () => rollback,
-  setActive: () => setActive,
-  update: () => update,
-  versions: () => versions
-});
-function list() {
-  return request("GET", "/policies");
-}
-function get(id, version) {
-  return request("GET", `/policies/${encodeURIComponent(id)}`, {
-    query: version !== void 0 ? { version } : void 0
-  });
-}
-function create(policy) {
-  return request("POST", "/policies", { body: policy });
+function clearLocalLog() {
+  try {
+    const n = readFileSync2(LOCAL_LOG, "utf-8").split("\n").filter(Boolean).length;
+    writeFileSync(LOCAL_LOG, "");
+    return n;
+  } catch {
+    return 0;
+  }
 }
-function update(id, policy) {
-  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+var DLP_REASON = /security layer \(dlp\)/i;
+var RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
+function reasonSignals(reason) {
+  const r = reason || "";
+  const dlp = [];
+  if (DLP_REASON.test(r)) {
+    const m = r.match(/contain(?:s)? (?:a |an )?(.+?)(?:\.|$)/i);
+    dlp.push(m ? m[1].trim() : "DLP");
+  }
+  return { dlp, burst: RL_REASON.test(r) };
 }
-function remove(id) {
-  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
-}
-function addRule(id, spec) {
-  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
-}
-function revokeRule(id, ruleId) {
-  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
-}
-function versions(id, opts = {}) {
-  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
-}
-function rollback(id, version) {
-  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
-}
-function active(agentId) {
-  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
-}
-function setActive(policyId) {
-  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
-}
-function dryRun(body) {
-  return request("POST", "/policies/dry-run", { body });
-}
-function backtest(body) {
-  return request("POST", "/policies/backtest", { body });
+function parseLocalLines(lines) {
+  const out = [];
+  for (const line of lines) {
+    try {
+      const j = JSON.parse(line);
+      const at = Date.parse(j.ts ?? "");
+      if (Number.isFinite(at)) out.push({ ...j, at });
+    } catch {
+    }
+  }
+  return out;
 }
 
-// src/api-client/settings.ts
-var settings_exports = {};
-__export(settings_exports, {
-  clearRateLimitHistory: () => clearRateLimitHistory,
-  createAlert: () => createAlert,
-  createWebhook: () => createWebhook,
-  deleteAlert: () => deleteAlert,
-  deleteWebhook: () => deleteWebhook,
-  getAlerts: () => getAlerts,
-  getGuardStatus: () => getGuardStatus,
-  getLocalLogs: () => getLocalLogs,
-  getRateLimitHistory: () => getRateLimitHistory,
-  getSecurityLayers: () => getSecurityLayers,
-  getSelfProtection: () => getSelfProtection,
-  getWebhooks: () => getWebhooks,
-  sendTestWebhook: () => sendTestWebhook,
-  setAlertEnabled: () => setAlertEnabled,
-  setLocalLogs: () => setLocalLogs,
-  setSecurityLayers: () => setSecurityLayers,
-  setSelfProtection: () => setSelfProtection,
-  updateAlert: () => updateAlert,
-  updateWebhook: () => updateWebhook
-});
-function getSecurityLayers() {
-  return request("GET", "/settings/security-layers");
-}
-function setSecurityLayers(layers) {
-  return request("PUT", "/settings/security-layers", { body: { layers } });
-}
-function getRateLimitHistory() {
-  return request("GET", "/settings/rate-limit-history");
-}
-function clearRateLimitHistory() {
-  return request("DELETE", "/settings/rate-limit-history", { query: { all: 1 } });
-}
-function getGuardStatus() {
-  return request("GET", "/settings/guard-status");
-}
-function getSelfProtection() {
-  return request("GET", "/settings/self-protection");
-}
-function setSelfProtection(enabled) {
-  return request("PUT", "/settings/self-protection", { body: { enabled } });
-}
-function getLocalLogs() {
-  return request("GET", "/settings/local-logs");
-}
-function setLocalLogs(cfg) {
-  return request("PUT", "/settings/local-logs", { body: cfg });
+// src/tui/panels/Live.tsx
+import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
+
+// src/api-client/client.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync, existsSync } from "fs";
+import { resolve, join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+var DEFAULT_API_URL = "https://api.solongate.com";
+var accountsFile = () => join3(homedir3(), ".solongate", "accounts.json");
+function listAccounts() {
+  let list5 = [];
+  try {
+    const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
+    if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
+  } catch {
+  }
+  const active2 = loginCredentialFile();
+  if (active2.apiKey && !list5.some((a) => a.apiKey === active2.apiKey)) {
+    list5.unshift({ apiKey: active2.apiKey, apiUrl: active2.apiUrl || DEFAULT_API_URL });
+  }
+  return list5;
 }
-function getAlerts() {
-  return request("GET", "/settings/denial-alerts");
+function saveAccount(acc) {
+  try {
+    const list5 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    const next = list5.filter((a) => a.apiKey !== acc.apiKey);
+    next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
+    mkdirSync(join3(homedir3(), ".solongate"), { recursive: true });
+    writeFileSync2(accountsFile(), JSON.stringify(next, null, 2));
+  } catch {
+  }
 }
-function createAlert(body) {
-  return request("POST", "/settings/denial-alerts", { body });
+function removeAccount(apiKey) {
+  try {
+    const list5 = (() => {
+      try {
+        const raw = JSON.parse(readFileSync3(accountsFile(), "utf-8"));
+        return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
+      } catch {
+        return [];
+      }
+    })();
+    writeFileSync2(accountsFile(), JSON.stringify(list5.filter((a) => a.apiKey !== apiKey), null, 2));
+  } catch {
+  }
 }
-function deleteAlert(id) {
-  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+var viewOverride = null;
+function setViewCredentials(creds) {
+  viewOverride = creds;
+  cached2 = null;
 }
-function setAlertEnabled(id, enabled) {
-  return request("PATCH", "/settings/denial-alerts", { query: { id }, body: { enabled } });
+function isActiveAccount(apiKey) {
+  return loginCredentialFile().apiKey === apiKey;
 }
-function updateAlert(id, patch) {
-  return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
+function setActiveAccount(creds) {
+  try {
+    const dir = join3(homedir3(), ".solongate");
+    mkdirSync(dir, { recursive: true });
+    const p = join3(dir, ["cloud", "guard.json"].join("-"));
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync3(p, "utf-8"));
+    } catch {
+    }
+    writeFileSync2(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2));
+    cached2 = null;
+    return true;
+  } catch {
+    return false;
+  }
 }
-function getWebhooks() {
-  return request("GET", "/settings/denial-webhook");
+function clearActiveCredential() {
+  try {
+    const p = join3(homedir3(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync(p)) {
+      cached2 = null;
+      return true;
+    }
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync3(p, "utf-8"));
+    } catch {
+    }
+    delete existing.apiKey;
+    delete existing.apiUrl;
+    writeFileSync2(p, JSON.stringify(existing, null, 2));
+    cached2 = null;
+    viewOverride = null;
+    return true;
+  } catch {
+    return false;
+  }
 }
-function createWebhook(body) {
-  return request("POST", "/settings/denial-webhook", { body });
+var ApiError = class extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor() {
+    super("Not logged in. Run `solongate` and log in from the Accounts panel.");
+    this.name = "NotAuthenticatedError";
+  }
+};
+function loginCredentialFile() {
+  try {
+    const p = join3(homedir3(), ".solongate", "cloud-guard.json");
+    if (!existsSync(p)) return {};
+    const c2 = JSON.parse(readFileSync3(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
+  } catch {
+    return {};
+  }
 }
-function deleteWebhook(id) {
-  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+function dotenvApiKey() {
+  try {
+    const envPath = resolve(".env");
+    if (!existsSync(envPath)) return void 0;
+    for (const line of readFileSync3(envPath, "utf-8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (key !== "SOLONGATE_API_KEY") continue;
+      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  return void 0;
 }
-function sendTestWebhook(id) {
-  return request("POST", "/settings/denial-webhook/send-test", { body: { id } });
+var cached2 = null;
+function resolveCredentials(apiUrlOverride) {
+  if (viewOverride && !apiUrlOverride) return viewOverride;
+  if (cached2 && !apiUrlOverride) return cached2;
+  const file = loginCredentialFile();
+  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
+  if (!apiKey) throw new NotAuthenticatedError();
+  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL;
+  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
+  if (!apiUrlOverride) cached2 = creds;
+  return creds;
 }
-function updateWebhook(id, patch) {
-  return request("PATCH", "/settings/denial-webhook", { body: { id, ...patch } });
+function buildUrl(base, path, query) {
+  const url = new URL(`${base}/api/v1${path}`);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v === void 0) continue;
+      url.searchParams.set(k, String(v));
+    }
+  }
+  return url.toString();
 }
-
-// src/api-client/stats.ts
-var stats_exports = {};
-__export(stats_exports, {
-  drift: () => drift,
-  get: () => get2,
-  securityInsights: () => securityInsights,
-  timeseries: () => timeseries
-});
+async function request(method, path, opts = {}) {
+  const creds = resolveCredentials(opts.apiUrl);
+  const url = buildUrl(creds.apiUrl, path, opts.query);
+  const headers = {
+    Authorization: `Bearer ${creds.apiKey}`
+  };
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  const attempt = () => fetch(url, {
+    method,
+    headers: { ...headers, Connection: "close" },
+    body: bodyInit,
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+  });
+  const maxTries = method === "GET" ? 3 : 1;
+  let res;
+  let lastErr;
+  for (let i = 0; i < maxTries; i++) {
+    try {
+      res = await attempt();
+      break;
+    } catch (err) {
+      lastErr = err;
+      if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
+    }
+  }
+  if (!res) {
+    const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
+    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
+  }
+  const text = await res.text().catch(() => "");
+  let json = void 0;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const envelope = json?.error;
+    if (envelope && typeof envelope === "object") {
+      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
+    }
+    if (typeof envelope === "string") {
+      throw new ApiError(res.status, "ERROR", envelope);
+    }
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate` and log in from the Accounts panel.");
+    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
+    if (res.status >= 500) throw new ApiError(res.status, "SERVER_ERROR", text || "SolonGate API had a problem (server error). Please try again in a moment.");
+    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
+  }
+  return json;
+}
+
+// src/api-client/device-login.ts
+import { spawn } from "child_process";
+function openBrowser(url) {
+  try {
+    const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", '""', url] : [url];
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function startDeviceLogin(apiUrl = DEFAULT_API_URL) {
+  const res = await fetch(`${apiUrl}/api/v1/auth/device/start`, { method: "POST" });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const j = await res.json();
+  return {
+    deviceCode: j.device_code,
+    verifyUrl: j.verification_uri_complete || j.verification_uri || "",
+    intervalMs: Math.max(2, Number(j.interval) || 3) * 1e3,
+    expiresAt: Date.now() + (Number(j.expires_in) || 600) * 1e3
+  };
+}
+async function pollDeviceLogin(apiUrl, deviceCode) {
+  try {
+    const res = await fetch(`${apiUrl}/api/v1/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const j = await res.json().catch(() => ({}));
+    if (j.status === "approved" && j.api_key) {
+      return { status: "approved", apiKey: j.api_key, project: j.project?.name, user: j.user?.name || j.user?.email, email: j.user?.email };
+    }
+    if (j.status === "expired" || j.status === "not_found") return { status: j.status };
+    return { status: "pending" };
+  } catch {
+    return { status: "pending" };
+  }
+}
+
+// src/api-client/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  me: () => me
+});
+function me() {
+  return request("GET", "/auth/me");
+}
+
+// src/api-client/policies.ts
+var policies_exports = {};
+__export(policies_exports, {
+  active: () => active,
+  addRule: () => addRule,
+  backtest: () => backtest,
+  create: () => create,
+  dryRun: () => dryRun,
+  get: () => get,
+  list: () => list,
+  remove: () => remove,
+  revokeRule: () => revokeRule,
+  rollback: () => rollback,
+  setActive: () => setActive,
+  update: () => update,
+  versions: () => versions
+});
+function list() {
+  return request("GET", "/policies");
+}
+function get(id, version) {
+  return request("GET", `/policies/${encodeURIComponent(id)}`, {
+    query: version !== void 0 ? { version } : void 0
+  });
+}
+function create(policy) {
+  return request("POST", "/policies", { body: policy });
+}
+function update(id, policy) {
+  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+}
+function remove(id) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
+}
+function addRule(id, spec) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
+}
+function revokeRule(id, ruleId) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
+}
+function versions(id, opts = {}) {
+  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
+}
+function rollback(id, version) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
+}
+function active(agentId) {
+  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
+}
+function setActive(policyId) {
+  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
+}
+function dryRun(body) {
+  return request("POST", "/policies/dry-run", { body });
+}
+function backtest(body) {
+  return request("POST", "/policies/backtest", { body });
+}
+
+// src/api-client/settings.ts
+var settings_exports = {};
+__export(settings_exports, {
+  clearRateLimitHistory: () => clearRateLimitHistory,
+  createAlert: () => createAlert,
+  createWebhook: () => createWebhook,
+  deleteAlert: () => deleteAlert,
+  deleteWebhook: () => deleteWebhook,
+  getAlerts: () => getAlerts,
+  getGuardStatus: () => getGuardStatus,
+  getLocalLogs: () => getLocalLogs,
+  getRateLimitHistory: () => getRateLimitHistory,
+  getSecurityLayers: () => getSecurityLayers,
+  getSelfProtection: () => getSelfProtection,
+  getWebhooks: () => getWebhooks,
+  sendTestWebhook: () => sendTestWebhook,
+  setAlertEnabled: () => setAlertEnabled,
+  setLocalLogs: () => setLocalLogs,
+  setSecurityLayers: () => setSecurityLayers,
+  setSelfProtection: () => setSelfProtection,
+  updateAlert: () => updateAlert,
+  updateWebhook: () => updateWebhook
+});
+function getSecurityLayers() {
+  return request("GET", "/settings/security-layers");
+}
+function setSecurityLayers(layers) {
+  return request("PUT", "/settings/security-layers", { body: { layers } });
+}
+function getRateLimitHistory() {
+  return request("GET", "/settings/rate-limit-history");
+}
+function clearRateLimitHistory() {
+  return request("DELETE", "/settings/rate-limit-history", { query: { all: 1 } });
+}
+function getGuardStatus() {
+  return request("GET", "/settings/guard-status");
+}
+function getSelfProtection() {
+  return request("GET", "/settings/self-protection");
+}
+function setSelfProtection(enabled) {
+  return request("PUT", "/settings/self-protection", { body: { enabled } });
+}
+function getLocalLogs() {
+  return request("GET", "/settings/local-logs");
+}
+function setLocalLogs(cfg) {
+  return request("PUT", "/settings/local-logs", { body: cfg });
+}
+function getAlerts() {
+  return request("GET", "/settings/denial-alerts");
+}
+function createAlert(body) {
+  return request("POST", "/settings/denial-alerts", { body });
+}
+function deleteAlert(id) {
+  return request("DELETE", "/settings/denial-alerts", { query: { id } });
+}
+function setAlertEnabled(id, enabled) {
+  return request("PATCH", "/settings/denial-alerts", { query: { id }, body: { enabled } });
+}
+function updateAlert(id, patch) {
+  return request("PATCH", "/settings/denial-alerts", { query: { id }, body: patch });
+}
+function getWebhooks() {
+  return request("GET", "/settings/denial-webhook");
+}
+function createWebhook(body) {
+  return request("POST", "/settings/denial-webhook", { body });
+}
+function deleteWebhook(id) {
+  return request("DELETE", "/settings/denial-webhook", { query: { id } });
+}
+function sendTestWebhook(id) {
+  return request("POST", "/settings/denial-webhook/send-test", { body: { id } });
+}
+function updateWebhook(id, patch) {
+  return request("PATCH", "/settings/denial-webhook", { body: { id, ...patch } });
+}
+
+// src/api-client/stats.ts
+var stats_exports = {};
+__export(stats_exports, {
+  drift: () => drift,
+  get: () => get2,
+  securityInsights: () => securityInsights,
+  timeseries: () => timeseries
+});
 function get2() {
   return request("GET", "/stats");
 }
@@ -3428,306 +3738,7 @@ function AuditPanel({ active: active2, focused }) {
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
 import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
-
-// src/global-install.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync2, mkdirSync as mkdirSync4, rmSync } from "fs";
-import { resolve as resolve2, join as join6, dirname } from "path";
-import { homedir as homedir6 } from "os";
-import { fileURLToPath } from "url";
-import { createInterface } from "readline";
-import { execFileSync } from "child_process";
-var __dirname = dirname(fileURLToPath(import.meta.url));
-var HOOKS_DIR = resolve2(__dirname, "..", "hooks");
-function lockFile(file) {
-  if (!existsSync2(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE)"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function unlockFile(file) {
-  if (!existsSync2(file)) return;
-  try {
-    if (process.platform === "win32") {
-      try {
-        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
-      } catch {
-      }
-      try {
-        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else if (process.platform === "darwin") {
-      try {
-        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
-      } catch {
-      }
-    } else {
-      try {
-        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-function protectedTargets() {
-  const p = globalPaths();
-  return [
-    join6(p.hooksDir, "guard.mjs"),
-    join6(p.hooksDir, "audit.mjs"),
-    join6(p.hooksDir, "stop.mjs"),
-    join6(p.hooksDir, "shield.mjs"),
-    p.configPath,
-    p.settingsPath,
-    p.antigravityHooksPath
-  ];
-}
-function lockProtected() {
-  for (const f of protectedTargets()) lockFile(f);
-}
-function unlockProtected() {
-  for (const f of protectedTargets()) unlockFile(f);
-}
-function globalPaths() {
-  const home = homedir6();
-  const sgDir = join6(home, ".solongate");
-  const hooksDir = join6(sgDir, "hooks");
-  const claudeDir = join6(home, ".claude");
-  const antigravityDir = join6(home, ".gemini", "config");
-  return {
-    home,
-    sgDir,
-    hooksDir,
-    claudeDir,
-    antigravityDir,
-    settingsPath: join6(claudeDir, "settings.json"),
-    backupPath: join6(claudeDir, "settings.solongate.bak"),
-    configPath: join6(sgDir, "cloud-guard.json"),
-    // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
-    // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
-    // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join6(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join6(antigravityDir, "hooks.solongate.bak")
-  };
-}
-function readHook(filename) {
-  return readFileSync4(join6(HOOKS_DIR, filename), "utf-8");
-}
-function firstAccountCredential() {
-  try {
-    const raw = JSON.parse(readFileSync4(join6(homedir6(), ".solongate", "accounts.json"), "utf-8"));
-    if (Array.isArray(raw)) {
-      const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
-      if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
-    }
-  } catch {
-  }
-  return {};
-}
-function readGuard() {
-  const bundled = join6(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync2(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
-}
-var ANTIGRAVITY_GROUP = "solongate-guard";
-function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
-}
-function installAntigravityGuard(p, guardAbs) {
-  mkdirSync4(p.antigravityDir, { recursive: true });
-  let existing = {};
-  if (existsSync2(p.antigravityHooksPath)) {
-    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
-    if (!existsSync2(p.antigravityBackupPath)) writeFileSync5(p.antigravityBackupPath, raw);
-    try {
-      existing = JSON.parse(raw);
-    } catch {
-      existing = {};
-    }
-  }
-  const merged = {
-    ...existing,
-    [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
-    }
-  };
-  writeFileSync5(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
-}
-function removeAntigravityGuard(p) {
-  if (!existsSync2(p.antigravityHooksPath)) return;
-  try {
-    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
-    if (!(ANTIGRAVITY_GROUP in s)) return;
-    delete s[ANTIGRAVITY_GROUP];
-    writeFileSync5(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
-  } catch {
-  }
-}
-function installGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    let apiKey = process.env["SOLONGATE_API_KEY"] || "";
-    let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
-    try {
-      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
-      if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
-      if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
-    } catch {
-    }
-    if (!apiKey) {
-      const acc = firstAccountCredential();
-      if (acc.apiKey) {
-        apiKey = acc.apiKey;
-        if (acc.apiUrl) apiUrl = acc.apiUrl;
-      }
-    }
-    if (!apiKey) return { ok: false, message: "no login on this device \u2014 add an account first (Accounts \u2192 + add)" };
-    mkdirSync4(p.hooksDir, { recursive: true });
-    mkdirSync4(p.claudeDir, { recursive: true });
-    unlockProtected();
-    writeFileSync5(join6(p.hooksDir, "guard.mjs"), readGuard());
-    writeFileSync5(join6(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-    writeFileSync5(join6(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-    writeFileSync5(join6(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-    writeFileSync5(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
-    let existing = {};
-    if (existsSync2(p.settingsPath)) {
-      const raw = readFileSync4(p.settingsPath, "utf-8");
-      if (!existsSync2(p.backupPath)) writeFileSync5(p.backupPath, raw);
-      try {
-        existing = JSON.parse(raw);
-      } catch {
-        existing = {};
-      }
-    }
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const call = process.platform === "win32" ? "& " : "";
-    const hookCmd = (script) => `${call}"${nodeBin}" "${join6(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
-    const merged = {
-      ...existing,
-      hooks: {
-        PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
-        PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
-        Stop: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] }]
-      }
-    };
-    writeFileSync5(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
-    try {
-      installAntigravityGuard(p, join6(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
-    } catch {
-    }
-    if (process.env["SOLONGATE_OS_LOCK"] === "1") lockProtected();
-    return { ok: true, message: "guard installed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-function installedGuardVersion() {
-  try {
-    const p = globalPaths();
-    const s = readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8");
-    const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
-    return m ? parseInt(m[1], 10) : null;
-  } catch {
-    return null;
-  }
-}
-function guardHookOutdated() {
-  try {
-    const p = globalPaths();
-    return readFileSync4(join6(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
-  } catch {
-    return false;
-  }
-}
-function isGuardInstalled() {
-  try {
-    const p = globalPaths();
-    if (!existsSync2(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
-    return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
-  } catch {
-    return false;
-  }
-}
-function uninstallGlobalQuiet() {
-  try {
-    const p = globalPaths();
-    unlockProtected();
-    removeClaudeShim();
-    try {
-      removeAntigravityGuard(p);
-    } catch {
-    }
-    if (!existsSync2(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
-    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
-    delete s.hooks;
-    writeFileSync5(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
-    return { ok: true, message: "guard removed (open a new session)" };
-  } catch (e) {
-    return { ok: false, message: e instanceof Error ? e.message : String(e) };
-  }
-}
-var SHIM_BEGIN = "# >>> SolonGate shield (auto secret redaction) >>>";
-var SHIM_END = "# <<< SolonGate shield <<<";
-function escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function shimTargets() {
-  if (process.platform === "win32") {
-    try {
-      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
-      return prof ? [prof] : [];
-    } catch {
-      return [];
-    }
-  }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join6(homedir6(), f)).filter((f) => existsSync2(f));
-}
-function writeShimBlock(file, block2) {
-  const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync2(file) ? readFileSync4(file, "utf-8") : "";
-  content = content.replace(re, "");
-  if (block2) {
-    if (content.length && !content.endsWith("\n")) content += "\n";
-    content += block2 + "\n";
-  }
-  mkdirSync4(dirname(file), { recursive: true });
-  writeFileSync5(file, content);
-}
-function removeClaudeShim() {
-  for (const file of shimTargets()) {
-    try {
-      writeShimBlock(file, null);
-    } catch {
-    }
-  }
-}
+init_global_install();
 
 // src/logs-server-daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -3781,7 +3792,10 @@ function startLogsServerDaemon() {
     const p = spawn3(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log, log],
-      windowsHide: true
+      windowsHide: true,
+      // Spawned by US, not by an agent: exempt from the human-only TTY gate
+      // (a detached daemon has no terminal by definition).
+      env: { ...process.env, SOLONGATE_INTERNAL: "1" }
     });
     p.on("error", () => {
     });