@solongate/proxy 0.83.34 → 0.83.36

package/dist/commands/format.d.ts

@@ -15,6 +15,23 @@ export declare const cyan: (s: string) => string;
  * (used for long or continuation lines). Returns the whole block as one string.
  */
 export declare function usage(title: string, tagline: string, rows: Array<[string, string?]>, footer?: string): string;
+/**
+ * What a command's switch falls through to when the first positional is not one
+ * of its subcommands.
+ *
+ * Printing the usage block on its own was the old behaviour everywhere, and it
+ * reads as though the command simply has no default: a correct-looking help
+ * screen appears, and finding the mistake means diffing it against what you
+ * typed. Naming the token first costs one line and removes that step.
+ *
+ * `solongate ghost -g` is the case that made it obvious. The parser treats only
+ * `--x` as a flag, so a single-dash token arrives as a SUBCOMMAND, and the
+ * result was a help screen that looked like a successful command.
+ *
+ * The empty case still happens: a command invoked with a flag and no subcommand
+ * has nothing to name, and `Unknown subcommand: ""` would be worse than none.
+ */
+export declare function unknownSub(command: string, sub: string, usageText: string): number;
 /** Color a decision string (ALLOW green, DENY/DENIED red). */
 export declare function decisionColor(decision: string): string;
 /**

package/dist/commands/index.js

@@ -606,6 +606,11 @@ function usage(title, tagline, rows, footer = "Add --json for machine-readable o
   if (footer) lines.push("", `  ${c.dim}${footer}${c.reset}`);
   return lines.join("\n");
 }
+function unknownSub(command, sub, usageText) {
+  if (sub) err(`${red("  \u2717 ")}Unknown ${command} subcommand: ${cyan(sub)}`);
+  err(usageText);
+  return 1;
+}
 function decisionColor(decision) {
   const d = decision.toUpperCase();
   if (d === "ALLOW") return green(d);
@@ -833,10 +838,7 @@ async function run(argv) {
       return 0;
     }
     default:
-      err(`  Unknown: policy ${sub}
-`);
-      err(USAGE);
-      return 1;
+      return unknownSub("policy", sub, USAGE);
   }
 }
 function printRules(rules) {
@@ -925,7 +927,7 @@ async function run2(argv) {
       return 0;
     }
     default:
-      return err(USAGE2), 1;
+      return unknownSub("ratelimit", sub, USAGE2);
   }
 }
 
@@ -1004,7 +1006,7 @@ async function run3(argv) {
       return err(green(`  \u2713 Removed custom pattern "${name}"`)), 0;
     }
     default:
-      return err(USAGE3), 1;
+      return unknownSub("dlp", sub, USAGE3);
   }
 }
 
@@ -1089,7 +1091,7 @@ async function run4(argv) {
       return err(green(`  \u2713 Stopped hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s) left)`)), 0;
     }
     default:
-      return err(USAGE4), 1;
+      return unknownSub("ghost", sub, USAGE4);
   }
 }
 
@@ -1158,7 +1160,7 @@ async function run5(argv) {
       return 0;
     }
     default:
-      return err(USAGE5), 1;
+      return unknownSub("stats", sub, USAGE5);
   }
 }
 
@@ -1435,6 +1437,80 @@ async function run7(argv) {
   return bad ? 1 : 0;
 }
 
+// src/commands/trace.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5, resolve as resolve3 } from "path";
+var USAGE7 = usage("solongate trace", "what the guard saw here", [
+  ["trace", "the last evaluations in this directory"],
+  ["trace --limit N", "how many to show (default 20)"],
+  ["trace --json", "the raw records"]
+]);
+function projectKey(dir) {
+  let h = 2166136261;
+  const s = String(dir || "");
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)) >>> 0;
+  }
+  return h.toString(16);
+}
+var countCell = (n) => {
+  if (n === void 0 || n === null) return dim("-");
+  if (n === 0) return red("0");
+  return String(n);
+};
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "";
+  if (sub === "help") return err(USAGE7), 0;
+  if (sub) return unknownSub("trace", sub, USAGE7);
+  const limit = flagNum(flags, "limit") || 20;
+  const dir = join5(homedir5(), ".solongate", "projects", projectKey(resolve3(process.cwd())));
+  let records;
+  try {
+    records = readFileSync6(join5(dir, ".eval-ring.jsonl"), "utf-8").split("\n").map((l) => l.trim()).filter(Boolean).map((l) => {
+      try {
+        return JSON.parse(l);
+      } catch {
+        return null;
+      }
+    }).filter((r) => r !== null).sort((a, b) => (b.ts ?? 0) - (a.ts ?? 0));
+  } catch {
+    err("");
+    err("  No local records for this directory.");
+    err(dim(`  ${dir}`));
+    err("");
+    err(dim("  The guard writes one per evaluation, in the directory the call was"));
+    err(dim("  made in. Run this from the project you are testing."));
+    return 1;
+  }
+  records = records.slice(0, limit);
+  if (flagBool(flags, "json")) return printJson(records), 0;
+  err("");
+  err(`  ${records.length} local evaluation(s) \xB7 ${dim(dir)}`);
+  table(
+    ["WHEN", "CLIENT", "TOOL", "PERM", "PATHS", "CMDS", "URLS", "ARGS", "MS"],
+    records.map((r) => [
+      r.ts ? new Date(r.ts).toTimeString().slice(0, 8) : "",
+      r.client ?? "",
+      r.tool ?? "",
+      dim(r.perm ?? ""),
+      countCell(r.paths),
+      countCell(r.cmds),
+      countCell(r.urls),
+      // An empty list is not the same as an absent one: it means the guard
+      // parsed the payload and found no arguments in it at all.
+      r.args === void 0 ? dim("-") : r.args.length ? r.args.join(",") : red("(none)"),
+      dim(`${Math.round(r.ms ?? 0)}ms`)
+    ])
+  );
+  err("");
+  err(dim("  PATHS/CMDS/URLS is what the guard extracted from the call. A path rule"));
+  err(dim("  cannot fire on a call whose PATHS is 0, whatever the rule says."));
+  return 0;
+}
+
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readSync as readSync2, statSync as statSync4 } from "fs";
 var trunc = (s, n) => s.length <= n ? s : s.slice(0, n - 1) + "\u2026";
@@ -1462,7 +1538,7 @@ function print(r, json) {
     `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
   );
 }
-async function run8(argv) {
+async function run9(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
   const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
@@ -1540,19 +1616,19 @@ async function run8(argv) {
 }
 
 // src/commands/alerts.ts
-var USAGE7 = usage("solongate alerts", "spike alerts (Telegram / email)", [
+var USAGE8 = usage("solongate alerts", "spike alerts (Telegram / email)", [
   ["alerts list"],
   ["alerts add --signal deny|dlp|ratelimit|any --threshold N --window S"],
   ["             (--email <a> | --telegram <chatId> | --slack <url>)"],
   ["alerts remove <id>"]
 ]);
-async function run9(argv) {
+async function run10(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE7), 0;
+      return err(USAGE8), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -1594,23 +1670,23 @@ async function run9(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return unknownSub("alerts", sub, USAGE8);
   }
 }
 
 // src/commands/webhooks.ts
-var USAGE8 = usage("solongate webhooks", "event webhooks", [
+var USAGE9 = usage("solongate webhooks", "event webhooks", [
   ["webhooks list"],
   ["webhooks add --url <https://\u2026> [--events denials|allowed|all]"],
   ["webhooks remove <id>"]
 ]);
-async function run10(argv) {
+async function run11(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE8), 0;
+      return err(USAGE9), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -1636,7 +1712,7 @@ async function run10(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE8), 1;
+      return unknownSub("webhooks", sub, USAGE9);
   }
 }
 
@@ -1661,12 +1737,14 @@ async function dispatch(command, argv) {
       return runAgent(argv);
     case "doctor":
       return run7(argv);
-    case "watch":
+    case "trace":
       return run8(argv);
-    case "alerts":
+    case "watch":
       return run9(argv);
-    case "webhooks":
+    case "alerts":
       return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;

package/dist/commands/trace.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/index.js

@@ -3043,12 +3043,12 @@ ${ctx.indent}`;
       for (const {
         format,
         test,
-        resolve: resolve7
+        resolve: resolve8
       } of tags) {
         if (test) {
           const match = str.match(test);
           if (match) {
-            let res = resolve7.apply(null, match);
+            let res = resolve8.apply(null, match);
             if (!(res instanceof Scalar)) res = new Scalar(res);
             if (format) res.format = format;
             return res;
@@ -7303,7 +7303,7 @@ async function runUpdateCommand() {
   return 0;
 }
 function runGlobalInstall2(version) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
       mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
       execFile(
@@ -7319,11 +7319,11 @@ ${output}
 `, { flag: "a" });
           } catch {
           }
-          resolve7({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
+          resolve8({ ok: !err2, needsAdmin: !!err2 && NEEDS_ADMIN_RE.test(output) });
         }
       );
     } catch {
-      resolve7({ ok: false, needsAdmin: false });
+      resolve8({ ok: false, needsAdmin: false });
     }
   });
 }
@@ -7364,13 +7364,13 @@ function ownNodeModules() {
   return null;
 }
 function globalInstallCheck() {
-  prefixCheck ??= new Promise((resolve7) => {
+  prefixCheck ??= new Promise((resolve8) => {
     try {
       const dir = ownNodeModules();
-      if (!dir) return resolve7({ writable: null, dir: null });
-      access(dir, FS.W_OK, (e) => resolve7({ writable: !e, dir }));
+      if (!dir) return resolve8({ writable: null, dir: null });
+      access(dir, FS.W_OK, (e) => resolve8({ writable: !e, dir }));
     } catch {
-      resolve7({ writable: null, dir: null });
+      resolve8({ writable: null, dir: null });
     }
   });
   return prefixCheck;
@@ -9755,7 +9755,7 @@ function DryRunPanel({ focused }) {
   const [off, setOff] = useState3(0);
   const { cols, rows } = usePanelSize();
   const selected = policies[Math.min(pi, Math.max(0, policies.length - 1))];
-  function run11(policyIdx = pi, lim = limit) {
+  function run12(policyIdx = pi, lim = limit) {
     const p = policies[policyIdx];
     if (!p) return;
     setRunning(true);
@@ -9773,7 +9773,7 @@ function DryRunPanel({ focused }) {
       pendingPolicyId = null;
     }
     setPi(idx);
-    run11(idx, limit);
+    run12(idx, limit);
   }, [policies.length]);
   useInput2((input, key) => {
     if (!focused || editLogs !== null) return;
@@ -9782,10 +9782,10 @@ function DryRunPanel({ focused }) {
     else if (input === "p" || input === "P") {
       const n = policies.length ? (pi + 1) % policies.length : 0;
       setPi(n);
-      run11(n, limit);
+      run12(n, limit);
     } else if (input === "n" || input === "N") {
       setEditLogs(String(limit));
-    } else if (input === "r" || input === "R") run11(pi, limit);
+    } else if (input === "r" || input === "R") run12(pi, limit);
   });
   function commitLogs(raw) {
     const cap = Math.min(MAX_LIMIT, totalLogs && totalLogs > 0 ? totalLogs : MAX_LIMIT);
@@ -9793,7 +9793,7 @@ function DryRunPanel({ focused }) {
     const next = Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, cap) : limit;
     setEditLogs(null);
     setLimit(next);
-    run11(pi, next);
+    run12(pi, next);
   }
   const w = Math.max(40, cols);
   const lines = [];
@@ -11090,7 +11090,7 @@ function AuditPanel({ active: active2, focused }) {
   const sessLoading = source === "cloud" ? agentsQ.loading : localQ.loading;
   const doDelete = (kind) => {
     setMsg({ text: "deleting\u2026", level: "ok" });
-    const run11 = async () => {
+    const run12 = async () => {
       if (source === "cloud") {
         if (kind === "one") {
           if (!current) throw new Error("nothing selected");
@@ -11106,14 +11106,14 @@ function AuditPanel({ active: active2, focused }) {
         localQ.reload();
       }
     };
-    run11().then(() => {
+    run12().then(() => {
       setMsg({ text: kind === "one" ? "\u2713 entry deleted" : `\u2713 ALL ${source} logs deleted`, level: "ok" });
       toTop();
     }).catch((e) => setMsg({ text: "\u2717 " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
-    const run11 = async () => {
+    const run12 = async () => {
       const dir = join11(homedir9(), ".solongate");
       const file = join11(dir, `audit-export-${source}.jsonl`);
       let rows2;
@@ -11126,7 +11126,7 @@ function AuditPanel({ active: active2, focused }) {
       writeFileSync9(file, rows2.map((x) => JSON.stringify(x)).join("\n") + (rows2.length ? "\n" : ""));
       return { n: rows2.length, file };
     };
-    run11().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
+    run12().then(({ n, file }) => setMsg({ text: `\u2713 exported ${n} rows \u2192 ${file}`, level: "ok" })).catch((e) => setMsg({ text: "\u2717 export failed: " + (e instanceof Error ? e.message : String(e)), level: "bad" }));
   };
   useInput6(
     (input, key) => {
@@ -11620,6 +11620,11 @@ function usage(title, tagline, rows, footer = "Add --json for machine-readable o
   if (footer) lines.push("", `  ${c.dim}${footer}${c.reset}`);
   return lines.join("\n");
 }
+function unknownSub(command, sub, usageText) {
+  if (sub) err(`${red("  \u2717 ")}Unknown ${command} subcommand: ${cyan(sub)}`);
+  err(usageText);
+  return 1;
+}
 function decisionColor2(decision) {
   const d = decision.toUpperCase();
   if (d === "ALLOW") return green(d);
@@ -12008,7 +12013,7 @@ function SettingsPanel({
     guardQ.reload();
     selfQ.reload();
   };
-  const run11 = (label, fn, reload) => {
+  const run12 = (label, fn, reload) => {
     if (busy) return;
     setBusy(true);
     setMsg({ text: label + "\u2026", level: "ok" });
@@ -12090,8 +12095,8 @@ function SettingsPanel({
     const body = { signal: editor.signal, threshold: editor.threshold, windowSeconds: editor.windowSeconds, enabled: editor.enabled, ...channels };
     const id = editor.id;
     setEditor(null);
-    if (id) run11("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
-    else run11(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
+    if (id) run12("alert updated", () => api.settings.updateAlert(id, body), alertQ.reload);
+    else run12(`${editor.channel} alert added`, () => api.settings.createAlert({ name: "SolonGate alert", ...body }), alertQ.reload);
   };
   const activate = (r) => {
     if (r.kind === "acct") {
@@ -12165,7 +12170,7 @@ function SettingsPanel({
       })();
     } else if (r.kind === "self") {
       if (!selfProt) return;
-      run11(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
+      run12(selfProt.enabled ? "self-protection disabled" : "self-protection enabled", () => api.settings.setSelfProtection(!selfProt.enabled), selfQ.reload);
     } else if (r.kind === "cli-update") {
       if (updBusy) return;
       setUpdBusy(true);
@@ -12212,7 +12217,7 @@ function SettingsPanel({
         setMsg({ text: "set a path first (\u2193 then enter)", level: "bad" });
         return;
       }
-      run11(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
+      run12(local.enabled ? "local logs disabled" : "local logs enabled", () => api.settings.setLocalLogs({ enabled: !local.enabled, path: local.path }), localQ.reload);
     } else if (r.kind === "ll-path") {
       setInput(local?.path ?? "");
       setEditing("path");
@@ -12223,7 +12228,7 @@ function SettingsPanel({
         next.running ? { text: `\u2713 dashboard link running on 127.0.0.1:${next.port} \u2014 keeps running after you close the dataroom`, level: "ok" } : { text: "\u2713 dashboard link stopped (disabled until you start it again)", level: "ok" }
       );
     } else if (r.kind === "wh") {
-      run11(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
+      run12(r.wh.enabled ? "webhook disabled" : "webhook enabled", () => api.settings.updateWebhook(r.wh.id, { enabled: !r.wh.enabled }), whQ.reload);
     } else if (r.kind === "wh-add") {
       setInput("");
       setEditing("wh-url");
@@ -12242,7 +12247,7 @@ function SettingsPanel({
     setEditing(null);
     if (which === "path") {
       const enabled = (local?.enabled ?? false) && v.length > 0;
-      run11(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
+      run12(v ? `path saved${enabled ? "" : " (press enter on enabled to turn on)"}` : "path cleared (local logs off)", () => api.settings.setLocalLogs({ enabled, path: v }), localQ.reload);
     } else if (which === "wh-url") {
       const url = v.replace(/^["'<]+|["'>]+$/g, "").trim();
       if (!url) return;
@@ -12250,7 +12255,7 @@ function SettingsPanel({
         setMsg({ text: "\u2717 webhook url must start with http:// or https://", level: "bad" });
         return;
       }
-      run11("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
+      run12("webhook added", () => api.settings.createWebhook({ url, events: "denials" }), whQ.reload);
     } else if (which === "alert-target" && editor) {
       setEditor({ ...editor, target: v, field: 1 });
     }
@@ -12305,7 +12310,7 @@ function SettingsPanel({
           setMsg(ok ? { text: `\u2713 ${acctLabel(cur.acc)} is now the ACTIVE key (guard + logging)`, level: "ok" } : { text: "\u2717 could not set active", level: "bad" });
           refreshAccounts();
         } else if (cur.kind === "wh" || cur.kind === "alert" || cur.kind === "self" || cur.kind === "auto-update" || cur.kind === "ll-enabled" || cur.kind === "ll-server") {
-          if (cur.kind === "alert") run11(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
+          if (cur.kind === "alert") run12(cur.rule.enabled ? "alert disabled" : "alert enabled", () => api.settings.setAlertEnabled(cur.rule.id, !cur.rule.enabled), alertQ.reload);
           else activate(cur);
         }
       } else if (inp === "x" && cur.kind === "acct") {
@@ -12336,13 +12341,13 @@ function SettingsPanel({
         refreshAccounts();
         onAccountsChanged?.();
       } else if (inp === "t" && cur.kind === "wh") {
-        run11("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
+        run12("webhook test sent \u2014 check your endpoint", () => api.settings.sendTestWebhook(cur.wh.id).then((r) => {
           if (!r.delivered) throw new Error("endpoint rejected the test (non-2xx)");
         }), whQ.reload);
       } else if (inp === "e" && cur.kind === "ll-path") activate(cur);
       else if (inp === "e" && cur.kind === "wh") {
         const next = EVENTS[(EVENTS.indexOf(cur.wh.events) + 1) % EVENTS.length];
-        run11(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
+        run12(`webhook events \u2192 ${next}`, () => api.settings.updateWebhook(cur.wh.id, { events: next }), whQ.reload);
       } else if (inp === "e" && cur.kind === "alert") {
         const ch = alertChannel(cur.rule);
         if (ch) openAlertEditor(ch, cur.rule);
@@ -12379,10 +12384,10 @@ function SettingsPanel({
         setConfirmDel(null);
         if (cur.kind === "wh") {
           const id = cur.wh.id;
-          run11("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
+          run12("webhook deleted", () => api.settings.deleteWebhook(id).then(() => setHidden((h) => new Set(h).add("wh:" + id))), whQ.reload);
         } else {
           const id = cur.rule.id;
-          run11("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
+          run12("alert deleted", () => api.settings.deleteAlert(id).then(() => setHidden((h) => new Set(h).add("alert:" + id))), alertQ.reload);
         }
       } else if (inp === "r") reloadAll();
     },
@@ -12770,9 +12775,9 @@ function App() {
   const [update2, setUpdate] = useState9({ kind: "idle" });
   useEffect8(() => {
     let alive = true;
-    const run11 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
-    run11();
-    const t = setInterval(run11, 30 * 6e4);
+    const run12 = () => void tuiUpdateFlow((s) => alive && setUpdate(s));
+    run12();
+    const t = setInterval(run12, 30 * 6e4);
     return () => {
       alive = false;
       clearInterval(t);
@@ -13127,10 +13132,7 @@ async function run2(argv) {
       return 0;
     }
     default:
-      err(`  Unknown: policy ${sub}
-`);
-      err(USAGE);
-      return 1;
+      return unknownSub("policy", sub, USAGE);
   }
 }
 function printRules(rules) {
@@ -13234,7 +13236,7 @@ async function run3(argv) {
       return 0;
     }
     default:
-      return err(USAGE2), 1;
+      return unknownSub("ratelimit", sub, USAGE2);
   }
 }
 var USAGE2, modeColor2;
@@ -13319,7 +13321,7 @@ async function run4(argv) {
       return err(green(`  \u2713 Removed custom pattern "${name}"`)), 0;
     }
     default:
-      return err(USAGE3), 1;
+      return unknownSub("dlp", sub, USAGE3);
   }
 }
 var USAGE3, modeColor3;
@@ -13413,7 +13415,7 @@ async function run5(argv) {
       return err(green(`  \u2713 Stopped hiding "${glob}"`) + dim(` (${saved.ghost.patterns.length} route(s) left)`)), 0;
     }
     default:
-      return err(USAGE4), 1;
+      return unknownSub("ghost", sub, USAGE4);
   }
 }
 var USAGE4, modeColor4, isBlanketGlob;
@@ -13495,7 +13497,7 @@ async function run6(argv) {
       return 0;
     }
     default:
-      return err(USAGE5), 1;
+      return unknownSub("stats", sub, USAGE5);
   }
 }
 var USAGE5;
@@ -13643,6 +13645,88 @@ var init_agents2 = __esm({
   }
 });
 
+// src/commands/trace.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join14, resolve as resolve6 } from "path";
+function projectKey2(dir) {
+  let h = 2166136261;
+  const s = String(dir || "");
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)) >>> 0;
+  }
+  return h.toString(16);
+}
+async function run8(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "";
+  if (sub === "help") return err(USAGE7), 0;
+  if (sub) return unknownSub("trace", sub, USAGE7);
+  const limit = flagNum(flags, "limit") || 20;
+  const dir = join14(homedir12(), ".solongate", "projects", projectKey2(resolve6(process.cwd())));
+  let records;
+  try {
+    records = readFileSync12(join14(dir, ".eval-ring.jsonl"), "utf-8").split("\n").map((l) => l.trim()).filter(Boolean).map((l) => {
+      try {
+        return JSON.parse(l);
+      } catch {
+        return null;
+      }
+    }).filter((r) => r !== null).sort((a, b) => (b.ts ?? 0) - (a.ts ?? 0));
+  } catch {
+    err("");
+    err("  No local records for this directory.");
+    err(dim(`  ${dir}`));
+    err("");
+    err(dim("  The guard writes one per evaluation, in the directory the call was"));
+    err(dim("  made in. Run this from the project you are testing."));
+    return 1;
+  }
+  records = records.slice(0, limit);
+  if (flagBool(flags, "json")) return printJson(records), 0;
+  err("");
+  err(`  ${records.length} local evaluation(s) \xB7 ${dim(dir)}`);
+  table(
+    ["WHEN", "CLIENT", "TOOL", "PERM", "PATHS", "CMDS", "URLS", "ARGS", "MS"],
+    records.map((r) => [
+      r.ts ? new Date(r.ts).toTimeString().slice(0, 8) : "",
+      r.client ?? "",
+      r.tool ?? "",
+      dim(r.perm ?? ""),
+      countCell(r.paths),
+      countCell(r.cmds),
+      countCell(r.urls),
+      // An empty list is not the same as an absent one: it means the guard
+      // parsed the payload and found no arguments in it at all.
+      r.args === void 0 ? dim("-") : r.args.length ? r.args.join(",") : red("(none)"),
+      dim(`${Math.round(r.ms ?? 0)}ms`)
+    ])
+  );
+  err("");
+  err(dim("  PATHS/CMDS/URLS is what the guard extracted from the call. A path rule"));
+  err(dim("  cannot fire on a call whose PATHS is 0, whatever the rule says."));
+  return 0;
+}
+var USAGE7, countCell;
+var init_trace = __esm({
+  "src/commands/trace.ts"() {
+    "use strict";
+    init_args();
+    init_format();
+    USAGE7 = usage("solongate trace", "what the guard saw here", [
+      ["trace", "the last evaluations in this directory"],
+      ["trace --limit N", "how many to show (default 20)"],
+      ["trace --json", "the raw records"]
+    ]);
+    countCell = (n) => {
+      if (n === void 0 || n === null) return dim("-");
+      if (n === 0) return red("0");
+      return String(n);
+    };
+  }
+});
+
 // src/commands/watch.ts
 import { closeSync as closeSync2, existsSync as existsSync7, openSync as openSync4, readSync as readSync2, statSync as statSync4 } from "fs";
 function tailLocal(file, maxBytes = 131072) {
@@ -13668,7 +13752,7 @@ function print(r, json) {
     `${c.dim}[${time(r.at)}]${c.reset} ${src}${c.reset} ${dec}${r.decision.padEnd(6)}${c.reset} ${c.cyan}${trunc(r.tool, 12).padEnd(13)}${c.reset}${c.dim}${r.permission.slice(0, 4).padEnd(5)}${c.reset}${r.dlp ? c.red + "DLP! " + c.reset : ""}${c.dim}${trunc(r.agent || "-", 12).padEnd(13)}${r.detail}${c.reset}`
   );
 }
-async function run8(argv) {
+async function run9(argv) {
   const { flags } = parse(argv);
   const json = flagBool(flags, "json");
   const decisionFilter = (flagStr(flags, "filter") || "").toUpperCase();
@@ -13759,13 +13843,13 @@ var init_watch = __esm({
 });
 
 // src/commands/alerts.ts
-async function run9(argv) {
+async function run10(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE7), 0;
+      return err(USAGE8), 0;
     case "list": {
       const { rules } = await api.settings.getAlerts();
       if (json) return printJson(rules), 0;
@@ -13807,17 +13891,17 @@ async function run9(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE7), 1;
+      return unknownSub("alerts", sub, USAGE8);
   }
 }
-var USAGE7;
+var USAGE8;
 var init_alerts = __esm({
   "src/commands/alerts.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE7 = usage("solongate alerts", "spike alerts (Telegram / email)", [
+    USAGE8 = usage("solongate alerts", "spike alerts (Telegram / email)", [
       ["alerts list"],
       ["alerts add --signal deny|dlp|ratelimit|any --threshold N --window S"],
       ["             (--email <a> | --telegram <chatId> | --slack <url>)"],
@@ -13827,13 +13911,13 @@ var init_alerts = __esm({
 });
 
 // src/commands/webhooks.ts
-async function run10(argv) {
+async function run11(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0] ?? "list";
   const json = flagBool(flags, "json");
   switch (sub) {
     case "help":
-      return err(USAGE8), 0;
+      return err(USAGE9), 0;
     case "list": {
       const { webhooks } = await api.settings.getWebhooks();
       if (json) return printJson(webhooks), 0;
@@ -13859,17 +13943,17 @@ async function run10(argv) {
       return err(green(`  \u2713 Removed ${id}`)), 0;
     }
     default:
-      return err(USAGE8), 1;
+      return unknownSub("webhooks", sub, USAGE9);
   }
 }
-var USAGE8;
+var USAGE9;
 var init_webhooks = __esm({
   "src/commands/webhooks.ts"() {
     "use strict";
     init_api_client();
     init_args();
     init_format();
-    USAGE8 = usage("solongate webhooks", "event webhooks", [
+    USAGE9 = usage("solongate webhooks", "event webhooks", [
       ["webhooks list"],
       ["webhooks add --url <https://\u2026> [--events denials|allowed|all]"],
       ["webhooks remove <id>"]
@@ -13903,12 +13987,14 @@ async function dispatch(command, argv) {
       return runAgent(argv);
     case "doctor":
       return run(argv);
-    case "watch":
+    case "trace":
       return run8(argv);
-    case "alerts":
+    case "watch":
       return run9(argv);
-    case "webhooks":
+    case "alerts":
       return run10(argv);
+    case "webhooks":
+      return run11(argv);
     default:
       err(`  Unknown command: ${command}`);
       return 1;
@@ -13945,6 +14031,7 @@ var init_commands = __esm({
     init_audit2();
     init_agents2();
     init_doctor();
+    init_trace();
     init_watch();
     init_alerts();
     init_webhooks();
@@ -13958,9 +14045,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer } from "http";
-import { readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { resolve as resolve6, join as join14, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir12 } from "os";
+import { readFileSync as readFileSync13, statSync as statSync5 } from "fs";
+import { resolve as resolve7, join as join15, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir13 } from "os";
 import { readdirSync as readdirSync3 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -13977,15 +14064,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute2(dir)) return dir;
-  return resolve6(homedir12(), ".solongate", "local-logs");
+  return resolve7(homedir13(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve6(homedir12(), ".solongate");
+  const base = resolve7(homedir13(), ".solongate");
   try {
     const files = readdirSync3(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync12(join14(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync13(join15(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -13994,7 +14081,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync12(join14(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync13(join15(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -14023,7 +14110,7 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join14(dir, LOG_FILENAME);
+  const file = join15(dir, LOG_FILENAME);
   try {
     const st = statSync5(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
@@ -14106,7 +14193,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync12(info.file, "utf-8");
+        const text = readFileSync13(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -14159,9 +14246,9 @@ var init_logs_server = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -16937,7 +17024,7 @@ var Mutex = class {
       this.locked = true;
       return;
     }
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const timer = setTimeout(() => {
         const idx = this.queue.indexOf(onReady);
         if (idx !== -1) this.queue.splice(idx, 1);
@@ -16945,7 +17032,7 @@ var Mutex = class {
       }, timeoutMs);
       const onReady = () => {
         clearTimeout(timer);
-        resolve7();
+        resolve8();
       };
       this.queue.push(onReady);
     });
@@ -17537,7 +17624,7 @@ ${msg.content.text}`;
 
 // src/index.ts
 init_cli_utils();
-var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "repair", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks", "dataroom"]);
+var CLI_SUBCOMMANDS = /* @__PURE__ */ new Set(["update", "repair", "logs-server", "local-logs", "policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "trace", "watch", "alerts", "webhooks", "dataroom"]);
 var CLI_INFO_ARGS = /* @__PURE__ */ new Set(["login", "help", "--help", "-h", "--version", "-v", "version"]);
 var IS_HUMAN_CLI = process.argv.length <= 2 || CLI_SUBCOMMANDS.has(process.argv[2] ?? "") || CLI_INFO_ARGS.has(process.argv[2] ?? "");
 if (!IS_HUMAN_CLI) {
@@ -17556,8 +17643,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join15(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync13(p, "utf-8")).version || "unknown";
+    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }
@@ -17602,6 +17689,7 @@ function printHelp() {
   cmd("update auto on|off", "background auto-update (default off \u2014 on macOS npm -g often needs sudo)");
   cmd("repair", "restore the guard + hook + settings files if they were deleted or disarmed");
   cmd("doctor", "health check: login, policy, guard, local logs");
+  cmd("trace [--limit N]", "what the guard saw in this directory, allows included");
   cmd("doctor --json", "the same health check as machine-readable JSON");
   cmd("logs-server start", "start the local audit-log service for the dashboard (background)");
   cmd("logs-server stop", "stop AND disable it (only this makes it stay down)");
@@ -17731,7 +17819,7 @@ async function main() {
     await launchTui2();
     return;
   }
-  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "watch", "alerts", "webhooks"]);
+  const MGMT_COMMANDS = /* @__PURE__ */ new Set(["policy", "ratelimit", "dlp", "ghost", "stats", "audit", "sessions", "session", "doctor", "trace", "watch", "alerts", "webhooks"]);
   if (MGMT_COMMANDS.has(subcommand ?? "")) {
     const { runCommand: runCommand2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     const code = await runCommand2(subcommand, process.argv.slice(3));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.34",
+  "version": "0.83.36",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {
@@ -61,12 +61,12 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@solongate/guard-linux-x64": "0.83.34",
-    "@solongate/guard-linux-arm64": "0.83.34",
-    "@solongate/guard-darwin-x64": "0.83.34",
-    "@solongate/guard-darwin-arm64": "0.83.34",
-    "@solongate/guard-win32-x64": "0.83.34",
-    "@solongate/guard-win32-arm64": "0.83.34"
+    "@solongate/guard-linux-x64": "0.83.36",
+    "@solongate/guard-linux-arm64": "0.83.36",
+    "@solongate/guard-darwin-x64": "0.83.36",
+    "@solongate/guard-darwin-arm64": "0.83.36",
+    "@solongate/guard-win32-x64": "0.83.36",
+    "@solongate/guard-win32-arm64": "0.83.36"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",