comisai 1.0.24 → 1.0.25

package/node_modules/@comis/web/dist/assets/{security-D15st4xx.js → security-QQXMRTlo.js}

@@ -1,24 +1,4 @@
-import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S as B}from"./index-CEcM1R_C.js";import"./ic-tabs-B7QtM_v8.js";import"./ic-empty-state-60l2ePhd.js";import"./ic-tag-CPPUnDLF.js";import"./ic-relative-time-3FqpjeAI.js";import"./ic-connection-dot-CnT1b8xr.js";import"./ic-select-Ce-Raudx.js";import"./ic-array-editor-B7m6x7-S.js";import"./ic-icon-xeGTVhVG.js";var j=Object.defineProperty,F=Object.getOwnPropertyDescriptor,T=(e,t,i,a)=>{for(var r=a>1?void 0:a?F(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&j(t,i,r),r};let g=class extends x{constructor(){super(...arguments),this.label="",this.value="",this.placeholder="env:SECRET_NAME or file:/path",this.disabled=!1,this._visible=!1}_onInput(e){const t=e.target.value;this.dispatchEvent(new CustomEvent("change",{detail:t,bubbles:!0,composed:!0}))}_toggleVisibility(){this._visible=!this._visible}render(){return s`
-      <div class="field-wrapper">
-        ${this.label?s`<label>${this.label}</label>`:p}
-        <div class="input-row">
-          <input
-            type=${this._visible?"text":"password"}
-            .value=${this.value}
-            placeholder=${this.placeholder}
-            ?disabled=${this.disabled}
-            @input=${this._onInput}
-          />
-          <button
-            class="toggle-btn"
-            type="button"
-            aria-label=${this._visible?"Hide value":"Show value"}
-            @click=${this._toggleVisibility}
-          >${this._visible?"🙈":"👁"}</button>
-        </div>
-        <span class="hint">Format: env:VAR_NAME or file:/path/to/secret</span>
-      </div>
-    `}};g.styles=[_,S,w`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-FLPhHz8p.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-array-editor-BLoEyeLS.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-tabs-yBjkWKJH.js";import"./ic-connection-dot-BgYiK2N4.js";import"./ic-select-BqfZISjw.js";var f=class extends r{constructor(...e){super(...e),this.label=``,this.value=``,this.placeholder=`env:SECRET_NAME or file:/path`,this.disabled=!1,this._visible=!1}static{this.styles=[o,i,n`
       :host {
         display: block;
       }
@@ -88,71 +68,27 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         color: var(--ic-text-dim);
         font-style: italic;
       }
-    `];T([d()],g.prototype,"label",2);T([d()],g.prototype,"value",2);T([d()],g.prototype,"placeholder",2);T([d({type:Boolean})],g.prototype,"disabled",2);T([l()],g.prototype,"_visible",2);g=T([$("ic-secret-input")],g);var L=Object.defineProperty,G=Object.getOwnPropertyDescriptor,R=(e,t,i,a)=>{for(var r=a>1?void 0:a?G(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&L(t,i,r),r};let y=class extends x{constructor(){super(...arguments),this._tokens=[],this._newTokenScopes=[],this._newSecretDisplay=null}connectedCallback(){super.connectedCallback()}updated(e){e.has("rpc")&&this.rpc&&this._loadTokens()}async _loadTokens(){if(this.rpc)try{const e=await this.rpc.call("tokens.list");this._tokens=e.tokens??[]}catch{}}async _revokeToken(e){if(this.rpc)try{await this.rpc.call("tokens.revoke",{id:e}),this._tokens=this._tokens.filter(t=>t.id!==e),n.show(`Token "${e}" revoked`,"success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(t){const i=t instanceof Error?t.message:"Failed to revoke token";n.show(i,"error")}}async _rotateToken(e){if(this.rpc)try{const t=await this.rpc.call("tokens.rotate",{id:e});this._newSecretDisplay=t.secret,n.show(`Token "${e}" rotated -- new secret shown below`,"success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(t){const i=t instanceof Error?t.message:"Failed to rotate token";n.show(i,"error")}}_onScopeToggle(e,t){t?this._newTokenScopes=[...this._newTokenScopes,e]:this._newTokenScopes=this._newTokenScopes.filter(i=>i!==e)}async _generateToken(){if(this.rpc)try{const e=await this.rpc.call("tokens.create",{scopes:[...this._newTokenScopes]});this._tokens=[...this._tokens,{id:e.id,scopes:e.scopes}],this._newSecretDisplay=e.secret,this._newTokenScopes=[],n.show("Token created -- secret shown below","success"),this.dispatchEvent(new CustomEvent("tokens-changed",{bubbles:!0,composed:!0}))}catch(e){const t=e instanceof Error?e.message:"Failed to create token";n.show(t,"error")}}_renderTokenRow(e){return s`
-      <div class="data-cell" role="cell">${e.id}</div>
-      <div class="data-cell scopes-cell" role="cell">
-        ${e.scopes.map(t=>s`<ic-tag variant="info">${t}</ic-tag>`)}
-      </div>
-      <div class="data-cell" role="cell">
-        <div class="token-actions">
-          <button class="rotate-btn" @click=${()=>this._rotateToken(e.id)}>Rotate</button>
-          <button class="revoke-btn" @click=${()=>this._revokeToken(e.id)}>Revoke</button>
-        </div>
-      </div>
-    `}render(){return s`
-      <div class="grid-table grid-table--tokens" role="table" aria-label="API tokens">
-        <div class="header-cell" role="columnheader">Token ID</div>
-        <div class="header-cell" role="columnheader">Scopes</div>
-        <div class="header-cell" role="columnheader">Actions</div>
-        ${this._tokens.map(e=>this._renderTokenRow(e))}
-      </div>
-
-      ${this._newSecretDisplay?s`
-            <div class="new-secret-banner">
-              <div class="secret-label">New Token Secret</div>
-              <div class="secret-value">${this._newSecretDisplay}</div>
-              <div class="secret-warning">Copy this secret now. It will not be shown again.</div>
-            </div>
-          `:p}
-
-      <div class="create-form">
-        <div class="create-form-title">Create Token</div>
-        <div class="form-field">
-          <label class="form-label">Scopes</label>
-          <div class="checkbox-row">
-            <input type="checkbox" id="scope-rpc"
-              .checked=${this._newTokenScopes.includes("rpc")}
-              @change=${e=>this._onScopeToggle("rpc",e.target.checked)}
-            /><label for="scope-rpc">rpc</label>
-          </div>
-          <div class="checkbox-row">
-            <input type="checkbox" id="scope-ws"
-              .checked=${this._newTokenScopes.includes("ws")}
-              @change=${e=>this._onScopeToggle("ws",e.target.checked)}
-            /><label for="scope-ws">ws</label>
-          </div>
-          <div class="checkbox-row">
-            <input type="checkbox" id="scope-admin"
-              .checked=${this._newTokenScopes.includes("admin")}
-              @change=${e=>this._onScopeToggle("admin",e.target.checked)}
-            /><label for="scope-admin">admin</label>
-          </div>
-          <div class="checkbox-row">
-            <input type="checkbox" id="scope-api"
-              .checked=${this._newTokenScopes.includes("api")}
-              @change=${e=>this._onScopeToggle("api",e.target.checked)}
-            /><label for="scope-api">api</label>
-          </div>
-          <div class="checkbox-row">
-            <input type="checkbox" id="scope-all"
-              .checked=${this._newTokenScopes.includes("*")}
-              @change=${e=>this._onScopeToggle("*",e.target.checked)}
-            /><label for="scope-all">* (all)</label>
-          </div>
+    `]}_onInput(e){let t=e.target.value;this.dispatchEvent(new CustomEvent(`change`,{detail:t,bubbles:!0,composed:!0}))}_toggleVisibility(){this._visible=!this._visible}render(){return t`
+      <div class="field-wrapper">
+        ${this.label?t`<label>${this.label}</label>`:l}
+        <div class="input-row">
+          <input
+            type=${this._visible?`text`:`password`}
+            .value=${this.value}
+            placeholder=${this.placeholder}
+            ?disabled=${this.disabled}
+            @input=${this._onInput}
+          />
+          <button
+            class="toggle-btn"
+            type="button"
+            aria-label=${this._visible?`Hide value`:`Show value`}
+            @click=${this._toggleVisibility}
+          >${this._visible?`🙈`:`👁`}</button>
         </div>
-        <button class="generate-btn" @click=${()=>this._generateToken()}>Generate</button>
+        <span class="hint">Format: env:VAR_NAME or file:/path/to/secret</span>
       </div>
-    `}};y.styles=[_,S,w`
+    `}};c([s()],f.prototype,`label`,void 0),c([s()],f.prototype,`value`,void 0),c([s()],f.prototype,`placeholder`,void 0),c([s({type:Boolean})],f.prototype,`disabled`,void 0),c([a()],f.prototype,`_visible`,void 0),f=c([e(`ic-secret-input`)],f);var p=class extends r{constructor(...e){super(...e),this._tokens=[],this._newTokenScopes=[],this._newSecretDisplay=null}static{this.styles=[o,i,n`
       :host {
         display: block;
       }
@@ -317,41 +253,71 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         color: var(--ic-text-dim);
         margin-top: var(--ic-space-xs);
       }
-    `];R([d({attribute:!1})],y.prototype,"rpc",2);R([l()],y.prototype,"_tokens",2);R([l()],y.prototype,"_newTokenScopes",2);R([l()],y.prototype,"_newSecretDisplay",2);y=R([$("ic-token-manager")],y);var V=Object.defineProperty,K=Object.getOwnPropertyDescriptor,I=(e,t,i,a)=>{for(var r=a>1?void 0:a?K(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&V(t,i,r),r};const U={low:"success",medium:"warning",high:"error",critical:"error"},J={low:"var(--ic-success)",medium:"var(--ic-warning)",high:"var(--ic-error)",critical:"var(--ic-error)"};let C=class extends x{constructor(){super(...arguments),this.approval=null,this._reason="",this._expanded=!1}_onApprove(){this.approval&&this.dispatchEvent(new CustomEvent("approve",{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}_onDeny(){this.approval&&this.dispatchEvent(new CustomEvent("deny",{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}render(){if(!this.approval)return p;const e=this.approval,t=U[e.classification]??"default",i=J[e.classification]??"var(--ic-border)";return s`
-      <div
-        class="card"
-        role="article"
-        aria-label="${e.agentId} ${e.action} approval request"
-        style="border-left-color: ${i};"
-      >
-        <div class="card-header">
-          <span class="agent-id">${e.agentId}</span>
-          <span class="action-name">${e.action}</span>
-          <ic-tag variant=${t}>${e.classification}</ic-tag>
-        </div>
-        <div class="timestamp">
-          <ic-relative-time .timestamp=${e.requestedAt}></ic-relative-time>
+    `]}connectedCallback(){super.connectedCallback()}updated(e){e.has(`rpc`)&&this.rpc&&this._loadTokens()}async _loadTokens(){if(this.rpc)try{let e=await this.rpc.call(`tokens.list`);this._tokens=e.tokens??[]}catch{}}async _revokeToken(e){if(this.rpc)try{await this.rpc.call(`tokens.revoke`,{id:e}),this._tokens=this._tokens.filter(t=>t.id!==e),u.show(`Token "${e}" revoked`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to revoke token`;u.show(t,`error`)}}async _rotateToken(e){if(this.rpc)try{let t=await this.rpc.call(`tokens.rotate`,{id:e});this._newSecretDisplay=t.secret,u.show(`Token "${e}" rotated -- new secret shown below`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to rotate token`;u.show(t,`error`)}}_onScopeToggle(e,t){t?this._newTokenScopes=[...this._newTokenScopes,e]:this._newTokenScopes=this._newTokenScopes.filter(t=>t!==e)}async _generateToken(){if(this.rpc)try{let e=await this.rpc.call(`tokens.create`,{scopes:[...this._newTokenScopes]});this._tokens=[...this._tokens,{id:e.id,scopes:e.scopes}],this._newSecretDisplay=e.secret,this._newTokenScopes=[],u.show(`Token created -- secret shown below`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to create token`;u.show(t,`error`)}}_renderTokenRow(e){return t`
+      <div class="data-cell" role="cell">${e.id}</div>
+      <div class="data-cell scopes-cell" role="cell">
+        ${e.scopes.map(e=>t`<ic-tag variant="info">${e}</ic-tag>`)}
+      </div>
+      <div class="data-cell" role="cell">
+        <div class="token-actions">
+          <button class="rotate-btn" @click=${()=>this._rotateToken(e.id)}>Rotate</button>
+          <button class="revoke-btn" @click=${()=>this._revokeToken(e.id)}>Revoke</button>
         </div>
-        ${e.user?s`<div class="user-row"><span class="user-label">Requested by:</span> ${e.user}</div>`:p}
-        <button
-          class="context-toggle"
-          @click=${()=>{this._expanded=!this._expanded}}
-        >${this._expanded?"Hide details":"Show details"}</button>
-        ${this._expanded?s`<div class="context-details">${e.context}</div>`:p}
-        <input
-          class="reason-input"
-          type="text"
-          placeholder="Reason (optional)"
-          aria-label="Decision reason"
-          .value=${this._reason}
-          @input=${a=>{this._reason=a.target.value}}
-        />
-        <div class="action-buttons">
-          <button class="approve-btn" @click=${()=>this._onApprove()}>Approve</button>
-          <button class="deny-btn" @click=${()=>this._onDeny()}>Deny</button>
+      </div>
+    `}render(){return t`
+      <div class="grid-table grid-table--tokens" role="table" aria-label="API tokens">
+        <div class="header-cell" role="columnheader">Token ID</div>
+        <div class="header-cell" role="columnheader">Scopes</div>
+        <div class="header-cell" role="columnheader">Actions</div>
+        ${this._tokens.map(e=>this._renderTokenRow(e))}
+      </div>
+
+      ${this._newSecretDisplay?t`
+            <div class="new-secret-banner">
+              <div class="secret-label">New Token Secret</div>
+              <div class="secret-value">${this._newSecretDisplay}</div>
+              <div class="secret-warning">Copy this secret now. It will not be shown again.</div>
+            </div>
+          `:l}
+
+      <div class="create-form">
+        <div class="create-form-title">Create Token</div>
+        <div class="form-field">
+          <label class="form-label">Scopes</label>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-rpc"
+              .checked=${this._newTokenScopes.includes(`rpc`)}
+              @change=${e=>this._onScopeToggle(`rpc`,e.target.checked)}
+            /><label for="scope-rpc">rpc</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-ws"
+              .checked=${this._newTokenScopes.includes(`ws`)}
+              @change=${e=>this._onScopeToggle(`ws`,e.target.checked)}
+            /><label for="scope-ws">ws</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-admin"
+              .checked=${this._newTokenScopes.includes(`admin`)}
+              @change=${e=>this._onScopeToggle(`admin`,e.target.checked)}
+            /><label for="scope-admin">admin</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-api"
+              .checked=${this._newTokenScopes.includes(`api`)}
+              @change=${e=>this._onScopeToggle(`api`,e.target.checked)}
+            /><label for="scope-api">api</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-all"
+              .checked=${this._newTokenScopes.includes(`*`)}
+              @change=${e=>this._onScopeToggle(`*`,e.target.checked)}
+            /><label for="scope-all">* (all)</label>
+          </div>
         </div>
+        <button class="generate-btn" @click=${()=>this._generateToken()}>Generate</button>
       </div>
-    `}};C.styles=[_,S,w`
+    `}};c([s({attribute:!1})],p.prototype,`rpc`,void 0),c([a()],p.prototype,`_tokens`,void 0),c([a()],p.prototype,`_newTokenScopes`,void 0),c([a()],p.prototype,`_newSecretDisplay`,void 0),p=c([e(`ic-token-manager`)],p);var m={low:`success`,medium:`warning`,high:`error`,critical:`error`},h={low:`var(--ic-success)`,medium:`var(--ic-warning)`,high:`var(--ic-error)`,critical:`var(--ic-error)`},g=class extends r{constructor(...e){super(...e),this.approval=null,this._reason=``,this._expanded=!1}static{this.styles=[o,i,n`
       :host {
         display: block;
         width: 100%;
@@ -483,119 +449,41 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
       .deny-btn:hover {
         background: color-mix(in srgb, var(--ic-error) 25%, transparent);
       }
-    `];I([d({type:Object})],C.prototype,"approval",2);I([l()],C.prototype,"_reason",2);I([l()],C.prototype,"_expanded",2);C=I([$("ic-approval-card")],C);var Q=Object.defineProperty,Y=Object.getOwnPropertyDescriptor,k=(e,t,i,a)=>{for(var r=a>1?void 0:a?Y(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&Q(t,i,r),r};function M(e){return{id:e.requestId,agentId:e.agentId,action:e.action||e.toolName,classification:e.trustLevel==="admin"?"low":e.trustLevel==="user"?"medium":"high",context:JSON.stringify(e.params,null,2),requestedAt:e.createdAt}}const q="ic:approval-history",H=10080*60*1e3;function X(){try{const e=localStorage.getItem(q);if(!e)return[];const t=JSON.parse(e),i=Date.now()-H;return t.filter(a=>a.resolvedAt>i)}catch{return[]}}function P(e){try{const t=Date.now()-H,i=e.filter(a=>a.resolvedAt>t);localStorage.setItem(q,JSON.stringify(i))}catch{}}let m=class extends x{constructor(){super(...arguments),this.securityConfig={},this.activeSubTab="pending",this._pendingApprovals=[],this._resolvedApprovals=[],this._approvalRules={defaultMode:"manual",timeoutMs:0}}connectedCallback(){super.connectedCallback(),this._resolvedApprovals=X()}updated(e){e.has("rpc")&&this.rpc&&this._loadApprovals(),e.has("securityConfig")&&(this._approvalRules=this.securityConfig.approvalRules??{defaultMode:"manual",timeoutMs:0})}async _loadApprovals(){if(this.rpc)try{const e=await this.rpc.call("admin.approval.pending");this._pendingApprovals=(e.requests??[]).map(M)}catch{}}onApprovalPending(e){const t=e;t?.requestId&&(this._pendingApprovals=[M(t),...this._pendingApprovals])}onApprovalResolved(e){const t=e,i=t?.requestId;if(!i)return;this._pendingApprovals=this._pendingApprovals.filter(o=>o.id!==i);const r={...M(t),outcome:t.approved?"approved":"denied",reason:t.reason??"",resolvedAt:t.resolvedAt??Date.now(),resolvedBy:t.approvedBy??"system"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}async _handleApprove(e){if(!this.rpc)return;const{id:t,reason:i}=e.detail;try{await this.rpc.call("admin.approval.resolve",{requestId:t,approved:!0,approvedBy:"operator",reason:i});const a=this._pendingApprovals.find(r=>r.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(r=>r.id!==t),a){const r={...a,outcome:"approved",reason:i,resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}n.show("Approval granted","success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(a){n.show(a instanceof Error?a.message:"Failed to approve request","error")}}async _handleDeny(e){if(!this.rpc)return;const{id:t,reason:i}=e.detail;try{await this.rpc.call("admin.approval.resolve",{requestId:t,approved:!1,approvedBy:"operator",reason:i});const a=this._pendingApprovals.find(r=>r.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(r=>r.id!==t),a){const r={...a,outcome:"denied",reason:i,resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[r,...this._resolvedApprovals],P(this._resolvedApprovals)}n.show("Approval denied","success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(a){n.show(a instanceof Error?a.message:"Failed to deny request","error")}}async _handleResolveAll(e){if(!(!this.rpc||this._pendingApprovals.length===0))try{const t=await this.rpc.call("admin.approval.resolveAll",{approved:e,approvedBy:"operator",reason:e?"Bulk approved by operator":"Bulk denied by operator"});for(const i of this._pendingApprovals){const a={...i,outcome:e?"approved":"denied",reason:e?"Bulk approved by operator":"Bulk denied by operator",resolvedAt:Date.now(),resolvedBy:"operator"};this._resolvedApprovals=[a,...this._resolvedApprovals]}this._pendingApprovals=[],P(this._resolvedApprovals),n.show(`${t.resolved} approval(s) ${e?"approved":"denied"}`,"success"),this.dispatchEvent(new CustomEvent("approvals-changed",{bubbles:!0,composed:!0}))}catch(t){n.show(t instanceof Error?t.message:"Bulk operation failed","error")}}async _handleClearDenialCache(){if(this.rpc)try{await this.rpc.call("admin.approval.clearDenialCache",{}),n.show("Denial cache cleared","success")}catch(e){n.show(e instanceof Error?e.message:"Failed to clear denial cache","error")}}async _patchConfig(e,t){if(!this.rpc)return!1;try{const i=e.indexOf("."),a=i>0?e.slice(0,i):e,r=i>0?e.slice(i+1):void 0;return await this.rpc.call("config.patch",{section:a,key:r,value:t}),n.show("Configuration updated","success"),!0}catch(i){return n.show(i instanceof Error?i.message:"Failed to update configuration","error"),!1}}async _onActionConfirmationChange(e,t){const i={...this.securityConfig.actionConfirmation,[e]:t};await this._patchConfig("security.actionConfirmation",i)}async _onAgentToAgentEnabledChange(e){const t={...this.securityConfig.agentToAgent,enabled:e};await this._patchConfig("security.agentToAgent",t)}async _onAgentToAgentAllowChange(e){const t={...this.securityConfig.agentToAgent,allowAgents:e};await this._patchConfig("security.agentToAgent",t)}async _onPermissionToggleChange(e){const t={...this.securityConfig.permission,enableNodePermissions:e};await this._patchConfig("security.permission",t)}async _onPermissionPathsChange(e,t){const i={...this.securityConfig.permission,[e]:t};await this._patchConfig("security.permission",i)}async _saveApprovalRules(){if(this.rpc)try{await this.rpc.call("config.patch",{section:"security",key:"approvalRules",value:this._approvalRules}),n.show("Approval rules updated","success")}catch(e){n.show(e instanceof Error?e.message:"Failed to update approval rules","error")}}_renderHistoryRow(e){const t=e.outcome==="approved"?"success":"error",i={low:"success",medium:"warning",high:"error",critical:"error"}[e.classification]??"default";return s`
-      <div class="data-cell" role="cell">${e.agentId}</div>
-      <div class="data-cell" role="cell">${e.action}</div>
-      <div class="data-cell" role="cell"><ic-tag variant=${i}>${e.classification}</ic-tag></div>
-      <div class="data-cell" role="cell"><ic-tag variant=${t}>${e.outcome}</ic-tag></div>
-      <div class="data-cell data-cell--muted" role="cell">${e.reason||"---"}</div>
-      <div class="data-cell data-cell--muted" role="cell"><ic-relative-time .timestamp=${e.resolvedAt}></ic-relative-time></div>
-      <div class="data-cell data-cell--muted" role="cell">${e.resolvedBy}</div>
-    `}_renderRulesContent(){const e=this.securityConfig.actionConfirmation??{},t=this.securityConfig.agentToAgent??{},i=this.securityConfig.permission??{},a=[{value:"manual",label:"Manual (all require approval)"},{value:"auto-low",label:"Auto-approve low risk"},{value:"auto-medium",label:"Auto-approve low + medium risk"},{value:"auto-all",label:"Auto-approve all (no approvals)"}];return s`
-      <div class="policy-section">
-        <div class="section-header">Action Confirmation</div>
-        <ic-toggle label="Require for destructive actions"
-          .checked=${e.requireForDestructive??!0}
-          @change=${r=>this._onActionConfirmationChange("requireForDestructive",r.detail)}
-        ></ic-toggle>
-        <div style="margin-top: var(--ic-space-sm);">
-          <ic-toggle label="Require for sensitive actions"
-            .checked=${e.requireForSensitive??!1}
-            @change=${r=>this._onActionConfirmationChange("requireForSensitive",r.detail)}
-          ></ic-toggle>
-        </div>
-        <div style="margin-top: var(--ic-space-md);">
-          <ic-array-editor label="Auto-approve list" .items=${e.autoApprove??[]} placeholder="Action name to auto-approve"
-            @change=${r=>this._onActionConfirmationChange("autoApprove",r.detail)}
-          ></ic-array-editor>
-        </div>
-      </div>
-
-      <div class="policy-section">
-        <div class="section-header">Agent-to-Agent Policy</div>
-        <ic-toggle label="Enable cross-agent messaging"
-          .checked=${t.enabled??!0}
-          @change=${r=>this._onAgentToAgentEnabledChange(r.detail)}
-        ></ic-toggle>
-        <div style="margin-top: var(--ic-space-md);">
-          <ic-array-editor label="Allowed agents" .items=${t.allowAgents??[]} placeholder="Agent ID"
-            @change=${r=>this._onAgentToAgentAllowChange(r.detail)}
-          ></ic-array-editor>
-        </div>
-      </div>
-
-      <div class="policy-section">
-        <div class="section-header">Permissions</div>
-        <ic-toggle label="Enable Node.js permission model"
-          .checked=${i.enableNodePermissions??!1}
-          @change=${r=>this._onPermissionToggleChange(r.detail)}
-        ></ic-toggle>
-        <div style="margin-top: var(--ic-space-md);">
-          <ic-array-editor label="Allowed filesystem paths" .items=${i.allowedFsPaths??[]} placeholder="/path/to/allow"
-            @change=${r=>this._onPermissionPathsChange("allowedFsPaths",r.detail)}
-          ></ic-array-editor>
+    `]}_onApprove(){this.approval&&this.dispatchEvent(new CustomEvent(`approve`,{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}_onDeny(){this.approval&&this.dispatchEvent(new CustomEvent(`deny`,{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}render(){if(!this.approval)return l;let e=this.approval,n=m[e.classification]??`default`,r=h[e.classification]??`var(--ic-border)`;return t`
+      <div
+        class="card"
+        role="article"
+        aria-label="${e.agentId} ${e.action} approval request"
+        style="border-left-color: ${r};"
+      >
+        <div class="card-header">
+          <span class="agent-id">${e.agentId}</span>
+          <span class="action-name">${e.action}</span>
+          <ic-tag variant=${n}>${e.classification}</ic-tag>
         </div>
-        <div style="margin-top: var(--ic-space-md);">
-          <ic-array-editor label="Allowed network hosts" .items=${i.allowedNetHosts??[]} placeholder="hostname or IP"
-            @change=${r=>this._onPermissionPathsChange("allowedNetHosts",r.detail)}
-          ></ic-array-editor>
+        <div class="timestamp">
+          <ic-relative-time .timestamp=${e.requestedAt}></ic-relative-time>
         </div>
-      </div>
-
-      <div class="policy-section">
-        <div class="section-header">Approval Mode</div>
-        <div class="rules-form">
-          <ic-select label="Default Mode" .value=${this._approvalRules.defaultMode} .options=${a}
-            @change=${r=>{this._approvalRules={...this._approvalRules,defaultMode:r.detail}}}
-          ></ic-select>
-          <div class="form-field">
-            <label class="form-label">Timeout (seconds)</label>
-            <input class="number-input" type="number" min="0"
-              .value=${String(Math.round(this._approvalRules.timeoutMs/1e3))}
-              @change=${r=>{const o=parseInt(r.target.value,10);!isNaN(o)&&o>=0&&(this._approvalRules={...this._approvalRules,timeoutMs:o*1e3})}}
-            />
-            <span class="form-hint">0 = no timeout (request waits indefinitely)</span>
-          </div>
-          <button class="save-btn" @click=${()=>this._saveApprovalRules()}>Save Rules</button>
+        ${e.user?t`<div class="user-row"><span class="user-label">Requested by:</span> ${e.user}</div>`:l}
+        <button
+          class="context-toggle"
+          @click=${()=>{this._expanded=!this._expanded}}
+        >${this._expanded?`Hide details`:`Show details`}</button>
+        ${this._expanded?t`<div class="context-details">${e.context}</div>`:l}
+        <input
+          class="reason-input"
+          type="text"
+          placeholder="Reason (optional)"
+          aria-label="Decision reason"
+          .value=${this._reason}
+          @input=${e=>{this._reason=e.target.value}}
+        />
+        <div class="action-buttons">
+          <button class="approve-btn" @click=${()=>this._onApprove()}>Approve</button>
+          <button class="deny-btn" @click=${()=>this._onDeny()}>Deny</button>
         </div>
       </div>
-    `}_renderPendingContent(){const e=[...this._pendingApprovals].sort((t,i)=>i.requestedAt-t.requestedAt);return s`
-      <div class="queue-header">
-        <span>Pending</span>
-        <span class="queue-count">${this._pendingApprovals.length}</span>
-      </div>
-      <div class="bulk-actions">
-        <button class="action-btn action-btn--success" ?disabled=${this._pendingApprovals.length===0}
-          @click=${()=>this._handleResolveAll(!0)}>Approve All (${this._pendingApprovals.length})</button>
-        <button class="action-btn action-btn--danger" ?disabled=${this._pendingApprovals.length===0}
-          @click=${()=>this._handleResolveAll(!1)}>Deny All (${this._pendingApprovals.length})</button>
-        <button class="action-btn" @click=${()=>this._handleClearDenialCache()}>Clear Denial Cache</button>
-      </div>
-      ${e.length===0?s`<ic-empty-state icon="security" message="No pending approvals" description="Approval requests will appear here as they arrive."></ic-empty-state>`:s`
-            <div class="queue-list">
-              ${e.map(t=>s`
-                <ic-approval-card .approval=${t}
-                  @approve=${i=>this._handleApprove(i)}
-                  @deny=${i=>this._handleDeny(i)}
-                ></ic-approval-card>
-              `)}
-            </div>
-          `}
-
-      <div class="history-divider">Recent History</div>
-      ${this._resolvedApprovals.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No resolved approvals in the last 7 days.</p>`:s`
-            <div class="history-grid" role="table" aria-label="Resolved approvals">
-              <div class="header-cell" role="columnheader">Agent</div>
-              <div class="header-cell" role="columnheader">Action</div>
-              <div class="header-cell" role="columnheader">Risk</div>
-              <div class="header-cell" role="columnheader">Outcome</div>
-              <div class="header-cell" role="columnheader">Reason</div>
-              <div class="header-cell" role="columnheader">Resolved At</div>
-              <div class="header-cell" role="columnheader">Resolved By</div>
-              ${this._resolvedApprovals.map(t=>this._renderHistoryRow(t))}
-            </div>
-          `}
-    `}render(){return this.activeSubTab==="rules"?this._renderRulesContent():this._renderPendingContent()}};m.styles=[_,S,w`
+    `}};c([s({type:Object})],g.prototype,`approval`,void 0),c([a()],g.prototype,`_reason`,void 0),c([a()],g.prototype,`_expanded`,void 0),g=c([e(`ic-approval-card`)],g);function _(e){return{id:e.requestId,agentId:e.agentId,action:e.action||e.toolName,classification:e.trustLevel===`admin`?`low`:e.trustLevel===`user`?`medium`:`high`,context:JSON.stringify(e.params,null,2),requestedAt:e.createdAt}}var v=`ic:approval-history`,y=10080*60*1e3;function b(){try{let e=localStorage.getItem(v);if(!e)return[];let t=JSON.parse(e),n=Date.now()-y;return t.filter(e=>e.resolvedAt>n)}catch{return[]}}function x(e){try{let t=Date.now()-y,n=e.filter(e=>e.resolvedAt>t);localStorage.setItem(v,JSON.stringify(n))}catch{}}var S=class extends r{constructor(...e){super(...e),this.securityConfig={},this.activeSubTab=`pending`,this._pendingApprovals=[],this._resolvedApprovals=[],this._approvalRules={defaultMode:`manual`,timeoutMs:0}}static{this.styles=[o,i,n`
       :host {
         display: block;
       }
@@ -772,24 +660,119 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         opacity: 0.5;
         cursor: not-allowed;
       }
-    `];k([d({attribute:!1})],m.prototype,"rpc",2);k([d({attribute:!1})],m.prototype,"securityConfig",2);k([d({type:String})],m.prototype,"activeSubTab",2);k([l()],m.prototype,"_pendingApprovals",2);k([l()],m.prototype,"_resolvedApprovals",2);k([l()],m.prototype,"_approvalRules",2);m=k([$("ic-approval-queue")],m);var W=Object.defineProperty,Z=Object.getOwnPropertyDescriptor,N=(e,t,i,a)=>{for(var r=a>1?void 0:a?Z(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&W(t,i,r),r};const ee={low:"success",medium:"warning",high:"error",critical:"error"};let z=class extends x{constructor(){super(...arguments),this.event=null}render(){if(!this.event)return s`
-        <div class="cell cell--muted" role="cell">---</div>
-        <div class="cell cell--muted" role="cell">---</div>
-        <div class="cell cell--muted" role="cell">---</div>
-        <div class="cell cell--muted" role="cell">---</div>
-        <div class="cell cell--muted" role="cell">---</div>
-      `;const e=this.event,t=ee[e.classification]??"default";return s`
-      <div class="cell cell--muted" role="cell">
-        <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
-      </div>
-      <div class="cell" role="cell">${e.agentId||"---"}</div>
-      <div class="cell" role="cell">${e.action||"---"}</div>
-      <div class="cell" role="cell">
-        <ic-tag variant=${t}>${e.classification||"unknown"}</ic-tag>
+    `]}connectedCallback(){super.connectedCallback(),this._resolvedApprovals=b()}updated(e){e.has(`rpc`)&&this.rpc&&this._loadApprovals(),e.has(`securityConfig`)&&(this._approvalRules=this.securityConfig.approvalRules??{defaultMode:`manual`,timeoutMs:0})}async _loadApprovals(){if(this.rpc)try{let e=await this.rpc.call(`admin.approval.pending`);this._pendingApprovals=(e.requests??[]).map(_)}catch{}}onApprovalPending(e){let t=e;t?.requestId&&(this._pendingApprovals=[_(t),...this._pendingApprovals])}onApprovalResolved(e){let t=e,n=t?.requestId;if(!n)return;this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==n);let r={..._(t),outcome:t.approved?`approved`:`denied`,reason:t.reason??``,resolvedAt:t.resolvedAt??Date.now(),resolvedBy:t.approvedBy??`system`};this._resolvedApprovals=[r,...this._resolvedApprovals],x(this._resolvedApprovals)}async _handleApprove(e){if(!this.rpc)return;let{id:t,reason:n}=e.detail;try{await this.rpc.call(`admin.approval.resolve`,{requestId:t,approved:!0,approvedBy:`operator`,reason:n});let e=this._pendingApprovals.find(e=>e.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==t),e){let t={...e,outcome:`approved`,reason:n,resolvedAt:Date.now(),resolvedBy:`operator`};this._resolvedApprovals=[t,...this._resolvedApprovals],x(this._resolvedApprovals)}u.show(`Approval granted`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){u.show(e instanceof Error?e.message:`Failed to approve request`,`error`)}}async _handleDeny(e){if(!this.rpc)return;let{id:t,reason:n}=e.detail;try{await this.rpc.call(`admin.approval.resolve`,{requestId:t,approved:!1,approvedBy:`operator`,reason:n});let e=this._pendingApprovals.find(e=>e.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==t),e){let t={...e,outcome:`denied`,reason:n,resolvedAt:Date.now(),resolvedBy:`operator`};this._resolvedApprovals=[t,...this._resolvedApprovals],x(this._resolvedApprovals)}u.show(`Approval denied`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){u.show(e instanceof Error?e.message:`Failed to deny request`,`error`)}}async _handleResolveAll(e){if(!(!this.rpc||this._pendingApprovals.length===0))try{let t=await this.rpc.call(`admin.approval.resolveAll`,{approved:e,approvedBy:`operator`,reason:e?`Bulk approved by operator`:`Bulk denied by operator`});for(let t of this._pendingApprovals){let n={...t,outcome:e?`approved`:`denied`,reason:e?`Bulk approved by operator`:`Bulk denied by operator`,resolvedAt:Date.now(),resolvedBy:`operator`};this._resolvedApprovals=[n,...this._resolvedApprovals]}this._pendingApprovals=[],x(this._resolvedApprovals),u.show(`${t.resolved} approval(s) ${e?`approved`:`denied`}`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){u.show(e instanceof Error?e.message:`Bulk operation failed`,`error`)}}async _handleClearDenialCache(){if(this.rpc)try{await this.rpc.call(`admin.approval.clearDenialCache`,{}),u.show(`Denial cache cleared`,`success`)}catch(e){u.show(e instanceof Error?e.message:`Failed to clear denial cache`,`error`)}}async _patchConfig(e,t){if(!this.rpc)return!1;try{let n=e.indexOf(`.`),r=n>0?e.slice(0,n):e,i=n>0?e.slice(n+1):void 0;return await this.rpc.call(`config.patch`,{section:r,key:i,value:t}),u.show(`Configuration updated`,`success`),!0}catch(e){return u.show(e instanceof Error?e.message:`Failed to update configuration`,`error`),!1}}async _onActionConfirmationChange(e,t){let n={...this.securityConfig.actionConfirmation,[e]:t};await this._patchConfig(`security.actionConfirmation`,n)}async _onAgentToAgentEnabledChange(e){let t={...this.securityConfig.agentToAgent,enabled:e};await this._patchConfig(`security.agentToAgent`,t)}async _onAgentToAgentAllowChange(e){let t={...this.securityConfig.agentToAgent,allowAgents:e};await this._patchConfig(`security.agentToAgent`,t)}async _onPermissionToggleChange(e){let t={...this.securityConfig.permission,enableNodePermissions:e};await this._patchConfig(`security.permission`,t)}async _onPermissionPathsChange(e,t){let n={...this.securityConfig.permission,[e]:t};await this._patchConfig(`security.permission`,n)}async _saveApprovalRules(){if(this.rpc)try{await this.rpc.call(`config.patch`,{section:`security`,key:`approvalRules`,value:this._approvalRules}),u.show(`Approval rules updated`,`success`)}catch(e){u.show(e instanceof Error?e.message:`Failed to update approval rules`,`error`)}}_renderHistoryRow(e){let n=e.outcome===`approved`?`success`:`error`,r={low:`success`,medium:`warning`,high:`error`,critical:`error`}[e.classification]??`default`;return t`
+      <div class="data-cell" role="cell">${e.agentId}</div>
+      <div class="data-cell" role="cell">${e.action}</div>
+      <div class="data-cell" role="cell"><ic-tag variant=${r}>${e.classification}</ic-tag></div>
+      <div class="data-cell" role="cell"><ic-tag variant=${n}>${e.outcome}</ic-tag></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.reason||`---`}</div>
+      <div class="data-cell data-cell--muted" role="cell"><ic-relative-time .timestamp=${e.resolvedAt}></ic-relative-time></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.resolvedBy}</div>
+    `}_renderRulesContent(){let e=this.securityConfig.actionConfirmation??{},n=this.securityConfig.agentToAgent??{},r=this.securityConfig.permission??{};return t`
+      <div class="policy-section">
+        <div class="section-header">Action Confirmation</div>
+        <ic-toggle label="Require for destructive actions"
+          .checked=${e.requireForDestructive??!0}
+          @change=${e=>this._onActionConfirmationChange(`requireForDestructive`,e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-sm);">
+          <ic-toggle label="Require for sensitive actions"
+            .checked=${e.requireForSensitive??!1}
+            @change=${e=>this._onActionConfirmationChange(`requireForSensitive`,e.detail)}
+          ></ic-toggle>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Auto-approve list" .items=${e.autoApprove??[]} placeholder="Action name to auto-approve"
+            @change=${e=>this._onActionConfirmationChange(`autoApprove`,e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Agent-to-Agent Policy</div>
+        <ic-toggle label="Enable cross-agent messaging"
+          .checked=${n.enabled??!0}
+          @change=${e=>this._onAgentToAgentEnabledChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed agents" .items=${n.allowAgents??[]} placeholder="Agent ID"
+            @change=${e=>this._onAgentToAgentAllowChange(e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Permissions</div>
+        <ic-toggle label="Enable Node.js permission model"
+          .checked=${r.enableNodePermissions??!1}
+          @change=${e=>this._onPermissionToggleChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed filesystem paths" .items=${r.allowedFsPaths??[]} placeholder="/path/to/allow"
+            @change=${e=>this._onPermissionPathsChange(`allowedFsPaths`,e.detail)}
+          ></ic-array-editor>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed network hosts" .items=${r.allowedNetHosts??[]} placeholder="hostname or IP"
+            @change=${e=>this._onPermissionPathsChange(`allowedNetHosts`,e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Approval Mode</div>
+        <div class="rules-form">
+          <ic-select label="Default Mode" .value=${this._approvalRules.defaultMode} .options=${[{value:`manual`,label:`Manual (all require approval)`},{value:`auto-low`,label:`Auto-approve low risk`},{value:`auto-medium`,label:`Auto-approve low + medium risk`},{value:`auto-all`,label:`Auto-approve all (no approvals)`}]}
+            @change=${e=>{this._approvalRules={...this._approvalRules,defaultMode:e.detail}}}
+          ></ic-select>
+          <div class="form-field">
+            <label class="form-label">Timeout (seconds)</label>
+            <input class="number-input" type="number" min="0"
+              .value=${String(Math.round(this._approvalRules.timeoutMs/1e3))}
+              @change=${e=>{let t=parseInt(e.target.value,10);!isNaN(t)&&t>=0&&(this._approvalRules={...this._approvalRules,timeoutMs:t*1e3})}}
+            />
+            <span class="form-hint">0 = no timeout (request waits indefinitely)</span>
+          </div>
+          <button class="save-btn" @click=${()=>this._saveApprovalRules()}>Save Rules</button>
+        </div>
       </div>
-      <div class="cell cell--muted" role="cell">${e.user||"---"}</div>
-      ${e.details?s`<div class="cell cell--details" role="cell" style="grid-column: 1 / -1;">${e.details}</div>`:p}
-    `}};z.styles=[_,w`
+    `}_renderPendingContent(){let e=[...this._pendingApprovals].sort((e,t)=>t.requestedAt-e.requestedAt);return t`
+      <div class="queue-header">
+        <span>Pending</span>
+        <span class="queue-count">${this._pendingApprovals.length}</span>
+      </div>
+      <div class="bulk-actions">
+        <button class="action-btn action-btn--success" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!0)}>Approve All (${this._pendingApprovals.length})</button>
+        <button class="action-btn action-btn--danger" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!1)}>Deny All (${this._pendingApprovals.length})</button>
+        <button class="action-btn" @click=${()=>this._handleClearDenialCache()}>Clear Denial Cache</button>
+      </div>
+      ${e.length===0?t`<ic-empty-state icon="security" message="No pending approvals" description="Approval requests will appear here as they arrive."></ic-empty-state>`:t`
+            <div class="queue-list">
+              ${e.map(e=>t`
+                <ic-approval-card .approval=${e}
+                  @approve=${e=>this._handleApprove(e)}
+                  @deny=${e=>this._handleDeny(e)}
+                ></ic-approval-card>
+              `)}
+            </div>
+          `}
+
+      <div class="history-divider">Recent History</div>
+      ${this._resolvedApprovals.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No resolved approvals in the last 7 days.</p>`:t`
+            <div class="history-grid" role="table" aria-label="Resolved approvals">
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">Outcome</div>
+              <div class="header-cell" role="columnheader">Reason</div>
+              <div class="header-cell" role="columnheader">Resolved At</div>
+              <div class="header-cell" role="columnheader">Resolved By</div>
+              ${this._resolvedApprovals.map(e=>this._renderHistoryRow(e))}
+            </div>
+          `}
+    `}render(){return this.activeSubTab===`rules`?this._renderRulesContent():this._renderPendingContent()}};c([s({attribute:!1})],S.prototype,`rpc`,void 0),c([s({attribute:!1})],S.prototype,`securityConfig`,void 0),c([s({type:String})],S.prototype,`activeSubTab`,void 0),c([a()],S.prototype,`_pendingApprovals`,void 0),c([a()],S.prototype,`_resolvedApprovals`,void 0),c([a()],S.prototype,`_approvalRules`,void 0),S=c([e(`ic-approval-queue`)],S);var C={low:`success`,medium:`warning`,high:`error`,critical:`error`},w=class extends r{constructor(...e){super(...e),this.event=null}static{this.styles=[o,n`
       :host {
         display: contents;
       }
@@ -812,47 +795,24 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         color: var(--ic-text-dim);
         font-size: var(--ic-text-xs);
       }
-    `];N([d({type:Object})],z.prototype,"event",2);z=N([$("ic-audit-row")],z);var te=Object.defineProperty,ie=Object.getOwnPropertyDescriptor,E=(e,t,i,a)=>{for(var r=a>1?void 0:a?ie(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&te(t,i,r),r};let f=class extends x{constructor(){super(...arguments),this.activeSubTab="events",this.securityEvents=[],this.inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:"session"},this._auditEntries=[],this._paused=!1,this._pauseBuffer=[],this._expandedEvents=new Set}onAuditEvent(e){const t=e;if(t){if(this._paused){this._pauseBuffer=[...this._pauseBuffer.slice(-199),t];return}this._auditEntries=[...this._auditEntries.slice(-199),t]}}get auditEntries(){return this._auditEntries}get paused(){return this._paused}get pauseBuffer(){return this._pauseBuffer}_severityVariant(e){switch(e){case"critical":case"high":return"error";case"medium":return"warning";default:return"info"}}_toggleEventDetails(e){this._expandedEvents.has(e)?this._expandedEvents.delete(e):this._expandedEvents.add(e),this.requestUpdate()}_togglePause(){if(this._paused){const e=[...this._auditEntries,...this._pauseBuffer].slice(-200);this._auditEntries=e,this._pauseBuffer=[]}this._paused=!this._paused}_renderEventsContent(){return s`
-      <div class="guard-summary">
-        <span style="font-size: var(--ic-text-sm); font-weight: 500; color: var(--ic-text-muted);">Input Guard</span>
-        <ic-tag variant="error">${this.inputGuardSummary.blockedAttempts} blocked</ic-tag>
-        ${this.inputGuardSummary.patternsTriggered.length>0?s`<ic-tag variant="warning">${this.inputGuardSummary.patternsTriggered.join(", ")}</ic-tag>`:p}
+    `]}render(){if(!this.event)return t`
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+      `;let e=this.event,n=C[e.classification]??`default`;return t`
+      <div class="cell cell--muted" role="cell">
+        <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
       </div>
-      ${this.securityEvents.length===0?s`<ic-empty-state icon="security" message="No security events" description="Security events will appear here in real-time as they are detected."></ic-empty-state>`:s`
-            <div role="list" aria-label="Security events">
-              ${this.securityEvents.map(e=>s`
-                  <div class="event-row" role="listitem">
-                    <ic-tag variant=${this._severityVariant(e.severity)}>${e.severity}</ic-tag>
-                    <ic-tag variant="default">${e.type}</ic-tag>
-                    <span class="event-message">${e.message}</span>
-                    ${e.agentId?s`<ic-tag variant="info">${e.agentId}</ic-tag>`:p}
-                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
-                    <button class="event-details-toggle"
-                      @click=${()=>this._toggleEventDetails(e.id)}
-                    >${this._expandedEvents.has(e.id)?"hide":"details"}</button>
-                  </div>
-                  ${this._expandedEvents.has(e.id)?s`<pre class="event-details">${JSON.stringify(e.details,null,2)}</pre>`:p}
-                `)}
-            </div>
-          `}
-    `}_renderAuditContent(){return s`
-      <div class="audit-controls">
-        <button class="pause-btn" ?data-active=${this._paused}
-          @click=${()=>this._togglePause()}
-        >${this._paused?"Resume":"Pause"}</button>
-        ${this._paused?s`<span style="font-size: var(--ic-text-xs); color: var(--ic-text-dim);">${this._pauseBuffer.length} buffered</span>`:p}
+      <div class="cell" role="cell">${e.agentId||`---`}</div>
+      <div class="cell" role="cell">${e.action||`---`}</div>
+      <div class="cell" role="cell">
+        <ic-tag variant=${n}>${e.classification||`unknown`}</ic-tag>
       </div>
-      ${this._auditEntries.length===0?s`<ic-empty-state icon="security" message="No audit events" description="Events will appear here as they occur."></ic-empty-state>`:s`
-            <div class="audit-grid" role="table" aria-label="Audit log">
-              <div class="header-cell" role="columnheader">Time</div>
-              <div class="header-cell" role="columnheader">Agent</div>
-              <div class="header-cell" role="columnheader">Action</div>
-              <div class="header-cell" role="columnheader">Risk</div>
-              <div class="header-cell" role="columnheader">User</div>
-              ${this._auditEntries.map(e=>s`<ic-audit-row .event=${e} role="row"></ic-audit-row>`)}
-            </div>
-          `}
-    `}render(){return this.activeSubTab==="audit"?this._renderAuditContent():this._renderEventsContent()}};f.styles=[_,S,w`
+      <div class="cell cell--muted" role="cell">${e.user||`---`}</div>
+      ${e.details?t`<div class="cell cell--details" role="cell" style="grid-column: 1 / -1;">${e.details}</div>`:l}
+    `}};c([s({type:Object})],w.prototype,`event`,void 0),w=c([e(`ic-audit-row`)],w);var T=200,E=class extends r{constructor(...e){super(...e),this.activeSubTab=`events`,this.securityEvents=[],this.inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:`session`},this._auditEntries=[],this._paused=!1,this._pauseBuffer=[],this._expandedEvents=new Set}static{this.styles=[o,i,n`
       :host {
         display: block;
       }
@@ -951,120 +911,47 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         top: 0;
         z-index: 1;
       }
-    `];E([d({type:String})],f.prototype,"activeSubTab",2);E([d({attribute:!1})],f.prototype,"securityEvents",2);E([d({attribute:!1})],f.prototype,"inputGuardSummary",2);E([l()],f.prototype,"_auditEntries",2);E([l()],f.prototype,"_paused",2);f=E([$("ic-security-event-feed")],f);var re=Object.defineProperty,ae=Object.getOwnPropertyDescriptor,u=(e,t,i,a)=>{for(var r=a>1?void 0:a?ae(t,i):t,o=e.length-1,c;o>=0;o--)(c=e[o])&&(r=(a?c(t,i,r):c(r))||r);return a&&r&&re(t,i,r),r};const b=200,O=100,se=[{id:"events",label:"Security Events"},{id:"audit",label:"Audit Log"},{id:"tokens",label:"API Tokens"},{id:"secrets",label:"Secrets"},{id:"rules",label:"Approval Rules"},{id:"pending",label:"Pending Approvals"},{id:"health",label:"Provider Health"}];let v=class extends x{constructor(){super(...arguments),this.rpcClient=null,this.apiClient=null,this.eventDispatcher=null,this._sse=null,this._loadState="loading",this._error="",this._activeTab="events",this._securityEvents=[],this._inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:"session"},this._securityConfig={},this._providerHealth=[],this._failoverLog=[],this._authCooldowns=[],this._healthReloadDebounce=null}_scheduleHealthReload(e=300){this._healthReloadDebounce!==null&&clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=setTimeout(()=>{this._healthReloadDebounce=null,this._loadProviderHealth()},e)}connectedCallback(){super.connectedCallback(),this._initSse()}disconnectedCallback(){super.disconnectedCallback(),this._healthReloadDebounce!==null&&(clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=null)}updated(e){e.has("rpcClient")&&this.rpcClient&&this._loadData(),e.has("eventDispatcher")&&this.eventDispatcher&&!this._sse&&this._initSse()}get _eventFeed(){return this.shadowRoot?.querySelector("ic-security-event-feed")??null}get _approvalQueue(){return this.shadowRoot?.querySelector("ic-approval-queue")??null}_initSse(){!this.eventDispatcher||this._sse||(this._sse=new B(this,this.eventDispatcher,{"audit:event":e=>{this._eventFeed?.onAuditEvent(e);const t=e;if(t.actionType==="output_guard"){const i=t.metadata??{},a=i.action,r=a==="redacted"?"high":"medium",o=i.findingCount??0,c={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"output_guard",severity:r,message:`Output guard ${a??"scan"}: ${o} finding(s)`,details:{findingTypes:i.findingTypes,severities:i.severities,action:i.action,context:i.context},timestamp:t.timestamp??Date.now(),agentId:t.agentId};this._securityEvents=[c,...this._securityEvents].slice(0,b)}},"approval:requested":e=>{this._approvalQueue?.onApprovalPending(e)},"approval:resolved":e=>{this._approvalQueue?.onApprovalResolved(e)},"security:injection_detected":e=>{const t=e,i=t.riskLevel??"medium",r={high:"high",medium:"medium",low:"low"}[i]??"medium",o=t.source??"unknown",c=t.patterns??[],D={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"injection",severity:r,message:`Injection detected from ${o}`,details:{patterns:c,source:o,sessionKey:t.sessionKey},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[D,...this._securityEvents].slice(0,b);const A=[...new Set([...this._inputGuardSummary.patternsTriggered,...c])];this._inputGuardSummary={...this._inputGuardSummary,blockedAttempts:this._inputGuardSummary.blockedAttempts+1,patternsTriggered:A}},"security:injection_rate_exceeded":e=>{const t=e,i=t.count??0,a=t.threshold??0,r=t.action??"block",o={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"input_guard",severity:"critical",message:`Rate limit exceeded: ${i}/${a} (action: ${r})`,details:{sessionKey:t.sessionKey,count:i,threshold:a,action:r},timestamp:Date.now()};this._securityEvents=[o,...this._securityEvents].slice(0,b)},"security:memory_tainted":e=>{const t=e,i=t.blocked??!1,a=t.originalTrustLevel??"unknown",r=t.adjustedTrustLevel??"unknown",o={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"memory_tainted",severity:i?"high":"medium",message:`Memory tainted for ${t.agentId??"unknown"}: ${a} -> ${r}`,details:{patterns:t.patterns,blocked:i,originalTrustLevel:a,adjustedTrustLevel:r},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[o,...this._securityEvents].slice(0,b)},"security:warn":e=>{const t=e,i={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"warn",severity:"medium",message:t.message??"Security warning",details:{category:t.category},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[i,...this._securityEvents].slice(0,b)},"secret:accessed":e=>{const t=e,i=t.outcome??"unknown",r={denied:"high",not_found:"medium",success:"low"}[i]??"medium",o=t.secretName??"unknown",c={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"secret_access",severity:r,message:`Secret '${o}' ${i} by ${t.agentId??"unknown"}`,details:{secretName:o,outcome:i},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[c,...this._securityEvents].slice(0,b)},"secret:modified":e=>{const t=e,i=t.secretName??"unknown",a=t.action??"modified",r={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:"secret_access",severity:"medium",message:`Secret '${i}' ${a}`,details:{secretName:i,action:a},timestamp:Date.now()};this._securityEvents=[r,...this._securityEvents].slice(0,b)},"provider:degraded":e=>{const i=e.provider??"";this._providerHealth=this._providerHealth.map(a=>a.providerId===i?{...a,status:"degraded"}:a),this._scheduleHealthReload()},"provider:recovered":e=>{const i=e.provider??"";this._providerHealth=this._providerHealth.map(a=>a.providerId===i?{...a,status:"healthy"}:a),this._scheduleHealthReload()},"model:auth_cooldown":e=>{const t=e,i={keyName:t.keyName,provider:t.provider,cooldownMs:t.cooldownMs,failureCount:t.failureCount,timestamp:t.timestamp};this._authCooldowns=[i,...this._authCooldowns].slice(0,50),this._scheduleHealthReload(500)},"model:fallback_attempt":e=>{const t=e,i={fromProvider:t.fromProvider,fromModel:t.fromModel,toProvider:t.toProvider,toModel:t.toModel,error:t.error,attemptNumber:t.attemptNumber,timestamp:t.timestamp};this._failoverLog=[i,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"model:fallback_exhausted":e=>{const t=e,i={provider:t.provider,model:t.model,totalAttempts:t.totalAttempts,timestamp:t.timestamp,exhausted:!0};this._failoverLog=[i,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"observability:token_usage":()=>{this._scheduleHealthReload(500)}}))}async _loadProviderHealth(){if(this.rpcClient)try{const e=await this.rpcClient.call("agent.cacheStats"),t=Date.now(),i=t-300*1e3,a=(e.providers??[]).map(r=>{const o=this._failoverLog.filter(h=>h.fromProvider===r.provider||h.provider===r.provider),c=o.length>0?Math.max(...o.map(h=>h.timestamp)):void 0;let D="healthy";const A=this._authCooldowns.find(h=>h.provider===r.provider&&h.timestamp+h.cooldownMs>t);return A&&(D="degraded"),this._failoverLog.find(h=>h.exhausted===!0&&h.provider===r.provider&&h.timestamp>i)&&(D="down"),{providerId:r.provider,name:r.provider,status:D,cacheHitRate:r.cacheHitRate,failoverCount:o.length,lastFailover:c,authCooldownUntil:A?A.timestamp+A.cooldownMs:void 0}});this._providerHealth=a}catch{}}async _loadData(){if(this.rpcClient){this._loadState="loading",this._error="";try{const e=await this.rpcClient.call("config.read");this._securityConfig=e.config.security??{},this._loadState="loaded",this._loadProviderHealth()}catch(e){this._error=e instanceof Error?e.message:"Failed to load security configuration",this._loadState="error"}}}async _patchConfig(e,t){if(!this.rpcClient)return!1;try{const i=e.indexOf("."),a=i>0?e.slice(0,i):e,r=i>0?e.slice(i+1):void 0;return await this.rpcClient.call("config.patch",{section:a,key:r,value:t}),n.show("Configuration updated","success"),!0}catch(i){const a=i instanceof Error?i.message:"Failed to update configuration";return n.show(a,"error"),!1}}async _onSecretsEnabledChange(e){const t={...this._securityConfig.secrets,enabled:e};await this._patchConfig("security.secrets",t)&&(this._securityConfig={...this._securityConfig,secrets:t})}_renderSecretsTab(){const e=this._securityConfig.secrets??{};return s`
-      <div class="policy-section">
-        <div class="section-header">Encrypted Secrets Store</div>
-        <ic-toggle
-          label="Enabled"
-          .checked=${e.enabled??!1}
-          @change=${t=>this._onSecretsEnabledChange(t.detail)}
-        ></ic-toggle>
-        <div style="margin-top: var(--ic-space-md);">
-          <div class="tls-row">
-            <span class="tls-label">DB Path</span>
-            <span class="tls-value">${e.dbPath??"secrets.db"}</span>
-          </div>
-        </div>
+    `]}onAuditEvent(e){let t=e;if(t){if(this._paused){this._pauseBuffer=[...this._pauseBuffer.slice(-(T-1)),t];return}this._auditEntries=[...this._auditEntries.slice(-(T-1)),t]}}get auditEntries(){return this._auditEntries}get paused(){return this._paused}get pauseBuffer(){return this._pauseBuffer}_severityVariant(e){switch(e){case`critical`:case`high`:return`error`;case`medium`:return`warning`;default:return`info`}}_toggleEventDetails(e){this._expandedEvents.has(e)?this._expandedEvents.delete(e):this._expandedEvents.add(e),this.requestUpdate()}_togglePause(){if(this._paused){let e=[...this._auditEntries,...this._pauseBuffer].slice(-T);this._auditEntries=e,this._pauseBuffer=[]}this._paused=!this._paused}_renderEventsContent(){return t`
+      <div class="guard-summary">
+        <span style="font-size: var(--ic-text-sm); font-weight: 500; color: var(--ic-text-muted);">Input Guard</span>
+        <ic-tag variant="error">${this.inputGuardSummary.blockedAttempts} blocked</ic-tag>
+        ${this.inputGuardSummary.patternsTriggered.length>0?t`<ic-tag variant="warning">${this.inputGuardSummary.patternsTriggered.join(`, `)}</ic-tag>`:l}
       </div>
-    `}_statusToDotStatus(e){switch(e){case"healthy":return"connected";case"degraded":return"reconnecting";case"down":return"disconnected";default:return"disconnected"}}_renderHealthTab(){const e=Date.now(),t=this._authCooldowns.filter(i=>i.timestamp+i.cooldownMs>e);return s`
-      <div class="section-header">Provider Status</div>
-      ${this._providerHealth.length===0?s`<ic-empty-state icon="cloud" message="No provider data" description="Provider health data will appear after LLM calls are made."></ic-empty-state>`:s`
-            <div class="health-grid">
-              ${this._providerHealth.map(i=>s`
-                  <div class="health-card">
-                    <div class="health-card-header">
-                      <strong>${i.name}</strong>
-                      <ic-connection-dot
-                        status=${this._statusToDotStatus(i.status)}
-                        size="8px"
-                      ></ic-connection-dot>
-                    </div>
-                    <ic-progress-bar
-                      .value=${Math.round(i.cacheHitRate*100)}
-                      label="Cache Hit Rate"
-                      .thresholds=${{green:101,yellow:102}}
-                    ></ic-progress-bar>
-                    <div class="health-card-stat">
-                      Failovers: ${i.failoverCount}
-                      ${i.lastFailover?s` &mdash; last <ic-relative-time .timestamp=${i.lastFailover}></ic-relative-time>`:p}
-                    </div>
-                    ${i.authCooldownUntil&&i.authCooldownUntil>e?s`
-                          <div class="health-card-stat">
-                            <ic-tag variant="warning">Auth cooldown</ic-tag>
-                            ${Math.ceil((i.authCooldownUntil-e)/1e3)}s remaining
-                          </div>
-                        `:p}
-                  </div>
-                `)}
-            </div>
-          `}
-
-      <div class="section-header" style="margin-top: var(--ic-space-xl);">Failover Event Log</div>
-      ${this._failoverLog.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No failover events recorded</p>`:s`
-            <div class="failover-log">
-              ${this._failoverLog.map(i=>s`
-                  <div class="failover-entry">
-                    <ic-relative-time .timestamp=${i.timestamp}></ic-relative-time>
-                    ${i.exhausted?s`
-                          <span>${i.provider??"unknown"} exhausted after ${i.totalAttempts??"?"} attempts</span>
-                          <ic-tag variant="error">EXHAUSTED</ic-tag>
-                        `:s`
-                          <span>${i.fromProvider??"?"}/${i.fromModel??"?"} &rarr; ${i.toProvider??"?"}/${i.toModel??"?"}</span>
-                          ${i.attemptNumber!=null?s`<ic-tag variant="info">#${i.attemptNumber}</ic-tag>`:p}
-                          ${i.error?s`<span style="color: var(--ic-text-dim);">${i.error}</span>`:p}
-                        `}
+      ${this.securityEvents.length===0?t`<ic-empty-state icon="security" message="No security events" description="Security events will appear here in real-time as they are detected."></ic-empty-state>`:t`
+            <div role="list" aria-label="Security events">
+              ${this.securityEvents.map(e=>t`
+                  <div class="event-row" role="listitem">
+                    <ic-tag variant=${this._severityVariant(e.severity)}>${e.severity}</ic-tag>
+                    <ic-tag variant="default">${e.type}</ic-tag>
+                    <span class="event-message">${e.message}</span>
+                    ${e.agentId?t`<ic-tag variant="info">${e.agentId}</ic-tag>`:l}
+                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+                    <button class="event-details-toggle"
+                      @click=${()=>this._toggleEventDetails(e.id)}
+                    >${this._expandedEvents.has(e.id)?`hide`:`details`}</button>
                   </div>
+                  ${this._expandedEvents.has(e.id)?t`<pre class="event-details">${JSON.stringify(e.details,null,2)}</pre>`:l}
                 `)}
             </div>
           `}
-
-      <div class="section-header" style="margin-top: var(--ic-space-xl);">Auth Cooldowns</div>
-      ${t.length===0?s`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No active cooldowns</p>`:s`
-            <div class="cooldown-list">
-              ${t.map(i=>s`
-                  <div class="cooldown-entry">
-                    <ic-tag variant="warning">${i.provider}</ic-tag>
-                    <span>${i.keyName}</span>
-                    <span style="color: var(--ic-text-dim);">${i.failureCount} failures</span>
-                    <span>${Math.ceil((i.timestamp+i.cooldownMs-e)/1e3)}s remaining</span>
-                  </div>
-                `)}
+    `}_renderAuditContent(){return t`
+      <div class="audit-controls">
+        <button class="pause-btn" ?data-active=${this._paused}
+          @click=${()=>this._togglePause()}
+        >${this._paused?`Resume`:`Pause`}</button>
+        ${this._paused?t`<span style="font-size: var(--ic-text-xs); color: var(--ic-text-dim);">${this._pauseBuffer.length} buffered</span>`:l}
+      </div>
+      ${this._auditEntries.length===0?t`<ic-empty-state icon="security" message="No audit events" description="Events will appear here as they occur."></ic-empty-state>`:t`
+            <div class="audit-grid" role="table" aria-label="Audit log">
+              <div class="header-cell" role="columnheader">Time</div>
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">User</div>
+              ${this._auditEntries.map(e=>t`<ic-audit-row .event=${e} role="row"></ic-audit-row>`)}
             </div>
           `}
-    `}_renderTabContent(){switch(this._activeTab){case"events":return s`<ic-security-event-feed
-          activeSubTab="events"
-          .securityEvents=${this._securityEvents}
-          .inputGuardSummary=${this._inputGuardSummary}
-        ></ic-security-event-feed>`;case"audit":return s`<ic-security-event-feed
-          activeSubTab="audit"
-          .securityEvents=${this._securityEvents}
-          .inputGuardSummary=${this._inputGuardSummary}
-        ></ic-security-event-feed>`;case"tokens":return s`<ic-token-manager .rpc=${this.rpcClient}></ic-token-manager>`;case"secrets":return this._renderSecretsTab();case"rules":return s`<ic-approval-queue
-          activeSubTab="rules"
-          .rpc=${this.rpcClient}
-          .securityConfig=${this._securityConfig}
-        ></ic-approval-queue>`;case"pending":return s`<ic-approval-queue
-          activeSubTab="pending"
-          .rpc=${this.rpcClient}
-          .securityConfig=${this._securityConfig}
-        ></ic-approval-queue>`;case"health":return this._renderHealthTab();default:return p}}render(){return this._loadState==="loading"?s`<ic-skeleton-view variant="list"></ic-skeleton-view>`:this._loadState==="error"?s`
-        <div class="error-container">
-          <span class="error-message">${this._error}</span>
-          <button class="retry-btn" @click=${()=>this._loadData()}>Retry</button>
-        </div>
-      `:s`
-      <div class="view-header">
-        <div class="view-title">Security</div>
-      </div>
-      <ic-tabs
-        .tabs=${se}
-        .activeTab=${this._activeTab}
-        @tab-change=${e=>{this._activeTab=e.detail}}
-      ></ic-tabs>
-      <div class="tab-content">
-        ${this._renderTabContent()}
-      </div>
-    `}};v.styles=[_,S,w`
+    `}render(){return this.activeSubTab===`audit`?this._renderAuditContent():this._renderEventsContent()}};c([s({type:String})],E.prototype,`activeSubTab`,void 0),c([s({attribute:!1})],E.prototype,`securityEvents`,void 0),c([s({attribute:!1})],E.prototype,`inputGuardSummary`,void 0),c([a()],E.prototype,`_auditEntries`,void 0),c([a()],E.prototype,`_paused`,void 0),E=c([e(`ic-security-event-feed`)],E);var D=200,O=100,k=[{id:`events`,label:`Security Events`},{id:`audit`,label:`Audit Log`},{id:`tokens`,label:`API Tokens`},{id:`secrets`,label:`Secrets`},{id:`rules`,label:`Approval Rules`},{id:`pending`,label:`Pending Approvals`},{id:`health`,label:`Provider Health`}],A=class extends r{constructor(...e){super(...e),this.rpcClient=null,this.apiClient=null,this.eventDispatcher=null,this._sse=null,this._loadState=`loading`,this._error=``,this._activeTab=`events`,this._securityEvents=[],this._inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:`session`},this._securityConfig={},this._providerHealth=[],this._failoverLog=[],this._authCooldowns=[],this._healthReloadDebounce=null}static{this.styles=[o,i,n`
       :host {
         display: block;
       }
@@ -1221,4 +1108,117 @@ import{s as _,f as S,i as w,n as d,r as l,a as x,A as p,b as s,t as $,I as n,S a
         align-items: center;
         font-size: var(--ic-text-sm);
       }
-    `];u([d({attribute:!1})],v.prototype,"rpcClient",2);u([d({attribute:!1})],v.prototype,"apiClient",2);u([d({attribute:!1})],v.prototype,"eventDispatcher",2);u([l()],v.prototype,"_loadState",2);u([l()],v.prototype,"_error",2);u([l()],v.prototype,"_activeTab",2);u([l()],v.prototype,"_securityEvents",2);u([l()],v.prototype,"_inputGuardSummary",2);u([l()],v.prototype,"_securityConfig",2);u([l()],v.prototype,"_providerHealth",2);u([l()],v.prototype,"_failoverLog",2);u([l()],v.prototype,"_authCooldowns",2);v=u([$("ic-security-view")],v);export{v as IcSecurityView};
+    `]}_scheduleHealthReload(e=300){this._healthReloadDebounce!==null&&clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=setTimeout(()=>{this._healthReloadDebounce=null,this._loadProviderHealth()},e)}connectedCallback(){super.connectedCallback(),this._initSse()}disconnectedCallback(){super.disconnectedCallback(),this._healthReloadDebounce!==null&&(clearTimeout(this._healthReloadDebounce),this._healthReloadDebounce=null)}updated(e){e.has(`rpcClient`)&&this.rpcClient&&this._loadData(),e.has(`eventDispatcher`)&&this.eventDispatcher&&!this._sse&&this._initSse()}get _eventFeed(){return this.shadowRoot?.querySelector(`ic-security-event-feed`)??null}get _approvalQueue(){return this.shadowRoot?.querySelector(`ic-approval-queue`)??null}_initSse(){!this.eventDispatcher||this._sse||(this._sse=new d(this,this.eventDispatcher,{"audit:event":e=>{this._eventFeed?.onAuditEvent(e);let t=e;if(t.actionType===`output_guard`){let e=t.metadata??{},n=e.action,r=n===`redacted`?`high`:`medium`,i=e.findingCount??0,a={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`output_guard`,severity:r,message:`Output guard ${n??`scan`}: ${i} finding(s)`,details:{findingTypes:e.findingTypes,severities:e.severities,action:e.action,context:e.context},timestamp:t.timestamp??Date.now(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,D)}},"approval:requested":e=>{this._approvalQueue?.onApprovalPending(e)},"approval:resolved":e=>{this._approvalQueue?.onApprovalResolved(e)},"security:injection_detected":e=>{let t=e,n={high:`high`,medium:`medium`,low:`low`}[t.riskLevel??`medium`]??`medium`,r=t.source??`unknown`,i=t.patterns??[],a={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`injection`,severity:n,message:`Injection detected from ${r}`,details:{patterns:i,source:r,sessionKey:t.sessionKey},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,D);let o=[...new Set([...this._inputGuardSummary.patternsTriggered,...i])];this._inputGuardSummary={...this._inputGuardSummary,blockedAttempts:this._inputGuardSummary.blockedAttempts+1,patternsTriggered:o}},"security:injection_rate_exceeded":e=>{let t=e,n=t.count??0,r=t.threshold??0,i=t.action??`block`,a={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`input_guard`,severity:`critical`,message:`Rate limit exceeded: ${n}/${r} (action: ${i})`,details:{sessionKey:t.sessionKey,count:n,threshold:r,action:i},timestamp:Date.now()};this._securityEvents=[a,...this._securityEvents].slice(0,D)},"security:memory_tainted":e=>{let t=e,n=t.blocked??!1,r=t.originalTrustLevel??`unknown`,i=t.adjustedTrustLevel??`unknown`,a={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`memory_tainted`,severity:n?`high`:`medium`,message:`Memory tainted for ${t.agentId??`unknown`}: ${r} -> ${i}`,details:{patterns:t.patterns,blocked:n,originalTrustLevel:r,adjustedTrustLevel:i},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,D)},"security:warn":e=>{let t=e,n={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`warn`,severity:`medium`,message:t.message??`Security warning`,details:{category:t.category},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[n,...this._securityEvents].slice(0,D)},"secret:accessed":e=>{let t=e,n=t.outcome??`unknown`,r={denied:`high`,not_found:`medium`,success:`low`}[n]??`medium`,i=t.secretName??`unknown`,a={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`secret_access`,severity:r,message:`Secret '${i}' ${n} by ${t.agentId??`unknown`}`,details:{secretName:i,outcome:n},timestamp:Date.now(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,D)},"secret:modified":e=>{let t=e,n=t.secretName??`unknown`,r=t.action??`modified`,i={id:`sec-${Date.now()}-${Math.random().toString(36).slice(2,6)}`,type:`secret_access`,severity:`medium`,message:`Secret '${n}' ${r}`,details:{secretName:n,action:r},timestamp:Date.now()};this._securityEvents=[i,...this._securityEvents].slice(0,D)},"provider:degraded":e=>{let t=e.provider??``;this._providerHealth=this._providerHealth.map(e=>e.providerId===t?{...e,status:`degraded`}:e),this._scheduleHealthReload()},"provider:recovered":e=>{let t=e.provider??``;this._providerHealth=this._providerHealth.map(e=>e.providerId===t?{...e,status:`healthy`}:e),this._scheduleHealthReload()},"model:auth_cooldown":e=>{let t=e,n={keyName:t.keyName,provider:t.provider,cooldownMs:t.cooldownMs,failureCount:t.failureCount,timestamp:t.timestamp};this._authCooldowns=[n,...this._authCooldowns].slice(0,50),this._scheduleHealthReload(500)},"model:fallback_attempt":e=>{let t=e,n={fromProvider:t.fromProvider,fromModel:t.fromModel,toProvider:t.toProvider,toModel:t.toModel,error:t.error,attemptNumber:t.attemptNumber,timestamp:t.timestamp};this._failoverLog=[n,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"model:fallback_exhausted":e=>{let t=e,n={provider:t.provider,model:t.model,totalAttempts:t.totalAttempts,timestamp:t.timestamp,exhausted:!0};this._failoverLog=[n,...this._failoverLog].slice(0,O),this._scheduleHealthReload()},"observability:token_usage":()=>{this._scheduleHealthReload(500)}}))}async _loadProviderHealth(){if(this.rpcClient)try{let e=await this.rpcClient.call(`agent.cacheStats`),t=Date.now(),n=t-300*1e3,r=(e.providers??[]).map(e=>{let r=this._failoverLog.filter(t=>t.fromProvider===e.provider||t.provider===e.provider),i=r.length>0?Math.max(...r.map(e=>e.timestamp)):void 0,a=`healthy`,o=this._authCooldowns.find(n=>n.provider===e.provider&&n.timestamp+n.cooldownMs>t);return o&&(a=`degraded`),this._failoverLog.find(t=>t.exhausted===!0&&t.provider===e.provider&&t.timestamp>n)&&(a=`down`),{providerId:e.provider,name:e.provider,status:a,cacheHitRate:e.cacheHitRate,failoverCount:r.length,lastFailover:i,authCooldownUntil:o?o.timestamp+o.cooldownMs:void 0}});this._providerHealth=r}catch{}}async _loadData(){if(this.rpcClient){this._loadState=`loading`,this._error=``;try{let e=await this.rpcClient.call(`config.read`);this._securityConfig=e.config.security??{},this._loadState=`loaded`,this._loadProviderHealth()}catch(e){this._error=e instanceof Error?e.message:`Failed to load security configuration`,this._loadState=`error`}}}async _patchConfig(e,t){if(!this.rpcClient)return!1;try{let n=e.indexOf(`.`),r=n>0?e.slice(0,n):e,i=n>0?e.slice(n+1):void 0;return await this.rpcClient.call(`config.patch`,{section:r,key:i,value:t}),u.show(`Configuration updated`,`success`),!0}catch(e){let t=e instanceof Error?e.message:`Failed to update configuration`;return u.show(t,`error`),!1}}async _onSecretsEnabledChange(e){let t={...this._securityConfig.secrets,enabled:e};await this._patchConfig(`security.secrets`,t)&&(this._securityConfig={...this._securityConfig,secrets:t})}_renderSecretsTab(){let e=this._securityConfig.secrets??{};return t`
+      <div class="policy-section">
+        <div class="section-header">Encrypted Secrets Store</div>
+        <ic-toggle
+          label="Enabled"
+          .checked=${e.enabled??!1}
+          @change=${e=>this._onSecretsEnabledChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <div class="tls-row">
+            <span class="tls-label">DB Path</span>
+            <span class="tls-value">${e.dbPath??`secrets.db`}</span>
+          </div>
+        </div>
+      </div>
+    `}_statusToDotStatus(e){switch(e){case`healthy`:return`connected`;case`degraded`:return`reconnecting`;case`down`:return`disconnected`;default:return`disconnected`}}_renderHealthTab(){let e=Date.now(),n=this._authCooldowns.filter(t=>t.timestamp+t.cooldownMs>e);return t`
+      <div class="section-header">Provider Status</div>
+      ${this._providerHealth.length===0?t`<ic-empty-state icon="cloud" message="No provider data" description="Provider health data will appear after LLM calls are made."></ic-empty-state>`:t`
+            <div class="health-grid">
+              ${this._providerHealth.map(n=>t`
+                  <div class="health-card">
+                    <div class="health-card-header">
+                      <strong>${n.name}</strong>
+                      <ic-connection-dot
+                        status=${this._statusToDotStatus(n.status)}
+                        size="8px"
+                      ></ic-connection-dot>
+                    </div>
+                    <ic-progress-bar
+                      .value=${Math.round(n.cacheHitRate*100)}
+                      label="Cache Hit Rate"
+                      .thresholds=${{green:101,yellow:102}}
+                    ></ic-progress-bar>
+                    <div class="health-card-stat">
+                      Failovers: ${n.failoverCount}
+                      ${n.lastFailover?t` &mdash; last <ic-relative-time .timestamp=${n.lastFailover}></ic-relative-time>`:l}
+                    </div>
+                    ${n.authCooldownUntil&&n.authCooldownUntil>e?t`
+                          <div class="health-card-stat">
+                            <ic-tag variant="warning">Auth cooldown</ic-tag>
+                            ${Math.ceil((n.authCooldownUntil-e)/1e3)}s remaining
+                          </div>
+                        `:l}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Failover Event Log</div>
+      ${this._failoverLog.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No failover events recorded</p>`:t`
+            <div class="failover-log">
+              ${this._failoverLog.map(e=>t`
+                  <div class="failover-entry">
+                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+                    ${e.exhausted?t`
+                          <span>${e.provider??`unknown`} exhausted after ${e.totalAttempts??`?`} attempts</span>
+                          <ic-tag variant="error">EXHAUSTED</ic-tag>
+                        `:t`
+                          <span>${e.fromProvider??`?`}/${e.fromModel??`?`} &rarr; ${e.toProvider??`?`}/${e.toModel??`?`}</span>
+                          ${e.attemptNumber==null?l:t`<ic-tag variant="info">#${e.attemptNumber}</ic-tag>`}
+                          ${e.error?t`<span style="color: var(--ic-text-dim);">${e.error}</span>`:l}
+                        `}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Auth Cooldowns</div>
+      ${n.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No active cooldowns</p>`:t`
+            <div class="cooldown-list">
+              ${n.map(n=>t`
+                  <div class="cooldown-entry">
+                    <ic-tag variant="warning">${n.provider}</ic-tag>
+                    <span>${n.keyName}</span>
+                    <span style="color: var(--ic-text-dim);">${n.failureCount} failures</span>
+                    <span>${Math.ceil((n.timestamp+n.cooldownMs-e)/1e3)}s remaining</span>
+                  </div>
+                `)}
+            </div>
+          `}
+    `}_renderTabContent(){switch(this._activeTab){case`events`:return t`<ic-security-event-feed
+          activeSubTab="events"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case`audit`:return t`<ic-security-event-feed
+          activeSubTab="audit"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case`tokens`:return t`<ic-token-manager .rpc=${this.rpcClient}></ic-token-manager>`;case`secrets`:return this._renderSecretsTab();case`rules`:return t`<ic-approval-queue
+          activeSubTab="rules"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case`pending`:return t`<ic-approval-queue
+          activeSubTab="pending"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case`health`:return this._renderHealthTab();default:return l}}render(){return this._loadState===`loading`?t`<ic-skeleton-view variant="list"></ic-skeleton-view>`:this._loadState===`error`?t`
+        <div class="error-container">
+          <span class="error-message">${this._error}</span>
+          <button class="retry-btn" @click=${()=>this._loadData()}>Retry</button>
+        </div>
+      `:t`
+      <div class="view-header">
+        <div class="view-title">Security</div>
+      </div>
+      <ic-tabs
+        .tabs=${k}
+        .activeTab=${this._activeTab}
+        @tab-change=${e=>{this._activeTab=e.detail}}
+      ></ic-tabs>
+      <div class="tab-content">
+        ${this._renderTabContent()}
+      </div>
+    `}};c([s({attribute:!1})],A.prototype,`rpcClient`,void 0),c([s({attribute:!1})],A.prototype,`apiClient`,void 0),c([s({attribute:!1})],A.prototype,`eventDispatcher`,void 0),c([a()],A.prototype,`_loadState`,void 0),c([a()],A.prototype,`_error`,void 0),c([a()],A.prototype,`_activeTab`,void 0),c([a()],A.prototype,`_securityEvents`,void 0),c([a()],A.prototype,`_inputGuardSummary`,void 0),c([a()],A.prototype,`_securityConfig`,void 0),c([a()],A.prototype,`_providerHealth`,void 0),c([a()],A.prototype,`_failoverLog`,void 0),c([a()],A.prototype,`_authCooldowns`,void 0),A=c([e(`ic-security-view`)],A);export{A as IcSecurityView};