@byok-sdk/client 0.15.0 → 0.17.0

package/dist/bin/byok-agent.js

@@ -2379,7 +2379,7 @@ function resolveLocalAgentReleaseIdentity(input) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.15.0"
+  version: "0.17.0"
 });
 
 // src/bin/config.ts
@@ -14266,6 +14266,10 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
       this.revokedTasks.add(taskId);
     });
   }
+  /** The same terminal classification used by operator receipts and archival. */
+  terminalRecords() {
+    return Object.freeze(this.records().filter((record4) => this.isTerminalEvidence(record4.taskId)));
+  }
   isTerminalEvidence(taskId) {
     return this.revokedTasks.has(taskId) || this.dispositionByTask.get(taskId)?.outcome === "refused";
   }
@@ -14357,7 +14361,7 @@ var AgentMessageOutbox = class _AgentMessageOutbox {
   async archiveTerminalRecords(archiveDirectory) {
     return this.exclusive(async () => {
       if (!path14__default.isAbsolute(archiveDirectory)) throw new AgentMessageOutboxError("message archive directory must be absolute");
-      const terminal = this.records().filter((record4) => this.isTerminalEvidence(record4.taskId));
+      const terminal = this.terminalRecords();
       if (terminal.length === 0) return void 0;
       await ensureSecureDir(archiveDirectory);
       const archivePath = path14__default.join(archiveDirectory, `message-terminal-${randomUUID()}.jsonl`);
@@ -22910,1004 +22914,1192 @@ async function repairDeviceEnrollmentMetadata(config, input) {
     throw new DeviceMetadataRepairError(failureCode);
   }
 }
-
-// src/bin/format.ts
-function quote(text) {
-  return JSON.stringify(text);
+function auditLogPath(storeDir) {
+  return path14__default.join(storeDir, "audit.jsonl");
 }
-function redactedByteCountPlaceholder(text) {
-  return `[redacted: ${Buffer.byteLength(text, "utf8")} bytes]`;
+var AUDIT_LOG_MODE = 384;
+var AUDIT_STORE_DIR_MODE = 448;
+var MAX_AUDIT_LOG_BYTES = 10 * 1024 * 1024;
+var AUDIT_LOG_TRIM_TARGET_LINES = 5e3;
+var MAX_LIVE_TASK_ANCHORS = 500;
+function byteSize(text) {
+  return text === void 0 ? void 0 : Buffer.byteLength(text, "utf8");
+}
+function valueByteSize(value) {
+  if (value === void 0) return void 0;
+  try {
+    const json = JSON.stringify(value);
+    return json === void 0 ? void 0 : Buffer.byteLength(json, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function placeholderFor(size, spilled) {
+  const suffix = spilled ? ", spilled" : "";
+  return size === void 0 ? `[redacted${suffix}]` : `[redacted: ${size} bytes${suffix}]`;
 }
 var STABLE_GIT_ERROR_CATEGORIES = new Set(GIT_ERROR_CATEGORIES);
 function stableGitErrorCategory(value) {
-  return value !== void 0 && STABLE_GIT_ERROR_CATEGORIES.has(value) ? value : void 0;
+  return typeof value === "string" && STABLE_GIT_ERROR_CATEGORIES.has(value) ? value : void 0;
 }
-function formatAgentEvent(event) {
+function gitCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function gitDirty(value) {
+  const dirty = asRecord2(value);
+  const staged = gitCount(dirty.staged);
+  const unstaged = gitCount(dirty.unstaged);
+  const untracked = gitCount(dirty.untracked);
+  const conflicted = gitCount(dirty.conflicted);
+  return staged !== void 0 && unstaged !== void 0 && untracked !== void 0 && conflicted !== void 0 ? { staged, unstaged, untracked, conflicted } : void 0;
+}
+function redactAgentEvent(event) {
   switch (event.type) {
     case "progress":
-      return `progress: ${quote(event.text)}`;
+      return { type: "progress", textSize: byteSize(event.text) };
     case "tool_use":
-      return `tool_use: ${event.tool}`;
+      return event.spill !== void 0 ? { type: "tool_use", tool: event.tool, inputSize: event.spill.totalBytes, inputSpilled: true } : { type: "tool_use", tool: event.tool, inputSize: valueByteSize(event.input) };
     case "tool_result":
-      return `tool_result: ${event.tool}`;
+      return event.spill !== void 0 ? { type: "tool_result", tool: event.tool, outputSize: event.spill.totalBytes, outputSpilled: true } : { type: "tool_result", tool: event.tool, outputSize: valueByteSize(event.output) };
     case "artifact":
-      return `artifact: ${event.name} (${event.contentType})`;
+      return { type: "artifact", name: event.name, contentType: event.contentType };
     case "needs_approval":
-      return `needs_approval: ${quote(event.summary)}`;
+      return { type: "needs_approval", summarySize: byteSize(event.summary) };
     case "turn_end":
-      return "turn_end";
+      return { type: "turn_end" };
     case "error":
-      return `error: ${quote(event.message)}`;
-    case "usage": {
-      const parts = [];
-      if (event.inputTokens !== void 0) parts.push(`in=${event.inputTokens}`);
-      if (event.outputTokens !== void 0) parts.push(`out=${event.outputTokens}`);
-      if (event.totalTokens !== void 0) parts.push(`total=${event.totalTokens}`);
-      return `usage: ${parts.length ? parts.join(" ") : "(no fields reported)"}`;
-    }
+      return { type: "error", messageSize: byteSize(event.message) };
+    case "usage":
+      return {
+        type: "usage",
+        inputTokens: event.inputTokens,
+        cachedInputTokens: event.cachedInputTokens,
+        outputTokens: event.outputTokens,
+        reasoningTokens: event.reasoningTokens,
+        totalTokens: event.totalTokens
+      };
   }
 }
-function formatDaemonEventLine(event, options = {}) {
-  const prefix = `[${event.ts}]`;
+function redactForAudit(event) {
+  const base = { kind: event.kind, ts: event.ts };
   switch (event.kind) {
     case "offered":
-      return `${prefix} offered taskId=${event.taskId}${event.runtime ? ` runtime=${event.runtime}` : ""}`;
+      return { ...base, taskId: event.taskId, runtime: event.runtime };
     case "claimed":
-      return `${prefix} claimed taskId=${event.taskId}${event.claimedRuntime !== void 0 ? ` claimedRuntime=${event.claimedRuntime}` : ""}`;
+      return { ...base, taskId: event.taskId, claimedRuntime: event.claimedRuntime };
     case "started":
-      return `${prefix} started taskId=${event.taskId}`;
+      return { ...base, taskId: event.taskId };
     case "progress":
-      return `${prefix} progress taskId=${event.taskId} ${formatAgentEvent(event.event)}`;
+      return { ...base, taskId: event.taskId, event: redactAgentEvent(event.event) };
     case "artifact":
-      return `${prefix} artifact taskId=${event.taskId} name=${event.name} contentType=${event.contentType}`;
-    case "awaiting-approval": {
-      const summary = options.redactApprovalSummary ? redactedByteCountPlaceholder(event.summary) : event.summary;
-      return `${prefix} awaiting-approval taskId=${event.taskId}${event.approvalId ? ` approvalId=${event.approvalId}` : ""} summary=${quote(summary)}`;
-    }
+      return {
+        ...base,
+        taskId: event.taskId,
+        name: event.name,
+        contentType: event.contentType,
+        // `inline` is base64 file bytes (up to the 64KB inline cap) — never
+        // persisted. `blobRef.url` is a presigned URL — itself effectively a
+        // time-limited bearer credential for the actual bytes, so it's
+        // dropped too; only the safe pointer/size metadata survives.
+        inlineSize: byteSize(event.inline),
+        blobRef: event.blobRef ? {
+          blobId: event.blobRef.blobId,
+          contentHash: event.blobRef.contentHash,
+          size: event.blobRef.size,
+          contentType: event.blobRef.contentType
+        } : void 0
+      };
+    case "awaiting-approval":
+      return { ...base, taskId: event.taskId, summarySize: byteSize(event.summary) };
     case "completed":
-      return `${prefix} completed taskId=${event.taskId} sessionRef=${event.sessionRef} summary=${quote(event.summary)}`;
+      return { ...base, taskId: event.taskId, summarySize: byteSize(event.summary), sessionRef: event.sessionRef };
     case "failed":
-      return `${prefix} failed taskId=${event.taskId} retryable=${event.retryable}${event.preClaim ? " preClaim=true" : ""} reason=${quote(event.reason)}`;
+      return {
+        ...base,
+        taskId: event.taskId,
+        reasonSize: byteSize(event.reason),
+        retryable: event.retryable,
+        preClaim: event.preClaim
+      };
     case "cancelled":
-      return `${prefix} cancelled taskId=${event.taskId}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+      return { ...base, taskId: event.taskId, reasonSize: byteSize(event.reason) };
     case "connection":
-      return `${prefix} connection state=${event.state}`;
+      return { ...base, state: event.state };
     case "paired":
-      return `${prefix} paired deviceId=${event.deviceId}`;
+      return { ...base, deviceId: event.deviceId };
     case "unpaired":
-      return `${prefix} unpaired`;
+      return { ...base };
     case "runtimes-detected":
-      return `${prefix} runtimes-detected ids=${event.runtimes.map((r) => r.id).join(",") || "(none)"}`;
+      return { ...base, runtimes: event.runtimes };
     case "shutdown-requested":
-      return `${prefix} shutdown-requested reason=${quote(event.reason)}`;
+      return { ...base, reason: event.reason };
     case "shutdown-complete":
-      return `${prefix} shutdown-complete reason=${quote(event.reason)}${event.undeliveredOutboxCount !== void 0 ? ` undeliveredOutboxCount=${event.undeliveredOutboxCount}` : ""}`;
+      return { ...base, reason: event.reason, undeliveredOutboxCount: event.undeliveredOutboxCount };
     case "stale-approval-decision":
-      return `${prefix} stale-approval-decision taskId=${event.taskId} decision=${event.decision}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+      return { ...base, taskId: event.taskId, decision: event.decision, reasonSize: byteSize(event.reason) };
     case "runtime-disposal-failed":
-      return `${prefix} runtime-disposal-failed taskId=${event.taskId} runtime=${event.runtimeId} stage=${event.stage} reason=${quote(event.reason)}`;
-    case "git-workspace": {
-      const parts = [
-        `${prefix} git-workspace taskId=${event.taskId}`,
-        `workspaceId=${event.workspaceId}`,
-        `phase=${event.phase}`,
-        event.headChanged !== void 0 ? `headChanged=${event.headChanged}` : void 0,
-        event.commitsSinceBaseline !== void 0 ? `commits=${event.commitsSinceBaseline}` : void 0,
-        event.dirty ? `dirty=${event.dirty.staged}/${event.dirty.unstaged}/${event.dirty.untracked}/${event.dirty.conflicted}` : void 0,
-        stableGitErrorCategory(event.errorCategory) ? `errorCategory=${stableGitErrorCategory(event.errorCategory)}` : void 0
-      ].filter((part) => part !== void 0);
-      return parts.join(" ");
-    }
-    case "device-assertion": {
-      const parts = event.result === "issued" ? [
-        `${prefix} device-assertion result=issued`,
-        `audience=${quote(event.audience)}`,
-        `jti=${event.jti}`,
-        `expiresAt=${event.expiresAt}`
-      ] : [
-        `${prefix} device-assertion result=denied`,
-        `reason=${event.reason}`,
-        event.audienceSize !== void 0 ? `audienceSize=${event.audienceSize}` : void 0
-      ].filter((part) => part !== void 0);
-      return parts.join(" ");
-    }
+      return { ...base, taskId: event.taskId, runtimeId: event.runtimeId, stage: event.stage, reason: event.reason };
+    case "device-assertion":
+      return event.result === "issued" ? {
+        ...base,
+        result: "issued",
+        audience: event.audience,
+        jti: event.jti,
+        expiresAt: event.expiresAt
+      } : { ...base, result: "denied", reason: event.reason, audienceSize: event.audienceSize };
+    case "git-workspace":
+      return {
+        ...base,
+        taskId: event.taskId,
+        workspaceId: event.workspaceId,
+        phase: event.phase,
+        headChanged: event.headChanged,
+        commitsSinceBaseline: event.commitsSinceBaseline,
+        dirty: event.dirty,
+        errorCategory: stableGitErrorCategory(event.errorCategory)
+      };
   }
 }
-function formatTaskLine(task) {
-  const git = "git" in task ? task.git : void 0;
-  const gitStatus = git ? [
-    `git=${git.phase}`,
-    git.commitsSinceBaseline !== void 0 ? `commits=${git.commitsSinceBaseline}` : void 0,
-    git.dirty ? `dirty=${git.dirty.staged}/${git.dirty.unstaged}/${git.dirty.untracked}/${git.dirty.conflicted}` : void 0
-  ].filter((part) => part !== void 0).join(" ") : void 0;
-  const parts = [
-    task.taskId,
-    task.state,
-    task.runtime ? `runtime=${task.runtime}` : void 0,
-    gitStatus,
-    task.claimedRuntime !== void 0 ? `claimedRuntime=${task.claimedRuntime}` : void 0,
-    `updatedAt=${task.updatedAt}`,
-    task.sessionRef ? `sessionRef=${task.sessionRef}` : void 0,
-    task.declined ? "declined=true" : void 0,
-    task.summary ? `summary=${quote(task.summary)}` : void 0
-  ].filter((part) => Boolean(part));
-  return parts.join(" ");
+function asRecord2(value) {
+  return value !== null && typeof value === "object" ? value : {};
 }
-function formatTaskListLines(tasks) {
-  if (tasks.length === 0) return ["(no tasks observed yet)"];
-  return tasks.map(formatTaskLine);
+function str(value, fallback = "") {
+  return typeof value === "string" ? value : fallback;
 }
-function formatRuntimeLines(runtimes) {
-  if (runtimes.length === 0) return ["(no runtimes configured \u2014 check runtimeAllowlist)"];
-  return runtimes.map((r) => {
-    if (!r.present) return `${r.id}: ${r.outcome}`;
-    const caps = [];
-    if (r.steer) caps.push("steer");
-    if (r.resume) caps.push("resume");
-    const parts = [
-      "present",
-      r.version ? `version=${r.version}` : void 0,
-      r.authPresent !== void 0 ? `authPresent=${r.authPresent}` : void 0,
-      `capabilities=${caps.length ? caps.join(",") : "(none)"}`,
-      `modes=${r.permissionModes.length ? r.permissionModes.join(",") : "(none)"}`
-    ].filter((part) => Boolean(part));
-    return `${r.id}: ${parts.join(" ")}`;
-  });
+function num(value) {
+  return typeof value === "number" ? value : void 0;
 }
-function formatStatusLines(view) {
-  const lines = [];
-  const label = view.branding?.displayName ?? view.productName;
-  lines.push(`product: ${label} (${view.productId})`);
-  lines.push(
-    `local-agent-release: ${view.localAgentRelease.version}${view.localAgentRelease.buildId ? ` buildId=${view.localAgentRelease.buildId}` : ""}`
-  );
-  if (view.branding?.supportUrl) lines.push(`support: ${view.branding.supportUrl}`);
-  lines.push(`paired: ${view.paired ? "yes" : "no"}${view.deviceId ? ` deviceId=${view.deviceId}` : ""}`);
-  lines.push(
-    view.connection ? `connection: last-known=${view.connection.state} at=${view.connection.ts}` : "connection: unknown (no audit log yet \u2014 run `byok-agent start` at least once to begin observing)"
-  );
-  const runtimeSummary = view.runtimes.map((r) => `${r.id}=${r.present ? "present" : r.outcome}`).join(" ");
-  lines.push(`runtimes: ${runtimeSummary || "(none configured)"}`);
-  const c = view.taskCounts;
-  lines.push(
-    `tasks: total=${c.total} offered=${c.Offered} claimed=${c.Claimed} running=${c.Running} awaitApproval=${c.AwaitApproval} complete=${c.Complete} failed=${c.Failed} cancelled=${c.Cancelled}`
-  );
-  lines.push(`audit-log: ${view.auditLogPath} (${view.auditLogLineCount} event${view.auditLogLineCount === 1 ? "" : "s"})`);
-  return lines;
+function bool(value, fallback) {
+  return typeof value === "boolean" ? value : fallback;
 }
-function formatLiveStatusLines(live) {
-  const liveRelease = live.localAgentRelease;
-  const lines = [
-    `live: pid=${live.pid} uptimeMs=${live.uptimeMs} transport=${live.transport}`,
-    liveRelease ? `live-local-agent-release: ${liveRelease.version}${liveRelease.buildId ? ` buildId=${liveRelease.buildId}` : ""}` : "live-local-agent-release: unknown",
-    `live-paired: ${live.paired ? "yes" : "no"}${live.deviceId ? ` deviceId=${live.deviceId}` : ""}`,
-    `live-runtimes: ${live.runtimeIds.length ? live.runtimeIds.join(",") : "(none)"}`,
-    `live-toolsets: revision=${live.toolsets.revision} count=${live.toolsets.toolsets.length}`
-  ];
-  for (const toolset of live.toolsets.toolsets) lines.push(formatToolsetStatusLine("live-toolset", toolset));
-  const health = live.operationalHealth;
-  if (health.availability === "unavailable") {
-    lines.push(`live-operational-health: unavailable reason=${quote(health.reason)}`);
-  } else {
-    lines.push(
-      `live-operational-health: state=${health.state} failures=${health.failureCount}/${health.failureThreshold} windowMs=${health.windowMs} crashes=${health.crashCount}${health.lastCrashAt ? ` lastCrashAt=${health.lastCrashAt}` : ""}`
-    );
+function reconstructAgentEvent(raw) {
+  const r = asRecord2(raw);
+  const type = str(r.type);
+  switch (type) {
+    case "progress":
+      return { type: "progress", text: placeholderFor(num(r.textSize)) };
+    case "tool_use":
+      return { type: "tool_use", tool: str(r.tool), input: placeholderFor(num(r.inputSize), bool(r.inputSpilled, false)) };
+    case "tool_result":
+      return { type: "tool_result", tool: str(r.tool), output: placeholderFor(num(r.outputSize), bool(r.outputSpilled, false)) };
+    case "artifact":
+      return { type: "artifact", name: str(r.name), contentType: str(r.contentType) };
+    case "needs_approval":
+      return { type: "needs_approval", summary: placeholderFor(num(r.summarySize)) };
+    case "turn_end":
+      return { type: "turn_end" };
+    case "error":
+      return { type: "error", message: placeholderFor(num(r.messageSize)) };
+    case "usage":
+      return {
+        type: "usage",
+        inputTokens: num(r.inputTokens),
+        cachedInputTokens: num(r.cachedInputTokens),
+        outputTokens: num(r.outputTokens),
+        reasoningTokens: num(r.reasoningTokens),
+        totalTokens: num(r.totalTokens)
+      };
+    default:
+      return { type: "error", message: `[unrecognized audit event type: ${type || "(missing)"}]` };
   }
-  if (live.activeTasks.length === 0) {
-    lines.push("live-active-tasks: (none)");
-  } else {
-    for (const task of live.activeTasks) {
-      lines.push(`live-active-task: ${task.taskId} ${task.state}`);
+}
+function reconstructDaemonEvent(raw) {
+  const kind = str(raw.kind);
+  const ts = str(raw.ts);
+  switch (kind) {
+    case "offered":
+      return { kind: "offered", ts, taskId: str(raw.taskId), runtime: typeof raw.runtime === "string" ? raw.runtime : void 0 };
+    case "claimed": {
+      const claimedRuntime = typeof raw.claimedRuntime === "string" ? raw.claimedRuntime : void 0;
+      return claimedRuntime === void 0 ? { kind: "claimed", ts, taskId: str(raw.taskId) } : { kind: "claimed", ts, taskId: str(raw.taskId), claimedRuntime };
     }
-  }
-  lines.push(`live-approvals-pending: ${live.approvalsPending}`);
-  if (live.approvals.length === 0) {
-    lines.push("live-approvals: (none)");
-  } else {
-    for (const approval of live.approvals) {
-      lines.push(`live-approval: ${approval.approvalId} taskId=${approval.taskId} summary=${quote(summaryExcerpt(approval.summary))}`);
+    case "started":
+      return { kind: "started", ts, taskId: str(raw.taskId) };
+    case "progress":
+      return { kind: "progress", ts, taskId: str(raw.taskId), event: reconstructAgentEvent(raw.event) };
+    case "artifact": {
+      const blobRefPresent = raw.blobRef !== void 0 && raw.blobRef !== null;
+      const blobRefRaw = asRecord2(raw.blobRef);
+      const blobRef = blobRefPresent ? {
+        blobId: str(blobRefRaw.blobId),
+        contentHash: str(blobRefRaw.contentHash),
+        size: num(blobRefRaw.size) ?? 0,
+        contentType: str(blobRefRaw.contentType)
+      } : void 0;
+      const inlineSize = num(raw.inlineSize);
+      return {
+        kind: "artifact",
+        ts,
+        taskId: str(raw.taskId),
+        name: str(raw.name),
+        contentType: str(raw.contentType),
+        inline: inlineSize === void 0 ? void 0 : placeholderFor(inlineSize),
+        blobRef
+      };
     }
-  }
-  if (live.queueWatermarks.length === 0) {
-    lines.push("live-queue-watermarks: (none)");
-  } else {
-    for (const watermark of live.queueWatermarks) {
-      lines.push(
-        `live-queue-watermark: ${watermark.taskId} progressBatcherPending=${watermark.progressBatcherPending} pendingApprovals=${watermark.pendingApprovals}`
-      );
+    case "awaiting-approval":
+      return { kind: "awaiting-approval", ts, taskId: str(raw.taskId), summary: placeholderFor(num(raw.summarySize)) };
+    case "completed":
+      return {
+        kind: "completed",
+        ts,
+        taskId: str(raw.taskId),
+        summary: placeholderFor(num(raw.summarySize)),
+        sessionRef: str(raw.sessionRef)
+      };
+    case "failed":
+      return {
+        kind: "failed",
+        ts,
+        taskId: str(raw.taskId),
+        reason: placeholderFor(num(raw.reasonSize)),
+        retryable: bool(raw.retryable, false),
+        preClaim: typeof raw.preClaim === "boolean" ? raw.preClaim : void 0
+      };
+    case "cancelled": {
+      const reasonSize = num(raw.reasonSize);
+      return {
+        kind: "cancelled",
+        ts,
+        taskId: str(raw.taskId),
+        reason: reasonSize === void 0 ? void 0 : placeholderFor(reasonSize)
+      };
     }
-  }
-  const storage = live.storage;
-  if (storage !== void 0) {
-    lines.push(
-      `live-storage: state=${storage.pressureState} used=${storage.usedBytes} budget=${storage.budgetBytes} free=${storage.freeBytes} measuredAt=${storage.measuredAt}`
-    );
-    for (const category of storage.categories) {
-      lines.push(`live-storage-category: ${category.category} bytes=${category.bytes}${category.approximate ? " (approximate)" : ""}`);
+    case "connection":
+      return { kind: "connection", ts, state: str(raw.state) };
+    case "paired":
+      return { kind: "paired", ts, deviceId: str(raw.deviceId) };
+    case "unpaired":
+      return { kind: "unpaired", ts };
+    case "runtimes-detected":
+      return { kind: "runtimes-detected", ts, runtimes: Array.isArray(raw.runtimes) ? raw.runtimes : [] };
+    case "shutdown-requested":
+      return { kind: "shutdown-requested", ts, reason: str(raw.reason) };
+    case "shutdown-complete":
+      return { kind: "shutdown-complete", ts, reason: str(raw.reason), undeliveredOutboxCount: num(raw.undeliveredOutboxCount) };
+    case "stale-approval-decision": {
+      const reasonSize = num(raw.reasonSize);
+      return {
+        kind: "stale-approval-decision",
+        ts,
+        taskId: str(raw.taskId),
+        decision: str(raw.decision),
+        reason: reasonSize === void 0 ? void 0 : placeholderFor(reasonSize)
+      };
     }
-    if (storage.lastCompaction) {
-      lines.push(
-        `live-storage-compaction: checkpointed=${storage.lastCompaction.checkpointed} walFramesRemaining=${storage.lastCompaction.walFramesRemaining} pagesVacuumed=${storage.lastCompaction.pagesVacuumed} durationMs=${storage.lastCompaction.durationMs} at=${storage.lastCompaction.at}`
-      );
+    case "runtime-disposal-failed":
+      return {
+        kind: "runtime-disposal-failed",
+        ts,
+        taskId: str(raw.taskId),
+        runtimeId: str(raw.runtimeId),
+        stage: str(raw.stage),
+        reason: str(raw.reason)
+      };
+    case "device-assertion": {
+      if (raw.result === "issued") {
+        return {
+          kind: "device-assertion",
+          ts,
+          result: "issued",
+          audience: typeof raw.audience === "string" ? raw.audience : "",
+          jti: typeof raw.jti === "string" ? raw.jti : "",
+          expiresAt: typeof raw.expiresAt === "string" ? raw.expiresAt : ""
+        };
+      }
+      const audienceSize = num(raw.audienceSize);
+      return {
+        kind: "device-assertion",
+        ts,
+        result: "denied",
+        reason: typeof raw.reason === "string" ? raw.reason : "",
+        ...audienceSize === void 0 ? {} : { audienceSize }
+      };
+    }
+    case "git-workspace": {
+      const commitsSinceBaseline = gitCount(raw.commitsSinceBaseline);
+      const dirty = gitDirty(raw.dirty);
+      return {
+        kind: "git-workspace",
+        ts,
+        taskId: str(raw.taskId),
+        workspaceId: str(raw.workspaceId),
+        phase: str(raw.phase),
+        headChanged: typeof raw.headChanged === "boolean" ? raw.headChanged : void 0,
+        commitsSinceBaseline,
+        dirty,
+        errorCategory: stableGitErrorCategory(raw.errorCategory)
+      };
     }
+    default:
+      return void 0;
   }
-  return lines;
 }
-function formatToolsetStatusLine(prefix, toolset) {
-  const observation = toolset.observation;
-  return [
-    `${prefix}: ${toolset.id}`,
-    `servers=${toolset.serverCount}`,
-    `definitionRevision=${toolset.definitionRevision}`,
-    `state=${observation?.state ?? "unobserved"}`,
-    observation?.version === void 0 ? void 0 : `version=${quote(observation.version)}`,
-    observation?.observedAt === void 0 ? void 0 : `observedAt=${observation.observedAt}`,
-    observation?.reasonCode === void 0 ? void 0 : `reasonCode=${observation.reasonCode}`
-  ].filter((part) => part !== void 0).join(" ");
-}
-function formatToolsetsReloadReceiptLines(receipt) {
-  return [
-    `toolsets-reload: changed=${receipt.changed ? "yes" : "no"} previousRevision=${receipt.previousRevision} revision=${receipt.revision}`,
-    ...receipt.toolsets.map((toolset) => formatToolsetStatusLine("toolset", toolset))
-  ];
-}
-var SUMMARY_EXCERPT_MAX_LEN = 60;
-function summaryExcerpt(summary) {
-  if (!summary) return "(no summary)";
-  return summary.length > SUMMARY_EXCERPT_MAX_LEN ? `${summary.slice(0, SUMMARY_EXCERPT_MAX_LEN)}\u2026` : summary;
-}
-function formatAge(ms) {
-  const totalSeconds = Math.floor(Math.max(0, ms) / 1e3);
-  if (totalSeconds < 60) return `${totalSeconds}s`;
-  const totalMinutes = Math.floor(totalSeconds / 60);
-  if (totalMinutes < 60) return `${totalMinutes}m`;
-  const totalHours = Math.floor(totalMinutes / 60);
-  if (totalHours < 24) return `${totalHours}h`;
-  const totalDays = Math.floor(totalHours / 24);
-  return `${totalDays}d`;
-}
-function formatApprovalsListLines(approvals, nowMs) {
-  if (approvals.length === 0) return ["(no pending approvals)"];
-  return approvals.map((approval) => {
-    const ageMs = nowMs - Date.parse(approval.createdAt);
-    return `${approval.approvalId} taskId=${approval.taskId} age=${formatAge(ageMs)} summary=${quote(summaryExcerpt(approval.summary))}`;
+async function appendAuditEvent(storeDir, event) {
+  await promises.mkdir(storeDir, { recursive: true, mode: AUDIT_STORE_DIR_MODE });
+  await promises.chmod(storeDir, AUDIT_STORE_DIR_MODE).catch(() => {
   });
-}
-
-// src/bin/commands/approvals.ts
-async function runApprovalsCommand(storeDir, productId, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const error = deps.error ?? ((line) => console.error(line));
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const now = deps.now ?? (() => Date.now());
-  const conn = await connectControl({ storeDir, productId });
-  if (!conn.ok) {
-    const message = `cannot list approvals: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
-    error(message);
-    throw new Error(message);
-  }
+  const filePath = auditLogPath(storeDir);
+  const line = `${JSON.stringify(redactForAudit(event))}
+`;
+  const handle = await promises.open(filePath, "a", AUDIT_LOG_MODE);
   try {
-    const result = await conn.client.request("approvals.list");
-    for (const line of formatApprovalsListLines(result.approvals, now())) log(line);
-  } catch (err) {
-    if (err instanceof ControlError) {
-      error(`approvals list failed: ${err.message}`);
-    } else {
-      error(`approvals list failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    throw err;
+    await handle.chmod(AUDIT_LOG_MODE);
+    await handle.appendFile(line, "utf8");
   } finally {
-    conn.client.close();
+    await handle.close();
   }
+  await rotateIfNeeded(filePath);
 }
-
-// src/bin/commands/approve-reject.ts
-async function runApproveCommand(storeDir, productId, approvalId, deps = {}) {
-  return resolveApproval(storeDir, productId, approvalId, "approve", void 0, deps);
+var TERMINAL_EVENT_KINDS = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+function eventTaskId(event) {
+  if (event.kind === "git-workspace") return void 0;
+  return "taskId" in event ? event.taskId : void 0;
 }
-async function runRejectCommand(storeDir, productId, approvalId, reason, deps = {}) {
-  return resolveApproval(storeDir, productId, approvalId, "reject", reason, deps);
+function compactPreservingLiveTasks(lines, targetLines) {
+  if (lines.length <= targetLines) return [...lines];
+  const cutIndex = lines.length - targetLines;
+  const hasTerminalEvent = /* @__PURE__ */ new Set();
+  const lastIndexForTask = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line === void 0) continue;
+    const event = parseAuditLine(line);
+    if (!event) continue;
+    const taskId = eventTaskId(event);
+    if (taskId === void 0) continue;
+    lastIndexForTask.set(taskId, i);
+    if (TERMINAL_EVENT_KINDS.has(event.kind)) hasTerminalEvent.add(taskId);
+  }
+  let anchorIndices = [];
+  for (const [taskId, lastIndex] of lastIndexForTask) {
+    if (hasTerminalEvent.has(taskId)) continue;
+    if (lastIndex < cutIndex) anchorIndices.push(lastIndex);
+  }
+  anchorIndices.sort((a, b) => a - b);
+  if (anchorIndices.length > MAX_LIVE_TASK_ANCHORS) {
+    const totalCandidates = anchorIndices.length;
+    const droppedCount = totalCandidates - MAX_LIVE_TASK_ANCHORS;
+    anchorIndices = anchorIndices.slice(-MAX_LIVE_TASK_ANCHORS);
+    console.warn(
+      `[byok/client] audit log rotation: ${totalCandidates} non-terminal task lifecycle anchors exceeded MAX_LIVE_TASK_ANCHORS (${MAX_LIVE_TASK_ANCHORS}) \u2014 dropped the oldest ${droppedCount}, kept the most recently-touched ${MAX_LIVE_TASK_ANCHORS}; dropped tasks will stop appearing in tasks/status once their own events age out of the retained tail`
+    );
+  }
+  return [...anchorIndices.map((i) => lines[i]), ...lines.slice(cutIndex)].filter((l) => l !== void 0);
 }
-async function resolveApproval(storeDir, productId, approvalId, decision, reason, deps) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const error = deps.error ?? ((line) => console.error(line));
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const verb = decision === "approve" ? "approved" : "rejected";
-  const conn = await connectControl({ storeDir, productId });
-  if (!conn.ok) {
-    const message = `cannot ${decision} approvalId=${approvalId}: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
-    error(message);
-    throw new Error(message);
+async function rotateIfNeeded(filePath) {
+  let size;
+  try {
+    size = (await promises.stat(filePath)).size;
+  } catch {
+    return;
   }
+  if (size <= MAX_AUDIT_LOG_BYTES) return;
+  const lines = await readCompleteLines(filePath);
+  const kept = compactPreservingLiveTasks(lines, AUDIT_LOG_TRIM_TARGET_LINES);
+  const content = kept.length > 0 ? `${kept.join("\n")}
+` : "";
+  await atomicWriteFile(filePath, content, { mode: AUDIT_LOG_MODE });
+}
+function createAuditAppender(storeDir, onError = () => {
+}) {
+  let chain = Promise.resolve();
+  return (event) => {
+    chain = chain.then(() => appendAuditEvent(storeDir, event)).catch(onError);
+  };
+}
+function isAuditRecordShaped(value) {
+  return typeof value === "object" && value !== null && typeof value.kind === "string" && typeof value.ts === "string";
+}
+function parseAuditLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return void 0;
   try {
-    await conn.client.request("approvals.resolve", { approvalId, decision, reason });
-    log(`${verb}: approvalId=${approvalId}${reason ? ` reason=${JSON.stringify(reason)}` : ""}`);
+    const parsed = JSON.parse(trimmed);
+    if (!isAuditRecordShaped(parsed)) return void 0;
+    return reconstructDaemonEvent(parsed);
+  } catch {
+    return void 0;
+  }
+}
+function completeLines(raw) {
+  const parts = raw.split("\n");
+  parts.pop();
+  return parts;
+}
+async function readCompleteLines(filePath) {
+  let raw;
+  try {
+    raw = await promises.readFile(filePath, "utf8");
   } catch (err) {
-    if (err instanceof ControlError && err.code === "not_found") {
-      error(`${err.message} \u2014 run \`byok-agent approvals\` to see pending approvalIds`);
-    } else {
-      error(`${decision} failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
+    if (err.code === "ENOENT") return [];
     throw err;
-  } finally {
-    conn.client.close();
   }
+  return completeLines(raw);
 }
-
-// src/bin/commands/pair.ts
-async function runPairCommand(config, code, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  if (deps.daemon) {
-    const result2 = await deps.daemon.pair(code);
-    log(`paired: deviceId=${result2.deviceId}`);
-    return;
+async function readAuditEvents(storeDir) {
+  const lines = await readCompleteLines(auditLogPath(storeDir));
+  const events = [];
+  for (const line of lines) {
+    const event = parseAuditLine(line);
+    if (event) events.push(event);
   }
-  const connectControl = deps.connectControl ?? connectControlClient;
-  const conn = await connectControl({ storeDir: resolveStoreDir(config), productId: config.productId });
-  if (conn.ok) {
+  return events;
+}
+function delay3(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function followAuditLog(filePath, onEvent, options) {
+  const { signal, pollIntervalMs = 200, fromEnd = true } = options;
+  let offset = 0;
+  let pending = Buffer.alloc(0);
+  let lastFileIdentity;
+  if (fromEnd) {
     try {
-      const result2 = await conn.client.request("enrollment.pair", { pairingCode: code });
-      log(`paired: deviceId=${result2.deviceId}`);
-      return;
-    } finally {
-      conn.client.close();
+      const st = await promises.stat(filePath);
+      offset = st.size;
+      lastFileIdentity = `${st.dev}:${st.ino}`;
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      offset = 0;
     }
   }
-  const daemon = createDaemon(config);
-  const result = await daemon.pair(code);
-  log(`paired: deviceId=${result.deviceId}`);
-}
-
-// src/bin/commands/doctor.ts
-var DoctorConfirmationRequiredError = class extends Error {
-  constructor() {
-    super("doctor --fix requires explicit --yes confirmation");
-    this.name = "DoctorConfirmationRequiredError";
-  }
-};
-var DoctorDaemonRunningError = class extends Error {
-  constructor() {
-    super("doctor --fix refuses while the daemon control socket is reachable; stop the daemon first");
-    this.name = "DoctorDaemonRunningError";
-  }
-};
-function formatDoctorLines(snapshot, fixResult) {
-  const lines = [
-    `doctor: productHash=${snapshot.product.nameHash} generatedAt=${snapshot.generatedAt}`,
-    `system: node=${snapshot.system.node} platform=${snapshot.system.platform} arch=${snapshot.system.arch} sqlite=${snapshot.system.sqliteAvailable ? "available" : "unavailable"}`
-  ];
-  for (const check of snapshot.checks) lines.push(`check ${check.id}: ${check.status} (${check.summary})`);
-  if (snapshot.health.status === "corrupt" || snapshot.health.status === "unavailable") {
-    lines.push(`health-detail: ${snapshot.health.reason}; bytes=${snapshot.health.sizeBytes ?? "unknown"}`);
-  }
-  if (snapshot.quarantine.truncated) {
-    lines.push(`quarantine-detail: inventory truncated after ${snapshot.quarantine.scannedCount} scanned entries`);
-  }
-  if (fixResult?.status === "quarantined") {
-    lines.push(
-      `fix: quarantined ${fixResult.sizeBytes} bytes as ${fixResult.evidenceName}; manifest=${fixResult.manifestName}; sha256=${fixResult.sha256}`
-    );
-  } else if (fixResult) {
-    lines.push(`fix: no change (${fixResult.reason})`);
-  }
-  return lines;
-}
-async function runDoctorCommand(config, options = {}) {
-  if (options.repair !== void 0) {
-    if (options.fix || options.repair !== "restore-enrollment-metadata") {
-      throw new Error("doctor requires one supported repair action; --fix cannot be combined with --repair");
+  async function readNewBytes() {
+    let handle;
+    try {
+      handle = await promises.open(filePath, "r");
+    } catch (err) {
+      if (err.code === "ENOENT") return Buffer.alloc(0);
+      throw err;
     }
-    const log2 = options.log ?? ((line) => console.log(line));
     try {
-      const repair = await repairDeviceEnrollmentMetadata(config, {
-        confirmed: options.confirmed,
-        expectedDeviceId: options.expectedDeviceId,
-        expectedTenantId: options.expectedTenantId
-      });
-      log2(options.json ? JSON.stringify({ repair }, null, 2) : `repair ${repair.action}: ${repair.status} (${repair.scope})`);
-      return;
-    } catch (error) {
-      if (options.json && error instanceof DeviceMetadataRepairError) {
-        log2(JSON.stringify({ repair: { action: "restore-enrollment-metadata", scope: "device", status: "failed", code: error.code } }, null, 2));
+      const st = await handle.stat();
+      const identity = `${st.dev}:${st.ino}`;
+      if (lastFileIdentity !== void 0 && identity !== lastFileIdentity) {
+        offset = 0;
+        pending = Buffer.alloc(0);
+      } else if (st.size < offset) {
+        offset = 0;
+        pending = Buffer.alloc(0);
       }
-      throw error;
+      lastFileIdentity = identity;
+      if (st.size <= offset) return Buffer.alloc(0);
+      const length = st.size - offset;
+      const buffer = Buffer.alloc(length);
+      const { bytesRead } = await handle.read(buffer, 0, length, offset);
+      offset += bytesRead;
+      return buffer.subarray(0, bytesRead);
+    } finally {
+      await handle.close();
     }
   }
-  if (options.expectedDeviceId !== void 0 || options.expectedTenantId !== void 0) {
-    throw new Error("expected identity flags require --repair restore-enrollment-metadata");
-  }
-  if (options.fix && !options.confirmed) throw new DoctorConfirmationRequiredError();
-  const storeDir = resolveStoreDir(config);
-  let snapshot = await collectDiagnostics(config, storeDir, options);
-  let fixResult;
-  if (options.fix) {
-    if (snapshot.control.status === "online") throw new DoctorDaemonRunningError();
-    fixResult = await quarantineCorruptOperationalHealth(storeDir, { clock: options.clock });
-    snapshot = await collectDiagnostics(config, storeDir, options);
-  }
-  const log = options.log ?? ((line) => console.log(line));
-  if (options.json) {
-    log(JSON.stringify({ diagnostics: snapshot, ...fixResult ? { fix: fixResult } : {} }, null, 2));
-    return;
+  while (!signal.aborted) {
+    const chunk = await readNewBytes();
+    if (chunk.length > 0) {
+      const combined = pending.length > 0 ? Buffer.concat([pending, chunk]) : chunk;
+      const lastNewline = combined.lastIndexOf(10);
+      if (lastNewline === -1) {
+        pending = combined;
+      } else {
+        const completeText = combined.subarray(0, lastNewline + 1).toString("utf8");
+        pending = Buffer.from(combined.subarray(lastNewline + 1));
+        for (const line of completeText.split("\n")) {
+          if (!line) continue;
+          const event = parseAuditLine(line);
+          if (event) onEvent(event);
+        }
+      }
+    }
+    if (signal.aborted) break;
+    await delay3(pollIntervalMs, signal);
   }
-  for (const line of formatDoctorLines(snapshot, fixResult)) log(line);
 }
 
-// src/bin/commands/runtimes.ts
-async function runRuntimesCommand(config, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const adapters = deps.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
-  const runtimes = await probeRuntimes(adapters);
-  for (const line of formatRuntimeLines(runtimes)) log(line);
-}
-function buildServiceDefinition(config, configPath, rest) {
-  const name = argValue(rest, "--name") ?? config.productId;
-  const agentBin = argValue(rest, "--agent-bin") ?? process.argv[1] ?? "byok-agent";
-  const nodeBin = argValue(rest, "--node-bin") ?? process.execPath;
-  const absoluteConfigPath = path14__default.resolve(configPath);
-  const logDir = path14__default.join(resolveStoreDir(config), "service-logs");
-  const definition = {
-    name,
-    displayName: config.branding?.displayName ?? config.productName,
-    program: nodeAgentProgram({ agentBin, configPath: absoluteConfigPath, nodeBin }),
-    logDir
-  };
-  const winswBin = argValue(rest, "--winsw-bin");
-  if (winswBin) {
-    const installDir = argValue(rest, "--winsw-install-dir");
-    definition.windows = installDir ? { winswBin, installDir } : { winswBin };
-  }
-  return definition;
-}
-function buildLifecycle(config, configPath, rest, deps) {
-  return deps.lifecycle ?? createServiceLifecycle(buildServiceDefinition(config, configPath, rest));
-}
-function serviceNameFor(config, rest) {
-  return argValue(rest, "--name") ?? config.productId;
-}
-async function runInstallCommand(config, configPath, rest, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const lifecycle = buildLifecycle(config, configPath, rest, deps);
-  await lifecycle.install();
-  log(`service installed and started: ${serviceNameFor(config, rest)}`);
-}
-async function runUninstallCommand(config, configPath, rest, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const lifecycle = buildLifecycle(config, configPath, rest, deps);
-  await lifecycle.uninstall();
-  log(`service uninstalled: ${serviceNameFor(config, rest)}`);
-}
-async function runServiceStartCommand(config, configPath, rest, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const lifecycle = buildLifecycle(config, configPath, rest, deps);
-  await lifecycle.start();
-  log(`service started: ${serviceNameFor(config, rest)}`);
-}
-async function runServiceStopCommand(config, configPath, rest, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const lifecycle = buildLifecycle(config, configPath, rest, deps);
-  await lifecycle.stop();
-  log(`service stopped: ${serviceNameFor(config, rest)}`);
-}
-async function runServiceStatusCommand(config, configPath, rest, deps = {}) {
-  const log = deps.log ?? ((line) => console.log(line));
-  const lifecycle = buildLifecycle(config, configPath, rest, deps);
-  const status = await lifecycle.status();
-  log(`installed: ${status.installed ? "yes" : "no"}`);
-  const runningLabel = status.running ? "yes" : status.determinate ? "no" : "unknown (could not query the service manager)";
-  log(`running: ${runningLabel}`);
-  log(`detail: ${status.detail.trim() || "(none)"}`);
-}
-function auditLogPath(storeDir) {
-  return path14__default.join(storeDir, "audit.jsonl");
+// src/diagnostics/support-bundle.ts
+var MAX_SUPPORT_AUDIT_TAIL_BYTES = 256 * 1024;
+var MAX_SUPPORT_AUDIT_FACTS = 200;
+var AUDIT_KINDS = /* @__PURE__ */ new Set([
+  "artifact",
+  "awaiting-approval",
+  "cancelled",
+  "claimed",
+  "completed",
+  "connection",
+  "failed",
+  "git-workspace",
+  "offered",
+  "paired",
+  "progress",
+  "runtimes-detected",
+  "shutdown-complete",
+  "shutdown-requested",
+  "stale-approval-decision",
+  "started",
+  "unpaired"
+]);
+function isAuditKind(value) {
+  return typeof value === "string" && AUDIT_KINDS.has(value);
 }
-var AUDIT_LOG_MODE = 384;
-var AUDIT_STORE_DIR_MODE = 448;
-var MAX_AUDIT_LOG_BYTES = 10 * 1024 * 1024;
-var AUDIT_LOG_TRIM_TARGET_LINES = 5e3;
-var MAX_LIVE_TASK_ANCHORS = 500;
-function byteSize(text) {
-  return text === void 0 ? void 0 : Buffer.byteLength(text, "utf8");
+function sameFileState6(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
-function valueByteSize(value) {
-  if (value === void 0) return void 0;
+async function recentAuditFacts(storeDir) {
+  const filePath = auditLogPath(storeDir);
+  let pathStat;
   try {
-    const json = JSON.stringify(value);
-    return json === void 0 ? void 0 : Buffer.byteLength(json, "utf8");
-  } catch {
-    return void 0;
+    pathStat = await promises.lstat(filePath, { bigint: true });
+    if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
   }
-}
-function placeholderFor(size, spilled) {
-  const suffix = spilled ? ", spilled" : "";
-  return size === void 0 ? `[redacted${suffix}]` : `[redacted: ${size} bytes${suffix}]`;
-}
-var STABLE_GIT_ERROR_CATEGORIES2 = new Set(GIT_ERROR_CATEGORIES);
-function stableGitErrorCategory2(value) {
-  return typeof value === "string" && STABLE_GIT_ERROR_CATEGORIES2.has(value) ? value : void 0;
-}
-function gitCount(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
-}
-function gitDirty(value) {
-  const dirty = asRecord2(value);
-  const staged = gitCount(dirty.staged);
-  const unstaged = gitCount(dirty.unstaged);
-  const untracked = gitCount(dirty.untracked);
-  const conflicted = gitCount(dirty.conflicted);
-  return staged !== void 0 && unstaged !== void 0 && untracked !== void 0 && conflicted !== void 0 ? { staged, unstaged, untracked, conflicted } : void 0;
-}
-function redactAgentEvent(event) {
-  switch (event.type) {
-    case "progress":
-      return { type: "progress", textSize: byteSize(event.text) };
-    case "tool_use":
-      return event.spill !== void 0 ? { type: "tool_use", tool: event.tool, inputSize: event.spill.totalBytes, inputSpilled: true } : { type: "tool_use", tool: event.tool, inputSize: valueByteSize(event.input) };
-    case "tool_result":
-      return event.spill !== void 0 ? { type: "tool_result", tool: event.tool, outputSize: event.spill.totalBytes, outputSpilled: true } : { type: "tool_result", tool: event.tool, outputSize: valueByteSize(event.output) };
-    case "artifact":
-      return { type: "artifact", name: event.name, contentType: event.contentType };
-    case "needs_approval":
-      return { type: "needs_approval", summarySize: byteSize(event.summary) };
-    case "turn_end":
-      return { type: "turn_end" };
-    case "error":
-      return { type: "error", messageSize: byteSize(event.message) };
-    case "usage":
-      return {
-        type: "usage",
-        inputTokens: event.inputTokens,
-        cachedInputTokens: event.cachedInputTokens,
-        outputTokens: event.outputTokens,
-        reasoningTokens: event.reasoningTokens,
-        totalTokens: event.totalTokens
-      };
+  let handle;
+  try {
+    handle = await promises.open(
+      filePath,
+      constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
+    );
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
   }
-}
-function redactForAudit(event) {
-  const base = { kind: event.kind, ts: event.ts };
-  switch (event.kind) {
-    case "offered":
-      return { ...base, taskId: event.taskId, runtime: event.runtime };
-    case "claimed":
-      return { ...base, taskId: event.taskId, claimedRuntime: event.claimedRuntime };
-    case "started":
-      return { ...base, taskId: event.taskId };
-    case "progress":
-      return { ...base, taskId: event.taskId, event: redactAgentEvent(event.event) };
-    case "artifact":
-      return {
-        ...base,
-        taskId: event.taskId,
-        name: event.name,
-        contentType: event.contentType,
-        // `inline` is base64 file bytes (up to the 64KB inline cap) — never
-        // persisted. `blobRef.url` is a presigned URL — itself effectively a
-        // time-limited bearer credential for the actual bytes, so it's
-        // dropped too; only the safe pointer/size metadata survives.
-        inlineSize: byteSize(event.inline),
-        blobRef: event.blobRef ? {
-          blobId: event.blobRef.blobId,
-          contentHash: event.blobRef.contentHash,
-          size: event.blobRef.size,
-          contentType: event.blobRef.contentType
-        } : void 0
-      };
-    case "awaiting-approval":
-      return { ...base, taskId: event.taskId, summarySize: byteSize(event.summary) };
-    case "completed":
-      return { ...base, taskId: event.taskId, summarySize: byteSize(event.summary), sessionRef: event.sessionRef };
-    case "failed":
-      return {
-        ...base,
-        taskId: event.taskId,
-        reasonSize: byteSize(event.reason),
-        retryable: event.retryable,
-        preClaim: event.preClaim
-      };
-    case "cancelled":
-      return { ...base, taskId: event.taskId, reasonSize: byteSize(event.reason) };
-    case "connection":
-      return { ...base, state: event.state };
-    case "paired":
-      return { ...base, deviceId: event.deviceId };
-    case "unpaired":
-      return { ...base };
-    case "runtimes-detected":
-      return { ...base, runtimes: event.runtimes };
-    case "shutdown-requested":
-      return { ...base, reason: event.reason };
-    case "shutdown-complete":
-      return { ...base, reason: event.reason, undeliveredOutboxCount: event.undeliveredOutboxCount };
-    case "stale-approval-decision":
-      return { ...base, taskId: event.taskId, decision: event.decision, reasonSize: byteSize(event.reason) };
-    case "runtime-disposal-failed":
-      return { ...base, taskId: event.taskId, runtimeId: event.runtimeId, stage: event.stage, reason: event.reason };
-    case "device-assertion":
-      return event.result === "issued" ? {
-        ...base,
-        result: "issued",
-        audience: event.audience,
-        jti: event.jti,
-        expiresAt: event.expiresAt
-      } : { ...base, result: "denied", reason: event.reason, audienceSize: event.audienceSize };
-    case "git-workspace":
-      return {
-        ...base,
-        taskId: event.taskId,
-        workspaceId: event.workspaceId,
-        phase: event.phase,
-        headChanged: event.headChanged,
-        commitsSinceBaseline: event.commitsSinceBaseline,
-        dirty: event.dirty,
-        errorCategory: stableGitErrorCategory2(event.errorCategory)
-      };
+  try {
+    const stat = await handle.stat({ bigint: true });
+    const namedAfterOpen = await promises.lstat(filePath, { bigint: true });
+    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState6(pathStat, stat) || !sameFileState6(stat, namedAfterOpen)) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    const sourceSize = Number(stat.size);
+    const length = Math.min(sourceSize, MAX_SUPPORT_AUDIT_TAIL_BYTES);
+    const start = Math.max(0, sourceSize - length);
+    const buffer = Buffer.alloc(length);
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    const afterRead = await handle.stat({ bigint: true });
+    const namedAfterRead = await promises.lstat(filePath, { bigint: true });
+    if (bytesRead !== length || namedAfterRead.isSymbolicLink() || !sameFileState6(stat, afterRead) || !sameFileState6(afterRead, namedAfterRead)) {
+      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+    }
+    let text = buffer.subarray(0, bytesRead).toString("utf8");
+    if (start > 0) text = text.slice(Math.max(0, text.indexOf("\n") + 1));
+    const lines = text.split("\n").filter(Boolean).slice(-MAX_SUPPORT_AUDIT_FACTS);
+    const facts = [];
+    for (const line of lines) {
+      try {
+        const value = JSON.parse(line);
+        if (isAuditKind(value.kind) && typeof value.ts === "string" && Number.isFinite(Date.parse(value.ts))) {
+          facts.push({ kind: value.kind, ts: new Date(Date.parse(value.ts)).toISOString() });
+        }
+      } catch {
+      }
+    }
+    return { status: "available", included: facts.length, sourceBytesRead: bytesRead, sourceTruncated: sourceSize > bytesRead, facts };
+  } catch {
+    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
+  } finally {
+    await handle.close();
   }
 }
-function asRecord2(value) {
-  return value !== null && typeof value === "object" ? value : {};
+function projectControl(control) {
+  if (control.status === "offline") return { status: "offline" };
+  const transport = ["connecting", "open", "closed", "revoked"].includes(control.transport) ? control.transport : "unavailable";
+  const operationalHealth = control.operationalHealth.availability === "available" ? {
+    availability: "available",
+    state: control.operationalHealth.state,
+    failureCount: control.operationalHealth.failureCount,
+    windowMs: control.operationalHealth.windowMs,
+    failureThreshold: control.operationalHealth.failureThreshold,
+    crashCount: control.operationalHealth.crashCount
+  } : { availability: "unavailable" };
+  return {
+    status: "online",
+    pid: control.pid,
+    uptimeMs: control.uptimeMs,
+    transport,
+    activeTaskCount: control.activeTaskCount,
+    pendingApprovalCount: control.pendingApprovalCount,
+    operationalHealth,
+    storagePresent: control.storage !== void 0
+  };
+}
+async function createSupportBundle(config, storeDir, options = {}) {
+  const [snapshot, recentEvents] = await Promise.all([collectDiagnostics(config, storeDir, options), recentAuditFacts(storeDir)]);
+  return {
+    version: 1,
+    generatedAt: snapshot.generatedAt,
+    product: snapshot.product,
+    system: snapshot.system,
+    config: {
+      serverProtocol: snapshot.config.serverProtocol,
+      customStoreDir: snapshot.config.customStoreDir,
+      hostedJournal: snapshot.config.hostedJournal,
+      ...snapshot.config.runtimeAllowlistCount === void 0 ? {} : { runtimeAllowlistCount: snapshot.config.runtimeAllowlistCount }
+    },
+    device: {
+      status: snapshot.device.status,
+      ...snapshot.device.deviceIdHash ? { deviceIdHash: snapshot.device.deviceIdHash } : {}
+    },
+    runtimes: snapshot.runtimes,
+    control: projectControl(snapshot.control),
+    health: snapshot.health,
+    journal: snapshot.journal,
+    workspace: snapshot.workspace,
+    quarantine: {
+      status: snapshot.quarantine.status,
+      count: snapshot.quarantine.count,
+      scannedCount: snapshot.quarantine.scannedCount,
+      truncated: snapshot.quarantine.truncated,
+      entries: snapshot.quarantine.entries
+    },
+    checks: snapshot.checks.map(({ id, status }) => ({ id, status })),
+    recentEvents,
+    redaction: {
+      policy: "allowlist-v1",
+      omitted: [
+        "server URL host/path/query",
+        "store/workspace/config paths",
+        "control token and provider credentials",
+        "task, prompt, tool input/output and approval text",
+        "raw audit and quarantine contents"
+      ],
+      transformed: ["productName/productId/deviceId/runtimeId/quarantine filenames -> SHA-256", "audit events -> closed kind/timestamp only"]
+    }
+  };
 }
-function str(value, fallback = "") {
-  return typeof value === "string" ? value : fallback;
+async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
+  const dir = path14__default.dirname(outputPath);
+  const parentStat = await promises.stat(dir);
+  if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
+  const privateDir = path14__default.join(dir, `.${path14__default.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
+  const tempPath = path14__default.join(privateDir, "bundle.tmp");
+  try {
+    await promises.mkdir(privateDir, { mode: 448 });
+    await ensureSecureDir(privateDir, secureFileOptions);
+    await atomicWriteFile(tempPath, `${JSON.stringify(bundle, null, 2)}
+`, { mode: 384, fsync: true });
+    await ensureSecureFile(tempPath, secureFileOptions);
+    await promises.link(tempPath, outputPath);
+    const published = await promises.open(outputPath, "r+");
+    try {
+      await published.sync();
+    } finally {
+      await published.close();
+    }
+    if (process.platform !== "win32") {
+      const parent = await promises.open(dir, "r");
+      try {
+        await parent.sync();
+      } finally {
+        await parent.close();
+      }
+    }
+  } finally {
+    await promises.rm(privateDir, { recursive: true, force: true }).catch(() => void 0);
+  }
 }
-function num(value) {
-  return typeof value === "number" ? value : void 0;
+
+// src/bin/format.ts
+function quote(text) {
+  return JSON.stringify(text);
 }
-function bool(value, fallback) {
-  return typeof value === "boolean" ? value : fallback;
+function redactedByteCountPlaceholder(text) {
+  return `[redacted: ${Buffer.byteLength(text, "utf8")} bytes]`;
 }
-function reconstructAgentEvent(raw) {
-  const r = asRecord2(raw);
-  const type = str(r.type);
-  switch (type) {
+var STABLE_GIT_ERROR_CATEGORIES2 = new Set(GIT_ERROR_CATEGORIES);
+function stableGitErrorCategory2(value) {
+  return value !== void 0 && STABLE_GIT_ERROR_CATEGORIES2.has(value) ? value : void 0;
+}
+function formatAgentEvent(event) {
+  switch (event.type) {
     case "progress":
-      return { type: "progress", text: placeholderFor(num(r.textSize)) };
+      return `progress: ${quote(event.text)}`;
     case "tool_use":
-      return { type: "tool_use", tool: str(r.tool), input: placeholderFor(num(r.inputSize), bool(r.inputSpilled, false)) };
+      return `tool_use: ${event.tool}`;
     case "tool_result":
-      return { type: "tool_result", tool: str(r.tool), output: placeholderFor(num(r.outputSize), bool(r.outputSpilled, false)) };
+      return `tool_result: ${event.tool}`;
     case "artifact":
-      return { type: "artifact", name: str(r.name), contentType: str(r.contentType) };
+      return `artifact: ${event.name} (${event.contentType})`;
     case "needs_approval":
-      return { type: "needs_approval", summary: placeholderFor(num(r.summarySize)) };
+      return `needs_approval: ${quote(event.summary)}`;
     case "turn_end":
-      return { type: "turn_end" };
+      return "turn_end";
     case "error":
-      return { type: "error", message: placeholderFor(num(r.messageSize)) };
-    case "usage":
-      return {
-        type: "usage",
-        inputTokens: num(r.inputTokens),
-        cachedInputTokens: num(r.cachedInputTokens),
-        outputTokens: num(r.outputTokens),
-        reasoningTokens: num(r.reasoningTokens),
-        totalTokens: num(r.totalTokens)
-      };
-    default:
-      return { type: "error", message: `[unrecognized audit event type: ${type || "(missing)"}]` };
+      return `error: ${quote(event.message)}`;
+    case "usage": {
+      const parts = [];
+      if (event.inputTokens !== void 0) parts.push(`in=${event.inputTokens}`);
+      if (event.outputTokens !== void 0) parts.push(`out=${event.outputTokens}`);
+      if (event.totalTokens !== void 0) parts.push(`total=${event.totalTokens}`);
+      return `usage: ${parts.length ? parts.join(" ") : "(no fields reported)"}`;
+    }
   }
 }
-function reconstructDaemonEvent(raw) {
-  const kind = str(raw.kind);
-  const ts = str(raw.ts);
-  switch (kind) {
+function formatDaemonEventLine(event, options = {}) {
+  const prefix = `[${event.ts}]`;
+  switch (event.kind) {
     case "offered":
-      return { kind: "offered", ts, taskId: str(raw.taskId), runtime: typeof raw.runtime === "string" ? raw.runtime : void 0 };
-    case "claimed": {
-      const claimedRuntime = typeof raw.claimedRuntime === "string" ? raw.claimedRuntime : void 0;
-      return claimedRuntime === void 0 ? { kind: "claimed", ts, taskId: str(raw.taskId) } : { kind: "claimed", ts, taskId: str(raw.taskId), claimedRuntime };
-    }
-    case "started":
-      return { kind: "started", ts, taskId: str(raw.taskId) };
-    case "progress":
-      return { kind: "progress", ts, taskId: str(raw.taskId), event: reconstructAgentEvent(raw.event) };
-    case "artifact": {
-      const blobRefPresent = raw.blobRef !== void 0 && raw.blobRef !== null;
-      const blobRefRaw = asRecord2(raw.blobRef);
-      const blobRef = blobRefPresent ? {
-        blobId: str(blobRefRaw.blobId),
-        contentHash: str(blobRefRaw.contentHash),
-        size: num(blobRefRaw.size) ?? 0,
-        contentType: str(blobRefRaw.contentType)
-      } : void 0;
-      const inlineSize = num(raw.inlineSize);
-      return {
-        kind: "artifact",
-        ts,
-        taskId: str(raw.taskId),
-        name: str(raw.name),
-        contentType: str(raw.contentType),
-        inline: inlineSize === void 0 ? void 0 : placeholderFor(inlineSize),
-        blobRef
-      };
-    }
-    case "awaiting-approval":
-      return { kind: "awaiting-approval", ts, taskId: str(raw.taskId), summary: placeholderFor(num(raw.summarySize)) };
-    case "completed":
-      return {
-        kind: "completed",
-        ts,
-        taskId: str(raw.taskId),
-        summary: placeholderFor(num(raw.summarySize)),
-        sessionRef: str(raw.sessionRef)
-      };
-    case "failed":
-      return {
-        kind: "failed",
-        ts,
-        taskId: str(raw.taskId),
-        reason: placeholderFor(num(raw.reasonSize)),
-        retryable: bool(raw.retryable, false),
-        preClaim: typeof raw.preClaim === "boolean" ? raw.preClaim : void 0
-      };
-    case "cancelled": {
-      const reasonSize = num(raw.reasonSize);
-      return {
-        kind: "cancelled",
-        ts,
-        taskId: str(raw.taskId),
-        reason: reasonSize === void 0 ? void 0 : placeholderFor(reasonSize)
-      };
-    }
-    case "connection":
-      return { kind: "connection", ts, state: str(raw.state) };
-    case "paired":
-      return { kind: "paired", ts, deviceId: str(raw.deviceId) };
-    case "unpaired":
-      return { kind: "unpaired", ts };
-    case "runtimes-detected":
-      return { kind: "runtimes-detected", ts, runtimes: Array.isArray(raw.runtimes) ? raw.runtimes : [] };
-    case "shutdown-requested":
-      return { kind: "shutdown-requested", ts, reason: str(raw.reason) };
-    case "shutdown-complete":
-      return { kind: "shutdown-complete", ts, reason: str(raw.reason), undeliveredOutboxCount: num(raw.undeliveredOutboxCount) };
-    case "stale-approval-decision": {
-      const reasonSize = num(raw.reasonSize);
-      return {
-        kind: "stale-approval-decision",
-        ts,
-        taskId: str(raw.taskId),
-        decision: str(raw.decision),
-        reason: reasonSize === void 0 ? void 0 : placeholderFor(reasonSize)
-      };
-    }
-    case "runtime-disposal-failed":
-      return {
-        kind: "runtime-disposal-failed",
-        ts,
-        taskId: str(raw.taskId),
-        runtimeId: str(raw.runtimeId),
-        stage: str(raw.stage),
-        reason: str(raw.reason)
-      };
-    case "device-assertion": {
-      if (raw.result === "issued") {
-        return {
-          kind: "device-assertion",
-          ts,
-          result: "issued",
-          audience: typeof raw.audience === "string" ? raw.audience : "",
-          jti: typeof raw.jti === "string" ? raw.jti : "",
-          expiresAt: typeof raw.expiresAt === "string" ? raw.expiresAt : ""
-        };
-      }
-      const audienceSize = num(raw.audienceSize);
-      return {
-        kind: "device-assertion",
-        ts,
-        result: "denied",
-        reason: typeof raw.reason === "string" ? raw.reason : "",
-        ...audienceSize === void 0 ? {} : { audienceSize }
-      };
+      return `${prefix} offered taskId=${event.taskId}${event.runtime ? ` runtime=${event.runtime}` : ""}`;
+    case "claimed":
+      return `${prefix} claimed taskId=${event.taskId}${event.claimedRuntime !== void 0 ? ` claimedRuntime=${event.claimedRuntime}` : ""}`;
+    case "started":
+      return `${prefix} started taskId=${event.taskId}`;
+    case "progress":
+      return `${prefix} progress taskId=${event.taskId} ${formatAgentEvent(event.event)}`;
+    case "artifact":
+      return `${prefix} artifact taskId=${event.taskId} name=${event.name} contentType=${event.contentType}`;
+    case "awaiting-approval": {
+      const summary = options.redactApprovalSummary ? redactedByteCountPlaceholder(event.summary) : event.summary;
+      return `${prefix} awaiting-approval taskId=${event.taskId}${event.approvalId ? ` approvalId=${event.approvalId}` : ""} summary=${quote(summary)}`;
     }
+    case "completed":
+      return `${prefix} completed taskId=${event.taskId} sessionRef=${event.sessionRef} summary=${quote(event.summary)}`;
+    case "failed":
+      return `${prefix} failed taskId=${event.taskId} retryable=${event.retryable}${event.preClaim ? " preClaim=true" : ""} reason=${quote(event.reason)}`;
+    case "cancelled":
+      return `${prefix} cancelled taskId=${event.taskId}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+    case "connection":
+      return `${prefix} connection state=${event.state}`;
+    case "paired":
+      return `${prefix} paired deviceId=${event.deviceId}`;
+    case "unpaired":
+      return `${prefix} unpaired`;
+    case "runtimes-detected":
+      return `${prefix} runtimes-detected ids=${event.runtimes.map((r) => r.id).join(",") || "(none)"}`;
+    case "shutdown-requested":
+      return `${prefix} shutdown-requested reason=${quote(event.reason)}`;
+    case "shutdown-complete":
+      return `${prefix} shutdown-complete reason=${quote(event.reason)}${event.undeliveredOutboxCount !== void 0 ? ` undeliveredOutboxCount=${event.undeliveredOutboxCount}` : ""}`;
+    case "stale-approval-decision":
+      return `${prefix} stale-approval-decision taskId=${event.taskId} decision=${event.decision}${event.reason ? ` reason=${quote(event.reason)}` : ""}`;
+    case "runtime-disposal-failed":
+      return `${prefix} runtime-disposal-failed taskId=${event.taskId} runtime=${event.runtimeId} stage=${event.stage} reason=${quote(event.reason)}`;
     case "git-workspace": {
-      const commitsSinceBaseline = gitCount(raw.commitsSinceBaseline);
-      const dirty = gitDirty(raw.dirty);
-      return {
-        kind: "git-workspace",
-        ts,
-        taskId: str(raw.taskId),
-        workspaceId: str(raw.workspaceId),
-        phase: str(raw.phase),
-        headChanged: typeof raw.headChanged === "boolean" ? raw.headChanged : void 0,
-        commitsSinceBaseline,
-        dirty,
-        errorCategory: stableGitErrorCategory2(raw.errorCategory)
-      };
+      const parts = [
+        `${prefix} git-workspace taskId=${event.taskId}`,
+        `workspaceId=${event.workspaceId}`,
+        `phase=${event.phase}`,
+        event.headChanged !== void 0 ? `headChanged=${event.headChanged}` : void 0,
+        event.commitsSinceBaseline !== void 0 ? `commits=${event.commitsSinceBaseline}` : void 0,
+        event.dirty ? `dirty=${event.dirty.staged}/${event.dirty.unstaged}/${event.dirty.untracked}/${event.dirty.conflicted}` : void 0,
+        stableGitErrorCategory2(event.errorCategory) ? `errorCategory=${stableGitErrorCategory2(event.errorCategory)}` : void 0
+      ].filter((part) => part !== void 0);
+      return parts.join(" ");
+    }
+    case "device-assertion": {
+      const parts = event.result === "issued" ? [
+        `${prefix} device-assertion result=issued`,
+        `audience=${quote(event.audience)}`,
+        `jti=${event.jti}`,
+        `expiresAt=${event.expiresAt}`
+      ] : [
+        `${prefix} device-assertion result=denied`,
+        `reason=${event.reason}`,
+        event.audienceSize !== void 0 ? `audienceSize=${event.audienceSize}` : void 0
+      ].filter((part) => part !== void 0);
+      return parts.join(" ");
     }
-    default:
-      return void 0;
   }
 }
-async function appendAuditEvent(storeDir, event) {
-  await promises.mkdir(storeDir, { recursive: true, mode: AUDIT_STORE_DIR_MODE });
-  await promises.chmod(storeDir, AUDIT_STORE_DIR_MODE).catch(() => {
+function formatTaskLine(task) {
+  const git = "git" in task ? task.git : void 0;
+  const gitStatus = git ? [
+    `git=${git.phase}`,
+    git.commitsSinceBaseline !== void 0 ? `commits=${git.commitsSinceBaseline}` : void 0,
+    git.dirty ? `dirty=${git.dirty.staged}/${git.dirty.unstaged}/${git.dirty.untracked}/${git.dirty.conflicted}` : void 0
+  ].filter((part) => part !== void 0).join(" ") : void 0;
+  const parts = [
+    task.taskId,
+    task.state,
+    task.runtime ? `runtime=${task.runtime}` : void 0,
+    gitStatus,
+    task.claimedRuntime !== void 0 ? `claimedRuntime=${task.claimedRuntime}` : void 0,
+    `updatedAt=${task.updatedAt}`,
+    task.sessionRef ? `sessionRef=${task.sessionRef}` : void 0,
+    task.declined ? "declined=true" : void 0,
+    task.summary ? `summary=${quote(task.summary)}` : void 0
+  ].filter((part) => Boolean(part));
+  return parts.join(" ");
+}
+function formatTaskListLines(tasks) {
+  if (tasks.length === 0) return ["(no tasks observed yet)"];
+  return tasks.map(formatTaskLine);
+}
+function formatRuntimeLines(runtimes) {
+  if (runtimes.length === 0) return ["(no runtimes configured \u2014 check runtimeAllowlist)"];
+  return runtimes.map((r) => {
+    if (!r.present) return `${r.id}: ${r.outcome}`;
+    const caps = [];
+    if (r.steer) caps.push("steer");
+    if (r.resume) caps.push("resume");
+    const parts = [
+      "present",
+      r.version ? `version=${r.version}` : void 0,
+      r.authPresent !== void 0 ? `authPresent=${r.authPresent}` : void 0,
+      `capabilities=${caps.length ? caps.join(",") : "(none)"}`,
+      `modes=${r.permissionModes.length ? r.permissionModes.join(",") : "(none)"}`
+    ].filter((part) => Boolean(part));
+    return `${r.id}: ${parts.join(" ")}`;
   });
-  const filePath = auditLogPath(storeDir);
-  const line = `${JSON.stringify(redactForAudit(event))}
-`;
-  const handle = await promises.open(filePath, "a", AUDIT_LOG_MODE);
-  try {
-    await handle.chmod(AUDIT_LOG_MODE);
-    await handle.appendFile(line, "utf8");
-  } finally {
-    await handle.close();
-  }
-  await rotateIfNeeded(filePath);
 }
-var TERMINAL_EVENT_KINDS = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
-function eventTaskId(event) {
-  if (event.kind === "git-workspace") return void 0;
-  return "taskId" in event ? event.taskId : void 0;
+function formatStatusLines(view) {
+  const lines = [];
+  const label = view.branding?.displayName ?? view.productName;
+  lines.push(`product: ${label} (${view.productId})`);
+  lines.push(
+    `local-agent-release: ${view.localAgentRelease.version}${view.localAgentRelease.buildId ? ` buildId=${view.localAgentRelease.buildId}` : ""}`
+  );
+  if (view.branding?.supportUrl) lines.push(`support: ${view.branding.supportUrl}`);
+  lines.push(`paired: ${view.paired ? "yes" : "no"}${view.deviceId ? ` deviceId=${view.deviceId}` : ""}`);
+  lines.push(
+    view.connection ? `connection: last-known=${view.connection.state} at=${view.connection.ts}` : "connection: unknown (no audit log yet \u2014 run `byok-agent start` at least once to begin observing)"
+  );
+  const runtimeSummary = view.runtimes.map((r) => `${r.id}=${r.present ? "present" : r.outcome}`).join(" ");
+  lines.push(`runtimes: ${runtimeSummary || "(none configured)"}`);
+  const c = view.taskCounts;
+  lines.push(
+    `tasks: total=${c.total} offered=${c.Offered} claimed=${c.Claimed} running=${c.Running} awaitApproval=${c.AwaitApproval} complete=${c.Complete} failed=${c.Failed} cancelled=${c.Cancelled}`
+  );
+  lines.push(`audit-log: ${view.auditLogPath} (${view.auditLogLineCount} event${view.auditLogLineCount === 1 ? "" : "s"})`);
+  return lines;
 }
-function compactPreservingLiveTasks(lines, targetLines) {
-  if (lines.length <= targetLines) return [...lines];
-  const cutIndex = lines.length - targetLines;
-  const hasTerminalEvent = /* @__PURE__ */ new Set();
-  const lastIndexForTask = /* @__PURE__ */ new Map();
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line === void 0) continue;
-    const event = parseAuditLine(line);
-    if (!event) continue;
-    const taskId = eventTaskId(event);
-    if (taskId === void 0) continue;
-    lastIndexForTask.set(taskId, i);
-    if (TERMINAL_EVENT_KINDS.has(event.kind)) hasTerminalEvent.add(taskId);
+function formatLiveStatusLines(live) {
+  const liveRelease = live.localAgentRelease;
+  const lines = [
+    `live: pid=${live.pid} uptimeMs=${live.uptimeMs} transport=${live.transport}`,
+    liveRelease ? `live-local-agent-release: ${liveRelease.version}${liveRelease.buildId ? ` buildId=${liveRelease.buildId}` : ""}` : "live-local-agent-release: unknown",
+    `live-paired: ${live.paired ? "yes" : "no"}${live.deviceId ? ` deviceId=${live.deviceId}` : ""}`,
+    `live-runtimes: ${live.runtimeIds.length ? live.runtimeIds.join(",") : "(none)"}`,
+    `live-toolsets: revision=${live.toolsets.revision} count=${live.toolsets.toolsets.length}`
+  ];
+  for (const toolset of live.toolsets.toolsets) lines.push(formatToolsetStatusLine("live-toolset", toolset));
+  const health = live.operationalHealth;
+  if (health.availability === "unavailable") {
+    lines.push(`live-operational-health: unavailable reason=${quote(health.reason)}`);
+  } else {
+    lines.push(
+      `live-operational-health: state=${health.state} failures=${health.failureCount}/${health.failureThreshold} windowMs=${health.windowMs} crashes=${health.crashCount}${health.lastCrashAt ? ` lastCrashAt=${health.lastCrashAt}` : ""}`
+    );
   }
-  let anchorIndices = [];
-  for (const [taskId, lastIndex] of lastIndexForTask) {
-    if (hasTerminalEvent.has(taskId)) continue;
-    if (lastIndex < cutIndex) anchorIndices.push(lastIndex);
+  if (live.activeTasks.length === 0) {
+    lines.push("live-active-tasks: (none)");
+  } else {
+    for (const task of live.activeTasks) {
+      lines.push(`live-active-task: ${task.taskId} ${task.state}`);
+    }
   }
-  anchorIndices.sort((a, b) => a - b);
-  if (anchorIndices.length > MAX_LIVE_TASK_ANCHORS) {
-    const totalCandidates = anchorIndices.length;
-    const droppedCount = totalCandidates - MAX_LIVE_TASK_ANCHORS;
-    anchorIndices = anchorIndices.slice(-MAX_LIVE_TASK_ANCHORS);
-    console.warn(
-      `[byok/client] audit log rotation: ${totalCandidates} non-terminal task lifecycle anchors exceeded MAX_LIVE_TASK_ANCHORS (${MAX_LIVE_TASK_ANCHORS}) \u2014 dropped the oldest ${droppedCount}, kept the most recently-touched ${MAX_LIVE_TASK_ANCHORS}; dropped tasks will stop appearing in tasks/status once their own events age out of the retained tail`
+  lines.push(`live-approvals-pending: ${live.approvalsPending}`);
+  if (live.approvals.length === 0) {
+    lines.push("live-approvals: (none)");
+  } else {
+    for (const approval of live.approvals) {
+      lines.push(`live-approval: ${approval.approvalId} taskId=${approval.taskId} summary=${quote(summaryExcerpt(approval.summary))}`);
+    }
+  }
+  if (live.queueWatermarks.length === 0) {
+    lines.push("live-queue-watermarks: (none)");
+  } else {
+    for (const watermark of live.queueWatermarks) {
+      lines.push(
+        `live-queue-watermark: ${watermark.taskId} progressBatcherPending=${watermark.progressBatcherPending} pendingApprovals=${watermark.pendingApprovals}`
+      );
+    }
+  }
+  const storage = live.storage;
+  if (storage !== void 0) {
+    lines.push(
+      `live-storage: state=${storage.pressureState} used=${storage.usedBytes} budget=${storage.budgetBytes} free=${storage.freeBytes} measuredAt=${storage.measuredAt}`
     );
+    for (const category of storage.categories) {
+      lines.push(`live-storage-category: ${category.category} bytes=${category.bytes}${category.approximate ? " (approximate)" : ""}`);
+    }
+    if (storage.lastCompaction) {
+      lines.push(
+        `live-storage-compaction: checkpointed=${storage.lastCompaction.checkpointed} walFramesRemaining=${storage.lastCompaction.walFramesRemaining} pagesVacuumed=${storage.lastCompaction.pagesVacuumed} durationMs=${storage.lastCompaction.durationMs} at=${storage.lastCompaction.at}`
+      );
+    }
   }
-  return [...anchorIndices.map((i) => lines[i]), ...lines.slice(cutIndex)].filter((l) => l !== void 0);
+  return lines;
 }
-async function rotateIfNeeded(filePath) {
-  let size;
-  try {
-    size = (await promises.stat(filePath)).size;
-  } catch {
-    return;
-  }
-  if (size <= MAX_AUDIT_LOG_BYTES) return;
-  const lines = await readCompleteLines(filePath);
-  const kept = compactPreservingLiveTasks(lines, AUDIT_LOG_TRIM_TARGET_LINES);
-  const content = kept.length > 0 ? `${kept.join("\n")}
-` : "";
-  await atomicWriteFile(filePath, content, { mode: AUDIT_LOG_MODE });
+function formatToolsetStatusLine(prefix, toolset) {
+  const observation = toolset.observation;
+  return [
+    `${prefix}: ${toolset.id}`,
+    `servers=${toolset.serverCount}`,
+    `definitionRevision=${toolset.definitionRevision}`,
+    `state=${observation?.state ?? "unobserved"}`,
+    observation?.version === void 0 ? void 0 : `version=${quote(observation.version)}`,
+    observation?.observedAt === void 0 ? void 0 : `observedAt=${observation.observedAt}`,
+    observation?.reasonCode === void 0 ? void 0 : `reasonCode=${observation.reasonCode}`
+  ].filter((part) => part !== void 0).join(" ");
+}
+function formatToolsetsReloadReceiptLines(receipt) {
+  return [
+    `toolsets-reload: changed=${receipt.changed ? "yes" : "no"} previousRevision=${receipt.previousRevision} revision=${receipt.revision}`,
+    ...receipt.toolsets.map((toolset) => formatToolsetStatusLine("toolset", toolset))
+  ];
+}
+var SUMMARY_EXCERPT_MAX_LEN = 60;
+function summaryExcerpt(summary) {
+  if (!summary) return "(no summary)";
+  return summary.length > SUMMARY_EXCERPT_MAX_LEN ? `${summary.slice(0, SUMMARY_EXCERPT_MAX_LEN)}\u2026` : summary;
 }
-function createAuditAppender(storeDir, onError = () => {
-}) {
-  let chain = Promise.resolve();
-  return (event) => {
-    chain = chain.then(() => appendAuditEvent(storeDir, event)).catch(onError);
-  };
+function formatAge(ms) {
+  const totalSeconds = Math.floor(Math.max(0, ms) / 1e3);
+  if (totalSeconds < 60) return `${totalSeconds}s`;
+  const totalMinutes = Math.floor(totalSeconds / 60);
+  if (totalMinutes < 60) return `${totalMinutes}m`;
+  const totalHours = Math.floor(totalMinutes / 60);
+  if (totalHours < 24) return `${totalHours}h`;
+  const totalDays = Math.floor(totalHours / 24);
+  return `${totalDays}d`;
 }
-function isAuditRecordShaped(value) {
-  return typeof value === "object" && value !== null && typeof value.kind === "string" && typeof value.ts === "string";
+function formatApprovalsListLines(approvals, nowMs) {
+  if (approvals.length === 0) return ["(no pending approvals)"];
+  return approvals.map((approval) => {
+    const ageMs = nowMs - Date.parse(approval.createdAt);
+    return `${approval.approvalId} taskId=${approval.taskId} age=${formatAge(ageMs)} summary=${quote(summaryExcerpt(approval.summary))}`;
+  });
 }
-function parseAuditLine(line) {
-  const trimmed = line.trim();
-  if (!trimmed) return void 0;
+
+// src/bin/commands/approvals.ts
+async function runApprovalsCommand(storeDir, productId, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const error = deps.error ?? ((line) => console.error(line));
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const now = deps.now ?? (() => Date.now());
+  const conn = await connectControl({ storeDir, productId });
+  if (!conn.ok) {
+    const message = `cannot list approvals: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
+    error(message);
+    throw new Error(message);
+  }
   try {
-    const parsed = JSON.parse(trimmed);
-    if (!isAuditRecordShaped(parsed)) return void 0;
-    return reconstructDaemonEvent(parsed);
-  } catch {
-    return void 0;
+    const result = await conn.client.request("approvals.list");
+    for (const line of formatApprovalsListLines(result.approvals, now())) log(line);
+  } catch (err) {
+    if (err instanceof ControlError) {
+      error(`approvals list failed: ${err.message}`);
+    } else {
+      error(`approvals list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    throw err;
+  } finally {
+    conn.client.close();
   }
 }
-function completeLines(raw) {
-  const parts = raw.split("\n");
-  parts.pop();
-  return parts;
+
+// src/bin/commands/approve-reject.ts
+async function runApproveCommand(storeDir, productId, approvalId, deps = {}) {
+  return resolveApproval(storeDir, productId, approvalId, "approve", void 0, deps);
 }
-async function readCompleteLines(filePath) {
-  let raw;
+async function runRejectCommand(storeDir, productId, approvalId, reason, deps = {}) {
+  return resolveApproval(storeDir, productId, approvalId, "reject", reason, deps);
+}
+async function resolveApproval(storeDir, productId, approvalId, decision, reason, deps) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const error = deps.error ?? ((line) => console.error(line));
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const verb = decision === "approve" ? "approved" : "rejected";
+  const conn = await connectControl({ storeDir, productId });
+  if (!conn.ok) {
+    const message = `cannot ${decision} approvalId=${approvalId}: daemon not reachable (${conn.reason}) \u2014 is \`byok-agent start\` (or the installed service) running?`;
+    error(message);
+    throw new Error(message);
+  }
   try {
-    raw = await promises.readFile(filePath, "utf8");
+    await conn.client.request("approvals.resolve", { approvalId, decision, reason });
+    log(`${verb}: approvalId=${approvalId}${reason ? ` reason=${JSON.stringify(reason)}` : ""}`);
   } catch (err) {
-    if (err.code === "ENOENT") return [];
+    if (err instanceof ControlError && err.code === "not_found") {
+      error(`${err.message} \u2014 run \`byok-agent approvals\` to see pending approvalIds`);
+    } else {
+      error(`${decision} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     throw err;
+  } finally {
+    conn.client.close();
   }
-  return completeLines(raw);
 }
-async function readAuditEvents(storeDir) {
-  const lines = await readCompleteLines(auditLogPath(storeDir));
-  const events = [];
-  for (const line of lines) {
-    const event = parseAuditLine(line);
-    if (event) events.push(event);
+
+// src/bin/commands/pair.ts
+async function runPairCommand(config, code, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  if (deps.daemon) {
+    const result2 = await deps.daemon.pair(code);
+    log(`paired: deviceId=${result2.deviceId}`);
+    return;
   }
-  return events;
-}
-function delay3(ms, signal) {
-  if (signal.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function followAuditLog(filePath, onEvent, options) {
-  const { signal, pollIntervalMs = 200, fromEnd = true } = options;
-  let offset = 0;
-  let pending = Buffer.alloc(0);
-  let lastFileIdentity;
-  if (fromEnd) {
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const conn = await connectControl({ storeDir: resolveStoreDir(config), productId: config.productId });
+  if (conn.ok) {
     try {
-      const st = await promises.stat(filePath);
-      offset = st.size;
-      lastFileIdentity = `${st.dev}:${st.ino}`;
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-      offset = 0;
+      const result2 = await conn.client.request("enrollment.pair", { pairingCode: code });
+      log(`paired: deviceId=${result2.deviceId}`);
+      return;
+    } finally {
+      conn.client.close();
     }
   }
-  async function readNewBytes() {
-    let handle;
-    try {
-      handle = await promises.open(filePath, "r");
-    } catch (err) {
-      if (err.code === "ENOENT") return Buffer.alloc(0);
-      throw err;
+  const daemon = createDaemon(config);
+  const result = await daemon.pair(code);
+  log(`paired: deviceId=${result.deviceId}`);
+}
+
+// src/bin/commands/doctor.ts
+var DoctorConfirmationRequiredError = class extends Error {
+  constructor() {
+    super("doctor --fix requires explicit --yes confirmation");
+    this.name = "DoctorConfirmationRequiredError";
+  }
+};
+var DoctorDaemonRunningError = class extends Error {
+  constructor() {
+    super("doctor --fix refuses while the daemon control socket is reachable; stop the daemon first");
+    this.name = "DoctorDaemonRunningError";
+  }
+};
+function formatDoctorLines(snapshot, fixResult) {
+  const lines = [
+    `doctor: productHash=${snapshot.product.nameHash} generatedAt=${snapshot.generatedAt}`,
+    `system: node=${snapshot.system.node} platform=${snapshot.system.platform} arch=${snapshot.system.arch} sqlite=${snapshot.system.sqliteAvailable ? "available" : "unavailable"}`
+  ];
+  for (const check of snapshot.checks) lines.push(`check ${check.id}: ${check.status} (${check.summary})`);
+  if (snapshot.health.status === "corrupt" || snapshot.health.status === "unavailable") {
+    lines.push(`health-detail: ${snapshot.health.reason}; bytes=${snapshot.health.sizeBytes ?? "unknown"}`);
+  }
+  if (snapshot.quarantine.truncated) {
+    lines.push(`quarantine-detail: inventory truncated after ${snapshot.quarantine.scannedCount} scanned entries`);
+  }
+  if (fixResult?.status === "quarantined") {
+    lines.push(
+      `fix: quarantined ${fixResult.sizeBytes} bytes as ${fixResult.evidenceName}; manifest=${fixResult.manifestName}; sha256=${fixResult.sha256}`
+    );
+  } else if (fixResult) {
+    lines.push(`fix: no change (${fixResult.reason})`);
+  }
+  return lines;
+}
+async function runDoctorCommand(config, options = {}) {
+  if (options.repair !== void 0) {
+    if (options.fix || options.repair !== "restore-enrollment-metadata") {
+      throw new Error("doctor requires one supported repair action; --fix cannot be combined with --repair");
     }
+    const log2 = options.log ?? ((line) => console.log(line));
     try {
-      const st = await handle.stat();
-      const identity = `${st.dev}:${st.ino}`;
-      if (lastFileIdentity !== void 0 && identity !== lastFileIdentity) {
-        offset = 0;
-        pending = Buffer.alloc(0);
-      } else if (st.size < offset) {
-        offset = 0;
-        pending = Buffer.alloc(0);
+      const repair = await repairDeviceEnrollmentMetadata(config, {
+        confirmed: options.confirmed,
+        expectedDeviceId: options.expectedDeviceId,
+        expectedTenantId: options.expectedTenantId
+      });
+      log2(options.json ? JSON.stringify({ repair }, null, 2) : `repair ${repair.action}: ${repair.status} (${repair.scope})`);
+      return;
+    } catch (error) {
+      if (options.json && error instanceof DeviceMetadataRepairError) {
+        log2(JSON.stringify({ repair: { action: "restore-enrollment-metadata", scope: "device", status: "failed", code: error.code } }, null, 2));
       }
-      lastFileIdentity = identity;
-      if (st.size <= offset) return Buffer.alloc(0);
-      const length = st.size - offset;
-      const buffer = Buffer.alloc(length);
-      const { bytesRead } = await handle.read(buffer, 0, length, offset);
-      offset += bytesRead;
-      return buffer.subarray(0, bytesRead);
-    } finally {
-      await handle.close();
+      throw error;
     }
   }
-  while (!signal.aborted) {
-    const chunk = await readNewBytes();
-    if (chunk.length > 0) {
-      const combined = pending.length > 0 ? Buffer.concat([pending, chunk]) : chunk;
-      const lastNewline = combined.lastIndexOf(10);
-      if (lastNewline === -1) {
-        pending = combined;
-      } else {
-        const completeText = combined.subarray(0, lastNewline + 1).toString("utf8");
-        pending = Buffer.from(combined.subarray(lastNewline + 1));
-        for (const line of completeText.split("\n")) {
-          if (!line) continue;
-          const event = parseAuditLine(line);
-          if (event) onEvent(event);
-        }
-      }
-    }
-    if (signal.aborted) break;
-    await delay3(pollIntervalMs, signal);
+  if (options.expectedDeviceId !== void 0 || options.expectedTenantId !== void 0) {
+    throw new Error("expected identity flags require --repair restore-enrollment-metadata");
+  }
+  if (options.fix && !options.confirmed) throw new DoctorConfirmationRequiredError();
+  const storeDir = resolveStoreDir(config);
+  let snapshot = await collectDiagnostics(config, storeDir, options);
+  let fixResult;
+  if (options.fix) {
+    if (snapshot.control.status === "online") throw new DoctorDaemonRunningError();
+    fixResult = await quarantineCorruptOperationalHealth(storeDir, { clock: options.clock });
+    snapshot = await collectDiagnostics(config, storeDir, options);
+  }
+  const log = options.log ?? ((line) => console.log(line));
+  if (options.json) {
+    log(JSON.stringify({ diagnostics: snapshot, ...fixResult ? { fix: fixResult } : {} }, null, 2));
+    return;
+  }
+  for (const line of formatDoctorLines(snapshot, fixResult)) log(line);
+}
+
+// src/bin/commands/runtimes.ts
+async function runRuntimesCommand(config, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const adapters = deps.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
+  const runtimes = await probeRuntimes(adapters);
+  for (const line of formatRuntimeLines(runtimes)) log(line);
+}
+function buildServiceDefinition(config, configPath, rest) {
+  const name = argValue(rest, "--name") ?? config.productId;
+  const agentBin = argValue(rest, "--agent-bin") ?? process.argv[1] ?? "byok-agent";
+  const nodeBin = argValue(rest, "--node-bin") ?? process.execPath;
+  const absoluteConfigPath = path14__default.resolve(configPath);
+  const logDir = path14__default.join(resolveStoreDir(config), "service-logs");
+  const definition = {
+    name,
+    displayName: config.branding?.displayName ?? config.productName,
+    program: nodeAgentProgram({ agentBin, configPath: absoluteConfigPath, nodeBin }),
+    logDir
+  };
+  const winswBin = argValue(rest, "--winsw-bin");
+  if (winswBin) {
+    const installDir = argValue(rest, "--winsw-install-dir");
+    definition.windows = installDir ? { winswBin, installDir } : { winswBin };
   }
+  return definition;
+}
+function buildLifecycle(config, configPath, rest, deps) {
+  return deps.lifecycle ?? createServiceLifecycle(buildServiceDefinition(config, configPath, rest));
+}
+function serviceNameFor(config, rest) {
+  return argValue(rest, "--name") ?? config.productId;
+}
+async function runInstallCommand(config, configPath, rest, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const lifecycle = buildLifecycle(config, configPath, rest, deps);
+  await lifecycle.install();
+  log(`service installed and started: ${serviceNameFor(config, rest)}`);
+}
+async function runUninstallCommand(config, configPath, rest, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const lifecycle = buildLifecycle(config, configPath, rest, deps);
+  await lifecycle.uninstall();
+  log(`service uninstalled: ${serviceNameFor(config, rest)}`);
+}
+async function runServiceStartCommand(config, configPath, rest, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const lifecycle = buildLifecycle(config, configPath, rest, deps);
+  await lifecycle.start();
+  log(`service started: ${serviceNameFor(config, rest)}`);
+}
+async function runServiceStopCommand(config, configPath, rest, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const lifecycle = buildLifecycle(config, configPath, rest, deps);
+  await lifecycle.stop();
+  log(`service stopped: ${serviceNameFor(config, rest)}`);
+}
+async function runServiceStatusCommand(config, configPath, rest, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const lifecycle = buildLifecycle(config, configPath, rest, deps);
+  const status = await lifecycle.status();
+  log(`installed: ${status.installed ? "yes" : "no"}`);
+  const runningLabel = status.running ? "yes" : status.determinate ? "no" : "unknown (could not query the service manager)";
+  log(`running: ${runningLabel}`);
+  log(`detail: ${status.detail.trim() || "(none)"}`);
 }
 
 // src/bin/commands/start.ts
@@ -24082,194 +24274,6 @@ async function runStatusCommand(config, deps = {}) {
     conn.client.close();
   }
 }
-var MAX_SUPPORT_AUDIT_TAIL_BYTES = 256 * 1024;
-var MAX_SUPPORT_AUDIT_FACTS = 200;
-var AUDIT_KINDS = /* @__PURE__ */ new Set([
-  "artifact",
-  "awaiting-approval",
-  "cancelled",
-  "claimed",
-  "completed",
-  "connection",
-  "failed",
-  "git-workspace",
-  "offered",
-  "paired",
-  "progress",
-  "runtimes-detected",
-  "shutdown-complete",
-  "shutdown-requested",
-  "stale-approval-decision",
-  "started",
-  "unpaired"
-]);
-function isAuditKind(value) {
-  return typeof value === "string" && AUDIT_KINDS.has(value);
-}
-function sameFileState6(left, right) {
-  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
-}
-async function recentAuditFacts(storeDir) {
-  const filePath = auditLogPath(storeDir);
-  let pathStat;
-  try {
-    pathStat = await promises.lstat(filePath, { bigint: true });
-    if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
-      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-    }
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-    }
-    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-  }
-  let handle;
-  try {
-    handle = await promises.open(
-      filePath,
-      constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
-    );
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { status: "missing", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-    }
-    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-  }
-  try {
-    const stat = await handle.stat({ bigint: true });
-    const namedAfterOpen = await promises.lstat(filePath, { bigint: true });
-    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState6(pathStat, stat) || !sameFileState6(stat, namedAfterOpen)) {
-      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-    }
-    const sourceSize = Number(stat.size);
-    const length = Math.min(sourceSize, MAX_SUPPORT_AUDIT_TAIL_BYTES);
-    const start = Math.max(0, sourceSize - length);
-    const buffer = Buffer.alloc(length);
-    const { bytesRead } = await handle.read(buffer, 0, length, start);
-    const afterRead = await handle.stat({ bigint: true });
-    const namedAfterRead = await promises.lstat(filePath, { bigint: true });
-    if (bytesRead !== length || namedAfterRead.isSymbolicLink() || !sameFileState6(stat, afterRead) || !sameFileState6(afterRead, namedAfterRead)) {
-      return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-    }
-    let text = buffer.subarray(0, bytesRead).toString("utf8");
-    if (start > 0) text = text.slice(Math.max(0, text.indexOf("\n") + 1));
-    const lines = text.split("\n").filter(Boolean).slice(-MAX_SUPPORT_AUDIT_FACTS);
-    const facts = [];
-    for (const line of lines) {
-      try {
-        const value = JSON.parse(line);
-        if (isAuditKind(value.kind) && typeof value.ts === "string" && Number.isFinite(Date.parse(value.ts))) {
-          facts.push({ kind: value.kind, ts: new Date(Date.parse(value.ts)).toISOString() });
-        }
-      } catch {
-      }
-    }
-    return { status: "available", included: facts.length, sourceBytesRead: bytesRead, sourceTruncated: sourceSize > bytesRead, facts };
-  } catch {
-    return { status: "unavailable", included: 0, sourceBytesRead: 0, sourceTruncated: false, facts: [] };
-  } finally {
-    await handle.close();
-  }
-}
-function projectControl(control) {
-  if (control.status === "offline") return { status: "offline" };
-  const transport = ["connecting", "open", "closed", "revoked"].includes(control.transport) ? control.transport : "unavailable";
-  const operationalHealth = control.operationalHealth.availability === "available" ? {
-    availability: "available",
-    state: control.operationalHealth.state,
-    failureCount: control.operationalHealth.failureCount,
-    windowMs: control.operationalHealth.windowMs,
-    failureThreshold: control.operationalHealth.failureThreshold,
-    crashCount: control.operationalHealth.crashCount
-  } : { availability: "unavailable" };
-  return {
-    status: "online",
-    pid: control.pid,
-    uptimeMs: control.uptimeMs,
-    transport,
-    activeTaskCount: control.activeTaskCount,
-    pendingApprovalCount: control.pendingApprovalCount,
-    operationalHealth,
-    storagePresent: control.storage !== void 0
-  };
-}
-async function createSupportBundle(config, storeDir, options = {}) {
-  const [snapshot, recentEvents] = await Promise.all([collectDiagnostics(config, storeDir, options), recentAuditFacts(storeDir)]);
-  return {
-    version: 1,
-    generatedAt: snapshot.generatedAt,
-    product: snapshot.product,
-    system: snapshot.system,
-    config: {
-      serverProtocol: snapshot.config.serverProtocol,
-      customStoreDir: snapshot.config.customStoreDir,
-      hostedJournal: snapshot.config.hostedJournal,
-      ...snapshot.config.runtimeAllowlistCount === void 0 ? {} : { runtimeAllowlistCount: snapshot.config.runtimeAllowlistCount }
-    },
-    device: {
-      status: snapshot.device.status,
-      ...snapshot.device.deviceIdHash ? { deviceIdHash: snapshot.device.deviceIdHash } : {}
-    },
-    runtimes: snapshot.runtimes,
-    control: projectControl(snapshot.control),
-    health: snapshot.health,
-    journal: snapshot.journal,
-    workspace: snapshot.workspace,
-    quarantine: {
-      status: snapshot.quarantine.status,
-      count: snapshot.quarantine.count,
-      scannedCount: snapshot.quarantine.scannedCount,
-      truncated: snapshot.quarantine.truncated,
-      entries: snapshot.quarantine.entries
-    },
-    checks: snapshot.checks.map(({ id, status }) => ({ id, status })),
-    recentEvents,
-    redaction: {
-      policy: "allowlist-v1",
-      omitted: [
-        "server URL host/path/query",
-        "store/workspace/config paths",
-        "control token and provider credentials",
-        "task, prompt, tool input/output and approval text",
-        "raw audit and quarantine contents"
-      ],
-      transformed: ["productName/productId/deviceId/runtimeId/quarantine filenames -> SHA-256", "audit events -> closed kind/timestamp only"]
-    }
-  };
-}
-async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
-  const dir = path14__default.dirname(outputPath);
-  const parentStat = await promises.stat(dir);
-  if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
-  const privateDir = path14__default.join(dir, `.${path14__default.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
-  const tempPath = path14__default.join(privateDir, "bundle.tmp");
-  try {
-    await promises.mkdir(privateDir, { mode: 448 });
-    await ensureSecureDir(privateDir, secureFileOptions);
-    await atomicWriteFile(tempPath, `${JSON.stringify(bundle, null, 2)}
-`, { mode: 384, fsync: true });
-    await ensureSecureFile(tempPath, secureFileOptions);
-    await promises.link(tempPath, outputPath);
-    const published = await promises.open(outputPath, "r+");
-    try {
-      await published.sync();
-    } finally {
-      await published.close();
-    }
-    if (process.platform !== "win32") {
-      const parent = await promises.open(dir, "r");
-      try {
-        await parent.sync();
-      } finally {
-        await parent.close();
-      }
-    }
-  } finally {
-    await promises.rm(privateDir, { recursive: true, force: true }).catch(() => void 0);
-  }
-}
-
-// src/bin/commands/support-bundle.ts
 async function runSupportBundleCommand(config, options) {
   if (!options.outputPath) throw new Error("support-bundle requires --output <path>");
   const outputPath = path14__default.resolve(options.outputPath);