@solongate/proxy 0.83.32 → 0.83.34

package/dist/commands/ghost.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/index.js

@@ -692,7 +692,7 @@ var USAGE = usage("solongate policy", "manage cloud policies", [
   ["policy deny  <id> [--command|--path|--url <val>]", "append a DENY rule"],
   ["policy revoke <id> <ruleId>", "remove a rule"],
   ["policy active", "show the resolved active policy"],
-  ["policy activate <id> | --clear", "pin / unpin the active policy"],
+  ["policy activate <id> | --off", "pin the active policy, or enforce nothing"],
   ["policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]", "replay recent traffic against rules"]
 ], "Add --json to any read command for machine-readable output.");
 async function run(argv) {
@@ -798,13 +798,15 @@ async function run(argv) {
       return 0;
     }
     case "activate": {
-      if (flagBool(flags, "clear")) {
+      if (flagBool(flags, "off") || flagBool(flags, "clear")) {
         const res2 = await api.policies.setActive(null);
         if (json) return printJson(res2), 0;
-        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+        err(green("  \u2713 Deactivated - this project now enforces no policy."));
+        err(dim("    Pin one again with: solongate policy activate <id>"));
+        return 0;
       }
       const id = positionals[1];
-      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --off"), 1;
       const res = await api.policies.setActive(id);
       if (json) return printJson(res), 0;
       err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));
@@ -1006,19 +1008,104 @@ async function run3(argv) {
   }
 }
 
+// src/commands/ghost.ts
+var USAGE4 = usage("solongate ghost", "hidden paths", [
+  ["ghost show", "current mode + routes"],
+  ["ghost on", "start hiding the routes"],
+  ["ghost off", "stop hiding them (the routes are kept)"],
+  ["ghost add <glob>", "hide one more path"],
+  ["ghost remove <glob>", "stop hiding one path"]
+]);
+var modeColor3 = (m) => m === "on" ? green(m) : dim("off");
+var isBlanketGlob = (glob) => glob.replaceAll("*", "").trim() === "";
+async function run4(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  if (sub === "help") return err(USAGE4), 0;
+  const { layers } = await api.settings.getSecurityLayers();
+  const save = async (next) => (await api.settings.setSecurityLayers(next)).layers;
+  switch (sub) {
+    case "show": {
+      if (json) return printJson(layers.ghost), 0;
+      err("");
+      err(`  Ghost   mode: ${modeColor3(layers.ghost.mode)}`);
+      if (!layers.ghost.patterns.length) {
+        err(dim("\n  No routes. `solongate ghost add <glob>` to hide a path."));
+        return 0;
+      }
+      table(["", "ROUTE"], layers.ghost.patterns.map((r) => [cyan("\u2022"), r]));
+      if (layers.ghost.mode !== "on") {
+        err(dim("\n  Ghost is off: these routes are stored but nothing is hidden."));
+      }
+      return 0;
+    }
+    case "on":
+    case "off": {
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, mode: sub } });
+      if (json) return printJson(saved.ghost), 0;
+      err(green(`  \u2713 Ghost \u2192 ${saved.ghost.mode}`));
+      if (sub === "on" && !saved.ghost.patterns.length) {
+        err(dim("  No routes yet, so nothing is hidden. `solongate ghost add <glob>`."));
+      }
+      return 0;
+    }
+    case "add": {
+      const glob = positionals.slice(1).join(" ");
+      if (!glob) return err("  Usage: ghost add <glob>"), 1;
+      if (isBlanketGlob(glob)) {
+        err(`${red("  \u2717 ")}"${glob}" would hide every path.`);
+        err(dim("    Ghost routes are globs: `*` is any run of non-whitespace."));
+        err(dim("    Anchor it on something, e.g. *payroll.csv or *internal/*.pem"));
+        return 1;
+      }
+      if (layers.ghost.patterns.includes(glob)) {
+        if (json) return printJson(layers.ghost), 0;
+        return err(green(`  \u2713 Route "${glob}" is already hidden`)), 0;
+      }
+      const patterns = [...layers.ghost.patterns, glob];
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, patterns } });
+      if (json) return printJson(saved.ghost), 0;
+      err(green(`  \u2713 Hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s))`));
+      if (saved.ghost.mode !== "on") {
+        err(dim("    Ghost is off. `solongate ghost on` to start hiding."));
+      }
+      return 0;
+    }
+    case "remove": {
+      const glob = positionals.slice(1).join(" ");
+      if (!glob) return err("  Usage: ghost remove <glob>"), 1;
+      if (!layers.ghost.patterns.includes(glob)) {
+        err(`  No such route: "${glob}"`);
+        if (layers.ghost.patterns.length) {
+          err(dim("  Current:"));
+          for (const r of layers.ghost.patterns) err(`    ${dim("\u2022")} ${r}`);
+        }
+        return 1;
+      }
+      const patterns = layers.ghost.patterns.filter((r) => r !== glob);
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, patterns } });
+      if (json) return printJson(saved.ghost), 0;
+      return err(green(`  \u2713 Stopped hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s) left)`)), 0;
+    }
+    default:
+      return err(USAGE4), 1;
+  }
+}
+
 // src/commands/stats.ts
-var USAGE4 = usage("solongate stats", "traffic & security stats", [
+var USAGE5 = usage("solongate stats", "traffic & security stats", [
   ["stats", "overview (totals, recent activity)"],
   ["stats timeseries [--period 24h|7d|30d|all]"],
   ["stats drift [--days N]", "denials rising/falling vs previous window"]
 ]);
-async function run4(argv) {
+async function run5(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "overview";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE4), 0;
+      return err(USAGE5), 0;
     case "overview": {
       const s = await api.stats.get();
       if (json) return printJson(s), 0;
@@ -1071,21 +1158,21 @@ async function run4(argv) {
       return 0;
     }
     default:
-      return err(USAGE4), 1;
+      return err(USAGE5), 1;
   }
 }
 
 // src/commands/audit.ts
-var USAGE5 = usage("solongate audit", "audit log", [
+var USAGE6 = usage("solongate audit", "audit log", [
   ["audit [--filter ALLOW|DENY] [--tool <substr>] [--signal dlp|ratelimit]"],
   ["      [--search <text>] [--agent-name <name>] [--limit N]"],
   ["audit whitelist <logId> [--scope exact|tool]", "turn a denied call into an ALLOW rule"],
   ["audit block <logId> [--scope exact|tool]", "turn a call into a DENY rule"]
 ]);
-async function run5(argv) {
+async function run6(argv) {
   const { positionals, flags } = parse(argv);
   const json = flagBool(flags, "json");
-  if (positionals[0] === "help") return err(USAGE5), 0;
+  if (positionals[0] === "help") return err(USAGE6), 0;
   if (positionals[0] === "whitelist") {
     const id = positionals[1];
     if (!id) return err("  Usage: audit whitelist <logId> [--scope exact|tool]"), 1;
@@ -1327,7 +1414,7 @@ async function collectChecks() {
   }
   return checks;
 }
-async function run6(argv) {
+async function run7(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
   const checks = await collectChecks();
@@ -1375,7 +1462,7 @@ function print(r, json) {
     `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
   );
 }
-async function run7(argv) {
+async function run8(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
   const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
@@ -1453,19 +1540,19 @@ async function run7(argv) {
 }
 
 // src/commands/alerts.ts
-var USAGE6 = usage("solongate alerts", "spike alerts (Telegram / email)", [
+var USAGE7 = usage("solongate alerts", "spike alerts (Telegram / email)", [
   ["alerts list"],
   ["alerts add --signal deny|dlp|ratelimit|any --threshold N --window S"],
   ["             (--email <a> | --telegram <chatId> | --slack <url>)"],
   ["alerts remove <id>"]
 ]);
-async function run8(argv) {
+async function run9(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE6), 0;
+      return err(USAGE7), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -1507,23 +1594,23 @@ async function run8(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE6), 1;
+      return err(USAGE7), 1;
   }
 }
 
 // src/commands/webhooks.ts
-var USAGE7 = usage("solongate webhooks", "event webhooks", [
+var USAGE8 = usage("solongate webhooks", "event webhooks", [
   ["webhooks list"],
   ["webhooks add --url <https://\u2026> [--events denials|allowed|all]"],
   ["webhooks remove <id>"]
 ]);
-async function run9(argv) {
+async function run10(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE7), 0;
+      return err(USAGE8), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -1549,7 +1636,7 @@ async function run9(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return err(USAGE8), 1;
   }
 }
 
@@ -1562,22 +1649,24 @@ async function dispatch(command, argv) {
       return run2(argv);
     case "dlp":
       return run3(argv);
-    case "stats":
+    case "ghost":
       return run4(argv);
-    case "audit":
+    case "stats":
       return run5(argv);
+    case "audit":
+      return run6(argv);
     case "sessions":
       return runAgents(argv);
     case "session":
       return runAgent(argv);
     case "doctor":
-      return run6(argv);
-    case "watch":
       return run7(argv);
-    case "alerts":
+    case "watch":
       return run8(argv);
-    case "webhooks":
+    case "alerts":
       return run9(argv);
+    case "webhooks":
+      return run10(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;

package/dist/index.js

@@ -9351,7 +9351,7 @@ function LivePanel({ active: active2 }) {
     ] });
   }
   if (mode === "layers") {
-    const modeColor4 = (m) => m === "block" || m === "on" ? theme.ok : m === "detect" ? theme.warn : theme.dim;
+    const modeColor5 = (m) => m === "block" || m === "on" ? theme.ok : m === "detect" ? theme.warn : theme.dim;
     const barW = Math.max(10, Math.min(40, innerW - 30));
     const burstsInBuf = mergedAll.filter((e) => e.burst).length;
     const dlpInBuf = mergedAll.filter((e) => e.dlp).length;
@@ -9366,7 +9366,7 @@ function LivePanel({ active: active2 }) {
           "\u258E",
           label.padEnd(10)
         ] }),
-        /* @__PURE__ */ jsx2(Text2, { bold: true, color: modeColor4(m), children: (m ?? "?").padEnd(8) }),
+        /* @__PURE__ */ jsx2(Text2, { bold: true, color: modeColor5(m), children: (m ?? "?").padEnd(8) }),
         note ? /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: note }) : null
       ] })
     );
@@ -9755,7 +9755,7 @@ function DryRunPanel({ focused }) {
   const [off, setOff] = useState3(0);
   const { cols, rows } = usePanelSize();
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
-  function run10(policyIdx = pi, lim = limit) {
+  function run11(policyIdx = pi, lim = limit) {
     const p = policies[policyIdx];
     if (!p) return;
     setRunning(true);
@@ -9773,7 +9773,7 @@ function DryRunPanel({ focused }) {
       pendingPolicyId = null;
     }
     setPi(idx);
-    run10(idx, limit);
+    run11(idx, limit);
   }, [policies.length]);
   useInput2((input, key) => {
     if (!focused || editLogs !== null) return;
@@ -9782,10 +9782,10 @@ function DryRunPanel({ focused }) {
     else if (input === "p" || input === "P") {
       const n = policies.length ? (pi + 1) % policies.length : 0;
       setPi(n);
-      run10(n, limit);
+      run11(n, limit);
     } else if (input === "n" || input === "N") {
       setEditLogs(String(limit));
-    } else if (input === "r" || input === "R") run10(pi, limit);
+    } else if (input === "r" || input === "R") run11(pi, limit);
   });
   function commitLogs(raw) {
     const cap = Math.min(MAX_LIMIT, totalLogs && totalLogs > 0 ? totalLogs : MAX_LIMIT);
@@ -9793,7 +9793,7 @@ function DryRunPanel({ focused }) {
     const next = Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, cap) : limit;
     setEditLogs(null);
     setLimit(next);
-    run10(pi, next);
+    run11(pi, next);
   }
   const w = Math.max(40, cols);
   const lines = [];
@@ -11090,7 +11090,7 @@ function AuditPanel({ active: active2, focused }) {
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
     setMsg({ text: "deleting\u2026", level: "ok" });
-    const run10 = async () => {
+    const run11 = async () => {
       if (source === "cloud") {
         if (kind === "one") {
           if (!current) throw new Error("nothing selected");
@@ -11106,14 +11106,14 @@ function AuditPanel({ active: active2, focused }) {
         localQ.reload();
       }
     };
-    run10().then(() => {
+    run11().then(() => {
       setMsg({ text: kind === "one" ? "\u2713 entry deleted" : `\u2713 ALL ${source} logs deleted`, level: "ok" });
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
-    const run10 = async () => {
+    const run11 = async () => {
       const dir = join11(homedir9(), ".solongate");
       const file = join11(dir, `audit-export-${source}.jsonl`);
       let rows2;
@@ -11126,7 +11126,7 @@ function AuditPanel({ active: active2, focused }) {
       writeFileSync9(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
-    run10().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+    run11().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   useInput6(
     (input, key) => {
@@ -12008,7 +12008,7 @@ function SettingsPanel({
     guardQ.reload();
     selfQ.reload();
   };
-  const run10 = (label, fn, reload) => {
+  const run11 = (label, fn, reload) => {
     if (busy) return;
     setBusy(true);
     setMsg({ text: label + "\u2026", level: "ok" });
@@ -12090,8 +12090,8 @@ function SettingsPanel({
     const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
     const id = editor.id;
     setEditor(null);
-    if (id) run10("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
-    else run10(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
+    if (id) run11("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run11(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
   };
   const activate = (r) => {
     if (r.kind === "acct") {
@@ -12165,7 +12165,7 @@ function SettingsPanel({
       })();
     } else if (r.kind === "self") {
       if (!selfProt) return;
-      run10(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+      run11(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
     } else if (r.kind === "cli-update") {
       if (updBusy) return;
       setUpdBusy(true);
@@ -12212,7 +12212,7 @@ function SettingsPanel({
         setMsg({ text: "set a path first (\u2193 then enter)", level: "bad" });
         return;
       }
-      run10(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
+      run11(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
     } else if (r.kind === "ll-path") {
       setInput(local?.path ?? "");
       setEditing("path");
@@ -12223,7 +12223,7 @@ function SettingsPanel({
         next.running ? { text: `\u2713 dashboard link running on 127.0.0.1:${next.port} \u2014 keeps running after you close the dataroom`, level: "ok" } : { text: "\u2713 dashboard link stopped (disabled until you start it again)", level: "ok" }
       );
     } else if (r.kind === "wh") {
-      run10(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
+      run11(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
     } else if (r.kind === "wh-add") {
       setInput("");
       setEditing("wh-url");
@@ -12242,7 +12242,7 @@ function SettingsPanel({
     setEditing(null);
     if (which === "path") {
       const enabled = (local?.enabled ?? false) && v.length > 0;
-      run10(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
+      run11(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
     } else if (which === "wh-url") {
       const url = v.replace(/^["'<]+|["'>]+$/g, "").trim();
       if (!url) return;
@@ -12250,7 +12250,7 @@ function SettingsPanel({
         setMsg({ text: "\u2717 webhook url must start with http:// or https://", level: "bad" });
         return;
       }
-      run10("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
+      run11("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
     } else if (which === "alert-target" && editor) {
       setEditor({ ...editor, target: v, field: 1 });
     }
@@ -12305,7 +12305,7 @@ function SettingsPanel({
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
-          if (cur.kind === "alert") run10(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
+          if (cur.kind === "alert") run11(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
       } else if (inp === "x" && cur.kind === "acct") {
@@ -12336,13 +12336,13 @@ function SettingsPanel({
         refreshAccounts();
         onAccountsChanged?.();
       } else if (inp === "t" && cur.kind === "wh") {
-        run10("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
+        run11("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
-        run10(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
+        run11(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
       } else if (inp === "e" && cur.kind === "alert") {
         const ch = alertChannel(cur.rule);
         if (ch) openAlertEditor(ch, cur.rule);
@@ -12379,10 +12379,10 @@ function SettingsPanel({
         setConfirmDel(null);
         if (cur.kind === "wh") {
           const id = cur.wh.id;
-          run10("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
+          run11("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
         } else {
           const id = cur.rule.id;
-          run10("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
+          run11("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
         }
       } else if (inp === "r") reloadAll();
     },
@@ -12770,9 +12770,9 @@ function App() {
   const [update2, setUpdate] = useState9({ kind: "idle" });
   useEffect8(() => {
     let alive = true;
-    const run10 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
-    run10();
-    const t = setInterval(run10, 30 * 6e4);
+    const run11 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
+    run11();
+    const t = setInterval(run11, 30 * 6e4);
     return () => {
       alive = false;
       clearInterval(t);
@@ -13092,13 +13092,15 @@ async function run2(argv) {
       return 0;
     }
     case "activate": {
-      if (flagBool(flags, "clear")) {
+      if (flagBool(flags, "off") || flagBool(flags, "clear")) {
         const res2 = await api.policies.setActive(null);
         if (json) return printJson(res2), 0;
-        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+        err(green("  \u2713 Deactivated - this project now enforces no policy."));
+        err(dim("    Pin one again with: solongate policy activate <id>"));
+        return 0;
       }
       const id = positionals[1];
-      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --off"), 1;
       const res = await api.policies.setActive(id);
       if (json) return printJson(res), 0;
       err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));
@@ -13167,7 +13169,7 @@ var init_policy = __esm({
       ["policy deny  <id> [--command|--path|--url <val>]", "append a DENY rule"],
       ["policy revoke <id> <ruleId>", "remove a rule"],
       ["policy active", "show the resolved active policy"],
-      ["policy activate <id> | --clear", "pin / unpin the active policy"],
+      ["policy activate <id> | --off", "pin the active policy, or enforce nothing"],
       ["policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]", "replay recent traffic against rules"]
     ], "Add --json to any read command for machine-readable output.");
   }
@@ -13339,14 +13341,108 @@ var init_dlp = __esm({
   }
 });
 
-// src/commands/stats.ts
+// src/commands/ghost.ts
 async function run5(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  if (sub === "help") return err(USAGE4), 0;
+  const { layers } = await api.settings.getSecurityLayers();
+  const save = async (next) => (await api.settings.setSecurityLayers(next)).layers;
+  switch (sub) {
+    case "show": {
+      if (json) return printJson(layers.ghost), 0;
+      err("");
+      err(`  Ghost   mode: ${modeColor4(layers.ghost.mode)}`);
+      if (!layers.ghost.patterns.length) {
+        err(dim("\n  No routes. `solongate ghost add <glob>` to hide a path."));
+        return 0;
+      }
+      table(["", "ROUTE"], layers.ghost.patterns.map((r) => [cyan("\u2022"), r]));
+      if (layers.ghost.mode !== "on") {
+        err(dim("\n  Ghost is off: these routes are stored but nothing is hidden."));
+      }
+      return 0;
+    }
+    case "on":
+    case "off": {
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, mode: sub } });
+      if (json) return printJson(saved.ghost), 0;
+      err(green(`  \u2713 Ghost \u2192 ${saved.ghost.mode}`));
+      if (sub === "on" && !saved.ghost.patterns.length) {
+        err(dim("  No routes yet, so nothing is hidden. `solongate ghost add <glob>`."));
+      }
+      return 0;
+    }
+    case "add": {
+      const glob = positionals.slice(1).join(" ");
+      if (!glob) return err("  Usage: ghost add <glob>"), 1;
+      if (isBlanketGlob(glob)) {
+        err(`${red("  \u2717 ")}"${glob}" would hide every path.`);
+        err(dim("    Ghost routes are globs: `*` is any run of non-whitespace."));
+        err(dim("    Anchor it on something, e.g. *payroll.csv or *internal/*.pem"));
+        return 1;
+      }
+      if (layers.ghost.patterns.includes(glob)) {
+        if (json) return printJson(layers.ghost), 0;
+        return err(green(`  \u2713 Route "${glob}" is already hidden`)), 0;
+      }
+      const patterns = [...layers.ghost.patterns, glob];
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, patterns } });
+      if (json) return printJson(saved.ghost), 0;
+      err(green(`  \u2713 Hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s))`));
+      if (saved.ghost.mode !== "on") {
+        err(dim("    Ghost is off. `solongate ghost on` to start hiding."));
+      }
+      return 0;
+    }
+    case "remove": {
+      const glob = positionals.slice(1).join(" ");
+      if (!glob) return err("  Usage: ghost remove <glob>"), 1;
+      if (!layers.ghost.patterns.includes(glob)) {
+        err(`  No such route: "${glob}"`);
+        if (layers.ghost.patterns.length) {
+          err(dim("  Current:"));
+          for (const r of layers.ghost.patterns) err(`    ${dim("\u2022")} ${r}`);
+        }
+        return 1;
+      }
+      const patterns = layers.ghost.patterns.filter((r) => r !== glob);
+      const saved = await save({ ...layers, ghost: { ...layers.ghost, patterns } });
+      if (json) return printJson(saved.ghost), 0;
+      return err(green(`  \u2713 Stopped hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s) left)`)), 0;
+    }
+    default:
+      return err(USAGE4), 1;
+  }
+}
+var USAGE4, modeColor4, isBlanketGlob;
+var init_ghost = __esm({
+  "src/commands/ghost.ts"() {
+    "use strict";
+    init_api_client();
+    init_args();
+    init_format();
+    USAGE4 = usage("solongate ghost", "hidden paths", [
+      ["ghost show", "current mode + routes"],
+      ["ghost on", "start hiding the routes"],
+      ["ghost off", "stop hiding them (the routes are kept)"],
+      ["ghost add <glob>", "hide one more path"],
+      ["ghost remove <glob>", "stop hiding one path"]
+    ]);
+    modeColor4 = (m) => m === "on" ? green(m) : dim("off");
+    isBlanketGlob = (glob) => glob.replaceAll("*", "").trim() === "";
+  }
+});
+
+// src/commands/stats.ts
+async function run6(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "overview";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE4), 0;
+      return err(USAGE5), 0;
     case "overview": {
       const s = await api.stats.get();
       if (json) return printJson(s), 0;
@@ -13399,17 +13495,17 @@ async function run5(argv) {
       return 0;
     }
     default:
-      return err(USAGE4), 1;
+      return err(USAGE5), 1;
   }
 }
-var USAGE4;
+var USAGE5;
 var init_stats2 = __esm({
   "src/commands/stats.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE4 = usage("solongate stats", "traffic & security stats", [
+    USAGE5 = usage("solongate stats", "traffic & security stats", [
       ["stats", "overview (totals, recent activity)"],
       ["stats timeseries [--period 24h|7d|30d|all]"],
       ["stats drift [--days N]", "denials rising/falling vs previous window"]
@@ -13418,10 +13514,10 @@ var init_stats2 = __esm({
 });
 
 // src/commands/audit.ts
-async function run6(argv) {
+async function run7(argv) {
   const { positionals, flags } = parse(argv);
   const json = flagBool(flags, "json");
-  if (positionals[0] === "help") return err(USAGE5), 0;
+  if (positionals[0] === "help") return err(USAGE6), 0;
   if (positionals[0] === "whitelist") {
     const id = positionals[1];
     if (!id) return err("  Usage: audit whitelist <logId> [--scope exact|tool]"), 1;
@@ -13469,14 +13565,14 @@ async function run6(argv) {
   );
   return 0;
 }
-var USAGE5;
+var USAGE6;
 var init_audit2 = __esm({
   "src/commands/audit.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE5 = usage("solongate audit", "audit log", [
+    USAGE6 = usage("solongate audit", "audit log", [
       ["audit [--filter ALLOW|DENY] [--tool <substr>] [--signal dlp|ratelimit]"],
       ["      [--search <text>] [--agent-name <name>] [--limit N]"],
       ["audit whitelist <logId> [--scope exact|tool]", "turn a denied call into an ALLOW rule"],
@@ -13572,7 +13668,7 @@ function print(r, json) {
     `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
   );
 }
-async function run7(argv) {
+async function run8(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
   const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
@@ -13663,13 +13759,13 @@ var init_watch = __esm({
 });
 
 // src/commands/alerts.ts
-async function run8(argv) {
+async function run9(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE6), 0;
+      return err(USAGE7), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -13711,17 +13807,17 @@ async function run8(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE6), 1;
+      return err(USAGE7), 1;
   }
 }
-var USAGE6;
+var USAGE7;
 var init_alerts = __esm({
   "src/commands/alerts.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE6 = usage("solongate alerts", "spike alerts (Telegram / email)", [
+    USAGE7 = usage("solongate alerts", "spike alerts (Telegram / email)", [
       ["alerts list"],
       ["alerts add --signal deny|dlp|ratelimit|any --threshold N --window S"],
       ["             (--email <a> | --telegram <chatId> | --slack <url>)"],
@@ -13731,13 +13827,13 @@ var init_alerts = __esm({
 });
 
 // src/commands/webhooks.ts
-async function run9(argv) {
+async function run10(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE7), 0;
+      return err(USAGE8), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -13763,17 +13859,17 @@ async function run9(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return err(USAGE8), 1;
   }
 }
-var USAGE7;
+var USAGE8;
 var init_webhooks = __esm({
   "src/commands/webhooks.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE7 = usage("solongate webhooks", "event webhooks", [
+    USAGE8 = usage("solongate webhooks", "event webhooks", [
       ["webhooks list"],
       ["webhooks add --url <https://\u2026> [--events denials|allowed|all]"],
       ["webhooks remove <id>"]
@@ -13795,10 +13891,12 @@ async function dispatch(command, argv) {
       return run3(argv);
     case "dlp":
       return run4(argv);
-    case "stats":
+    case "ghost":
       return run5(argv);
-    case "audit":
+    case "stats":
       return run6(argv);
+    case "audit":
+      return run7(argv);
     case "sessions":
       return runAgents(argv);
     case "session":
@@ -13806,11 +13904,11 @@ async function dispatch(command, argv) {
     case "doctor":
       return run(argv);
     case "watch":
-      return run7(argv);
-    case "alerts":
       return run8(argv);
-    case "webhooks":
+    case "alerts":
       return run9(argv);
+    case "webhooks":
+      return run10(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -13842,6 +13940,7 @@ var init_commands = __esm({
     init_policy();
     init_ratelimit();
     init_dlp();
+    init_ghost();
     init_stats2();
     init_audit2();
     init_agents2();
@@ -17438,7 +17537,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "repair", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "repair", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -17515,7 +17614,7 @@ function printHelp() {
   cmd("policy allow <id> [--command|--path|--url <val>]", "add an ALLOW rule");
   cmd("policy deny <id> [--command|--path|--url <val>]", "add a DENY rule");
   cmd("policy revoke <id> <ruleId>", "remove a rule");
-  cmd("policy activate <id> | --clear", "pin / unpin the active policy");
+  cmd("policy activate <id> | --off", "pin the active policy, or enforce nothing");
   cmd("policy active", "show the resolved active policy");
   cmd("policy dry-run <id|file.json> [--mode denylist|whitelist]", "replay recent traffic against rules");
   head("Rate limits");
@@ -17529,6 +17628,11 @@ function printHelp() {
   cmd("dlp disable <pattern>", "disable a built-in pattern");
   cmd("dlp add-custom --name X --re <regex>", "add a custom pattern");
   cmd("dlp remove-custom <name>", "remove a custom pattern");
+  head("Ghost (hidden paths)");
+  cmd("ghost show", "current mode + routes");
+  cmd("ghost on | off", "start or stop hiding the routes");
+  cmd("ghost add <glob>", "hide one more path");
+  cmd("ghost remove <glob>", "stop hiding one path");
   head("Monitoring");
   cmd("audit [--filter ALLOW|DENY] [--tool <s>] [--signal dlp|ratelimit] [--limit N]", "browse the audit log");
   cmd("audit whitelist <logId> [--scope exact|tool]", "turn a denial into an ALLOW rule");
@@ -17627,7 +17731,7 @@ async function main() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.32",
+  "version": "0.83.34",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.32",
-    "@solongate/guard-linux-arm64": "0.83.32",
-    "@solongate/guard-darwin-x64": "0.83.32",
-    "@solongate/guard-darwin-arm64": "0.83.32",
-    "@solongate/guard-win32-x64": "0.83.32",
-    "@solongate/guard-win32-arm64": "0.83.32"
+    "@solongate/guard-linux-x64": "0.83.34",
+    "@solongate/guard-linux-arm64": "0.83.34",
+    "@solongate/guard-darwin-x64": "0.83.34",
+    "@solongate/guard-darwin-arm64": "0.83.34",
+    "@solongate/guard-win32-x64": "0.83.34",
+    "@solongate/guard-win32-arm64": "0.83.34"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",