@solongate/proxy 0.82.82 → 0.82.84

package/dist/tui/index.js

@@ -338,6 +338,36 @@ function codexHooksStatus() {
   }
   return { registered, trusted, disabled };
 }
+function repairQuiet() {
+  const p = globalPaths();
+  const has = (f) => existsSync2(f);
+  const guardFile = join3(p.hooksDir, "guard.mjs");
+  const line = (label, ok, yes, no) => ({ label, ok, detail: ok ? yes : no });
+  const before = [
+    line("guard hook file", has(guardFile), "present", "MISSING"),
+    line("cloud credential", has(p.configPath), "present", "MISSING"),
+    line("Claude Code settings", isGuardInstalled(), "guard registered", "guard NOT registered"),
+    line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered")
+  ];
+  const r = installGlobalQuiet();
+  if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
+  const after = [
+    { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
+    line("Claude Code settings", isGuardInstalled(), "guard registered", "NOT registered"),
+    line("Antigravity hooks", has(p.antigravityHooksPath), "present", "MISSING"),
+    line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered")
+  ];
+  const notes = [];
+  const cx = codexHooksStatus();
+  if (cx.registered && !cx.trusted) {
+    notes.push("Codex only: run `/hooks` inside Codex once and trust the SolonGate hooks (Codex skips any hook it has not been told to trust).");
+  }
+  if (cx.disabled) {
+    notes.push("Codex only: hooks are turned OFF in ~/.codex/config.toml ([features] hooks = false) - the guard cannot run there until that line is removed.");
+  }
+  return { ok: true, message: "guard repaired. Open a new AI session for it to take effect.", before, after, notes };
+}
 function installGlobalQuiet() {
   try {
     const p = globalPaths();
@@ -500,8 +530,8 @@ var init_global_install = __esm({
 
 // src/tui/index.tsx
 import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import { render } from "ink";
 
 // src/tui/App.tsx
@@ -960,6 +990,14 @@ function dotenvApiKey() {
   return void 0;
 }
 var cached2 = null;
+function isAuthenticated() {
+  try {
+    resolveCredentials();
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveCredentials(apiUrlOverride) {
   if (viewOverride && !apiUrlOverride) return viewOverride;
   if (cached2 && !apiUrlOverride) return cached2;
@@ -1005,8 +1043,8 @@ async function request(method, path, opts = {}) {
     try {
       res = await attempt();
       break;
-    } catch (err) {
-      lastErr = err;
+    } catch (err2) {
+      lastErr = err2;
       if (i < maxTries - 1) await new Promise((r) => setTimeout(r, 600 * (i + 1)));
     }
   }
@@ -1931,8 +1969,8 @@ function LivePanel({ active: active2 }) {
         until: Date.now() + 7e3
       });
       pushLog(`${act === "whitelist" ? "\u2713 whitelisted" : "\u26D4 blocked"} ${e.tool}`, act === "whitelist" ? "ok" : "warn");
-    } catch (err) {
-      setActionMsg({ text: "\u2717 " + (err instanceof Error ? err.message : String(err)), level: "bad", until: Date.now() + 7e3 });
+    } catch (err2) {
+      setActionMsg({ text: "\u2717 " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 7e3 });
     }
   };
   useInput(
@@ -2035,8 +2073,8 @@ function LivePanel({ active: active2 }) {
           mkdirSync3(join5(homedir5(), ".solongate"), { recursive: true });
           writeFileSync4(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
-        } catch (err) {
-          setActionMsg({ text: "\u2717 export failed: " + (err instanceof Error ? err.message : String(err)), level: "bad", until: Date.now() + 6e3 });
+        } catch (err2) {
+          setActionMsg({ text: "\u2717 export failed: " + (err2 instanceof Error ? err2.message : String(err2)), level: "bad", until: Date.now() + 6e3 });
         }
       } else if (key.downArrow) setSel((n) => Math.min(visibleDesc.length - 1, n + 1));
       else if (key.upArrow) setSel((n) => Math.max(0, n - 1));
@@ -2461,7 +2499,7 @@ function DryRunPanel({ focused }) {
   const totalLogs = statsQ.data?.total_calls ?? null;
   const [res, setRes] = useState3(null);
   const [running, setRunning] = useState3(false);
-  const [err, setErr] = useState3(null);
+  const [err2, setErr] = useState3(null);
   const [off, setOff] = useState3(0);
   const { cols, rows } = usePanelSize();
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
@@ -2475,7 +2513,7 @@ function DryRunPanel({ focused }) {
     api.policies.backtest({ rules: p.rules ?? [], mode: p.mode, limit: lim }).then((r) => setRes(r)).catch((e) => setErr(e instanceof Error ? e.message : String(e))).finally(() => setRunning(false));
   }
   useEffect3(() => {
-    if (policies.length === 0 || res || running || err) return;
+    if (policies.length === 0 || res || running || err2) return;
     let idx = 0;
     if (pendingPolicyId) {
       const found = policies.findIndex((p) => p.id === pendingPolicyId);
@@ -2508,7 +2546,7 @@ function DryRunPanel({ focused }) {
   const w = Math.max(40, cols);
   const lines = [];
   const head = (t) => lines.push(/* @__PURE__ */ jsx3(Text3, { bold: true, color: theme.accentBright, children: t }, `h${lines.length}`));
-  const dim = (t) => lines.push(/* @__PURE__ */ jsx3(Text3, { color: theme.dim, wrap: "truncate", children: t }, `d${lines.length}`));
+  const dim2 = (t) => lines.push(/* @__PURE__ */ jsx3(Text3, { color: theme.dim, wrap: "truncate", children: t }, `d${lines.length}`));
   const row = (t) => lines.push(/* @__PURE__ */ jsx3(Text3, { wrap: "truncate", children: t }, `r${lines.length}`));
   const blank = () => lines.push(/* @__PURE__ */ jsx3(Text3, { children: " " }, `b${lines.length}`));
   if (res) {
@@ -2534,7 +2572,7 @@ function DryRunPanel({ focused }) {
     blank();
     if (res.per_rule.length) {
       head("Per-rule impact");
-      dim(`  ${"RULE".padEnd(38)}${"MATCHED".padEnd(9)}${"%".padEnd(8)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
+      dim2(`  ${"RULE".padEnd(38)}${"MATCHED".padEnd(9)}${"%".padEnd(8)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
       for (const r of res.per_rule.slice(0, 30)) {
         row(`  ${truncate(r.rule_id, 36).padEnd(38)}${String(r.matched).padEnd(9)}${pct(r.matched, s.evaluated).padEnd(8)}${String(r.newly_blocked).padEnd(9)}${r.newly_allowed}`);
       }
@@ -2542,7 +2580,7 @@ function DryRunPanel({ focused }) {
     }
     if (res.per_agent.length) {
       head("Per-agent impact");
-      dim(`  ${"AGENT".padEnd(24)}${"EVALUATED".padEnd(11)}${"CHANGED".padEnd(9)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
+      dim2(`  ${"AGENT".padEnd(24)}${"EVALUATED".padEnd(11)}${"CHANGED".padEnd(9)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
       for (const a of res.per_agent) {
         row(`  ${truncate(a.agent || "-", 22).padEnd(24)}${String(a.evaluated).padEnd(11)}${String(a.changed).padEnd(9)}${String(a.newly_blocked).padEnd(9)}${a.newly_allowed}`);
       }
@@ -2550,7 +2588,7 @@ function DryRunPanel({ focused }) {
     }
     if (res.per_tool.length) {
       head("Per-tool breakdown");
-      dim(`  ${"TOOL".padEnd(24)}${"EVALUATED".padEnd(11)}${"CHANGED".padEnd(9)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
+      dim2(`  ${"TOOL".padEnd(24)}${"EVALUATED".padEnd(11)}${"CHANGED".padEnd(9)}${"NEW-BLK".padEnd(9)}NEW-ALW`);
       for (const t of res.per_tool) {
         row(`  ${truncate(t.tool || "-", 22).padEnd(24)}${String(t.evaluated).padEnd(11)}${String(t.changed).padEnd(9)}${String(t.newly_blocked).padEnd(9)}${t.newly_allowed}`);
       }
@@ -2599,8 +2637,8 @@ function DryRunPanel({ focused }) {
     ] }),
     /* @__PURE__ */ jsx3(Text3, { color: theme.dim, wrap: "truncate", children: focused ? `\u2191\u2193 scroll \xB7 p policy \xB7 n logs \xB7 r re-run${above ? ` \xB7 \u25B2${above}` : ""}${below ? ` \xB7 \u25BC${below}` : ""}` : "press \u2192 to open" }),
     running ? /* @__PURE__ */ jsx3(Text3, { color: theme.warn, children: "replaying recent traffic\u2026" }) : null,
-    err ? /* @__PURE__ */ jsx3(Text3, { color: theme.bad, wrap: "truncate", children: "\u2717 " + err }) : null,
-    !running && !err && !res ? /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "no result yet, press r to run" }) : null,
+    err2 ? /* @__PURE__ */ jsx3(Text3, { color: theme.bad, wrap: "truncate", children: "\u2717 " + err2 }) : null,
+    !running && !err2 && !res ? /* @__PURE__ */ jsx3(Text3, { color: theme.dim, children: "no result yet, press r to run" }) : null,
     /* @__PURE__ */ jsx3(Box3, { marginTop: 1, flexDirection: "column", children: win })
   ] }) });
 }
@@ -4238,19 +4276,85 @@ import TextInput6 from "ink-text-input";
 import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
 init_global_install();
 
+// src/commands/doctor.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
+init_global_install();
+async function collectChecks() {
+  const checks = [];
+  if (!isAuthenticated()) {
+    checks.push({ name: "login", ok: false, detail: "not logged in - run `solongate`, add your account in the Accounts panel" });
+  } else {
+    const { apiUrl } = resolveCredentials();
+    checks.push({ name: "login", ok: true, detail: `paired \xB7 ${apiUrl}` });
+    try {
+      const active2 = await api.policies.active();
+      if (active2.policy) {
+        checks.push({ name: "active policy", ok: true, detail: `${active2.policy.name} v${active2.version} \xB7 ${active2.policy.mode ?? "denylist"} \xB7 matched by ${active2.matched_by}` });
+      } else {
+        checks.push({ name: "active policy", ok: "warn", detail: "no policy resolves - every call falls back to default" });
+      }
+      const sec = active2.security;
+      checks.push({ name: "rate limit", ok: sec?.rateLimit ? true : "warn", detail: sec?.rateLimit ? `${sec.rateLimit.perMinute}/min` : "off" });
+      checks.push({ name: "dlp", ok: sec?.dlpBlock ? true : "warn", detail: sec?.dlpBlock ? `block \xB7 ${sec.dlpBlock.patterns.length} patterns` : sec?.dlpRedact ? "redact" : "off" });
+      checks.push({ name: "self-protection", ok: active2.self_protection_enabled ? true : "warn", detail: active2.self_protection_enabled ? "on" : "off" });
+    } catch (e) {
+      checks.push({ name: "api", ok: false, detail: "unreachable: " + (e instanceof Error ? e.message : String(e)) });
+    }
+    try {
+      const g = await api.settings.getGuardStatus();
+      checks.push({ name: "guard hook", ok: g.up_to_date ? true : "warn", detail: g.up_to_date ? `v${g.installed} (latest) \xB7 ${g.device_count} device(s)` : `v${g.installed} \u2192 v${g.latest} available \xB7 update from \`solongate\` \u2192 Settings \u2192 guard` });
+    } catch {
+    }
+  }
+  if (codexDetected()) {
+    const cx = codexHooksStatus();
+    if (!cx.registered) {
+      checks.push({ name: "codex hooks", ok: false, detail: "guard not registered - run `solongate repair`" });
+    } else if (cx.disabled) {
+      checks.push({ name: "codex hooks", ok: false, detail: "hooks disabled in ~/.codex/config.toml ([features] hooks = false)" });
+    } else if (!cx.trusted) {
+      checks.push({ name: "codex hooks", ok: "warn", detail: "registered - run `/hooks` in Codex once and trust them (Codex skips untrusted hooks)" });
+    } else {
+      checks.push({ name: "codex hooks", ok: true, detail: "registered + trusted" });
+    }
+  }
+  try {
+    const raw = readFileSync5(join7(homedir7(), ".solongate", ".key-rejected.json"), "utf-8");
+    const m = JSON.parse(raw);
+    const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
+    checks.push({
+      name: "hook credential",
+      ok: false,
+      detail: `rejected by ${m.apiUrl ?? "the API"}${ageMin != null ? ` ${ageMin}m ago` : ""} \xB7 key from ${m.keySource ?? "?"}${m.cwd ? ` (agent cwd ${m.cwd})` : ""} - nothing is being logged from there`
+    });
+  } catch {
+  }
+  const LOCAL_LOG2 = localLogFile();
+  if (existsSync4(LOCAL_LOG2)) {
+    const st = statSync2(LOCAL_LOG2);
+    const ageMin = (Date.now() - st.mtimeMs) / 6e4;
+    checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
+  } else {
+    checks.push({ name: "local logs", ok: "warn", detail: "off (logs go to cloud) - enable in dashboard \u2192 Settings" });
+  }
+  return checks;
+}
+
 // src/logs-server-daemon.ts
 import { spawn as spawn3 } from "child_process";
-import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname2, join as join7 } from "path";
+import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname2, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var DIR = join7(homedir7(), ".solongate");
-var STATE_FILE = join7(DIR, ".logs-server.json");
-var LOG_FILE = join7(DIR, "logs-server.log");
+var DIR = join8(homedir8(), ".solongate");
+var STATE_FILE = join8(DIR, ".logs-server.json");
+var LOG_FILE = join8(DIR, "logs-server.log");
 var LOGS_SERVER_PORT = 8788;
 function readState() {
   try {
-    const s = JSON.parse(readFileSync5(STATE_FILE, "utf-8"));
+    const s = JSON.parse(readFileSync6(STATE_FILE, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -4286,7 +4390,7 @@ function startLogsServerDaemon() {
   try {
     mkdirSync5(DIR, { recursive: true });
     const log = openSync2(LOG_FILE, "a");
-    const cli = join7(dirname2(fileURLToPath2(import.meta.url)), "index.js");
+    const cli = join8(dirname2(fileURLToPath2(import.meta.url)), "index.js");
     const p = spawn3(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log, log],
@@ -4318,18 +4422,18 @@ function stopLogsServerDaemon() {
 
 // src/self-update.ts
 import { execFile, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
-import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname3, join as join8 } from "path";
+import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname3, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var PKG = "@solongate/proxy";
 var CHECK_EVERY_MS = 30 * 60 * 1e3;
 var ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
-var STATE_FILE2 = join8(homedir8(), ".solongate", ".self-update.json");
-var LOG_FILE2 = join8(homedir8(), ".solongate", "self-update.log");
+var STATE_FILE2 = join9(homedir9(), ".solongate", ".self-update.json");
+var LOG_FILE2 = join9(homedir9(), ".solongate", "self-update.log");
 function readState2() {
   try {
-    const s = JSON.parse(readFileSync6(STATE_FILE2, "utf-8"));
+    const s = JSON.parse(readFileSync7(STATE_FILE2, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -4337,14 +4441,14 @@ function readState2() {
 }
 function writeState2(s) {
   try {
-    mkdirSync6(join8(homedir8(), ".solongate"), { recursive: true });
+    mkdirSync6(join9(homedir9(), ".solongate"), { recursive: true });
     writeFileSync7(STATE_FILE2, JSON.stringify(s));
   } catch {
   }
 }
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync6(join8(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(join9(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -4381,20 +4485,20 @@ async function fetchLatest() {
 function runGlobalInstall(version) {
   return new Promise((resolve3) => {
     try {
-      mkdirSync6(join8(homedir8(), ".solongate"), { recursive: true });
+      mkdirSync6(join9(homedir9(), ".solongate"), { recursive: true });
       execFile(
         "npm",
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
-        (err, stdout, stderr) => {
+        (err2, stdout, stderr) => {
           try {
-            writeFileSync7(LOG_FILE2, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err ? "FAILED" : "ok"}
+            writeFileSync7(LOG_FILE2, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
 ${stdout}
 ${stderr}
 `, { flag: "a" });
           } catch {
           }
-          resolve3(!err);
+          resolve3(!err2);
         }
       );
     } catch {
@@ -4457,6 +4561,24 @@ function SettingsPanel({
   const [busy, setBusy] = useState8(false);
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
+  const [diagBusy, setDiagBusy] = useState8(null);
+  const [diag, setDiag] = useState8(null);
+  const [diagStep, setDiagStep] = useState8(0);
+  const DIAG_STEPS = {
+    doctor: ["login", "active policy", "guard hook", "agent hooks", "local logs"],
+    repair: ["inspecting protection files", "rewriting hook files", "registering with agents", "re-locking"]
+  };
+  const settle = async (started, of) => {
+    const min = DIAG_STEPS[of].length * 220 + 160;
+    const left = min - (Date.now() - started);
+    if (left > 0) await new Promise((res) => setTimeout(res, left));
+  };
+  useEffect7(() => {
+    if (!diagBusy) return;
+    const total = DIAG_STEPS[diagBusy].length;
+    const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
+    return () => clearInterval(step);
+  }, [diagBusy]);
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -4495,10 +4617,11 @@ function SettingsPanel({
     return () => clearInterval(t);
   }, []);
   useEffect7(() => {
-    if (!login || login.phase === "done" || login.phase === "error") return;
+    const loggingIn = login && login.phase !== "done" && login.phase !== "error";
+    if (!loggingIn && !diagBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login]);
+  }, [login, diagBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -4530,6 +4653,8 @@ function SettingsPanel({
     ...locked ? [] : [
       { kind: "guard" },
       { kind: "self" },
+      { kind: "doctor" },
+      { kind: "repair" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -4648,6 +4773,64 @@ function SettingsPanel({
       setMsg({ text: (res.ok ? "\u2713 " : "\u2717 ") + res.message, level: res.ok ? "ok" : "bad" });
       refreshGuard();
       guardQ.reload();
+    } else if (r.kind === "doctor") {
+      if (diagBusy) return;
+      setDiagBusy("doctor");
+      setDiagStep(0);
+      setDiag(null);
+      void (async () => {
+        const started = Date.now();
+        try {
+          const checks = await collectChecks();
+          await settle(started, "doctor");
+          const bad = checks.filter((c2) => c2.ok === false).length;
+          const warn = checks.filter((c2) => c2.ok === "warn").length;
+          setDiag({
+            of: "doctor",
+            lines: checks.map((c2) => ({
+              text: `${c2.ok === true ? "\u2713" : c2.ok === "warn" ? "!" : "\u2717"} ${c2.name.padEnd(16)} ${c2.detail}`,
+              level: c2.ok === true ? "ok" : c2.ok === "warn" ? "warn" : "bad"
+            }))
+          });
+          setMsg(
+            bad ? { text: `\u2717 ${bad} problem(s)${warn ? ` \xB7 ${warn} warning(s)` : ""}`, level: "bad" } : { text: warn ? `\u2713 guard is working \xB7 ${warn} warning(s)` : "\u2713 all good", level: "ok" }
+          );
+        } catch (e) {
+          setMsg({ text: "\u2717 doctor failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" });
+        } finally {
+          setDiagBusy(null);
+        }
+      })();
+    } else if (r.kind === "repair") {
+      if (diagBusy) return;
+      setDiagBusy("repair");
+      setDiagStep(0);
+      setDiag(null);
+      void (async () => {
+        try {
+          const started = Date.now();
+          await new Promise((res) => setTimeout(res, 60));
+          const rep = repairQuiet();
+          await settle(started, "repair");
+          setDiag({
+            of: "repair",
+            lines: [
+              ...(rep.ok ? rep.after : rep.before).map((l) => ({
+                text: `${l.ok ? "\u2713" : "\u2717"} ${l.label.padEnd(20)} ${l.detail}`,
+                level: l.ok ? "ok" : "bad"
+              })),
+              ...rep.notes.map((n) => ({ text: n, level: "warn" }))
+            ]
+          });
+          setMsg({ text: (rep.ok ? "\u2713 " : "\u2717 ") + rep.message, level: rep.ok ? "ok" : "bad" });
+          refreshGuard();
+          guardQ.reload();
+        } catch (e) {
+          setMsg({ text: "\u2717 repair failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" });
+        } finally {
+          setDiagBusy(null);
+        }
+      })();
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
@@ -4937,6 +5120,18 @@ function SettingsPanel({
           selfProt ? onOff(selfProt.enabled) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "\u2026" }),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "   blocks agents editing SolonGate\u2019s own hooks/config \xB7 enter toggles" })
         ] });
+      case "doctor":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "doctor".padEnd(11) }),
+          diagBusy === "doctor" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} running health check\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "health check: login, policy, guard, hooks, local logs \xB7 enter runs it" })
+        ] });
+      case "repair":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
+          diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -4989,10 +5184,10 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
-    PROTECTION: "guard hook: enter install/update (writes the files) \xB7 d remove \xB7 + self-protection",
+    PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -5024,6 +5219,31 @@ function SettingsPanel({
     }
     lineEls.push(/* @__PURE__ */ jsx8(Box8, { children: rowLine(r) }, keyOf(r)));
     lineKey.push(keyOf(r));
+    if ((r.kind === "doctor" || r.kind === "repair") && diagBusy === r.kind) {
+      DIAG_STEPS[r.kind].forEach((label, i) => {
+        const done = i < diagStep;
+        lineEls.push(
+          /* @__PURE__ */ jsx8(Text8, { wrap: "truncate", color: done ? theme.ok : i === diagStep ? theme.accentBright : theme.dim, children: `      ${done ? "\u2713" : i === diagStep ? spin : " "} ${label}` }, `step:${r.kind}:${i}`)
+        );
+        lineKey.push("");
+      });
+    }
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+      diag.lines.forEach((l, i) => {
+        lineEls.push(
+          /* @__PURE__ */ jsx8(
+            Text8,
+            {
+              wrap: "truncate",
+              color: l.level === "ok" ? theme.ok : l.level === "warn" ? theme.warn : l.level === "bad" ? theme.bad : theme.dim,
+              children: "    " + l.text
+            },
+            `diag:${diag.of}:${i}`
+          )
+        );
+        lineKey.push("");
+      });
+    }
   });
   if (hasEmailAlert && hasTgAlert) {
     lineEls.push(
@@ -5258,11 +5478,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join9(homedir9(), ".solongate", "dataroom-debug.log");
+  const debugLog = join10(homedir10(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync7(join9(homedir9(), ".solongate"), { recursive: true });
+      mkdirSync7(join10(homedir10(), ".solongate"), { recursive: true });
       appendFileSync(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.82.82",
+  "version": "0.82.84",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {