comisai 1.0.36 → 1.0.40

package/node_modules/@comis/web/dist/assets/security-CVla4rqz.js

@@ -0,0 +1,1224 @@
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,n as d,s as f}from"./system-time-B0nBw4nV.js";import{a as p,i as m}from"./index-D_ZV_sV5.js";import"./ic-tag-CKh2gHHX.js";import"./ic-relative-time-D6XlY7ay.js";import"./ic-array-editor-Cyy1IkY8.js";import"./ic-empty-state-BRy4ZXds.js";import"./ic-tabs-BM8xZY4a.js";import"./ic-connection-dot-gE_3dfRP.js";import"./ic-select-BEeaNppH.js";function h(e,t){let n={hostConnected(){},hostDisconnected(){},readConfig(){return t.call(`config.read`)},async patchConfig(e,n,r){await t.call(`config.patch`,{section:e,key:n,value:r})},getProviderCacheStats(){return t.call(`agent.cacheStats`)}};return e.addController(n),n}var g=class extends r{constructor(...e){super(...e),this.label=``,this.value=``,this.placeholder=`env:SECRET_NAME or file:/path`,this.disabled=!1,this._visible=!1}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+      }
+
+      .field-wrapper {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+      }
+
+      label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .input-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-xs);
+      }
+
+      input {
+        flex: 1;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+        transition: border-color var(--ic-transition);
+      }
+
+      input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      input::placeholder {
+        color: var(--ic-text-dim);
+      }
+
+      input:disabled {
+        opacity: 0.5;
+        cursor: not-allowed;
+      }
+
+      .toggle-btn {
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-dim);
+        cursor: pointer;
+        padding: 0.5rem;
+        font-size: var(--ic-text-sm);
+        line-height: 1;
+        flex-shrink: 0;
+      }
+
+      .toggle-btn:hover {
+        color: var(--ic-text);
+      }
+
+      .hint {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        font-style: italic;
+      }
+    `]}_onInput(e){let t=e.target.value;this.dispatchEvent(new CustomEvent(`change`,{detail:t,bubbles:!0,composed:!0}))}_toggleVisibility(){this._visible=!this._visible}render(){return t`
+      <div class="field-wrapper">
+        ${this.label?t`<label>${this.label}</label>`:l}
+        <div class="input-row">
+          <input
+            type=${this._visible?`text`:`password`}
+            .value=${this.value}
+            placeholder=${this.placeholder}
+            ?disabled=${this.disabled}
+            @input=${this._onInput}
+          />
+          <button
+            class="toggle-btn"
+            type="button"
+            aria-label=${this._visible?`Hide value`:`Show value`}
+            @click=${this._toggleVisibility}
+          >${this._visible?`🙈`:`👁`}</button>
+        </div>
+        <span class="hint">Format: env:VAR_NAME or file:/path/to/secret</span>
+      </div>
+    `}};c([s()],g.prototype,`label`,void 0),c([s()],g.prototype,`value`,void 0),c([s()],g.prototype,`placeholder`,void 0),c([s({type:Boolean})],g.prototype,`disabled`,void 0),c([a()],g.prototype,`_visible`,void 0),g=c([e(`ic-secret-input`)],g);var _=class extends r{constructor(...e){super(...e),this._tokens=[],this._newTokenScopes=[],this._newSecretDisplay=null}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+      }
+
+      .grid-table {
+        display: grid;
+        width: 100%;
+      }
+
+      .grid-table--tokens {
+        grid-template-columns: 1fr 1fr 10rem;
+      }
+
+      .grid-table .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+      }
+
+      .grid-table .data-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .scopes-cell {
+        display: flex;
+        gap: var(--ic-space-xs);
+        flex-wrap: wrap;
+      }
+
+      .create-form {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-md);
+        margin-top: var(--ic-space-lg);
+        max-width: 32rem;
+      }
+
+      .create-form-title {
+        font-size: var(--ic-text-sm);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-field {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .checkbox-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .checkbox-row input[type="checkbox"] {
+        accent-color: var(--ic-accent);
+      }
+
+      .checkbox-row label {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        cursor: pointer;
+      }
+
+      .generate-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-accent);
+        color: white;
+        border: none;
+        border-radius: var(--ic-radius-md);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .generate-btn:hover {
+        opacity: 0.9;
+      }
+
+      .revoke-btn {
+        padding: 0.25rem 0.5rem;
+        background: none;
+        border: 1px solid var(--ic-error);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-error);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .revoke-btn:hover {
+        background: color-mix(in srgb, var(--ic-error) 10%, transparent);
+      }
+
+      .rotate-btn {
+        padding: 0.25rem 0.5rem;
+        background: none;
+        border: 1px solid var(--ic-accent);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-accent);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .rotate-btn:hover {
+        background: color-mix(in srgb, var(--ic-accent) 10%, transparent);
+      }
+
+      .token-actions {
+        display: flex;
+        gap: var(--ic-space-xs);
+      }
+
+      .new-secret-banner {
+        background: color-mix(in srgb, var(--ic-success) 10%, transparent);
+        border: 1px solid var(--ic-success);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-sm) var(--ic-space-md);
+        margin-top: var(--ic-space-md);
+        max-width: 32rem;
+      }
+
+      .new-secret-banner .secret-label {
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-success);
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .new-secret-banner .secret-value {
+        font-family: ui-monospace, monospace;
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        word-break: break-all;
+      }
+
+      .new-secret-banner .secret-warning {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-top: var(--ic-space-xs);
+      }
+    `]}connectedCallback(){super.connectedCallback()}updated(e){e.has(`rpc`)&&this.rpc&&this._loadTokens()}async _loadTokens(){if(this.rpc)try{let e=await this.rpc.call(`tokens.list`);this._tokens=e.tokens??[]}catch{}}async _revokeToken(e){if(this.rpc)try{await this.rpc.call(`tokens.revoke`,{id:e}),this._tokens=this._tokens.filter(t=>t.id!==e),p.show(`Token "${e}" revoked`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to revoke token`;p.show(t,`error`)}}async _rotateToken(e){if(this.rpc)try{let t=await this.rpc.call(`tokens.rotate`,{id:e});this._newSecretDisplay=t.secret,p.show(`Token "${e}" rotated -- new secret shown below`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to rotate token`;p.show(t,`error`)}}_onScopeToggle(e,t){t?this._newTokenScopes=[...this._newTokenScopes,e]:this._newTokenScopes=this._newTokenScopes.filter(t=>t!==e)}async _generateToken(){if(this.rpc)try{let e=await this.rpc.call(`tokens.create`,{scopes:[...this._newTokenScopes]});this._tokens=[...this._tokens,{id:e.id,scopes:e.scopes}],this._newSecretDisplay=e.secret,this._newTokenScopes=[],p.show(`Token created -- secret shown below`,`success`),this.dispatchEvent(new CustomEvent(`tokens-changed`,{bubbles:!0,composed:!0}))}catch(e){let t=e instanceof Error?e.message:`Failed to create token`;p.show(t,`error`)}}_renderTokenRow(e){return t`
+      <div class="data-cell" role="cell">${e.id}</div>
+      <div class="data-cell scopes-cell" role="cell">
+        ${e.scopes.map(e=>t`<ic-tag variant="info">${e}</ic-tag>`)}
+      </div>
+      <div class="data-cell" role="cell">
+        <div class="token-actions">
+          <button class="rotate-btn" @click=${()=>this._rotateToken(e.id)}>Rotate</button>
+          <button class="revoke-btn" @click=${()=>this._revokeToken(e.id)}>Revoke</button>
+        </div>
+      </div>
+    `}render(){return t`
+      <div class="grid-table grid-table--tokens" role="table" aria-label="API tokens">
+        <div class="header-cell" role="columnheader">Token ID</div>
+        <div class="header-cell" role="columnheader">Scopes</div>
+        <div class="header-cell" role="columnheader">Actions</div>
+        ${this._tokens.map(e=>this._renderTokenRow(e))}
+      </div>
+
+      ${this._newSecretDisplay?t`
+            <div class="new-secret-banner">
+              <div class="secret-label">New Token Secret</div>
+              <div class="secret-value">${this._newSecretDisplay}</div>
+              <div class="secret-warning">Copy this secret now. It will not be shown again.</div>
+            </div>
+          `:l}
+
+      <div class="create-form">
+        <div class="create-form-title">Create Token</div>
+        <div class="form-field">
+          <label class="form-label">Scopes</label>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-rpc"
+              .checked=${this._newTokenScopes.includes(`rpc`)}
+              @change=${e=>this._onScopeToggle(`rpc`,e.target.checked)}
+            /><label for="scope-rpc">rpc</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-ws"
+              .checked=${this._newTokenScopes.includes(`ws`)}
+              @change=${e=>this._onScopeToggle(`ws`,e.target.checked)}
+            /><label for="scope-ws">ws</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-admin"
+              .checked=${this._newTokenScopes.includes(`admin`)}
+              @change=${e=>this._onScopeToggle(`admin`,e.target.checked)}
+            /><label for="scope-admin">admin</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-api"
+              .checked=${this._newTokenScopes.includes(`api`)}
+              @change=${e=>this._onScopeToggle(`api`,e.target.checked)}
+            /><label for="scope-api">api</label>
+          </div>
+          <div class="checkbox-row">
+            <input type="checkbox" id="scope-all"
+              .checked=${this._newTokenScopes.includes(`*`)}
+              @change=${e=>this._onScopeToggle(`*`,e.target.checked)}
+            /><label for="scope-all">* (all)</label>
+          </div>
+        </div>
+        <button class="generate-btn" @click=${()=>this._generateToken()}>Generate</button>
+      </div>
+    `}};c([s({attribute:!1})],_.prototype,`rpc`,void 0),c([a()],_.prototype,`_tokens`,void 0),c([a()],_.prototype,`_newTokenScopes`,void 0),c([a()],_.prototype,`_newSecretDisplay`,void 0),_=c([e(`ic-token-manager`)],_);var v={low:`success`,medium:`warning`,high:`error`,critical:`error`},y={low:`var(--ic-success)`,medium:`var(--ic-warning)`,high:`var(--ic-error)`,critical:`var(--ic-error)`},b=class extends r{constructor(...e){super(...e),this.approval=null,this._reason=``,this._expanded=!1}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+        width: 100%;
+      }
+
+      .card {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-lg);
+        padding: var(--ic-space-md);
+        border-left: 3px solid var(--ic-border);
+      }
+
+      .card-header {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        flex-wrap: wrap;
+        margin-bottom: var(--ic-space-xs);
+      }
+
+      .agent-id {
+        font-weight: 600;
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+      }
+
+      .action-name {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text-muted);
+        font-family: ui-monospace, monospace;
+      }
+
+      .timestamp {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .user-row {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .user-label {
+        color: var(--ic-text-muted);
+      }
+
+      .context-toggle {
+        background: none;
+        border: none;
+        color: var(--ic-accent);
+        font-size: var(--ic-text-xs);
+        cursor: pointer;
+        padding: 0;
+        font-family: inherit;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .context-toggle:hover {
+        text-decoration: underline;
+      }
+
+      .context-details {
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-muted);
+        white-space: pre-wrap;
+        word-break: break-word;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .reason-input {
+        width: 100%;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+        margin-bottom: var(--ic-space-sm);
+        box-sizing: border-box;
+      }
+
+      .reason-input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      .action-buttons {
+        display: flex;
+        gap: var(--ic-space-sm);
+        flex-wrap: wrap;
+      }
+
+      .approve-btn {
+        padding: 0.375rem 0.75rem;
+        background: color-mix(in srgb, var(--ic-success) 15%, transparent);
+        border: 1px solid var(--ic-success);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-success);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        font-weight: 500;
+      }
+
+      .approve-btn:hover {
+        background: color-mix(in srgb, var(--ic-success) 25%, transparent);
+      }
+
+      .deny-btn {
+        padding: 0.375rem 0.75rem;
+        background: color-mix(in srgb, var(--ic-error) 15%, transparent);
+        border: 1px solid var(--ic-error);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-error);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        font-weight: 500;
+      }
+
+      .deny-btn:hover {
+        background: color-mix(in srgb, var(--ic-error) 25%, transparent);
+      }
+    `]}_onApprove(){this.approval&&this.dispatchEvent(new CustomEvent(`approve`,{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}_onDeny(){this.approval&&this.dispatchEvent(new CustomEvent(`deny`,{detail:{id:this.approval.id,reason:this._reason},bubbles:!0,composed:!0}))}render(){if(!this.approval)return l;let e=this.approval,n=v[e.classification]??`default`,r=y[e.classification]??`var(--ic-border)`;return t`
+      <div
+        class="card"
+        role="article"
+        aria-label="${e.agentId} ${e.action} approval request"
+        style="border-left-color: ${r};"
+      >
+        <div class="card-header">
+          <span class="agent-id">${e.agentId}</span>
+          <span class="action-name">${e.action}</span>
+          <ic-tag variant=${n}>${e.classification}</ic-tag>
+        </div>
+        <div class="timestamp">
+          <ic-relative-time .timestamp=${e.requestedAt}></ic-relative-time>
+        </div>
+        ${e.user?t`<div class="user-row"><span class="user-label">Requested by:</span> ${e.user}</div>`:l}
+        <button
+          class="context-toggle"
+          @click=${()=>{this._expanded=!this._expanded}}
+        >${this._expanded?`Hide details`:`Show details`}</button>
+        ${this._expanded?t`<div class="context-details">${e.context}</div>`:l}
+        <input
+          class="reason-input"
+          type="text"
+          placeholder="Reason (optional)"
+          aria-label="Decision reason"
+          .value=${this._reason}
+          @input=${e=>{this._reason=e.target.value}}
+        />
+        <div class="action-buttons">
+          <button class="approve-btn" @click=${()=>this._onApprove()}>Approve</button>
+          <button class="deny-btn" @click=${()=>this._onDeny()}>Deny</button>
+        </div>
+      </div>
+    `}};c([s({type:Object})],b.prototype,`approval`,void 0),c([a()],b.prototype,`_reason`,void 0),c([a()],b.prototype,`_expanded`,void 0),b=c([e(`ic-approval-card`)],b);function x(e){return{id:e.requestId,agentId:e.agentId,action:e.action||e.toolName,classification:e.trustLevel===`admin`?`low`:e.trustLevel===`user`?`medium`:`high`,context:JSON.stringify(e.params,null,2),requestedAt:e.createdAt}}var S=`ic:approval-history`,C=10080*60*1e3;function w(){try{let e=localStorage.getItem(S);if(!e)return[];let t=JSON.parse(e),n=u()-C;return t.filter(e=>e.resolvedAt>n)}catch{return[]}}function T(e){try{let t=u()-C,n=e.filter(e=>e.resolvedAt>t);localStorage.setItem(S,JSON.stringify(n))}catch{}}var E=class extends r{constructor(...e){super(...e),this.securityConfig={},this.activeSubTab=`pending`,this._pendingApprovals=[],this._resolvedApprovals=[],this._approvalRules={defaultMode:`manual`,timeoutMs:0}}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+      }
+
+      .section-header {
+        font-size: var(--ic-text-base);
+        font-weight: 600;
+        color: var(--ic-text);
+        margin-top: var(--ic-space-lg);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .section-header:first-child {
+        margin-top: 0;
+      }
+
+      .policy-section {
+        margin-bottom: var(--ic-space-xl);
+        max-width: 40rem;
+      }
+
+      .queue-header {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+      }
+
+      .queue-count {
+        background: var(--ic-accent);
+        color: white;
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        padding: 0.125rem 0.5rem;
+        border-radius: var(--ic-radius-md);
+        min-width: 1.25rem;
+        text-align: center;
+      }
+
+      .queue-list {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-md);
+      }
+
+      .history-divider {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin: var(--ic-space-xl) 0 var(--ic-space-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        font-weight: 600;
+      }
+
+      .history-divider::after {
+        content: "";
+        flex: 1;
+        height: 1px;
+        background: var(--ic-border);
+      }
+
+      .history-grid {
+        display: grid;
+        grid-template-columns: 7rem 8rem 6rem 5rem 1fr 8rem 6rem;
+        width: 100%;
+      }
+
+      .history-grid .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+      }
+
+      .history-grid .data-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .history-grid .data-cell--muted {
+        color: var(--ic-text-muted);
+      }
+
+      .rules-form {
+        max-width: 32rem;
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-md);
+      }
+
+      .save-btn,
+      .action-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-accent);
+        color: white;
+        border: none;
+        border-radius: var(--ic-radius-md);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+        align-self: flex-start;
+      }
+
+      .save-btn:hover,
+      .action-btn:hover {
+        opacity: 0.9;
+      }
+
+      .form-field {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-xs);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .form-label {
+        font-size: var(--ic-text-sm);
+        font-weight: 500;
+        color: var(--ic-text-muted);
+      }
+
+      .form-hint {
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+      }
+
+      .number-input {
+        width: 8rem;
+        padding: 0.5rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text);
+        font-family: inherit;
+        font-size: var(--ic-text-sm);
+      }
+
+      .number-input:focus {
+        outline: none;
+        border-color: var(--ic-accent);
+      }
+
+      .bulk-actions {
+        display: flex;
+        flex-direction: row;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+        flex-wrap: wrap;
+      }
+
+      .action-btn--success {
+        background: var(--ic-success, #22c55e);
+        color: white;
+      }
+
+      .action-btn--danger {
+        background: var(--ic-error, #ef4444);
+        color: white;
+      }
+
+      .action-btn:disabled,
+      .action-btn--success:disabled,
+      .action-btn--danger:disabled {
+        opacity: 0.5;
+        cursor: not-allowed;
+      }
+    `]}connectedCallback(){super.connectedCallback(),this._resolvedApprovals=w()}updated(e){e.has(`rpc`)&&this.rpc&&this._loadApprovals(),e.has(`securityConfig`)&&(this._approvalRules=this.securityConfig.approvalRules??{defaultMode:`manual`,timeoutMs:0})}async _loadApprovals(){if(this.rpc)try{let e=await this.rpc.call(`admin.approval.pending`);this._pendingApprovals=(e.requests??[]).map(x)}catch{}}onApprovalPending(e){let t=e;t?.requestId&&(this._pendingApprovals=[x(t),...this._pendingApprovals])}onApprovalResolved(e){let t=e,n=t?.requestId;if(!n)return;this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==n);let r={...x(t),outcome:t.approved?`approved`:`denied`,reason:t.reason??``,resolvedAt:t.resolvedAt??u(),resolvedBy:t.approvedBy??`system`};this._resolvedApprovals=[r,...this._resolvedApprovals],T(this._resolvedApprovals)}async _handleApprove(e){if(!this.rpc)return;let{id:t,reason:n}=e.detail;try{await this.rpc.call(`admin.approval.resolve`,{requestId:t,approved:!0,approvedBy:`operator`,reason:n});let e=this._pendingApprovals.find(e=>e.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==t),e){let t={...e,outcome:`approved`,reason:n,resolvedAt:u(),resolvedBy:`operator`};this._resolvedApprovals=[t,...this._resolvedApprovals],T(this._resolvedApprovals)}p.show(`Approval granted`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){p.show(e instanceof Error?e.message:`Failed to approve request`,`error`)}}async _handleDeny(e){if(!this.rpc)return;let{id:t,reason:n}=e.detail;try{await this.rpc.call(`admin.approval.resolve`,{requestId:t,approved:!1,approvedBy:`operator`,reason:n});let e=this._pendingApprovals.find(e=>e.id===t);if(this._pendingApprovals=this._pendingApprovals.filter(e=>e.id!==t),e){let t={...e,outcome:`denied`,reason:n,resolvedAt:u(),resolvedBy:`operator`};this._resolvedApprovals=[t,...this._resolvedApprovals],T(this._resolvedApprovals)}p.show(`Approval denied`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){p.show(e instanceof Error?e.message:`Failed to deny request`,`error`)}}async _handleResolveAll(e){if(!(!this.rpc||this._pendingApprovals.length===0))try{let t=await this.rpc.call(`admin.approval.resolveAll`,{approved:e,approvedBy:`operator`,reason:e?`Bulk approved by operator`:`Bulk denied by operator`});for(let t of this._pendingApprovals){let n={...t,outcome:e?`approved`:`denied`,reason:e?`Bulk approved by operator`:`Bulk denied by operator`,resolvedAt:u(),resolvedBy:`operator`};this._resolvedApprovals=[n,...this._resolvedApprovals]}this._pendingApprovals=[],T(this._resolvedApprovals),p.show(`${t.resolved} approval(s) ${e?`approved`:`denied`}`,`success`),this.dispatchEvent(new CustomEvent(`approvals-changed`,{bubbles:!0,composed:!0}))}catch(e){p.show(e instanceof Error?e.message:`Bulk operation failed`,`error`)}}async _handleClearDenialCache(){if(this.rpc)try{await this.rpc.call(`admin.approval.clearDenialCache`,{}),p.show(`Denial cache cleared`,`success`)}catch(e){p.show(e instanceof Error?e.message:`Failed to clear denial cache`,`error`)}}async _patchConfig(e,t){if(!this.rpc)return!1;try{let n=e.indexOf(`.`),r=n>0?e.slice(0,n):e,i=n>0?e.slice(n+1):void 0;return await this.rpc.call(`config.patch`,{section:r,key:i,value:t}),p.show(`Configuration updated`,`success`),!0}catch(e){return p.show(e instanceof Error?e.message:`Failed to update configuration`,`error`),!1}}async _onActionConfirmationChange(e,t){let n={...this.securityConfig.actionConfirmation,[e]:t};await this._patchConfig(`security.actionConfirmation`,n)}async _onAgentToAgentEnabledChange(e){let t={...this.securityConfig.agentToAgent,enabled:e};await this._patchConfig(`security.agentToAgent`,t)}async _onAgentToAgentAllowChange(e){let t={...this.securityConfig.agentToAgent,allowAgents:e};await this._patchConfig(`security.agentToAgent`,t)}async _onPermissionToggleChange(e){let t={...this.securityConfig.permission,enableNodePermissions:e};await this._patchConfig(`security.permission`,t)}async _onPermissionPathsChange(e,t){let n={...this.securityConfig.permission,[e]:t};await this._patchConfig(`security.permission`,n)}async _saveApprovalRules(){if(this.rpc)try{await this.rpc.call(`config.patch`,{section:`security`,key:`approvalRules`,value:this._approvalRules}),p.show(`Approval rules updated`,`success`)}catch(e){p.show(e instanceof Error?e.message:`Failed to update approval rules`,`error`)}}_renderHistoryRow(e){let n=e.outcome===`approved`?`success`:`error`,r={low:`success`,medium:`warning`,high:`error`,critical:`error`}[e.classification]??`default`;return t`
+      <div class="data-cell" role="cell">${e.agentId}</div>
+      <div class="data-cell" role="cell">${e.action}</div>
+      <div class="data-cell" role="cell"><ic-tag variant=${r}>${e.classification}</ic-tag></div>
+      <div class="data-cell" role="cell"><ic-tag variant=${n}>${e.outcome}</ic-tag></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.reason||`---`}</div>
+      <div class="data-cell data-cell--muted" role="cell"><ic-relative-time .timestamp=${e.resolvedAt}></ic-relative-time></div>
+      <div class="data-cell data-cell--muted" role="cell">${e.resolvedBy}</div>
+    `}_renderRulesContent(){let e=this.securityConfig.actionConfirmation??{},n=this.securityConfig.agentToAgent??{},r=this.securityConfig.permission??{};return t`
+      <div class="policy-section">
+        <div class="section-header">Action Confirmation</div>
+        <ic-toggle label="Require for destructive actions"
+          .checked=${e.requireForDestructive??!0}
+          @change=${e=>this._onActionConfirmationChange(`requireForDestructive`,e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-sm);">
+          <ic-toggle label="Require for sensitive actions"
+            .checked=${e.requireForSensitive??!1}
+            @change=${e=>this._onActionConfirmationChange(`requireForSensitive`,e.detail)}
+          ></ic-toggle>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Auto-approve list" .items=${e.autoApprove??[]} placeholder="Action name to auto-approve"
+            @change=${e=>this._onActionConfirmationChange(`autoApprove`,e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Agent-to-Agent Policy</div>
+        <ic-toggle label="Enable cross-agent messaging"
+          .checked=${n.enabled??!0}
+          @change=${e=>this._onAgentToAgentEnabledChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed agents" .items=${n.allowAgents??[]} placeholder="Agent ID"
+            @change=${e=>this._onAgentToAgentAllowChange(e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Permissions</div>
+        <ic-toggle label="Enable Node.js permission model"
+          .checked=${r.enableNodePermissions??!1}
+          @change=${e=>this._onPermissionToggleChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed filesystem paths" .items=${r.allowedFsPaths??[]} placeholder="/path/to/allow"
+            @change=${e=>this._onPermissionPathsChange(`allowedFsPaths`,e.detail)}
+          ></ic-array-editor>
+        </div>
+        <div style="margin-top: var(--ic-space-md);">
+          <ic-array-editor label="Allowed network hosts" .items=${r.allowedNetHosts??[]} placeholder="hostname or IP"
+            @change=${e=>this._onPermissionPathsChange(`allowedNetHosts`,e.detail)}
+          ></ic-array-editor>
+        </div>
+      </div>
+
+      <div class="policy-section">
+        <div class="section-header">Approval Mode</div>
+        <div class="rules-form">
+          <ic-select label="Default Mode" .value=${this._approvalRules.defaultMode} .options=${[{value:`manual`,label:`Manual (all require approval)`},{value:`auto-low`,label:`Auto-approve low risk`},{value:`auto-medium`,label:`Auto-approve low + medium risk`},{value:`auto-all`,label:`Auto-approve all (no approvals)`}]}
+            @change=${e=>{this._approvalRules={...this._approvalRules,defaultMode:e.detail}}}
+          ></ic-select>
+          <div class="form-field">
+            <label class="form-label">Timeout (seconds)</label>
+            <input class="number-input" type="number" min="0"
+              .value=${String(Math.round(this._approvalRules.timeoutMs/1e3))}
+              @change=${e=>{let t=parseInt(e.target.value,10);!isNaN(t)&&t>=0&&(this._approvalRules={...this._approvalRules,timeoutMs:t*1e3})}}
+            />
+            <span class="form-hint">0 = no timeout (request waits indefinitely)</span>
+          </div>
+          <button class="save-btn" @click=${()=>this._saveApprovalRules()}>Save Rules</button>
+        </div>
+      </div>
+    `}_renderPendingContent(){let e=[...this._pendingApprovals].sort((e,t)=>t.requestedAt-e.requestedAt);return t`
+      <div class="queue-header">
+        <span>Pending</span>
+        <span class="queue-count">${this._pendingApprovals.length}</span>
+      </div>
+      <div class="bulk-actions">
+        <button class="action-btn action-btn--success" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!0)}>Approve All (${this._pendingApprovals.length})</button>
+        <button class="action-btn action-btn--danger" ?disabled=${this._pendingApprovals.length===0}
+          @click=${()=>this._handleResolveAll(!1)}>Deny All (${this._pendingApprovals.length})</button>
+        <button class="action-btn" @click=${()=>this._handleClearDenialCache()}>Clear Denial Cache</button>
+      </div>
+      ${e.length===0?t`<ic-empty-state icon="security" message="No pending approvals" description="Approval requests will appear here as they arrive."></ic-empty-state>`:t`
+            <div class="queue-list">
+              ${e.map(e=>t`
+                <ic-approval-card .approval=${e}
+                  @approve=${e=>this._handleApprove(e)}
+                  @deny=${e=>this._handleDeny(e)}
+                ></ic-approval-card>
+              `)}
+            </div>
+          `}
+
+      <div class="history-divider">Recent History</div>
+      ${this._resolvedApprovals.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No resolved approvals in the last 7 days.</p>`:t`
+            <div class="history-grid" role="table" aria-label="Resolved approvals">
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">Outcome</div>
+              <div class="header-cell" role="columnheader">Reason</div>
+              <div class="header-cell" role="columnheader">Resolved At</div>
+              <div class="header-cell" role="columnheader">Resolved By</div>
+              ${this._resolvedApprovals.map(e=>this._renderHistoryRow(e))}
+            </div>
+          `}
+    `}render(){return this.activeSubTab===`rules`?this._renderRulesContent():this._renderPendingContent()}};c([s({attribute:!1})],E.prototype,`rpc`,void 0),c([s({attribute:!1})],E.prototype,`securityConfig`,void 0),c([s({type:String})],E.prototype,`activeSubTab`,void 0),c([a()],E.prototype,`_pendingApprovals`,void 0),c([a()],E.prototype,`_resolvedApprovals`,void 0),c([a()],E.prototype,`_approvalRules`,void 0),E=c([e(`ic-approval-queue`)],E);var D={low:`success`,medium:`warning`,high:`error`,critical:`error`},O=class extends r{constructor(...e){super(...e),this.event=null}static{this.styles=[o,n`
+      :host {
+        display: contents;
+      }
+
+      .cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text);
+        display: flex;
+        align-items: center;
+        border-bottom: 1px solid var(--ic-border);
+        min-height: 2.25rem;
+      }
+
+      .cell--muted {
+        color: var(--ic-text-muted);
+      }
+
+      .cell--details {
+        color: var(--ic-text-dim);
+        font-size: var(--ic-text-xs);
+      }
+    `]}render(){if(!this.event)return t`
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+        <div class="cell cell--muted" role="cell">---</div>
+      `;let e=this.event,n=D[e.classification]??`default`;return t`
+      <div class="cell cell--muted" role="cell">
+        <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+      </div>
+      <div class="cell" role="cell">${e.agentId||`---`}</div>
+      <div class="cell" role="cell">${e.action||`---`}</div>
+      <div class="cell" role="cell">
+        <ic-tag variant=${n}>${e.classification||`unknown`}</ic-tag>
+      </div>
+      <div class="cell cell--muted" role="cell">${e.user||`---`}</div>
+      ${e.details?t`<div class="cell cell--details" role="cell" style="grid-column: 1 / -1;">${e.details}</div>`:l}
+    `}};c([s({type:Object})],O.prototype,`event`,void 0),O=c([e(`ic-audit-row`)],O);var k=200,A=class extends r{constructor(...e){super(...e),this.activeSubTab=`events`,this.securityEvents=[],this.inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:`session`},this._auditEntries=[],this._paused=!1,this._pauseBuffer=[],this._expandedEvents=new Set}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+      }
+
+      .guard-summary {
+        display: flex;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm) var(--ic-space-md);
+        background: var(--ic-surface-alt, var(--ic-surface-2));
+        border-radius: var(--ic-radius-md);
+        margin-bottom: var(--ic-space-md);
+        align-items: center;
+        flex-wrap: wrap;
+      }
+
+      .event-row {
+        display: flex;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm) var(--ic-space-sm);
+        border-bottom: 1px solid var(--ic-border);
+        align-items: center;
+      }
+
+      .event-message {
+        flex: 1;
+        font-size: var(--ic-text-sm);
+      }
+
+      .event-details {
+        font-family: ui-monospace, monospace;
+        font-size: var(--ic-text-xs);
+        background: var(--ic-surface-alt, var(--ic-surface-2));
+        padding: var(--ic-space-sm);
+        border-radius: var(--ic-radius-md);
+        max-height: 200px;
+        overflow: auto;
+        white-space: pre-wrap;
+        margin-top: var(--ic-space-xs);
+      }
+
+      .event-details-toggle {
+        cursor: pointer;
+        font-size: var(--ic-text-xs);
+        color: var(--ic-text-dim);
+        background: none;
+        border: none;
+        font-family: inherit;
+        padding: 0;
+      }
+
+      .event-details-toggle:hover {
+        color: var(--ic-text-muted);
+      }
+
+      .audit-controls {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        margin-bottom: var(--ic-space-md);
+      }
+
+      .pause-btn {
+        padding: 0.375rem 0.75rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .pause-btn[data-active] {
+        background: var(--ic-warning);
+        color: var(--ic-bg);
+        border-color: var(--ic-warning);
+      }
+
+      .audit-grid {
+        display: grid;
+        grid-template-columns: 8rem 7rem 1fr 6rem 6rem;
+        overflow-y: auto;
+        max-height: 600px;
+      }
+
+      .audit-grid .header-cell {
+        padding: var(--ic-space-xs) var(--ic-space-sm);
+        font-size: var(--ic-text-xs);
+        font-weight: 600;
+        color: var(--ic-text-muted);
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+        border-bottom: 2px solid var(--ic-border);
+        background: var(--ic-surface);
+        position: sticky;
+        top: 0;
+        z-index: 1;
+      }
+    `]}onAuditEvent(e){let t=e;if(t){if(this._paused){this._pauseBuffer=[...this._pauseBuffer.slice(-(k-1)),t];return}this._auditEntries=[...this._auditEntries.slice(-(k-1)),t]}}get auditEntries(){return this._auditEntries}get paused(){return this._paused}get pauseBuffer(){return this._pauseBuffer}_severityVariant(e){switch(e){case`critical`:case`high`:return`error`;case`medium`:return`warning`;default:return`info`}}_toggleEventDetails(e){this._expandedEvents.has(e)?this._expandedEvents.delete(e):this._expandedEvents.add(e),this.requestUpdate()}_togglePause(){if(this._paused){let e=[...this._auditEntries,...this._pauseBuffer].slice(-k);this._auditEntries=e,this._pauseBuffer=[]}this._paused=!this._paused}_renderEventsContent(){return t`
+      <div class="guard-summary">
+        <span style="font-size: var(--ic-text-sm); font-weight: 500; color: var(--ic-text-muted);">Input Guard</span>
+        <ic-tag variant="error">${this.inputGuardSummary.blockedAttempts} blocked</ic-tag>
+        ${this.inputGuardSummary.patternsTriggered.length>0?t`<ic-tag variant="warning">${this.inputGuardSummary.patternsTriggered.join(`, `)}</ic-tag>`:l}
+      </div>
+      ${this.securityEvents.length===0?t`<ic-empty-state icon="security" message="No security events" description="Security events will appear here in real-time as they are detected."></ic-empty-state>`:t`
+            <div role="list" aria-label="Security events">
+              ${this.securityEvents.map(e=>t`
+                  <div class="event-row" role="listitem">
+                    <ic-tag variant=${this._severityVariant(e.severity)}>${e.severity}</ic-tag>
+                    <ic-tag variant="default">${e.type}</ic-tag>
+                    <span class="event-message">${e.message}</span>
+                    ${e.agentId?t`<ic-tag variant="info">${e.agentId}</ic-tag>`:l}
+                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+                    <button class="event-details-toggle"
+                      @click=${()=>this._toggleEventDetails(e.id)}
+                    >${this._expandedEvents.has(e.id)?`hide`:`details`}</button>
+                  </div>
+                  ${this._expandedEvents.has(e.id)?t`<pre class="event-details">${JSON.stringify(e.details,null,2)}</pre>`:l}
+                `)}
+            </div>
+          `}
+    `}_renderAuditContent(){return t`
+      <div class="audit-controls">
+        <button class="pause-btn" ?data-active=${this._paused}
+          @click=${()=>this._togglePause()}
+        >${this._paused?`Resume`:`Pause`}</button>
+        ${this._paused?t`<span style="font-size: var(--ic-text-xs); color: var(--ic-text-dim);">${this._pauseBuffer.length} buffered</span>`:l}
+      </div>
+      ${this._auditEntries.length===0?t`<ic-empty-state icon="security" message="No audit events" description="Events will appear here as they occur."></ic-empty-state>`:t`
+            <div class="audit-grid" role="table" aria-label="Audit log">
+              <div class="header-cell" role="columnheader">Time</div>
+              <div class="header-cell" role="columnheader">Agent</div>
+              <div class="header-cell" role="columnheader">Action</div>
+              <div class="header-cell" role="columnheader">Risk</div>
+              <div class="header-cell" role="columnheader">User</div>
+              ${this._auditEntries.map(e=>t`<ic-audit-row .event=${e} role="row"></ic-audit-row>`)}
+            </div>
+          `}
+    `}render(){return this.activeSubTab===`audit`?this._renderAuditContent():this._renderEventsContent()}};c([s({type:String})],A.prototype,`activeSubTab`,void 0),c([s({attribute:!1})],A.prototype,`securityEvents`,void 0),c([s({attribute:!1})],A.prototype,`inputGuardSummary`,void 0),c([a()],A.prototype,`_auditEntries`,void 0),c([a()],A.prototype,`_paused`,void 0),A=c([e(`ic-security-event-feed`)],A);var j=200,M=100,N=[{id:`events`,label:`Security Events`},{id:`audit`,label:`Audit Log`},{id:`tokens`,label:`API Tokens`},{id:`secrets`,label:`Secrets`},{id:`rules`,label:`Approval Rules`},{id:`pending`,label:`Pending Approvals`},{id:`health`,label:`Provider Health`}],P=class extends r{constructor(...e){super(...e),this.rpcClient=null,this.apiClient=null,this.eventDispatcher=null,this._sse=null,this._loadState=`loading`,this._error=``,this._activeTab=`events`,this._securityEvents=[],this._inputGuardSummary={blockedAttempts:0,patternsTriggered:[],period:`session`},this._securityConfig={},this._providerHealth=[],this._failoverLog=[],this._authCooldowns=[],this._healthReloadDebounce=null,this._controller=null,this._capturedRpcClient=null}static{this.styles=[o,i,n`
+      :host {
+        display: block;
+      }
+
+      .view-header {
+        margin-bottom: var(--ic-space-lg);
+      }
+
+      .view-title {
+        font-size: 1.125rem;
+        font-weight: 600;
+      }
+
+      .state-container {
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 3rem;
+      }
+
+      .error-container {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 0.75rem;
+        padding: 3rem;
+      }
+
+      .error-message {
+        color: var(--ic-error);
+        font-size: var(--ic-text-sm);
+      }
+
+      .retry-btn {
+        padding: 0.5rem 1rem;
+        background: var(--ic-surface-2);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        color: var(--ic-text-muted);
+        font-size: var(--ic-text-sm);
+        cursor: pointer;
+        font-family: inherit;
+      }
+
+      .retry-btn:hover {
+        background: var(--ic-border);
+      }
+
+      .tab-content {
+        margin-top: var(--ic-space-md);
+      }
+
+      .section-header {
+        font-size: var(--ic-text-base);
+        font-weight: 600;
+        color: var(--ic-text);
+        margin-top: var(--ic-space-lg);
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .section-header:first-child {
+        margin-top: 0;
+      }
+
+      /* Secrets tab styles */
+      .policy-section {
+        margin-bottom: var(--ic-space-xl);
+        max-width: 40rem;
+      }
+
+      .tls-row {
+        display: flex;
+        align-items: center;
+        gap: var(--ic-space-sm);
+        font-size: var(--ic-text-sm);
+      }
+
+      .tls-label {
+        font-weight: 500;
+        color: var(--ic-text-muted);
+        min-width: 6rem;
+      }
+
+      .tls-value {
+        font-family: ui-monospace, monospace;
+        color: var(--ic-text);
+        font-size: var(--ic-text-xs);
+      }
+
+      /* Provider Health tab */
+      .health-grid {
+        display: grid;
+        grid-template-columns: 1fr;
+        gap: var(--ic-space-md);
+      }
+
+      @media (min-width: 768px) {
+        .health-grid {
+          grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+        }
+      }
+
+      .health-card {
+        background: var(--ic-surface);
+        border: 1px solid var(--ic-border);
+        border-radius: var(--ic-radius-md);
+        padding: var(--ic-space-md);
+      }
+
+      .health-card-header {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        margin-bottom: var(--ic-space-sm);
+      }
+
+      .health-card-header strong {
+        font-size: var(--ic-text-sm);
+      }
+
+      .health-card-stat {
+        font-size: var(--ic-text-sm);
+        color: var(--ic-text-muted);
+        margin-top: var(--ic-space-xs);
+      }
+
+      .failover-log {
+        max-height: 300px;
+        overflow-y: auto;
+        margin-top: var(--ic-space-md);
+      }
+
+      .failover-entry {
+        display: flex;
+        flex-direction: row;
+        gap: var(--ic-space-sm);
+        padding: var(--ic-space-sm);
+        border-bottom: 1px solid var(--ic-border);
+        font-size: var(--ic-text-sm);
+        align-items: center;
+        flex-wrap: wrap;
+      }
+
+      .cooldown-list {
+        display: flex;
+        flex-direction: column;
+        gap: var(--ic-space-sm);
+        margin-top: var(--ic-space-md);
+      }
+
+      .cooldown-entry {
+        display: flex;
+        gap: var(--ic-space-sm);
+        align-items: center;
+        font-size: var(--ic-text-sm);
+      }
+    `]}_ensureController(){return this._controller&&this._capturedRpcClient!==this.rpcClient&&(this.removeController(this._controller),this._controller=null,this._capturedRpcClient=null),!this._controller&&this.rpcClient&&(this._capturedRpcClient=this.rpcClient,this._controller=h(this,this.rpcClient)),this._controller}_scheduleHealthReload(e=300){this._healthReloadDebounce!==null&&d(this._healthReloadDebounce),this._healthReloadDebounce=f(()=>{this._healthReloadDebounce=null,this._loadProviderHealth()},e)}connectedCallback(){super.connectedCallback(),this._ensureController(),this._initSse()}disconnectedCallback(){super.disconnectedCallback(),this._healthReloadDebounce!==null&&(d(this._healthReloadDebounce),this._healthReloadDebounce=null)}updated(e){e.has(`rpcClient`)&&this.rpcClient&&(this._ensureController(),this._loadData()),e.has(`eventDispatcher`)&&this.eventDispatcher&&!this._sse&&this._initSse()}get _eventFeed(){return this.shadowRoot?.querySelector(`ic-security-event-feed`)??null}get _approvalQueue(){return this.shadowRoot?.querySelector(`ic-approval-queue`)??null}_initSse(){!this.eventDispatcher||this._sse||(this._sse=new m(this,this.eventDispatcher,{"audit:event":e=>{this._eventFeed?.onAuditEvent(e);let t=e;if(t.actionType===`output_guard`){let e=t.metadata??{},n=e.action,r=n===`redacted`?`high`:`medium`,i=e.findingCount??0,a={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`output_guard`,severity:r,message:`Output guard ${n??`scan`}: ${i} finding(s)`,details:{findingTypes:e.findingTypes,severities:e.severities,action:e.action,context:e.context},timestamp:t.timestamp??u(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,j)}},"approval:requested":e=>{this._approvalQueue?.onApprovalPending(e)},"approval:resolved":e=>{this._approvalQueue?.onApprovalResolved(e)},"security:injection_detected":e=>{let t=e,n={high:`high`,medium:`medium`,low:`low`}[t.riskLevel??`medium`]??`medium`,r=t.source??`unknown`,i=t.patterns??[],a={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`injection`,severity:n,message:`Injection detected from ${r}`,details:{patterns:i,source:r,sessionKey:t.sessionKey},timestamp:u(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,j);let o=[...new Set([...this._inputGuardSummary.patternsTriggered,...i])];this._inputGuardSummary={...this._inputGuardSummary,blockedAttempts:this._inputGuardSummary.blockedAttempts+1,patternsTriggered:o}},"security:injection_rate_exceeded":e=>{let t=e,n=t.count??0,r=t.threshold??0,i=t.action??`block`,a={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`input_guard`,severity:`critical`,message:`Rate limit exceeded: ${n}/${r} (action: ${i})`,details:{sessionKey:t.sessionKey,count:n,threshold:r,action:i},timestamp:u()};this._securityEvents=[a,...this._securityEvents].slice(0,j)},"security:memory_tainted":e=>{let t=e,n=t.blocked??!1,r=t.originalTrustLevel??`unknown`,i=t.adjustedTrustLevel??`unknown`,a={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`memory_tainted`,severity:n?`high`:`medium`,message:`Memory tainted for ${t.agentId??`unknown`}: ${r} -> ${i}`,details:{patterns:t.patterns,blocked:n,originalTrustLevel:r,adjustedTrustLevel:i},timestamp:u(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,j)},"security:warn":e=>{let t=e,n={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`warn`,severity:`medium`,message:t.message??`Security warning`,details:{category:t.category},timestamp:u(),agentId:t.agentId};this._securityEvents=[n,...this._securityEvents].slice(0,j)},"secret:accessed":e=>{let t=e,n=t.outcome??`unknown`,r={denied:`high`,not_found:`medium`,success:`low`}[n]??`medium`,i=t.secretName??`unknown`,a={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`secret_access`,severity:r,message:`Secret '${i}' ${n} by ${t.agentId??`unknown`}`,details:{secretName:i,outcome:n},timestamp:u(),agentId:t.agentId};this._securityEvents=[a,...this._securityEvents].slice(0,j)},"secret:modified":e=>{let t=e,n=t.secretName??`unknown`,r=t.action??`modified`,i={id:`sec-${u()}-${Math.random().toString(36).slice(2,6)}`,type:`secret_access`,severity:`medium`,message:`Secret '${n}' ${r}`,details:{secretName:n,action:r},timestamp:u()};this._securityEvents=[i,...this._securityEvents].slice(0,j)},"provider:degraded":e=>{let t=e.provider??``;this._providerHealth=this._providerHealth.map(e=>e.providerId===t?{...e,status:`degraded`}:e),this._scheduleHealthReload()},"provider:recovered":e=>{let t=e.provider??``;this._providerHealth=this._providerHealth.map(e=>e.providerId===t?{...e,status:`healthy`}:e),this._scheduleHealthReload()},"model:auth_cooldown":e=>{let t=e,n={keyName:t.keyName,provider:t.provider,cooldownMs:t.cooldownMs,failureCount:t.failureCount,timestamp:t.timestamp};this._authCooldowns=[n,...this._authCooldowns].slice(0,50),this._scheduleHealthReload(500)},"model:fallback_attempt":e=>{let t=e,n={fromProvider:t.fromProvider,fromModel:t.fromModel,toProvider:t.toProvider,toModel:t.toModel,error:t.error,attemptNumber:t.attemptNumber,timestamp:t.timestamp};this._failoverLog=[n,...this._failoverLog].slice(0,M),this._scheduleHealthReload()},"model:fallback_exhausted":e=>{let t=e,n={provider:t.provider,model:t.model,totalAttempts:t.totalAttempts,timestamp:t.timestamp,exhausted:!0};this._failoverLog=[n,...this._failoverLog].slice(0,M),this._scheduleHealthReload()},"observability:token_usage":()=>{this._scheduleHealthReload(500)}}))}async _loadProviderHealth(){let e=this._ensureController();if(e)try{let t=await e.getProviderCacheStats(),n=u(),r=n-300*1e3,i=(t.providers??[]).map(e=>{let t=this._failoverLog.filter(t=>t.fromProvider===e.provider||t.provider===e.provider),i=t.length>0?Math.max(...t.map(e=>e.timestamp)):void 0,a=`healthy`,o=this._authCooldowns.find(t=>t.provider===e.provider&&t.timestamp+t.cooldownMs>n);return o&&(a=`degraded`),this._failoverLog.find(t=>t.exhausted===!0&&t.provider===e.provider&&t.timestamp>r)&&(a=`down`),{providerId:e.provider,name:e.provider,status:a,cacheHitRate:e.cacheHitRate,failoverCount:t.length,lastFailover:i,authCooldownUntil:o?o.timestamp+o.cooldownMs:void 0}});this._providerHealth=i}catch{}}async _loadData(){let e=this._ensureController();if(e){this._loadState=`loading`,this._error=``;try{let t=await e.readConfig();this._securityConfig=t.config.security??{},this._loadState=`loaded`,this._loadProviderHealth()}catch(e){this._error=e instanceof Error?e.message:`Failed to load security configuration`,this._loadState=`error`}}}async _patchConfig(e,t){let n=this._ensureController();if(!n)return!1;try{let r=e.indexOf(`.`),i=r>0?e.slice(0,r):e,a=r>0?e.slice(r+1):void 0;return await n.patchConfig(i,a,t),p.show(`Configuration updated`,`success`),!0}catch(e){let t=e instanceof Error?e.message:`Failed to update configuration`;return p.show(t,`error`),!1}}async _onSecretsEnabledChange(e){let t={...this._securityConfig.secrets,enabled:e};await this._patchConfig(`security.secrets`,t)&&(this._securityConfig={...this._securityConfig,secrets:t})}_renderSecretsTab(){let e=this._securityConfig.secrets??{};return t`
+      <div class="policy-section">
+        <div class="section-header">Encrypted Secrets Store</div>
+        <ic-toggle
+          label="Enabled"
+          .checked=${e.enabled??!1}
+          @change=${e=>this._onSecretsEnabledChange(e.detail)}
+        ></ic-toggle>
+        <div style="margin-top: var(--ic-space-md);">
+          <div class="tls-row">
+            <span class="tls-label">DB Path</span>
+            <span class="tls-value">${e.dbPath??`secrets.db`}</span>
+          </div>
+        </div>
+      </div>
+    `}_statusToDotStatus(e){switch(e){case`healthy`:return`connected`;case`degraded`:return`reconnecting`;case`down`:return`disconnected`;default:return`disconnected`}}_renderHealthTab(){let e=u(),n=this._authCooldowns.filter(t=>t.timestamp+t.cooldownMs>e);return t`
+      <div class="section-header">Provider Status</div>
+      ${this._providerHealth.length===0?t`<ic-empty-state icon="cloud" message="No provider data" description="Provider health data will appear after LLM calls are made."></ic-empty-state>`:t`
+            <div class="health-grid">
+              ${this._providerHealth.map(n=>t`
+                  <div class="health-card">
+                    <div class="health-card-header">
+                      <strong>${n.name}</strong>
+                      <ic-connection-dot
+                        status=${this._statusToDotStatus(n.status)}
+                        size="8px"
+                      ></ic-connection-dot>
+                    </div>
+                    <ic-progress-bar
+                      .value=${Math.round(n.cacheHitRate*100)}
+                      label="Cache Hit Rate"
+                      .thresholds=${{green:101,yellow:102}}
+                    ></ic-progress-bar>
+                    <div class="health-card-stat">
+                      Failovers: ${n.failoverCount}
+                      ${n.lastFailover?t` &mdash; last <ic-relative-time .timestamp=${n.lastFailover}></ic-relative-time>`:l}
+                    </div>
+                    ${n.authCooldownUntil&&n.authCooldownUntil>e?t`
+                          <div class="health-card-stat">
+                            <ic-tag variant="warning">Auth cooldown</ic-tag>
+                            ${Math.ceil((n.authCooldownUntil-e)/1e3)}s remaining
+                          </div>
+                        `:l}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Failover Event Log</div>
+      ${this._failoverLog.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No failover events recorded</p>`:t`
+            <div class="failover-log">
+              ${this._failoverLog.map(e=>t`
+                  <div class="failover-entry">
+                    <ic-relative-time .timestamp=${e.timestamp}></ic-relative-time>
+                    ${e.exhausted?t`
+                          <span>${e.provider??`unknown`} exhausted after ${e.totalAttempts??`?`} attempts</span>
+                          <ic-tag variant="error">EXHAUSTED</ic-tag>
+                        `:t`
+                          <span>${e.fromProvider??`?`}/${e.fromModel??`?`} &rarr; ${e.toProvider??`?`}/${e.toModel??`?`}</span>
+                          ${e.attemptNumber==null?l:t`<ic-tag variant="info">#${e.attemptNumber}</ic-tag>`}
+                          ${e.error?t`<span style="color: var(--ic-text-dim);">${e.error}</span>`:l}
+                        `}
+                  </div>
+                `)}
+            </div>
+          `}
+
+      <div class="section-header" style="margin-top: var(--ic-space-xl);">Auth Cooldowns</div>
+      ${n.length===0?t`<p style="font-size: var(--ic-text-sm); color: var(--ic-text-dim); font-style: italic;">No active cooldowns</p>`:t`
+            <div class="cooldown-list">
+              ${n.map(n=>t`
+                  <div class="cooldown-entry">
+                    <ic-tag variant="warning">${n.provider}</ic-tag>
+                    <span>${n.keyName}</span>
+                    <span style="color: var(--ic-text-dim);">${n.failureCount} failures</span>
+                    <span>${Math.ceil((n.timestamp+n.cooldownMs-e)/1e3)}s remaining</span>
+                  </div>
+                `)}
+            </div>
+          `}
+    `}_renderTabContent(){switch(this._activeTab){case`events`:return t`<ic-security-event-feed
+          activeSubTab="events"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case`audit`:return t`<ic-security-event-feed
+          activeSubTab="audit"
+          .securityEvents=${this._securityEvents}
+          .inputGuardSummary=${this._inputGuardSummary}
+        ></ic-security-event-feed>`;case`tokens`:return t`<ic-token-manager .rpc=${this.rpcClient}></ic-token-manager>`;case`secrets`:return this._renderSecretsTab();case`rules`:return t`<ic-approval-queue
+          activeSubTab="rules"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case`pending`:return t`<ic-approval-queue
+          activeSubTab="pending"
+          .rpc=${this.rpcClient}
+          .securityConfig=${this._securityConfig}
+        ></ic-approval-queue>`;case`health`:return this._renderHealthTab();default:return l}}render(){return this._loadState===`loading`?t`<ic-skeleton-view variant="list"></ic-skeleton-view>`:this._loadState===`error`?t`
+        <div class="error-container">
+          <span class="error-message">${this._error}</span>
+          <button class="retry-btn" @click=${()=>this._loadData()}>Retry</button>
+        </div>
+      `:t`
+      <div class="view-header">
+        <div class="view-title">Security</div>
+      </div>
+      <ic-tabs
+        .tabs=${N}
+        .activeTab=${this._activeTab}
+        @tab-change=${e=>{this._activeTab=e.detail}}
+      ></ic-tabs>
+      <div class="tab-content">
+        ${this._renderTabContent()}
+      </div>
+    `}};c([s({attribute:!1})],P.prototype,`rpcClient`,void 0),c([s({attribute:!1})],P.prototype,`apiClient`,void 0),c([s({attribute:!1})],P.prototype,`eventDispatcher`,void 0),c([a()],P.prototype,`_loadState`,void 0),c([a()],P.prototype,`_error`,void 0),c([a()],P.prototype,`_activeTab`,void 0),c([a()],P.prototype,`_securityEvents`,void 0),c([a()],P.prototype,`_inputGuardSummary`,void 0),c([a()],P.prototype,`_securityConfig`,void 0),c([a()],P.prototype,`_providerHealth`,void 0),c([a()],P.prototype,`_failoverLog`,void 0),c([a()],P.prototype,`_authCooldowns`,void 0),P=c([e(`ic-security-view`)],P);export{P as IcSecurityView};