@solongate/proxy 0.83.3 → 0.83.5

package/dist/index.js

@@ -465,13 +465,13 @@ ${offset}${err2}${errEnd}`;
         return next >= src.length || src[next] === "\n" ? str + "\n" : str;
       }
       // ^(---|...)
-      static atDocumentBoundary(src, offset, sep) {
+      static atDocumentBoundary(src, offset, sep2) {
         const ch0 = src[offset];
         if (!ch0) return true;
         const prev = src[offset - 1];
         if (prev && prev !== "\n") return false;
-        if (sep) {
-          if (ch0 !== sep) return false;
+        if (sep2) {
+          if (ch0 !== sep2) return false;
         } else {
           if (ch0 !== Char.DIRECTIVES_END && ch0 !== Char.DOCUMENT_END) return false;
         }
@@ -1647,7 +1647,7 @@ var require_parse_cst = __commonJS({
         const folded = this.type === PlainValue.Type.BLOCK_FOLDED;
         let atStart = true;
         let str = "";
-        let sep = "";
+        let sep2 = "";
         let prevMoreIndented = false;
         for (let i = start; i < end; ++i) {
           for (let j = 0; j < bi; ++j) {
@@ -1656,21 +1656,21 @@ var require_parse_cst = __commonJS({
           }
           const ch2 = src[i];
           if (ch2 === "\n") {
-            if (sep === "\n") str += "\n";
-            else sep = "\n";
+            if (sep2 === "\n") str += "\n";
+            else sep2 = "\n";
           } else {
             const lineEnd = PlainValue.Node.endOfLine(src, i);
             const line = src.slice(i, lineEnd);
             i = lineEnd;
             if (folded && (ch2 === " " || ch2 === "	") && i < keepStart) {
-              if (sep === " ") sep = "\n";
-              else if (!prevMoreIndented && !atStart && sep === "\n") sep = "\n\n";
-              str += sep + line;
-              sep = lineEnd < end && src[lineEnd] || "";
+              if (sep2 === " ") sep2 = "\n";
+              else if (!prevMoreIndented && !atStart && sep2 === "\n") sep2 = "\n\n";
+              str += sep2 + line;
+              sep2 = lineEnd < end && src[lineEnd] || "";
               prevMoreIndented = true;
             } else {
-              str += sep + line;
-              sep = folded && i < keepStart ? " " : "\n";
+              str += sep2 + line;
+              sep2 = folded && i < keepStart ? " " : "\n";
               prevMoreIndented = false;
             }
             if (atStart && line !== "") atStart = false;
@@ -6612,6 +6612,16 @@ function repairQuiet() {
 }
 async function runRepair() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0 && process.env["SOLONGATE_INTERNAL"] !== "1") {
+    out2("");
+    out2("  Do not run `solongate repair` with sudo.");
+    out2("  It installs the guard into your home directory, and as root it would");
+    out2(`  arm root\u2019s home instead${process.env["SUDO_USER"] ? ` of ${process.env["SUDO_USER"]}\u2019s` : ""} \u2014 reporting success while nothing changed for you.`);
+    out2("");
+    out2("  Run it as yourself:  solongate repair");
+    out2("");
+    return 1;
+  }
   const rep = repairQuiet();
   out2("");
   out2("  SolonGate repair");
@@ -6924,22 +6934,25 @@ var init_global_install = __esm({
 var self_update_exports = {};
 __export(self_update_exports, {
   adminInstallCommand: () => adminInstallCommand,
+  adminUpdateSteps: () => adminUpdateSteps,
   autoUpdateEnabled: () => autoUpdateEnabled,
   autoUpdateForcedByEnv: () => autoUpdateForcedByEnv,
   currentVersion: () => currentVersion,
+  globalInstallCheck: () => globalInstallCheck,
   latestVersion: () => latestVersion,
   maybeSelfUpdate: () => maybeSelfUpdate,
   newerThan: () => newerThan,
   runAutoUpdateCommand: () => runAutoUpdateCommand,
   runUpdateCommand: () => runUpdateCommand,
+  runningAsRoot: () => runningAsRoot,
   setAutoUpdate: () => setAutoUpdate,
   tuiUpdateFlow: () => tuiUpdateFlow,
   updateNow: () => updateNow
 });
 import { execFile, execFileSync as execFileSync3, spawn } from "child_process";
-import { mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, constants as FS } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join5, sep } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readState() {
   try {
@@ -7026,6 +7039,17 @@ function spawnGlobalInstall(version) {
 }
 async function runUpdateCommand() {
   const out2 = (s) => void process.stderr.write(s + "\n");
+  if (runningAsRoot()) {
+    out2("");
+    out2("  Do not run `solongate update` with sudo.");
+    out2("  npm would install fine, but the guard hooks would be written into root\u2019s");
+    out2("  home instead of yours, and your agents would stop being guarded.");
+    out2("");
+    out2("  Run these two instead:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+    out2("");
+    return 1;
+  }
   const cur = currentVersion();
   out2(`  current  ${cur}`);
   const latest = await latestVersion();
@@ -7034,13 +7058,26 @@ async function runUpdateCommand() {
     return 1;
   }
   if (newerThan(latest, cur)) {
+    const pre = await globalInstallCheck();
+    if (pre.writable === false) {
+      writeState({ ...readState(), needsAdmin: latest });
+      out2(`  v${latest} is out, but npm\u2019s global folder needs admin rights on this machine:`);
+      out2(`    ${pre.dir}`);
+      out2("  That is the normal macOS setup \u2014 SolonGate cannot install there on its own.");
+      out2("");
+      out2("  Run these two:");
+      for (const s of adminUpdateSteps()) out2("  " + s);
+      out2("");
+      return 1;
+    }
     out2(`  updating ${cur} -> ${latest} ...`);
     const r = await runGlobalInstall2(latest);
     if (!r.ok) {
       if (r.needsAdmin) {
         writeState({ ...readState(), needsAdmin: latest });
-        out2(`  npm could not write to the global folder (it needs admin rights).`);
-        out2(`  Run:  ${adminInstallCommand()}`);
+        out2("  npm could not write to the global folder (it needs admin rights).");
+        out2("  Run these two:");
+        for (const s of adminUpdateSteps()) out2("  " + s);
       } else {
         out2("  update failed. Try: npm i -g @solongate/proxy@latest");
       }
@@ -7095,11 +7132,43 @@ ${output}
 function adminInstallCommand() {
   return process.platform === "win32" ? `npm i -g ${PKG}@latest  (in an Administrator terminal)` : `sudo npm i -g ${PKG}@latest`;
 }
+function runningAsRoot() {
+  return process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0;
+}
+function ownNodeModules() {
+  let dir = dirname2(fileURLToPath2(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    if (dir.endsWith(`${sep}node_modules`)) return dir;
+    dir = parent;
+  }
+  return null;
+}
+function globalInstallCheck() {
+  prefixCheck ??= new Promise((resolve6) => {
+    try {
+      const dir = ownNodeModules();
+      if (!dir) return resolve6({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve6({ writable: !e, dir }));
+    } catch {
+      resolve6({ writable: null, dir: null });
+    }
+  });
+  return prefixCheck;
+}
+function adminUpdateSteps() {
+  return [`  ${adminInstallCommand()}`, `  solongate repair${process.platform === "win32" ? "" : "   (this one WITHOUT sudo)"}`];
+}
 async function updateNow() {
   const cur = currentVersion();
   const latest = await fetchLatest();
   if (!latest) return { status: "unreachable", version: cur };
   if (!newerThan(latest, cur)) return { status: "current", version: cur };
+  if ((await globalInstallCheck()).writable === false) {
+    writeState({ ...readState(), needsAdmin: latest });
+    return { status: "needs-admin", version: latest };
+  }
   const r = await runGlobalInstall2(latest);
   if (r.ok) {
     writeState({ ...readState(), installed: latest, needsAdmin: void 0 });
@@ -7111,7 +7180,7 @@ async function updateNow() {
   }
   return { status: "failed", version: latest };
 }
-function runAutoUpdateCommand(arg) {
+async function runAutoUpdateCommand(arg) {
   const out2 = (s) => void process.stderr.write(s + "\n");
   const envForced = autoUpdateForcedByEnv();
   if (arg === void 0) {
@@ -7128,6 +7197,13 @@ function runAutoUpdateCommand(arg) {
   }
   setAutoUpdate(on);
   out2(on ? "  \u2713 auto-update on \u2014 new versions install in the background" : "  \u2713 auto-update off \u2014 update with: solongate update");
+  if (on && (await globalInstallCheck()).writable === false) {
+    out2("");
+    out2("  Heads up: npm\u2019s global folder needs admin rights on this machine, so a");
+    out2("  background install cannot succeed here. Updates will still be announced,");
+    out2("  and installing them takes:");
+    for (const s of adminUpdateSteps()) out2("  " + s);
+  }
   if (envForced) out2(`  note: SOLONGATE_AUTO_UPDATE is set and overrides this while it stays set`);
   return 0;
 }
@@ -7178,18 +7254,25 @@ function maybeSelfUpdate(notify = (l) => process.stderr.write(l + "\n")) {
       const attempts = readState().attempts ?? {};
       if (now - (attempts[latest] ?? 0) < ATTEMPT_EVERY_MS) return;
       writeState({ ...readState(), attempts: { [latest]: now } });
+      const needsAdmin = (await globalInstallCheck()).writable === false;
+      const head = `${c.dim}\u2191 solongate v${latest} available (running v${current})`;
+      if (needsAdmin) {
+        notify(`${head} \u2014 needs admin rights on this machine:${c.reset}`);
+        for (const s of adminUpdateSteps()) notify(`${c.cyan}  ${s.trim()}${c.reset}`);
+        return;
+      }
       if (!autoUpdateEnabled()) {
-        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
+        notify(`${head} \u2014 run ${c.reset}${c.cyan}solongate update${c.reset}`);
         return;
       }
       if (spawnGlobalInstall(latest)) {
-        notify(`${c.dim}\u2191 solongate v${latest} available (running v${current}) \u2014 updating in the background, next run uses it${c.reset}`);
+        notify(`${head} \u2014 updating in the background, next run uses it${c.reset}`);
       }
     } catch {
     }
   })();
 }
-var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE;
+var PKG, CHECK_EVERY_MS, ATTEMPT_EVERY_MS, STATE_FILE, LOG_FILE, NEEDS_ADMIN_RE, prefixCheck;
 var init_self_update = __esm({
   "src/self-update.ts"() {
     "use strict";
@@ -7200,6 +7283,7 @@ var init_self_update = __esm({
     STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
     LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
     NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
+    prefixCheck = null;
   }
 });
 
@@ -7632,26 +7716,6 @@ var init_local_log = __esm({
 });
 
 // src/api-client/client.ts
-var client_exports = {};
-__export(client_exports, {
-  ApiError: () => ApiError,
-  DEFAULT_API_URL: () => DEFAULT_API_URL2,
-  GUEST_EMAIL_SUFFIX: () => GUEST_EMAIL_SUFFIX,
-  GuestReadOnlyError: () => GuestReadOnlyError,
-  NotAuthenticatedError: () => NotAuthenticatedError,
-  clearActiveCredential: () => clearActiveCredential,
-  enforcingKey: () => enforcingKey,
-  isActiveAccount: () => isActiveAccount,
-  isAuthenticated: () => isAuthenticated,
-  isGuestAccount: () => isGuestAccount,
-  listAccounts: () => listAccounts,
-  removeAccount: () => removeAccount,
-  request: () => request,
-  resolveCredentials: () => resolveCredentials,
-  saveAccount: () => saveAccount,
-  setActiveAccount: () => setActiveAccount,
-  setViewCredentials: () => setViewCredentials
-});
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
 import { resolve as resolve4, join as join9 } from "path";
 import { homedir as homedir7 } from "os";
@@ -7703,15 +7767,6 @@ function setViewCredentials(creds) {
   viewOverride = creds;
   cached2 = null;
 }
-function isGuestAccount() {
-  try {
-    const active2 = loginCredentialFile().apiKey;
-    if (!active2) return false;
-    return listAccounts().some((a) => a.apiKey === active2 && (a.email ?? "").endsWith(GUEST_EMAIL_SUFFIX));
-  } catch {
-    return false;
-  }
-}
 function enforcingKey() {
   return loginCredentialFile().apiKey ?? null;
 }
@@ -7814,9 +7869,6 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function request(method, path, opts = {}) {
-  if (method !== "GET" && isGuestAccount()) {
-    throw new GuestReadOnlyError();
-  }
   const creds = resolveCredentials(opts.apiUrl);
   const url = buildUrl(creds.apiUrl, path, opts.query);
   const headers = {
@@ -7872,7 +7924,7 @@ async function request(method, path, opts = {}) {
   }
   return json;
 }
-var DEFAULT_API_URL2, accountsFile, viewOverride, GUEST_EMAIL_SUFFIX, ApiError, GuestReadOnlyError, NotAuthenticatedError, cached2;
+var DEFAULT_API_URL2, accountsFile, viewOverride, ApiError, NotAuthenticatedError, cached2;
 var init_client = __esm({
   "src/api-client/client.ts"() {
     "use strict";
@@ -7880,7 +7932,6 @@ var init_client = __esm({
     DEFAULT_API_URL2 = "https://api.solongate.com";
     accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
     viewOverride = null;
-    GUEST_EMAIL_SUFFIX = "@anonymous.solongate.invalid";
     ApiError = class extends Error {
       status;
       code;
@@ -7891,12 +7942,6 @@ var init_client = __esm({
         this.code = code;
       }
     };
-    GuestReadOnlyError = class extends Error {
-      constructor() {
-        super("Guest account: sign up at auth.solongate.com to change anything. Your project, its policy and everything recorded carry over.");
-        this.name = "GuestReadOnlyError";
-      }
-    };
     NotAuthenticatedError = class extends Error {
       constructor() {
         super("Not logged in. Run `solongate` and log in from the Accounts panel.");
@@ -9237,18 +9282,18 @@ function LivePanel({ active: active2 }) {
       }
     ) : null,
     activeAction ? /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", backgroundColor: activeAction.level === "bad" ? "#3d1220" : "#123d1f", color: activeAction.level === "bad" ? "#ff6b6b" : "#7bd88f", bold: true, children: ` ${truncate2(activeAction.text, innerW - 4)} ` }) : null,
-    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, marginRight: 2, children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: 1 + chartH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: leftW, height: 1 + chartH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "TRAFFIC", extra: `${trafficLabel} \xB7 peak ${Math.max(0, ...traffic)} \xB7 red = denials`, width: leftW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: traffic, hot: trafficHot, height: chartH, width: leftW, color: theme.accent })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: rightW, height: 1 + chartH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "API LATENCY", extra: `now ${latNow}ms \xB7 med ${latMed}ms \xB7 amber >${Math.round(latHotAt)}ms`, width: rightW }),
         /* @__PURE__ */ jsx2(ColumnChart, { series: lat, hot: lat.map((v) => v > latHotAt), height: chartH, width: rightW, color: "white", hotColor: "#ffb454" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs2(Box2, { height: colH, children: [
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+    /* @__PURE__ */ jsxs2(Box2, { height: colH, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "LAYERS", extra: "l = inspect", width: colW }),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "RATELIMIT ".padEnd(10) }),
@@ -9261,7 +9306,11 @@ function LivePanel({ active: active2 }) {
           /* @__PURE__ */ jsx2(Text2, { color: dl?.mode === "block" ? theme.ok : dl?.mode === "detect" ? theme.warn : theme.dim, children: (dl?.mode ?? "?").padEnd(7) }),
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: `${(dl?.patterns ?? []).length} builtin \xB7 ${(dl?.custom ?? []).length} custom` })
         ] }),
-        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate2(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "          no dlp hits in last 7 days" }),
+        dlpBars.length ? dlpBars.map((d2) => /* @__PURE__ */ jsx2(HBar, { label: truncate2(d2.pattern, 10), value: d2.count, max: maxDlpBar, width: Math.max(6, colW - 16), color: theme.bad }, d2.pattern)) : (
+          // 36 chars against a colW that is ~31 at cols=100: without truncate
+          // this wrapped onto a second line and pushed the column over colH.
+          /* @__PURE__ */ jsx2(Text2, { wrap: "truncate", color: theme.dim, children: "          no dlp hits in last 7 days" })
+        ),
         /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "GUARD".padEnd(10) }),
           ring ? /* @__PURE__ */ jsxs2(Text2, { color: theme.ok, children: [
@@ -9270,7 +9319,7 @@ function LivePanel({ active: active2 }) {
           ] }) : /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "no local ring in cwd" })
         ] })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, marginRight: 2, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, marginRight: 2, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "SESSIONS", extra: mode === "pick" ? "\u2191\u2193 pick \xB7 enter open" : `${combinedSess.length} \xB7 s = inspect`, width: colW }),
         pickable.length === 0 ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: "scanning\u2026" }) : null,
         pickable.map((r, i) => {
@@ -9296,7 +9345,7 @@ function LivePanel({ active: active2 }) {
           ] }, r.id);
         })
       ] }),
-      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, overflow: "hidden", children: [
+      /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", width: colW, height: colH, overflow: "hidden", children: [
         /* @__PURE__ */ jsx2(PaneTitle, { label: "EVENT LOG", extra: "system heartbeat", width: colW }),
         log3.slice(-(colH - 1)).map((l, i) => /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
           /* @__PURE__ */ jsxs2(Text2, { color: theme.dim, children: [
@@ -11503,26 +11552,7 @@ var init_doctor = __esm({
 import { Box as Box8, Text as Text8, useInput as useInput7 } from "ink";
 import TextInput6 from "ink-text-input";
 import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } from "react";
-import { readFileSync as readFileSync11, readdirSync as readdirSync2 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
 import { Fragment as Fragment5, jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
-function guestAllowance() {
-  try {
-    const dir = join13(homedir11(), ".solongate");
-    for (const f of readdirSync2(dir)) {
-      if (!f.startsWith(".policy-cache-") || !f.endsWith(".json")) continue;
-      try {
-        const c2 = JSON.parse(readFileSync11(join13(dir, f), "utf-8"));
-        const q = c2?.security?.guestQuota;
-        if (q && typeof q.limit === "number") return { used: q.used ?? 0, limit: q.limit };
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 function SettingsPanel({
   active: active2,
   focused,
@@ -11543,6 +11573,17 @@ function SettingsPanel({
   const [diagBusy, setDiagBusy] = useState8(null);
   const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
   const [updBusy, setUpdBusy] = useState8(false);
+  const [canInstall, setCanInstall] = useState8(null);
+  useEffect7(() => {
+    let live2 = true;
+    globalInstallCheck().then((r) => {
+      if (live2) setCanInstall(r.writable);
+    }).catch(() => {
+    });
+    return () => {
+      live2 = false;
+    };
+  }, []);
   const [diag, setDiag] = useState8(null);
   const [diagStep, setDiagStep] = useState8(0);
   const DIAG_STEPS = {
@@ -11560,7 +11601,6 @@ function SettingsPanel({
     const step = setInterval(() => setDiagStep((s) => Math.min(s + 1, total - 1)), 220);
     return () => clearInterval(step);
   }, [diagBusy]);
-  void guestAllowance;
   const ver = currentVersion();
   useEffect7(() => {
     let live2 = true;
@@ -11822,15 +11862,27 @@ function SettingsPanel({
       if (updBusy) return;
       setUpdBusy(true);
       setMsg({ text: "updating\u2026", level: "ok" });
+      setDiag(null);
       void (async () => {
         try {
           const res = await updateNow();
           if (res.status === "updated") setMsg({ text: `\u2713 v${res.version} installed \xB7 restart (q, then solongate) to apply`, level: "ok" });
           else if (res.status === "current") setMsg({ text: `\u2713 already on the latest version (v${res.version})`, level: "ok" });
-          else if (res.status === "needs-admin") setMsg({ text: `\u2717 npm needs admin rights here \u2014 run: ${adminInstallCommand()}`, level: "bad" });
-          else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
+          else if (res.status === "needs-admin") {
+            setMsg({ text: `\u2717 v${res.version} needs admin rights \u2014 run the two commands below`, level: "bad" });
+            setDiag({
+              of: "cli-update",
+              lines: [
+                { text: "npm\u2019s global folder belongs to root on this machine (the usual macOS", level: "warn" },
+                { text: "setup), so SolonGate cannot install there by itself. In a terminal:", level: "warn" },
+                ...adminUpdateSteps().map((s) => ({ text: s.trim(), level: "ok" })),
+                { text: "run repair WITHOUT sudo, or the guard hooks land in root\u2019s home", level: "dim" }
+              ]
+            });
+          } else if (res.status === "unreachable") setMsg({ text: "\u2717 could not reach the npm registry", level: "bad" });
           else setMsg({ text: `\u2717 update to v${res.version} failed \u2014 see ~/.solongate/self-update.log`, level: "bad" });
           setLatest(await latestVersion());
+          setCanInstall((await globalInstallCheck()).writable);
         } finally {
           setUpdBusy(false);
         }
@@ -11844,7 +11896,7 @@ function SettingsPanel({
       setAutoUpdate(next);
       setAutoUp(next);
       setMsg(
-        next ? { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
+        next ? canInstall === false ? { text: "\u2713 auto-update on \u2014 but npm needs sudo here, so it still cannot install on its own", level: "bad" } : { text: "\u2713 auto-update on \u2014 new versions install in the background", level: "ok" } : { text: "\u2713 auto-update off \u2014 update from this row or with: solongate update", level: "ok" }
       );
     } else if (r.kind === "ll-enabled") {
       if (!local) return;
@@ -12113,15 +12165,6 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "+ add account (enter \u2014 device login in the browser)" })
         ] });
-      case "allowance": {
-        const left = Math.max(0, r.limit - r.used);
-        return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
-          cursor(r),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "allowance".padEnd(11) }),
-          /* @__PURE__ */ jsx8(Text8, { color: left === 0 ? theme.bad : left <= 20 ? theme.warn : theme.ok, bold: true, children: `${r.used}/${r.limit} tool calls` }),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: left === 0 ? "   used up \u2014 every call is denied \xB7 create an account to carry on" : `   ${left} left on this guest account \xB7 create an account for no limit` })
-        ] });
-      }
       case "guard":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
@@ -12162,7 +12205,10 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "version".padEnd(11) }),
           /* @__PURE__ */ jsx8(Text8, { color: behind ? theme.warn : theme.ok, children: `v${ver}` }),
-          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
+          updBusy ? /* @__PURE__ */ jsx8(Text8, { color: theme.accentBright, children: `   ${spin} updating\u2026` }) : behind && canInstall === false ? (
+            // Said before they press enter, not after a minute of npm noise.
+            /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: `   v${latest} on npm \xB7 needs sudo here \xB7 enter shows how` })
+          ) : behind ? /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `   v${latest} on npm \xB7 enter updates now` }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: latest ? "   latest \xB7 enter checks again" : "   enter checks npm and updates" })
         ] });
       }
       case "auto-update":
@@ -12170,7 +12216,7 @@ function SettingsPanel({
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "auto".padEnd(11) }),
           onOff(autoUp),
-          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
+          /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: autoUpdateForcedByEnv() ? "   set by SOLONGATE_AUTO_UPDATE" : canInstall === false ? "   cannot work here: npm needs sudo, so updates stay manual \xB7 enter toggles" : autoUp ? "   installs new versions in the background \xB7 enter toggles" : "   off: nothing installs on its own (npm -g may need sudo) \xB7 enter toggles" })
         ] });
       case "ll-enabled":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
@@ -12224,7 +12270,7 @@ function SettingsPanel({
         ] });
     }
   };
-  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" || r.kind === "allowance" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
+  const sectionOf = (r) => r.kind === "acct" || r.kind === "acct-add" ? "ACCOUNTS" : r.kind === "guard" || r.kind === "self" || r.kind === "doctor" || r.kind === "repair" ? "PROTECTION" : r.kind === "cli-update" || r.kind === "auto-update" ? "UPDATES" : r.kind === "ll-enabled" || r.kind === "ll-path" || r.kind === "ll-server" ? "LOCAL LOGS" : r.kind === "wh" || r.kind === "wh-add" ? "WEBHOOKS" : "ALERTS";
   const SECTION_DESC = {
     ACCOUNTS: `on this device (${accounts.length}) \xB7 \u25CF viewing \xB7 ACTIVE = guard key \xB7 x removes`,
     PROTECTION: "guard hook: enter install/update \xB7 d remove \xB7 self-protection \xB7 doctor + repair",
@@ -12269,7 +12315,7 @@ function SettingsPanel({
         lineKey.push("");
       });
     }
-    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair")) {
+    if (diag && (r.kind === "doctor" && diag.of === "doctor" || r.kind === "repair" && diag.of === "repair" || r.kind === "cli-update" && diag.of === "cli-update")) {
       diag.lines.forEach((l, i) => {
         lineEls.push(
           /* @__PURE__ */ jsx8(
@@ -12418,23 +12464,7 @@ function App() {
   const acctIdx = Math.max(0, accounts.findIndex((a) => a.apiKey === viewKey));
   const cur = accounts[acctIdx];
   const rawEmail = cur?.email ?? "";
-  const isGuestAccount2 = rawEmail.endsWith("@anonymous.solongate.invalid");
-  const acctLabel2 = !cur ? "not logged in" : isGuestAccount2 ? "Anonymous" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
-  const [guestSpent, setGuestSpent] = useState9(false);
-  useEffect8(() => {
-    if (!isGuestAccount2) {
-      setGuestSpent(false);
-      return;
-    }
-    let alive = true;
-    api.auth.me().then((r) => {
-      if (alive) setGuestSpent(r.guest?.exhausted === true);
-    }).catch(() => {
-    });
-    return () => {
-      alive = false;
-    };
-  }, [isGuestAccount2, cur?.apiKey]);
+  const acctLabel2 = !cur ? "not logged in" : rawEmail || cur.user || cur.project || `account \u2026${cur.apiKey.slice(-4)}`;
   useEffect8(() => {
     if (!cur || cur.email) return;
     let alive = true;
@@ -12520,12 +12550,7 @@ function App() {
       /* @__PURE__ */ jsxs9(Text9, { wrap: "truncate", children: [
         /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "account: " }),
         /* @__PURE__ */ jsx9(Text9, { color: locked ? theme.warn : theme.accentBright, bold: true, children: acctLabel2 }),
-        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : guestSpent ? (
-          // Said on this line rather than on a new one: every panel budgets its
-          // height against a fixed shell, so one more line up here silently clips
-          // a row off whichever panel is open.
-          /* @__PURE__ */ jsx9(Text9, { color: theme.bad, bold: true, children: "  \xB7 allowance used up \xB7 every call denied \xB7 create an account to carry on" })
-        ) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
+        locked ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 log in from Settings to unlock the dataroom" }) : accounts.length > 1 ? /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: `  (${acctIdx + 1}/${accounts.length} \xB7 a switch \xB7 Settings to manage)` }) : /* @__PURE__ */ jsx9(Text9, { color: theme.dim, children: "  \xB7 Settings to add another" }),
         update2.kind === "updating" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 updating to v${update2.version}\u2026` }) : update2.kind === "updated" ? /* @__PURE__ */ jsx9(Text9, { color: theme.ok, bold: true, children: `  \u2191 v${update2.version} installed \xB7 restart (q, then solongate) to apply` }) : update2.kind === "available" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} out \xB7 Settings \u2192 UPDATES` }) : update2.kind === "needs-admin" ? /* @__PURE__ */ jsx9(Text9, { color: theme.warn, children: `  \u2191 v${update2.version} needs admin rights \xB7 Settings \u2192 UPDATES` }) : null
       ] }),
       /* @__PURE__ */ jsxs9(Box9, { marginTop: 1, flexGrow: 1, children: [
@@ -12603,8 +12628,8 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join14 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 import { render } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
@@ -12615,11 +12640,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join14(homedir12(), ".solongate", "dataroom-debug.log");
+  const debugLog = join13(homedir11(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync9(join14(homedir12(), ".solongate"), { recursive: true });
+      mkdirSync9(join13(homedir11(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -12646,7 +12671,7 @@ var init_tui = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 async function run2(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -12803,7 +12828,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync12(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -13517,10 +13542,10 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer } from "http";
-import { readFileSync as readFileSync13, statSync as statSync4 } from "fs";
-import { resolve as resolve5, join as join15, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir13 } from "os";
-import { readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { resolve as resolve5, join as join14, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir12 } from "os";
+import { readdirSync as readdirSync2 } from "fs";
 function allowedOrigins() {
   const base = [
     "https://dashboard.solongate.com",
@@ -13536,15 +13561,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute2(dir)) return dir;
-  return resolve5(homedir13(), ".solongate", "local-logs");
+  return resolve5(homedir12(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve5(homedir13(), ".solongate");
+  const base = resolve5(homedir12(), ".solongate");
   try {
-    const files = readdirSync3(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
+    const files = readdirSync2(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync13(join15(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync12(join14(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -13553,7 +13578,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync13(join15(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync12(join14(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -13582,7 +13607,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join15(dir, LOG_FILENAME);
+  const file = join14(dir, LOG_FILENAME);
   try {
     const st = statSync4(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -13665,7 +13690,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync13(info.file, "utf-8");
+        const text = readFileSync12(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -13718,9 +13743,9 @@ var init_logs_server = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join16 } from "path";
+import { dirname as dirname4, join as join15 } from "path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -17115,8 +17140,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
+    const p = join15(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync13(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }
@@ -17157,7 +17182,7 @@ function printHelp() {
   console.log(`  ${c.dim}Usage:${c.reset} ${c.cyan}solongate${c.reset} ${c.dim}[command]${c.reset}   ${c.dim}(no command opens the dataroom: all of this in a terminal UI)${c.reset}`);
   head("Setup & status");
   cmd("solongate", "open the dataroom UI (login, policies, audit, settings)");
-  cmd("update", "update SolonGate to the newest version and refresh the guard");
+  cmd("update", "update SolonGate and refresh the guard (tells you if it needs sudo)");
   cmd("update auto on|off", "background auto-update (default off \u2014 on macOS npm -g often needs sudo)");
   cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
@@ -17287,13 +17312,6 @@ async function main() {
   }
   const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
-    const { isGuestAccount: isGuestAccount2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-    if (subcommand !== "doctor" && isGuestAccount2()) {
-      process.stderr.write(
-        "\n  This is a guest account, which can look but not change.\n  Create an account to use the management commands:\n    https://auth.solongate.com\n\n  Your project, its policy and everything already recorded carry over,\n  and this device keeps working without being paired again.\n\n"
-      );
-      process.exit(1);
-    }
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));
     process.exit(code);
@@ -17308,7 +17326,7 @@ async function main() {
   if (subcommand === "update") {
     if (process.argv[3] === "auto") {
       const { runAutoUpdateCommand: runAutoUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
-      process.exit(runAutoUpdateCommand2(process.argv[4]));
+      process.exit(await runAutoUpdateCommand2(process.argv[4]));
     }
     const { runUpdateCommand: runUpdateCommand2 } = await Promise.resolve().then(() => (init_self_update(), self_update_exports));
     process.exit(await runUpdateCommand2());