@solongate/proxy 0.83.56 → 0.83.58

package/dist/tui/index.js

@@ -8,38 +8,230 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/global-install.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync, rmSync, rmdirSync, readdirSync as readdirSync2, statSync as statSync2, chmodSync, copyFileSync, renameSync } from "fs";
-import { resolve, join as join3, dirname } from "path";
+// src/hook-launcher.ts
+function launcherScript(pinnedNode) {
+  const pinned = pinnedNode.replace(/'/g, `'\\''`);
+  return `#!/bin/sh
+# SolonGate hook launcher \u2014 generated by \`solongate init --global\` / \`repair\`.
+#
+# Finds a working node and execs the hook with it. Do not edit: a reinstall
+# overwrites this file, and on macOS it is chflags-locked besides.
+#
+# The reason it exists rather than the hook naming a node directly: an absolute
+# node path recorded at install time is a Homebrew Cellar path or an nvm version
+# directory, and both are deleted by a routine upgrade. The hook then could not
+# start, nothing was enforced, nothing was logged, and every check still said
+# the guard was registered \u2014 because it was.
+
+set -u
+
+script="\${1:-}"
+[ -n "$script" ] || { echo "solongate: launcher called with no hook script" >&2; exit 1; }
+shift
+
+hook=\${script##*/}
+home=\${HOME:-~}
+beatdir="$home/.solongate/${BEAT_DIR}"
+
+# The beat. Written BEFORE node is resolved, because its whole job is to record
+# that the client invoked us \u2014 which is true even when everything after this
+# line fails. The file's modification time is the timestamp; nothing is forked
+# to produce one, and the directory test is a builtin.
+#
+# The braces matter. A redirect into a missing directory is reported by the
+# SHELL, before the command runs, so a \`2>/dev/null\` on the printf alone does
+# not suppress it \u2014 it lands on the hook's stderr, and Claude Code shows a
+# hook's stderr to the person using it. Redirecting the group catches both.
+beat() {
+  [ -d "$beatdir" ] || mkdir -p "$beatdir" 2>/dev/null || return 0
+  { printf '%s\\n' "$1" > "$beatdir/$hook"; } 2>/dev/null || true
+}
+
+try() {
+  [ -n "\${1:-}" ] && [ -x "$1" ]
+}
+
+resolve_node() {
+  # Told explicitly.
+  if try "\${SOLONGATE_NODE:-}"; then echo "$SOLONGATE_NODE"; return 0; fi
+  # The node this was installed with.
+  if try '${pinned}'; then echo '${pinned}'; return 0; fi
+  # PATH, when the client gave us one worth having.
+  p=$(command -v node 2>/dev/null) || p=
+  if try "$p"; then echo "$p"; return 0; fi
+  # The fixed locations.
+  for c in ${NODE_CANDIDATES.map((c2) => `"${c2}"`).join(" ")}; do
+    for g in $c; do
+      if try "$g"; then echo "$g"; return 0; fi
+    done
+  done
+  # The version managers.
+  for c in ${NODE_GLOBS.join(" ")}; do
+    for g in $c; do
+      if try "$g"; then echo "$g"; return 0; fi
+    done
+  done
+  return 1
+}
+
+node_bin=$(resolve_node) || node_bin=
+
+# --sg-doctor: report what would be used and leave. This is what \`solongate
+# doctor\` runs, so the health check exercises the REAL resolution rather than a
+# copy of it that can drift.
+if [ "$script" = "--sg-doctor" ] || [ "\${1:-}" = "--sg-doctor" ]; then
+  [ -n "$node_bin" ] && { echo "$node_bin"; exit 0; }
+  echo "no node found" >&2
+  exit 1
+fi
+
+if [ -z "$node_bin" ]; then
+  beat "no-node"
+  # Nothing can be enforced without node, and which way to fail is not a
+  # judgement call: the guard is fail-closed, so it refuses the call and says
+  # why. Everything else here only records what already happened, and refusing
+  # a tool call because the log could not be written would be a worse product
+  # than a gap in the log.
+  echo "solongate: no node runtime found, so $hook did not run." >&2
+  echo "solongate: run \\\`solongate repair\\\` in a terminal, or set SOLONGATE_NODE to your node binary." >&2
+  case "$hook" in
+    guard.mjs) echo "solongate: this tool call is REFUSED \u2014 the guard is fail-closed." >&2; exit 2 ;;
+    *) exit 0 ;;
+  esac
+fi
+
+beat "$node_bin"
+exec "$node_bin" "$script" "$@"
+`;
+}
+var NODE_CANDIDATES, NODE_GLOBS, LAUNCHER_NAME, BEAT_DIR;
+var init_hook_launcher = __esm({
+  "src/hook-launcher.ts"() {
+    "use strict";
+    NODE_CANDIDATES = [
+      // Homebrew, by the STABLE symlink rather than the Cellar path behind it —
+      // the exact distinction this file exists for. Apple Silicon then Intel.
+      "/opt/homebrew/bin/node",
+      "/usr/local/bin/node",
+      // Homebrew's keg-only layout, both prefixes.
+      "/opt/homebrew/opt/node/bin/node",
+      "/usr/local/opt/node/bin/node",
+      // Distro and hand-built.
+      "/usr/bin/node",
+      "/usr/local/n/versions/node/*/bin/node",
+      "/snap/bin/node"
+    ];
+    NODE_GLOBS = [
+      // nvm. NVM_DIR is exported by its own shell hook, which a non-interactive
+      // hook environment does not run, so the default location is tried too.
+      '"${NVM_DIR:-}"/versions/node/*/bin/node',
+      '"$home"/.nvm/versions/node/*/bin/node',
+      // fnm, both the XDG location and the macOS Application Support one.
+      '"$home"/.local/share/fnm/node-versions/*/installation/bin/node',
+      '"$home"/Library/Application Support/fnm/node-versions/*/installation/bin/node',
+      // Volta.
+      '"$home"/.volta/tools/image/node/*/bin/node',
+      // asdf, old layout and the current plugin one.
+      '"$home"/.asdf/installs/nodejs/*/bin/node',
+      '"$home"/.asdf/installs/node/*/bin/node'
+    ];
+    LAUNCHER_NAME = "sg-run.sh";
+    BEAT_DIR = ".beat";
+  }
+});
+
+// src/hook-health.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { join as join3 } from "path";
 import { homedir as homedir3 } from "os";
+function hookCanStart() {
+  const launcher = join3(hooksDir(), LAUNCHER_NAME);
+  if (process.platform === "win32") {
+    const ok = existsSync2(process.execPath);
+    return { ok, node: process.execPath, detail: ok ? process.execPath : `${process.execPath} is gone` };
+  }
+  if (!existsSync2(launcher)) {
+    return { ok: false, detail: "hook launcher missing - run `solongate repair`" };
+  }
+  try {
+    const out = execFileSync("/bin/sh", [launcher, "--sg-doctor"], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (!out) return { ok: false, detail: "launcher found no node runtime - set SOLONGATE_NODE or install node" };
+    return { ok: true, node: out, detail: out };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { ok: false, detail: `launcher will not run: ${msg.split("\n")[0]}` };
+  }
+}
+function hookBeats() {
+  const dir = join3(sgDir(), BEAT_DIR);
+  const out = [];
+  for (const hook of ["guard.mjs", "audit.mjs", "conversation.mjs", "stop.mjs"]) {
+    const f = join3(dir, hook);
+    try {
+      const st = statSync2(f);
+      out.push({ hook, at: st.mtime, node: readFileSync3(f, "utf-8").trim() });
+    } catch {
+    }
+  }
+  return out.sort((a, b) => b.at.getTime() - a.at.getTime());
+}
+function guardBeat() {
+  return hookBeats().find((b) => b.hook === "guard.mjs") ?? null;
+}
+function agoLabel(d) {
+  const s = Math.max(0, Math.round((Date.now() - d.getTime()) / 1e3));
+  if (s < 60) return s <= 3 ? "just now" : `${s}s ago`;
+  if (s < 3600) return `${Math.round(s / 60)}m ago`;
+  if (s < 86400) return `${Math.round(s / 3600)}h ago`;
+  return `${Math.round(s / 86400)}d ago`;
+}
+var sgDir, hooksDir;
+var init_hook_health = __esm({
+  "src/hook-health.ts"() {
+    "use strict";
+    init_hook_launcher();
+    sgDir = () => join3(homedir3(), ".solongate");
+    hooksDir = () => join3(sgDir(), "hooks");
+  }
+});
+
+// src/global-install.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync, rmSync, rmdirSync, readdirSync as readdirSync2, statSync as statSync3, chmodSync, copyFileSync, renameSync } from "fs";
+import { resolve, join as join4, dirname, basename } from "path";
+import { homedir as homedir4 } from "os";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 import { createInterface } from "readline";
-import { execFileSync, spawn } from "child_process";
+import { execFileSync as execFileSync2, spawn } from "child_process";
 function lockFile(file) {
-  if (!existsSync2(file)) return;
+  if (!existsSync3(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/deny", "*S-1-1-0:(WD,AD,DC,DE,WDAC,WO)"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/grant", "*S-1-3-4:(RX)"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync("attrib", ["+R", file], { stdio: "ignore" });
+        execFileSync2("attrib", ["+R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync("chflags", ["uchg", file], { stdio: "ignore" });
+        execFileSync2("chflags", ["uchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync("chattr", ["+i", file], { stdio: "ignore" });
+        execFileSync2("chattr", ["+i", file], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -51,33 +243,33 @@ function lockFile(file) {
   }
 }
 function unlockFile(file) {
-  if (!existsSync2(file)) return;
+  if (!existsSync3(file)) return;
   try {
     if (process.platform === "win32") {
       try {
-        execFileSync("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/remove:g", "*S-1-3-4"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/remove:d", "*S-1-1-0"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync("icacls", [file, "/reset"], { stdio: "ignore" });
+        execFileSync2("icacls", [file, "/reset"], { stdio: "ignore" });
       } catch {
       }
       try {
-        execFileSync("attrib", ["-R", file], { stdio: "ignore" });
+        execFileSync2("attrib", ["-R", file], { stdio: "ignore" });
       } catch {
       }
     } else if (process.platform === "darwin") {
       try {
-        execFileSync("chflags", ["nouchg", file], { stdio: "ignore" });
+        execFileSync2("chflags", ["nouchg", file], { stdio: "ignore" });
       } catch {
       }
     } else {
       try {
-        execFileSync("chattr", ["-i", file], { stdio: "ignore" });
+        execFileSync2("chattr", ["-i", file], { stdio: "ignore" });
       } catch {
       }
       try {
@@ -91,14 +283,19 @@ function unlockFile(file) {
 function protectedTargets() {
   const p = globalPaths();
   return [
-    join3(p.hooksDir, "guard.mjs"),
-    join3(p.hooksDir, "audit.mjs"),
-    join3(p.hooksDir, "stop.mjs"),
-    join3(p.hooksDir, "shield.mjs"),
+    join4(p.hooksDir, "guard.mjs"),
+    join4(p.hooksDir, "audit.mjs"),
+    join4(p.hooksDir, "stop.mjs"),
+    join4(p.hooksDir, "shield.mjs"),
     // The conversation record is locked with the rest. A guest who could edit
     // it could decide what their host sees them say, which is the same class of
     // problem as editing the guard.
-    join3(p.hooksDir, "conversation.mjs"),
+    join4(p.hooksDir, "conversation.mjs"),
+    // The launcher is the enforcement path now: every hook command in every
+    // client config runs THROUGH it. A program that could rewrite it could
+    // point every hook at /bin/true and disarm the guard without touching a
+    // single file that used to be locked.
+    join4(p.hooksDir, LAUNCHER_NAME),
     p.configPath,
     p.settingsPath,
     p.antigravityHooksPath,
@@ -132,52 +329,52 @@ function writeProtectedFile(file, contents) {
   }
 }
 function globalPaths() {
-  const home = homedir3();
-  const sgDir = join3(home, ".solongate");
-  const hooksDir = join3(sgDir, "hooks");
-  const claudeDir = join3(home, ".claude");
-  const antigravityDir = join3(home, ".gemini", "config");
-  const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join3(home, ".codex");
-  const opencodeDir = join3(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join3(home, ".config"), "opencode");
-  const binDir = join3(sgDir, "bin");
+  const home = homedir4();
+  const sgDir2 = join4(home, ".solongate");
+  const hooksDir2 = join4(sgDir2, "hooks");
+  const claudeDir = join4(home, ".claude");
+  const antigravityDir = join4(home, ".gemini", "config");
+  const codexDir = process.env["CODEX_HOME"] ? resolve(process.env["CODEX_HOME"]) : join4(home, ".codex");
+  const opencodeDir = join4(process.env["XDG_CONFIG_HOME"] ? resolve(process.env["XDG_CONFIG_HOME"]) : join4(home, ".config"), "opencode");
+  const binDir = join4(sgDir2, "bin");
   return {
     home,
-    sgDir,
-    hooksDir,
+    sgDir: sgDir2,
+    hooksDir: hooksDir2,
     binDir,
     claudeDir,
     antigravityDir,
     codexDir,
     opencodeDir,
-    settingsPath: join3(claudeDir, "settings.json"),
-    backupPath: join3(claudeDir, "settings.solongate.bak"),
-    configPath: join3(sgDir, "cloud-guard.json"),
+    settingsPath: join4(claudeDir, "settings.json"),
+    backupPath: join4(claudeDir, "settings.solongate.bak"),
+    configPath: join4(sgDir2, "cloud-guard.json"),
     // Antigravity reads global hooks from ~/.gemini/config/hooks.json. Only the
     // guard is registered there (PreToolUse); Antigravity's ALLOW-path audit is
     // covered by the passive session-log collector, not a hook.
-    antigravityHooksPath: join3(antigravityDir, "hooks.json"),
-    antigravityBackupPath: join3(antigravityDir, "hooks.solongate.bak"),
+    antigravityHooksPath: join4(antigravityDir, "hooks.json"),
+    antigravityBackupPath: join4(antigravityDir, "hooks.solongate.bak"),
     // Codex reads user-level hooks from ~/.codex/hooks.json (or a [hooks] table
     // in ~/.codex/config.toml — we use the JSON file so we never have to rewrite
     // the user's TOML, which also holds the hook TRUST state Codex manages).
-    codexHooksPath: join3(codexDir, "hooks.json"),
-    codexBackupPath: join3(codexDir, "hooks.solongate.bak"),
-    codexConfigPath: join3(codexDir, "config.toml"),
+    codexHooksPath: join4(codexDir, "hooks.json"),
+    codexBackupPath: join4(codexDir, "hooks.solongate.bak"),
+    codexConfigPath: join4(codexDir, "config.toml"),
     // OpenCode scans its plugin folder at startup and loads every module in it.
     // Measured on 1.18.10: BOTH `plugin/` and `plugins/` are scanned, so the
     // docs and the field reports are each half right. We write the documented
     // one. There is nothing to register anywhere — dropping the file IS the
     // installation, which also means deleting the file IS the uninstall.
-    opencodePluginDir: join3(opencodeDir, "plugins"),
-    opencodePluginPath: join3(opencodeDir, "plugins", "solongate.js")
+    opencodePluginDir: join4(opencodeDir, "plugins"),
+    opencodePluginPath: join4(opencodeDir, "plugins", "solongate.js")
   };
 }
 function readHook(filename) {
-  return readFileSync3(join3(HOOKS_DIR, filename), "utf-8");
+  return readFileSync4(join4(HOOKS_DIR, filename), "utf-8");
 }
 function firstAccountCredential() {
   try {
-    const raw = JSON.parse(readFileSync3(join3(homedir3(), ".solongate", "accounts.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync4(join4(homedir4(), ".solongate", "accounts.json"), "utf-8"));
     if (Array.isArray(raw)) {
       const acc = raw.find((a) => a && typeof a.apiKey === "string" && a.apiKey);
       if (acc) return { apiKey: acc.apiKey, apiUrl: typeof acc.apiUrl === "string" ? acc.apiUrl : void 0 };
@@ -187,8 +384,8 @@ function firstAccountCredential() {
   return {};
 }
 function readGuard() {
-  const bundled = join3(HOOKS_DIR, "guard.bundled.mjs");
-  return existsSync2(bundled) ? readFileSync3(bundled, "utf-8") : readHook("guard.mjs");
+  const bundled = join4(HOOKS_DIR, "guard.bundled.mjs");
+  return existsSync3(bundled) ? readFileSync4(bundled, "utf-8") : readHook("guard.mjs");
 }
 function installGoBinaries(binDir) {
   const os_ = process.platform === "win32" ? "win32" : process.platform;
@@ -208,10 +405,10 @@ function installGoBinaries(binDir) {
     return placed;
   }
   for (const name of ["solongate-guard", "solongate"]) {
-    const from = join3(pkgDir, name + suffix);
-    const to = join3(binDir, name + suffix);
+    const from = join4(pkgDir, name + suffix);
+    const to = join4(binDir, name + suffix);
     try {
-      if (!existsSync2(from)) continue;
+      if (!existsSync3(from)) continue;
       const tmp = to + ".new";
       copyFileSync(from, tmp);
       chmodSync(tmp, 493);
@@ -223,16 +420,17 @@ function installGoBinaries(binDir) {
   return placed;
 }
 function antigravityHookCommand(guardAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  const call = process.platform === "win32" ? "& " : "";
-  return `${call}"${nodeBin}" "${guardAbs.replace(/\\/g, "/")}" antigravity "Antigravity"`;
+  return hookCommandFor(dirname(guardAbs), basename(guardAbs), "antigravity", "Antigravity");
+}
+function antigravityConversationCommand(guardAbs) {
+  return hookCommandFor(dirname(guardAbs), "conversation.mjs", "antigravity", "Antigravity");
 }
 function installAntigravityGuard(p, guardAbs) {
   mkdirSync(p.antigravityDir, { recursive: true });
   let existing = {};
-  if (existsSync2(p.antigravityHooksPath)) {
-    const raw = readFileSync3(p.antigravityHooksPath, "utf-8");
-    if (!existsSync2(p.antigravityBackupPath)) writeFileSync2(p.antigravityBackupPath, raw);
+  if (existsSync3(p.antigravityHooksPath)) {
+    const raw = readFileSync4(p.antigravityHooksPath, "utf-8");
+    if (!existsSync3(p.antigravityBackupPath)) writeFileSync2(p.antigravityBackupPath, raw);
     try {
       existing = JSON.parse(raw);
     } catch {
@@ -242,15 +440,16 @@ function installAntigravityGuard(p, guardAbs) {
   const merged = {
     ...existing,
     [ANTIGRAVITY_GROUP]: {
-      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }]
+      PreToolUse: [{ matcher: "", hooks: [{ type: "command", command: antigravityHookCommand(guardAbs) }] }],
+      Stop: [{ matcher: "", hooks: [{ type: "command", command: antigravityConversationCommand(guardAbs) }] }]
     }
   };
   writeFileSync2(p.antigravityHooksPath, JSON.stringify(merged, null, 2) + "\n");
 }
 function removeAntigravityGuard(p) {
-  if (!existsSync2(p.antigravityHooksPath)) return;
+  if (!existsSync3(p.antigravityHooksPath)) return;
   try {
-    const s = JSON.parse(readFileSync3(p.antigravityHooksPath, "utf-8"));
+    const s = JSON.parse(readFileSync4(p.antigravityHooksPath, "utf-8"));
     if (!(ANTIGRAVITY_GROUP in s)) return;
     delete s[ANTIGRAVITY_GROUP];
     writeFileSync2(p.antigravityHooksPath, JSON.stringify(s, null, 2) + "\n");
@@ -258,8 +457,10 @@ function removeAntigravityGuard(p) {
   }
 }
 function codexHookCommand(scriptAbs) {
-  const nodeBin = process.execPath.replace(/\\/g, "/");
-  return `"${nodeBin}" "${scriptAbs.replace(/\\/g, "/")}" codex "Codex"`;
+  if (process.platform === "win32") {
+    return `"${process.execPath.replace(/\\/g, "/")}" "${scriptAbs.replace(/\\/g, "/")}" codex "Codex"`;
+  }
+  return hookCommandFor(dirname(scriptAbs), basename(scriptAbs), "codex", "Codex");
 }
 function isOurCodexGroup(group) {
   const hooks = Array.isArray(group?.hooks) ? group.hooks : [];
@@ -267,10 +468,10 @@ function isOurCodexGroup(group) {
 }
 function readCodexHooksFile(path) {
   const out = { hooks: {}, rest: {} };
-  if (!existsSync2(path)) return out;
+  if (!existsSync3(path)) return out;
   let raw;
   try {
-    raw = JSON.parse(readFileSync3(path, "utf-8"));
+    raw = JSON.parse(readFileSync4(path, "utf-8"));
   } catch {
     return out;
   }
@@ -315,10 +516,10 @@ function writeCodexHooksFile(path, file) {
   body["hooks"] = hooks;
   writeFileSync2(path, JSON.stringify(body, null, 2) + "\n");
 }
-function installCodexGuard(p, hooksDir) {
+function installCodexGuard(p, hooksDir2) {
   mkdirSync(p.codexDir, { recursive: true });
-  if (existsSync2(p.codexHooksPath) && !existsSync2(p.codexBackupPath)) {
-    writeFileSync2(p.codexBackupPath, readFileSync3(p.codexHooksPath, "utf-8"));
+  if (existsSync3(p.codexHooksPath) && !existsSync3(p.codexBackupPath)) {
+    writeFileSync2(p.codexBackupPath, readFileSync4(p.codexHooksPath, "utf-8"));
   }
   const file = readCodexHooksFile(p.codexHooksPath);
   const script = {
@@ -342,7 +543,7 @@ function installCodexGuard(p, hooksDir) {
       ...ev === "Stop" ? {} : { matcher: "*" },
       hooks: [{
         type: "command",
-        command: codexHookCommand(join3(hooksDir, script[ev]).replace(/\\/g, "/")),
+        command: codexHookCommand(join4(hooksDir2, script[ev]).replace(/\\/g, "/")),
         timeout: CODEX_TIMEOUT_SEC,
         statusMessage: status[ev]
       }]
@@ -352,7 +553,7 @@ function installCodexGuard(p, hooksDir) {
   writeCodexHooksFile(p.codexHooksPath, file);
 }
 function removeCodexGuard(p) {
-  if (!existsSync2(p.codexHooksPath)) return;
+  if (!existsSync3(p.codexHooksPath)) return;
   try {
     const file = readCodexHooksFile(p.codexHooksPath);
     let changed = false;
@@ -378,7 +579,7 @@ function isCodexGuardInstalled() {
 }
 function codexDetected() {
   try {
-    return existsSync2(globalPaths().codexDir);
+    return existsSync3(globalPaths().codexDir);
   } catch {
     return false;
   }
@@ -388,7 +589,7 @@ function codexHooksStatus() {
   const registered = isCodexGuardInstalled();
   let trusted = false, disabled = false;
   try {
-    const toml = readFileSync3(p.codexConfigPath, "utf-8");
+    const toml = readFileSync4(p.codexConfigPath, "utf-8");
     trusted = /trusted_hash\s*=/.test(toml);
     disabled = /^\s*hooks\s*=\s*false\s*$/m.test(toml);
   } catch {
@@ -407,10 +608,10 @@ function removeOpencodeGuard(p) {
   } catch {
   }
 }
-function warmPolicyCache(hooksDir, agents) {
+function warmPolicyCache(hooksDir2, agents) {
   for (const agent of agents) {
     try {
-      const child = spawn(process.execPath, [join3(hooksDir, "guard.mjs"), agent, "--sg-refresh-policy"], {
+      const child = spawn(process.execPath, [join4(hooksDir2, "guard.mjs"), agent, "--sg-refresh-policy"], {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -424,23 +625,23 @@ function warmPolicyCache(hooksDir, agents) {
 }
 function isOpencodeGuardInstalled() {
   try {
-    return readFileSync3(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
+    return readFileSync4(globalPaths().opencodePluginPath, "utf-8").includes("tool.execute.before");
   } catch {
     return false;
   }
 }
 function opencodeDetected() {
   try {
-    return existsSync2(globalPaths().opencodeDir);
+    return existsSync3(globalPaths().opencodeDir);
   } catch {
     return false;
   }
 }
-function sweepStrayScratchDirs(root = homedir3(), maxDepth = 6, budget = 4e4) {
+function sweepStrayScratchDirs(root = homedir4(), maxDepth = 6, budget = 4e4) {
   let removed = 0;
   let visited = 0;
   const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".next", "build"]);
-  const store = join3(homedir3(), ".solongate");
+  const store = join4(homedir4(), ".solongate");
   const walk = (dir, depth) => {
     if (depth > maxDepth || visited++ > budget) return;
     let entries;
@@ -451,11 +652,11 @@ function sweepStrayScratchDirs(root = homedir3(), maxDepth = 6, budget = 4e4) {
     }
     for (const name of entries) {
       if (skip.has(name)) continue;
-      const full = join3(dir, name);
+      const full = join4(dir, name);
       if (full === store) continue;
       let isDir = false;
       try {
-        isDir = statSync2(full).isDirectory();
+        isDir = statSync3(full).isDirectory();
       } catch {
         continue;
       }
@@ -466,7 +667,7 @@ function sweepStrayScratchDirs(root = homedir3(), maxDepth = 6, budget = 4e4) {
           for (const f of readdirSync2(full)) {
             if (SCRATCH_FILES.has(f)) {
               try {
-                rmSync(join3(full, f), { force: true });
+                rmSync(join4(full, f), { force: true });
               } catch {
                 left.push(f);
               }
@@ -488,12 +689,17 @@ function sweepStrayScratchDirs(root = homedir3(), maxDepth = 6, budget = 4e4) {
 }
 function repairQuiet() {
   const p = globalPaths();
-  const has = (f) => existsSync2(f);
-  const guardFile = join3(p.hooksDir, "guard.mjs");
+  const has = (f) => existsSync3(f);
+  const guardFile = join4(p.hooksDir, "guard.mjs");
   const line = (label, ok, yes, no) => ({ label, ok, detail: ok ? yes : no });
+  const runtime = () => {
+    const r2 = hookCanStart();
+    return { label: "hook runtime", ok: r2.ok, detail: r2.ok ? `node ${r2.detail}` : r2.detail };
+  };
   const before = [
     line("guard hook file", has(guardFile), "present", "MISSING"),
     line("cloud credential", has(p.configPath), "present", "MISSING"),
+    runtime(),
     line("Claude hooks", isGuardInstalled(), "guard registered", "guard NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "guard registered", "guard NOT registered"),
     line("Codex hooks", isCodexGuardInstalled(), "guard registered", "guard NOT registered"),
@@ -503,6 +709,7 @@ function repairQuiet() {
   if (!r.ok) return { ok: false, message: r.message, before, after: [], notes: [] };
   const after = [
     { label: "guard hook file", ok: true, detail: `present (v${installedGuardVersion() ?? "?"})` },
+    runtime(),
     line("Claude hooks", isGuardInstalled(), "guard registered", "NOT registered"),
     line("Antigravity hooks", has(p.antigravityHooksPath), "guard registered", "NOT registered"),
     line("Codex hooks", isCodexGuardInstalled(), "guard registered", "NOT registered"),
@@ -529,7 +736,7 @@ function installGlobalQuiet() {
     let apiKey = process.env["SOLONGATE_API_KEY"] || "";
     let apiUrl = process.env["SOLONGATE_API_URL"] || "https://api.solongate.com";
     try {
-      const cfg = JSON.parse(readFileSync3(p.configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync4(p.configPath, "utf-8"));
       if (cfg && typeof cfg.apiKey === "string") apiKey = apiKey || cfg.apiKey;
       if (cfg && typeof cfg.apiUrl === "string") apiUrl = cfg.apiUrl;
     } catch {
@@ -545,26 +752,26 @@ function installGlobalQuiet() {
     mkdirSync(p.hooksDir, { recursive: true });
     mkdirSync(p.claudeDir, { recursive: true });
     unlockProtected();
-    writeFileSync2(join3(p.hooksDir, "guard.mjs"), readGuard());
+    writeFileSync2(join4(p.hooksDir, "guard.mjs"), readGuard());
     installGoBinaries(p.binDir);
-    writeFileSync2(join3(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
-    writeFileSync2(join3(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
-    writeFileSync2(join3(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
-    writeFileSync2(join3(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
+    writeFileSync2(join4(p.hooksDir, "audit.mjs"), readHook("audit.mjs"));
+    writeFileSync2(join4(p.hooksDir, "stop.mjs"), readHook("stop.mjs"));
+    writeFileSync2(join4(p.hooksDir, "shield.mjs"), readHook("shield.mjs"));
+    writeFileSync2(join4(p.hooksDir, "conversation.mjs"), readHook("conversation.mjs"));
+    writeLauncher(p.hooksDir);
+    writeLauncher(p.hooksDir);
     writeFileSync2(p.configPath, JSON.stringify({ apiKey, apiUrl }, null, 2) + "\n");
     let existing = {};
-    if (existsSync2(p.settingsPath)) {
-      const raw = readFileSync3(p.settingsPath, "utf-8");
-      if (!existsSync2(p.backupPath)) writeFileSync2(p.backupPath, raw);
+    if (existsSync3(p.settingsPath)) {
+      const raw = readFileSync4(p.settingsPath, "utf-8");
+      if (!existsSync3(p.backupPath)) writeFileSync2(p.backupPath, raw);
       try {
         existing = JSON.parse(raw);
       } catch {
         existing = {};
       }
     }
-    const nodeBin = process.execPath.replace(/\\/g, "/");
-    const call = process.platform === "win32" ? "& " : "";
-    const hookCmd = (script) => `${call}"${nodeBin}" "${join3(p.hooksDir, script).replace(/\\/g, "/")}" claude-code "Claude Code"`;
+    const hookCmd = (script) => hookCommandFor(p.hooksDir, script);
     const merged = {
       ...existing,
       hooks: {
@@ -591,7 +798,7 @@ function installGlobalQuiet() {
     };
     writeFileSync2(p.settingsPath, JSON.stringify(merged, null, 2) + "\n");
     try {
-      installAntigravityGuard(p, join3(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
+      installAntigravityGuard(p, join4(p.hooksDir, "guard.mjs").replace(/\\/g, "/"));
     } catch {
     }
     try {
@@ -612,7 +819,7 @@ function installGlobalQuiet() {
 function installedGuardVersion() {
   try {
     const p = globalPaths();
-    const s = readFileSync3(join3(p.hooksDir, "guard.mjs"), "utf-8");
+    const s = readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8");
     const m = s.match(/HOOK_VERSION\s*=\s*(\d+)/);
     return m ? parseInt(m[1], 10) : null;
   } catch {
@@ -622,16 +829,35 @@ function installedGuardVersion() {
 function guardHookOutdated() {
   try {
     const p = globalPaths();
-    return readFileSync3(join3(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
+    return readFileSync4(join4(p.hooksDir, "guard.mjs"), "utf-8") !== readGuard();
   } catch {
     return false;
   }
 }
+function hookCommandFor(hooksDir2, script, client = "claude-code", label = "Claude Code") {
+  const target = join4(hooksDir2, script).replace(/\\/g, "/");
+  if (process.platform === "win32") {
+    return `& "${process.execPath.replace(/\\/g, "/")}" "${target}" ${client} "${label}"`;
+  }
+  const launcher = join4(hooksDir2, LAUNCHER_NAME).replace(/\\/g, "/");
+  return `/bin/sh "${launcher}" "${target}" ${client} "${label}"`;
+}
+function writeLauncher(hooksDir2) {
+  writeFileSync2(join4(hooksDir2, LAUNCHER_NAME), launcherScript(process.execPath));
+  try {
+    chmodSync(join4(hooksDir2, LAUNCHER_NAME), 493);
+  } catch {
+  }
+  try {
+    mkdirSync(join4(hooksDir2, "..", BEAT_DIR), { recursive: true });
+  } catch {
+  }
+}
 function isGuardInstalled() {
   try {
     const p = globalPaths();
-    if (!existsSync2(p.settingsPath)) return false;
-    const s = JSON.parse(readFileSync3(p.settingsPath, "utf-8"));
+    if (!existsSync3(p.settingsPath)) return false;
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
     return !!s.hooks && JSON.stringify(s.hooks).includes(".solongate");
   } catch {
     return false;
@@ -654,8 +880,8 @@ function uninstallGlobalQuiet() {
       removeOpencodeGuard(p);
     } catch {
     }
-    if (!existsSync2(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
-    const s = JSON.parse(readFileSync3(p.settingsPath, "utf-8"));
+    if (!existsSync3(p.settingsPath)) return { ok: true, message: "guard removed (open a new session)" };
+    const s = JSON.parse(readFileSync4(p.settingsPath, "utf-8"));
     delete s.hooks;
     writeFileSync2(p.settingsPath, JSON.stringify(s, null, 2) + "\n");
     return { ok: true, message: "guard removed (open a new session)" };
@@ -669,17 +895,17 @@ function escapeRe(s) {
 function shimTargets() {
   if (process.platform === "win32") {
     try {
-      const prof = execFileSync("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
+      const prof = execFileSync2("powershell", ["-NoProfile", "-Command", "$PROFILE.CurrentUserAllHosts"], { encoding: "utf-8" }).trim();
       return prof ? [prof] : [];
     } catch {
       return [];
     }
   }
-  return [".bashrc", ".zshrc", ".profile"].map((f) => join3(homedir3(), f)).filter((f) => existsSync2(f));
+  return [".bashrc", ".zshrc", ".profile"].map((f) => join4(homedir4(), f)).filter((f) => existsSync3(f));
 }
 function writeShimBlock(file, block2) {
   const re = new RegExp(escapeRe(SHIM_BEGIN) + "[\\s\\S]*?" + escapeRe(SHIM_END) + "\\r?\\n?", "g");
-  let content = existsSync2(file) ? readFileSync3(file, "utf-8") : "";
+  let content = existsSync3(file) ? readFileSync4(file, "utf-8") : "";
   content = content.replace(re, "");
   if (block2) {
     if (content.length && !content.endsWith("\n")) content += "\n";
@@ -700,6 +926,10 @@ var __dirname, HOOKS_DIR, ANTIGRAVITY_GROUP, CODEX_EVENTS, CODEX_TIMEOUT_SEC, SC
 var init_global_install = __esm({
   "src/global-install.ts"() {
     "use strict";
+    init_hook_launcher();
+    init_hook_launcher();
+    init_hook_health();
+    init_hook_health();
     __dirname = dirname(fileURLToPath(import.meta.url));
     HOOKS_DIR = resolve(__dirname, "..", "hooks");
     ANTIGRAVITY_GROUP = "solongate-guard";
@@ -713,8 +943,8 @@ var init_global_install = __esm({
 
 // src/tui/index.tsx
 import { appendFileSync, mkdirSync as mkdirSync7 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join11 } from "path";
 import { render } from "ink";
 
 // src/tui/App.tsx
@@ -915,8 +1145,8 @@ function KeyHints({ hints }) {
 import { Box as Box2, Text as Text2, useInput } from "ink";
 import TextInput from "ink-text-input";
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join6, resolve as resolve3 } from "path";
 
 // src/tui/local-log.ts
 import { closeSync, existsSync, openSync, readdirSync, readFileSync as readFileSync2, readSync, statSync, writeFileSync } from "fs";
@@ -948,9 +1178,9 @@ function localLogsSetting() {
   return off;
 }
 function policyCachesNewestFirst() {
-  const sgDir = join2(homedir2(), ".solongate");
-  return readdirSync(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
-    const p = join2(sgDir, f);
+  const sgDir2 = join2(homedir2(), ".solongate");
+  return readdirSync(sgDir2).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+    const p = join2(sgDir2, f);
     let mtime = 0;
     try {
       mtime = statSync(p).mtimeMs;
@@ -961,9 +1191,9 @@ function policyCachesNewestFirst() {
 }
 function localLogFile() {
   try {
-    const sgDir = join2(homedir2(), ".solongate");
-    const caches = readdirSync(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
-      const p = join2(sgDir, f);
+    const sgDir2 = join2(homedir2(), ".solongate");
+    const caches = readdirSync(sgDir2).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+      const p = join2(sgDir2, f);
       let mtime = 0;
       try {
         mtime = statSync(p).mtimeMs;
@@ -1074,15 +1304,15 @@ import { useCallback as useCallback2, useEffect as useEffect2, useRef as useRef2
 
 // src/api-client/client.ts
 init_global_install();
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, join as join4 } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+import { resolve as resolve2, join as join5 } from "path";
+import { homedir as homedir5 } from "os";
 var DEFAULT_API_URL = "https://api.solongate.com";
-var accountsFile = () => join4(homedir4(), ".solongate", "accounts.json");
+var accountsFile = () => join5(homedir5(), ".solongate", "accounts.json");
 function listAccounts() {
   let list5 = [];
   try {
-    const raw = JSON.parse(readFileSync4(accountsFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync5(accountsFile(), "utf-8"));
     if (Array.isArray(raw)) list5 = raw.filter((a) => a && typeof a.apiKey === "string");
   } catch {
   }
@@ -1096,7 +1326,7 @@ function saveAccount(acc) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync4(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync5(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
@@ -1104,7 +1334,7 @@ function saveAccount(acc) {
     })();
     const next = list5.filter((a) => a.apiKey !== acc.apiKey);
     next.unshift({ ...acc, addedAt: acc.addedAt ?? Date.now() });
-    mkdirSync2(join4(homedir4(), ".solongate"), { recursive: true });
+    mkdirSync2(join5(homedir5(), ".solongate"), { recursive: true });
     writeFileSync3(accountsFile(), JSON.stringify(next, null, 2));
   } catch {
   }
@@ -1113,7 +1343,7 @@ function removeAccount(apiKey) {
   try {
     const list5 = (() => {
       try {
-        const raw = JSON.parse(readFileSync4(accountsFile(), "utf-8"));
+        const raw = JSON.parse(readFileSync5(accountsFile(), "utf-8"));
         return Array.isArray(raw) ? raw.filter((a) => a && a.apiKey) : [];
       } catch {
         return [];
@@ -1136,12 +1366,12 @@ function isActiveAccount(apiKey) {
 }
 function setActiveAccount(creds) {
   try {
-    const dir = join4(homedir4(), ".solongate");
+    const dir = join5(homedir5(), ".solongate");
     mkdirSync2(dir, { recursive: true });
-    const p = join4(dir, ["cloud", "guard.json"].join("-"));
+    const p = join5(dir, ["cloud", "guard.json"].join("-"));
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync4(p, "utf-8"));
+      existing = JSON.parse(readFileSync5(p, "utf-8"));
     } catch {
     }
     if (!writeProtectedFile(p, JSON.stringify({ ...existing, apiKey: creds.apiKey, apiUrl: creds.apiUrl }, null, 2))) return false;
@@ -1153,14 +1383,14 @@ function setActiveAccount(creds) {
 }
 function clearActiveCredential() {
   try {
-    const p = join4(homedir4(), ".solongate", ["cloud", "guard.json"].join("-"));
-    if (!existsSync3(p)) {
+    const p = join5(homedir5(), ".solongate", ["cloud", "guard.json"].join("-"));
+    if (!existsSync4(p)) {
       cached2 = null;
       return true;
     }
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync4(p, "utf-8"));
+      existing = JSON.parse(readFileSync5(p, "utf-8"));
     } catch {
     }
     delete existing.apiKey;
@@ -1191,9 +1421,9 @@ var NotAuthenticatedError = class extends Error {
 };
 function loginCredentialFile() {
   try {
-    const p = join4(homedir4(), ".solongate", "cloud-guard.json");
-    if (!existsSync3(p)) return {};
-    const c2 = JSON.parse(readFileSync4(p, "utf-8"));
+    const p = join5(homedir5(), ".solongate", "cloud-guard.json");
+    if (!existsSync4(p)) return {};
+    const c2 = JSON.parse(readFileSync5(p, "utf-8"));
     return c2 && typeof c2 === "object" ? c2 : {};
   } catch {
     return {};
@@ -1202,8 +1432,8 @@ function loginCredentialFile() {
 function dotenvApiKey() {
   try {
     const envPath = resolve2(".env");
-    if (!existsSync3(envPath)) return void 0;
-    for (const line of readFileSync4(envPath, "utf-8").split("\n")) {
+    if (!existsSync4(envPath)) return void 0;
+    for (const line of readFileSync5(envPath, "utf-8").split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) continue;
       const eq = trimmed.indexOf("=");
@@ -1687,7 +1917,7 @@ var projectKey = (dir) => {
   }
   return h.toString(16);
 };
-var RING = join5(homedir5(), ".solongate", "projects", projectKey(resolve3(process.cwd())), ".eval-ring.jsonl");
+var RING = join6(homedir6(), ".solongate", "projects", projectKey(resolve3(process.cwd())), ".eval-ring.jsonl");
 var fmtUp = (ms) => {
   const s = Math.floor(ms / 1e3);
   const p = (n) => String(n).padStart(2, "0");
@@ -2294,9 +2524,9 @@ function LivePanel({ active: active2 }) {
       else if (input === "x") toggleSignal("dlp");
       else if (input === "r") toggleSignal("ratelimit");
       else if (input === "e") {
-        const file = join5(homedir5(), ".solongate", "live-export.jsonl");
+        const file = join6(homedir6(), ".solongate", "live-export.jsonl");
         try {
-          mkdirSync3(join5(homedir5(), ".solongate"), { recursive: true });
+          mkdirSync3(join6(homedir6(), ".solongate"), { recursive: true });
           writeFileSync4(file, visibleDesc.map((x) => JSON.stringify(x)).join("\n") + "\n");
           setActionMsg({ text: `\u2713 exported ${visibleDesc.length} lines \u2192 ${file}`, level: "ok", until: Date.now() + 6e3 });
         } catch (err2) {
@@ -3896,8 +4126,8 @@ function DlpPanel({ focused }) {
 import { Box as Box7, Text as Text7, useInput as useInput6 } from "ink";
 import TextInput5 from "ink-text-input";
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join6 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
 import { useState as useState7 } from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 var DECISIONS = [void 0, "DENY", "ALLOW"];
@@ -4104,8 +4334,8 @@ function AuditPanel({ active: active2, focused }) {
   const doExport = (kind) => {
     setMsg({ text: "exporting\u2026", level: "ok" });
     const run = async () => {
-      const dir = join6(homedir6(), ".solongate");
-      const file = join6(dir, `audit-export-${source}.jsonl`);
+      const dir = join7(homedir7(), ".solongate");
+      const file = join7(dir, `audit-export-${source}.jsonl`);
       let rows2;
       if (kind === "page") rows2 = pageRows;
       else if (source === "cloud") {
@@ -4479,10 +4709,11 @@ import { useEffect as useEffect7, useRef as useRef3, useState as useState8 } fro
 init_global_install();
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 init_global_install();
+init_hook_health();
 async function collectChecks() {
   const checks = [];
   if (!isAuthenticated()) {
@@ -4530,8 +4761,32 @@ async function collectChecks() {
     ok: claudeReg,
     detail: claudeReg ? "guard registered" : "guard NOT registered - run `solongate repair`"
   });
-  if (existsSync4(globalPaths().antigravityDir)) {
-    const reg = existsSync4(globalPaths().antigravityHooksPath);
+  if (claudeReg) {
+    const start = hookCanStart();
+    checks.push({
+      name: "hook runtime",
+      ok: start.ok,
+      detail: start.ok ? `node ${start.detail}` : `${start.detail} - nothing is being enforced or logged`
+    });
+    const beat = guardBeat();
+    if (!beat) {
+      checks.push({
+        name: "guard fired",
+        ok: "warn",
+        detail: "never - open your agent and run one tool call, then check again"
+      });
+    } else if (beat.node === "no-node") {
+      checks.push({
+        name: "guard fired",
+        ok: false,
+        detail: `${agoLabel(beat.at)}, but found no node to run with - run \`solongate repair\``
+      });
+    } else {
+      checks.push({ name: "guard fired", ok: true, detail: `${agoLabel(beat.at)} \xB7 ${beat.node}` });
+    }
+  }
+  if (existsSync5(globalPaths().antigravityDir)) {
+    const reg = existsSync5(globalPaths().antigravityHooksPath);
     checks.push({
       name: "Antigravity hooks",
       ok: reg,
@@ -4559,7 +4814,7 @@ async function collectChecks() {
     });
   }
   try {
-    const raw = readFileSync5(join7(homedir7(), ".solongate", ".key-rejected.json"), "utf-8");
+    const raw = readFileSync6(join8(homedir8(), ".solongate", ".key-rejected.json"), "utf-8");
     const m = JSON.parse(raw);
     const ageMin = m.ts ? Math.round((Date.now() - m.ts) / 6e4) : null;
     checks.push({
@@ -4570,8 +4825,8 @@ async function collectChecks() {
   } catch {
   }
   const LOCAL_LOG2 = localLogFile();
-  if (existsSync4(LOCAL_LOG2)) {
-    const st = statSync3(LOCAL_LOG2);
+  if (existsSync5(LOCAL_LOG2)) {
+    const st = statSync4(LOCAL_LOG2);
     const ageMin = (Date.now() - st.mtimeMs) / 6e4;
     checks.push({ name: "local logs", ok: true, detail: `on \xB7 ${(st.size / 1024).toFixed(0)}KB \xB7 last write ${ageMin < 1 ? "just now" : Math.round(ageMin) + "m ago"}` });
   } else {
@@ -4582,17 +4837,17 @@ async function collectChecks() {
 
 // src/logs-server-daemon.ts
 import { spawn as spawn4 } from "child_process";
-import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname2, join as join8 } from "path";
+import { mkdirSync as mkdirSync5, openSync as openSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname2, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var DIR = join8(homedir8(), ".solongate");
-var STATE_FILE = join8(DIR, ".logs-server.json");
-var LOG_FILE = join8(DIR, "logs-server.log");
+var DIR = join9(homedir9(), ".solongate");
+var STATE_FILE = join9(DIR, ".logs-server.json");
+var LOG_FILE = join9(DIR, "logs-server.log");
 var LOGS_SERVER_PORT = 8788;
 function readState() {
   try {
-    const s = JSON.parse(readFileSync6(STATE_FILE, "utf-8"));
+    const s = JSON.parse(readFileSync7(STATE_FILE, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -4628,7 +4883,7 @@ function startLogsServerDaemon() {
   try {
     mkdirSync5(DIR, { recursive: true });
     const log = openSync2(LOG_FILE, "a");
-    const cli = join8(dirname2(fileURLToPath2(import.meta.url)), "index.js");
+    const cli = join9(dirname2(fileURLToPath2(import.meta.url)), "index.js");
     const p = spawn4(process.execPath, [cli, "logs-server"], {
       detached: true,
       stdio: ["ignore", log, log],
@@ -4659,22 +4914,22 @@ function stopLogsServerDaemon() {
 }
 
 // src/self-update.ts
-import { execFile, execFileSync as execFileSync2, spawn as spawn5 } from "child_process";
-import { access, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync7, constants as FS } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname3, join as join9, sep } from "path";
+import { execFile, execFileSync as execFileSync3, spawn as spawn5 } from "child_process";
+import { access, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync7, constants as FS } from "fs";
+import { homedir as homedir10 } from "os";
+import { dirname as dirname3, join as join10, sep } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var PKG = "@solongate/proxy";
 var CHECK_EVERY_MS = 30 * 60 * 1e3;
 var ATTEMPT_EVERY_MS = 6 * 60 * 60 * 1e3;
-var STATE_FILE2 = join9(homedir9(), ".solongate", ".self-update.json");
-var LOG_FILE2 = join9(homedir9(), ".solongate", "self-update.log");
-var LOCK_FILE = join9(homedir9(), ".solongate", ".update-install.lock");
+var STATE_FILE2 = join10(homedir10(), ".solongate", ".self-update.json");
+var LOG_FILE2 = join10(homedir10(), ".solongate", "self-update.log");
+var LOCK_FILE = join10(homedir10(), ".solongate", ".update-install.lock");
 var LOCK_STALE_MS = 3 * 6e4;
 var NEEDS_ADMIN_RE = /\bEACCES\b|\bEPERM\b|permission denied|operation not permitted/i;
 function readState2() {
   try {
-    const s = JSON.parse(readFileSync7(STATE_FILE2, "utf-8"));
+    const s = JSON.parse(readFileSync8(STATE_FILE2, "utf-8"));
     return s && typeof s === "object" ? s : {};
   } catch {
     return {};
@@ -4682,7 +4937,7 @@ function readState2() {
 }
 function writeState2(s) {
   try {
-    mkdirSync6(join9(homedir9(), ".solongate"), { recursive: true });
+    mkdirSync6(join10(homedir10(), ".solongate"), { recursive: true });
     writeFileSync7(STATE_FILE2, JSON.stringify(s));
   } catch {
   }
@@ -4703,7 +4958,7 @@ function setAutoUpdate(on) {
 }
 function currentVersion() {
   try {
-    const pkg = JSON.parse(readFileSync7(join9(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync8(join10(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json"), "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -4740,7 +4995,7 @@ async function fetchLatest() {
 function runGlobalInstall(version) {
   return new Promise((resolve4) => {
     try {
-      mkdirSync6(join9(homedir9(), ".solongate"), { recursive: true });
+      mkdirSync6(join10(homedir10(), ".solongate"), { recursive: true });
       execFile(
         "npm",
         ["install", "-g", `${PKG}@${version}`],
@@ -5904,11 +6159,11 @@ async function launchTui() {
     return;
   }
   process.stdout.write("\x1B[?1049h\x1B[H");
-  const debugLog = join10(homedir10(), ".solongate", "dataroom-debug.log");
+  const debugLog = join11(homedir11(), ".solongate", "dataroom-debug.log");
   const saved = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
   const toFile = (level) => (...args) => {
     try {
-      mkdirSync7(join10(homedir10(), ".solongate"), { recursive: true });
+      mkdirSync7(join11(homedir11(), ".solongate"), { recursive: true });
       appendFileSync(debugLog, `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
 `);
     } catch {