@solongate/proxy 0.83.56 → 0.83.58

package/dist/index.js

@@ -6187,14 +6187,213 @@ var init_cli_utils = __esm({
   }
 });
 
+// src/hook-launcher.ts
+function launcherScript(pinnedNode) {
+  const pinned = pinnedNode.replace(/'/g, `'\\''`);
+  return `#!/bin/sh
+# SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
+#
+# Finds a working node and execs the hook with it. Do not edit: a reinstall
+# overwrites this file, and on macOS it is chflags-locked besides.
+#
+# The reason it exists rather than the hook naming a node directly: an absolute
+# node path recorded at install time is a Homebrew Cellar path or an nvm version
+# directory, and both are deleted by a routine upgrade. The hook then could not
+# start, nothing was enforced, nothing was logged, and every check still said
+# the guard was registered \u2014 because it was.
+
+set -u
+
+script="\${1:-}"
+[ -n "$script" ] || { echo "solongate: launcher called with no hook script" >&2; exit 1; }
+shift
+
+hook=\${script##*/}
+home=\${HOME:-~}
+beatdir="$home/.solongate/${BEAT_DIR}"
+
+# The beat. Written BEFORE node is resolved, because its whole job is to record
+# that the client invoked us \u2014 which is true even when everything after this
+# line fails. The file's modification time is the timestamp; nothing is forked
+# to produce one, and the directory test is a builtin.
+#
+# The braces matter. A redirect into a missing directory is reported by the
+# SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
+# not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
+# hook's stderr to the person using it. Redirecting the group catches both.
+beat() {
+  [ -d "$beatdir" ] || mkdir -p "$beatdir" 2>/dev/null || return 0
+  { printf '%s\\n' "$1" > "$beatdir/$hook"; } 2>/dev/null || true
+}
+
+try() {
+  [ -n "\${1:-}" ] && [ -x "$1" ]
+}
+
+resolve_node() {
+  # Told explicitly.
+  if try "\${SOLONGATE_NODE:-}"; then echo "$SOLONGATE_NODE"; return 0; fi
+  # The node this was installed with.
+  if try '${pinned}'; then echo '${pinned}'; return 0; fi
+  # PATH, when the client gave us one worth having.
+  p=$(command -v node 2>/dev/null) || p=
+  if try "$p"; then echo "$p"; return 0; fi
+  # The fixed locations.
+  for c in ${NODE_CANDIDATES.map((c2) => `"${c2}"`).join(" ")}; do
+    for g in $c; do
+      if try "$g"; then echo "$g"; return 0; fi
+    done
+  done
+  # The version managers.
+  for c in ${NODE_GLOBS.join(" ")}; do
+    for g in $c; do
+      if try "$g"; then echo "$g"; return 0; fi
+    done
+  done
+  return 1
+}
+
+node_bin=$(resolve_node) || node_bin=
+
+# --sg-doctor: report what would be used and leave. This is what \`solongate
+# doctor\` runs, so the health check exercises the REAL resolution rather than a
+# copy of it that can drift.
+if [ "$script" = "--sg-doctor" ] || [ "\${1:-}" = "--sg-doctor" ]; then
+  [ -n "$node_bin" ] && { echo "$node_bin"; exit 0; }
+  echo "no node found" >&2
+  exit 1
+fi
+
+if [ -z "$node_bin" ]; then
+  beat "no-node"
+  # Nothing can be enforced without node, and which way to fail is not a
+  # judgement call: the guard is fail-closed, so it refuses the call and says
+  # why. Everything else here only records what already happened, and refusing
+  # a tool call because the log could not be written would be a worse product
+  # than a gap in the log.
+  echo "solongate: no node runtime found, so $hook did not run." >&2
+  echo "solongate: run \\\`solongate repair\\\` in a terminal, or set SOLONGATE_NODE to your node binary." >&2
+  case "$hook" in
+    guard.mjs) echo "solongate: this tool call is REFUSED \u2014 the guard is fail-closed." >&2; exit 2 ;;
+    *) exit 0 ;;
+  esac
+fi
+
+beat "$node_bin"
+exec "$node_bin" "$script" "$@"
+`;
+}
+var NODE_CANDIDATES, NODE_GLOBS, LAUNCHER_NAME, BEAT_DIR;
+var init_hook_launcher = __esm({
+  "src/hook-launcher.ts"() {
+    "use strict";
+    NODE_CANDIDATES = [
+      // Homebrew, by the STABLE symlink rather than the Cellar path behind it —
+      // the exact distinction this file exists for. Apple Silicon then Intel.
+      "/opt/homebrew/bin/node",
+      "/usr/local/bin/node",
+      // Homebrew's keg-only layout, both prefixes.
+      "/opt/homebrew/opt/node/bin/node",
+      "/usr/local/opt/node/bin/node",
+      // Distro and hand-built.
+      "/usr/bin/node",
+      "/usr/local/n/versions/node/*/bin/node",
+      "/snap/bin/node"
+    ];
+    NODE_GLOBS = [
+      // nvm. NVM_DIR is exported by its own shell hook, which a non-interactive
+      // hook environment does not run, so the default location is tried too.
+      '"${NVM_DIR:-}"/versions/node/*/bin/node',
+      '"$home"/.nvm/versions/node/*/bin/node',
+      // fnm, both the XDG location and the macOS Application Support one.
+      '"$home"/.local/share/fnm/node-versions/*/installation/bin/node',
+      '"$home"/Library/Application Support/fnm/node-versions/*/installation/bin/node',
+      // Volta.
+      '"$home"/.volta/tools/image/node/*/bin/node',
+      // asdf, old layout and the current plugin one.
+      '"$home"/.asdf/installs/nodejs/*/bin/node',
+      '"$home"/.asdf/installs/node/*/bin/node'
+    ];
+    LAUNCHER_NAME = "sg-run.sh";
+    BEAT_DIR = ".beat";
+  }
+});
+
+// src/hook-health.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+function hookCanStart() {
+  const launcher = join4(hooksDir(), LAUNCHER_NAME);
+  if (process.platform === "win32") {
+    const ok = existsSync3(process.execPath);
+    return { ok, node: process.execPath, detail: ok ? process.execPath : `${process.execPath} is gone` };
+  }
+  if (!existsSync3(launcher)) {
+    return { ok: false, detail: "hook launcher missing - run `solongate repair`" };
+  }
+  try {
+    const out2 = execFileSync2("/bin/sh", [launcher, "--sg-doctor"], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (!out2) return { ok: false, detail: "launcher found no node runtime - set SOLONGATE_NODE or install node" };
+    return { ok: true, node: out2, detail: out2 };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { ok: false, detail: `launcher will not run: ${msg.split("\n")[0]}` };
+  }
+}
+function hookBeats() {
+  const dir = join4(sgDir(), BEAT_DIR);
+  const out2 = [];
+  for (const hook of ["guard.mjs", "audit.mjs", "conversation.mjs", "stop.mjs"]) {
+    const f = join4(dir, hook);
+    try {
+      const st = statSync(f);
+      out2.push({ hook, at: st.mtime, node: readFileSync4(f, "utf-8").trim() });
+    } catch {
+    }
+  }
+  return out2.sort((a, b) => b.at.getTime() - a.at.getTime());
+}
+function guardBeat() {
+  return hookBeats().find((b) => b.hook === "guard.mjs") ?? null;
+}
+function agoLabel(d) {
+  const s = Math.max(0, Math.round((Date.now() - d.getTime()) / 1e3));
+  if (s < 60) return s <= 3 ? "just now" : `${s}s ago`;
+  if (s < 3600) return `${Math.round(s / 60)}m ago`;
+  if (s < 86400) return `${Math.round(s / 3600)}h ago`;
+  return `${Math.round(s / 86400)}d ago`;
+}
+var sgDir, hooksDir;
+var init_hook_health = __esm({
+  "src/hook-health.ts"() {
+    "use strict";
+    init_hook_launcher();
+    sgDir = () => join4(homedir2(), ".solongate");
+    hooksDir = () => join4(sgDir(), "hooks");
+  }
+});
+
 // src/global-install.ts
 var global_install_exports = {};
 __export(global_install_exports, {
+  BEAT_DIR: () => BEAT_DIR,
+  LAUNCHER_NAME: () => LAUNCHER_NAME,
+  agoLabel: () => agoLabel,
   clearGuardUpdateCheck: () => clearGuardUpdateCheck,
   codexDetected: () => codexDetected,
   codexHooksStatus: () => codexHooksStatus,
   globalPaths: () => globalPaths,
+  guardBeat: () => guardBeat,
   guardHookOutdated: () => guardHookOutdated,
+  hookBeats: () => hookBeats,
+  hookCanStart: () => hookCanStart,
+  hookCommandFor: () => hookCommandFor,
   installClaudeShim: () => installClaudeShim,
   installGlobalQuiet: () => installGlobalQuiet,
   installGlobalWithKey: () => installGlobalWithKey,
@@ -6202,6 +6401,7 @@ __export(global_install_exports, {
   isCodexGuardInstalled: () => isCodexGuardInstalled,
   isGuardInstalled: () => isGuardInstalled,
   isOpencodeGuardInstalled: () => isOpencodeGuardInstalled,
+  launcherScript: () => launcherScript,
   lockProtected: () => lockProtected,
   opencodeDetected: () => opencodeDetected,
   removeClaudeShim: () => removeClaudeShim,
@@ -6212,39 +6412,40 @@ __export(global_install_exports, {
   sweepStrayScratchDirs: () => sweepStrayScratchDirs,
   uninstallGlobalQuiet: () => uninstallGlobalQuiet,
   unlockProtected: () => unlockProtected,
+  writeLauncher: () => writeLauncher,
   writeProtectedFile: () => writeProtectedFile
 });
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2, rmdirSync, readdirSync, statSync, chmodSync, copyFileSync, renameSync } from "fs";
-import { resolve as resolve3, join as join4, dirname } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3, rmSync as rmSync2, rmdirSync, readdirSync, statSync as statSync2, chmodSync, copyFileSync, renameSync } from "fs";
+import { resolve as resolve3, join as join5, dirname, basename } from "path";
+import { homedir as homedir3 } from "os";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync as execFileSync2, spawn } from "child_process";
+import { execFileSync as execFileSync3, spawn } from "child_process";
 function lockFile(file) {
-  if (!existsSync3(file)) return;
+  if (!existsSync4(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
+        execFileSync3("attrib", ["+R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
+        execFileSync3("chflags", ["uchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
+        execFileSync3("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -6256,33 +6457,33 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync3(file)) return;
+  if (!existsSync4(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync2("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
+        execFileSync3("icacls", [file, "/reset"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
+        execFileSync3("attrib", ["-R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
+        execFileSync3("chflags", ["nouchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
+        execFileSync3("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -6296,14 +6497,19 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join4(p.hooksDir, "guard.mjs"),
-    join4(p.hooksDir, "audit.mjs"),
-    join4(p.hooksDir, "stop.mjs"),
-    join4(p.hooksDir, "shield.mjs"),
+    join5(p.hooksDir, "guard.mjs"),
+    join5(p.hooksDir, "audit.mjs"),
+    join5(p.hooksDir, "stop.mjs"),
+    join5(p.hooksDir, "shield.mjs"),
     // The conversation record is locked with the rest. A guest who could edit
     // it could decide what their host sees them say, which is the same class of
     // problem as editing the guard.
-    join4(p.hooksDir, "conversation.mjs"),
+    join5(p.hooksDir, "conversation.mjs"),
+    // The launcher is the enforcement path now: every hook command in every
+    // client config runs THROUGH it. A program that could rewrite it could
+    // point every hook at /bin/true and disarm the guard without touching a
+    // single file that used to be locked.
+    join5(p.hooksDir, LAUNCHER_NAME),
     p.configPath,
     p.settingsPath,
     p.antigravityHooksPath,
@@ -6337,60 +6543,60 @@ function writeProtectedFile(file, contents) {
   }
 }
 function globalPaths() {
-  const home = homedir2();
-  const sgDir = join4(home, ".solongate");
-  const hooksDir = join4(sgDir, "hooks");
-  const claudeDir = join4(home, ".claude");
-  const antigravityDir = join4(home, ".gemini", "config");
-  const codexDir = process.env["CODEX_HOME"] ? resolve3(process.env["CODEX_HOME"]) : join4(home, ".codex");
-  const opencodeDir = join4(process.env["XDG_CONFIG_HOME"] ? resolve3(process.env["XDG_CONFIG_HOME"]) : join4(home, ".config"), "opencode");
-  const binDir = join4(sgDir, "bin");
+  const home = homedir3();
+  const sgDir2 = join5(home, ".solongate");
+  const hooksDir2 = join5(sgDir2, "hooks");
+  const claudeDir = join5(home, ".claude");
+  const antigravityDir = join5(home, ".gemini", "config");
+  const codexDir = process.env["CODEX_HOME"] ? resolve3(process.env["CODEX_HOME"]) : join5(home, ".codex");
+  const opencodeDir = join5(process.env["XDG_CONFIG_HOME"] ? resolve3(process.env["XDG_CONFIG_HOME"]) : join5(home, ".config"), "opencode");
+  const binDir = join5(sgDir2, "bin");
   return {
     home,
-    sgDir,
-    hooksDir,
+    sgDir: sgDir2,
+    hooksDir: hooksDir2,
     binDir,
     claudeDir,
     antigravityDir,
     codexDir,
     opencodeDir,
-    settingsPath: join4(claudeDir, "settings.json"),
-    backupPath: join4(claudeDir, "settings.solongate.bak"),
-    configPath: join4(sgDir, "cloud-guard.json"),
+    settingsPath: join5(claudeDir, "settings.json"),
+    backupPath: join5(claudeDir, "settings.solongate.bak"),
+    configPath: join5(sgDir2, "cloud-guard.json"),
     // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
     // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
     // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join4(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join4(antigravityDir, "hooks.solongate.bak"),
+    antigravityHooksPath: join5(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join5(antigravityDir, "hooks.solongate.bak"),
     // Codex reads user-level hooks from ~/.codex/hooks.json (or a [hooks] table
     // in ~/.codex/config.toml — we use the JSON file so we never have to rewrite
     // the user's TOML, which also holds the hook TRUST state Codex manages).
-    codexHooksPath: join4(codexDir, "hooks.json"),
-    codexBackupPath: join4(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join4(codexDir, "config.toml"),
+    codexHooksPath: join5(codexDir, "hooks.json"),
+    codexBackupPath: join5(codexDir, "hooks.solongate.bak"),
+    codexConfigPath: join5(codexDir, "config.toml"),
     // OpenCode scans its plugin folder at startup and loads every module in it.
     // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
     // docs and the field reports are each half right. We write the documented
     // one. There is nothing to register anywhere — dropping the file IS the
     // installation, which also means deleting the file IS the uninstall.
-    opencodePluginDir: join4(opencodeDir, "plugins"),
-    opencodePluginPath: join4(opencodeDir, "plugins", "solongate.js")
+    opencodePluginDir: join5(opencodeDir, "plugins"),
+    opencodePluginPath: join5(opencodeDir, "plugins", "solongate.js")
   };
 }
 function clearGuardUpdateCheck() {
   try {
-    rmSync2(join4(globalPaths().sgDir, ".hook-update-check"), { force: true });
+    rmSync2(join5(globalPaths().sgDir, ".hook-update-check"), { force: true });
     return true;
   } catch {
     return false;
   }
 }
 function readHook(filename) {
-  return readFileSync4(join4(HOOKS_DIR, filename), "utf-8");
+  return readFileSync5(join5(HOOKS_DIR, filename), "utf-8");
 }
 function firstAccountCredential() {
   try {
-    const raw = JSON.parse(readFileSync4(join4(homedir2(), ".solongate", "accounts.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync5(join5(homedir3(), ".solongate", "accounts.json"), "utf-8"));
     if (Array.isArray(raw)) {
       const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
       if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
@@ -6400,8 +6606,8 @@ function firstAccountCredential() {
   return {};
 }
 function readGuard() {
-  const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync3(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join5(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync4(bundled) ? readFileSync5(bundled, "utf-8") : readHook("guard.mjs");
 }
 function installGoBinaries(binDir) {
   const os_ = process.platform === "win32" ? "win32" : process.platform;
@@ -6421,10 +6627,10 @@ function installGoBinaries(binDir) {
     return placed;
   }
   for (const name of ["solongate-guard", "solongate"]) {
-    const from = join4(pkgDir, name + suffix);
-    const to = join4(binDir, name + suffix);
+    const from = join5(pkgDir, name + suffix);
+    const to = join5(binDir, name + suffix);
     try {
-      if (!existsSync3(from)) continue;
+      if (!existsSync4(from)) continue;
       const tmp = to + ".new";
       copyFileSync(from, tmp);
       chmodSync(tmp, 493);
@@ -6436,16 +6642,17 @@ function installGoBinaries(binDir) {
   return placed;
 }
 function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
+  return hookCommandFor(dirname(guardAbs), basename(guardAbs), "antigravity", "Antigravity");
+}
+function antigravityConversationCommand(guardAbs) {
+  return hookCommandFor(dirname(guardAbs), "conversation.mjs", "antigravity", "Antigravity");
 }
 function installAntigravityGuard(p, guardAbs) {
   mkdirSync3(p.antigravityDir, { recursive: true });
   let existing = {};
-  if (existsSync3(p.antigravityHooksPath)) {
-    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
-    if (!existsSync3(p.antigravityBackupPath)) writeFileSync3(p.antigravityBackupPath, raw);
+  if (existsSync4(p.antigravityHooksPath)) {
+    const raw = readFileSync5(p.antigravityHooksPath, "utf-8");
+    if (!existsSync4(p.antigravityBackupPath)) writeFileSync3(p.antigravityBackupPath, raw);
     try {
       existing = JSON.parse(raw);
     } catch {
@@ -6455,15 +6662,16 @@ function installAntigravityGuard(p, guardAbs) {
   const merged = {
     ...existing,
     [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: antigravityConversationCommand(guardAbs) }] }]
     }
   };
   writeFileSync3(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
 }
 function removeAntigravityGuard(p) {
-  if (!existsSync3(p.antigravityHooksPath)) return;
+  if (!existsSync4(p.antigravityHooksPath)) return;
   try {
-    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
+    const s = JSON.parse(readFileSync5(p.antigravityHooksPath, "utf-8"));
     if (!(ANTIGRAVITY_GROUP in s)) return;
     delete s[ANTIGRAVITY_GROUP];
     writeFileSync3(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
@@ -6471,8 +6679,10 @@ function removeAntigravityGuard(p) {
   }
 }
 function codexHookCommand(scriptAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  return `"${nodeBin}" "${scriptAbs.replace(/\\/g, "/")}" codex "Codex"`;
+  if (process.platform === "win32") {
+    return `"${process.execPath.replace(/\\/g, "/")}" "${scriptAbs.replace(/\\/g, "/")}" codex "Codex"`;
+  }
+  return hookCommandFor(dirname(scriptAbs), basename(scriptAbs), "codex", "Codex");
 }
 function isOurCodexGroup(group) {
   const hooks = Array.isArray(group?.hooks) ? group.hooks : [];
@@ -6480,10 +6690,10 @@ function isOurCodexGroup(group) {
 }
 function readCodexHooksFile(path) {
   const out2 = { hooks: {}, rest: {} };
-  if (!existsSync3(path)) return out2;
+  if (!existsSync4(path)) return out2;
   let raw;
   try {
-    raw = JSON.parse(readFileSync4(path, "utf-8"));
+    raw = JSON.parse(readFileSync5(path, "utf-8"));
   } catch {
     return out2;
   }
@@ -6528,10 +6738,10 @@ function writeCodexHooksFile(path, file) {
   body["hooks"] = hooks;
   writeFileSync3(path, JSON.stringify(body, null, 2) + "\n");
 }
-function installCodexGuard(p, hooksDir) {
+function installCodexGuard(p, hooksDir2) {
   mkdirSync3(p.codexDir, { recursive: true });
-  if (existsSync3(p.codexHooksPath) && !existsSync3(p.codexBackupPath)) {
-    writeFileSync3(p.codexBackupPath, readFileSync4(p.codexHooksPath, "utf-8"));
+  if (existsSync4(p.codexHooksPath) && !existsSync4(p.codexBackupPath)) {
+    writeFileSync3(p.codexBackupPath, readFileSync5(p.codexHooksPath, "utf-8"));
   }
   const file = readCodexHooksFile(p.codexHooksPath);
   const script = {
@@ -6555,7 +6765,7 @@ function installCodexGuard(p, hooksDir) {
       ...ev === "Stop" ? {} : { matcher: "*" },
       hooks: [{
         type: "command",
-        command: codexHookCommand(join4(hooksDir, script[ev]).replace(/\\/g, "/")),
+        command: codexHookCommand(join5(hooksDir2, script[ev]).replace(/\\/g, "/")),
         timeout: CODEX_TIMEOUT_SEC,
         statusMessage: status[ev]
       }]
@@ -6565,7 +6775,7 @@ function installCodexGuard(p, hooksDir) {
   writeCodexHooksFile(p.codexHooksPath, file);
 }
 function removeCodexGuard(p) {
-  if (!existsSync3(p.codexHooksPath)) return;
+  if (!existsSync4(p.codexHooksPath)) return;
   try {
     const file = readCodexHooksFile(p.codexHooksPath);
     let changed = false;
@@ -6591,7 +6801,7 @@ function isCodexGuardInstalled() {
 }
 function codexDetected() {
   try {
-    return existsSync3(globalPaths().codexDir);
+    return existsSync4(globalPaths().codexDir);
   } catch {
     return false;
   }
@@ -6601,7 +6811,7 @@ function codexHooksStatus() {
   const registered = isCodexGuardInstalled();
   let trusted = false, disabled = false;
   try {
-    const toml = readFileSync4(p.codexConfigPath, "utf-8");
+    const toml = readFileSync5(p.codexConfigPath, "utf-8");
     trusted = /trusted_hash\s*=/.test(toml);
     disabled = /^\s*hooks\s*=\s*false\s*$/m.test(toml);
   } catch {
@@ -6620,10 +6830,10 @@ function removeOpencodeGuard(p) {
   } catch {
   }
 }
-function warmPolicyCache(hooksDir, agents) {
+function warmPolicyCache(hooksDir2, agents) {
   for (const agent of agents) {
     try {
-      const child = spawn(process.execPath, [join4(hooksDir, "guard.mjs"), agent, "--sg-refresh-policy"], {
+      const child = spawn(process.execPath, [join5(hooksDir2, "guard.mjs"), agent, "--sg-refresh-policy"], {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -6637,23 +6847,23 @@ function warmPolicyCache(hooksDir, agents) {
 }
 function isOpencodeGuardInstalled() {
   try {
-    return readFileSync4(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+    return readFileSync5(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
   } catch {
     return false;
   }
 }
 function opencodeDetected() {
   try {
-    return existsSync3(globalPaths().opencodeDir);
+    return existsSync4(globalPaths().opencodeDir);
   } catch {
     return false;
   }
 }
-function sweepStrayScratchDirs(root = homedir2(), maxDepth = 6, budget = 4e4) {
+function sweepStrayScratchDirs(root = homedir3(), maxDepth = 6, budget = 4e4) {
   let removed = 0;
   let visited = 0;
   const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next", "build"]);
-  const store = join4(homedir2(), ".solongate");
+  const store = join5(homedir3(), ".solongate");
   const walk = (dir, depth) => {
     if (depth > maxDepth || visited++ > budget) return;
     let entries;
@@ -6664,11 +6874,11 @@ function sweepStrayScratchDirs(root = homedir2(), maxDepth = 6, budget = 4e4) {
     }
     for (const name of entries) {
       if (skip.has(name)) continue;
-      const full = join4(dir, name);
+      const full = join5(dir, name);
       if (full === store) continue;
       let isDir = false;
       try {
-        isDir = statSync(full).isDirectory();
+        isDir = statSync2(full).isDirectory();
       } catch {
         continue;
       }
@@ -6679,7 +6889,7 @@ function sweepStrayScratchDirs(root = homedir2(), maxDepth = 6, budget = 4e4) {
           for (const f of readdirSync(full)) {
             if (SCRATCH_FILES.has(f)) {
               try {
-                rmSync2(join4(full, f), { force: true });
+                rmSync2(join5(full, f), { force: true });
               } catch {
                 left.push(f);
               }
@@ -6719,12 +6929,12 @@ function runGlobalRestore() {
     removeOpencodeGuard(p);
   } catch {
   }
-  if (existsSync3(p.backupPath)) {
-    writeFileSync3(p.settingsPath, readFileSync4(p.backupPath, "utf-8"));
+  if (existsSync4(p.backupPath)) {
+    writeFileSync3(p.settingsPath, readFileSync5(p.backupPath, "utf-8"));
     console.log(`  Restored ${p.settingsPath} from backup.`);
-  } else if (existsSync3(p.settingsPath)) {
+  } else if (existsSync4(p.settingsPath)) {
     try {
-      const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+      const s = JSON.parse(readFileSync5(p.settingsPath, "utf-8"));
       delete s.hooks;
       writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
       console.log(`  Removed SolonGate hooks from ${p.settingsPath}.`);
@@ -6737,12 +6947,17 @@ function runGlobalRestore() {
 }
 function repairQuiet() {
   const p = globalPaths();
-  const has = (f) => existsSync3(f);
-  const guardFile = join4(p.hooksDir, "guard.mjs");
+  const has = (f) => existsSync4(f);
+  const guardFile = join5(p.hooksDir, "guard.mjs");
   const line = (label, ok, yes, no) => ({ label, ok, detail: ok ? yes : no });
+  const runtime = () => {
+    const r2 = hookCanStart();
+    return { label: "hook runtime", ok: r2.ok, detail: r2.ok ? `node ${r2.detail}` : r2.detail };
+  };
   const before = [
     line("guard hook file", has(guardFile), "present", "MISSING"),
     line("cloud credential", has(p.configPath), "present", "MISSING"),
+    runtime(),
     line("Claude hooks", isGuardInstalled(), "guard registered", "guard NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "guard registered", "guard NOT registered"),
     line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered"),
@@ -6752,6 +6967,7 @@ function repairQuiet() {
   if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
   const after = [
     { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
+    runtime(),
     line("Claude hooks", isGuardInstalled(), "guard registered", "NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "guard registered", "NOT registered"),
     line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered"),
@@ -6812,7 +7028,7 @@ function installGlobalQuiet() {
     let apiKey = process.env["SOLONGATE_API_KEY"] || "";
     let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
     try {
-      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync5(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
       if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
     } catch {
@@ -6828,26 +7044,26 @@ function installGlobalQuiet() {
     mkdirSync3(p.hooksDir, { recursive: true });
     mkdirSync3(p.claudeDir, { recursive: true });
     unlockProtected();
-    writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync3(join5(p.hooksDir, "guard.mjs"), readGuard());
     installGoBinaries(p.binDir);
-    writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-    writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-    writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-    writeFileSync3(join4(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
+    writeFileSync3(join5(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync3(join5(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync3(join5(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync3(join5(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
+    writeLauncher(p.hooksDir);
+    writeLauncher(p.hooksDir);
     writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
     let existing = {};
-    if (existsSync3(p.settingsPath)) {
-      const raw = readFileSync4(p.settingsPath, "utf-8");
-      if (!existsSync3(p.backupPath)) writeFileSync3(p.backupPath, raw);
+    if (existsSync4(p.settingsPath)) {
+      const raw = readFileSync5(p.settingsPath, "utf-8");
+      if (!existsSync4(p.backupPath)) writeFileSync3(p.backupPath, raw);
       try {
         existing = JSON.parse(raw);
       } catch {
         existing = {};
       }
     }
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const call = process.platform === "win32" ? "& " : "";
-    const hookCmd = (script) => `${call}"${nodeBin}" "${join4(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const hookCmd = (script) => hookCommandFor(p.hooksDir, script);
     const merged = {
       ...existing,
       hooks: {
@@ -6874,7 +7090,7 @@ function installGlobalQuiet() {
     };
     writeFileSync3(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
     try {
-      installAntigravityGuard(p, join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
+      installAntigravityGuard(p, join5(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
     try {
@@ -6895,7 +7111,7 @@ function installGlobalQuiet() {
 function installedGuardVersion() {
   try {
     const p = globalPaths();
-    const s = readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8");
+    const s = readFileSync5(join5(p.hooksDir, "guard.mjs"), "utf-8");
     const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
     return m ? parseInt(m[1], 10) : null;
   } catch {
@@ -6905,16 +7121,35 @@ function installedGuardVersion() {
 function guardHookOutdated() {
   try {
     const p = globalPaths();
-    return readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
+    return readFileSync5(join5(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
     return false;
   }
 }
+function hookCommandFor(hooksDir2, script, client = "claude-code", label = "Claude Code") {
+  const target = join5(hooksDir2, script).replace(/\\/g, "/");
+  if (process.platform === "win32") {
+    return `& "${process.execPath.replace(/\\/g, "/")}" "${target}" ${client} "${label}"`;
+  }
+  const launcher = join5(hooksDir2, LAUNCHER_NAME).replace(/\\/g, "/");
+  return `/bin/sh "${launcher}" "${target}" ${client} "${label}"`;
+}
+function writeLauncher(hooksDir2) {
+  writeFileSync3(join5(hooksDir2, LAUNCHER_NAME), launcherScript(process.execPath));
+  try {
+    chmodSync(join5(hooksDir2, LAUNCHER_NAME), 493);
+  } catch {
+  }
+  try {
+    mkdirSync3(join5(hooksDir2, "..", BEAT_DIR), { recursive: true });
+  } catch {
+  }
+}
 function isGuardInstalled() {
   try {
     const p = globalPaths();
-    if (!existsSync3(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    if (!existsSync4(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync5(p.settingsPath, "utf-8"));
     return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
   } catch {
     return false;
@@ -6937,8 +7172,8 @@ function uninstallGlobalQuiet() {
       removeOpencodeGuard(p);
     } catch {
     }
-    if (!existsSync3(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
-    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
+    if (!existsSync4(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync5(p.settingsPath, "utf-8"));
     delete s.hooks;
     writeFileSync3(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
     return { ok: true, message: "guard removed (open a new session)" };
@@ -6952,7 +7187,7 @@ function escapeRe(s) {
 function resolveRealClaude() {
   try {
     const finder = process.platform === "win32" ? "where" : "which";
-    const out2 = execFileSync2(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    const out2 = execFileSync3(finder, ["claude"], { encoding: "utf-8" }).split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
     if (process.platform === "win32") {
       const low = (s) => s.toLowerCase();
       return out2.find((l) => low(l).endsWith(".cmd")) || out2.find((l) => low(l).endsWith(".exe")) || out2.find((l) => low(l).endsWith(".bat")) || out2[0] || null;
@@ -6965,17 +7200,17 @@ function resolveRealClaude() {
 function shimTargets() {
   if (process.platform === "win32") {
     try {
-      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      const prof = execFileSync3("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
       return prof ? [prof] : [];
     } catch {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir2(), f)).filter((f) => existsSync3(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join5(homedir3(), f)).filter((f) => existsSync4(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync3(file) ? readFileSync4(file, "utf-8") : "";
+  let content = existsSync4(file) ? readFileSync5(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
@@ -7020,7 +7255,7 @@ async function runGlobalInstall(opts = {}) {
   let apiKey = opts.apiKey || process.env["SOLONGATE_API_KEY"] || "";
   if (!apiKey || apiKey === "sg_live_your_key_here") {
     try {
-      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync5(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = cfg.apiKey;
     } catch {
     }
@@ -7040,19 +7275,19 @@ async function runGlobalInstall(opts = {}) {
   mkdirSync3(p.hooksDir, { recursive: true });
   mkdirSync3(p.claudeDir, { recursive: true });
   unlockProtected();
-  writeFileSync3(join4(p.hooksDir, "guard.mjs"), readGuard());
-  writeFileSync3(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-  writeFileSync3(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-  writeFileSync3(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-  writeFileSync3(join4(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
+  writeFileSync3(join5(p.hooksDir, "guard.mjs"), readGuard());
+  writeFileSync3(join5(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+  writeFileSync3(join5(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+  writeFileSync3(join5(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+  writeFileSync3(join5(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
   console.log(`  Installed hooks \u2192 ${p.hooksDir}`);
-  installClaudeShim(join4(p.hooksDir, "shield.mjs"));
+  installClaudeShim(join5(p.hooksDir, "shield.mjs"));
   writeFileSync3(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
   console.log(`  Wrote ${p.configPath}`);
   let existing = {};
-  if (existsSync3(p.settingsPath)) {
-    const raw = readFileSync4(p.settingsPath, "utf-8");
-    if (!existsSync3(p.backupPath)) {
+  if (existsSync4(p.settingsPath)) {
+    const raw = readFileSync5(p.settingsPath, "utf-8");
+    if (!existsSync4(p.backupPath)) {
       writeFileSync3(p.backupPath, raw);
       console.log(`  Backed up existing settings \u2192 ${p.backupPath}`);
     }
@@ -7062,22 +7297,17 @@ async function runGlobalInstall(opts = {}) {
       existing = {};
     }
   }
-  const guardAbs = join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
-  const auditAbs = join4(p.hooksDir, "audit.mjs").replace(/\\/g, "/");
-  const stopAbs = join4(p.hooksDir, "stop.mjs").replace(/\\/g, "/");
-  const convAbs = join4(p.hooksDir, "conversation.mjs").replace(/\\/g, "/");
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  const hookCmd = (script) => `${call}"${nodeBin}" "${script}" claude-code "Claude Code"`;
+  const guardAbs = join5(p.hooksDir, "guard.mjs").replace(/\\/g, "/");
+  const hookCmd = (script) => hookCommandFor(p.hooksDir, script);
   const merged = {
     ...existing,
     hooks: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(guardAbs) }] }],
-      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(auditAbs) }] }],
-      UserPromptSubmit: [{ matcher: "", hooks: [{ type: "command", command: hookCmd(convAbs) }] }],
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("guard.mjs") }] }],
+      PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("audit.mjs") }] }],
+      UserPromptSubmit: [{ matcher: "", hooks: [{ type: "command", command: hookCmd("conversation.mjs") }] }],
       Stop: [
-        { matcher: "", hooks: [{ type: "command", command: hookCmd(stopAbs) }] },
-        { matcher: "", hooks: [{ type: "command", command: hookCmd(convAbs) }] }
+        { matcher: "", hooks: [{ type: "command", command: hookCmd("stop.mjs") }] },
+        { matcher: "", hooks: [{ type: "command", command: hookCmd("conversation.mjs") }] }
       ]
     }
   };
@@ -7122,6 +7352,10 @@ var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, CODEX_EVENTS, CODEX_TIMEOUT_SEC, SC
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
+    init_hook_launcher();
+    init_hook_launcher();
+    init_hook_health();
+    init_hook_health();
     __dirname = dirname(fileURLToPath(import.meta.url));
     HOOKS_DIR = resolve3(__dirname, "..", "hooks");
     ANTIGRAVITY_GROUP = "solongate-guard";
@@ -7152,14 +7386,14 @@ __export(self_update_exports, {
   tuiUpdateFlow: () => tuiUpdateFlow,
   updateNow: () => updateNow
 });
-import { execFile, execFileSync as execFileSync3, spawn as spawn2 } from "child_process";
-import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, constants as FS } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join5, sep } from "path";
+import { execFile, execFileSync as execFileSync4, spawn as spawn2 } from "child_process";
+import { access, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync6, writeFileSync as writeFileSync4, constants as FS } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join6, sep } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function lockHeldAt() {
   try {
-    const ts = Number(readFileSync5(LOCK_FILE, "utf-8").trim().split(/\s+/)[1] ?? 0);
+    const ts = Number(readFileSync6(LOCK_FILE, "utf-8").trim().split(/\s+/)[1] ?? 0);
     if (!Number.isFinite(ts) || Date.now() - ts >= LOCK_STALE_MS) return null;
     return ts;
   } catch {
@@ -7168,7 +7402,7 @@ function lockHeldAt() {
 }
 function takeInstallLock() {
   try {
-    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    mkdirSync4(join6(homedir4(), ".solongate"), { recursive: true });
     writeFileSync4(LOCK_FILE, `${process.pid} ${Date.now()}
 `);
   } catch {
@@ -7183,7 +7417,7 @@ function releaseInstallLock() {
 }
 function readState() {
   try {
-    const s = JSON.parse(readFileSync5(STATE_FILE, "utf-8"));
+    const s = JSON.parse(readFileSync6(STATE_FILE, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -7191,7 +7425,7 @@ function readState() {
 }
 function writeState(s) {
   try {
-    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    mkdirSync4(join6(homedir4(), ".solongate"), { recursive: true });
     writeFileSync4(STATE_FILE, JSON.stringify(s));
   } catch {
   }
@@ -7212,7 +7446,7 @@ function setAutoUpdate(on) {
 }
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync5(join5(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync6(join6(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -7249,7 +7483,7 @@ async function fetchLatest() {
 function spawnGlobalInstall(version) {
   if (lockHeldAt() !== null) return false;
   try {
-    mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+    mkdirSync4(join6(homedir4(), ".solongate"), { recursive: true });
     takeInstallLock();
     const log3 = openSync(LOG_FILE, "a");
     const p = spawn2("npm", ["install", "-g", `${PKG}@${version}`], {
@@ -7320,7 +7554,7 @@ async function runUpdateCommand() {
   }
   try {
     if (newerThan(latest, cur)) {
-      execFileSync3("solongate", ["repair"], {
+      execFileSync4("solongate", ["repair"], {
         env: { ...process.env, SOLONGATE_INTERNAL: "1" },
         stdio: "inherit",
         shell: process.platform === "win32"
@@ -7337,7 +7571,7 @@ async function runUpdateCommand() {
 function runGlobalInstall2(version) {
   return new Promise((resolve8) => {
     try {
-      mkdirSync4(join5(homedir3(), ".solongate"), { recursive: true });
+      mkdirSync4(join6(homedir4(), ".solongate"), { recursive: true });
       execFile(
         "npm",
         ["install", "-g", `${PKG}@${version}`],
@@ -7530,9 +7764,9 @@ var init_self_update = __esm({
     PKG = "@solongate/proxy";
     CHECK_EVERY_MS = 30 * 60 * 1e3;
     ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
-    STATE_FILE = join5(homedir3(), ".solongate", ".self-update.json");
-    LOG_FILE = join5(homedir3(), ".solongate", "self-update.log");
-    LOCK_FILE = join5(homedir3(), ".solongate", ".update-install.lock");
+    STATE_FILE = join6(homedir4(), ".solongate", ".self-update.json");
+    LOG_FILE = join6(homedir4(), ".solongate", "self-update.log");
+    LOCK_FILE = join6(homedir4(), ".solongate", ".update-install.lock");
     LOCK_STALE_MS = 3 * 6e4;
     LOCK_WAIT_MS = 9e4;
     sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -7552,13 +7786,13 @@ __export(logs_server_daemon_exports, {
   stopLogsServerDaemon: () => stopLogsServerDaemon
 });
 import { spawn as spawn3 } from "child_process";
-import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
+import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname3, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function readState2() {
   try {
-    const s = JSON.parse(readFileSync6(STATE_FILE2, "utf-8"));
+    const s = JSON.parse(readFileSync7(STATE_FILE2, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -7597,7 +7831,7 @@ function startLogsServerDaemon() {
   try {
     mkdirSync5(DIR, { recursive: true });
     const log3 = openSync2(LOG_FILE2, "a");
-    const cli = join6(dirname3(fileURLToPath3(import.meta.url)), "index.js");
+    const cli = join7(dirname3(fileURLToPath3(import.meta.url)), "index.js");
     const p = spawn3(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log3, log3],
@@ -7637,22 +7871,22 @@ var DIR, STATE_FILE2, LOG_FILE2, LOGS_SERVER_PORT;
 var init_logs_server_daemon = __esm({
   "src/logs-server-daemon.ts"() {
     "use strict";
-    DIR = join6(homedir4(), ".solongate");
-    STATE_FILE2 = join6(DIR, ".logs-server.json");
-    LOG_FILE2 = join6(DIR, "logs-server.log");
+    DIR = join7(homedir5(), ".solongate");
+    STATE_FILE2 = join7(DIR, ".logs-server.json");
+    LOG_FILE2 = join7(DIR, "logs-server.log");
     LOGS_SERVER_PORT = 8788;
   }
 });
 
 // src/tui/config.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
 function loadConfig() {
   if (cached) return cached;
   const defaults = { notifications: true };
   try {
-    const raw = readFileSync7(join7(homedir5(), ".solongate", "tui-config.json"), "utf-8");
+    const raw = readFileSync8(join8(homedir6(), ".solongate", "tui-config.json"), "utf-8");
     const j = JSON.parse(raw);
     cached = {
       notifications: j.notifications !== false,
@@ -7823,16 +8057,16 @@ var init_components = __esm({
 });
 
 // src/tui/local-log.ts
-import { closeSync, existsSync as existsSync4, openSync as openSync3, readdirSync as readdirSync2, readFileSync as readFileSync8, readSync, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir6 } from "os";
+import { closeSync, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync2, readFileSync as readFileSync9, readSync, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
 import { createHash as createHash2 } from "crypto";
-import { isAbsolute, join as join8 } from "path";
+import { isAbsolute, join as join9 } from "path";
 function localLogsSetting() {
   const off = { enabled: false, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
   try {
     for (const cache of policyCachesNewestFirst()) {
       try {
-        const c2 = JSON.parse(readFileSync8(cache, "utf-8"));
+        const c2 = JSON.parse(readFileSync9(cache, "utf-8"));
         const l = c2?.security?.localLogs;
         if (!l || typeof l.enabled !== "boolean") continue;
         if (!l.enabled) return { ...off, configuredPath: typeof l.path === "string" ? l.path.trim() || null : null };
@@ -7840,8 +8074,8 @@ function localLogsSetting() {
         const dir = raw.replace(/[\\/]+$/, "");
         if (!dir) return { enabled: true, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
         if (!isAbsolute(dir)) return { enabled: true, configuredPath: raw, usableHere: false, file: DEFAULT_LOCAL_LOG };
-        const file = join8(dir, "solongate-audit.jsonl");
-        const usable = existsSync4(file) || existsSync4(dir);
+        const file = join9(dir, "solongate-audit.jsonl");
+        const usable = existsSync5(file) || existsSync5(dir);
         return { enabled: true, configuredPath: raw, usableHere: usable, file: usable ? file : DEFAULT_LOCAL_LOG };
       } catch {
       }
@@ -7851,12 +8085,12 @@ function localLogsSetting() {
   return off;
 }
 function policyCachesNewestFirst() {
-  const sgDir = join8(homedir6(), ".solongate");
-  return readdirSync2(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
-    const p = join8(sgDir, f);
+  const sgDir2 = join9(homedir7(), ".solongate");
+  return readdirSync2(sgDir2).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+    const p = join9(sgDir2, f);
     let mtime = 0;
     try {
-      mtime = statSync2(p).mtimeMs;
+      mtime = statSync3(p).mtimeMs;
     } catch {
     }
     return { p, mtime };
@@ -7864,27 +8098,27 @@ function policyCachesNewestFirst() {
 }
 function localLogFile() {
   try {
-    const sgDir = join8(homedir6(), ".solongate");
-    const caches = readdirSync2(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
-      const p = join8(sgDir, f);
+    const sgDir2 = join9(homedir7(), ".solongate");
+    const caches = readdirSync2(sgDir2).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+      const p = join9(sgDir2, f);
       let mtime = 0;
       try {
-        mtime = statSync2(p).mtimeMs;
+        mtime = statSync3(p).mtimeMs;
       } catch {
       }
       return { p, mtime };
     }).sort((a, b) => b.mtime - a.mtime);
     for (const { p } of caches) {
       try {
-        const c2 = JSON.parse(readFileSync8(p, "utf-8"));
+        const c2 = JSON.parse(readFileSync9(p, "utf-8"));
         const l = c2?.security?.localLogs;
         if (!l || !l.enabled || typeof l.path !== "string" || !l.path.trim()) continue;
         const dir = l.path.trim().replace(/[\\/]+$/, "");
         if (!dir) continue;
         if (!isAbsolute(dir)) return DEFAULT_LOCAL_LOG;
-        const file = join8(dir, "solongate-audit.jsonl");
-        if (existsSync4(file)) return file;
-        return existsSync4(dir) ? file : DEFAULT_LOCAL_LOG;
+        const file = join9(dir, "solongate-audit.jsonl");
+        if (existsSync5(file)) return file;
+        return existsSync5(dir) ? file : DEFAULT_LOCAL_LOG;
       } catch {
       }
     }
@@ -7894,11 +8128,11 @@ function localLogFile() {
 }
 function ensureLocalLogOwner(activeApiKey) {
   try {
-    const marker = join8(homedir6(), ".solongate", "local-logs", ".owner");
+    const marker = join9(homedir7(), ".solongate", "local-logs", ".owner");
     const want = activeApiKey ? createHash2("sha256").update(activeApiKey).digest("hex").slice(0, 16) : "";
     let have = "";
     try {
-      have = readFileSync8(marker, "utf-8").trim();
+      have = readFileSync9(marker, "utf-8").trim();
     } catch {
     }
     if (have === want) return false;
@@ -7913,7 +8147,7 @@ function ensureLocalLogOwner(activeApiKey) {
 }
 function tailLines(file, maxBytes = 131072) {
   try {
-    const size = statSync2(file).size;
+    const size = statSync3(file).size;
     const start = Math.max(0, size - maxBytes);
     const fd = openSync3(file, "r");
     const buf = Buffer.alloc(size - start);
@@ -7929,7 +8163,7 @@ function tailLines(file, maxBytes = 131072) {
 function clearLocalLog() {
   try {
     const file = localLogFile();
-    const n = readFileSync8(file, "utf-8").split("\n").filter(Boolean).length;
+    const n = readFileSync9(file, "utf-8").split("\n").filter(Boolean).length;
     writeFileSync6(file, "");
     return n;
   } catch {
@@ -7947,8 +8181,8 @@ function reasonSignals(reason) {
 }
 function ownMark() {
   try {
-    const p = join8(homedir6(), ".solongate", "cloud-guard.json");
-    const c2 = JSON.parse(readFileSync8(p, "utf-8"));
+    const p = join9(homedir7(), ".solongate", "cloud-guard.json");
+    const c2 = JSON.parse(readFileSync9(p, "utf-8"));
     return c2?.apiKey ? createHash2("sha256").update(c2.apiKey).digest("hex").slice(0, 16) : "";
   } catch {
     return "";
@@ -7972,7 +8206,7 @@ var DEFAULT_LOCAL_LOG, LOCAL_LOG, DLP_REASON, RL_REASON;
 var init_local_log = __esm({
   "src/tui/local-log.ts"() {
     "use strict";
-    DEFAULT_LOCAL_LOG = join8(homedir6(), ".solongate", "local-logs", "solongate-audit.jsonl");
+    DEFAULT_LOCAL_LOG = join9(homedir7(), ".solongate", "local-logs", "solongate-audit.jsonl");
     LOCAL_LOG = localLogFile();
     DLP_REASON = /security layer \(dlp\)/i;
     RL_REASON = /security layer \(rate limit\)|rate[- ]?limit(?:ed)?\b.*exceed|exceeded \d+ calls/i;
@@ -7980,13 +8214,13 @@ var init_local_log = __esm({
 });
 
 // src/api-client/client.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
-import { resolve as resolve4, join as join9 } from "path";
-import { homedir as homedir7 } from "os";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, join as join10 } from "path";
+import { homedir as homedir8 } from "os";
 function listAccounts() {
   let list5 = [];
   try {
-    const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync10(accountsFile(), "utf-8"));
     if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
   } catch {
   }
@@ -8000,7 +8234,7 @@ function saveAccount(acc) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync10(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
@@ -8008,7 +8242,7 @@ function saveAccount(acc) {
     })();
     const next = list5.filter((a) => a.apiKey !== acc.apiKey);
     next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync6(join9(homedir7(), ".solongate"), { recursive: true });
+    mkdirSync6(join10(homedir8(), ".solongate"), { recursive: true });
     writeFileSync7(accountsFile(), JSON.stringify(next, null, 2));
   } catch {
   }
@@ -8017,7 +8251,7 @@ function removeAccount(apiKey) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync9(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync10(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
@@ -8039,12 +8273,12 @@ function isActiveAccount(apiKey) {
 }
 function setActiveAccount(creds) {
   try {
-    const dir = join9(homedir7(), ".solongate");
+    const dir = join10(homedir8(), ".solongate");
     mkdirSync6(dir, { recursive: true });
-    const p = join9(dir, ["cloud", "guard.json"].join("-"));
+    const p = join10(dir, ["cloud", "guard.json"].join("-"));
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync9(p, "utf-8"));
+      existing = JSON.parse(readFileSync10(p, "utf-8"));
     } catch {
     }
     if (!writeProtectedFile(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2))) return false;
@@ -8056,14 +8290,14 @@ function setActiveAccount(creds) {
 }
 function clearActiveCredential() {
   try {
-    const p = join9(homedir7(), ".solongate", ["cloud", "guard.json"].join("-"));
-    if (!existsSync5(p)) {
+    const p = join10(homedir8(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync6(p)) {
       cached2 = null;
       return true;
     }
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync9(p, "utf-8"));
+      existing = JSON.parse(readFileSync10(p, "utf-8"));
     } catch {
     }
     delete existing.apiKey;
@@ -8078,9 +8312,9 @@ function clearActiveCredential() {
 }
 function loginCredentialFile() {
   try {
-    const p = join9(homedir7(), ".solongate", "cloud-guard.json");
-    if (!existsSync5(p)) return {};
-    const c2 = JSON.parse(readFileSync9(p, "utf-8"));
+    const p = join10(homedir8(), ".solongate", "cloud-guard.json");
+    if (!existsSync6(p)) return {};
+    const c2 = JSON.parse(readFileSync10(p, "utf-8"));
     return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
@@ -8089,8 +8323,8 @@ function loginCredentialFile() {
 function dotenvApiKey() {
   try {
     const envPath = resolve4(".env");
-    if (!existsSync5(envPath)) return void 0;
-    for (const line of readFileSync9(envPath, "utf-8").split("\n")) {
+    if (!existsSync6(envPath)) return void 0;
+    for (const line of readFileSync10(envPath, "utf-8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
       const eq = trimmed.indexOf("=");
@@ -8194,7 +8428,7 @@ var init_client = __esm({
     "use strict";
     init_global_install();
     DEFAULT_API_URL2 = "https://api.solongate.com";
-    accountsFile = () => join9(homedir7(), ".solongate", "accounts.json");
+    accountsFile = () => join10(homedir8(), ".solongate", "accounts.json");
     viewOverride = null;
     ApiError = class extends Error {
       status;
@@ -8678,8 +8912,8 @@ var init_hooks = __esm({
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10, resolve as resolve5 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join11, resolve as resolve5 } from "path";
 import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function extractTarget(detail) {
@@ -9236,9 +9470,9 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join10(homedir8(), ".solongate", "live-export.jsonl");
+        const file = join11(homedir9(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync7(join10(homedir8(), ".solongate"), { recursive: true });
+          mkdirSync7(join11(homedir9(), ".solongate"), { recursive: true });
           writeFileSync8(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
@@ -9676,7 +9910,7 @@ var init_Live = __esm({
       }
       return h.toString(16);
     };
-    RING = join10(homedir8(), ".solongate", "projects", projectKey(resolve5(process.cwd())), ".eval-ring.jsonl");
+    RING = join11(homedir9(), ".solongate", "projects", projectKey(resolve5(process.cwd())), ".eval-ring.jsonl");
     fmtUp = (ms) => {
       const s = Math.floor(ms / 1e3);
       const p = (n) => String(n).padStart(2, "0");
@@ -10962,8 +11196,8 @@ var init_Dlp = __esm({
 import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import TextInput5 from "ink-text-input";
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join11 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join12 } from "path";
 import { useState as useState7 } from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 function loadLocalRows() {
@@ -11089,8 +11323,8 @@ function AuditPanel({ active: active2, focused }) {
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
     const run12 = async () => {
-      const dir = join11(homedir9(), ".solongate");
-      const file = join11(dir, `audit-export-${source}.jsonl`);
+      const dir = join12(homedir10(), ".solongate");
+      const file = join12(dir, `audit-export-${source}.jsonl`);
       let rows2;
       if (kind === "page") rows2 = pageRows;
       else if (source === "cloud") {
@@ -11674,9 +11908,9 @@ var init_args = __esm({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync6, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join13 } from "path";
 async function collectChecks() {
   const checks = [];
   if (!isAuthenticated()) {
@@ -11724,8 +11958,32 @@ async function collectChecks() {
     ok: claudeReg,
     detail: claudeReg ? "guard registered" : "guard NOT registered - run `solongate repair`"
   });
-  if (existsSync6(globalPaths().antigravityDir)) {
-    const reg = existsSync6(globalPaths().antigravityHooksPath);
+  if (claudeReg) {
+    const start = hookCanStart();
+    checks.push({
+      name: "hook runtime",
+      ok: start.ok,
+      detail: start.ok ? `node ${start.detail}` : `${start.detail} - nothing is being enforced or logged`
+    });
+    const beat = guardBeat();
+    if (!beat) {
+      checks.push({
+        name: "guard fired",
+        ok: "warn",
+        detail: "never - open your agent and run one tool call, then check again"
+      });
+    } else if (beat.node === "no-node") {
+      checks.push({
+        name: "guard fired",
+        ok: false,
+        detail: `${agoLabel(beat.at)}, but found no node to run with - run \`solongate repair\``
+      });
+    } else {
+      checks.push({ name: "guard fired", ok: true, detail: `${agoLabel(beat.at)} \xB7 ${beat.node}` });
+    }
+  }
+  if (existsSync7(globalPaths().antigravityDir)) {
+    const reg = existsSync7(globalPaths().antigravityHooksPath);
     checks.push({
       name: "Antigravity hooks",
       ok: reg,
@@ -11753,7 +12011,7 @@ async function collectChecks() {
     });
   }
   try {
-    const raw = readFileSync10(join12(homedir10(), ".solongate", ".key-rejected.json"), "utf-8");
+    const raw = readFileSync11(join13(homedir11(), ".solongate", ".key-rejected.json"), "utf-8");
     const m = JSON.parse(raw);
     const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
     checks.push({
@@ -11764,8 +12022,8 @@ async function collectChecks() {
   } catch {
   }
   const LOCAL_LOG2 = localLogFile();
-  if (existsSync6(LOCAL_LOG2)) {
-    const st = statSync3(LOCAL_LOG2);
+  if (existsSync7(LOCAL_LOG2)) {
+    const st = statSync4(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
   } else {
@@ -11798,6 +12056,7 @@ var init_doctor = __esm({
     "use strict";
     init_api_client();
     init_global_install();
+    init_hook_health();
     init_local_log();
     init_format();
     init_args();
@@ -12905,8 +13164,8 @@ __export(tui_exports, {
   launchTui: () => launchTui
 });
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join14 } from "path";
 import { render } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 async function launchTui() {
@@ -12917,11 +13176,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join13(homedir11(), ".solongate", "dataroom-debug.log");
+  const debugLog = join14(homedir12(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync9(join13(homedir11(), ".solongate"), { recursive: true });
+      mkdirSync9(join14(homedir12(), ".solongate"), { recursive: true });
       appendFileSync2(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {
@@ -12948,7 +13207,7 @@ var init_tui = __esm({
 });
 
 // src/commands/policy.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 async function run2(argv) {
   const { positionals, flags } = parse(argv);
   const sub = positionals[0];
@@ -13157,7 +13416,7 @@ function printRules(rules) {
 }
 async function resolveRules(target) {
   if (target.endsWith(".json")) {
-    const parsed = JSON.parse(readFileSync11(target, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(target, "utf-8"));
     return parsed.rules ?? [];
   }
   const p = await api.policies.get(target);
@@ -13656,11 +13915,11 @@ var init_agents2 = __esm({
 });
 
 // src/commands/trace.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join14, resolve as resolve6 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir13 } from "os";
+import { join as join15, resolve as resolve6 } from "path";
 function readAllRings() {
-  const root = join14(homedir12(), ".solongate", "projects");
+  const root = join15(homedir13(), ".solongate", "projects");
   let dirs;
   try {
     dirs = readdirSync3(root);
@@ -13671,7 +13930,7 @@ function readAllRings() {
   for (const d of dirs) {
     let text;
     try {
-      text = readFileSync12(join14(root, d, ".eval-ring.jsonl"), "utf-8");
+      text = readFileSync13(join15(root, d, ".eval-ring.jsonl"), "utf-8");
     } catch {
       continue;
     }
@@ -13764,10 +14023,10 @@ var init_trace = __esm({
 });
 
 // src/commands/watch.ts
-import { closeSync as closeSync2, existsSync as existsSync7, openSync as openSync4, readSync as readSync2, statSync as statSync4 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync8, openSync as openSync4, readSync as readSync2, statSync as statSync5 } from "fs";
 function tailLocal(file, maxBytes = 131072) {
   try {
-    const size = statSync4(file).size;
+    const size = statSync5(file).size;
     const start = Math.max(0, size - maxBytes);
     const fd = openSync4(file, "r");
     const buf = Buffer.alloc(size - start);
@@ -13809,7 +14068,7 @@ async function run9(argv) {
   };
   const pollLocal = () => {
     const LOCAL_LOG2 = localLogFile();
-    if (cloudOnly || !existsSync7(LOCAL_LOG2)) return;
+    if (cloudOnly || !existsSync8(LOCAL_LOG2)) return;
     const rows = [];
     for (const line of tailLocal(LOCAL_LOG2)) {
       try {
@@ -14081,9 +14340,9 @@ __export(logs_server_exports, {
   runLogsServer: () => runLogsServer
 });
 import { createServer } from "http";
-import { readFileSync as readFileSync13, statSync as statSync5 } from "fs";
-import { resolve as resolve7, join as join15, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir13 } from "os";
+import { readFileSync as readFileSync14, statSync as statSync6 } from "fs";
+import { resolve as resolve7, join as join16, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir14 } from "os";
 import { readdirSync as readdirSync4 } from "fs";
 function allowedOrigins() {
   const base = [
@@ -14100,15 +14359,15 @@ function resolveLocalLogDir(rawPath) {
   const dir = String(rawPath || "").trim().replace(/[\\/]+$/, "");
   if (!dir) return null;
   if (isAbsolute2(dir)) return dir;
-  return resolve7(homedir13(), ".solongate", "local-logs");
+  return resolve7(homedir14(), ".solongate", "local-logs");
 }
 async function findLogDir() {
-  const base = resolve7(homedir13(), ".solongate");
+  const base = resolve7(homedir14(), ".solongate");
   try {
     const files = readdirSync4(base).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json"));
     for (const f of files) {
       try {
-        const c2 = JSON.parse(readFileSync13(join15(base, f), "utf-8"));
+        const c2 = JSON.parse(readFileSync14(join16(base, f), "utf-8"));
         const p = c2?.security?.localLogs?.path;
         if (typeof p === "string" && p.trim()) return { dir: resolveLocalLogDir(p), configured: p };
       } catch {
@@ -14117,7 +14376,7 @@ async function findLogDir() {
   } catch {
   }
   try {
-    const cfgRaw = readFileSync13(join15(base, "cloud-guard.json"), "utf-8");
+    const cfgRaw = readFileSync14(join16(base, "cloud-guard.json"), "utf-8");
     const { apiKey, apiUrl } = JSON.parse(cfgRaw);
     if (apiKey) {
       const url = `${apiUrl || "https://api.solongate.com"}/api/v1/policies/active`;
@@ -14146,9 +14405,9 @@ function setCors(req, res) {
 }
 function fileInfo(dir) {
   if (!dir) return { file: null, exists: false, size: 0, mtimeMs: 0 };
-  const file = join15(dir, LOG_FILENAME);
+  const file = join16(dir, LOG_FILENAME);
   try {
-    const st = statSync5(file);
+    const st = statSync6(file);
     return { file, exists: true, size: st.size, mtimeMs: st.mtimeMs };
   } catch {
     return { file, exists: false, size: 0, mtimeMs: 0 };
@@ -14229,7 +14488,7 @@ async function runLogsServer() {
         return;
       }
       try {
-        const text = readFileSync13(info.file, "utf-8");
+        const text = readFileSync14(info.file, "utf-8");
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Last-Modified": lastMod, "X-Solongate-Exists": "1" });
         res.end(text);
       } catch {
@@ -14282,9 +14541,9 @@ var init_logs_server = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname4, join as join16 } from "path";
+import { dirname as dirname4, join as join17 } from "path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "fs";
@@ -15397,9 +15656,9 @@ function extractFilenames(args) {
       if (isUrl) return;
       if (trimmed.includes("/") || trimmed.includes("\\")) {
         const parts = trimmed.split(/[/\\]/);
-        const basename = parts[parts.length - 1];
-        if (basename && looksLikeFilename(basename)) {
-          addFilename(basename);
+        const basename2 = parts[parts.length - 1];
+        if (basename2 && looksLikeFilename(basename2)) {
+          addFilename(basename2);
         }
       }
       const lower = trimmed.toLowerCase();
@@ -15417,9 +15676,9 @@ function extractFilenames(args) {
         }
         if (word.includes("/") || word.includes("\\")) {
           const parts = word.split(/[/\\]/);
-          const basename = parts[parts.length - 1];
-          if (basename && looksLikeFilename(basename)) {
-            addFilename(basename);
+          const basename2 = parts[parts.length - 1];
+          if (basename2 && looksLikeFilename(basename2)) {
+            addFilename(basename2);
           }
         }
         if (word.includes("*") || word.includes("?")) {
@@ -17679,8 +17938,8 @@ if (!IS_HUMAN_CLI) {
 }
 var PKG_VERSION = (() => {
   try {
-    const p = join16(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync14(p, "utf-8")).version || "unknown";
+    const p = join17(dirname4(fileURLToPath4(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync15(p, "utf-8")).version || "unknown";
   } catch {
     return "unknown";
   }