@solongate/proxy 0.83.2 → 0.83.4

package/dist/global-install.js

@@ -405,6 +405,16 @@ function repairQuiet() {
 }
 async function runRepair() {
   const out = (s) => void process.stderr.write(s + "\n");
+  if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env["SOLONGATE_INTERNAL"] !== "1") {
+    out("");
+    out("  Do not run `solongate repair` with sudo.");
+    out("  It installs the guard into your home directory, and as root it would");
+    out(`  arm root\u2019s home instead${process.env["SUDO_USER"] ? ` of ${process.env["SUDO_USER"]}\u2019s` : ""} \u2014 reporting success while nothing changed for you.`);
+    out("");
+    out("  Run it as yourself:  solongate repair");
+    out("");
+    return 1;
+  }
   const rep = repairQuiet();
   out("");
   out("  SolonGate repair");

package/dist/index.js

@@ -465,13 +465,13 @@ ${offset}${err2}${errEnd}`;
         return next >= src.length || src[next] === "\n" ? str + "\n" : str;
       }
       // ^(---|...)
-      static atDocumentBoundary(src, offset, sep) {
+      static atDocumentBoundary(src, offset, sep2) {
         const ch0 = src[offset];
         if (!ch0) return true;
         const prev = src[offset - 1];
         if (prev && prev !== "\n") return false;
-        if (sep) {
-          if (ch0 !== sep) return false;
+        if (sep2) {
+          if (ch0 !== sep2) return false;
         } else {
           if (ch0 !== Char.DIRECTIVES_END && ch0 !== Char.DOCUMENT_END) return false;
         }
@@ -1647,7 +1647,7 @@ var require_parse_cst = __commonJS({
         const folded = this.type === PlainValue.Type.BLOCK_FOLDED;
         let atStart = true;
         let str = "";
-        let sep = "";
+        let sep2 = "";
         let prevMoreIndented = false;
         for (let i = start; i < end; ++i) {
           for (let j = 0; j < bi; ++j) {
@@ -1656,21 +1656,21 @@ var require_parse_cst = __commonJS({
           }
           const ch2 = src[i];
           if (ch2 === "\n") {
-            if (sep === "\n") str += "\n";
-            else sep = "\n";
+            if (sep2 === "\n") str += "\n";
+            else sep2 = "\n";
           } else {
             const lineEnd = PlainValue.Node.endOfLine(src, i);
             const line = src.slice(i, lineEnd);
             i = lineEnd;
             if (folded && (ch2 === " " || ch2 === "	") && i < keepStart) {
-              if (sep === " ") sep = "\n";
-              else if (!prevMoreIndented && !atStart && sep === "\n") sep = "\n\n";
-              str += sep + line;
-              sep = lineEnd < end && src[lineEnd] || "";
+              if (sep2 === " ") sep2 = "\n";
+              else if (!prevMoreIndented && !atStart && sep2 === "\n") sep2 = "\n\n";
+              str += sep2 + line;
+              sep2 = lineEnd < end && src[lineEnd] || "";
               prevMoreIndented = true;
             } else {
-              str += sep + line;
-              sep = folded && i < keepStart ? " " : "\n";
+              str += sep2 + line;
+              sep2 = folded && i < keepStart ? " " : "\n";
               prevMoreIndented = false;
             }
             if (atStart && line !== "") atStart = false;
@@ -6612,6 +6612,16 @@ function repairQuiet() {
 }
 async function runRepair() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env["SOLONGATE_INTERNAL"] !== "1") {
+    out2("");
+    out2("  Do not run `solongate repair` with sudo.");
+    out2("  It installs the guard into your home directory, and as root it would");
+    out2(`  arm root\u2019s home instead${process.env["SUDO_USER"] ? ` of ${process.env["SUDO_USER"]}\u2019s` : ""} \u2014 reporting success while nothing changed for you.`);
+    out2("");
+    out2("  Run it as yourself:  solongate repair");
+    out2("");
+    return 1;
+  }
   const rep = repairQuiet();
   out2("");
   out2("  SolonGate repair");
@@ -6923,17 +6933,26 @@ var init_global_install = __esm({
 // src/self-update.ts
 var self_update_exports = {};
 __export(self_update_exports, {
+  adminInstallCommand: () => adminInstallCommand,
+  adminUpdateSteps: () => adminUpdateSteps,
+  autoUpdateEnabled: () => autoUpdateEnabled,
+  autoUpdateForcedByEnv: () => autoUpdateForcedByEnv,
   currentVersion: () => currentVersion,
+  globalInstallCheck: () => globalInstallCheck,
   latestVersion: () => latestVersion,
   maybeSelfUpdate: () => maybeSelfUpdate,
   newerThan: () => newerThan,
+  runAutoUpdateCommand: () => runAutoUpdateCommand,
   runUpdateCommand: () => runUpdateCommand,
-  tuiUpdateFlow: () => tuiUpdateFlow
+  runningAsRoot: () => runningAsRoot,
+  setAutoUpdate: () => setAutoUpdate,
+  tuiUpdateFlow: () => tuiUpdateFlow,
+  updateNow: () => updateNow
 });
 import { execFile, execFileSync as execFileSync3, spawn } from "child_process";
-import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, constants as FS } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join5, sep } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readState() {
   try {
@@ -6950,6 +6969,20 @@ function writeState(s) {
   } catch {
   }
 }
+function autoUpdateEnabled() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  if (env === "1" || env === "true" || env === "on" || env === "yes") return true;
+  if (env === "0" || env === "false" || env === "off" || env === "no") return false;
+  return readState().auto === true;
+}
+function autoUpdateForcedByEnv() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  return ["1", "true", "on", "yes", "0", "false", "off", "no"].includes(env);
+}
+function setAutoUpdate(on) {
+  const s = readState();
+  writeState(on ? { ...s, auto: true, needsAdmin: void 0 } : { ...s, auto: false });
+}
 function currentVersion() {
   try {
     const pkg = JSON.parse(readFileSync5(join5(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
@@ -7006,6 +7039,17 @@ function spawnGlobalInstall(version) {
 }
 async function runUpdateCommand() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (runningAsRoot()) {
+    out2("");
+    out2("  Do not run `solongate update` with sudo.");
+    out2("  npm would install fine, but the guard hooks would be written into root\u2019s");
+    out2("  home instead of yours, and your agents would stop being guarded.");
+    out2("");
+    out2("  Run these two instead:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+    out2("");
+    return 1;
+  }
   const cur = currentVersion();
   out2(`  current  ${cur}`);
   const latest = await latestVersion();
@@ -7014,12 +7058,32 @@ async function runUpdateCommand() {
     return 1;
   }
   if (newerThan(latest, cur)) {
+    const pre = await globalInstallCheck();
+    if (pre.writable === false) {
+      writeState({ ...readState(), needsAdmin: latest });
+      out2(`  v${latest} is out, but npm\u2019s global folder needs admin rights on this machine:`);
+      out2(`    ${pre.dir}`);
+      out2("  That is the normal macOS setup \u2014 SolonGate cannot install there on its own.");
+      out2("");
+      out2("  Run these two:");
+      for (const s of adminUpdateSteps()) out2("  " + s);
+      out2("");
+      return 1;
+    }
     out2(`  updating ${cur} -> ${latest} ...`);
-    const ok = await runGlobalInstall2(latest);
-    if (!ok) {
-      out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+    const r = await runGlobalInstall2(latest);
+    if (!r.ok) {
+      if (r.needsAdmin) {
+        writeState({ ...readState(), needsAdmin: latest });
+        out2("  npm could not write to the global folder (it needs admin rights).");
+        out2("  Run these two:");
+        for (const s of adminUpdateSteps()) out2("  " + s);
+      } else {
+        out2("  update failed. Try: npm i -g @solongate/proxy@latest");
+      }
       return 1;
     }
+    writeState({ ...readState(), needsAdmin: void 0 });
     out2(`  \u2713 updated to ${latest}  (open a new session to use it)`);
   } else {
     out2(`  \u2713 already up to date`);
@@ -7049,20 +7113,99 @@ function runGlobalInstall2(version) {
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
         (err2, stdout, stderr) => {
+          const output = `${stdout}
+${stderr}`;
           try {
             writeFileSync4(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
-${stdout}
-${stderr}
+${output}
 `, { flag: "a" });
           } catch {
           }
-          resolve6(!err2);
+          resolve6({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
         }
       );
     } catch {
-      resolve6(false);
+      resolve6({ ok: false, needsAdmin: false });
+    }
+  });
+}
+function adminInstallCommand() {
+  return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
+}
+function runningAsRoot() {
+  return process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0;
+}
+function ownNodeModules() {
+  let dir = dirname2(fileURLToPath2(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    if (dir.endsWith(`${sep}node_modules`)) return dir;
+    dir = parent;
+  }
+  return null;
+}
+function globalInstallCheck() {
+  prefixCheck ??= new Promise((resolve6) => {
+    try {
+      const dir = ownNodeModules();
+      if (!dir) return resolve6({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve6({ writable: !e, dir }));
+    } catch {
+      resolve6({ writable: null, dir: null });
     }
   });
+  return prefixCheck;
+}
+function adminUpdateSteps() {
+  return [`  ${adminInstallCommand()}`, `  solongate repair${process.platform === "win32" ? "" : "   (this one WITHOUT sudo)"}`];
+}
+async function updateNow() {
+  const cur = currentVersion();
+  const latest = await fetchLatest();
+  if (!latest) return { status: "unreachable", version: cur };
+  if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  if ((await globalInstallCheck()).writable === false) {
+    writeState({ ...readState(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  const r = await runGlobalInstall2(latest);
+  if (r.ok) {
+    writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
+    return { status: "updated", version: latest };
+  }
+  if (r.needsAdmin) {
+    writeState({ ...readState(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  return { status: "failed", version: latest };
+}
+async function runAutoUpdateCommand(arg) {
+  const out2 = (s) => void process.stderr.write(s + "\n");
+  const envForced = autoUpdateForcedByEnv();
+  if (arg === void 0) {
+    out2(`  auto-update is ${autoUpdateEnabled() ? "on" : "off"}${envForced ? "  (forced by SOLONGATE_AUTO_UPDATE)" : ""}`);
+    out2("  change it with: solongate update auto on|off");
+    return 0;
+  }
+  const v = arg.trim().toLowerCase();
+  const on = ["on", "1", "true", "yes", "enable", "enabled"].includes(v);
+  const off = ["off", "0", "false", "no", "disable", "disabled"].includes(v);
+  if (!on && !off) {
+    out2(`  unknown value "${arg}" \u2014 use: solongate update auto on|off`);
+    return 1;
+  }
+  setAutoUpdate(on);
+  out2(on ? "  \u2713 auto-update on \u2014 new versions install in the background" : "  \u2713 auto-update off \u2014 update with: solongate update");
+  if (on && (await globalInstallCheck()).writable === false) {
+    out2("");
+    out2("  Heads up: npm\u2019s global folder needs admin rights on this machine, so a");
+    out2("  background install cannot succeed here. Updates will still be announced,");
+    out2("  and installing them takes:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+  }
+  if (envForced) out2(`  note: SOLONGATE_AUTO_UPDATE is set and overrides this while it stays set`);
+  return 0;
 }
 async function tuiUpdateFlow(onStatus) {
   try {
@@ -7075,10 +7218,22 @@ async function tuiUpdateFlow(onStatus) {
       onStatus({ kind: "updated", version: latest });
       return;
     }
+    if (!autoUpdateEnabled()) {
+      onStatus({ kind: "available", version: latest });
+      return;
+    }
+    if (readState().needsAdmin === latest) {
+      onStatus({ kind: "needs-admin", version: latest });
+      return;
+    }
     onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall2(latest)) {
-      writeState({ ...readState(), installed: latest });
+    const r = await runGlobalInstall2(latest);
+    if (r.ok) {
+      writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
       onStatus({ kind: "updated", version: latest });
+    } else if (r.needsAdmin) {
+      writeState({ ...readState(), needsAdmin: latest });
+      onStatus({ kind: "needs-admin", version: latest });
     }
   } catch {
   }
@@ -7097,17 +7252,27 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
       }
       if (!latest || !newerThan(latest, current)) return;
       const attempts = readState().attempts ?? {};
-      if (now - (attempts[latest] ?? 0) >= ATTEMPT_EVERY_MS) {
-        writeState({ ...readState(), attempts: { [latest]: now } });
-        if (spawnGlobalInstall(latest)) {
-          notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
-        }
+      if (now - (attempts[latest] ?? 0) < ATTEMPT_EVERY_MS) return;
+      writeState({ ...readState(), attempts: { [latest]: now } });
+      const needsAdmin = (await globalInstallCheck()).writable === false;
+      const head = `${c.dim}\u2191 solongate v${latest} available (running v${current})`;
+      if (needsAdmin) {
+        notify(`${head} \u2014 needs admin rights on this machine:${c.reset}`);
+        for (const s of adminUpdateSteps()) notify(`${c.cyan}  ${s.trim()}${c.reset}`);
+        return;
+      }
+      if (!autoUpdateEnabled()) {
+        notify(`${head} \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
+        return;
+      }
+      if (spawnGlobalInstall(latest)) {
+        notify(`${head} \u2014 updating in the background, next run uses it${c.reset}`);
       }
     } catch {
     }
   })();
 }
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE;
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE, prefixCheck;
 var init_self_update = __esm({
   "src/self-update.ts"() {
     "use strict";
@@ -7117,6 +7282,8 @@ var init_self_update = __esm({
     ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
     STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
     LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
+    NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
+    prefixCheck = null;
   }
 });
 
@@ -11458,6 +11625,19 @@ function SettingsPanel({
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
   const [diagBusy, setDiagBusy] = useState8(null);
+  const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
+  const [updBusy, setUpdBusy] = useState8(false);
+  const [canInstall, setCanInstall] = useState8(null);
+  useEffect7(() => {
+    let live2 = true;
+    globalInstallCheck().then((r) => {
+      if (live2) setCanInstall(r.writable);
+    }).catch(() => {
+    });
+    return () => {
+      live2 = false;
+    };
+  }, []);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -11515,10 +11695,10 @@ function SettingsPanel({
   }, []);
   useEffect7(() => {
     const loggingIn = login && login.phase !== "done" && login.phase !== "error";
-    if (!loggingIn && !diagBusy) return;
+    if (!loggingIn && !diagBusy && !updBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login, diagBusy]);
+  }, [login, diagBusy, updBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -11552,6 +11732,8 @@ function SettingsPanel({
       { kind: "self" },
       { kind: "doctor" },
       { kind: "repair" },
+      { kind: "cli-update" },
+      { kind: "auto-update" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -11731,6 +11913,46 @@ function SettingsPanel({
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+    } else if (r.kind === "cli-update") {
+      if (updBusy) return;
+      setUpdBusy(true);
+      setMsg({ text: "updating\u2026", level: "ok" });
+      setDiag(null);
+      void (async () => {
+        try {
+          const res = await updateNow();
+          if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
+          else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
+          else if (res.status === "needs-admin") {
+            setMsg({ text: `\u2717 v${res.version} needs admin rights \u2014 run the two commands below`, level: "bad" });
+            setDiag({
+              of: "cli-update",
+              lines: [
+                { text: "npm\u2019s global folder belongs to root on this machine (the usual macOS", level: "warn" },
+                { text: "setup), so SolonGate cannot install there by itself. In a terminal:", level: "warn" },
+                ...adminUpdateSteps().map((s) => ({ text: s.trim(), level: "ok" })),
+                { text: "run repair WITHOUT sudo, or the guard hooks land in root\u2019s home", level: "dim" }
+              ]
+            });
+          } else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
+          setLatest(await latestVersion());
+          setCanInstall((await globalInstallCheck()).writable);
+        } finally {
+          setUpdBusy(false);
+        }
+      })();
+    } else if (r.kind === "auto-update") {
+      if (autoUpdateForcedByEnv()) {
+        setMsg({ text: "SOLONGATE_AUTO_UPDATE is set \u2014 unset it to change this here", level: "bad" });
+        return;
+      }
+      const next = !autoUp;
+      setAutoUpdate(next);
+      setAutoUp(next);
+      setMsg(
+        next ? canInstall === false ? { text: "\u2713 auto-update on \u2014 but npm needs sudo here, so it still cannot install on its own", level: "bad" } : { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+      );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
@@ -11829,7 +12051,7 @@ function SettingsPanel({
           if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
-        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
+        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
           if (cur.kind === "alert") run10(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
@@ -12041,6 +12263,25 @@ function SettingsPanel({
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
           diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
         ] });
+      case "cli-update": {
+        const behind = latest ? newerThan(latest, ver) : false;
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind && canInstall === false ? (
+            // Said before they press enter, not after a minute of npm noise.
+            /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `   v${latest} on npm \xB7 needs sudo here \xB7 enter shows how` })
+          ) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+        ] });
+      }
+      case "auto-update":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
+          onOff(autoUp),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : canInstall === false ? "   cannot work here: npm needs sudo, so updates stay manual \xB7 enter toggles" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -12093,10 +12334,11 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
+    UPDATES: "the solongate CLI itself \xB7 background auto-update is off unless you turn it on",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -12137,7 +12379,7 @@ function SettingsPanel({
         lineKey.push("");
       });
     }
-    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair" || r.kind === "cli-update" && diag.of === "cli-update")) {
       diag.lines.forEach((l, i) => {
         lineEls.push(
           /* @__PURE__ */ jsx8(
@@ -12165,7 +12407,7 @@ function SettingsPanel({
   lineEls.push(
     /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", color: theme.dim, children: [
       `solongate v${ver}`,
-      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 auto-updating` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
+      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 ${autoUp ? "auto-updating" : "UPDATES above"}` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
     ] }, "ver")
   );
   lineKey.push("");
@@ -12394,7 +12636,7 @@ function App() {
           // a row off whichever panel is open.
           /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
         ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {
@@ -17025,7 +17267,8 @@ function printHelp() {
   console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
-  cmd("update", "update SolonGate to the newest version and refresh the guard");
+  cmd("update", "update SolonGate and refresh the guard (tells you if it needs sudo)");
+  cmd("update auto on|off", "background auto-update (default off \u2014 on macOS npm -g often needs sudo)");
   cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
   cmd("doctor --json", "the same health check as machine-readable JSON");
@@ -17173,6 +17416,10 @@ async function main() {
     return;
   }
   if (subcommand === "update") {
+    if (process.argv[3] === "auto") {
+      const { runAutoUpdateCommand: runAutoUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
+      process.exit(await runAutoUpdateCommand2(process.argv[4]));
+    }
     const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
     process.exit(await runUpdateCommand2());
   }

package/dist/self-update.d.ts

@@ -1,30 +1,77 @@
+/**
+ * Is the background updater turned on? Default: NO — see the file header.
+ * SOLONGATE_AUTO_UPDATE=on|off (1/0, true/false) overrides the stored setting
+ * for one run, so a CI image or a managed fleet can force either way without
+ * writing to the user's home directory.
+ */
+export declare function autoUpdateEnabled(): boolean;
+/** True when the env var is deciding, so the UI can say the row is overridden. */
+export declare function autoUpdateForcedByEnv(): boolean;
+/** Turn the background updater on/off. Clears the "npm refused" memo on enable. */
+export declare function setAutoUpdate(on: boolean): void;
 export declare function currentVersion(): string;
 /** true when `b` is a strictly newer semver than `a` (numeric triples only). */
 export declare function newerThan(b: string, a: string): boolean;
 /** The latest version published to npm, or null if it can't be reached. */
 export declare function latestVersion(): Promise<string | null>;
-/** Foreground global install — resolves true on success, output → update log. */
 /**
- * `solongate update` — explicit, visible update instead of waiting for the
- * background auto-update: installs the newest CLI globally, then refreshes the
- * installed guard hooks. Returns a process exit code.
+ * `solongate update` — the normal way to update, and the ONLY way when the
+ * background updater is off (which is the default): installs the newest CLI
+ * globally, then refreshes the installed guard hooks. Returns a process exit
+ * code.
  */
 export declare function runUpdateCommand(): Promise<number>;
+/** The exact command that fixes a root-owned global prefix. */
+export declare function adminInstallCommand(): string;
+/** Are we root — i.e. did someone run this under sudo? */
+export declare function runningAsRoot(): boolean;
+export declare function globalInstallCheck(): Promise<{
+    writable: boolean | null;
+    dir: string | null;
+}>;
+/**
+ * The two commands that update SolonGate on a machine whose global npm folder
+ * belongs to root. `repair` is deliberately NOT under sudo: it writes the guard
+ * hooks into the invoking user's home, so as root it would arm root's home and
+ * leave the actual user unguarded.
+ */
+export declare function adminUpdateSteps(): string[];
+/**
+ * Install the newest version NOW, whatever the auto-update setting says — the
+ * dataroom's UPDATES row and `solongate update` both run through here.
+ */
+export declare function updateNow(): Promise<{
+    status: 'updated' | 'current' | 'needs-admin' | 'unreachable' | 'failed';
+    version: string;
+}>;
+/**
+ * `solongate update auto [on|off]` — show or change the background updater.
+ * Kept separate from `runUpdateCommand` so `solongate update` stays "update me
+ * now" and never changes a setting as a side effect.
+ */
+export declare function runAutoUpdateCommand(arg?: string): Promise<number>;
 /** What the dataroom shows about the updater. */
 export type UpdateStatus = {
     kind: 'idle';
+} | {
+    kind: 'available';
+    version: string;
 } | {
     kind: 'updating';
     version: string;
 } | {
     kind: 'updated';
     version: string;
+} | {
+    kind: 'needs-admin';
+    version: string;
 };
 /**
- * The dataroom's updater (Claude Code-style): check the registry EVERY time the
- * TUI opens (and periodically while it stays open), install the new version in
- * the background, then tell the user to restart. `onStatus` drives the in-app
- * status line; nothing is ever written to the terminal directly.
+ * The dataroom's updater: check the registry EVERY time the TUI opens (and
+ * periodically while it stays open). With auto-update ON, install in the
+ * background and ask for a restart; with it OFF (the default), only report that
+ * a version is available. `onStatus` drives the in-app status line; nothing is
+ * ever written to the terminal directly.
  */
 export declare function tuiUpdateFlow(onStatus: (s: UpdateStatus) => void): Promise<void>;
 /**

package/dist/tui/index.js

@@ -4495,15 +4495,16 @@ function stopLogsServerDaemon() {
 
 // src/self-update.ts
 import { execFile, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
-import { mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { access, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7, constants as FS } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname3, join as join9 } from "path";
+import { dirname as dirname3, join as join9, sep } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var PKG = "@solongate/proxy";
 var CHECK_EVERY_MS = 30 * 60 * 1e3;
 var ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
 var STATE_FILE2 = join9(homedir9(), ".solongate", ".self-update.json");
 var LOG_FILE2 = join9(homedir9(), ".solongate", "self-update.log");
+var NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
 function readState2() {
   try {
     const s = JSON.parse(readFileSync7(STATE_FILE2, "utf-8"));
@@ -4519,6 +4520,20 @@ function writeState2(s) {
   } catch {
   }
 }
+function autoUpdateEnabled() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  if (env === "1" || env === "true" || env === "on" || env === "yes") return true;
+  if (env === "0" || env === "false" || env === "off" || env === "no") return false;
+  return readState2().auto === true;
+}
+function autoUpdateForcedByEnv() {
+  const env = (process.env.SOLONGATE_AUTO_UPDATE ?? "").trim().toLowerCase();
+  return ["1", "true", "on", "yes", "0", "false", "off", "no"].includes(env);
+}
+function setAutoUpdate(on) {
+  const s = readState2();
+  writeState2(on ? { ...s, auto: true, needsAdmin: void 0 } : { ...s, auto: false });
+}
 function currentVersion() {
   try {
     const pkg = JSON.parse(readFileSync7(join9(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
@@ -4564,20 +4579,70 @@ function runGlobalInstall(version) {
         ["install", "-g", `${PKG}@${version}`],
         { timeout: 3e5, windowsHide: true, shell: process.platform === "win32" },
         (err2, stdout, stderr) => {
+          const output = `${stdout}
+${stderr}`;
           try {
             writeFileSync7(LOG_FILE2, `${(/* @__PURE__ */ new Date()).toISOString()} install ${version}: ${err2 ? "FAILED" : "ok"}
-${stdout}
-${stderr}
+${output}
 `, { flag: "a" });
           } catch {
           }
-          resolve3(!err2);
+          resolve3({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
         }
       );
     } catch {
-      resolve3(false);
+      resolve3({ ok: false, needsAdmin: false });
+    }
+  });
+}
+function adminInstallCommand() {
+  return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
+}
+function ownNodeModules() {
+  let dir = dirname3(fileURLToPath3(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const parent = dirname3(dir);
+    if (parent === dir) break;
+    if (dir.endsWith(`${sep}node_modules`)) return dir;
+    dir = parent;
+  }
+  return null;
+}
+var prefixCheck = null;
+function globalInstallCheck() {
+  prefixCheck ??= new Promise((resolve3) => {
+    try {
+      const dir = ownNodeModules();
+      if (!dir) return resolve3({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve3({ writable: !e, dir }));
+    } catch {
+      resolve3({ writable: null, dir: null });
     }
   });
+  return prefixCheck;
+}
+function adminUpdateSteps() {
+  return [`  ${adminInstallCommand()}`, `  solongate repair${process.platform === "win32" ? "" : "   (this one WITHOUT sudo)"}`];
+}
+async function updateNow() {
+  const cur = currentVersion();
+  const latest = await fetchLatest();
+  if (!latest) return { status: "unreachable", version: cur };
+  if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  if ((await globalInstallCheck()).writable === false) {
+    writeState2({ ...readState2(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  const r = await runGlobalInstall(latest);
+  if (r.ok) {
+    writeState2({ ...readState2(), installed: latest, needsAdmin: void 0 });
+    return { status: "updated", version: latest };
+  }
+  if (r.needsAdmin) {
+    writeState2({ ...readState2(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
+  return { status: "failed", version: latest };
 }
 async function tuiUpdateFlow(onStatus) {
   try {
@@ -4590,10 +4655,22 @@ async function tuiUpdateFlow(onStatus) {
       onStatus({ kind: "updated", version: latest });
       return;
     }
+    if (!autoUpdateEnabled()) {
+      onStatus({ kind: "available", version: latest });
+      return;
+    }
+    if (readState2().needsAdmin === latest) {
+      onStatus({ kind: "needs-admin", version: latest });
+      return;
+    }
     onStatus({ kind: "updating", version: latest });
-    if (await runGlobalInstall(latest)) {
-      writeState2({ ...readState2(), installed: latest });
+    const r = await runGlobalInstall(latest);
+    if (r.ok) {
+      writeState2({ ...readState2(), installed: latest, needsAdmin: void 0 });
       onStatus({ kind: "updated", version: latest });
+    } else if (r.needsAdmin) {
+      writeState2({ ...readState2(), needsAdmin: latest });
+      onStatus({ kind: "needs-admin", version: latest });
     }
   } catch {
   }
@@ -4654,6 +4731,19 @@ function SettingsPanel({
   const [editor, setEditor] = useState8(null);
   const [latest, setLatest] = useState8(null);
   const [diagBusy, setDiagBusy] = useState8(null);
+  const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
+  const [updBusy, setUpdBusy] = useState8(false);
+  const [canInstall, setCanInstall] = useState8(null);
+  useEffect7(() => {
+    let live2 = true;
+    globalInstallCheck().then((r) => {
+      if (live2) setCanInstall(r.writable);
+    }).catch(() => {
+    });
+    return () => {
+      live2 = false;
+    };
+  }, []);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -4711,10 +4801,10 @@ function SettingsPanel({
   }, []);
   useEffect7(() => {
     const loggingIn = login && login.phase !== "done" && login.phase !== "error";
-    if (!loggingIn && !diagBusy) return;
+    if (!loggingIn && !diagBusy && !updBusy) return;
     const t = setInterval(() => setTick((n) => n + 1), 120);
     return () => clearInterval(t);
-  }, [login, diagBusy]);
+  }, [login, diagBusy, updBusy]);
   const localQ = useLoader(() => listAccounts().length ? api.settings.getLocalLogs() : Promise.resolve(null));
   const whQ = useLoader(() => listAccounts().length ? api.settings.getWebhooks() : Promise.resolve(null));
   const alertQ = useLoader(() => listAccounts().length ? api.settings.getAlerts() : Promise.resolve(null));
@@ -4748,6 +4838,8 @@ function SettingsPanel({
       { kind: "self" },
       { kind: "doctor" },
       { kind: "repair" },
+      { kind: "cli-update" },
+      { kind: "auto-update" },
       { kind: "ll-enabled" },
       { kind: "ll-path" },
       { kind: "ll-server" },
@@ -4927,6 +5019,46 @@ function SettingsPanel({
     } else if (r.kind === "self") {
       if (!selfProt) return;
       run(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+    } else if (r.kind === "cli-update") {
+      if (updBusy) return;
+      setUpdBusy(true);
+      setMsg({ text: "updating\u2026", level: "ok" });
+      setDiag(null);
+      void (async () => {
+        try {
+          const res = await updateNow();
+          if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
+          else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
+          else if (res.status === "needs-admin") {
+            setMsg({ text: `\u2717 v${res.version} needs admin rights \u2014 run the two commands below`, level: "bad" });
+            setDiag({
+              of: "cli-update",
+              lines: [
+                { text: "npm\u2019s global folder belongs to root on this machine (the usual macOS", level: "warn" },
+                { text: "setup), so SolonGate cannot install there by itself. In a terminal:", level: "warn" },
+                ...adminUpdateSteps().map((s) => ({ text: s.trim(), level: "ok" })),
+                { text: "run repair WITHOUT sudo, or the guard hooks land in root\u2019s home", level: "dim" }
+              ]
+            });
+          } else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
+          setLatest(await latestVersion());
+          setCanInstall((await globalInstallCheck()).writable);
+        } finally {
+          setUpdBusy(false);
+        }
+      })();
+    } else if (r.kind === "auto-update") {
+      if (autoUpdateForcedByEnv()) {
+        setMsg({ text: "SOLONGATE_AUTO_UPDATE is set \u2014 unset it to change this here", level: "bad" });
+        return;
+      }
+      const next = !autoUp;
+      setAutoUpdate(next);
+      setAutoUp(next);
+      setMsg(
+        next ? canInstall === false ? { text: "\u2713 auto-update on \u2014 but npm needs sudo here, so it still cannot install on its own", level: "bad" } : { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+      );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
       if (!local.enabled && !local.path.trim()) {
@@ -5025,7 +5157,7 @@ function SettingsPanel({
           if (ok) clearLocalLog();
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
-        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
+        } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
           if (cur.kind === "alert") run(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
@@ -5237,6 +5369,25 @@ function SettingsPanel({
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "repair".padEnd(11) }),
           diagBusy === "repair" ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `${spin} restoring protection\u2026` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "restore every protection file after tampering or deletion \xB7 enter runs it" })
         ] });
+      case "cli-update": {
+        const behind = latest ? newerThan(latest, ver) : false;
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
+          /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind && canInstall === false ? (
+            // Said before they press enter, not after a minute of npm noise.
+            /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `   v${latest} on npm \xB7 needs sudo here \xB7 enter shows how` })
+          ) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+        ] });
+      }
+      case "auto-update":
+        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
+          cursor(r),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
+          onOff(autoUp),
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : canInstall === false ? "   cannot work here: npm needs sudo, so updates stay manual \xB7 enter toggles" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+        ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -5289,10 +5440,11 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
+    UPDATES: "the solongate CLI itself \xB7 background auto-update is off unless you turn it on",
     "LOCAL LOGS": "mirror every decision to a file + dashboard link",
     WEBHOOKS: `POST events to a URL (${webhooks.length}) \xB7 t tests`,
     ALERTS: `one email + one telegram (${alerts.length}) \xB7 enter edits \xB7 m on/off`
@@ -5333,7 +5485,7 @@ function SettingsPanel({
         lineKey.push("");
       });
     }
-    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair" || r.kind === "cli-update" && diag.of === "cli-update")) {
       diag.lines.forEach((l, i) => {
         lineEls.push(
           /* @__PURE__ */ jsx8(
@@ -5361,7 +5513,7 @@ function SettingsPanel({
   lineEls.push(
     /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", color: theme.dim, children: [
       `solongate v${ver}`,
-      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 auto-updating` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
+      latest ? newerThan(latest, ver) ? /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `  \xB7 v${latest} on npm \u2014 ${autoUp ? "auto-updating" : "UPDATES above"}` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.ok, children: "  \xB7 latest" }) : null
     ] }, "ver")
   );
   lineKey.push("");
@@ -5566,7 +5718,7 @@ function App() {
           // a row off whichever panel is open.
           /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
         ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
-        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : null
+        update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
         /* @__PURE__ */ jsx9(Box9, { flexDirection: "column", flexShrink: 0, width: 16, borderStyle: "round", borderColor: focus === "nav" ? theme.accent : "gray", paddingX: 1, children: SECTIONS.map((s, i) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.2",
+  "version": "0.83.4",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {