@solongate/proxy 0.82.82 → 0.82.84

package/dist/index.js

@@ -6203,6 +6203,7 @@ __export(global_install_exports, {
   isGuardInstalled: () => isGuardInstalled,
   lockProtected: () => lockProtected,
   removeClaudeShim: () => removeClaudeShim,
+  repairQuiet: () => repairQuiet,
   runGlobalInstall: () => runGlobalInstall,
   runGlobalRestore: () => runGlobalRestore,
   runRepair: () => runRepair,
@@ -6579,44 +6580,57 @@ function runGlobalRestore() {
   }
   console.log("  Global SolonGate enforcement uninstalled. Restart Claude Code.");
 }
-async function runRepair() {
+function repairQuiet() {
   const p = globalPaths();
-  const out2 = (s) => void process.stderr.write(s + "\n");
   const has = (f) => existsSync3(f);
   const guardFile = join4(p.hooksDir, "guard.mjs");
+  const line = (label, ok, yes, no) => ({ label, ok, detail: ok ? yes : no });
+  const before = [
+    line("guard hook file", has(guardFile), "present", "MISSING"),
+    line("cloud credential", has(p.configPath), "present", "MISSING"),
+    line("Claude Code settings", isGuardInstalled(), "guard registered", "guard NOT registered"),
+    line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered")
+  ];
+  const r = installGlobalQuiet();
+  if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
+  const after = [
+    { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
+    line("Claude Code settings", isGuardInstalled(), "guard registered", "NOT registered"),
+    line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered")
+  ];
+  const notes = [];
+  const cx = codexHooksStatus();
+  if (cx.registered && !cx.trusted) {
+    notes.push("Codex only: run `/hooks` inside Codex once and trust the SolonGate hooks (Codex skips any hook it has not been told to trust).");
+  }
+  if (cx.disabled) {
+    notes.push("Codex only: hooks are turned OFF in ~/.codex/config.toml ([features] hooks = false) - the guard cannot run there until that line is removed.");
+  }
+  return { ok: true, message: "guard repaired. Open a new AI session for it to take effect.", before, after, notes };
+}
+async function runRepair() {
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const rep = repairQuiet();
   out2("");
   out2("  SolonGate repair");
   out2("");
   out2("  before:");
-  out2(`    guard hook file      ${has(guardFile) ? "present" : "MISSING"}`);
-  out2(`    cloud credential     ${has(p.configPath) ? "present" : "MISSING"}`);
-  out2(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "guard NOT registered"}`);
-  out2(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
-  out2(`    Codex hooks          ${isCodexGuardInstalled() ? "guard registered" : "guard NOT registered"}`);
+  for (const l of rep.before) out2(`    ${l.label.padEnd(20)} ${l.detail}`);
   out2("");
-  const r = installGlobalQuiet();
-  if (!r.ok) {
-    out2(`  \u2717 ${r.message}`);
+  if (!rep.ok) {
+    out2(`  \u2717 ${rep.message}`);
     return 1;
   }
   out2("  restored:");
-  out2(`    guard hook file      present (v${installedGuardVersion() ?? "?"})`);
-  out2(`    Claude Code settings ${isGuardInstalled() ? "guard registered" : "NOT registered"}`);
-  out2(`    Antigravity hooks    ${has(p.antigravityHooksPath) ? "present" : "MISSING"}`);
-  out2(`    Codex hooks          ${isCodexGuardInstalled() ? "guard registered" : "NOT registered"}`);
+  for (const l of rep.after) out2(`    ${l.label.padEnd(20)} ${l.detail}`);
   out2("");
-  const cx = codexHooksStatus();
-  if (cx.registered && !cx.trusted) {
-    out2("  Codex only: run `/hooks` inside Codex once and trust the SolonGate hooks");
-    out2("  (Codex skips any hook it has not been told to trust).");
+  for (const n of rep.notes) {
+    out2(`  ${n}`);
     out2("");
   }
-  if (cx.disabled) {
-    out2("  Codex only: hooks are turned OFF in ~/.codex/config.toml ([features] hooks = false)");
-    out2("  \u2014 the guard cannot run there until that line is removed.");
-    out2("");
-  }
-  out2("  \u2713 guard repaired. Open a new AI session for it to take effect.");
+  out2(`  \u2713 ${rep.message}`);
   out2("");
   return 0;
 }
@@ -11095,6 +11109,220 @@ var init_Audit = __esm({
   }
 });
 
+// src/commands/format.ts
+function printJson(value) {
+  out(JSON.stringify(value, null, 2));
+}
+function usage(title, tagline, rows, footer = "Add --json for machine-readable output.") {
+  const W = 40;
+  const lines = ["", `  ${c.bold}${c.blue4}${title}${c.reset}  ${c.dim}${tagline}${c.reset}`, ""];
+  for (const [syntax, desc] of rows) {
+    if (!syntax) {
+      lines.push("");
+      continue;
+    }
+    if (desc === void 0) {
+      lines.push(`    ${c.cyan}${syntax}${c.reset}`);
+      continue;
+    }
+    if (syntax.length <= W) {
+      lines.push(`    ${c.cyan}${syntax}${c.reset}${" ".repeat(W - syntax.length)}${c.dim}${desc}${c.reset}`);
+    } else {
+      lines.push(`    ${c.cyan}${syntax}${c.reset}`);
+      lines.push(`    ${" ".repeat(W)}${c.dim}${desc}${c.reset}`);
+    }
+  }
+  if (footer) lines.push("", `  ${c.dim}${footer}${c.reset}`);
+  return lines.join("\n");
+}
+function decisionColor2(decision) {
+  const d = decision.toUpperCase();
+  if (d === "ALLOW") return green(d);
+  if (d === "DENY" || d === "DENIED") return red(d);
+  return dim(d);
+}
+function table(headers, rows) {
+  const cols = headers.length;
+  const w = new Array(cols).fill(0);
+  for (let i = 0; i < cols; i++) w[i] = width(headers[i] ?? "");
+  for (const row of rows) {
+    for (let i = 0; i < cols; i++) w[i] = Math.max(w[i], width(row[i] ?? ""));
+  }
+  const pad = (s, i) => s + " ".repeat(Math.max(0, w[i] - width(s)));
+  err("  " + headers.map((h, i) => dim(pad(h, i))).join("  "));
+  for (const row of rows) {
+    err("  " + row.map((cell, i) => pad(cell ?? "", i)).join("  "));
+  }
+}
+function truncate3(s, n) {
+  if (s.length <= n) return s;
+  return s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+function sparkline(values) {
+  if (values.length === 0) return "";
+  const max = Math.max(...values, 0);
+  if (max === 0) return BLOCKS[0].repeat(values.length);
+  return values.map((v) => BLOCKS[Math.min(BLOCKS.length - 1, Math.round(v / max * (BLOCKS.length - 1)))]).join("");
+}
+var out, err, dim, bold, green, red, yellow, cyan, ANSI, width, BLOCKS;
+var init_format = __esm({
+  "src/commands/format.ts"() {
+    "use strict";
+    init_cli_utils();
+    out = (s = "") => void process.stdout.write(s + "\n");
+    err = (s = "") => void process.stderr.write(s + "\n");
+    dim = (s) => `${c.dim}${s}${c.reset}`;
+    bold = (s) => `${c.bold}${s}${c.reset}`;
+    green = (s) => `${c.green}${s}${c.reset}`;
+    red = (s) => `${c.red}${s}${c.reset}`;
+    yellow = (s) => `${c.yellow}${s}${c.reset}`;
+    cyan = (s) => `${c.cyan}${s}${c.reset}`;
+    ANSI = /\x1b\[[0-9;]*m/g;
+    width = (s) => s.replace(ANSI, "").length;
+    BLOCKS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
+  }
+});
+
+// src/commands/args.ts
+function parse(argv) {
+  const positionals = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith("--")) {
+      const body = tok.slice(2);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        flags[body] = next;
+        i++;
+      } else {
+        flags[body] = true;
+      }
+    } else {
+      positionals.push(tok);
+    }
+  }
+  return { positionals, flags };
+}
+function flagStr(flags, name) {
+  const v = flags[name];
+  return typeof v === "string" ? v : void 0;
+}
+function flagNum(flags, name) {
+  const v = flagStr(flags, name);
+  if (v === void 0) return void 0;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function flagBool(flags, name) {
+  return flags[name] === true || flags[name] === "true";
+}
+var init_args = __esm({
+  "src/commands/args.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/doctor.ts
+import { existsSync as existsSync6, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join12 } from "path";
+async function collectChecks() {
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in - run `solongate`, add your account in the Accounts panel" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves - every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 update from \`solongate\` \u2192 Settings \u2192 guard` });
+    } catch {
+    }
+  }
+  if (codexDetected()) {
+    const cx = codexHooksStatus();
+    if (!cx.registered) {
+      checks.push({ name: "codex hooks", ok: false, detail: "guard not registered - run `solongate repair`" });
+    } else if (cx.disabled) {
+      checks.push({ name: "codex hooks", ok: false, detail: "hooks disabled in ~/.codex/config.toml ([features] hooks = false)" });
+    } else if (!cx.trusted) {
+      checks.push({ name: "codex hooks", ok: "warn", detail: "registered - run `/hooks` in Codex once and trust them (Codex skips untrusted hooks)" });
+    } else {
+      checks.push({ name: "codex hooks", ok: true, detail: "registered + trusted" });
+    }
+  }
+  try {
+    const raw = readFileSync10(join12(homedir10(), ".solongate", ".key-rejected.json"), "utf-8");
+    const m = JSON.parse(raw);
+    const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
+    checks.push({
+      name: "hook credential",
+      ok: false,
+      detail: `rejected by ${m.apiUrl ?? "the API"}${ageMin != null ? ` ${ageMin}m ago` : ""} \xB7 key from ${m.keySource ?? "?"}${m.cwd ? ` (agent cwd ${m.cwd})` : ""} - nothing is being logged from there`
+    });
+  } catch {
+  }
+  const LOCAL_LOG2 = localLogFile();
+  if (existsSync6(LOCAL_LOG2)) {
+    const st = statSync2(LOCAL_LOG2);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) - enable in dashboard \u2192 Settings" });
+  }
+  return checks;
+}
+async function run(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const checks = await collectChecks();
+  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
+  err("");
+  err(`  ${bold("SolonGate doctor")}`);
+  err("");
+  for (const c2 of checks) {
+    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
+    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
+  }
+  err("");
+  const bad = checks.filter((c2) => c2.ok === false).length;
+  const warn = checks.filter((c2) => c2.ok === "warn").length;
+  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
+  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("- guard is working")}`);
+  else err(`  ${green("all good")}`);
+  return bad ? 1 : 0;
+}
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    init_api_client();
+    init_global_install();
+    init_local_log();
+    init_format();
+    init_args();
+  }
+});
+
 // src/tui/panels/Settings.tsx
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
@@ -11117,6 +11345,24 @@ function SettingsPanel({
   const [busy, setBusy] = useState8(false);
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
+  const [diagBusy, setDiagBusy] = useState8(null);
+  const [diag, setDiag] = useState8(null);
+  const [diagStep, setDiagStep] = useState8(0);
+  const DIAG_STEPS = {
+    doctor: ["login", "active policy", "guard hook", "agent hooks", "local logs"],
+    repair: ["inspecting protection files", "rewriting hook files", "registering with agents", "re-locking"]
+  };
+  const settle = async (started, of) => {
+    const min = DIAG_STEPS[of].length * 220 + 160;
+    const left = min - (Date.now() - started);
+    if (left > 0) await new Promise((res) => setTimeout(res, left));
+  };
+  useEffect7(() => {
+    if (!diagBusy) return;
+    const total = DIAG_STEPS[diagBusy].length;
+    const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
+    return () => clearInterval(step);
+  }, [diagBusy]);
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -11155,10 +11401,11 @@ function SettingsPanel({
     return () => clearInterval(t);
   }, []);
   useEffect7(() => {
-    if (!login || login.phase === "done" || login.phase === "error") return;
+    const loggingIn = login && login.phase !== "done" && login.phase !== "error";
+    if (!loggingIn && !diagBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login]);
+  }, [login, diagBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -11190,6 +11437,8 @@ function SettingsPanel({
     ...locked ? [] : [
       { kind: "guard" },
       { kind: "self" },
+      { kind: "doctor" },
+      { kind: "repair" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -11308,6 +11557,64 @@ function SettingsPanel({
       setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
       refreshGuard();
       guardQ.reload();
+    } else if (r.kind === "doctor") {
+      if (diagBusy) return;
+      setDiagBusy("doctor");
+      setDiagStep(0);
+      setDiag(null);
+      void (async () => {
+        const started = Date.now();
+        try {
+          const checks = await collectChecks();
+          await settle(started, "doctor");
+          const bad = checks.filter((c2) => c2.ok === false).length;
+          const warn = checks.filter((c2) => c2.ok === "warn").length;
+          setDiag({
+            of: "doctor",
+            lines: checks.map((c2) => ({
+              text: `${c2.ok === true ? "\u2713" : c2.ok === "warn" ? "!" : "\u2717"} ${c2.name.padEnd(16)} ${c2.detail}`,
+              level: c2.ok === true ? "ok" : c2.ok === "warn" ? "warn" : "bad"
+            }))
+          });
+          setMsg(
+            bad ? { text: `\u2717 ${bad} problem(s)${warn ? ` \xB7 ${warn} warning(s)` : ""}`, level: "bad" } : { text: warn ? `\u2713 guard is working \xB7 ${warn} warning(s)` : "\u2713 all good", level: "ok" }
+          );
+        } catch (e) {
+          setMsg({ text: "\u2717 doctor failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" });
+        } finally {
+          setDiagBusy(null);
+        }
+      })();
+    } else if (r.kind === "repair") {
+      if (diagBusy) return;
+      setDiagBusy("repair");
+      setDiagStep(0);
+      setDiag(null);
+      void (async () => {
+        try {
+          const started = Date.now();
+          await new Promise((res) => setTimeout(res, 60));
+          const rep = repairQuiet();
+          await settle(started, "repair");
+          setDiag({
+            of: "repair",
+            lines: [
+              ...(rep.ok ? rep.after : rep.before).map((l) => ({
+                text: `${l.ok ? "\u2713" : "\u2717"} ${l.label.padEnd(20)} ${l.detail}`,
+                level: l.ok ? "ok" : "bad"
+              })),
+              ...rep.notes.map((n) => ({ text: n, level: "warn" }))
+            ]
+          });
+          setMsg({ text: (rep.ok ? "\u2713 " : "\u2717 ") + rep.message, level: rep.ok ? "ok" : "bad" });
+          refreshGuard();
+          guardQ.reload();
+        } catch (e) {
+          setMsg({ text: "\u2717 repair failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" });
+        } finally {
+          setDiagBusy(null);
+        }
+      })();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -11597,6 +11904,18 @@ function SettingsPanel({
           selfProt ? onOff(selfProt.enabled) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "\u2026" }),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "   blocks agents editing SolonGate\u2019s own hooks/config \xB7 enter toggles" })
         ] });
+      case "doctor":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "doctor".padEnd(11) }),
+          diagBusy === "doctor" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} running health check\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "health check: login, policy, guard, hooks, local logs \xB7 enter runs it" })
+        ] });
+      case "repair":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
+          diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -11649,10 +11968,10 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
+    PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -11684,6 +12003,31 @@ function SettingsPanel({
     }
     lineEls.push(/* @__PURE__ */ jsx8(Box8, { children: rowLine(r) }, keyOf(r)));
     lineKey.push(keyOf(r));
+    if ((r.kind === "doctor" || r.kind === "repair") && diagBusy === r.kind) {
+      DIAG_STEPS[r.kind].forEach((label, i) => {
+        const done = i < diagStep;
+        lineEls.push(
+          /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: done ? theme.ok : i === diagStep ? theme.accentBright : theme.dim, children: `      ${done ? "\u2713" : i === diagStep ? spin : " "} ${label}` }, `step:${r.kind}:${i}`)
+        );
+        lineKey.push("");
+      });
+    }
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+      diag.lines.forEach((l, i) => {
+        lineEls.push(
+          /* @__PURE__ */ jsx8(
+            Text8,
+            {
+              wrap: "truncate",
+              color: l.level === "ok" ? theme.ok : l.level === "warn" ? theme.warn : l.level === "bad" ? theme.bad : theme.dim,
+              children: "    " + l.text
+            },
+            `diag:${diag.of}:${i}`
+          )
+        );
+        lineKey.push("");
+      });
+    }
   });
   if (hasEmailAlert && hasTgAlert) {
     lineEls.push(
@@ -11725,6 +12069,7 @@ var init_Settings = __esm({
     init_client();
     init_device_login();
     init_global_install();
+    init_doctor();
     init_logs_server_daemon();
     init_self_update();
     init_components();
@@ -11968,8 +12313,8 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join12 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 import { render } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
@@ -11980,11 +12325,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join12(homedir10(), ".solongate", "dataroom-debug.log");
+  const debugLog = join13(homedir11(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync9(join12(homedir10(), ".solongate"), { recursive: true });
+      mkdirSync9(join13(homedir11(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -12010,128 +12355,9 @@ var init_tui = __esm({
   }
 });
 
-// src/commands/format.ts
-function printJson(value) {
-  out(JSON.stringify(value, null, 2));
-}
-function usage(title, tagline, rows, footer = "Add --json for machine-readable output.") {
-  const W = 40;
-  const lines = ["", `  ${c.bold}${c.blue4}${title}${c.reset}  ${c.dim}${tagline}${c.reset}`, ""];
-  for (const [syntax, desc] of rows) {
-    if (!syntax) {
-      lines.push("");
-      continue;
-    }
-    if (desc === void 0) {
-      lines.push(`    ${c.cyan}${syntax}${c.reset}`);
-      continue;
-    }
-    if (syntax.length <= W) {
-      lines.push(`    ${c.cyan}${syntax}${c.reset}${" ".repeat(W - syntax.length)}${c.dim}${desc}${c.reset}`);
-    } else {
-      lines.push(`    ${c.cyan}${syntax}${c.reset}`);
-      lines.push(`    ${" ".repeat(W)}${c.dim}${desc}${c.reset}`);
-    }
-  }
-  if (footer) lines.push("", `  ${c.dim}${footer}${c.reset}`);
-  return lines.join("\n");
-}
-function decisionColor2(decision) {
-  const d = decision.toUpperCase();
-  if (d === "ALLOW") return green(d);
-  if (d === "DENY" || d === "DENIED") return red(d);
-  return dim(d);
-}
-function table(headers, rows) {
-  const cols = headers.length;
-  const w = new Array(cols).fill(0);
-  for (let i = 0; i < cols; i++) w[i] = width(headers[i] ?? "");
-  for (const row of rows) {
-    for (let i = 0; i < cols; i++) w[i] = Math.max(w[i], width(row[i] ?? ""));
-  }
-  const pad = (s, i) => s + " ".repeat(Math.max(0, w[i] - width(s)));
-  err("  " + headers.map((h, i) => dim(pad(h, i))).join("  "));
-  for (const row of rows) {
-    err("  " + row.map((cell, i) => pad(cell ?? "", i)).join("  "));
-  }
-}
-function truncate3(s, n) {
-  if (s.length <= n) return s;
-  return s.slice(0, Math.max(0, n - 1)) + "\u2026";
-}
-function sparkline(values) {
-  if (values.length === 0) return "";
-  const max = Math.max(...values, 0);
-  if (max === 0) return BLOCKS[0].repeat(values.length);
-  return values.map((v) => BLOCKS[Math.min(BLOCKS.length - 1, Math.round(v / max * (BLOCKS.length - 1)))]).join("");
-}
-var out, err, dim, bold, green, red, yellow, cyan, ANSI, width, BLOCKS;
-var init_format = __esm({
-  "src/commands/format.ts"() {
-    "use strict";
-    init_cli_utils();
-    out = (s = "") => void process.stdout.write(s + "\n");
-    err = (s = "") => void process.stderr.write(s + "\n");
-    dim = (s) => `${c.dim}${s}${c.reset}`;
-    bold = (s) => `${c.bold}${s}${c.reset}`;
-    green = (s) => `${c.green}${s}${c.reset}`;
-    red = (s) => `${c.red}${s}${c.reset}`;
-    yellow = (s) => `${c.yellow}${s}${c.reset}`;
-    cyan = (s) => `${c.cyan}${s}${c.reset}`;
-    ANSI = /\x1b\[[0-9;]*m/g;
-    width = (s) => s.replace(ANSI, "").length;
-    BLOCKS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
-  }
-});
-
-// src/commands/args.ts
-function parse(argv) {
-  const positionals = [];
-  const flags = {};
-  for (let i = 0; i < argv.length; i++) {
-    const tok = argv[i];
-    if (tok.startsWith("--")) {
-      const body = tok.slice(2);
-      const eq = body.indexOf("=");
-      if (eq !== -1) {
-        flags[body.slice(0, eq)] = body.slice(eq + 1);
-        continue;
-      }
-      const next = argv[i + 1];
-      if (next !== void 0 && !next.startsWith("--")) {
-        flags[body] = next;
-        i++;
-      } else {
-        flags[body] = true;
-      }
-    } else {
-      positionals.push(tok);
-    }
-  }
-  return { positionals, flags };
-}
-function flagStr(flags, name) {
-  const v = flags[name];
-  return typeof v === "string" ? v : void 0;
-}
-function flagNum(flags, name) {
-  const v = flagStr(flags, name);
-  if (v === void 0) return void 0;
-  const n = Number(v);
-  return Number.isFinite(n) ? n : void 0;
-}
-function flagBool(flags, name) {
-  return flags[name] === true || flags[name] === "true";
-}
-var init_args = __esm({
-  "src/commands/args.ts"() {
-    "use strict";
-  }
-});
-
 // src/commands/policy.ts
-import { readFileSync as readFileSync10 } from "fs";
-async function run(argv) {
+import { readFileSync as readFileSync11 } from "fs";
+async function run2(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
   const json = flagBool(flags, "json");
@@ -12287,7 +12513,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync10(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -12316,7 +12542,7 @@ var init_policy = __esm({
 });
 
 // src/commands/ratelimit.ts
-async function run2(argv) {
+async function run3(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "show";
   const json = flagBool(flags, "json");
@@ -12394,7 +12620,7 @@ var init_ratelimit = __esm({
 });
 
 // src/commands/dlp.ts
-async function run3(argv) {
+async function run4(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "show";
   const json = flagBool(flags, "json");
@@ -12482,7 +12708,7 @@ var init_dlp = __esm({
 });
 
 // src/commands/stats.ts
-async function run4(argv) {
+async function run5(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "overview";
   const json = flagBool(flags, "json");
@@ -12560,7 +12786,7 @@ var init_stats2 = __esm({
 });
 
 // src/commands/audit.ts
-async function run5(argv) {
+async function run6(argv) {
   const { positionals, flags } = parse(argv);
   const json = flagBool(flags, "json");
   if (positionals[0] === "help") return err(USAGE5), 0;
@@ -12689,97 +12915,6 @@ var init_agents2 = __esm({
   }
 });
 
-// src/commands/doctor.ts
-import { existsSync as existsSync6, readFileSync as readFileSync11, statSync as statSync2 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
-async function run6(argv) {
-  const { flags } = parse(argv);
-  const json = flagBool(flags, "json");
-  const checks = [];
-  if (!isAuthenticated()) {
-    checks.push({ name: "login", ok: false, detail: "not logged in - run `solongate`, add your account in the Accounts panel" });
-  } else {
-    const { apiUrl } = resolveCredentials();
-    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
-    try {
-      const active2 = await api.policies.active();
-      if (active2.policy) {
-        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
-      } else {
-        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves - every call falls back to default" });
-      }
-      const sec = active2.security;
-      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
-      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
-      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
-    } catch (e) {
-      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
-    }
-    try {
-      const g = await api.settings.getGuardStatus();
-      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 update from \`solongate\` \u2192 Settings \u2192 guard` });
-    } catch {
-    }
-  }
-  if (codexDetected()) {
-    const cx = codexHooksStatus();
-    if (!cx.registered) {
-      checks.push({ name: "codex hooks", ok: false, detail: "guard not registered - run `solongate repair`" });
-    } else if (cx.disabled) {
-      checks.push({ name: "codex hooks", ok: false, detail: "hooks disabled in ~/.codex/config.toml ([features] hooks = false)" });
-    } else if (!cx.trusted) {
-      checks.push({ name: "codex hooks", ok: "warn", detail: "registered - run `/hooks` in Codex once and trust them (Codex skips untrusted hooks)" });
-    } else {
-      checks.push({ name: "codex hooks", ok: true, detail: "registered + trusted" });
-    }
-  }
-  try {
-    const raw = readFileSync11(join13(homedir11(), ".solongate", ".key-rejected.json"), "utf-8");
-    const m = JSON.parse(raw);
-    const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
-    checks.push({
-      name: "hook credential",
-      ok: false,
-      detail: `rejected by ${m.apiUrl ?? "the API"}${ageMin != null ? ` ${ageMin}m ago` : ""} \xB7 key from ${m.keySource ?? "?"}${m.cwd ? ` (agent cwd ${m.cwd})` : ""} - nothing is being logged from there`
-    });
-  } catch {
-  }
-  const LOCAL_LOG2 = localLogFile();
-  if (existsSync6(LOCAL_LOG2)) {
-    const st = statSync2(LOCAL_LOG2);
-    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
-    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
-  } else {
-    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) - enable in dashboard \u2192 Settings" });
-  }
-  if (json) return printJson(checks), checks.some((c2) => c2.ok === false) ? 1 : 0;
-  err("");
-  err(`  ${bold("SolonGate doctor")}`);
-  err("");
-  for (const c2 of checks) {
-    const mark = c2.ok === true ? green("\u2713") : c2.ok === "warn" ? yellow("!") : red("\u2717");
-    err(`  ${mark} ${c2.name.padEnd(16)} ${dim(c2.detail)}`);
-  }
-  err("");
-  const bad = checks.filter((c2) => c2.ok === false).length;
-  const warn = checks.filter((c2) => c2.ok === "warn").length;
-  if (bad) err(`  ${red(`${bad} problem(s)`)}${warn ? dim(` \xB7 ${warn} warning(s)`) : ""}`);
-  else if (warn) err(`  ${yellow(`${warn} warning(s)`)} ${dim("- guard is working")}`);
-  else err(`  ${green("all good")}`);
-  return bad ? 1 : 0;
-}
-var init_doctor = __esm({
-  "src/commands/doctor.ts"() {
-    "use strict";
-    init_api_client();
-    init_global_install();
-    init_local_log();
-    init_format();
-    init_args();
-  }
-});
-
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync7, openSync as openSync4, readSync as readSync2, statSync as statSync3 } from "fs";
 function tailLocal(file, maxBytes = 131072) {
@@ -13023,21 +13158,21 @@ __export(commands_exports, {
 async function dispatch(command, argv) {
   switch (command) {
     case "policy":
-      return run(argv);
-    case "ratelimit":
       return run2(argv);
-    case "dlp":
+    case "ratelimit":
       return run3(argv);
-    case "stats":
+    case "dlp":
       return run4(argv);
-    case "audit":
+    case "stats":
       return run5(argv);
+    case "audit":
+      return run6(argv);
     case "sessions":
       return runAgents(argv);
     case "session":
       return runAgent(argv);
     case "doctor":
-      return run6(argv);
+      return run(argv);
     case "watch":
       return run7(argv);
     case "alerts":