@kortix/agent-tunnel 0.1.2 → 0.1.3

package/dist/agent-cli.js

@@ -0,0 +1,4061 @@
+#!/usr/bin/env node
+import {
+  __esm,
+  __export,
+  __require,
+  __toCommonJS
+} from "./chunk-7N7GSU6K.js";
+
+// src/agent/capabilities/desktop/swift-helper.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync, writeFileSync, chmodSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+async function ensureHelper() {
+  if (compiled && existsSync2(HELPER_PATH)) return HELPER_PATH;
+  if (existsSync2(HELPER_PATH)) {
+    compiled = true;
+    return HELPER_PATH;
+  }
+  mkdirSync(BIN_DIR, { recursive: true });
+  const srcPath = join3(BIN_DIR, `desktop-helper-${HELPER_VERSION}.swift`);
+  writeFileSync(srcPath, SWIFT_SOURCE);
+  await new Promise((resolve2, reject) => {
+    const proc = spawn2("swiftc", ["-O", "-o", HELPER_PATH, srcPath], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stderr = "";
+    proc.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code === 0) {
+        chmodSync(HELPER_PATH, 493);
+        compiled = true;
+        resolve2();
+      } else {
+        reject(new Error(`swiftc failed (exit ${code}): ${stderr}`));
+      }
+    });
+    proc.on("error", (err) => {
+      reject(new Error(`swiftc not found: ${err.message}. Install Xcode CLI tools: xcode-select --install`));
+    });
+  });
+  return HELPER_PATH;
+}
+async function execHelper(request) {
+  const helperPath = await ensureHelper();
+  return new Promise((resolve2, reject) => {
+    const proc = spawn2(helperPath, [], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString();
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        if (stderr.includes("accessibility") || stderr.includes("kAXError")) {
+          reject(new Error(
+            "Accessibility permission required. Open System Settings \u2192 Privacy & Security \u2192 Accessibility \u2192 Enable your terminal app."
+          ));
+          return;
+        }
+        reject(new Error(`Helper failed (exit ${code}): ${stderr}`));
+        return;
+      }
+      try {
+        const response = JSON.parse(stdout.trim());
+        if (!response.ok && response.error) {
+          reject(new Error(response.error));
+          return;
+        }
+        resolve2(response);
+      } catch {
+        reject(new Error(`Invalid helper output: ${stdout}`));
+      }
+    });
+    proc.on("error", reject);
+    proc.stdin.write(JSON.stringify(request));
+    proc.stdin.end();
+  });
+}
+var HELPER_VERSION, BIN_DIR, HELPER_PATH, SWIFT_SOURCE, compiled;
+var init_swift_helper = __esm({
+  "src/agent/capabilities/desktop/swift-helper.ts"() {
+    "use strict";
+    HELPER_VERSION = "v4";
+    BIN_DIR = join3(homedir2(), ".agent-tunnel", "bin");
+    HELPER_PATH = join3(BIN_DIR, `desktop-helper-${HELPER_VERSION}`);
+    SWIFT_SOURCE = `
+import Foundation
+import CoreGraphics
+
+struct Request: Decodable {
+    let action: String
+    let x: Double?
+    let y: Double?
+    let toX: Double?
+    let toY: Double?
+    let button: String?
+    let clicks: Int?
+    let modifiers: [String]?
+    let deltaX: Int?
+    let deltaY: Int?
+    let keys: [String]?
+    let pid: Int?
+    let maxDepth: Int?
+    let roles: [String]?
+    let elementId: String?
+    let action_name: String?
+    let query: String?
+    let role: String?
+    let maxResults: Int?
+    let value: String?
+}
+
+struct Response: Encodable {
+    let ok: Bool
+    let x: Double?
+    let y: Double?
+    let error: String?
+    let elements: String?
+    let elementCount: Int?
+}
+
+// \u2500\u2500\u2500 AX Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+import ApplicationServices
+
+var axElementCount = 0
+
+func esc(_ s: String) -> String {
+    return s.replacingOccurrences(of: "\\\\", with: "\\\\\\\\")
+            .replacingOccurrences(of: "\\"", with: "\\\\\\"")
+            .replacingOccurrences(of: "\\n", with: "\\\\n")
+            .replacingOccurrences(of: "\\r", with: "\\\\r")
+            .replacingOccurrences(of: "\\t", with: "\\\\t")
+}
+
+func axStr(_ element: AXUIElement, _ attr: String) -> String {
+    var ref: AnyObject?
+    let err = AXUIElementCopyAttributeValue(element, attr as CFString, &ref)
+    if err != .success { return "" }
+    if let s = ref as? String { return s }
+    if let n = ref as? NSNumber { return n.stringValue }
+    if ref != nil { return "\\(ref!)" }
+    return ""
+}
+
+struct AXProps {
+    var role: String
+    var subrole: String
+    var title: String
+    var value: String
+    var description: String
+    var label: String
+    var roleDescription: String
+    var placeholder: String
+    var identifier: String
+    var help: String
+    var bounds: (x: Int, y: Int, w: Int, h: Int)
+    var enabled: Bool
+    var focused: Bool
+    var actions: [String]
+    var children: [AXUIElement]
+
+    // All searchable text combined
+    var searchText: String {
+        return [title, value, description, label, roleDescription, placeholder, identifier, help]
+            .joined(separator: " ")
+            .lowercased()
+    }
+
+    // Best display label
+    var displayLabel: String {
+        if !title.isEmpty { return title }
+        if !label.isEmpty { return label }
+        if !value.isEmpty {
+            let v = value.count > 60 ? String(value.prefix(60)) + "\u2026" : value
+            return v
+        }
+        if !description.isEmpty { return description }
+        if !roleDescription.isEmpty { return roleDescription }
+        if !placeholder.isEmpty { return "[\\(placeholder)]" }
+        if !help.isEmpty { return help }
+        return "(unnamed)"
+    }
+
+    func toJson(id: String) -> String {
+        var json = "{"
+        json += "\\"id\\":\\"\\(esc(id))\\""
+        json += ",\\"role\\":\\"\\(esc(role))\\""
+        if !subrole.isEmpty { json += ",\\"subrole\\":\\"\\(esc(subrole))\\"" }
+        json += ",\\"title\\":\\"\\(esc(displayLabel))\\""
+        json += ",\\"value\\":\\"\\(esc(value))\\""
+        json += ",\\"description\\":\\"\\(esc(description))\\""
+        if !label.isEmpty { json += ",\\"label\\":\\"\\(esc(label))\\"" }
+        if !placeholder.isEmpty { json += ",\\"placeholder\\":\\"\\(esc(placeholder))\\"" }
+        if !identifier.isEmpty { json += ",\\"identifier\\":\\"\\(esc(identifier))\\"" }
+        json += ",\\"bounds\\":{\\"x\\":\\(bounds.x),\\"y\\":\\(bounds.y),\\"width\\":\\(bounds.w),\\"height\\":\\(bounds.h)}"
+        json += ",\\"enabled\\":\\(enabled)"
+        json += ",\\"focused\\":\\(focused)"
+        json += ",\\"actions\\":["
+        json += actions.map { "\\"\\(esc($0))\\"" }.joined(separator: ",")
+        json += "]"
+        return json
+    }
+}
+
+func readAXProps(_ element: AXUIElement) -> AXProps {
+    let role = axStr(element, kAXRoleAttribute as String)
+    let subrole = axStr(element, kAXSubroleAttribute as String)
+    let title = axStr(element, kAXTitleAttribute as String)
+    let description = axStr(element, kAXDescriptionAttribute as String)
+    let label = axStr(element, "AXLabel")
+    let roleDescription = axStr(element, kAXRoleDescriptionAttribute as String)
+    let placeholder = axStr(element, kAXPlaceholderValueAttribute as String)
+    let identifier = axStr(element, "AXIdentifier")
+    let help = axStr(element, kAXHelpAttribute as String)
+
+    // Value: read carefully, handle different types
+    var valueStr = ""
+    var valueRef: AnyObject?
+    let valErr = AXUIElementCopyAttributeValue(element, kAXValueAttribute as CFString, &valueRef)
+    if valErr == .success, let v = valueRef {
+        if let s = v as? String { valueStr = s }
+        else if let n = v as? NSNumber { valueStr = n.stringValue }
+        else { valueStr = "\\(v)" }
+    }
+
+    // Bounds
+    var posPoint = CGPoint.zero
+    var posRef: AnyObject?
+    if AXUIElementCopyAttributeValue(element, kAXPositionAttribute as CFString, &posRef) == .success, let p = posRef {
+        AXValueGetValue(p as! AXValue, .cgPoint, &posPoint)
+    }
+    var sizVal = CGSize.zero
+    var sizRef: AnyObject?
+    if AXUIElementCopyAttributeValue(element, kAXSizeAttribute as CFString, &sizRef) == .success, let s = sizRef {
+        AXValueGetValue(s as! AXValue, .cgSize, &sizVal)
+    }
+
+    // States
+    var en: AnyObject?
+    AXUIElementCopyAttributeValue(element, kAXEnabledAttribute as CFString, &en)
+    let enabled = (en as? Bool) ?? true
+    var foc: AnyObject?
+    AXUIElementCopyAttributeValue(element, kAXFocusedAttribute as CFString, &foc)
+    let focused = (foc as? Bool) ?? false
+
+    // Actions
+    var actionsArray: CFArray?
+    AXUIElementCopyActionNames(element, &actionsArray)
+    let actions = (actionsArray as? [String]) ?? []
+
+    // Children
+    var childrenRef: AnyObject?
+    AXUIElementCopyAttributeValue(element, kAXChildrenAttribute as CFString, &childrenRef)
+    let children = (childrenRef as? [AXUIElement]) ?? []
+
+    return AXProps(
+        role: role, subrole: subrole, title: title, value: valueStr,
+        description: description, label: label, roleDescription: roleDescription,
+        placeholder: placeholder, identifier: identifier, help: help,
+        bounds: (Int(posPoint.x), Int(posPoint.y), Int(sizVal.width), Int(sizVal.height)),
+        enabled: enabled, focused: focused, actions: actions, children: children
+    )
+}
+
+func axTreeToJson(_ element: AXUIElement, depth: Int, maxDepth: Int, roles: [String]?, pathPrefix: String) -> String? {
+    if depth > maxDepth { return nil }
+    axElementCount += 1
+
+    let p = readAXProps(element)
+
+    // If role filter active and this element doesn't match, skip but walk children
+    if let r = roles, !r.isEmpty, !r.contains(p.role.lowercased()) {
+        var childJsons: [String] = []
+        for (i, child) in p.children.enumerated() {
+            let childPath = pathPrefix.isEmpty ? "\\(i)" : "\\(pathPrefix).\\(i)"
+            if let cj = axTreeToJson(child, depth: depth, maxDepth: maxDepth, roles: roles, pathPrefix: childPath) {
+                childJsons.append(cj)
+            }
+        }
+        return childJsons.isEmpty ? nil : childJsons.joined(separator: ",")
+    }
+
+    var json = p.toJson(id: pathPrefix)
+
+    json += ",\\"children\\":["
+    if depth < maxDepth {
+        var childJsons: [String] = []
+        for (i, child) in p.children.enumerated() {
+            let childPath = pathPrefix.isEmpty ? "\\(i)" : "\\(pathPrefix).\\(i)"
+            if let cj = axTreeToJson(child, depth: depth + 1, maxDepth: maxDepth, roles: roles, pathPrefix: childPath) {
+                childJsons.append(cj)
+            }
+        }
+        json += childJsons.joined(separator: ",")
+    }
+    json += "]}"
+    return json
+}
+
+func navigateToElement(_ root: AXUIElement, path: String) -> AXUIElement? {
+    let parts = path.split(separator: ".").compactMap { Int($0) }
+    var current = root
+    for idx in parts {
+        var childrenRef: AnyObject?
+        AXUIElementCopyAttributeValue(current, kAXChildrenAttribute as CFString, &childrenRef)
+        guard let children = childrenRef as? [AXUIElement], idx < children.count else { return nil }
+        current = children[idx]
+    }
+    return current
+}
+
+func resolveAppElement(_ pid: Int) -> AXUIElement {
+    if pid > 0 {
+        return AXUIElementCreateApplication(pid_t(pid))
+    }
+    // pid=0: get the focused (frontmost) application
+    let systemWide = AXUIElementCreateSystemWide()
+    var focusedApp: AnyObject?
+    let err = AXUIElementCopyAttributeValue(systemWide, kAXFocusedApplicationAttribute as CFString, &focusedApp)
+    if err == .success, let app = focusedApp {
+        return (app as! AXUIElement)
+    }
+    // fallback to system-wide (limited)
+    return systemWide
+}
+
+func searchAXTree(_ element: AXUIElement, query: String, roleFilter: String?, maxResults: Int, results: inout [String], pathPrefix: String, depth: Int, maxDepth: Int) {
+    if results.count >= maxResults || depth > maxDepth { return }
+
+    let p = readAXProps(element)
+    let q = query.lowercased()
+
+    // Search across ALL text attributes
+    var match = p.searchText.contains(q)
+
+    if let rf = roleFilter, !rf.isEmpty, p.role.lowercased() != rf.lowercased() {
+        match = false
+    }
+
+    if match {
+        results.append(p.toJson(id: pathPrefix) + ",\\"children\\":[]}")
+    }
+
+    // Walk children
+    for (i, child) in p.children.enumerated() {
+        if results.count >= maxResults { break }
+        let childPath = pathPrefix.isEmpty ? "\\(i)" : "\\(pathPrefix).\\(i)"
+        searchAXTree(child, query: query, roleFilter: roleFilter, maxResults: maxResults, results: &results, pathPrefix: childPath, depth: depth + 1, maxDepth: maxDepth)
+    }
+}
+
+func modifierFlags(_ names: [String]) -> CGEventFlags {
+    var flags = CGEventFlags()
+    for name in names {
+        switch name.lowercased() {
+        case "cmd", "command": flags.insert(.maskCommand)
+        case "shift": flags.insert(.maskShift)
+        case "alt", "option": flags.insert(.maskAlternate)
+        case "ctrl", "control": flags.insert(.maskControl)
+        case "fn": flags.insert(.maskSecondaryFn)
+        default: break
+        }
+    }
+    return flags
+}
+
+let keyMap: [String: UInt16] = [
+    "return": 36, "enter": 36, "tab": 48, "space": 49, "delete": 51, "backspace": 51,
+    "escape": 53, "esc": 53,
+    "up": 126, "down": 125, "left": 123, "right": 124,
+    "f1": 122, "f2": 120, "f3": 99, "f4": 118, "f5": 96, "f6": 97,
+    "f7": 98, "f8": 100, "f9": 101, "f10": 109, "f11": 103, "f12": 111,
+    "home": 115, "end": 119, "pageup": 116, "pagedown": 121,
+    "a": 0, "b": 11, "c": 8, "d": 2, "e": 14, "f": 3, "g": 5, "h": 4,
+    "i": 34, "j": 38, "k": 40, "l": 37, "m": 46, "n": 45, "o": 31,
+    "p": 35, "q": 12, "r": 15, "s": 1, "t": 17, "u": 32, "v": 9,
+    "w": 13, "x": 7, "y": 16, "z": 6,
+    "0": 29, "1": 18, "2": 19, "3": 20, "4": 21, "5": 23,
+    "6": 22, "7": 26, "8": 28, "9": 25,
+    "-": 27, "=": 24, "[": 33, "]": 30, "\\\\": 42, ";": 41,
+    "'": 39, ",": 43, ".": 47, "/": 44, "\`": 50,
+]
+
+func mouseButton(_ name: String?) -> CGMouseButton {
+    switch name?.lowercased() {
+    case "right": return .right
+    case "middle": return .center
+    default: return .left
+    }
+}
+
+func mouseDownType(_ btn: CGMouseButton) -> CGEventType {
+    switch btn {
+    case .right: return .rightMouseDown
+    case .center: return .otherMouseDown
+    default: return .leftMouseDown
+    }
+}
+
+func mouseUpType(_ btn: CGMouseButton) -> CGEventType {
+    switch btn {
+    case .right: return .rightMouseUp
+    case .center: return .otherMouseUp
+    default: return .leftMouseUp
+    }
+}
+
+func mouseDragType(_ btn: CGMouseButton) -> CGEventType {
+    switch btn {
+    case .right: return .rightMouseDragged
+    case .center: return .otherMouseDragged
+    default: return .leftMouseDragged
+    }
+}
+
+func respond(_ r: Response) {
+    let data = try! JSONEncoder().encode(r)
+    FileHandle.standardOutput.write(data)
+    FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+}
+
+func handleRequest(_ req: Request) {
+    switch req.action {
+    case "click":
+        let point = CGPoint(x: req.x ?? 0, y: req.y ?? 0)
+        let btn = mouseButton(req.button)
+        let clicks = req.clicks ?? 1
+        let mods = modifierFlags(req.modifiers ?? [])
+
+        for i in 0..<clicks {
+            if let down = CGEvent(mouseEventSource: nil, mouseType: mouseDownType(btn), mouseCursorPosition: point, mouseButton: btn) {
+                down.setIntegerValueField(.mouseEventClickState, value: Int64(i + 1))
+                if !mods.isEmpty { down.flags = mods }
+                down.post(tap: .cghidEventTap)
+            }
+            if let up = CGEvent(mouseEventSource: nil, mouseType: mouseUpType(btn), mouseCursorPosition: point, mouseButton: btn) {
+                up.setIntegerValueField(.mouseEventClickState, value: Int64(i + 1))
+                if !mods.isEmpty { up.flags = mods }
+                up.post(tap: .cghidEventTap)
+            }
+        }
+        respond(Response(ok: true, x: nil, y: nil, error: nil, elements: nil, elementCount: nil))
+
+    case "move":
+        let point = CGPoint(x: req.x ?? 0, y: req.y ?? 0)
+        if let event = CGEvent(mouseEventSource: nil, mouseType: .mouseMoved, mouseCursorPosition: point, mouseButton: .left) {
+            event.post(tap: .cghidEventTap)
+        }
+        respond(Response(ok: true, x: nil, y: nil, error: nil, elements: nil, elementCount: nil))
+
+    case "drag":
+        let from = CGPoint(x: req.x ?? 0, y: req.y ?? 0)
+        let to = CGPoint(x: req.toX ?? 0, y: req.toY ?? 0)
+        let btn = mouseButton(req.button)
+
+        if let down = CGEvent(mouseEventSource: nil, mouseType: mouseDownType(btn), mouseCursorPosition: from, mouseButton: btn) {
+            down.post(tap: .cghidEventTap)
+        }
+        usleep(50000)
+
+        let steps = 10
+        for i in 1...steps {
+            let t = Double(i) / Double(steps)
+            let mid = CGPoint(x: from.x + (to.x - from.x) * t, y: from.y + (to.y - from.y) * t)
+            if let drag = CGEvent(mouseEventSource: nil, mouseType: mouseDragType(btn), mouseCursorPosition: mid, mouseButton: btn) {
+                drag.post(tap: .cghidEventTap)
+            }
+            usleep(10000)
+        }
+
+        if let up = CGEvent(mouseEventSource: nil, mouseType: mouseUpType(btn), mouseCursorPosition: to, mouseButton: btn) {
+            up.post(tap: .cghidEventTap)
+        }
+        respond(Response(ok: true, x: nil, y: nil, error: nil, elements: nil, elementCount: nil))
+
+    case "scroll":
+        let point = CGPoint(x: req.x ?? 0, y: req.y ?? 0)
+        if let move = CGEvent(mouseEventSource: nil, mouseType: .mouseMoved, mouseCursorPosition: point, mouseButton: .left) {
+            move.post(tap: .cghidEventTap)
+        }
+        usleep(10000)
+
+        let dy = Int32(req.deltaY ?? 0)
+        let dx = Int32(req.deltaX ?? 0)
+        if let scroll = CGEvent(scrollWheelEvent2Source: nil, units: .pixel, wheelCount: 3, wheel1: dy, wheel2: dx, wheel3: 0) {
+            scroll.post(tap: .cghidEventTap)
+        }
+        respond(Response(ok: true, x: nil, y: nil, error: nil, elements: nil, elementCount: nil))
+
+    case "key":
+        let keys = req.keys ?? []
+        var mods: [String] = []
+        var mainKeys: [String] = []
+
+        for k in keys {
+            let lower = k.lowercased()
+            if ["cmd", "command", "shift", "alt", "option", "ctrl", "control", "fn"].contains(lower) {
+                mods.append(lower)
+            } else {
+                mainKeys.append(lower)
+            }
+        }
+
+        let flags = modifierFlags(mods)
+
+        for key in mainKeys {
+            guard let code = keyMap[key] else {
+                respond(Response(ok: false, x: nil, y: nil, error: "Unknown key: \\(key)", elements: nil, elementCount: nil))
+                return
+            }
+            if let down = CGEvent(keyboardEventSource: nil, virtualKey: code, keyDown: true) {
+                if !flags.isEmpty { down.flags = flags }
+                down.post(tap: .cghidEventTap)
+            }
+            if let up = CGEvent(keyboardEventSource: nil, virtualKey: code, keyDown: false) {
+                if !flags.isEmpty { up.flags = flags }
+                up.post(tap: .cghidEventTap)
+            }
+        }
+        respond(Response(ok: true, x: nil, y: nil, error: nil, elements: nil, elementCount: nil))
+
+    case "position":
+        let loc = CGEvent(source: nil)!.location
+        respond(Response(ok: true, x: Double(loc.x), y: Double(loc.y), error: nil, elements: nil, elementCount: nil))
+
+    case "ax_tree":
+        let pid = req.pid ?? 0
+        let maxD = req.maxDepth ?? 8
+        let rolesFilter = req.roles?.map { $0.lowercased() }
+
+        let appElement = resolveAppElement(pid)
+
+        axElementCount = 0
+        let treeJson = axTreeToJson(appElement, depth: 0, maxDepth: maxD, roles: rolesFilter, pathPrefix: "0") ?? "null"
+        let treeOut = "{\\"ok\\":true,\\"root\\":" + treeJson + ",\\"elementCount\\":" + "\\(axElementCount)" + "}"
+        FileHandle.standardOutput.write(treeOut.data(using: .utf8)!)
+        FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+
+    case "ax_action":
+        let pid = req.pid ?? 0
+        let elementId = req.elementId ?? "0"
+        let actionName = req.action_name ?? ""
+
+        let appElement = resolveAppElement(pid)
+
+        guard let target = navigateToElement(appElement, path: elementId) else {
+            respond(Response(ok: false, x: nil, y: nil, error: "Element not found: \\(elementId)", elements: nil, elementCount: nil))
+            return
+        }
+
+        // Read state BEFORE action
+        let beforeProps = readAXProps(target)
+        let beforeFocused = beforeProps.focused
+        let beforeValue = beforeProps.value
+
+        let result = AXUIElementPerformAction(target, actionName as CFString)
+        if result != .success {
+            respond(Response(ok: false, x: nil, y: nil, error: "Action failed: \\(actionName) (error \\(result.rawValue))", elements: nil, elementCount: nil))
+            return
+        }
+
+        // Brief pause for state to settle
+        usleep(50000)
+
+        // Read state AFTER action for verification
+        let afterProps = readAXProps(target)
+        var verifyJson = "{\\"ok\\":true"
+        verifyJson += ",\\"action\\":\\"\\(esc(actionName))\\""
+        verifyJson += ",\\"elementId\\":\\"\\(esc(elementId))\\""
+        verifyJson += ",\\"before\\":{\\"focused\\":\\(beforeFocused),\\"value\\":\\"\\(esc(beforeValue))\\"}"
+        verifyJson += ",\\"after\\":{\\"focused\\":\\(afterProps.focused),\\"value\\":\\"\\(esc(afterProps.value))\\"}"
+        verifyJson += ",\\"role\\":\\"\\(esc(afterProps.role))\\""
+        verifyJson += ",\\"title\\":\\"\\(esc(afterProps.displayLabel))\\""
+        let changed = (beforeFocused != afterProps.focused) || (beforeValue != afterProps.value)
+        verifyJson += ",\\"stateChanged\\":\\(changed)"
+        verifyJson += "}"
+        FileHandle.standardOutput.write(verifyJson.data(using: .utf8)!)
+        FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+
+    case "ax_set_value":
+        let pid = req.pid ?? 0
+        let elementId = req.elementId ?? "0"
+        let newValue = req.value ?? ""
+
+        let appElement = resolveAppElement(pid)
+
+        guard let target = navigateToElement(appElement, path: elementId) else {
+            respond(Response(ok: false, x: nil, y: nil, error: "Element not found: \\(elementId)", elements: nil, elementCount: nil))
+            return
+        }
+
+        // First focus the element
+        AXUIElementSetAttributeValue(target, kAXFocusedAttribute as CFString, kCFBooleanTrue)
+        usleep(30000)
+
+        // Set the value directly
+        let setResult = AXUIElementSetAttributeValue(target, kAXValueAttribute as CFString, newValue as CFTypeRef)
+        usleep(50000)
+
+        // Verify by reading back
+        let verifyValue = axStr(target, kAXValueAttribute as String)
+        let success = (setResult == .success) && (verifyValue == newValue || verifyValue.contains(newValue))
+
+        var svJson = "{\\"ok\\":\\(success)"
+        svJson += ",\\"elementId\\":\\"\\(esc(elementId))\\""
+        svJson += ",\\"requestedValue\\":\\"\\(esc(newValue))\\""
+        svJson += ",\\"actualValue\\":\\"\\(esc(verifyValue))\\""
+        if !success {
+            if setResult != .success {
+                svJson += ",\\"error\\":\\"SetAttributeValue failed (error \\(setResult.rawValue)). Element may not support direct value setting.\\""
+            } else {
+                svJson += ",\\"error\\":\\"Value was set but verification failed. Expected \\\\\\"\\"  + esc(newValue) + \\"\\\\\\", got \\\\\\"\\"+  esc(verifyValue) + \\"\\\\\\"\\""
+            }
+        }
+        svJson += "}"
+        FileHandle.standardOutput.write(svJson.data(using: .utf8)!)
+        FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+
+    case "ax_focus":
+        let pid = req.pid ?? 0
+        let elementId = req.elementId ?? "0"
+
+        let appElement = resolveAppElement(pid)
+
+        guard let target = navigateToElement(appElement, path: elementId) else {
+            respond(Response(ok: false, x: nil, y: nil, error: "Element not found: \\(elementId)", elements: nil, elementCount: nil))
+            return
+        }
+
+        // Read focus state before
+        let beforeFocProps = readAXProps(target)
+
+        // Set focused attribute
+        let focResult = AXUIElementSetAttributeValue(target, kAXFocusedAttribute as CFString, kCFBooleanTrue)
+        usleep(50000)
+
+        // Verify focus
+        let afterFocProps = readAXProps(target)
+        let focSuccess = afterFocProps.focused
+
+        var focJson = "{\\"ok\\":\\(focSuccess)"
+        focJson += ",\\"elementId\\":\\"\\(esc(elementId))\\""
+        focJson += ",\\"role\\":\\"\\(esc(afterFocProps.role))\\""
+        focJson += ",\\"title\\":\\"\\(esc(afterFocProps.displayLabel))\\""
+        focJson += ",\\"before\\":{\\"focused\\":\\(beforeFocProps.focused)}"
+        focJson += ",\\"after\\":{\\"focused\\":\\(afterFocProps.focused)}"
+        if !focSuccess {
+            if focResult != .success {
+                focJson += ",\\"error\\":\\"SetAttributeValue(kAXFocusedAttribute) failed (error \\(focResult.rawValue))\\""
+            } else {
+                focJson += ",\\"error\\":\\"Focus was requested but element reports not focused. It may not be focusable.\\""
+            }
+        }
+        focJson += "}"
+        FileHandle.standardOutput.write(focJson.data(using: .utf8)!)
+        FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+
+    case "ax_search":
+        let pid = req.pid ?? 0
+        let query = req.query ?? ""
+        let roleFilter = req.role
+        let maxRes = req.maxResults ?? 20
+
+        let appElement = resolveAppElement(pid)
+
+        var searchResults: [String] = []
+        searchAXTree(appElement, query: query, roleFilter: roleFilter, maxResults: maxRes, results: &searchResults, pathPrefix: "0", depth: 0, maxDepth: 20)
+
+        let searchOut = "{\\"ok\\":true,\\"elements\\":[" + searchResults.joined(separator: ",") + "]}"
+        FileHandle.standardOutput.write(searchOut.data(using: .utf8)!)
+        FileHandle.standardOutput.write("\\n".data(using: .utf8)!)
+
+    default:
+        respond(Response(ok: false, x: nil, y: nil, error: "Unknown action: \\(req.action)", elements: nil, elementCount: nil))
+    }
+}
+
+let input = FileHandle.standardInput.readDataToEndOfFile()
+guard let req = try? JSONDecoder().decode(Request.self, from: input) else {
+    respond(Response(ok: false, x: nil, y: nil, error: "Invalid JSON input", elements: nil, elementCount: nil))
+    exit(1)
+}
+handleRequest(req)
+`;
+    compiled = false;
+  }
+});
+
+// src/agent/capabilities/desktop/macos-driver.ts
+var macos_driver_exports = {};
+__export(macos_driver_exports, {
+  MacOSDriver: () => MacOSDriver
+});
+import { spawn as spawn3 } from "child_process";
+import { readFile as readFile2, unlink as unlink2 } from "fs/promises";
+import { join as join4 } from "path";
+import { tmpdir } from "os";
+import { randomBytes as randomBytes2 } from "crypto";
+function tmpPath(ext = ".png") {
+  return join4(tmpdir(), `tunnel-ss-${randomBytes2(6).toString("hex")}${ext}`);
+}
+function exec(cmd, args, timeoutMs = 15e3) {
+  return new Promise((resolve2, reject) => {
+    const proc = spawn3(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    const timer = setTimeout(() => {
+      killed = true;
+      proc.kill("SIGKILL");
+      reject(new Error(`${cmd} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString();
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      clearTimeout(timer);
+      if (killed) return;
+      if (code !== 0) reject(new Error(`${cmd} failed (${code}): ${stderr}`));
+      else resolve2(stdout);
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timer);
+      if (!killed) reject(err);
+    });
+  });
+}
+function osascript(script, timeoutMs = 15e3) {
+  return exec("osascript", ["-l", "JavaScript", "-e", script], timeoutMs);
+}
+async function runAx(params) {
+  const paramsJson = JSON.stringify(params);
+  const result = await exec("osascript", ["-l", "JavaScript", "-e", JXA_AX_SCRIPT, "--", paramsJson], 3e4);
+  const parsed = JSON.parse(result.trim());
+  if (!parsed.ok && parsed.error) throw new Error(parsed.error);
+  return parsed;
+}
+async function captureToBase64(args) {
+  const capturePath = tmpPath(".png");
+  const jpegPath = tmpPath(".jpg");
+  await exec("screencapture", ["-x", "-t", "png", ...args, capturePath]);
+  await exec("sips", [
+    "-s",
+    "format",
+    "jpeg",
+    "-s",
+    "formatOptions",
+    "60",
+    "--resampleHeightWidthMax",
+    "1920",
+    capturePath,
+    "--out",
+    jpegPath
+  ]);
+  let width = 0, height = 0;
+  try {
+    const info = await exec("sips", ["-g", "pixelWidth", "-g", "pixelHeight", jpegPath]);
+    const wm = info.match(/pixelWidth:\s*(\d+)/);
+    const hm = info.match(/pixelHeight:\s*(\d+)/);
+    if (wm) width = parseInt(wm[1], 10);
+    if (hm) height = parseInt(hm[1], 10);
+  } catch {
+  }
+  const buf = await readFile2(jpegPath);
+  await unlink2(capturePath).catch(() => {
+  });
+  await unlink2(jpegPath).catch(() => {
+  });
+  return {
+    image: buf.toString("base64"),
+    width,
+    height,
+    format: "jpeg"
+  };
+}
+var JXA_AX_SCRIPT, MacOSDriver;
+var init_macos_driver = __esm({
+  "src/agent/capabilities/desktop/macos-driver.ts"() {
+    "use strict";
+    init_swift_helper();
+    JXA_AX_SCRIPT = `function run(argv) {
+  try {
+    var p = JSON.parse(argv[0]);
+    var se = Application("System Events");
+
+    // Resolve target process: by PID or frontmost
+    var proc;
+    if (p.pid && p.pid > 0) {
+      var m = se.processes.whose({unixId: p.pid})();
+      if (!m.length) return JSON.stringify({ok:false, error:"Process with PID "+p.pid+" not found"});
+      proc = m[0];
+    } else {
+      var m = se.processes.whose({frontmost: true})();
+      if (!m.length) return JSON.stringify({ok:false, error:"No frontmost application found"});
+      proc = m[0];
+    }
+
+    // Navigate to element by dot-path (e.g. "0.3.1")
+    function nav(path) {
+      var el = proc, parts = path.split(".");
+      for (var i = 0; i < parts.length; i++) {
+        try { el = el.uiElements()[parseInt(parts[i])]; }
+        catch(e) { return null; }
+      }
+      return el;
+    }
+
+    // Read all useful properties, safely
+    function props(el) {
+      var r = {role:"",title:"",value:"",desc:"",pos:[0,0],sz:[0,0],en:true,foc:false,acts:[]};
+      try { r.role = el.role() || ""; } catch(e) {}
+      try { r.title = el.title() || ""; } catch(e) {}
+      try { var v = el.value(); r.value = (v == null) ? "" : String(v); } catch(e) {}
+      try { r.desc = el.description() || ""; } catch(e) {}
+      try { r.pos = el.position() || [0,0]; } catch(e) {}
+      try { r.sz = el.size() || [0,0]; } catch(e) {}
+      try { r.en = el.enabled(); } catch(e) {}
+      try { r.foc = el.focused(); } catch(e) {}
+      try { r.acts = el.actions().map(function(a) { return a.name(); }); } catch(e) {}
+      return r;
+    }
+
+    // Convert to output node
+    function toNode(id, pr) {
+      var label = pr.title || pr.value || pr.desc || "(unnamed)";
+      if (label.length > 120) label = label.substring(0, 120) + "...";
+      return {
+        id:id, role:pr.role, title:label, value:pr.value, description:pr.desc,
+        bounds:{x:pr.pos[0]||0, y:pr.pos[1]||0, width:pr.sz[0]||0, height:pr.sz[1]||0},
+        enabled:pr.en, focused:pr.foc, actions:pr.acts, children:[]
+      };
+    }
+
+    // \u2500\u2500 TREE \u2500\u2500
+    if (p.op === "tree") {
+      var cnt = 0, maxD = p.maxDepth || 8;
+      function walk(el, id, depth) {
+        if (depth > maxD) return null;
+        cnt++;
+        var pr = props(el);
+        var node = toNode(id, pr);
+        if (depth < maxD) {
+          try {
+            var kids = el.uiElements();
+            for (var i = 0; i < kids.length; i++) {
+              var c = walk(kids[i], id + "." + i, depth + 1);
+              if (c) node.children.push(c);
+            }
+          } catch(e) {}
+        }
+        return node;
+      }
+      var root = walk(proc, "0", 0);
+      return JSON.stringify({ok:true, root:root, elementCount:cnt});
+    }
+
+    // \u2500\u2500 ACTION (with before/after verification) \u2500\u2500
+    if (p.op === "action") {
+      var el = nav(p.elementId || "0");
+      if (!el) return JSON.stringify({ok:false, error:"Element not found: " + p.elementId});
+      var bPr = props(el);
+      try { el.actions.byName(p.actionName).perform(); }
+      catch(e) { return JSON.stringify({ok:false, error:"Action failed: " + String(e)}); }
+      delay(0.05);
+      var aPr = props(el);
+      var changed = (bPr.foc !== aPr.foc) || (bPr.value !== aPr.value);
+      return JSON.stringify({
+        ok:true, action:p.actionName, elementId:p.elementId,
+        before:{focused:bPr.foc, value:bPr.value},
+        after:{focused:aPr.foc, value:aPr.value},
+        stateChanged:changed, role:aPr.role, title:aPr.title||aPr.value||""
+      });
+    }
+
+    // \u2500\u2500 SET VALUE (direct + verify) \u2500\u2500
+    if (p.op === "set_value") {
+      var el = nav(p.elementId || "0");
+      if (!el) return JSON.stringify({ok:false, error:"Element not found: " + p.elementId});
+      try { el.focused = true; } catch(e) {}
+      delay(0.03);
+      try { el.value = p.value; }
+      catch(e) {
+        return JSON.stringify({ok:false, elementId:p.elementId, requestedValue:p.value,
+          actualValue:"", error:"Cannot set value: " + String(e)});
+      }
+      delay(0.05);
+      var actual = "";
+      try { var v = el.value(); actual = (v == null) ? "" : String(v); } catch(e) {}
+      var ok = (actual === p.value) || actual.indexOf(p.value) >= 0;
+      return JSON.stringify({ok:ok, elementId:p.elementId, requestedValue:p.value,
+        actualValue:actual, error:ok ? undefined : "Verification failed: value is " + JSON.stringify(actual)});
+    }
+
+    // \u2500\u2500 FOCUS (direct + verify) \u2500\u2500
+    if (p.op === "focus") {
+      var el = nav(p.elementId || "0");
+      if (!el) return JSON.stringify({ok:false, error:"Element not found: " + p.elementId});
+      var bFoc = false;
+      try { bFoc = el.focused(); } catch(e) {}
+      try { el.focused = true; }
+      catch(e) {
+        return JSON.stringify({ok:false, elementId:p.elementId, role:"", title:"",
+          before:{focused:bFoc}, after:{focused:false}, error:"Cannot set focus: " + String(e)});
+      }
+      delay(0.05);
+      var pr = props(el);
+      return JSON.stringify({ok:pr.foc, elementId:p.elementId, role:pr.role,
+        title:pr.title||pr.value||"",
+        before:{focused:bFoc}, after:{focused:pr.foc},
+        error:pr.foc ? undefined : "Element does not report as focused after setting"});
+    }
+
+    // \u2500\u2500 SEARCH \u2500\u2500
+    if (p.op === "search") {
+      var results = [], q = (p.query || "").toLowerCase(), maxR = p.maxResults || 20;
+      function srch(el, id, depth) {
+        if (results.length >= maxR || depth > 20) return;
+        var pr = props(el);
+        var txt = (pr.title + " " + pr.value + " " + pr.desc).toLowerCase();
+        if (txt.indexOf(q) >= 0) {
+          if (!p.role || pr.role.toLowerCase() === p.role.toLowerCase()) {
+            results.push(toNode(id, pr));
+          }
+        }
+        try {
+          var kids = el.uiElements();
+          for (var i = 0; i < kids.length; i++) { srch(kids[i], id+"."+i, depth+1); }
+        } catch(e) {}
+      }
+      srch(proc, "0", 0);
+      return JSON.stringify({ok:true, elements:results});
+    }
+
+    return JSON.stringify({ok:false, error:"Unknown op: " + p.op});
+  } catch(e) {
+    return JSON.stringify({ok:false, error:String(e)});
+  }
+}`;
+    MacOSDriver = class {
+      async screenshot(options) {
+        const args = [];
+        if (options.region) {
+          const { x, y, width, height } = options.region;
+          args.push("-R", `${x},${y},${width},${height}`);
+        } else if (options.windowId) {
+          args.push("-l", String(options.windowId));
+        }
+        return captureToBase64(args);
+      }
+      async mouseClick(options) {
+        await execHelper({
+          action: "click",
+          x: options.x,
+          y: options.y,
+          button: options.button || "left",
+          clicks: options.clicks || 1,
+          modifiers: options.modifiers
+        });
+      }
+      async mouseMove(options) {
+        await execHelper({ action: "move", x: options.x, y: options.y });
+      }
+      async mouseDrag(options) {
+        await execHelper({
+          action: "drag",
+          x: options.fromX,
+          y: options.fromY,
+          toX: options.toX,
+          toY: options.toY,
+          button: options.button || "left"
+        });
+      }
+      async mouseScroll(options) {
+        await execHelper({
+          action: "scroll",
+          x: options.x,
+          y: options.y,
+          deltaX: options.deltaX || 0,
+          deltaY: options.deltaY || 0
+        });
+      }
+      async mousePosition() {
+        const res = await execHelper({ action: "position" });
+        return { x: res.x, y: res.y };
+      }
+      async keyboardType(options) {
+        const escaped = options.text.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const script = `
+      const se = Application("System Events");
+      se.keystroke("${escaped}");
+    `;
+        await osascript(script);
+        if (options.delay) {
+          await new Promise((r) => setTimeout(r, options.delay));
+        }
+      }
+      async keyboardKey(options) {
+        await execHelper({ action: "key", keys: options.keys });
+      }
+      async windowList() {
+        const script = `
+      ObjC.import("CoreGraphics");
+      ObjC.import("Foundation");
+      const kOnScreen = (1 << 0);
+      const kExclDesk = (1 << 4);
+      const raw = $.CGWindowListCopyWindowInfo(kOnScreen | kExclDesk, 0);
+      const list = ObjC.unwrap(raw);
+      const result = [];
+      for (let i = 0; i < list.length; i++) {
+        const w = list[i];
+        const layer = w["kCGWindowLayer"];
+        if (layer !== 0) continue;
+        const owner = w["kCGWindowOwnerName"] || "";
+        const name = w["kCGWindowName"];
+        if (name === undefined || name === null) continue;
+        const num = w["kCGWindowNumber"];
+        const b = w["kCGWindowBounds"];
+        result.push({
+          id: num,
+          app: owner,
+          title: name || "",
+          bounds: { x: b.X, y: b.Y, width: b.Width, height: b.Height },
+          minimized: false,
+        });
+      }
+      JSON.stringify(result);
+    `;
+        const out = await osascript(script);
+        return JSON.parse(out.trim());
+      }
+      async windowFocus(windowId) {
+        const windows = await this.windowList();
+        const win = windows.find((w) => w.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        const script = `
+      const app = Application("${win.app}");
+      app.activate();
+    `;
+        await osascript(script);
+      }
+      async windowResize(windowId, bounds) {
+        const windows = await this.windowList();
+        const win = windows.find((w) => w.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        const parts = [];
+        if (bounds.x !== void 0 || bounds.y !== void 0) {
+          const x = bounds.x ?? win.bounds.x;
+          const y = bounds.y ?? win.bounds.y;
+          parts.push(`w.position = [${x}, ${y}];`);
+        }
+        if (bounds.width !== void 0 || bounds.height !== void 0) {
+          const w = bounds.width ?? win.bounds.width;
+          const h = bounds.height ?? win.bounds.height;
+          parts.push(`w.size = [${w}, ${h}];`);
+        }
+        if (parts.length === 0) return;
+        const title = win.title.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const script = `
+      const se = Application("System Events");
+      const proc = se.processes.byName("${win.app}");
+      const wins = proc.windows();
+      for (const w of wins) {
+        try {
+          const pos = w.position();
+          if (w.title() === "${title}" && pos[0] === ${win.bounds.x} && pos[1] === ${win.bounds.y}) {
+            ${parts.join("\n            ")}
+            break;
+          }
+        } catch(e) {}
+      }
+    `;
+        await osascript(script);
+      }
+      async windowClose(windowId) {
+        const windows = await this.windowList();
+        const win = windows.find((w) => w.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        const title = win.title.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const script = `
+      const se = Application("System Events");
+      const proc = se.processes.byName("${win.app}");
+      const wins = proc.windows();
+      for (const w of wins) {
+        try {
+          const pos = w.position();
+          if (w.title() === "${title}" && pos[0] === ${win.bounds.x} && pos[1] === ${win.bounds.y}) {
+            w.buttons.whose({subrole: "AXCloseButton"})()[0].click();
+            break;
+          }
+        } catch(e) {}
+      }
+    `;
+        await osascript(script);
+      }
+      async windowMinimize(windowId) {
+        const windows = await this.windowList();
+        const win = windows.find((w) => w.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        const title = win.title.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const script = `
+      const se = Application("System Events");
+      const proc = se.processes.byName("${win.app}");
+      const wins = proc.windows();
+      for (const w of wins) {
+        try {
+          const pos = w.position();
+          if (w.title() === "${title}" && pos[0] === ${win.bounds.x} && pos[1] === ${win.bounds.y}) {
+            w.minimized = true;
+            break;
+          }
+        } catch(e) {}
+      }
+    `;
+        await osascript(script);
+      }
+      async appLaunch(name) {
+        await exec("open", ["-a", name]);
+      }
+      async appQuit(name) {
+        const script = `
+      try {
+        const app = Application("${name}");
+        app.quit();
+        "ok";
+      } catch(e) {
+        "error: " + e.message;
+      }
+    `;
+        const result = await osascript(script);
+        if (result.trim().startsWith("error:")) {
+          throw new Error(result.trim());
+        }
+      }
+      async appList() {
+        const script = `
+      const se = Application("System Events");
+      const procs = se.processes.whose({backgroundOnly: false})();
+      const result = [];
+      for (const proc of procs) {
+        try {
+          result.push({
+            name: proc.name(),
+            pid: proc.unixId(),
+            bundleId: proc.bundleIdentifier() || undefined,
+          });
+        } catch(e) {}
+      }
+      JSON.stringify(result);
+    `;
+        const out = await osascript(script);
+        return JSON.parse(out.trim());
+      }
+      async clipboardRead() {
+        return exec("pbpaste", []);
+      }
+      async clipboardWrite(text) {
+        await new Promise((resolve2, reject) => {
+          const proc = spawn3("pbcopy", [], { stdio: ["pipe", "ignore", "pipe"] });
+          proc.on("close", (code) => {
+            if (code !== 0) reject(new Error(`pbcopy failed (${code})`));
+            else resolve2();
+          });
+          proc.on("error", reject);
+          proc.stdin.write(text);
+          proc.stdin.end();
+        });
+      }
+      async screenInfo() {
+        const script = `
+      ObjC.import("AppKit");
+      const screen = $.NSScreen.mainScreen;
+      const frame = screen.frame;
+      const scale = screen.backingScaleFactor;
+      JSON.stringify({
+        width: frame.size.width,
+        height: frame.size.height,
+        scaleFactor: scale,
+      });
+    `;
+        const out = await osascript(script);
+        return JSON.parse(out.trim());
+      }
+      async cursorImage(radius = 50) {
+        const pos = await this.mousePosition();
+        const x = Math.max(0, Math.round(pos.x - radius));
+        const y = Math.max(0, Math.round(pos.y - radius));
+        const size = radius * 2;
+        return captureToBase64(["-R", `${x},${y},${size},${size}`]);
+      }
+      async axTree(options) {
+        const res = await runAx({
+          op: "tree",
+          pid: options.pid || 0,
+          maxDepth: options.maxDepth ?? 8
+        });
+        return { root: res.root, elementCount: res.elementCount };
+      }
+      async axAction(options) {
+        return await runAx({
+          op: "action",
+          elementId: options.elementId,
+          actionName: options.action,
+          pid: options.pid || 0
+        });
+      }
+      async axSetValue(options) {
+        return await runAx({
+          op: "set_value",
+          elementId: options.elementId,
+          value: options.value,
+          pid: options.pid || 0
+        });
+      }
+      async axFocus(options) {
+        return await runAx({
+          op: "focus",
+          elementId: options.elementId,
+          pid: options.pid || 0
+        });
+      }
+      async axSearch(options) {
+        const res = await runAx({
+          op: "search",
+          query: options.query,
+          role: options.role,
+          pid: options.pid || 0,
+          maxResults: options.maxResults ?? 20
+        });
+        return { elements: res.elements || [] };
+      }
+    };
+  }
+});
+
+// src/agent/capabilities/desktop/csharp-helper.ts
+import { spawn as spawn4 } from "child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+async function ensureHelper2() {
+  if (compiled2 && existsSync3(HELPER_PATH2)) return HELPER_PATH2;
+  if (existsSync3(HELPER_PATH2)) {
+    compiled2 = true;
+    return HELPER_PATH2;
+  }
+  mkdirSync2(BIN_DIR2, { recursive: true });
+  const srcPath = join5(BIN_DIR2, `desktop-helper-win-${HELPER_VERSION2}.cs`);
+  writeFileSync2(srcPath, CSHARP_SOURCE);
+  const cscPath = join5(
+    process.env.WINDIR || "C:\\Windows",
+    "Microsoft.NET",
+    "Framework64",
+    "v4.0.30319",
+    "csc.exe"
+  );
+  await new Promise((resolve2, reject) => {
+    const proc = spawn4(cscPath, [
+      "/nologo",
+      "/optimize+",
+      `/out:${HELPER_PATH2}`,
+      "/r:System.Windows.Forms.dll",
+      "/r:System.Drawing.dll",
+      "/r:UIAutomationClient.dll",
+      "/r:UIAutomationTypes.dll",
+      "/r:WindowsBase.dll",
+      "/r:PresentationCore.dll",
+      srcPath
+    ], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stderr = "";
+    proc.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code === 0) {
+        compiled2 = true;
+        resolve2();
+      } else {
+        reject(new Error(`csc.exe failed (exit ${code}): ${stderr}`));
+      }
+    });
+    proc.on("error", (err) => {
+      reject(new Error(`csc.exe not found: ${err.message}. Ensure .NET Framework 4.x is installed.`));
+    });
+  });
+  return HELPER_PATH2;
+}
+async function execHelper2(request) {
+  const helperPath = await ensureHelper2();
+  return new Promise((resolve2, reject) => {
+    const proc = spawn4(helperPath, [], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString();
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(`Helper failed (exit ${code}): ${stderr}`));
+        return;
+      }
+      try {
+        const response = JSON.parse(stdout.trim());
+        if (!response.ok && response.error) {
+          reject(new Error(response.error));
+          return;
+        }
+        resolve2(response);
+      } catch {
+        reject(new Error(`Invalid helper output: ${stdout}`));
+      }
+    });
+    proc.on("error", reject);
+    proc.stdin.write(JSON.stringify(request));
+    proc.stdin.end();
+  });
+}
+var HELPER_VERSION2, BIN_DIR2, HELPER_PATH2, CSHARP_SOURCE, compiled2;
+var init_csharp_helper = __esm({
+  "src/agent/capabilities/desktop/csharp-helper.ts"() {
+    "use strict";
+    HELPER_VERSION2 = "v1";
+    BIN_DIR2 = join5(homedir3(), ".agent-tunnel", "bin");
+    HELPER_PATH2 = join5(BIN_DIR2, `desktop-helper-win-${HELPER_VERSION2}.exe`);
+    CSHARP_SOURCE = `
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Drawing;
+using System.Drawing.Imaging;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+using System.Windows.Automation;
+using System.Windows.Forms;
+
+class Helper
+{
+    // \u2500\u2500\u2500 P/Invoke \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    [DllImport("user32.dll")] static extern bool SetCursorPos(int X, int Y);
+    [DllImport("user32.dll")] static extern bool GetCursorPos(out POINT lpPoint);
+    [DllImport("user32.dll")] static extern uint SendInput(uint nInputs, INPUT[] pInputs, int cbSize);
+    [DllImport("user32.dll")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam);
+    [DllImport("user32.dll")] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount);
+    [DllImport("user32.dll")] static extern bool GetWindowRect(IntPtr hWnd, out RECT lpRect);
+    [DllImport("user32.dll")] static extern bool IsWindowVisible(IntPtr hWnd);
+    [DllImport("user32.dll")] static extern bool SetForegroundWindow(IntPtr hWnd);
+    [DllImport("user32.dll")] static extern bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight, bool bRepaint);
+    [DllImport("user32.dll")] static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
+    [DllImport("user32.dll")] static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
+    [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);
+    [DllImport("user32.dll")] static extern int GetWindowTextLength(IntPtr hWnd);
+
+    delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);
+
+    const int SW_MINIMIZE = 6;
+    const uint WM_CLOSE = 0x0010;
+    const int INPUT_MOUSE = 0;
+    const int INPUT_KEYBOARD = 1;
+    const uint MOUSEEVENTF_LEFTDOWN = 0x0002;
+    const uint MOUSEEVENTF_LEFTUP = 0x0004;
+    const uint MOUSEEVENTF_RIGHTDOWN = 0x0008;
+    const uint MOUSEEVENTF_RIGHTUP = 0x0010;
+    const uint MOUSEEVENTF_MIDDLEDOWN = 0x0020;
+    const uint MOUSEEVENTF_MIDDLEUP = 0x0040;
+    const uint MOUSEEVENTF_WHEEL = 0x0800;
+    const uint MOUSEEVENTF_HWHEEL = 0x1000;
+    const uint MOUSEEVENTF_ABSOLUTE = 0x8000;
+    const uint MOUSEEVENTF_MOVE = 0x0001;
+    const uint KEYEVENTF_KEYUP = 0x0002;
+    const uint KEYEVENTF_UNICODE = 0x0004;
+
+    [StructLayout(LayoutKind.Sequential)] struct POINT { public int X; public int Y; }
+    [StructLayout(LayoutKind.Sequential)] struct RECT { public int Left, Top, Right, Bottom; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct INPUT { public int type; public INPUTUNION u; }
+
+    [StructLayout(LayoutKind.Explicit)]
+    struct INPUTUNION
+    {
+        [FieldOffset(0)] public MOUSEINPUT mi;
+        [FieldOffset(0)] public KEYBDINPUT ki;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct MOUSEINPUT { public int dx, dy; public uint mouseData; public uint dwFlags; public uint time; public IntPtr dwExtraInfo; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct KEYBDINPUT { public ushort wVk; public ushort wScan; public uint dwFlags; public uint time; public IntPtr dwExtraInfo; }
+
+    // \u2500\u2500\u2500 JSON helpers (minimal, no dependencies) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    static string JsonStr(string s) => "\\"" + s.Replace("\\\\", "\\\\\\\\").Replace("\\"", "\\\\\\"").Replace("\\n", "\\\\n").Replace("\\r", "\\\\r").Replace("\\t", "\\\\t") + "\\"";
+
+    static Dictionary<string, object> ParseJson(string json)
+    {
+        var d = new Dictionary<string, object>();
+        json = json.Trim();
+        if (json.StartsWith("{")) json = json.Substring(1, json.Length - 2).Trim();
+
+        int i = 0;
+        while (i < json.Length)
+        {
+            while (i < json.Length && (json[i] == ',' || json[i] == ' ' || json[i] == '\\n' || json[i] == '\\r' || json[i] == '\\t')) i++;
+            if (i >= json.Length) break;
+
+            var key = ParseJsonString(json, ref i);
+            while (i < json.Length && (json[i] == ' ' || json[i] == ':')) i++;
+            var val = ParseJsonValue(json, ref i);
+            d[key] = val;
+        }
+        return d;
+    }
+
+    static string ParseJsonString(string json, ref int i)
+    {
+        if (json[i] != '\\"') throw new Exception("Expected string at " + i);
+        i++;
+        var sb = new StringBuilder();
+        while (i < json.Length && json[i] != '\\"')
+        {
+            if (json[i] == '\\\\') { i++; sb.Append(json[i]); }
+            else sb.Append(json[i]);
+            i++;
+        }
+        i++; // skip closing quote
+        return sb.ToString();
+    }
+
+    static object ParseJsonValue(string json, ref int i)
+    {
+        while (i < json.Length && json[i] == ' ') i++;
+        if (i >= json.Length) return null;
+
+        if (json[i] == '\\"') return ParseJsonString(json, ref i);
+        if (json[i] == '[')
+        {
+            i++;
+            var list = new List<object>();
+            while (i < json.Length && json[i] != ']')
+            {
+                while (i < json.Length && (json[i] == ',' || json[i] == ' ' || json[i] == '\\n' || json[i] == '\\r' || json[i] == '\\t')) i++;
+                if (i < json.Length && json[i] != ']')
+                    list.Add(ParseJsonValue(json, ref i));
+            }
+            if (i < json.Length) i++;
+            return list;
+        }
+        if (json[i] == '{')
+        {
+            var start = i;
+            int depth = 1; i++;
+            while (i < json.Length && depth > 0) { if (json[i] == '{') depth++; if (json[i] == '}') depth--; i++; }
+            return json.Substring(start, i - start);
+        }
+        if (json[i] == 'n' && json.Substring(i, 4) == "null") { i += 4; return null; }
+        if (json[i] == 't' && json.Substring(i, 4) == "true") { i += 4; return true; }
+        if (json[i] == 'f' && json.Substring(i, 5) == "false") { i += 5; return false; }
+
+        // number
+        var numStart = i;
+        while (i < json.Length && (char.IsDigit(json[i]) || json[i] == '.' || json[i] == '-' || json[i] == 'e' || json[i] == 'E' || json[i] == '+')) i++;
+        var numStr = json.Substring(numStart, i - numStart);
+        if (numStr.Contains(".")) return double.Parse(numStr, System.Globalization.CultureInfo.InvariantCulture);
+        return int.Parse(numStr);
+    }
+
+    static int GetInt(Dictionary<string, object> d, string k, int def = 0) { return d.ContainsKey(k) && d[k] != null ? Convert.ToInt32(d[k]) : def; }
+    static double GetDbl(Dictionary<string, object> d, string k, double def = 0) { return d.ContainsKey(k) && d[k] != null ? Convert.ToDouble(d[k]) : def; }
+    static string GetStr(Dictionary<string, object> d, string k, string def = "") { return d.ContainsKey(k) && d[k] is string ? (string)d[k] : def; }
+    static List<object> GetList(Dictionary<string, object> d, string k) { return d.ContainsKey(k) && d[k] is List<object> ? (List<object>)d[k] : new List<object>(); }
+
+    // \u2500\u2500\u2500 Virtual key codes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    static Dictionary<string, ushort> VKMap = new Dictionary<string, ushort>(StringComparer.OrdinalIgnoreCase)
+    {
+        {"return", 0x0D}, {"enter", 0x0D}, {"tab", 0x09}, {"space", 0x20},
+        {"backspace", 0x08}, {"delete", 0x2E}, {"escape", 0x1B}, {"esc", 0x1B},
+        {"up", 0x26}, {"down", 0x28}, {"left", 0x25}, {"right", 0x27},
+        {"home", 0x24}, {"end", 0x23}, {"pageup", 0x21}, {"pagedown", 0x22},
+        {"f1", 0x70}, {"f2", 0x71}, {"f3", 0x72}, {"f4", 0x73},
+        {"f5", 0x74}, {"f6", 0x75}, {"f7", 0x76}, {"f8", 0x77},
+        {"f9", 0x78}, {"f10", 0x79}, {"f11", 0x7A}, {"f12", 0x7B},
+        {"shift", 0x10}, {"ctrl", 0x11}, {"control", 0x11},
+        {"alt", 0x12}, {"option", 0x12}, {"cmd", 0x5B}, {"command", 0x5B},
+        {"a", 0x41}, {"b", 0x42}, {"c", 0x43}, {"d", 0x44}, {"e", 0x45}, {"f", 0x46},
+        {"g", 0x47}, {"h", 0x48}, {"i", 0x49}, {"j", 0x4A}, {"k", 0x4B}, {"l", 0x4C},
+        {"m", 0x4D}, {"n", 0x4E}, {"o", 0x4F}, {"p", 0x50}, {"q", 0x51}, {"r", 0x52},
+        {"s", 0x53}, {"t", 0x54}, {"u", 0x55}, {"v", 0x56}, {"w", 0x57}, {"x", 0x58},
+        {"y", 0x59}, {"z", 0x5A},
+        {"0", 0x30}, {"1", 0x31}, {"2", 0x32}, {"3", 0x33}, {"4", 0x34},
+        {"5", 0x35}, {"6", 0x36}, {"7", 0x37}, {"8", 0x38}, {"9", 0x39},
+    };
+
+    static ushort GetVK(string key)
+    {
+        ushort vk;
+        if (VKMap.TryGetValue(key, out vk)) return vk;
+        if (key.Length == 1) return (ushort)char.ToUpper(key[0]);
+        return 0;
+    }
+
+    static bool IsModifier(string key)
+    {
+        var k = key.ToLower();
+        return k == "shift" || k == "ctrl" || k == "control" || k == "alt" || k == "option" || k == "cmd" || k == "command";
+    }
+
+    // \u2500\u2500\u2500 Mouse helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    static void SendMouseClick(int x, int y, string button, int clicks)
+    {
+        SetCursorPos(x, y);
+        Thread.Sleep(10);
+
+        uint downFlag, upFlag;
+        switch (button)
+        {
+            case "right": downFlag = MOUSEEVENTF_RIGHTDOWN; upFlag = MOUSEEVENTF_RIGHTUP; break;
+            case "middle": downFlag = MOUSEEVENTF_MIDDLEDOWN; upFlag = MOUSEEVENTF_MIDDLEUP; break;
+            default: downFlag = MOUSEEVENTF_LEFTDOWN; upFlag = MOUSEEVENTF_LEFTUP; break;
+        }
+
+        for (int c = 0; c < clicks; c++)
+        {
+            var inputs = new INPUT[]
+            {
+                new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { dwFlags = downFlag } } },
+                new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { dwFlags = upFlag } } },
+            };
+            SendInput(2, inputs, Marshal.SizeOf(typeof(INPUT)));
+            if (c < clicks - 1) Thread.Sleep(50);
+        }
+    }
+
+    // \u2500\u2500\u2500 AX helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    static int axElementCount;
+
+    static string WalkAXTree(AutomationElement el, int depth, int maxDepth, List<string> roles, string pathPrefix)
+    {
+        if (el == null || depth > maxDepth) return "null";
+        axElementCount++;
+
+        string role = "";
+        string name = "";
+        string val = "";
+        string desc = "";
+        var bounds = System.Windows.Rect.Empty;
+        bool enabled = true;
+        bool focused = false;
+        var actionList = new List<string>();
+
+        try { role = el.Current.ControlType.ProgrammaticName.Replace("ControlType.", ""); } catch {}
+        try { name = el.Current.Name ?? ""; } catch {}
+        try { val = el.Current.AutomationId ?? ""; } catch {}
+        try { desc = el.Current.HelpText ?? ""; } catch {}
+        try { bounds = el.Current.BoundingRectangle; } catch {}
+        try { enabled = el.Current.IsEnabled; } catch {}
+        try { focused = el.Current.HasKeyboardFocus; } catch {}
+
+        // Check supported patterns for actions
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsInvokePatternAvailableProperty)) actionList.Add("invoke"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsTogglePatternAvailableProperty)) actionList.Add("toggle"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsExpandCollapsePatternAvailableProperty)) actionList.Add("expandcollapse"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsValuePatternAvailableProperty)) actionList.Add("setvalue"); } catch {}
+
+        if (roles != null && roles.Count > 0 && !roles.Contains(role.ToLower()))
+        {
+            // Skip this element but still walk children
+            var sb2 = new StringBuilder();
+            bool first2 = true;
+            int childIdx = 0;
+            try
+            {
+                var walker = TreeWalker.ControlViewWalker;
+                var child = walker.GetFirstChild(el);
+                while (child != null)
+                {
+                    var childPath = pathPrefix.Length > 0 ? pathPrefix + "." + childIdx : childIdx.ToString();
+                    var childJson = WalkAXTree(child, depth, maxDepth, roles, childPath);
+                    if (childJson != "null")
+                    {
+                        if (!first2) sb2.Append(",");
+                        sb2.Append(childJson);
+                        first2 = false;
+                    }
+                    child = walker.GetNextSibling(child);
+                    childIdx++;
+                }
+            } catch {}
+            if (sb2.Length == 0) return "null";
+            return sb2.ToString();
+        }
+
+        var sb = new StringBuilder();
+        sb.Append("{");
+        sb.AppendFormat("\\"id\\":{0}", JsonStr(pathPrefix));
+        sb.AppendFormat(",\\"role\\":{0}", JsonStr(role));
+        sb.AppendFormat(",\\"title\\":{0}", JsonStr(name));
+        sb.AppendFormat(",\\"value\\":{0}", JsonStr(val));
+        sb.AppendFormat(",\\"description\\":{0}", JsonStr(desc));
+        sb.AppendFormat(",\\"bounds\\":{{\\"x\\":{0},\\"y\\":{1},\\"width\\":{2},\\"height\\":{3}}}",
+            bounds.IsEmpty ? 0 : (int)bounds.X,
+            bounds.IsEmpty ? 0 : (int)bounds.Y,
+            bounds.IsEmpty ? 0 : (int)bounds.Width,
+            bounds.IsEmpty ? 0 : (int)bounds.Height);
+        sb.AppendFormat(",\\"enabled\\":{0}", enabled ? "true" : "false");
+        sb.AppendFormat(",\\"focused\\":{0}", focused ? "true" : "false");
+        sb.Append(",\\"actions\\":[");
+        for (int a = 0; a < actionList.Count; a++) { if (a > 0) sb.Append(","); sb.Append(JsonStr(actionList[a])); }
+        sb.Append("]");
+
+        // Children
+        sb.Append(",\\"children\\":[");
+        if (depth < maxDepth)
+        {
+            bool first = true;
+            int childIdx = 0;
+            try
+            {
+                var walker = TreeWalker.ControlViewWalker;
+                var child = walker.GetFirstChild(el);
+                while (child != null)
+                {
+                    var childPath = pathPrefix.Length > 0 ? pathPrefix + "." + childIdx : childIdx.ToString();
+                    var childJson = WalkAXTree(child, depth + 1, maxDepth, roles, childPath);
+                    if (childJson != "null")
+                    {
+                        if (!first) sb.Append(",");
+                        sb.Append(childJson);
+                        first = false;
+                    }
+                    child = walker.GetNextSibling(child);
+                    childIdx++;
+                }
+            } catch {}
+        }
+        sb.Append("]");
+        sb.Append("}");
+        return sb.ToString();
+    }
+
+    static AutomationElement NavigateToElement(AutomationElement root, string elementId)
+    {
+        var parts = elementId.Split('.');
+        var current = root;
+
+        foreach (var part in parts)
+        {
+            int idx = int.Parse(part);
+            var walker = TreeWalker.ControlViewWalker;
+            var child = walker.GetFirstChild(current);
+            for (int i = 0; i < idx && child != null; i++)
+                child = walker.GetNextSibling(child);
+            if (child == null) throw new Exception("Element not found at path: " + elementId);
+            current = child;
+        }
+        return current;
+    }
+
+    static void SearchAXTree(AutomationElement el, string query, string roleFilter, int maxResults, List<string> results, string pathPrefix, int depth, int maxDepth)
+    {
+        if (el == null || results.Count >= maxResults || depth > maxDepth) return;
+
+        string role = "";
+        string name = "";
+        string val = "";
+        string desc = "";
+        var bounds = System.Windows.Rect.Empty;
+        bool enabled = true;
+        bool focused = false;
+        var actionList = new List<string>();
+
+        try { role = el.Current.ControlType.ProgrammaticName.Replace("ControlType.", ""); } catch {}
+        try { name = el.Current.Name ?? ""; } catch {}
+        try { val = el.Current.AutomationId ?? ""; } catch {}
+        try { desc = el.Current.HelpText ?? ""; } catch {}
+        try { bounds = el.Current.BoundingRectangle; } catch {}
+        try { enabled = el.Current.IsEnabled; } catch {}
+        try { focused = el.Current.HasKeyboardFocus; } catch {}
+
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsInvokePatternAvailableProperty)) actionList.Add("invoke"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsTogglePatternAvailableProperty)) actionList.Add("toggle"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsExpandCollapsePatternAvailableProperty)) actionList.Add("expandcollapse"); } catch {}
+        try { if ((bool)el.GetCurrentPropertyValue(AutomationElement.IsValuePatternAvailableProperty)) actionList.Add("setvalue"); } catch {}
+
+        var queryLower = query.ToLower();
+        bool match = name.ToLower().Contains(queryLower) || val.ToLower().Contains(queryLower) || desc.ToLower().Contains(queryLower);
+
+        if (roleFilter != null && roleFilter.Length > 0 && role.ToLower() != roleFilter.ToLower())
+            match = false;
+
+        if (match)
+        {
+            var sb = new StringBuilder();
+            sb.Append("{");
+            sb.AppendFormat("\\"id\\":{0}", JsonStr(pathPrefix));
+            sb.AppendFormat(",\\"role\\":{0}", JsonStr(role));
+            sb.AppendFormat(",\\"title\\":{0}", JsonStr(name));
+            sb.AppendFormat(",\\"value\\":{0}", JsonStr(val));
+            sb.AppendFormat(",\\"description\\":{0}", JsonStr(desc));
+            sb.AppendFormat(",\\"bounds\\":{{\\"x\\":{0},\\"y\\":{1},\\"width\\":{2},\\"height\\":{3}}}",
+                bounds.IsEmpty ? 0 : (int)bounds.X, bounds.IsEmpty ? 0 : (int)bounds.Y,
+                bounds.IsEmpty ? 0 : (int)bounds.Width, bounds.IsEmpty ? 0 : (int)bounds.Height);
+            sb.AppendFormat(",\\"enabled\\":{0}", enabled ? "true" : "false");
+            sb.AppendFormat(",\\"focused\\":{0}", focused ? "true" : "false");
+            sb.Append(",\\"actions\\":[");
+            for (int a = 0; a < actionList.Count; a++) { if (a > 0) sb.Append(","); sb.Append(JsonStr(actionList[a])); }
+            sb.Append("],\\"children\\":[]}");
+            results.Add(sb.ToString());
+        }
+
+        int childIdx = 0;
+        try
+        {
+            var walker = TreeWalker.ControlViewWalker;
+            var child = walker.GetFirstChild(el);
+            while (child != null && results.Count < maxResults)
+            {
+                var childPath = pathPrefix.Length > 0 ? pathPrefix + "." + childIdx : childIdx.ToString();
+                SearchAXTree(child, query, roleFilter, maxResults, results, childPath, depth + 1, maxDepth);
+                child = walker.GetNextSibling(child);
+                childIdx++;
+            }
+        } catch {}
+    }
+
+    static AutomationElement FindAppRoot(int pid)
+    {
+        if (pid <= 0) return AutomationElement.RootElement;
+
+        var cond = new PropertyCondition(AutomationElement.ProcessIdProperty, pid);
+        var el = AutomationElement.RootElement.FindFirst(TreeScope.Children, cond);
+        if (el == null) throw new Exception("No UI Automation element found for PID " + pid);
+        return el;
+    }
+
+    // \u2500\u2500\u2500 Main \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    [STAThread]
+    static void Main()
+    {
+        var input = Console.In.ReadToEnd().Trim();
+        Dictionary<string, object> req;
+        try { req = ParseJson(input); }
+        catch (Exception ex) { Console.WriteLine("{\\"ok\\":false,\\"error\\":" + JsonStr("Invalid JSON: " + ex.Message) + "}"); return; }
+
+        var action = GetStr(req, "action");
+
+        try
+        {
+            switch (action)
+            {
+                case "click":
+                {
+                    var x = (int)GetDbl(req, "x");
+                    var y = (int)GetDbl(req, "y");
+                    var button = GetStr(req, "button", "left");
+                    var clicks = GetInt(req, "clicks", 1);
+                    SendMouseClick(x, y, button, clicks);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "move":
+                {
+                    SetCursorPos((int)GetDbl(req, "x"), (int)GetDbl(req, "y"));
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "drag":
+                {
+                    int fx = (int)GetDbl(req, "x"), fy = (int)GetDbl(req, "y");
+                    int tx = (int)GetDbl(req, "toX"), ty = (int)GetDbl(req, "toY");
+                    SetCursorPos(fx, fy);
+                    Thread.Sleep(50);
+                    var down = new INPUT[] { new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { dwFlags = MOUSEEVENTF_LEFTDOWN } } } };
+                    SendInput(1, down, Marshal.SizeOf(typeof(INPUT)));
+
+                    for (int i = 1; i <= 10; i++)
+                    {
+                        double t = i / 10.0;
+                        int mx = fx + (int)((tx - fx) * t);
+                        int my = fy + (int)((ty - fy) * t);
+                        SetCursorPos(mx, my);
+                        Thread.Sleep(10);
+                    }
+
+                    var up = new INPUT[] { new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { dwFlags = MOUSEEVENTF_LEFTUP } } } };
+                    SendInput(1, up, Marshal.SizeOf(typeof(INPUT)));
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "scroll":
+                {
+                    SetCursorPos((int)GetDbl(req, "x"), (int)GetDbl(req, "y"));
+                    Thread.Sleep(10);
+                    int dy = GetInt(req, "deltaY");
+                    int dx = GetInt(req, "deltaX");
+                    if (dy != 0)
+                    {
+                        var inputs = new INPUT[] { new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { mouseData = (uint)(dy * 120), dwFlags = MOUSEEVENTF_WHEEL } } } };
+                        SendInput(1, inputs, Marshal.SizeOf(typeof(INPUT)));
+                    }
+                    if (dx != 0)
+                    {
+                        var inputs = new INPUT[] { new INPUT { type = INPUT_MOUSE, u = new INPUTUNION { mi = new MOUSEINPUT { mouseData = (uint)(dx * 120), dwFlags = MOUSEEVENTF_HWHEEL } } } };
+                        SendInput(1, inputs, Marshal.SizeOf(typeof(INPUT)));
+                    }
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "position":
+                {
+                    POINT p;
+                    GetCursorPos(out p);
+                    Console.WriteLine("{\\"ok\\":true,\\"x\\":" + p.X + ",\\"y\\":" + p.Y + "}");
+                    break;
+                }
+                case "key":
+                {
+                    var keys = GetList(req, "keys");
+                    var mods = new List<ushort>();
+                    var mainKeys = new List<ushort>();
+
+                    foreach (var k in keys)
+                    {
+                        var keyStr = k.ToString();
+                        var vk = GetVK(keyStr);
+                        if (vk == 0) { Console.WriteLine("{\\"ok\\":false,\\"error\\":" + JsonStr("Unknown key: " + keyStr) + "}"); return; }
+                        if (IsModifier(keyStr)) mods.Add(vk); else mainKeys.Add(vk);
+                    }
+
+                    var inputList = new List<INPUT>();
+                    foreach (var m in mods) inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wVk = m } } });
+                    foreach (var k in mainKeys) inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wVk = k } } });
+                    foreach (var k in mainKeys) inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wVk = k, dwFlags = KEYEVENTF_KEYUP } } });
+                    foreach (var m in mods) inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wVk = m, dwFlags = KEYEVENTF_KEYUP } } });
+
+                    SendInput((uint)inputList.Count, inputList.ToArray(), Marshal.SizeOf(typeof(INPUT)));
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "type":
+                {
+                    var text = GetStr(req, "text");
+                    var inputList = new List<INPUT>();
+                    foreach (char c in text)
+                    {
+                        inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wScan = (ushort)c, dwFlags = KEYEVENTF_UNICODE } } });
+                        inputList.Add(new INPUT { type = INPUT_KEYBOARD, u = new INPUTUNION { ki = new KEYBDINPUT { wScan = (ushort)c, dwFlags = KEYEVENTF_UNICODE | KEYEVENTF_KEYUP } } });
+                    }
+                    SendInput((uint)inputList.Count, inputList.ToArray(), Marshal.SizeOf(typeof(INPUT)));
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "screenshot":
+                {
+                    var bounds = Screen.PrimaryScreen.Bounds;
+                    using (var bmp = new Bitmap(bounds.Width, bounds.Height))
+                    using (var g = Graphics.FromImage(bmp))
+                    {
+                        g.CopyFromScreen(bounds.Location, System.Drawing.Point.Empty, bounds.Size);
+
+                        // Downscale if > 1920
+                        Bitmap output = bmp;
+                        bool scaled = false;
+                        if (bmp.Width > 1920 || bmp.Height > 1920)
+                        {
+                            double scale = Math.Min(1920.0 / bmp.Width, 1920.0 / bmp.Height);
+                            int nw = (int)(bmp.Width * scale);
+                            int nh = (int)(bmp.Height * scale);
+                            output = new Bitmap(nw, nh);
+                            using (var g2 = Graphics.FromImage(output))
+                            {
+                                g2.InterpolationMode = System.Drawing.Drawing2D.InterpolationMode.HighQualityBicubic;
+                                g2.DrawImage(bmp, 0, 0, nw, nh);
+                            }
+                            scaled = true;
+                        }
+
+                        using (var ms = new MemoryStream())
+                        {
+                            var jpegEncoder = ImageCodecInfo.GetImageEncoders().First(e => e.FormatID == ImageFormat.Jpeg.Guid);
+                            var encoderParams = new EncoderParameters(1);
+                            encoderParams.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, 60L);
+                            output.Save(ms, jpegEncoder, encoderParams);
+
+                            var b64 = Convert.ToBase64String(ms.ToArray());
+                            Console.WriteLine("{\\"ok\\":true,\\"image\\":" + JsonStr(b64) + ",\\"width\\":" + output.Width + ",\\"height\\":" + output.Height + ",\\"format\\":\\"jpeg\\"}");
+                        }
+                        if (scaled) output.Dispose();
+                    }
+                    break;
+                }
+                case "window_list":
+                {
+                    var windows = new List<string>();
+                    EnumWindows((hWnd, _) =>
+                    {
+                        if (!IsWindowVisible(hWnd)) return true;
+                        int len = GetWindowTextLength(hWnd);
+                        if (len == 0) return true;
+                        var sb = new StringBuilder(len + 1);
+                        GetWindowText(hWnd, sb, sb.Capacity);
+                        var title = sb.ToString();
+
+                        RECT r;
+                        GetWindowRect(hWnd, out r);
+
+                        uint pid;
+                        GetWindowThreadProcessId(hWnd, out pid);
+                        string appName = "";
+                        try { appName = Process.GetProcessById((int)pid).ProcessName; } catch {}
+
+                        windows.Add(String.Format("{{\\"id\\":{0},\\"app\\":{1},\\"title\\":{2},\\"bounds\\":{{\\"x\\":{3},\\"y\\":{4},\\"width\\":{5},\\"height\\":{6}}},\\"minimized\\":false}}",
+                            hWnd.ToInt64(), JsonStr(appName), JsonStr(title),
+                            r.Left, r.Top, r.Right - r.Left, r.Bottom - r.Top));
+                        return true;
+                    }, IntPtr.Zero);
+
+                    Console.WriteLine("{\\"ok\\":true,\\"windows\\":[" + string.Join(",", windows) + "]}");
+                    break;
+                }
+                case "window_focus":
+                {
+                    var wid = (IntPtr)(long)GetDbl(req, "windowId");
+                    SetForegroundWindow(wid);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "window_resize":
+                {
+                    var wid = (IntPtr)(long)GetDbl(req, "windowId");
+                    int x = (int)GetDbl(req, "x"), y = (int)GetDbl(req, "y");
+                    int w = (int)GetDbl(req, "width"), h = (int)GetDbl(req, "height");
+                    MoveWindow(wid, x, y, w, h, true);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "window_close":
+                {
+                    var wid = (IntPtr)(long)GetDbl(req, "windowId");
+                    SendMessage(wid, WM_CLOSE, IntPtr.Zero, IntPtr.Zero);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "window_minimize":
+                {
+                    var wid = (IntPtr)(long)GetDbl(req, "windowId");
+                    ShowWindow(wid, SW_MINIMIZE);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "app_launch":
+                {
+                    var app = GetStr(req, "name");
+                    Process.Start(app);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "app_quit":
+                {
+                    var app = GetStr(req, "name").ToLower();
+                    foreach (var p in Process.GetProcesses())
+                    {
+                        try { if (p.ProcessName.ToLower() == app) p.Kill(); } catch {}
+                    }
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "app_list":
+                {
+                    var apps = new List<string>();
+                    var seen = new HashSet<int>();
+                    foreach (var p in Process.GetProcesses())
+                    {
+                        try
+                        {
+                            if (p.MainWindowHandle != IntPtr.Zero && !seen.Contains(p.Id))
+                            {
+                                seen.Add(p.Id);
+                                apps.Add(String.Format("{{\\"name\\":{0},\\"pid\\":{1}}}", JsonStr(p.ProcessName), p.Id));
+                            }
+                        } catch {}
+                    }
+                    Console.WriteLine("{\\"ok\\":true,\\"apps\\":[" + string.Join(",", apps) + "]}");
+                    break;
+                }
+                case "clipboard_read":
+                {
+                    string text = Clipboard.GetText() ?? "";
+                    Console.WriteLine("{\\"ok\\":true,\\"text\\":" + JsonStr(text) + "}");
+                    break;
+                }
+                case "clipboard_write":
+                {
+                    var text = GetStr(req, "text");
+                    if (string.IsNullOrEmpty(text)) Clipboard.Clear();
+                    else Clipboard.SetText(text);
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "screen_info":
+                {
+                    var screen = Screen.PrimaryScreen;
+                    float dpi;
+                    using (var g = Graphics.FromHwnd(IntPtr.Zero)) { dpi = g.DpiX; }
+                    double scale = Math.Round(dpi / 96.0, 2);
+                    Console.WriteLine("{\\"ok\\":true,\\"width\\":" + screen.Bounds.Width + ",\\"height\\":" + screen.Bounds.Height + ",\\"scaleFactor\\":" + scale + "}");
+                    break;
+                }
+                case "ax_tree":
+                {
+                    int pid = GetInt(req, "pid");
+                    int maxDepth = GetInt(req, "maxDepth", 8);
+                    var rolesObj = GetList(req, "roles");
+                    var roles = rolesObj.Count > 0 ? rolesObj.Select(r => r.ToString().ToLower()).ToList() : null;
+
+                    var root = FindAppRoot(pid);
+                    axElementCount = 0;
+                    var treeJson = WalkAXTree(root, 0, maxDepth, roles, "0");
+                    Console.WriteLine("{\\"ok\\":true,\\"root\\":" + treeJson + ",\\"elementCount\\":" + axElementCount + "}");
+                    break;
+                }
+                case "ax_action":
+                {
+                    var elementId = GetStr(req, "elementId");
+                    var act = GetStr(req, "action_name");
+                    int pid = GetInt(req, "pid");
+
+                    var root = FindAppRoot(pid);
+                    var el = NavigateToElement(root, elementId);
+
+                    switch (act.ToLower())
+                    {
+                        case "invoke":
+                        case "press":
+                        case "click":
+                            ((InvokePattern)el.GetCurrentPattern(InvokePattern.Pattern)).Invoke();
+                            break;
+                        case "toggle":
+                            ((TogglePattern)el.GetCurrentPattern(TogglePattern.Pattern)).Toggle();
+                            break;
+                        case "expand":
+                            ((ExpandCollapsePattern)el.GetCurrentPattern(ExpandCollapsePattern.Pattern)).Expand();
+                            break;
+                        case "collapse":
+                            ((ExpandCollapsePattern)el.GetCurrentPattern(ExpandCollapsePattern.Pattern)).Collapse();
+                            break;
+                        default:
+                            if (act.StartsWith("setvalue:"))
+                            {
+                                var value = act.Substring(9);
+                                ((ValuePattern)el.GetCurrentPattern(ValuePattern.Pattern)).SetValue(value);
+                            }
+                            else
+                            {
+                                throw new Exception("Unsupported action: " + act);
+                            }
+                            break;
+                    }
+                    Console.WriteLine("{\\"ok\\":true}");
+                    break;
+                }
+                case "ax_search":
+                {
+                    var query = GetStr(req, "query");
+                    var roleFilter = GetStr(req, "role", null);
+                    int pid = GetInt(req, "pid");
+                    int maxResults = GetInt(req, "maxResults", 20);
+
+                    var root = FindAppRoot(pid);
+                    var results = new List<string>();
+                    SearchAXTree(root, query, roleFilter, maxResults, results, "0", 0, 20);
+                    Console.WriteLine("{\\"ok\\":true,\\"elements\\":[" + string.Join(",", results) + "]}");
+                    break;
+                }
+                default:
+                    Console.WriteLine("{\\"ok\\":false,\\"error\\":" + JsonStr("Unknown action: " + action) + "}");
+                    break;
+            }
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine("{\\"ok\\":false,\\"error\\":" + JsonStr(ex.Message) + "}");
+        }
+    }
+}
+`;
+    compiled2 = false;
+  }
+});
+
+// src/agent/capabilities/desktop/windows-driver.ts
+var windows_driver_exports = {};
+__export(windows_driver_exports, {
+  WindowsDriver: () => WindowsDriver
+});
+var WindowsDriver;
+var init_windows_driver = __esm({
+  "src/agent/capabilities/desktop/windows-driver.ts"() {
+    "use strict";
+    init_csharp_helper();
+    WindowsDriver = class {
+      async screenshot(_options) {
+        const res = await execHelper2({ action: "screenshot" });
+        return {
+          image: res.image,
+          width: res.width,
+          height: res.height,
+          format: res.format || "jpeg"
+        };
+      }
+      async mouseClick(options) {
+        await execHelper2({
+          action: "click",
+          x: options.x,
+          y: options.y,
+          button: options.button || "left",
+          clicks: options.clicks || 1
+        });
+      }
+      async mouseMove(options) {
+        await execHelper2({ action: "move", x: options.x, y: options.y });
+      }
+      async mouseDrag(options) {
+        await execHelper2({
+          action: "drag",
+          x: options.fromX,
+          y: options.fromY,
+          toX: options.toX,
+          toY: options.toY,
+          button: options.button || "left"
+        });
+      }
+      async mouseScroll(options) {
+        await execHelper2({
+          action: "scroll",
+          x: options.x,
+          y: options.y,
+          deltaX: options.deltaX || 0,
+          deltaY: options.deltaY || 0
+        });
+      }
+      async mousePosition() {
+        const res = await execHelper2({ action: "position" });
+        return { x: res.x, y: res.y };
+      }
+      async keyboardType(options) {
+        await execHelper2({ action: "type", text: options.text });
+        if (options.delay) {
+          await new Promise((r) => setTimeout(r, options.delay));
+        }
+      }
+      async keyboardKey(options) {
+        await execHelper2({ action: "key", keys: options.keys });
+      }
+      async windowList() {
+        const res = await execHelper2({ action: "window_list" });
+        return res.windows || [];
+      }
+      async windowFocus(windowId) {
+        await execHelper2({ action: "window_focus", windowId });
+      }
+      async windowResize(windowId, bounds) {
+        const windows = await this.windowList();
+        const win = windows.find((w) => w.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        await execHelper2({
+          action: "window_resize",
+          windowId,
+          x: bounds.x ?? win.bounds.x,
+          y: bounds.y ?? win.bounds.y,
+          width: bounds.width ?? win.bounds.width,
+          height: bounds.height ?? win.bounds.height
+        });
+      }
+      async windowClose(windowId) {
+        await execHelper2({ action: "window_close", windowId });
+      }
+      async windowMinimize(windowId) {
+        await execHelper2({ action: "window_minimize", windowId });
+      }
+      async appLaunch(name) {
+        await execHelper2({ action: "app_launch", name });
+      }
+      async appQuit(name) {
+        await execHelper2({ action: "app_quit", name });
+      }
+      async appList() {
+        const res = await execHelper2({ action: "app_list" });
+        return res.apps || [];
+      }
+      async clipboardRead() {
+        const res = await execHelper2({ action: "clipboard_read" });
+        return res.text || "";
+      }
+      async clipboardWrite(text) {
+        await execHelper2({ action: "clipboard_write", text });
+      }
+      async screenInfo() {
+        const res = await execHelper2({ action: "screen_info" });
+        return {
+          width: res.width,
+          height: res.height,
+          scaleFactor: res.scaleFactor
+        };
+      }
+      async cursorImage(radius = 50) {
+        const pos = await this.mousePosition();
+        return this.screenshot({
+          region: {
+            x: Math.max(0, Math.round(pos.x - radius)),
+            y: Math.max(0, Math.round(pos.y - radius)),
+            width: radius * 2,
+            height: radius * 2
+          }
+        });
+      }
+      async axTree(options) {
+        const res = await execHelper2({
+          action: "ax_tree",
+          pid: options.pid,
+          maxDepth: options.maxDepth ?? 8,
+          roles: options.roles
+        });
+        return {
+          root: res.root,
+          elementCount: res.elementCount
+        };
+      }
+      async axAction(options) {
+        const res = await execHelper2({
+          action: "ax_action",
+          elementId: options.elementId,
+          action_name: options.action,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axSetValue(options) {
+        const res = await execHelper2({
+          action: "ax_set_value",
+          elementId: options.elementId,
+          value: options.value,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axFocus(options) {
+        const res = await execHelper2({
+          action: "ax_focus",
+          elementId: options.elementId,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axSearch(options) {
+        const res = await execHelper2({
+          action: "ax_search",
+          query: options.query,
+          role: options.role,
+          pid: options.pid,
+          maxResults: options.maxResults ?? 20
+        });
+        return { elements: res.elements || [] };
+      }
+    };
+  }
+});
+
+// src/agent/capabilities/desktop/atspi-helper.ts
+import { spawn as spawn5 } from "child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+async function ensureHelper3() {
+  if (written && existsSync4(HELPER_PATH3)) return HELPER_PATH3;
+  if (existsSync4(HELPER_PATH3)) {
+    written = true;
+    return HELPER_PATH3;
+  }
+  mkdirSync3(BIN_DIR3, { recursive: true });
+  writeFileSync3(HELPER_PATH3, PYTHON_SOURCE, { mode: 493 });
+  written = true;
+  return HELPER_PATH3;
+}
+async function execAtspiHelper(request) {
+  const helperPath = await ensureHelper3();
+  return new Promise((resolve2, reject) => {
+    const proc = spawn5("python3", [helperPath], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString();
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(`AT-SPI helper failed (exit ${code}): ${stderr}`));
+        return;
+      }
+      try {
+        const response = JSON.parse(stdout.trim());
+        if (!response.ok && response.error) {
+          reject(new Error(response.error));
+          return;
+        }
+        resolve2(response);
+      } catch {
+        reject(new Error(`Invalid helper output: ${stdout}`));
+      }
+    });
+    proc.on("error", (err) => {
+      reject(new Error(`python3 not found: ${err.message}. Install: sudo apt install python3`));
+    });
+    proc.stdin.write(JSON.stringify(request));
+    proc.stdin.end();
+  });
+}
+var HELPER_VERSION3, BIN_DIR3, HELPER_PATH3, PYTHON_SOURCE, written;
+var init_atspi_helper = __esm({
+  "src/agent/capabilities/desktop/atspi-helper.ts"() {
+    "use strict";
+    HELPER_VERSION3 = "v1";
+    BIN_DIR3 = join6(homedir4(), ".agent-tunnel", "bin");
+    HELPER_PATH3 = join6(BIN_DIR3, `atspi-helper-${HELPER_VERSION3}.py`);
+    PYTHON_SOURCE = `#!/usr/bin/env python3
+"""AT-SPI2 accessibility helper for Linux."""
+import json
+import sys
+
+try:
+    import gi
+    gi.require_version('Atspi', '2.0')
+    from gi.repository import Atspi
+except ImportError:
+    print(json.dumps({"ok": False, "error": "python3-gi and gir1.2-atspi-2.0 required. Install: sudo apt install python3-gi gir1.2-atspi-2.0"}))
+    sys.exit(0)
+
+element_count = 0
+
+def get_role_name(accessible):
+    try:
+        return Atspi.Accessible.get_role_name(accessible)
+    except:
+        return ""
+
+def get_name(accessible):
+    try:
+        return Atspi.Accessible.get_name(accessible) or ""
+    except:
+        return ""
+
+def get_description(accessible):
+    try:
+        return Atspi.Accessible.get_description(accessible) or ""
+    except:
+        return ""
+
+def get_bounds(accessible):
+    try:
+        comp = accessible.get_component_iface()
+        if comp:
+            rect = comp.get_extents(Atspi.CoordType.SCREEN)
+            return {"x": rect.x, "y": rect.y, "width": rect.width, "height": rect.height}
+    except:
+        pass
+    return {"x": 0, "y": 0, "width": 0, "height": 0}
+
+def get_value(accessible):
+    try:
+        val = accessible.get_value_iface()
+        if val:
+            return str(val.get_current_value())
+    except:
+        pass
+    return ""
+
+def get_actions(accessible):
+    actions = []
+    try:
+        action_iface = accessible.get_action_iface()
+        if action_iface:
+            for i in range(action_iface.get_n_actions()):
+                name = action_iface.get_action_name(i)
+                if name:
+                    actions.append(name)
+    except:
+        pass
+    return actions
+
+def get_states(accessible):
+    enabled = True
+    focused = False
+    try:
+        state_set = accessible.get_state_set()
+        enabled = state_set.contains(Atspi.StateType.ENABLED) or state_set.contains(Atspi.StateType.SENSITIVE)
+        focused = state_set.contains(Atspi.StateType.FOCUSED)
+    except:
+        pass
+    return enabled, focused
+
+def walk_tree(accessible, depth, max_depth, roles, path_prefix):
+    global element_count
+    if accessible is None or depth > max_depth:
+        return None
+    element_count += 1
+
+    role = get_role_name(accessible)
+    name = get_name(accessible)
+    value = get_value(accessible)
+    desc = get_description(accessible)
+    bounds = get_bounds(accessible)
+    actions = get_actions(accessible)
+    enabled, focused = get_states(accessible)
+
+    children = []
+    if depth < max_depth:
+        try:
+            count = accessible.get_child_count()
+            for i in range(count):
+                child = accessible.get_child_at_index(i)
+                if child:
+                    child_path = f"{path_prefix}.{i}" if path_prefix else str(i)
+                    child_node = walk_tree(child, depth + 1, max_depth, roles, child_path)
+                    if child_node is not None:
+                        if isinstance(child_node, list):
+                            children.extend(child_node)
+                        else:
+                            children.append(child_node)
+        except:
+            pass
+
+    if roles and role.lower() not in [r.lower() for r in roles]:
+        return children if children else None
+
+    return {
+        "id": path_prefix,
+        "role": role,
+        "title": name,
+        "value": value,
+        "description": desc,
+        "bounds": bounds,
+        "children": children,
+        "actions": actions,
+        "enabled": enabled,
+        "focused": focused,
+    }
+
+def find_app_by_pid(pid):
+    desktop = Atspi.get_desktop(0)
+    count = desktop.get_child_count()
+    for i in range(count):
+        app = desktop.get_child_at_index(i)
+        if app:
+            try:
+                if app.get_process_id() == pid:
+                    return app
+            except:
+                pass
+    raise Exception(f"No AT-SPI application found for PID {pid}")
+
+def navigate_to_element(root, element_id):
+    parts = element_id.split(".")
+    current = root
+    for part in parts:
+        idx = int(part)
+        child = current.get_child_at_index(idx)
+        if child is None:
+            raise Exception(f"Element not found at path: {element_id}")
+        current = child
+    return current
+
+def search_tree(accessible, query, role_filter, max_results, results, path_prefix, depth, max_depth):
+    if accessible is None or len(results) >= max_results or depth > max_depth:
+        return
+
+    role = get_role_name(accessible)
+    name = get_name(accessible)
+    value = get_value(accessible)
+    desc = get_description(accessible)
+
+    query_lower = query.lower()
+    match = (query_lower in name.lower() or query_lower in value.lower() or query_lower in desc.lower())
+
+    if role_filter and role.lower() != role_filter.lower():
+        match = False
+
+    if match:
+        bounds = get_bounds(accessible)
+        actions = get_actions(accessible)
+        enabled, focused = get_states(accessible)
+        results.append({
+            "id": path_prefix,
+            "role": role,
+            "title": name,
+            "value": value,
+            "description": desc,
+            "bounds": bounds,
+            "children": [],
+            "actions": actions,
+            "enabled": enabled,
+            "focused": focused,
+        })
+
+    try:
+        count = accessible.get_child_count()
+        for i in range(count):
+            if len(results) >= max_results:
+                break
+            child = accessible.get_child_at_index(i)
+            if child:
+                child_path = f"{path_prefix}.{i}" if path_prefix else str(i)
+                search_tree(child, query, role_filter, max_results, results, child_path, depth + 1, max_depth)
+    except:
+        pass
+
+def main():
+    raw = sys.stdin.read().strip()
+    try:
+        req = json.loads(raw)
+    except:
+        print(json.dumps({"ok": False, "error": "Invalid JSON input"}))
+        return
+
+    action = req.get("action", "")
+
+    try:
+        if action == "ax_tree":
+            pid = req.get("pid", 0)
+            max_depth = req.get("maxDepth", 8)
+            roles = req.get("roles", [])
+
+            root = find_app_by_pid(pid) if pid > 0 else Atspi.get_desktop(0)
+
+            global element_count
+            element_count = 0
+            tree = walk_tree(root, 0, max_depth, roles, "0")
+            print(json.dumps({"ok": True, "root": tree, "elementCount": element_count}))
+
+        elif action == "ax_action":
+            element_id = req.get("elementId", "")
+            action_name = req.get("action_name", "")
+            pid = req.get("pid", 0)
+
+            root = find_app_by_pid(pid) if pid > 0 else Atspi.get_desktop(0)
+            el = navigate_to_element(root, element_id)
+
+            action_iface = el.get_action_iface()
+            if not action_iface:
+                raise Exception("Element does not support actions")
+
+            performed = False
+            for i in range(action_iface.get_n_actions()):
+                if action_iface.get_action_name(i).lower() == action_name.lower():
+                    action_iface.do_action(i)
+                    performed = True
+                    break
+
+            if not performed:
+                raise Exception(f"Action '{action_name}' not found on element")
+
+            print(json.dumps({"ok": True}))
+
+        elif action == "ax_search":
+            query = req.get("query", "")
+            role_filter = req.get("role", None)
+            pid = req.get("pid", 0)
+            max_results = req.get("maxResults", 20)
+
+            root = find_app_by_pid(pid) if pid > 0 else Atspi.get_desktop(0)
+            results = []
+            search_tree(root, query, role_filter, max_results, results, "0", 0, 20)
+            print(json.dumps({"ok": True, "elements": results}))
+
+        else:
+            print(json.dumps({"ok": False, "error": f"Unknown action: {action}"}))
+    except Exception as e:
+        print(json.dumps({"ok": False, "error": str(e)}))
+
+if __name__ == "__main__":
+    main()
+`;
+    written = false;
+  }
+});
+
+// src/agent/capabilities/desktop/linux-driver.ts
+var linux_driver_exports = {};
+__export(linux_driver_exports, {
+  LinuxDriver: () => LinuxDriver
+});
+import { spawn as spawn6 } from "child_process";
+import { readFile as readFile3, unlink as unlink3 } from "fs/promises";
+import { join as join7 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { randomBytes as randomBytes3 } from "crypto";
+function tmpPath2() {
+  return join7(tmpdir2(), `tunnel-ss-${randomBytes3(6).toString("hex")}.png`);
+}
+function exec2(cmd, args) {
+  return new Promise((resolve2, reject) => {
+    const proc = spawn6(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (d) => {
+      stdout += d.toString();
+    });
+    proc.stderr.on("data", (d) => {
+      stderr += d.toString();
+    });
+    proc.on("close", (code) => {
+      if (code !== 0) reject(new Error(`${cmd} failed (${code}): ${stderr}`));
+      else resolve2(stdout);
+    });
+    proc.on("error", (err) => {
+      reject(new Error(`${cmd} not found. Install it: sudo apt install ${cmd}`));
+    });
+  });
+}
+function parsePngDimensions(buf) {
+  if (buf.length >= 24 && buf[0] === 137 && buf[1] === 80) {
+    return {
+      width: buf.readUInt32BE(16),
+      height: buf.readUInt32BE(20)
+    };
+  }
+  return { width: 0, height: 0 };
+}
+var BUTTON_MAP, SCROLL_MAP, LinuxDriver;
+var init_linux_driver = __esm({
+  "src/agent/capabilities/desktop/linux-driver.ts"() {
+    "use strict";
+    init_atspi_helper();
+    BUTTON_MAP = {
+      left: "1",
+      middle: "2",
+      right: "3"
+    };
+    SCROLL_MAP = {
+      up: "4",
+      down: "5",
+      left: "6",
+      right: "7"
+    };
+    LinuxDriver = class {
+      async screenshot(options) {
+        const path = tmpPath2();
+        if (options.region) {
+          const { x, y, width: width2, height: height2 } = options.region;
+          await exec2("scrot", ["-a", `${x},${y},${width2},${height2}`, path]);
+        } else if (options.windowId) {
+          await exec2("scrot", ["-u", "-w", path]);
+        } else {
+          await exec2("scrot", [path]);
+        }
+        const buf = await readFile3(path);
+        await unlink3(path).catch(() => {
+        });
+        const { width, height } = parsePngDimensions(buf);
+        return {
+          image: buf.toString("base64"),
+          width,
+          height,
+          format: "png"
+        };
+      }
+      async mouseClick(options) {
+        const button = BUTTON_MAP[options.button || "left"] || "1";
+        const clicks = options.clicks || 1;
+        await exec2("xdotool", ["mousemove", "--sync", String(options.x), String(options.y)]);
+        const clickArgs = ["click", "--repeat", String(clicks), button];
+        await exec2("xdotool", clickArgs);
+      }
+      async mouseMove(options) {
+        await exec2("xdotool", ["mousemove", "--sync", String(options.x), String(options.y)]);
+      }
+      async mouseDrag(options) {
+        const button = BUTTON_MAP[options.button || "left"] || "1";
+        await exec2("xdotool", ["mousemove", "--sync", String(options.fromX), String(options.fromY)]);
+        await exec2("xdotool", ["mousedown", button]);
+        await exec2("xdotool", ["mousemove", "--sync", String(options.toX), String(options.toY)]);
+        await exec2("xdotool", ["mouseup", button]);
+      }
+      async mouseScroll(options) {
+        await exec2("xdotool", ["mousemove", "--sync", String(options.x), String(options.y)]);
+        const dy = options.deltaY || 0;
+        const dx = options.deltaX || 0;
+        if (dy !== 0) {
+          const btn = dy > 0 ? SCROLL_MAP.down : SCROLL_MAP.up;
+          const count = Math.abs(dy);
+          for (let i = 0; i < count; i++) {
+            await exec2("xdotool", ["click", btn]);
+          }
+        }
+        if (dx !== 0) {
+          const btn = dx > 0 ? SCROLL_MAP.right : SCROLL_MAP.left;
+          const count = Math.abs(dx);
+          for (let i = 0; i < count; i++) {
+            await exec2("xdotool", ["click", btn]);
+          }
+        }
+      }
+      async mousePosition() {
+        const out = await exec2("xdotool", ["getmouselocation"]);
+        const match = out.match(/x:(\d+)\s+y:(\d+)/);
+        if (!match) throw new Error(`Failed to parse mouse location: ${out}`);
+        return { x: parseInt(match[1]), y: parseInt(match[2]) };
+      }
+      async keyboardType(options) {
+        const args = ["type"];
+        if (options.delay) {
+          args.push("--delay", String(options.delay));
+        }
+        args.push("--", options.text);
+        await exec2("xdotool", args);
+      }
+      async keyboardKey(options) {
+        const combo = options.keys.map((k) => {
+          const map = {
+            cmd: "super",
+            command: "super",
+            ctrl: "ctrl",
+            control: "ctrl",
+            alt: "alt",
+            option: "alt",
+            shift: "shift",
+            enter: "Return",
+            return: "Return",
+            tab: "Tab",
+            space: "space",
+            escape: "Escape",
+            esc: "Escape",
+            delete: "BackSpace",
+            backspace: "BackSpace",
+            up: "Up",
+            down: "Down",
+            left: "Left",
+            right: "Right",
+            home: "Home",
+            end: "End",
+            pageup: "Prior",
+            pagedown: "Next"
+          };
+          return map[k.toLowerCase()] || k;
+        }).join("+");
+        await exec2("xdotool", ["key", combo]);
+      }
+      async windowList() {
+        const out = await exec2("wmctrl", ["-l", "-G", "-p"]);
+        const lines = out.trim().split("\n").filter(Boolean);
+        return lines.map((line) => {
+          const parts = line.split(/\s+/);
+          const id = parseInt(parts[0], 16);
+          const x = parseInt(parts[3]);
+          const y = parseInt(parts[4]);
+          const width = parseInt(parts[5]);
+          const height = parseInt(parts[6]);
+          const title = parts.slice(8).join(" ");
+          return {
+            id,
+            app: parts[7] || "",
+            title,
+            bounds: { x, y, width, height },
+            minimized: false
+          };
+        });
+      }
+      async windowFocus(windowId) {
+        await exec2("wmctrl", ["-i", "-a", `0x${windowId.toString(16)}`]);
+      }
+      async windowResize(windowId, bounds) {
+        const windows = await this.windowList();
+        const win = windows.find((w2) => w2.id === windowId);
+        if (!win) throw new Error(`Window ${windowId} not found`);
+        const x = bounds.x ?? win.bounds.x;
+        const y = bounds.y ?? win.bounds.y;
+        const w = bounds.width ?? win.bounds.width;
+        const h = bounds.height ?? win.bounds.height;
+        await exec2("wmctrl", ["-i", "-r", `0x${windowId.toString(16)}`, "-e", `0,${x},${y},${w},${h}`]);
+      }
+      async windowClose(windowId) {
+        await exec2("wmctrl", ["-i", "-c", `0x${windowId.toString(16)}`]);
+      }
+      async windowMinimize(windowId) {
+        await exec2("xdotool", ["windowminimize", String(windowId)]);
+      }
+      async appLaunch(name) {
+        const proc = spawn6("xdg-open", [name], {
+          stdio: "ignore",
+          detached: true
+        });
+        proc.unref();
+        await new Promise((r) => setTimeout(r, 500));
+      }
+      async appQuit(name) {
+        const out = await exec2("pgrep", ["-f", name]).catch(() => "");
+        const pids = out.trim().split("\n").filter(Boolean);
+        for (const pid of pids) {
+          await exec2("kill", [pid]).catch(() => {
+          });
+        }
+      }
+      async appList() {
+        const out = await exec2("wmctrl", ["-l", "-p"]);
+        const lines = out.trim().split("\n").filter(Boolean);
+        const seen = /* @__PURE__ */ new Set();
+        const apps = [];
+        for (const line of lines) {
+          const parts = line.split(/\s+/);
+          const pid = parseInt(parts[2]);
+          if (pid && !seen.has(pid)) {
+            seen.add(pid);
+            let name = parts.slice(4).join(" ");
+            try {
+              const cmdline = await exec2("cat", [`/proc/${pid}/comm`]);
+              name = cmdline.trim() || name;
+            } catch {
+            }
+            apps.push({ name, pid });
+          }
+        }
+        return apps;
+      }
+      async clipboardRead() {
+        return exec2("xclip", ["-selection", "clipboard", "-o"]);
+      }
+      async clipboardWrite(text) {
+        await new Promise((resolve2, reject) => {
+          const proc = spawn6("xclip", ["-selection", "clipboard"], {
+            stdio: ["pipe", "ignore", "pipe"]
+          });
+          proc.on("close", (code) => {
+            if (code !== 0) reject(new Error(`xclip failed (${code})`));
+            else resolve2();
+          });
+          proc.on("error", () => reject(new Error("xclip not found. Install: sudo apt install xclip")));
+          proc.stdin.write(text);
+          proc.stdin.end();
+        });
+      }
+      async screenInfo() {
+        const out = await exec2("xrandr", ["--current"]);
+        const match = out.match(/(\d+)x(\d+)\+/);
+        if (!match) throw new Error("Failed to parse xrandr output");
+        return {
+          width: parseInt(match[1]),
+          height: parseInt(match[2]),
+          scaleFactor: 1
+        };
+      }
+      async cursorImage(radius = 50) {
+        const pos = await this.mousePosition();
+        const x = Math.max(0, pos.x - radius);
+        const y = Math.max(0, pos.y - radius);
+        const size = radius * 2;
+        return this.screenshot({ region: { x, y, width: size, height: size } });
+      }
+      async axTree(options) {
+        const res = await execAtspiHelper({
+          action: "ax_tree",
+          pid: options.pid,
+          maxDepth: options.maxDepth ?? 8,
+          roles: options.roles
+        });
+        return {
+          root: res.root,
+          elementCount: res.elementCount
+        };
+      }
+      async axAction(options) {
+        const res = await execAtspiHelper({
+          action: "ax_action",
+          elementId: options.elementId,
+          action_name: options.action,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axSetValue(options) {
+        const res = await execAtspiHelper({
+          action: "ax_set_value",
+          elementId: options.elementId,
+          value: options.value,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axFocus(options) {
+        const res = await execAtspiHelper({
+          action: "ax_focus",
+          elementId: options.elementId,
+          pid: options.pid
+        });
+        return res;
+      }
+      async axSearch(options) {
+        const res = await execAtspiHelper({
+          action: "ax_search",
+          query: options.query,
+          role: options.role,
+          pid: options.pid,
+          maxResults: options.maxResults ?? 20
+        });
+        return { elements: res.elements || [] };
+      }
+    };
+  }
+});
+
+// src/node-ws-polyfill.ts
+if (typeof globalThis.WebSocket === "undefined") {
+  try {
+    const ws = __require("ws");
+    globalThis.WebSocket = ws.default || ws;
+  } catch {
+    console.error(
+      '[agent-tunnel] WebSocket is not available. Install the "ws" package or use Node.js 22+.'
+    );
+    process.exit(1);
+  }
+}
+
+// src/agent/config.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CONFIG_DIR = join(homedir(), ".agent-tunnel");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var DEFAULTS = {
+  apiUrl: "http://localhost:8080",
+  wsPath: "/ws",
+  maxFileSize: 10 * 1024 * 1024,
+  allowedPaths: [homedir()],
+  allowedCommands: [],
+  blockedCommands: [],
+  blockedPaths: [
+    "/etc/shadow",
+    "/etc/passwd",
+    "/etc/sudoers",
+    "/etc/ssh",
+    "/root/.ssh",
+    "/proc",
+    "/sys",
+    "/dev"
+  ],
+  workingDir: homedir(),
+  shellTimeout: 3e4,
+  shellMaxTimeout: 12e4,
+  shellMaxOutputSize: 1024 * 1024,
+  shellEnvPassthrough: ["PATH", "HOME", "USER", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "NODE_ENV", "HOSTNAME"]
+};
+function loadConfig(overrides = {}) {
+  let fileConfig = {};
+  if (existsSync(CONFIG_FILE)) {
+    try {
+      fileConfig = JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+    } catch (err) {
+      console.warn(`[config] Failed to parse ${CONFIG_FILE}:`, err);
+    }
+  }
+  const envConfig = {};
+  if (process.env.TUNNEL_TOKEN) envConfig.token = process.env.TUNNEL_TOKEN;
+  if (process.env.TUNNEL_ID) envConfig.tunnelId = process.env.TUNNEL_ID;
+  if (process.env.TUNNEL_API_URL) envConfig.apiUrl = process.env.TUNNEL_API_URL;
+  if (process.env.TUNNEL_WS_PATH) envConfig.wsPath = process.env.TUNNEL_WS_PATH;
+  if (process.env.TUNNEL_MAX_FILE_SIZE) envConfig.maxFileSize = parseInt(process.env.TUNNEL_MAX_FILE_SIZE, 10);
+  const merged = {
+    ...DEFAULTS,
+    ...fileConfig,
+    ...envConfig,
+    ...overrides
+  };
+  return merged;
+}
+
+// src/agent/agent.ts
+import { hostname, platform, arch, release } from "os";
+
+// src/agent/security/permission-guard.ts
+var PermissionGuard = class {
+  permissions = /* @__PURE__ */ new Map();
+  hasSynced = false;
+  /** Bulk-load permissions from server sync notification. */
+  syncPermissions(permissions) {
+    this.permissions.clear();
+    for (const perm of permissions) {
+      this.permissions.set(perm.permissionId, perm);
+    }
+    this.hasSynced = true;
+  }
+  addPermission(permission) {
+    this.permissions.set(permission.permissionId, permission);
+  }
+  revokePermission(permissionId) {
+    this.permissions.delete(permissionId);
+  }
+  checkPermission(permissionId) {
+    if (!permissionId) {
+      return false;
+    }
+    const perm = this.permissions.get(permissionId);
+    if (!perm) {
+      return false;
+    }
+    if (perm.expiresAt) {
+      const expiry = new Date(perm.expiresAt).getTime();
+      if (isNaN(expiry) || expiry < Date.now()) {
+        this.permissions.delete(permissionId);
+        return false;
+      }
+    }
+    return true;
+  }
+  clear() {
+    this.permissions.clear();
+    this.hasSynced = false;
+  }
+};
+
+// src/shared/crypto.ts
+import { createHash, createHmac, timingSafeEqual, randomBytes } from "crypto";
+function signMessage(signingKey, payload, nonce) {
+  return createHmac("sha256", signingKey).update(`${nonce}:${payload}`).digest("hex");
+}
+function verifyMessageSignature(signingKey, payload, nonce, signature) {
+  try {
+    const expected = signMessage(signingKey, payload, nonce);
+    const sigBuffer = Buffer.from(signature, "hex");
+    const expectedBuffer = Buffer.from(expected, "hex");
+    if (sigBuffer.length !== expectedBuffer.length) return false;
+    return timingSafeEqual(sigBuffer, expectedBuffer);
+  } catch {
+    return false;
+  }
+}
+
+// src/agent/agent.ts
+var c = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  white: "\x1B[97m",
+  gray: "\x1B[90m"
+};
+function log(icon, msg) {
+  console.log(`  ${icon} ${c.dim}${msg}${c.reset}`);
+}
+var TunnelAgent = class {
+  ws = null;
+  registry;
+  permissionGuard;
+  config;
+  reconnectAttempts = 0;
+  maxReconnectDelay = 3e4;
+  baseReconnectDelay = 1e3;
+  reconnectTimer = null;
+  isShuttingDown = false;
+  uptime = 0;
+  uptimeInterval = null;
+  // HMAC signature verification
+  signingKey = null;
+  lastNonce = 0;
+  responseNonce = 0;
+  constructor(config, registry) {
+    this.config = config;
+    this.registry = registry;
+    this.permissionGuard = new PermissionGuard();
+  }
+  connect() {
+    if (this.ws) {
+      this.ws.close();
+    }
+    const wsUrl = this.buildWsUrl();
+    log(`${c.cyan}\u25C6${c.reset}`, `Connecting\u2026`);
+    try {
+      this.ws = new WebSocket(wsUrl);
+      this.setupWsHandlers();
+    } catch (err) {
+      log(`${c.red}\u2717${c.reset}`, `Connection failed`);
+      this.scheduleReconnect();
+    }
+  }
+  disconnect() {
+    this.isShuttingDown = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.uptimeInterval) {
+      clearInterval(this.uptimeInterval);
+      this.uptimeInterval = null;
+    }
+    if (this.ws) {
+      try {
+        this.ws.close(1e3, "client shutdown");
+      } catch {
+      }
+      this.ws = null;
+    }
+    this.permissionGuard.clear();
+    log(`${c.gray}\u25CB${c.reset}`, `Disconnected`);
+  }
+  isConnected() {
+    return this.ws?.readyState === WebSocket.OPEN;
+  }
+  setupWsHandlers() {
+    if (!this.ws) return;
+    this.ws.addEventListener("open", () => {
+      this.reconnectAttempts = 0;
+      this.uptime = 0;
+      this.lastNonce = 0;
+      this.responseNonce = 0;
+      this.signingKey = null;
+      this.uptimeInterval = setInterval(() => {
+        this.uptime++;
+      }, 1e3);
+      this.send({ type: "auth", token: this.config.token });
+    });
+    this.ws.addEventListener("message", (event) => {
+      this.handleMessage(event.data);
+    });
+    this.ws.addEventListener("close", (event) => {
+      if (this.uptimeInterval) {
+        clearInterval(this.uptimeInterval);
+        this.uptimeInterval = null;
+      }
+      if (!this.isShuttingDown) {
+        if (event.code === 4001) {
+          log(`${c.red}\u2717${c.reset}`, `Authentication failed \u2014 check your token`);
+          return;
+        }
+        log(`${c.yellow}\u25CB${c.reset}`, `Disconnected ${c.gray}(code: ${event.code})${c.reset}`);
+        this.scheduleReconnect();
+      }
+    });
+    this.ws.addEventListener("error", (event) => {
+      log(`${c.red}\u2717${c.reset}`, `WebSocket error`);
+    });
+  }
+  async handleMessage(raw) {
+    let msg;
+    try {
+      msg = JSON.parse(raw);
+    } catch {
+      log(`${c.yellow}!${c.reset}`, `Received invalid JSON`);
+      return;
+    }
+    if (msg.type === "auth_ok" && msg.signingKey) {
+      this.signingKey = msg.signingKey;
+      log(`${c.green}\u25CF${c.reset}`, `Connected ${c.reset}${c.gray}(${this.registry.getCapabilityNames().join(", ")})${c.reset}`);
+      return;
+    }
+    if (!this.signingKey) {
+      log(`${c.yellow}!${c.reset}`, `Message received before auth completed`);
+      return;
+    }
+    if (!this.verifyIncomingSignature(msg, raw)) {
+      if ("id" in msg && msg.id) {
+        this.sendSignedError(msg.id, -32e3, "Invalid message signature");
+      }
+      return;
+    }
+    if ("method" in msg && msg.method === "tunnel.ping") {
+      this.sendPong();
+      return;
+    }
+    if ("method" in msg && msg.method === "tunnel.permissions.sync") {
+      const permissions = msg.params?.permissions || [];
+      this.permissionGuard.syncPermissions(permissions);
+      log(`${c.green}\u25CF${c.reset}`, `Synced ${c.reset}${c.white}${permissions.length}${c.dim} permissions`);
+      return;
+    }
+    if ("method" in msg && msg.method === "tunnel.permission.granted") {
+      const p = msg.params;
+      if (p?.permissionId) {
+        this.permissionGuard.addPermission(p);
+        log(`${c.green}+${c.reset}`, `Permission granted: ${p.capability} (${p.permissionId.slice(0, 12)}\u2026)`);
+      }
+      return;
+    }
+    if ("method" in msg && msg.method === "tunnel.permission.revoked") {
+      const permissionId = msg.params?.permissionId;
+      if (permissionId) {
+        this.permissionGuard.revokePermission(permissionId);
+        log(`${c.yellow}\u25CB${c.reset}`, `Permission revoked: ${permissionId.slice(0, 12)}\u2026`);
+      }
+      return;
+    }
+    if ("method" in msg && msg.method === "tunnel.token.rotated") {
+      log(`${c.yellow}!${c.reset}`, `Token rotated \u2014 reconnecting with new token`);
+      return;
+    }
+    if ("id" in msg && msg.id) {
+      await this.handleRpcRequest(msg);
+      return;
+    }
+  }
+  /**
+   * Verify HMAC signature on incoming messages (excluding pings).
+   */
+  verifyIncomingSignature(msg, _raw) {
+    const sig = msg._sig;
+    const nonce = msg._nonce;
+    if (sig === void 0 || nonce === void 0) {
+      log(`${c.yellow}!${c.reset}`, `Message missing signature fields`);
+      return false;
+    }
+    if (nonce <= this.lastNonce) {
+      log(`${c.red}\u2717${c.reset}`, `Replay detected: nonce ${nonce} <= ${this.lastNonce}`);
+      return false;
+    }
+    const { _sig, _nonce, ...payloadObj } = msg;
+    const payload = JSON.stringify(payloadObj);
+    if (!verifyMessageSignature(this.signingKey, payload, nonce, sig)) {
+      log(`${c.red}\u2717${c.reset}`, `Invalid HMAC signature`);
+      return false;
+    }
+    this.lastNonce = nonce;
+    return true;
+  }
+  async handleRpcRequest(request) {
+    const { id, method, params = {} } = request;
+    const permissionId = params.permissionId;
+    if (!this.permissionGuard.checkPermission(permissionId)) {
+      this.sendSignedError(id, -32e3, `Permission denied: ${permissionId ? "invalid or expired permission" : "no permissionId provided"}`);
+      return;
+    }
+    const handler = this.registry.getHandler(method);
+    if (!handler) {
+      this.sendSignedError(id, -32001, `Capability not registered for method: ${method}`);
+      return;
+    }
+    try {
+      const result = await handler(params);
+      this.sendSignedResult(id, result);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.sendSignedError(id, -32003, message);
+    }
+  }
+  /** Send HMAC-signed RPC result. */
+  sendSignedResult(id, result) {
+    const data = { jsonrpc: "2.0", id, result };
+    this.sendSigned(data);
+  }
+  /** Send HMAC-signed RPC error. */
+  sendSignedError(id, code, message) {
+    const data = { jsonrpc: "2.0", id, error: { code, message } };
+    this.sendSigned(data);
+  }
+  sendSigned(data) {
+    if (this.ws?.readyState === WebSocket.OPEN && this.signingKey) {
+      const nonce = ++this.responseNonce;
+      const payload = JSON.stringify(data);
+      const sig = signMessage(this.signingKey, payload, nonce);
+      const signed = { ...data, _sig: sig, _nonce: nonce };
+      try {
+        this.ws.send(JSON.stringify(signed));
+      } catch (err) {
+        log(`${c.red}\u2717${c.reset}`, `Send failed`);
+      }
+    }
+  }
+  send(data) {
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      try {
+        this.ws.send(JSON.stringify(data));
+      } catch (err) {
+        log(`${c.red}\u2717${c.reset}`, `Send failed`);
+      }
+    }
+  }
+  sendPong() {
+    this.sendSigned({
+      jsonrpc: "2.0",
+      method: "tunnel.pong",
+      params: {
+        uptime: this.uptime,
+        capabilities: this.registry.getCapabilityNames(),
+        machineInfo: {
+          hostname: hostname(),
+          platform: platform(),
+          arch: arch(),
+          osVersion: release(),
+          agentVersion: "0.1.2"
+        }
+      }
+    });
+  }
+  scheduleReconnect() {
+    if (this.isShuttingDown) return;
+    this.reconnectAttempts++;
+    const delay = Math.min(
+      this.baseReconnectDelay * Math.pow(2, this.reconnectAttempts - 1),
+      this.maxReconnectDelay
+    );
+    log(`${c.cyan}\u25C6${c.reset}`, `Reconnecting in ${c.reset}${c.white}${(delay / 1e3).toFixed(1)}s${c.dim} (attempt ${this.reconnectAttempts})`);
+    this.reconnectTimer = setTimeout(() => {
+      this.connect();
+    }, delay);
+  }
+  buildWsUrl() {
+    const base = this.config.apiUrl.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
+    if (base.startsWith("ws://") && !base.includes("localhost") && !base.includes("127.0.0.1")) {
+      log(`${c.red}!${c.reset}`, `${c.red}WARNING: Connecting over unencrypted ws:// to a remote host. Token will be sent in plaintext. Use https:// API URL for production.${c.reset}`);
+    }
+    const wsPath = this.config.wsPath || "/ws";
+    const params = new URLSearchParams({
+      tunnelId: this.config.tunnelId
+    });
+    return `${base}${wsPath}?${params.toString()}`;
+  }
+};
+
+// src/agent/capabilities/index.ts
+var CapabilityRegistry = class {
+  capabilities = /* @__PURE__ */ new Map();
+  register(capability) {
+    this.capabilities.set(capability.name, capability);
+  }
+  unregister(name) {
+    this.capabilities.delete(name);
+  }
+  getHandler(method) {
+    for (const cap of this.capabilities.values()) {
+      const handler = cap.methods.get(method);
+      if (handler) return handler;
+    }
+    return null;
+  }
+  getCapabilityNames() {
+    return Array.from(this.capabilities.keys());
+  }
+  has(name) {
+    return this.capabilities.has(name);
+  }
+};
+
+// src/agent/capabilities/filesystem.ts
+import { readFile, writeFile, readdir, stat, unlink, mkdir } from "fs/promises";
+import { join as join2, dirname } from "path";
+
+// src/agent/security/path-validator.ts
+import { resolve, normalize } from "path";
+import { realpathSync } from "fs";
+function validatePath(path, allowedPaths, blockedPaths = []) {
+  if (!path) {
+    throw new Error("Path is required");
+  }
+  const normalized = normalize(resolve(path));
+  let resolved;
+  try {
+    resolved = realpathSync(normalized);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      resolved = normalized;
+    } else {
+      throw new Error(`Access denied: cannot resolve path "${path}" (${code})`);
+    }
+  }
+  for (const blocked of blockedPaths) {
+    if (resolved === blocked || resolved.startsWith(blocked + "/")) {
+      throw new Error(`Access denied: blocked path "${path}"`);
+    }
+  }
+  if (allowedPaths.length > 0) {
+    const withinAllowed = allowedPaths.some((allowed) => {
+      const normalizedAllowed = normalize(resolve(allowed));
+      return resolved === normalizedAllowed || resolved.startsWith(normalizedAllowed + "/");
+    });
+    if (!withinAllowed) {
+      throw new Error(`Access denied: path "${path}" is outside allowed directories`);
+    }
+  }
+}
+
+// src/agent/capabilities/filesystem.ts
+function createFilesystemCapability(config) {
+  const methods = /* @__PURE__ */ new Map();
+  methods.set("fs.read", async (params) => {
+    const path = params.path;
+    const encoding = params.encoding || "utf-8";
+    validatePath(path, config.allowedPaths, config.blockedPaths);
+    const stats = await stat(path);
+    if (stats.size > config.maxFileSize) {
+      throw new Error(`File exceeds max size (${stats.size} > ${config.maxFileSize})`);
+    }
+    const content = await readFile(path, { encoding });
+    return {
+      content,
+      size: stats.size,
+      encoding
+    };
+  });
+  methods.set("fs.write", async (params) => {
+    const path = params.path;
+    const content = params.content;
+    const encoding = params.encoding || "utf-8";
+    validatePath(path, config.allowedPaths, config.blockedPaths);
+    if (content.length > config.maxFileSize) {
+      throw new Error(`Content exceeds max size (${content.length} > ${config.maxFileSize})`);
+    }
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, content, { encoding });
+    const stats = await stat(path);
+    return {
+      size: stats.size,
+      path
+    };
+  });
+  methods.set("fs.list", async (params) => {
+    const path = params.path;
+    const recursive = params.recursive || false;
+    validatePath(path, config.allowedPaths, config.blockedPaths);
+    const entries = await readdir(path, { withFileTypes: true });
+    const result = entries.map((entry) => ({
+      name: entry.name,
+      path: join2(path, entry.name),
+      isDirectory: entry.isDirectory(),
+      isFile: entry.isFile(),
+      isSymlink: entry.isSymbolicLink()
+    }));
+    if (recursive) {
+      const dirs = result.filter((e) => e.isDirectory);
+      for (const dir of dirs) {
+        try {
+          const subEntries = await readdir(dir.path, { withFileTypes: true });
+          for (const sub of subEntries) {
+            result.push({
+              name: sub.name,
+              path: join2(dir.path, sub.name),
+              isDirectory: sub.isDirectory(),
+              isFile: sub.isFile(),
+              isSymlink: sub.isSymbolicLink()
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    return { entries: result, count: result.length };
+  });
+  methods.set("fs.stat", async (params) => {
+    const path = params.path;
+    validatePath(path, config.allowedPaths, config.blockedPaths);
+    const stats = await stat(path);
+    return {
+      size: stats.size,
+      isDirectory: stats.isDirectory(),
+      isFile: stats.isFile(),
+      isSymlink: stats.isSymbolicLink(),
+      mode: stats.mode,
+      mtime: stats.mtime.toISOString(),
+      ctime: stats.ctime.toISOString(),
+      atime: stats.atime.toISOString()
+    };
+  });
+  methods.set("fs.delete", async (params) => {
+    const path = params.path;
+    validatePath(path, config.allowedPaths, config.blockedPaths);
+    await unlink(path);
+    return { deleted: true, path };
+  });
+  return {
+    name: "filesystem",
+    methods
+  };
+}
+
+// src/agent/capabilities/shell.ts
+import { spawn } from "child_process";
+
+// src/agent/security/command-validator.ts
+var SHELL_METACHAR_REGEX = /[;&|`$(){}[\]<>!#~]/;
+function validateCommand(command2, allowedCommands, blockedCommands) {
+  if (!command2 || typeof command2 !== "string") {
+    throw new Error("Command is required");
+  }
+  const trimmed = command2.trim();
+  if (SHELL_METACHAR_REGEX.test(trimmed)) {
+    throw new Error(`Command contains disallowed characters: "${trimmed}"`);
+  }
+  const executable = trimmed.split(/\s+/)[0];
+  if (blockedCommands.length > 0 && blockedCommands.includes(executable)) {
+    throw new Error(`Command "${executable}" is blocked`);
+  }
+  if (allowedCommands.length > 0) {
+    if (!allowedCommands.includes(executable)) {
+      throw new Error(`Command "${executable}" is not in the allowed commands list`);
+    }
+  }
+}
+
+// src/agent/capabilities/shell.ts
+function createShellCapability(config) {
+  const methods = /* @__PURE__ */ new Map();
+  methods.set("shell.exec", async (params) => {
+    const command2 = params.command;
+    const args = params.args || [];
+    const cwd = params.cwd || config.workingDir;
+    const timeout = Math.min(
+      params.timeout || config.shellTimeout,
+      config.shellMaxTimeout
+    );
+    validateCommand(command2, config.allowedCommands, config.blockedCommands);
+    if (cwd) {
+      validatePath(cwd, config.allowedPaths, config.blockedPaths);
+    }
+    const safeEnv = { TERM: "dumb" };
+    for (const key of config.shellEnvPassthrough) {
+      if (process.env[key]) {
+        safeEnv[key] = process.env[key];
+      }
+    }
+    return new Promise((resolve2, reject) => {
+      const proc = spawn(command2, args, {
+        cwd,
+        shell: false,
+        timeout,
+        env: safeEnv
+      });
+      let stdout = "";
+      let stderr = "";
+      let stdoutTruncated = false;
+      let stderrTruncated = false;
+      proc.stdout?.on("data", (data) => {
+        if (stdout.length >= config.shellMaxOutputSize) {
+          stdoutTruncated = true;
+          return;
+        }
+        const chunk = data.toString();
+        const remaining = config.shellMaxOutputSize - stdout.length;
+        if (chunk.length > remaining) {
+          stdout += chunk.slice(0, remaining);
+          stdoutTruncated = true;
+        } else {
+          stdout += chunk;
+        }
+      });
+      proc.stderr?.on("data", (data) => {
+        if (stderr.length >= config.shellMaxOutputSize) {
+          stderrTruncated = true;
+          return;
+        }
+        const chunk = data.toString();
+        const remaining = config.shellMaxOutputSize - stderr.length;
+        if (chunk.length > remaining) {
+          stderr += chunk.slice(0, remaining);
+          stderrTruncated = true;
+        } else {
+          stderr += chunk;
+        }
+      });
+      proc.on("error", (err) => {
+        reject(new Error(`Command failed to start: ${err.message}`));
+      });
+      proc.on("close", (code, signal) => {
+        resolve2({
+          exitCode: code,
+          signal,
+          stdout,
+          stderr,
+          stdoutTruncated,
+          stderrTruncated
+        });
+      });
+    });
+  });
+  return {
+    name: "shell",
+    methods
+  };
+}
+
+// src/agent/capabilities/desktop.ts
+import { platform as platform2 } from "os";
+function createDriver() {
+  switch (platform2()) {
+    case "darwin": {
+      const { MacOSDriver: MacOSDriver2 } = (init_macos_driver(), __toCommonJS(macos_driver_exports));
+      return new MacOSDriver2();
+    }
+    case "win32": {
+      const { WindowsDriver: WindowsDriver2 } = (init_windows_driver(), __toCommonJS(windows_driver_exports));
+      return new WindowsDriver2();
+    }
+    default: {
+      const { LinuxDriver: LinuxDriver2 } = (init_linux_driver(), __toCommonJS(linux_driver_exports));
+      return new LinuxDriver2();
+    }
+  }
+}
+function createDesktopCapability() {
+  const driver = createDriver();
+  const methods = /* @__PURE__ */ new Map();
+  methods.set("desktop.screenshot", async (params) => {
+    return driver.screenshot({
+      region: params.region,
+      windowId: params.windowId
+    });
+  });
+  methods.set("desktop.mouse.click", async (params) => {
+    await driver.mouseClick({
+      x: params.x,
+      y: params.y,
+      button: params.button,
+      clicks: params.clicks,
+      modifiers: params.modifiers
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.mouse.move", async (params) => {
+    await driver.mouseMove({
+      x: params.x,
+      y: params.y
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.mouse.drag", async (params) => {
+    await driver.mouseDrag({
+      fromX: params.fromX,
+      fromY: params.fromY,
+      toX: params.toX,
+      toY: params.toY,
+      button: params.button
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.mouse.scroll", async (params) => {
+    await driver.mouseScroll({
+      x: params.x,
+      y: params.y,
+      deltaX: params.deltaX,
+      deltaY: params.deltaY
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.mouse.position", async () => {
+    return driver.mousePosition();
+  });
+  methods.set("desktop.keyboard.type", async (params) => {
+    await driver.keyboardType({
+      text: params.text,
+      delay: params.delay
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.keyboard.key", async (params) => {
+    await driver.keyboardKey({
+      keys: params.keys
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.window.list", async () => {
+    return { windows: await driver.windowList() };
+  });
+  methods.set("desktop.window.focus", async (params) => {
+    await driver.windowFocus(params.windowId);
+    return { ok: true };
+  });
+  methods.set("desktop.window.resize", async (params) => {
+    await driver.windowResize(params.windowId, {
+      x: params.x,
+      y: params.y,
+      width: params.width,
+      height: params.height
+    });
+    return { ok: true };
+  });
+  methods.set("desktop.window.close", async (params) => {
+    await driver.windowClose(params.windowId);
+    return { ok: true };
+  });
+  methods.set("desktop.window.minimize", async (params) => {
+    await driver.windowMinimize(params.windowId);
+    return { ok: true };
+  });
+  methods.set("desktop.app.launch", async (params) => {
+    await driver.appLaunch(params.app);
+    return { ok: true };
+  });
+  methods.set("desktop.app.quit", async (params) => {
+    await driver.appQuit(params.app);
+    return { ok: true };
+  });
+  methods.set("desktop.app.list", async () => {
+    return { apps: await driver.appList() };
+  });
+  methods.set("desktop.clipboard.read", async () => {
+    return { text: await driver.clipboardRead() };
+  });
+  methods.set("desktop.clipboard.write", async (params) => {
+    await driver.clipboardWrite(params.text);
+    return { ok: true };
+  });
+  methods.set("desktop.screen.info", async () => {
+    return driver.screenInfo();
+  });
+  methods.set("desktop.cursor.image", async (params) => {
+    return driver.cursorImage(params.radius);
+  });
+  methods.set("desktop.ax.tree", async (params) => {
+    return driver.axTree({
+      pid: params.pid,
+      maxDepth: params.maxDepth,
+      roles: params.roles
+    });
+  });
+  methods.set("desktop.ax.action", async (params) => {
+    return driver.axAction({
+      elementId: params.elementId,
+      action: params.action,
+      pid: params.pid
+    });
+  });
+  methods.set("desktop.ax.set_value", async (params) => {
+    return driver.axSetValue({
+      elementId: params.elementId,
+      value: params.value,
+      pid: params.pid
+    });
+  });
+  methods.set("desktop.ax.focus", async (params) => {
+    return driver.axFocus({
+      elementId: params.elementId,
+      pid: params.pid
+    });
+  });
+  methods.set("desktop.ax.search", async (params) => {
+    return driver.axSearch({
+      query: params.query,
+      role: params.role,
+      pid: params.pid,
+      maxResults: params.maxResults
+    });
+  });
+  return {
+    name: "desktop",
+    methods
+  };
+}
+
+// src/agent/cli.ts
+import { hostname as hostname2, platform as platform3, arch as arch2 } from "os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, readFileSync as readFileSync2 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir5 } from "os";
+import { execSync } from "child_process";
+var c2 = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  italic: "\x1B[3m",
+  cyan: "\x1B[36m",
+  blue: "\x1B[34m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  magenta: "\x1B[35m",
+  white: "\x1B[97m",
+  gray: "\x1B[90m",
+  bgCyan: "\x1B[46m",
+  bgBlue: "\x1B[44m"
+};
+function parseArgs(argv) {
+  const command2 = argv[2] || "help";
+  const flags2 = {};
+  for (let i = 3; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      const value = argv[i + 1] && !argv[i + 1].startsWith("--") ? argv[++i] : "true";
+      flags2[key] = value;
+    }
+  }
+  return { command: command2, flags: flags2 };
+}
+function clearScreen() {
+  process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function printStartup(config, capabilities, version) {
+  const machine = hostname2();
+  const plat = `${platform3()} ${arch2()}`;
+  const truncate = (s, max) => s.length > max ? s.slice(0, max) + "\u2026" : s;
+  const tunnelDisplay = truncate(config.tunnelId, 40);
+  const apiDisplay = truncate(config.apiUrl, 40);
+  const machineDisplay = truncate(machine, 28);
+  console.log("");
+  console.log(`      ${c2.cyan}\u2584\u2580\u2588 \u2588\u2580\u2580 \u2588\u2580\u2580 \u2588\u2584 \u2588 \u2580\u2588\u2580${c2.reset}   ${c2.cyan}\u2580\u2588\u2580 \u2588 \u2588 \u2588\u2584 \u2588 \u2588\u2584 \u2588 \u2588\u2580\u2580 \u2588  ${c2.reset}`);
+  console.log(`      ${c2.cyan}\u2588\u2580\u2588 \u2588\u2584\u2588 \u2588\u2588\u2584 \u2588 \u2580\u2588  \u2588${c2.reset}    ${c2.cyan} \u2588  \u2588\u2584\u2588 \u2588 \u2580\u2588 \u2588 \u2580\u2588 \u2588\u2588\u2584 \u2588\u2584\u2584${c2.reset}`);
+  console.log("");
+  const barW = 50;
+  const frames = 14;
+  for (let i = 0; i <= frames; i++) {
+    const filled = Math.round(i / frames * barW);
+    const empty = barW - filled;
+    process.stdout.write(
+      `\r      ${c2.cyan}\u25C7${c2.reset} ${c2.cyan}${"\u2550".repeat(filled)}${c2.reset}${c2.gray}${"\u2500".repeat(empty)}${c2.reset}  `
+    );
+    await sleep(20);
+  }
+  process.stdout.write(`\r      ${c2.cyan}\u25C7 ${"\u2550".repeat(barW)} \u25C6${c2.reset}  
+`);
+  await sleep(120);
+  const W = 60;
+  const vLen = (s) => s.replace(/\x1b\[[0-9;]*m/g, "").length;
+  const row = (content) => {
+    const pad = Math.max(0, W - vLen(content));
+    console.log(`  ${c2.gray}\u2502${c2.reset}${content}${" ".repeat(pad)}${c2.gray}\u2502${c2.reset}`);
+  };
+  const blank = () => console.log(`  ${c2.gray}\u2502${c2.reset}${" ".repeat(W)}${c2.gray}\u2502${c2.reset}`);
+  const titleL = `   ${c2.cyan}\u25C6${c2.reset}  ${c2.bold}${c2.white}Agent Tunnel${c2.reset}`;
+  const titleR = `${c2.dim}v${version}${c2.reset}   `;
+  const titleLLen = 18;
+  const titleRLen = 1 + version.length + 3;
+  const titlePad = Math.max(1, W - titleLLen - titleRLen);
+  const capStr = capabilities.map((name) => `${c2.green}\u25CF${c2.reset} ${c2.white}${name}${c2.reset}`).join("   ");
+  const brand = "created by kortix";
+  const brandFill = W - brand.length - 3;
+  console.log("");
+  console.log(`  ${c2.gray}\u256D${"\u2500".repeat(W)}\u256E${c2.reset}`);
+  blank();
+  row(`${titleL}${" ".repeat(titlePad)}${titleR}`);
+  row(`   ${c2.dim}Bridge between AI agents & local machines${c2.reset}`);
+  blank();
+  row(`   ${c2.dim}tunnel${c2.reset}    ${c2.white}${tunnelDisplay}${c2.reset}`);
+  row(`   ${c2.dim}relay${c2.reset}     ${c2.white}${apiDisplay}${c2.reset}`);
+  row(`   ${c2.dim}machine${c2.reset}   ${c2.white}${machineDisplay}${c2.reset} ${c2.dim}(${plat})${c2.reset}`);
+  blank();
+  console.log(`  ${c2.gray}\u2570${"\u2500".repeat(brandFill)} ${c2.dim}created by ${c2.cyan}kortix${c2.reset} ${c2.gray}\u2500\u256F${c2.reset}`);
+  console.log("");
+}
+function startAgent(config) {
+  const registry = new CapabilityRegistry();
+  registry.register(createFilesystemCapability(config));
+  registry.register(createShellCapability(config));
+  registry.register(createDesktopCapability());
+  clearScreen();
+  printStartup(config, registry.getCapabilityNames(), "0.1.2");
+  const agent = new TunnelAgent(config, registry);
+  agent.connect();
+  const shutdown = () => {
+    console.log(`
+${c2.dim}  Shutting down\u2026${c2.reset}`);
+    agent.disconnect();
+    process.exit(0);
+  };
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+}
+function openBrowser(url) {
+  try {
+    const plat = platform3();
+    if (plat === "darwin") execSync(`open "${url}"`);
+    else if (plat === "win32") execSync(`start "" "${url}"`);
+    else execSync(`xdg-open "${url}"`);
+  } catch {
+  }
+}
+var CONFIG_DIR2 = join8(homedir5(), ".agent-tunnel");
+var CONFIG_FILE2 = join8(CONFIG_DIR2, "config.json");
+function saveCredentials(tunnelId, token, apiUrl) {
+  mkdirSync4(CONFIG_DIR2, { recursive: true });
+  let existing = {};
+  if (existsSync5(CONFIG_FILE2)) {
+    try {
+      existing = JSON.parse(readFileSync2(CONFIG_FILE2, "utf-8"));
+    } catch {
+    }
+  }
+  writeFileSync4(CONFIG_FILE2, JSON.stringify({ ...existing, tunnelId, token, apiUrl }, null, 2));
+}
+async function commandConnectDeviceAuth(config) {
+  console.log("");
+  console.log(`  ${c2.cyan}\u25C6${c2.reset} ${c2.bold}Device Authorization${c2.reset}`);
+  console.log("");
+  let deviceCode;
+  let deviceSecret;
+  let verificationUrl;
+  let expiresAt;
+  let pollIntervalMs;
+  try {
+    const res = await fetch(`${config.apiUrl}/device-auth`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ machineHostname: hostname2() })
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      console.error(`  ${c2.red}\u2717${c2.reset} Failed to create device auth request: ${res.status} ${text.slice(0, 200)}`);
+      process.exit(1);
+    }
+    const data = await res.json();
+    deviceCode = data.deviceCode;
+    deviceSecret = data.deviceSecret;
+    verificationUrl = data.verificationUrl;
+    expiresAt = data.expiresAt;
+    pollIntervalMs = data.pollIntervalMs || 2e3;
+  } catch (err) {
+    console.error(`  ${c2.red}\u2717${c2.reset} Failed to reach API at ${config.apiUrl}`);
+    process.exit(1);
+    return;
+  }
+  console.log(`  ${c2.dim}Code:${c2.reset}  ${c2.bold}${c2.white}${deviceCode}${c2.reset}`);
+  console.log("");
+  console.log(`  ${c2.dim}Open this URL on any device to approve:${c2.reset}`);
+  console.log(`  ${c2.cyan}${verificationUrl}${c2.reset}`);
+  console.log("");
+  openBrowser(verificationUrl);
+  const expiresAtMs = new Date(expiresAt).getTime();
+  while (true) {
+    const remaining = Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1e3));
+    if (remaining <= 0) {
+      console.log(`
+  ${c2.red}\u2717${c2.reset} Authorization expired. Please try again.`);
+      process.exit(1);
+    }
+    const min = Math.floor(remaining / 60);
+    const sec = remaining % 60;
+    process.stdout.write(`\r  ${c2.dim}Waiting for approval... ${c2.white}${min}:${sec.toString().padStart(2, "0")}${c2.reset}  `);
+    try {
+      const res = await fetch(`${config.apiUrl}/device-auth/${deviceCode}/status?secret=${deviceSecret}`);
+      if (res.ok) {
+        const data = await res.json();
+        if (data.status === "approved" && data.tunnelId && data.token) {
+          process.stdout.write("\r" + " ".repeat(60) + "\r");
+          console.log(`  ${c2.green}\u25CF${c2.reset} ${c2.bold}Authorized!${c2.reset}`);
+          console.log("");
+          saveCredentials(data.tunnelId, data.token, config.apiUrl);
+          console.log(`  ${c2.dim}Credentials saved to ${CONFIG_FILE2}${c2.reset}`);
+          console.log("");
+          const fullConfig = loadConfig({
+            token: data.token,
+            tunnelId: data.tunnelId,
+            apiUrl: config.apiUrl
+          });
+          startAgent(fullConfig);
+          return;
+        }
+        if (data.status === "denied") {
+          process.stdout.write("\r" + " ".repeat(60) + "\r");
+          console.log(`  ${c2.red}\u2717${c2.reset} Authorization denied.`);
+          process.exit(1);
+        }
+        if (data.status === "expired") {
+          process.stdout.write("\r" + " ".repeat(60) + "\r");
+          console.log(`  ${c2.red}\u2717${c2.reset} Authorization expired. Please try again.`);
+          process.exit(1);
+        }
+      }
+    } catch {
+    }
+    await sleep(pollIntervalMs);
+  }
+}
+async function commandConnect(flags2) {
+  const config = loadConfig({
+    token: flags2.token,
+    tunnelId: flags2["tunnel-id"],
+    apiUrl: flags2["api-url"]
+  });
+  if (config.token && config.tunnelId) {
+    startAgent(config);
+    return;
+  }
+  if (!config.token && !config.tunnelId) {
+    await commandConnectDeviceAuth(config);
+    return;
+  }
+  console.error(`${c2.red}${c2.bold} error${c2.reset} Provide both --token and --tunnel-id, or neither (for device auth)`);
+  process.exit(1);
+}
+async function commandStatus(flags2) {
+  const config = loadConfig({
+    token: flags2.token,
+    tunnelId: flags2["tunnel-id"],
+    apiUrl: flags2["api-url"]
+  });
+  if (!config.token || !config.tunnelId) {
+    console.error("Error: --token and --tunnel-id are required");
+    process.exit(1);
+  }
+  try {
+    const res = await fetch(`${config.apiUrl}/connections/${config.tunnelId}`, {
+      headers: { Authorization: `Bearer ${config.token}` }
+    });
+    if (!res.ok) {
+      console.error(`Error: ${res.status} ${await res.text()}`);
+      process.exit(1);
+    }
+    const data = await res.json();
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    console.error("Error:", err);
+    process.exit(1);
+  }
+}
+function showHelp() {
+  console.log("");
+  console.log(`  ${c2.cyan}\u2584\u2580\u2588 \u2588\u2580\u2580 \u2588\u2580\u2580 \u2588\u2584 \u2588 \u2580\u2588\u2580${c2.reset}   ${c2.cyan}\u2580\u2588\u2580 \u2588 \u2588 \u2588\u2584 \u2588 \u2588\u2584 \u2588 \u2588\u2580\u2580 \u2588  ${c2.reset}`);
+  console.log(`  ${c2.cyan}\u2588\u2580\u2588 \u2588\u2584\u2588 \u2588\u2588\u2584 \u2588 \u2580\u2588  \u2588${c2.reset}    ${c2.cyan} \u2588  \u2588\u2584\u2588 \u2588 \u2580\u2588 \u2588 \u2580\u2588 \u2588\u2588\u2584 \u2588\u2584\u2584${c2.reset}`);
+  console.log("");
+  console.log(`  ${c2.dim}Secure bridge between AI agents & local machines${c2.reset}`);
+  console.log("");
+  console.log(`  ${c2.bold}Usage${c2.reset}   ${c2.dim}npx @kortix/agent-tunnel <command> [options]${c2.reset}`);
+  console.log("");
+  console.log(`${c2.gray}  \u2500\u2500 Commands \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c2.reset}`);
+  console.log(`  ${c2.cyan}connect${c2.reset}       Connect via device auth (opens browser)`);
+  console.log(`  ${c2.cyan}status${c2.reset}        Check tunnel connection status`);
+  console.log(`  ${c2.cyan}help${c2.reset}          Show this help message`);
+  console.log("");
+  console.log(`${c2.gray}  \u2500\u2500 Options \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c2.reset}`);
+  console.log(`  ${c2.white}--token${c2.reset} ${c2.dim}<token>${c2.reset}       Skip device auth, connect directly`);
+  console.log(`  ${c2.white}--tunnel-id${c2.reset} ${c2.dim}<id>${c2.reset}     Tunnel ID ${c2.dim}(required with --token)${c2.reset}`);
+  console.log(`  ${c2.white}--api-url${c2.reset} ${c2.dim}<url>${c2.reset}       API URL ${c2.dim}(default: http://localhost:8080)${c2.reset}`);
+  console.log("");
+  console.log(`  ${c2.dim}Config: ~/.agent-tunnel/config.json${c2.reset}`);
+  console.log(`  ${c2.dim}powered by ${c2.cyan}kortix${c2.reset}`);
+  console.log("");
+}
+var { command, flags } = parseArgs(process.argv);
+switch (command) {
+  case "connect":
+    commandConnect(flags);
+    break;
+  case "status":
+    commandStatus(flags);
+    break;
+  case "help":
+  default:
+    showHelp();
+    break;
+}