local-commander-agent 0.3.13-launcher.1 → 0.3.14-cli.1

package/runtime/agent.mjs

@@ -2278,7 +2278,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash13 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash14 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2959,7 +2959,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest5 = createHash13("sha1").update(key + GUID).digest("base64");
+        const digest5 = createHash14("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest5) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3240,7 +3240,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open10() {
+          ws.once("open", function open11() {
             duplex._final(callback);
           });
           return;
@@ -3261,7 +3261,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open10() {
+          ws.once("open", function open11() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -3328,7 +3328,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash13 } = __require("crypto");
+    var { createHash: createHash14 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3635,7 +3635,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest5 = createHash13("sha1").update(key + GUID).digest("base64");
+        const digest5 = createHash14("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3723,9 +3723,9 @@ var require_websocket_server = __commonJS({
 });
 
 // agent/src/main.ts
-import path17 from "node:path";
-import os4 from "node:os";
-import { mkdir as mkdir9, open as open9, readFile as readFile6, rm as rm5 } from "node:fs/promises";
+import path18 from "node:path";
+import os5 from "node:os";
+import { mkdir as mkdir10, open as open10, readFile as readFile7, rm as rm6 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -4674,10 +4674,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path18) {
-  if (!path18)
+function getElementAtPath(obj, path19) {
+  if (!path19)
     return obj;
-  return path18.reduce((acc, key) => acc?.[key], obj);
+  return path19.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -5017,11 +5017,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path18, issues) {
+function prefixIssues(path19, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path18);
+    iss.path.unshift(path19);
     return iss;
   });
 }
@@ -5471,16 +5471,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path18 = []) => {
+  const processError = (error63, path19 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
       } else {
-        const fullpath = [...path18, ...issue2.path];
+        const fullpath = [...path19, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5519,17 +5519,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path18 = []) => {
+  const processError = (error63, path19 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
       } else {
-        const fullpath = [...path18, ...issue2.path];
+        const fullpath = [...path19, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5568,8 +5568,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path18 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path18) {
+  const path19 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path19) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -22671,13 +22671,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path18 = ref.slice(1).split("/").filter(Boolean);
-  if (path18.length === 0) {
+  const path19 = ref.slice(1).split("/").filter(Boolean);
+  if (path19.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path18[0] === defsKey) {
-    const key = path18[1] === void 0 ? void 0 : decodeJSONPointerSegment(path18[1]);
+  if (path19[0] === defsKey) {
+    const key = path19[1] === void 0 ? void 0 : decodeJSONPointerSegment(path19[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25773,7 +25773,12 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     }
     const approved = /* @__PURE__ */ new Set([MARKER, "owner-state.dat", "owner-state.lock", "journal", "agent-process.json", "optimization", ".local-commander"]);
     if (names.length && !names.includes(MARKER)) throw fail("STORE_DIRECTORY_UNKNOWN");
-    if (names.some((name2) => !approved.has(name2))) throw fail("STORE_DIRECTORY_UNKNOWN");
+    const memoryFile = (name2) => name2 === "host-memory.json" || /^host-memory\.json\.[1-9][0-9]{0,9}\.tmp$/.test(name2);
+    if (names.some((name2) => !approved.has(name2) && !memoryFile(name2))) throw fail("STORE_DIRECTORY_UNKNOWN");
+    for (const name2 of names.filter(memoryFile)) {
+      const stat = await lstat3(path5.join(absolute2, name2));
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 32768) throw fail("STORE_DIRECTORY_INVALID");
+    }
     for (const name2 of ["agent-process.json", "optimization", ".local-commander"]) {
       if (!names.includes(name2)) continue;
       const filename = path5.join(absolute2, name2), stat = await lstat3(filename);
@@ -26340,15 +26345,311 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
   }
 };
 
+// src/host-memory.ts
+import os2 from "node:os";
+import path7 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { accessSync, constants as constants3, statSync as statSync2 } from "node:fs";
+import { lstat as lstat4, readFile as readFile3, mkdir as mkdir3, open as open4, rename as rename3, rm as rm3 } from "node:fs/promises";
+
+// packages/agent-cli/bin/monitor-context.mjs
+var AGENT_NAMES = Object.freeze([
+  "Avi",
+  "Noam",
+  "Yael",
+  "Leah",
+  "Ezra",
+  "Eli",
+  "Tamar",
+  "Dalia",
+  "Ruth",
+  "Maya",
+  "Oren",
+  "Shira",
+  "Eitan",
+  "Lior",
+  "Hila",
+  "Amir",
+  "Ivan",
+  "Yuri",
+  "Olga",
+  "Anna",
+  "Boris",
+  "Nina",
+  "Pavel",
+  "Irina",
+  "Vera",
+  "Daria",
+  "Misha",
+  "Sasha",
+  "Vadim",
+  "Roman",
+  "Anya",
+  "Lev",
+  "Omar",
+  "Layla",
+  "Ali",
+  "Nadia",
+  "Salim",
+  "Hana",
+  "Rami",
+  "Zain",
+  "Noor",
+  "Amal",
+  "Samir",
+  "Farah",
+  "Malik",
+  "Yasmin",
+  "Adil",
+  "Hadi",
+  "Arjun",
+  "Priya",
+  "Ravi",
+  "Anika",
+  "Asha",
+  "Dev",
+  "Kiran",
+  "Meera",
+  "Nisha",
+  "Rohan",
+  "Diya",
+  "Neha",
+  "Anil",
+  "Sana",
+  "Vijay",
+  "Isha",
+  "Wei",
+  "Lin",
+  "Mei",
+  "Chen",
+  "Li",
+  "Jian",
+  "Ming",
+  "Hua",
+  "Yan",
+  "Tao",
+  "Jun",
+  "Lan",
+  "Yue",
+  "Lei",
+  "Hong",
+  "Qian"
+]);
+var identifier = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(value);
+function contextSummary(meta3 = {}) {
+  const source = typeof (meta3.cwd ?? meta3.path ?? meta3.project) === "string" ? meta3.cwd ?? meta3.path ?? meta3.project : "";
+  const normalized = source.replaceAll("\\", "/").replace(/\/+$/, "");
+  const safe = normalized.length <= 1024 && /^[A-Za-z0-9 _./:@()+-]*$/.test(normalized) && !/(?:^|\/)(?:\.env(?:\.[^/]*)?|credentials[^/]*|\.npmrc|agent-identities\.json)(?:\/|$)/i.test(normalized);
+  const directory = safe && normalized ? normalized.slice(-96) : null;
+  const project = directory ? directory.split("/").at(-1) : null;
+  const taskMatch = safe && normalized.match(/\/planning\/tasks\/([A-Za-z0-9][A-Za-z0-9_.:-]{0,95})\.md$/);
+  const taskId = identifier(meta3.taskId) ? meta3.taskId : taskMatch ? taskMatch[1] : null;
+  const branchPr = safe && normalized.match(/(?:^|[/_-])pr[-_]?(\d{1,7})(?:[/_.-]|$)/i);
+  const explicitPr = Number.isSafeInteger(meta3.pr) && meta3.pr > 0 && meta3.pr <= 9999999 ? meta3.pr : null;
+  const args = Array.isArray(meta3.args) ? meta3.args : [];
+  const ghPr = meta3.command === "gh" && args[0] === "pr" && ["view", "checkout", "diff", "checks", "merge"].includes(args[1]) && /^\d{1,7}$/.test(args[2] ?? "") ? Number(args[2]) : null;
+  return { project, directory, taskId, pr: explicitPr ?? ghPr ?? (branchPr ? Number(branchPr[1]) : null), inferred: !explicitPr && !identifier(meta3.taskId) };
+}
+function commandSummary(tool, meta3 = {}) {
+  if (tool === "agent_message" && ["send", "inbox", "ack"].includes(meta3.action)) {
+    const kind = ["status", "question", "answer", "handoff", "result_summary", "blocker"].includes(meta3.kind) ? " " + meta3.kind : "";
+    const target = identifier(meta3.to) ? " -> " + meta3.to.slice(0, 8) : "";
+    return "agent_message " + meta3.action + kind + target;
+  }
+  if (!["command_run", "process_start"].includes(tool)) return tool;
+  const candidate = typeof meta3.command === "string" ? meta3.command.replaceAll("\\", "/").split("/").at(-1).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase() : "";
+  const name2 = ["node", "npm", "npx", "git", "rg", "powershell", "pwsh", "cmd", "tsc", "python", "dotnet", "gh"].includes(candidate) ? candidate : "command";
+  const args = Array.isArray(meta3.args) ? meta3.args : [];
+  if (name2 === "git" && ["status", "diff", "log", "show", "fetch", "pull", "push", "commit"].includes(args[0])) return name2 + " " + args[0];
+  if (name2 === "npm" && ["test", "install", "ci", "pack", "publish"].includes(args[0])) return name2 + " " + args[0];
+  if (name2 === "npm" && args[0] === "run" && ["test", "build", "typecheck", "lint", "dev", "start"].includes(args[1])) return "npm run " + args[1];
+  return name2 + (args.length ? " [args]" : "");
+}
+function commandPreview(tool, meta3 = {}) {
+  if (!["command_run", "process_start"].includes(tool)) return commandSummary(tool, meta3);
+  const name2 = typeof meta3.command === "string" && /^[A-Za-z0-9_.-]{1,40}$/.test(meta3.command) ? meta3.command : "command";
+  const args = Array.isArray(meta3.args) ? meta3.args.slice(0, 24) : [];
+  let hideNext = false, inline = false;
+  const safe = args.map((arg) => {
+    if (inline || hideNext) {
+      hideNext = false;
+      return "[redacted]";
+    }
+    if (typeof arg !== "string") return "[value]";
+    if (/^(?:-e|--eval|-p|--print|-c|-command|--command|-encodedcommand|\/c|\/k)$/i.test(arg) && /^(?:node|python|bash|sh|powershell|pwsh|cmd)(?:\.[a-z]+)?$/i.test(name2)) inline = true;
+    if (/^(?:[-/]+(?:.*(?:token|password|passwd|secret|credential|authorization|api[-_]?key)|auth|key|header|env|config|data|data-raw|data-binary|message|prompt)|-[uHpmd])$/i.test(arg)) hideNext = true;
+    if (/(?:token|password|passwd|secret|credential|authorization|api[-_]?key)\s*[=:]|(?:^|[/\\])(?:\.env(?:\.|$)|credentials|\.npmrc)|:\/\/|[\x00-\x1f\x7f]|[A-Za-z0-9+/_=-]{40,}/i.test(arg)) return "[redacted]";
+    return arg.length <= 96 && /^[A-Za-z0-9 _./\\:@()+=-]+$/.test(arg) ? arg.includes(" ") ? JSON.stringify(arg) : arg : "[value]";
+  });
+  return [name2, ...safe, ...Array.isArray(meta3.args) && meta3.args.length > 24 ? ["\u2026"] : []].join(" ").slice(0, 240);
+}
+
+// src/process.ts
+import { statSync } from "node:fs";
+import path6 from "node:path";
+var WINDOWS_LAUNCH_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
+function envValue(env, name2) {
+  const key = Object.keys(env).find((k) => k.toUpperCase() === name2.toUpperCase());
+  return key === void 0 ? void 0 : env[key];
+}
+function resolveWindowsLauncher(commandName, env = process.env) {
+  const extensions = (envValue(env, "PATHEXT") || ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => ext.trim().toLowerCase()).filter((ext) => WINDOWS_LAUNCH_EXTENSIONS.includes(ext));
+  for (const entry of (envValue(env, "PATH") ?? "").split(";")) {
+    const dir = entry.trim().replace(/^"(.*)"$/, "$1");
+    if (!path6.win32.isAbsolute(dir)) continue;
+    for (const ext of extensions) {
+      const file2 = path6.win32.join(dir, commandName + ext);
+      try {
+        if (statSync(file2).isFile()) return { file: file2, shell: ext === ".bat" || ext === ".cmd" };
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+
+// src/host-memory.ts
+var Entry = external_exports.strictObject({
+  id: external_exports.string().regex(/^[a-f0-9]{16}$/),
+  command: external_exports.string().max(240).refine((v) => !/[\x00-\x1f\x7f]/.test(v)),
+  directory: external_exports.string().max(96).nullable(),
+  outcome: external_exports.enum(["succeeded", "failed"]),
+  code: external_exports.enum(["EXIT_NONZERO", "TIMED_OUT", "INCOMPLETE", "NOT_FOUND", "NOT_ALLOWED", "COMMAND_ERROR"]).nullable(),
+  exitCode: external_exports.number().int().nullable(),
+  at: external_exports.number().int().positive(),
+  count: external_exports.number().int().min(1).max(1e6)
+});
+var State = external_exports.strictObject({ version: external_exports.literal(1), platform: external_exports.string().max(16), entries: external_exports.array(Entry).max(32) });
+var HostMemory = class {
+  constructor(file2, allowed, programs) {
+    this.file = file2;
+    this.allowed = allowed;
+    this.programs = programs;
+  }
+  file;
+  allowed;
+  programs;
+  entries = [];
+  loaded;
+  writing = Promise.resolve();
+  errors = 0;
+  facts;
+  async load() {
+    this.loaded ??= (async () => {
+      try {
+        const stat = await lstat4(this.file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 32768) throw Error("HOST_MEMORY_INVALID");
+        const data = State.parse(JSON.parse(await readFile3(this.file, "utf8")));
+        if (data.platform === process.platform) this.entries = data.entries.filter((e) => e.at <= Date.now() && Date.now() - e.at < 30 * 864e5);
+      } catch (error62) {
+        if (error62.code !== "ENOENT") this.errors++;
+      }
+    })();
+    await this.loaded;
+  }
+  discover() {
+    const commands = this.allowed.slice(0, 32).filter((name2) => /^[A-Za-z0-9_.-]{1,40}$/.test(name2)).map((command) => {
+      let available = command === "node" && !this.programs;
+      if (this.programs) {
+        try {
+          const executable = this.programs[command];
+          available = !!executable && path7.isAbsolute(executable) && statSync2(executable).isFile();
+        } catch {
+          available = false;
+        }
+      }
+      if (!this.programs && !available && process.platform === "win32") available = !!resolveWindowsLauncher(command);
+      else if (!this.programs && !available) available = (process.env.PATH ?? "").split(path7.delimiter).some((dir) => {
+        if (!path7.isAbsolute(dir)) return false;
+        try {
+          const file2 = path7.join(dir, command);
+          accessSync(file2, constants3.X_OK);
+          return statSync2(file2).isFile();
+        } catch {
+          return false;
+        }
+      });
+      return { command, available, registeredOrAllowed: true };
+    });
+    return {
+      platform: process.platform,
+      os: os2.type(),
+      release: os2.release(),
+      architecture: process.arch,
+      node: process.version,
+      shell: process.platform === "win32" ? "Windows; prefer available powershell/pwsh or structured argv" : "POSIX; structured argv",
+      commands,
+      commandsTruncated: this.allowed.length > 32,
+      packages: "Executable availability only; package versions are not inferred",
+      observedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async context() {
+    await this.load();
+    if (!this.facts || Date.now() - this.facts.at > 6e4) this.facts = { at: Date.now(), value: this.discover() };
+    return {
+      system: this.facts.value,
+      workedCommands: this.entries.filter((e) => e.outcome === "succeeded").slice(-8).reverse(),
+      recentFailures: this.entries.filter((e) => e.outcome === "failed").slice(-8).reverse(),
+      persistenceErrors: this.errors,
+      guidance: (process.platform === "win32" ? "This is Windows: do not assume Bash exists. Use an available approved shell or structured argv. " : "") + "Use current system facts before discovery. Success is observed exit 0, not approval for reuse. Failures are hints; permissions remain unchanged."
+    };
+  }
+  async record(request, result2, error62) {
+    await this.load();
+    const command = commandPreview("command_run", request);
+    const directory = contextSummary({ cwd: request.cwd }).directory;
+    const complete = !!result2 && result2.exitCode !== null && !result2.timedOut && !result2.signal && !result2.descendantsHeldOutput && !result2.stdinFailed && !result2.cancelled && result2.treeTerminated !== false;
+    const succeeded = complete && result2.exitCode === 0;
+    const errorCode = error62?.code;
+    const message2 = error62 instanceof Error ? error62.message : "";
+    const code = succeeded ? null : result2?.timedOut ? "TIMED_OUT" : result2 && !complete ? "INCOMPLETE" : errorCode === "ENOENT" || errorCode === "COMMAND_NOT_FOUND" ? "NOT_FOUND" : message2.includes("is not allowed") || errorCode === "COMMAND_NOT_ALLOWED" || errorCode === "LOCAL_PERMISSION_REQUIRED" ? "NOT_ALLOWED" : result2 ? "EXIT_NONZERO" : "COMMAND_ERROR";
+    const id2 = createHash9("sha256").update(command + "\n" + (directory ?? "") + "\n" + (succeeded ? "succeeded" : "failed")).digest("hex").slice(0, 16);
+    const old = this.entries.find((e) => e.id === id2);
+    this.entries = this.entries.filter((e) => e.id !== id2);
+    this.entries.push({
+      id: id2,
+      command,
+      directory,
+      outcome: succeeded ? "succeeded" : "failed",
+      code,
+      exitCode: result2?.exitCode ?? null,
+      at: Date.now(),
+      count: Math.min(1e6, (old?.count ?? 0) + 1)
+    });
+    this.entries = this.entries.slice(-32);
+    const encoded = JSON.stringify({ version: 1, platform: process.platform, entries: this.entries }) + "\n";
+    this.writing = this.writing.then(async () => {
+      const directory2 = path7.dirname(this.file), temp = this.file + "." + process.pid + ".tmp";
+      await mkdir3(directory2, { recursive: true, mode: 448 });
+      const stat = await lstat4(directory2);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("HOST_MEMORY_DIRECTORY_INVALID");
+      const file2 = await open4(temp, "wx", 384);
+      try {
+        await file2.writeFile(encoded);
+        await file2.close();
+        await rename3(temp, this.file);
+      } finally {
+        await file2.close().catch(() => {
+        });
+        await rm3(temp, { force: true }).catch(() => {
+        });
+      }
+    }).catch(() => {
+      this.errors++;
+    });
+  }
+};
+
 // agent/src/tools.ts
-import { constants as constants3 } from "node:fs";
-import { lstat as lstat5, open as open4, readdir as readdir3, realpath as realpath5, rename as rename3, rm as rm3 } from "node:fs/promises";
-import path10 from "node:path";
-import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
+import { constants as constants4 } from "node:fs";
+import { lstat as lstat6, open as open5, readdir as readdir3, realpath as realpath5, rename as rename4, rm as rm4 } from "node:fs/promises";
+import path11 from "node:path";
+import { createHash as createHash10, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/guard.ts
-import { lstat as lstat4, realpath as realpath4 } from "node:fs/promises";
-import path6 from "node:path";
+import { lstat as lstat5, realpath as realpath4 } from "node:fs/promises";
+import path8 from "node:path";
 var SENSITIVE_NAMES = /* @__PURE__ */ new Set([
   ".npmrc",
   ".pypirc",
@@ -26385,12 +26686,12 @@ function comparePath(value) {
   return process.platform === "win32" ? value.toLowerCase() : value;
 }
 function isInside(root, candidate) {
-  const relative = path6.relative(root, candidate);
-  return relative === "" || !path6.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path6.sep}`);
+  const relative = path8.relative(root, candidate);
+  return relative === "" || !path8.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path8.sep}`);
 }
 function splitPathSegments(filePath) {
-  const parsed = path6.parse(path6.resolve(filePath));
-  return path6.relative(parsed.root, path6.resolve(filePath)).split(path6.sep).filter((segment) => segment.length > 0);
+  const parsed = path8.parse(path8.resolve(filePath));
+  return path8.relative(parsed.root, path8.resolve(filePath)).split(path8.sep).filter((segment) => segment.length > 0);
 }
 function isProtectedAuditFile(base) {
   return base === ".local-commander-audit.jsonl" || base.startsWith(".local-commander-audit.jsonl.");
@@ -26405,40 +26706,40 @@ function looksProtected(filePath) {
   return false;
 }
 function looksSensitive(filePath) {
-  const base = path6.basename(filePath).toLowerCase();
+  const base = path8.basename(filePath).toLowerCase();
   if (base === ".env" || base.startsWith(".env.") && base !== ".env.example") return true;
   if (SENSITIVE_NAMES.has(base)) return true;
-  if (SENSITIVE_EXTENSIONS.has(path6.extname(base))) return true;
+  if (SENSITIVE_EXTENSIONS.has(path8.extname(base))) return true;
   const segments = splitPathSegments(filePath).map((segment) => segment.toLowerCase());
   if (segments.slice(0, -1).some((segment) => SENSITIVE_DIRECTORIES.has(segment))) return true;
   const parent = segments.at(-2);
   return SENSITIVE_IN_DIRECTORY.some(([directory, name2]) => directory === parent && name2 === base);
 }
 async function canonicalizePossiblyMissing(inputPath, base) {
-  const absolute2 = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
-  const parsed = path6.parse(absolute2);
+  const absolute2 = path8.isAbsolute(inputPath) ? path8.resolve(inputPath) : path8.resolve(base, inputPath);
+  const parsed = path8.parse(absolute2);
   let current2 = absolute2;
   const missing = [];
   while (current2 !== parsed.root) {
     try {
       const resolved = await realpath4(current2);
-      return path6.join(resolved, ...missing.reverse());
+      return path8.join(resolved, ...missing.reverse());
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
       let exists = false;
       try {
-        await lstat4(current2);
+        await lstat5(current2);
         exists = true;
       } catch (statError) {
         if (statError.code !== "ENOENT") throw statError;
       }
       if (exists) throw error62;
-      missing.push(path6.basename(current2));
-      current2 = path6.dirname(current2);
+      missing.push(path8.basename(current2));
+      current2 = path8.dirname(current2);
     }
   }
   const root = await realpath4(parsed.root);
-  return path6.join(root, ...missing.reverse());
+  return path8.join(root, ...missing.reverse());
 }
 var PathGuard = class _PathGuard {
   constructor(roots, allowSensitiveFiles, protectedPaths) {
@@ -26454,11 +26755,11 @@ var PathGuard = class _PathGuard {
     for (const root of roots) {
       let resolved;
       try {
-        resolved = await realpath4(path6.resolve(root));
+        resolved = await realpath4(path8.resolve(root));
       } catch {
         throw new Error(`Configured root does not exist: ${root}`);
       }
-      const stat = await lstat4(resolved);
+      const stat = await lstat5(resolved);
       if (!stat.isDirectory()) throw new Error(`Configured root is not a directory: ${root}`);
       if (!canonical2.some((existing) => comparePath(existing) === comparePath(resolved))) {
         canonical2.push(resolved);
@@ -26467,8 +26768,8 @@ var PathGuard = class _PathGuard {
     if (canonical2.length === 0) throw new Error("At least one allowed root is required");
     const protectedPaths = [];
     for (const protectedPath of options.protectedPaths ?? []) {
-      const base = path6.isAbsolute(protectedPath) ? path6.parse(path6.resolve(protectedPath)).root : canonical2[0];
-      const absolute2 = path6.resolve(base, protectedPath);
+      const base = path8.isAbsolute(protectedPath) ? path8.parse(path8.resolve(protectedPath)).root : canonical2[0];
+      const absolute2 = path8.resolve(base, protectedPath);
       if (!protectedPaths.some((existing) => comparePath(existing) === comparePath(absolute2))) protectedPaths.push(absolute2);
       const resolved = await canonicalizePossiblyMissing(protectedPath, base);
       if (!protectedPaths.some((existing) => comparePath(existing) === comparePath(resolved))) {
@@ -26484,7 +26785,7 @@ var PathGuard = class _PathGuard {
   }
   assertNotProtected(candidate) {
     if (looksProtected(candidate)) {
-      throw new Error(`Local Commander protected state is blocked: ${path6.basename(candidate)}`);
+      throw new Error(`Local Commander protected state is blocked: ${path8.basename(candidate)}`);
     }
     const normalizedCandidate = comparePath(candidate);
     for (const protectedPath of this.protectedPaths) {
@@ -26497,13 +26798,13 @@ var PathGuard = class _PathGuard {
     this.assertNotProtected(filePath);
     if (!this.allowSensitiveFiles && looksSensitive(filePath)) {
       throw new Error(
-        `Sensitive file access is blocked by default: ${path6.basename(filePath)}. Enable files.allowSensitiveFiles only if you really need it.`
+        `Sensitive file access is blocked by default: ${path8.basename(filePath)}. Enable files.allowSensitiveFiles only if you really need it.`
       );
     }
   }
   async resolveExisting(inputPath, cwd) {
     const base = cwd ? await this.resolveExisting(cwd) : this.roots[0];
-    const candidate = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
+    const candidate = path8.isAbsolute(inputPath) ? path8.resolve(inputPath) : path8.resolve(base, inputPath);
     this.assertNotProtected(candidate);
     const resolved = await realpath4(candidate);
     this.assertWithinRoots(resolved);
@@ -26512,13 +26813,13 @@ var PathGuard = class _PathGuard {
   }
   async resolveDirectory(inputPath, cwd) {
     const resolved = await this.resolveExisting(inputPath, cwd);
-    const stat = await lstat4(resolved);
+    const stat = await lstat5(resolved);
     if (!stat.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
     return resolved;
   }
   async resolveForWrite(inputPath, cwd) {
     const base = cwd ? await this.resolveDirectory(cwd) : this.roots[0];
-    const candidate = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
+    const candidate = path8.isAbsolute(inputPath) ? path8.resolve(inputPath) : path8.resolve(base, inputPath);
     this.assertNotProtected(candidate);
     let existing;
     try {
@@ -26527,7 +26828,7 @@ var PathGuard = class _PathGuard {
       if (error62.code !== "ENOENT") throw error62;
       let exists = false;
       try {
-        await lstat4(candidate);
+        await lstat5(candidate);
         exists = true;
       } catch (statError) {
         if (statError.code !== "ENOENT") throw statError;
@@ -26540,11 +26841,11 @@ var PathGuard = class _PathGuard {
       this.assertSafeFile(existing);
       return existing;
     }
-    const parent = await realpath4(path6.dirname(candidate));
+    const parent = await realpath4(path8.dirname(candidate));
     this.assertWithinRoots(parent);
     this.assertNotProtected(parent);
     this.assertSafeFile(candidate);
-    const target = path6.join(parent, path6.basename(candidate));
+    const target = path8.join(parent, path8.basename(candidate));
     this.assertSafeFile(target);
     return target;
   }
@@ -26555,12 +26856,12 @@ var PathGuard = class _PathGuard {
 
 // src/windows-file-read.ts
 import { execFile } from "node:child_process";
-import path7 from "node:path";
+import path9 from "node:path";
 function readWindowsFile(bridge, file2, maxBytes, signal) {
   return invokeRead(bridge, file2, maxBytes, false, signal);
 }
 function invokeRead(bridge, file2, maxBytes, prefix, signal) {
-  if (process.platform !== "win32" || !path7.isAbsolute(bridge) || !path7.isAbsolute(file2) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
+  if (process.platform !== "win32" || !path9.isAbsolute(bridge) || !path9.isAbsolute(file2) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
     return Promise.reject(new Error("FILE_READ_ARGUMENT_INVALID"));
   }
   if (signal?.aborted) return Promise.reject(new Error("CANCELLED"));
@@ -26587,31 +26888,11 @@ function invokeRead(bridge, file2, maxBytes, prefix, signal) {
   });
 }
 
-// src/process.ts
-import { statSync } from "node:fs";
-import path8 from "node:path";
-var WINDOWS_LAUNCH_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
-function resolveWindowsLauncher(commandName, env = process.env) {
-  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => ext.trim().toLowerCase()).filter((ext) => WINDOWS_LAUNCH_EXTENSIONS.includes(ext));
-  for (const entry of (env.PATH ?? "").split(";")) {
-    const dir = entry.trim().replace(/^"(.*)"$/, "$1");
-    if (!path8.win32.isAbsolute(dir)) continue;
-    for (const ext of extensions) {
-      const file2 = path8.win32.join(dir, commandName + ext);
-      try {
-        if (statSync(file2).isFile()) return { file: file2, shell: ext === ".bat" || ext === ".cmd" };
-      } catch {
-      }
-    }
-  }
-  return void 0;
-}
-
 // agent/src/job-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import path9 from "node:path";
+import path10 from "node:path";
 function absolute(value) {
-  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path9.isAbsolute(value) && path9.resolve(value) === value;
+  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path10.isAbsolute(value) && path10.resolve(value) === value;
 }
 async function runSupervised(helper, request, options = {}) {
   if (process.platform !== "win32") throw Error("WINDOWS_SUPERVISOR_REQUIRED");
@@ -26627,7 +26908,7 @@ async function runSupervised(helper, request, options = {}) {
     let pid = null, outcome = null;
     let buffer = "", failure5 = null, closed = false, cancelSent = false;
     let killTimer, hardTimer;
-    const child = spawn2(helper, [], { cwd: path9.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
+    const child = spawn2(helper, [], { cwd: path10.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
     const cancel = () => {
       if (closed || cancelSent) return;
       cancelSent = true;
@@ -26782,7 +27063,7 @@ function fail2(code) {
   throw new NativeToolError(code);
 }
 function hash5(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function equalPath3(a, b) {
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
@@ -26796,10 +27077,10 @@ function stopped(signal) {
   if (signal.aborted) fail2("CANCELLED");
 }
 async function readBoundedFile(file2, maxBytes, bridge, signal) {
-  const stat = await lstat5(file2);
+  const stat = await lstat6(file2);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes) fail2("FILE_UNSUPPORTED_OR_TOO_LARGE");
   if (process.platform === "win32") return readWindowsFile(bridge, file2, maxBytes, signal);
-  const handle = await open4(file2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+  const handle = await open5(file2, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
   try {
     const current2 = await handle.stat();
     if (!current2.isFile() || current2.size > maxBytes) fail2("FILE_UNSUPPORTED_OR_TOO_LARGE");
@@ -26830,11 +27111,13 @@ var NativeTools = class {
   constructor(options) {
     this.options = options;
     this.options = structuredClone(options);
+    this.memory = new HostMemory(path11.join(options.stateDirectory, "host-memory.json"), Object.keys(options.programs), Object.fromEntries(Object.entries(options.programs).map(([name2, program]) => [name2, program.executable])));
   }
   options;
+  memory;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path10.join(path10.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path11.join(path11.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail2(error62.message);
@@ -26842,7 +27125,15 @@ var NativeTools = class {
     }
   }
   async prepare(workspace, candidate) {
-    const prepared = await this.prepareTool(workspace, candidate);
+    let prepared;
+    try {
+      prepared = await this.prepareTool(workspace, candidate);
+    } catch (error62) {
+      const parsed = ToolCallSchema.safeParse(candidate);
+      if (parsed.success && parsed.data.name === "command_run") await this.memory.record({ ...parsed.data.args, cwd: path11.resolve(workspace.root, parsed.data.args.cwd ?? ".") }, void 0, error62).catch(() => {
+      });
+      throw error62;
+    }
     prepared.effective = structuredClone({
       call: prepared.call,
       claims: prepared.claims,
@@ -26859,15 +27150,15 @@ var NativeTools = class {
     try {
       const canonical2 = await realpath5(workspace.root);
       if (!equalPath3(canonical2, workspace.root) || hash5(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace.rootHash) fail2("WORKSPACE_CHANGED");
-      const runtimeDirectory = path10.dirname(this.options.helperPath);
+      const runtimeDirectory = path11.dirname(this.options.helperPath);
       const protectedPaths = [
         this.options.stateDirectory,
         this.options.helperPath,
-        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path10.join(runtimeDirectory, name2))
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path11.join(runtimeDirectory, name2))
       ];
       if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
-      if (process.platform === "win32" && process.env.LOCALAPPDATA && path10.isAbsolute(process.env.LOCALAPPDATA)) {
-        protectedPaths.push(path10.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path11.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path11.join(process.env.LOCALAPPDATA, "LocalCommander"));
       }
       guard = await PathGuard.create([canonical2], false, { protectedPaths });
     } catch (e) {
@@ -26899,7 +27190,7 @@ var NativeTools = class {
         const bytes3 = await this.readFile(filename, 1048576, signal), contents = utf8(bytes3), lines = contents.split(/\r?\n/);
         const selected = lines.slice(first - 1, Math.min(last, lines.length)).join("\n");
         if (Buffer.byteLength(selected) > 12e4) fail2("OUTPUT_LIMIT_EXCEEDED");
-        return result({ path: path10.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
+        return result({ path: path11.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -26935,8 +27226,8 @@ var NativeTools = class {
         }
         const bytes3 = Buffer.from(contents, "utf8");
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail2("FILE_WRITE_LIMIT");
-        const temp = path10.join(path10.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
-        const handle = await open4(temp, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
+        const temp = path11.join(path11.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
+        const handle = await open5(temp, constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
           await handle.sync();
@@ -26946,17 +27237,17 @@ var NativeTools = class {
           if (!equalPath3(target, again)) fail2("FILE_CHANGED");
           if (old) {
             if (hash5(await this.readFile(target, 1048576, signal)) !== hash5(old)) fail2("FILE_CHANGED");
-            await rename3(temp, target);
+            await rename4(temp, target);
           } else {
             const { link } = await import("node:fs/promises");
             await link(temp, target);
-            await rm3(temp);
+            await rm4(temp);
           }
-          return result({ path: path10.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path11.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
-          await rm3(temp, { force: true }).catch(() => {
+          await rm4(temp, { force: true }).catch(() => {
           });
           throw e;
         }
@@ -26973,12 +27264,12 @@ var NativeTools = class {
           stopped(signal);
           if (matches2.length >= call.args.maxResults || scanned >= 300) break;
           try {
-            const filename = await guard.resolveExisting(path10.join(base, entry.path));
+            const filename = await guard.resolveExisting(path11.join(base, entry.path));
             guard.assertSafeFile(filename);
             const data = utf8(await this.readFile(filename, 256e3, signal));
             scanned++;
             const lines = data.split(/\r?\n/);
-            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path10.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
+            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path11.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
           } catch (error62) {
             if (error62 instanceof NativeToolError && ["FILE_READ_FAILED", "CANCELLED"].includes(error62.code)) throw error62;
           }
@@ -27031,7 +27322,16 @@ var NativeTools = class {
       const cwd2 = await resolve(call.args.cwd, true), program = await this.resolveProgram(call.args.command, workspace, call.args.args);
       const claims2 = writeClaim(cwd2);
       return { call, claims: claims2, execution: { ...program, cwd: cwd2 }, run: async (signal, onStarted, onOutput) => {
-        const r = await runSupervised(this.options.helperPath, { ...program, cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
+        let r;
+        try {
+          r = await runSupervised(this.options.helperPath, { ...program, cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
+        } catch (error62) {
+          await this.memory.record({ ...call.args, cwd: cwd2 }, void 0, error62).catch(() => {
+          });
+          throw error62;
+        }
+        await this.memory.record({ ...call.args, cwd: cwd2 }, r).catch(() => {
+        });
         const { pid: _pid, ...output2 } = r;
         return { ...output2, resultCode: r.cancelled ? "CANCELLED" : r.timedOut ? "TIMEOUT" : r.exitCode === 0 ? "SUCCESS" : "USER_PROGRAM_FAILED" };
       } };
@@ -27046,9 +27346,9 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path10.resolve(cwd, call.args.file));
-        const relative = path10.relative(cwd, file2);
-        if (relative.startsWith(".." + path10.sep) || relative === ".." || path10.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path11.resolve(cwd, call.args.file));
+        const relative = path11.relative(cwd, file2);
+        if (relative.startsWith(".." + path11.sep) || relative === ".." || path11.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail2("TOOL_MISSING");
@@ -27059,7 +27359,7 @@ var NativeTools = class {
         const listing = await this.list(guard, cwd, 1, call.args.startup ? 20 : 150, signal);
         let packageInfo = null;
         try {
-          const name2 = await guard.resolveExisting(path10.join(cwd, "package.json"));
+          const name2 = await guard.resolveExisting(path11.join(cwd, "package.json"));
           guard.assertSafeFile(name2);
           const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
@@ -27079,7 +27379,7 @@ var NativeTools = class {
           }
           const contextFile = async (relative, limit, optional2 = false) => {
             try {
-              const file2 = await guard.resolveExisting(path10.join(primary, relative));
+              const file2 = await guard.resolveExisting(path11.join(primary, relative));
               guard.assertSafeFile(file2);
               return utf8(await this.readFile(file2, limit, signal));
             } catch (error62) {
@@ -27095,6 +27395,7 @@ var NativeTools = class {
           return result({
             root: cwd,
             primary,
+            hostMemory: await this.memoryContext(workspace),
             package: packageInfo,
             git: status?.stdout ?? null,
             files: listing,
@@ -27102,7 +27403,7 @@ var NativeTools = class {
             task: call.args.taskId ? { taskId: call.args.taskId, entry: entry?.slice(0, 4096) ?? null, continuation: log?.slice(-4096) ?? null, truncated: !!entry && entry.length > 4096 || !!log && log.length > 4096 } : null
           });
         }
-        return result({ root: workspace.displayName, files: listing, package: packageInfo, git: status?.stdout ?? null });
+        return result({ root: workspace.displayName, hostMemory: await this.memoryContext(workspace), files: listing, package: packageInfo, git: status?.stdout ?? null });
       }
       if (!common) fail2("NOT_A_GIT_REPOSITORY");
       const r = await runGit(signal, onStarted, onOutput);
@@ -27111,19 +27412,19 @@ var NativeTools = class {
     } };
   }
   async resolveProgram(name2, workspace, args) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path10.isAbsolute(name2) && equalPath3(value.executable, path10.resolve(name2)));
+    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path11.isAbsolute(name2) && equalPath3(value.executable, path11.resolve(name2)));
     if (workspace.fullAccess) {
-      const commandKey = (value) => path10.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "");
+      const commandKey = (value) => path11.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "");
       const denied = new Set((workspace.deniedCommands ?? []).map(commandKey));
       if (denied.has(commandKey(name2)) || entry && denied.has(commandKey(entry[0]))) fail2("COMMAND_NOT_ALLOWED");
-      const extension2 = path10.extname(name2).toLowerCase();
-      const candidate = entry?.[1].executable ?? (path10.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
+      const extension2 = path11.extname(name2).toLowerCase();
+      const candidate = entry?.[1].executable ?? (path11.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
         commandKey(name2),
         [".exe", ".com", ".cmd", ".bat"].includes(extension2) ? { ...process.env, PATHEXT: extension2 } : process.env
       )?.file : void 0);
-      if (!candidate || !path10.isAbsolute(candidate)) fail2("COMMAND_NOT_FOUND");
+      if (!candidate || !path11.isAbsolute(candidate)) fail2("COMMAND_NOT_FOUND");
       const executable = await realpath5(candidate).catch(() => fail2("COMMAND_NOT_FOUND"));
-      if (!(await lstat5(executable)).isFile()) fail2("COMMAND_NOT_FOUND");
+      if (!(await lstat6(executable)).isFile()) fail2("COMMAND_NOT_FOUND");
       if (denied.has(commandKey(executable))) fail2("COMMAND_NOT_ALLOWED");
       for (const key of workspace.deniedCommands ?? []) {
         const configured = this.options.programs[key]?.executable;
@@ -27136,7 +27437,7 @@ var NativeTools = class {
       if (/\.(cmd|bat)$/i.test(executable)) {
         if ([executable, ...args].some((value) => /[&|<>^%!"\r\n]/.test(value))) fail2("INVALID_SCRIPT_ARGUMENTS");
         const literal2 = (value) => "'" + value.replaceAll("'", "''") + "'";
-        const shell = path10.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        const shell = path11.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
         if (denied.has("powershell") || denied.has("cmd")) fail2("COMMAND_NOT_ALLOWED");
         const script = "& " + literal2(executable) + " @(" + args.map(literal2).join(",") + "); exit $LASTEXITCODE";
         return { executable: shell, args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
@@ -27144,16 +27445,25 @@ var NativeTools = class {
       if (!/\.(exe|com)$/i.test(executable)) fail2("COMMAND_NOT_ALLOWED");
       return { executable, args: [...entry?.[1].prefixArgs ?? [], ...args] };
     }
-    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path10.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
+    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path11.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
     return { executable: entry[1].executable, args: [...entry[1].prefixArgs ?? [], ...args] };
   }
+  async memoryContext(workspace) {
+    const context = await this.memory.context();
+    const root = workspace.root.replaceAll("\\", "/").replace(/\/+$/, "").toLowerCase();
+    const inWorkspace = (entry) => entry.directory !== null && (entry.directory.toLowerCase() === root || entry.directory.toLowerCase().startsWith(root + "/"));
+    return { ...context, workedCommands: context.workedCommands.filter(inWorkspace), recentFailures: context.recentFailures.filter(inWorkspace), system: { ...context.system, commands: context.system.commands.map((item) => ({
+      ...item,
+      permitted: workspace.permissions.executeCommands && (workspace.fullAccess ? !(workspace.deniedCommands ?? []).includes(item.command) : workspace.allowedCommands.includes(item.command))
+    })) } };
+  }
   async gitExecution(cwd, args) {
     const configured = this.options.programs.git;
-    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path10.isAbsolute(root)).map(([root, suffix]) => path10.join(root, suffix, "cmd", "git.exe")) : [];
+    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path11.isAbsolute(root)).map(([root, suffix]) => path11.join(root, suffix, "cmd", "git.exe")) : [];
     for (const candidate of candidates) {
-      if (!path10.isAbsolute(candidate)) continue;
+      if (!path11.isAbsolute(candidate)) continue;
       try {
-        const stat = await lstat5(candidate);
+        const stat = await lstat6(candidate);
         if (!stat.isFile() || stat.isSymbolicLink() || !equalPath3(candidate, await realpath5(candidate))) continue;
       } catch {
         continue;
@@ -27177,7 +27487,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path10.join(current2.path, item.name);
+        const candidate = path11.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -27187,11 +27497,11 @@ var NativeTools = class {
         }
         if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path10.relative(root, resolved), type: "directory" });
+          entries.push({ path: path11.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
-          const stat = await lstat5(resolved);
-          entries.push({ path: path10.relative(root, resolved), type: "file", size: stat.size });
+          const stat = await lstat6(resolved);
+          entries.push({ path: path11.relative(root, resolved), type: "file", size: stat.size });
         }
       }
       if (truncated) break;
@@ -27201,49 +27511,49 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace.root)) {
-      const dotGit = path10.join(directory, ".git");
+      const dotGit = path11.join(directory, ".git");
       try {
-        const stat = await lstat5(dotGit);
+        const stat = await lstat6(dotGit);
         if (stat.isSymbolicLink()) fail2("GIT_METADATA_CHANGED");
         let gitDir;
         if (stat.isDirectory()) gitDir = await realpath5(dotGit);
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail2("GIT_METADATA_CHANGED");
-          gitDir = await realpath5(path10.resolve(directory, content.slice(8)));
+          gitDir = await realpath5(path11.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace.root) && (!workspace.gitCommonDir || !guard.isWithin(gitDir, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path10.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path11.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail2("GIT_METADATA_CHANGED");
-          common = await realpath5(path10.resolve(gitDir, content));
+          common = await realpath5(path11.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
-        if (!(await lstat5(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail2("GIT_METADATA_CHANGED");
+        if (!(await lstat6(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail2("GIT_METADATA_CHANGED");
         if (!guard.isWithin(common, workspace.root) && (!workspace.gitCommonDir || !equalPath3(common, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         return common;
       } catch (e) {
         if (e.code !== "ENOENT") throw e;
       }
       if (equalPath3(directory, workspace.root)) break;
-      directory = path10.dirname(directory);
+      directory = path11.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path11 from "node:path";
-import os2 from "node:os";
+import path12 from "node:path";
+import os3 from "node:os";
 function canonical(value) {
-  const p = path11.resolve(value);
+  const p = path12.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path11.relative(a, b);
-  return relative === "" || !path11.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path11.sep);
+  const relative = path12.relative(a, b);
+  return relative === "" || !path12.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path12.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -27251,7 +27561,7 @@ function claimsConflict(a, b) {
 var NativeScheduler = class {
   constructor(options = {}) {
     this.options = options;
-    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os2.availableParallelism?.() ?? os2.cpus().length) / 2)));
+    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os3.availableParallelism?.() ?? os3.cpus().length) / 2)));
     this.safeSlots = options.safeSlots ?? capacity;
     this.maxQueued = options.maxQueued ?? 32;
     if (!Number.isInteger(this.safeSlots) || this.safeSlots < 1 || this.safeSlots > 32 || !Number.isInteger(this.maxQueued) || this.maxQueued < 1 || this.maxQueued > 256) throw Error("INVALID_SCHEDULER_LIMIT");
@@ -27272,7 +27582,7 @@ var NativeScheduler = class {
   schedule(id2, claims, deadlineAt, run, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id2 || id2.length > 100 || this.active.has(id2) || this.waiting.some((j) => j.id === id2)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path11.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path12.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
@@ -27339,6 +27649,30 @@ var NativeScheduler = class {
   }
 };
 
+// packages/optimization/src/operation-library.mjs
+function compactJsonOutput(source) {
+  if (typeof source !== "string" || Buffer.byteLength(source) > 1048576 || !/^\s*[\[{]/.test(source)) return null;
+  try {
+    JSON.parse(source);
+  } catch {
+    return null;
+  }
+  let quoted = false, escaped = false, compact = "";
+  for (const ch of source) {
+    if (quoted) {
+      compact += ch;
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') quoted = false;
+    } else if (ch === '"') {
+      quoted = true;
+      compact += ch;
+    } else if (!/[ \t\r\n]/.test(ch)) compact += ch;
+  }
+  if (source.endsWith("\n")) compact += "\n";
+  return Buffer.byteLength(compact) < Buffer.byteLength(source) ? compact : null;
+}
+
 // packages/optimization/src/parsers/node-tap.ts
 var NODE_TAP_PARSER_ID = "node-tap";
 var NODE_TAP_PARSER_VERSION = "1";
@@ -27706,6 +28040,23 @@ function shapeCommandResultForAgentDetailed(input2, result2) {
   }
   const source = capture(input2, result2);
   const parsed = result2.exitCode === 0 ? parseNodeTapShadow(source) : parseNodeTapFailureShadow(source);
+  if (parsed.state !== "candidate" && result2.exitCode === 0 && !result2.stdoutTruncated && !result2.stderrTruncated && result2.stderr === "") {
+    const compact = compactJsonOutput(result2.stdout);
+    if (compact !== null) {
+      const sent = bytes(compact), saved = originalBytes - sent;
+      return Object.freeze({ result: Object.freeze({ ...result2, stdout: compact }), telemetry: Object.freeze({
+        parserId: "json-whitespace",
+        parserVersion: "1",
+        eligible: true,
+        applied: true,
+        reason: "validated_compact",
+        originalStdoutBytes: originalBytes,
+        sentStdoutBytes: sent,
+        savedStdoutBytes: saved,
+        reductionPercent: originalBytes === 0 ? 0 : saved / originalBytes * 100
+      }) });
+    }
+  }
   if (parsed.state !== "candidate") {
     return Object.freeze({
       result: result2,
@@ -28942,8 +29293,8 @@ function canonicalOrigin2(value) {
     fail4("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path18) {
-  return origin + path18;
+function endpoint(origin, path19) {
+  return origin + path19;
 }
 function uuid18(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail4(code);
@@ -29444,29 +29795,29 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 }
 
 // agent/src/optimization-ledger.ts
-import { constants as constants4 } from "node:fs";
-import { lstat as lstat6, mkdir as mkdir4, open as open5, readFile as readFile4, realpath as realpath6 } from "node:fs/promises";
-import path12 from "node:path";
+import { constants as constants5 } from "node:fs";
+import { lstat as lstat7, mkdir as mkdir5, open as open6, readFile as readFile5, realpath as realpath6 } from "node:fs/promises";
+import path13 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure4(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path12.resolve(directory);
+  const absolute2 = path13.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
-      if ((await lstat6(current2)).isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
+      if ((await lstat7(current2)).isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path12.dirname(current2);
+    const parent = path13.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
-  await mkdir4(absolute2, { recursive: true, mode: 448 });
-  const stat = await lstat6(absolute2);
+  await mkdir5(absolute2, { recursive: true, mode: 448 });
+  const stat = await lstat7(absolute2);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
   return realpath6(absolute2);
 }
@@ -29486,29 +29837,29 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path12.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path12.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path13.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path13.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
-      const stat = await lstat6(filename);
+      const stat = await lstat7(filename);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_LEDGER_BYTES) {
         throw failure4("OPTIMIZATION_LEDGER_INVALID");
       }
-      existing = await readFile4(filename, "utf8");
+      existing = await readFile5(filename, "utf8");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const handle = await open5(
+    const handle = await open6(
       filename,
-      constants4.O_CREAT | constants4.O_APPEND | constants4.O_WRONLY | (constants4.O_NOFOLLOW ?? 0),
+      constants5.O_CREAT | constants5.O_APPEND | constants5.O_WRONLY | (constants5.O_NOFOLLOW ?? 0),
       384
     );
     const ledger = new _OptimizationLedger(filename, handle, noticesFilename);
     try {
       try {
-        const noticeStat = await lstat6(noticesFilename);
+        const noticeStat = await lstat7(noticesFilename);
         if (!noticeStat.isFile() || noticeStat.isSymbolicLink() || noticeStat.size > MAX_NOTICE_LEDGER_BYTES) throw failure4("OPTIMIZATION_NOTICE_LEDGER_INVALID");
-        const notices = await readFile4(noticesFilename, "utf8");
+        const notices = await readFile5(noticesFilename, "utf8");
         for (const line of notices.split("\n")) {
           if (!line) continue;
           const parsed = JSON.parse(line);
@@ -29573,16 +29924,16 @@ var OptimizationLedger = class _OptimizationLedger {
       const marker = JSON.stringify({ sessionId: event.sessionId, checkpointCalls, deliveredAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
       let currentBytes = 0;
       try {
-        const stat = await lstat6(this.noticesFilename);
+        const stat = await lstat7(this.noticesFilename);
         if (!stat.isFile() || stat.isSymbolicLink()) throw failure4("OPTIMIZATION_NOTICE_LEDGER_INVALID");
         currentBytes = stat.size;
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
       if (currentBytes + Buffer.byteLength(marker, "utf8") > MAX_NOTICE_LEDGER_BYTES) throw failure4("OPTIMIZATION_NOTICE_LEDGER_CAPACITY_EXCEEDED");
-      const markerHandle = await open5(
+      const markerHandle = await open6(
         this.noticesFilename,
-        constants4.O_CREAT | constants4.O_APPEND | constants4.O_WRONLY | (constants4.O_NOFOLLOW ?? 0),
+        constants5.O_CREAT | constants5.O_APPEND | constants5.O_WRONLY | (constants5.O_NOFOLLOW ?? 0),
         384
       );
       try {
@@ -29620,114 +29971,13 @@ var OptimizationLedger = class _OptimizationLedger {
 };
 
 // agent/src/monitor.ts
-import { createHash as createHash10, randomUUID as randomUUID8 } from "node:crypto";
-import { lstat as lstat7, mkdir as mkdir5, open as open6, rename as rename4, rm as rm4 } from "node:fs/promises";
-import path13 from "node:path";
-import os3 from "node:os";
-
-// packages/agent-cli/bin/monitor-context.mjs
-var AGENT_NAMES = Object.freeze([
-  "Avi",
-  "Noam",
-  "Yael",
-  "Leah",
-  "Ezra",
-  "Eli",
-  "Tamar",
-  "Dalia",
-  "Ruth",
-  "Maya",
-  "Oren",
-  "Shira",
-  "Eitan",
-  "Lior",
-  "Hila",
-  "Amir",
-  "Ivan",
-  "Yuri",
-  "Olga",
-  "Anna",
-  "Boris",
-  "Nina",
-  "Pavel",
-  "Irina",
-  "Vera",
-  "Daria",
-  "Misha",
-  "Sasha",
-  "Vadim",
-  "Roman",
-  "Anya",
-  "Lev",
-  "Omar",
-  "Layla",
-  "Ali",
-  "Nadia",
-  "Salim",
-  "Hana",
-  "Rami",
-  "Zain",
-  "Noor",
-  "Amal",
-  "Samir",
-  "Farah",
-  "Malik",
-  "Yasmin",
-  "Adil",
-  "Hadi",
-  "Arjun",
-  "Priya",
-  "Ravi",
-  "Anika",
-  "Asha",
-  "Dev",
-  "Kiran",
-  "Meera",
-  "Nisha",
-  "Rohan",
-  "Diya",
-  "Neha",
-  "Anil",
-  "Sana",
-  "Vijay",
-  "Isha",
-  "Wei",
-  "Lin",
-  "Mei",
-  "Chen",
-  "Li",
-  "Jian",
-  "Ming",
-  "Hua",
-  "Yan",
-  "Tao",
-  "Jun",
-  "Lan",
-  "Yue",
-  "Lei",
-  "Hong",
-  "Qian"
-]);
-var identifier = (value) => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(value);
-function contextSummary(meta3 = {}) {
-  const source = typeof (meta3.cwd ?? meta3.path ?? meta3.project) === "string" ? meta3.cwd ?? meta3.path ?? meta3.project : "";
-  const normalized = source.replaceAll("\\", "/").replace(/\/+$/, "");
-  const safe = normalized.length <= 1024 && /^[A-Za-z0-9 _./:@()+-]*$/.test(normalized) && !/(?:^|\/)(?:\.env(?:\.[^/]*)?|credentials[^/]*|\.npmrc|agent-identities\.json)(?:\/|$)/i.test(normalized);
-  const directory = safe && normalized ? normalized.slice(-96) : null;
-  const project = directory ? directory.split("/").at(-1) : null;
-  const taskMatch = safe && normalized.match(/\/planning\/tasks\/([A-Za-z0-9][A-Za-z0-9_.:-]{0,95})\.md$/);
-  const taskId = identifier(meta3.taskId) ? meta3.taskId : taskMatch ? taskMatch[1] : null;
-  const branchPr = safe && normalized.match(/(?:^|[/_-])pr[-_]?(\d{1,7})(?:[/_.-]|$)/i);
-  const explicitPr = Number.isSafeInteger(meta3.pr) && meta3.pr > 0 && meta3.pr <= 9999999 ? meta3.pr : null;
-  const args = Array.isArray(meta3.args) ? meta3.args : [];
-  const ghPr = meta3.command === "gh" && args[0] === "pr" && ["view", "checkout", "diff", "checks", "merge"].includes(args[1]) && /^\d{1,7}$/.test(args[2] ?? "") ? Number(args[2]) : null;
-  return { project, directory, taskId, pr: explicitPr ?? ghPr ?? (branchPr ? Number(branchPr[1]) : null), inferred: !explicitPr && !identifier(meta3.taskId) };
-}
-
-// agent/src/monitor.ts
-function commandSummary(tool) {
+import { createHash as createHash11, randomUUID as randomUUID8 } from "node:crypto";
+import { lstat as lstat8, mkdir as mkdir6, open as open7, rename as rename5, rm as rm5 } from "node:fs/promises";
+import path14 from "node:path";
+import os4 from "node:os";
+function commandSummary2(tool) {
   if (tool.name !== "command_run") return { name: tool.name, command: tool.name };
-  const candidate = path13.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
+  const candidate = path14.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
   const name2 = ["node", "npm", "npx", "git", "rg", "powershell", "pwsh", "cmd", "tsc", "python", "dotnet"].includes(candidate) ? candidate : "command";
   let command = name2;
   if (name2 === "node" && tool.args.args.includes("--test") && !tool.args.args.some((arg) => ["-e", "--eval", "-p", "--print"].includes(arg))) command += " --test";
@@ -29740,8 +29990,8 @@ function commandSummary(tool) {
 var ProductionMonitor = class {
   constructor(directory, stateDirectory, agentVersion3) {
     this.agentVersion = agentVersion3;
-    const key = createHash10("sha256").update(path13.resolve(stateDirectory).toLowerCase()).digest("hex");
-    this.file = path13.join(directory, key + ".json");
+    const key = createHash11("sha256").update(path14.resolve(stateDirectory).toLowerCase()).digest("hex");
+    this.file = path14.join(directory, key + ".json");
   }
   agentVersion;
   instanceId = randomUUID8();
@@ -29752,7 +30002,7 @@ var ProductionMonitor = class {
   measured = /* @__PURE__ */ new Set();
   polls = { status: 0, output: 0 };
   efficiencyCalls = 0;
-  computer = os3.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
+  computer = os4.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
   sequence = 0;
   connection = {
     state: "starting",
@@ -29813,7 +30063,12 @@ var ProductionMonitor = class {
       this.executions.set(binding2.executionId, {
         executionId: binding2.executionId,
         sessionId: binding2.sessionId,
-        ...commandSummary(tool.data),
+        ...commandSummary2(tool.data),
+        preview: commandPreview(tool.data.name, tool.data.args),
+        startedAt: Date.now(),
+        endedAt: null,
+        exitCode: null,
+        timedOut: false,
         context: contextSummary(tool.data.args),
         state: "requested",
         pid: null,
@@ -29825,6 +30080,7 @@ var ProductionMonitor = class {
       });
       if (this.executions.size > 64) this.executions.delete(this.executions.keys().next().value);
     }
+    if (request.kind === "status" || request.kind === "output") return;
     this.record(request.kind, {
       sessionId: binding2.sessionId,
       executionId: binding2.executionId,
@@ -29833,7 +30089,10 @@ var ProductionMonitor = class {
   }
   result(binding2, state, code) {
     const execution = this.executions.get(binding2.executionId);
-    if (execution) execution.state = ["finished", "failed", "cancelled", "unknown"].includes(state) ? state : "unknown";
+    if (execution) {
+      execution.endedAt = Date.now();
+      execution.state = ["finished", "failed", "cancelled", "unknown"].includes(state) ? state : "unknown";
+    }
     this.record(["finished", "failed", "cancelled", "unknown"].includes(state) ? state : "result", {
       sessionId: binding2.sessionId,
       executionId: binding2.executionId,
@@ -29849,6 +30108,9 @@ var ProductionMonitor = class {
     if (frame.type === "not_accepted") execution.state = frame.provedNotStarted ? "rejected" : "unknown";
     if (frame.type === "result") {
       const result2 = frame.result;
+      execution.endedAt = Date.now();
+      execution.exitCode = result2.exitCode;
+      execution.timedOut = result2.timedOut;
       execution.state = !result2.treeTerminated ? "unknown" : result2.cancelled ? "cancelled" : result2.timedOut || result2.exitCode !== 0 ? "failed" : "finished";
     }
     if (frame.type === "control_result") execution.state = frame.state;
@@ -29928,21 +30190,21 @@ var ProductionMonitor = class {
     this.writing = (async () => {
       do {
         this.dirty = false;
-        const directory = path13.dirname(this.file);
-        await mkdir5(directory, { recursive: true, mode: 448 });
-        const stat = await lstat7(directory);
+        const directory = path14.dirname(this.file);
+        await mkdir6(directory, { recursive: true, mode: 448 });
+        const stat = await lstat8(directory);
         if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
         const temporary = this.file + "." + this.instanceId + ".tmp";
-        const handle = await open6(temporary, "wx", 384);
+        const handle = await open7(temporary, "wx", 384);
         try {
           try {
             await handle.writeFile(JSON.stringify(this.snapshot()) + "\n");
           } finally {
             await handle.close();
           }
-          await rename4(temporary, this.file);
+          await rename5(temporary, this.file);
         } finally {
-          await rm4(temporary, { force: true });
+          await rm5(temporary, { force: true });
         }
       } while (this.dirty);
     })().finally(() => {
@@ -29958,9 +30220,9 @@ var ProductionMonitor = class {
 };
 
 // agent/src/native-event-buffer.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function nativeFingerprint(code, executionId = "") {
-  return createHash11("sha256").update(code + "\0" + executionId).digest("hex");
+  return createHash12("sha256").update(code + "\0" + executionId).digest("hex");
 }
 var NativeEventBuffer = class {
   pending = /* @__PURE__ */ new Map();
@@ -30358,27 +30620,27 @@ var NativeFabricObserver = class {
 };
 
 // agent/src/native-fabric-startup.ts
-import { lstat as lstat9, mkdir as mkdir8, open as open8, readFile as readFile5 } from "node:fs/promises";
-import path16 from "node:path";
+import { lstat as lstat10, mkdir as mkdir9, open as open9, readFile as readFile6 } from "node:fs/promises";
+import path17 from "node:path";
 
 // src/agent-fabric-service.ts
-import { lstat as lstat8, mkdir as mkdir7, realpath as realpath7 } from "node:fs/promises";
+import { lstat as lstat9, mkdir as mkdir8, realpath as realpath7 } from "node:fs/promises";
 import { watch } from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // src/agent-runtime-identity.ts
-import { createHash as createHash12, randomBytes as randomBytes4, randomUUID as randomUUID10, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash13, randomBytes as randomBytes4, randomUUID as randomUUID10, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
 // src/agent-fabric-state.ts
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { mkdir as mkdir6, open as open7, rename as rename5, unlink } from "node:fs/promises";
-import path14 from "node:path";
+import { mkdir as mkdir7, open as open8, rename as rename6, unlink } from "node:fs/promises";
+import path15 from "node:path";
 var queues = /* @__PURE__ */ new Map();
 var FabricStateFile = class {
   constructor(file2, maxBytes, parse3) {
     this.maxBytes = maxBytes;
     this.parse = parse3;
-    this.file = path14.resolve(file2);
+    this.file = path15.resolve(file2);
   }
   maxBytes;
   parse;
@@ -30396,7 +30658,7 @@ var FabricStateFile = class {
     return result2;
   }
   async load() {
-    const handle = await open7(this.file, "r");
+    const handle = await open8(this.file, "r");
     try {
       const info = await handle.stat();
       if (!info.isFile() || info.size > this.maxBytes) throw Error("FABRIC_STATE_LIMIT");
@@ -30422,10 +30684,10 @@ var FabricStateFile = class {
   }
   update(fn, create) {
     return this.serial(async () => {
-      if (create) await mkdir6(path14.dirname(this.file), { recursive: true });
+      if (create) await mkdir7(path15.dirname(this.file), { recursive: true });
       const lockPath = this.file + ".lock";
       const token = randomUUID9();
-      const lock = await open7(lockPath, "wx", 384).catch((error62) => {
+      const lock = await open8(lockPath, "wx", 384).catch((error62) => {
         if (error62.code === "EEXIST") throw Error("FABRIC_STATE_BUSY");
         throw error62;
       });
@@ -30443,7 +30705,7 @@ var FabricStateFile = class {
         const encoded = JSON.stringify(this.parse(state));
         if (Buffer.byteLength(encoded) > this.maxBytes) throw Error("FABRIC_STATE_LIMIT");
         const temporary = this.file + "." + token + ".tmp";
-        const handle = await open7(temporary, "wx", 384);
+        const handle = await open8(temporary, "wx", 384);
         try {
           try {
             await handle.writeFile(encoded, "utf8");
@@ -30451,7 +30713,7 @@ var FabricStateFile = class {
           } finally {
             await handle.close();
           }
-          await rename5(temporary, this.file);
+          await rename6(temporary, this.file);
         } finally {
           await unlink(temporary).catch((error62) => {
             if (error62.code !== "ENOENT") throw error62;
@@ -30460,7 +30722,7 @@ var FabricStateFile = class {
         return result2;
       } finally {
         await lock.close();
-        const current2 = await open7(lockPath, "r");
+        const current2 = await open8(lockPath, "r");
         try {
           if ((await current2.stat()).size > 1024 || JSON.parse(await current2.readFile("utf8")).token !== token)
             throw Error("FABRIC_STATE_LOCK_CHANGED");
@@ -30490,7 +30752,7 @@ var StateSchema = external_exports.strictObject({
   bindings: external_exports.array(BindingSchema).max(MAX_BINDINGS)
 });
 function digest4(value) {
-  return createHash12("sha256").update(value, "utf8").digest();
+  return createHash13("sha256").update(value, "utf8").digest();
 }
 function encodedDigest(value) {
   return digest4(value).toString("hex");
@@ -31066,9 +31328,9 @@ var WorkerRequest = external_exports.discriminatedUnion("operation", [
 var AgentFabricService = class _AgentFabricService {
   constructor(directory, controllerId) {
     this.directory = directory;
-    this.identities = new AgentRuntimeIdentityStore(path15.join(directory, "identities.json"));
+    this.identities = new AgentRuntimeIdentityStore(path16.join(directory, "identities.json"));
     this.mailbox = new AgentWorkerMailbox(
-      path15.join(directory, "mailbox.json"),
+      path16.join(directory, "mailbox.json"),
       controllerId,
       this.identities,
       void 0,
@@ -31083,21 +31345,21 @@ var AgentFabricService = class _AgentFabricService {
   closed = false;
   static async open(directory, controllerId, device = null, initialize = true) {
     const expected = Binding.parse({ version: 1, controllerId, device, initialized: false });
-    const absolute2 = path15.resolve(directory);
-    for (let current2 = absolute2; ; current2 = path15.dirname(current2)) {
+    const absolute2 = path16.resolve(directory);
+    for (let current2 = absolute2; ; current2 = path16.dirname(current2)) {
       try {
-        if ((await lstat8(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
+        if ((await lstat9(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
-      if (path15.dirname(current2) === current2) break;
+      if (path16.dirname(current2) === current2) break;
     }
-    if (initialize) await mkdir7(absolute2, { recursive: true, mode: 448 });
-    if (!(await lstat8(absolute2)).isDirectory() || (await realpath7(absolute2)).toLowerCase() !== absolute2.toLowerCase())
+    if (initialize) await mkdir8(absolute2, { recursive: true, mode: 448 });
+    if (!(await lstat9(absolute2)).isDirectory() || (await realpath7(absolute2)).toLowerCase() !== absolute2.toLowerCase())
       throw Error("FABRIC_DIRECTORY_INVALID");
     const present = /* @__PURE__ */ new Set();
     for (const name2 of ["binding.json", "mailbox.json", "identities.json"]) {
-      const file2 = await lstat8(path15.join(absolute2, name2)).catch((error62) => {
+      const file2 = await lstat9(path16.join(absolute2, name2)).catch((error62) => {
         if (error62.code === "ENOENT") return null;
         throw error62;
       });
@@ -31105,7 +31367,7 @@ var AgentFabricService = class _AgentFabricService {
       if (file2) present.add(name2);
     }
     if (!present.has("binding.json") && present.size) throw Error("FABRIC_BINDING_MISSING");
-    const binding2 = new FabricStateFile(path15.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
+    const binding2 = new FabricStateFile(path16.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
     const service = new _AgentFabricService(absolute2, controllerId);
     await binding2.update(async (state) => {
       if (state.controllerId !== expected.controllerId || JSON.stringify(state.device) !== JSON.stringify(expected.device))
@@ -31120,7 +31382,7 @@ var AgentFabricService = class _AgentFabricService {
         state.initialized = true;
       }
       const snapshot2 = await service.mailbox.snapshot();
-      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat8(path15.join(absolute2, "identities.json"));
+      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat9(path16.join(absolute2, "identities.json"));
     }, initialize ? () => expected : void 0);
     return service;
   }
@@ -31207,23 +31469,23 @@ var Delivery = external_exports.strictObject({ capability: external_exports.stri
 async function openNativeFabric(stateDirectory, enrollment, box, initialize = true) {
   const controllerId = "device-" + external_exports.string().uuid().parse(enrollment.deviceId).toLowerCase();
   const tenantId = external_exports.string().uuid().parse(enrollment.tenantId).toLowerCase();
-  const parent = path16.join(stateDirectory, ".local-commander"), marker = path16.join(parent, "fabric-established.json");
+  const parent = path17.join(stateDirectory, ".local-commander"), marker = path17.join(parent, "fabric-established.json");
   try {
-    await mkdir8(parent, { mode: 448 });
+    await mkdir9(parent, { mode: 448 });
   } catch (error62) {
     if (error62.code !== "EEXIST") throw error62;
   }
-  const parentInfo = await lstat9(parent);
+  const parentInfo = await lstat10(parent);
   if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
   const expected = JSON.stringify({ version: 1, controllerId, tenantId });
   let fresh = false;
   try {
-    const info = await lstat9(marker);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile5(marker, "utf8") !== expected)
+    const info = await lstat10(marker);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile6(marker, "utf8") !== expected)
       throw Error("FABRIC_BINDING_CHANGED");
   } catch (error62) {
     if (error62.code !== "ENOENT" || !initialize) throw error62;
-    const file2 = await open8(marker, "wx", 384);
+    const file2 = await open9(marker, "wx", 384);
     try {
       await file2.writeFile(expected);
       await file2.datasync();
@@ -31233,22 +31495,22 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
     fresh = true;
   }
   const service = await AgentFabricService.open(
-    path16.join(stateDirectory, ".local-commander", "fabric"),
+    path17.join(stateDirectory, ".local-commander", "fabric"),
     controllerId,
     { deviceId: enrollment.deviceId.toLowerCase(), enrollmentEvidenceRef: "enrollment-" + tenantId },
     fresh
   );
   const purpose = "native-fabric:" + tenantId + ":" + controllerId;
-  const credentialFile = (workerId) => path16.join(service.directory, external_exports.string().uuid().parse(workerId) + ".capability");
+  const credentialFile = (workerId) => path17.join(service.directory, external_exports.string().uuid().parse(workerId) + ".capability");
   const decode4 = (value) => {
     const credential = Credential.parse(JSON.parse(box.open(Buffer.from(value, "base64"), purpose).toString("utf8")));
     if (credential.controllerId !== controllerId) throw Error("FABRIC_WORKER_DENIED");
     return credential;
   };
   async function capability(workerId) {
-    const file2 = credentialFile(workerId), info = await lstat9(file2);
+    const file2 = credentialFile(workerId), info = await lstat10(file2);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw Error("FABRIC_CREDENTIAL_UNKNOWN");
-    const encoded = await readFile5(file2, "utf8");
+    const encoded = await readFile6(file2, "utf8");
     if (decode4(encoded).workerId !== workerId) throw Error("FABRIC_WORKER_DENIED");
     return encoded;
   }
@@ -31281,7 +31543,7 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
         } else {
           const credential = await service.identities.issue();
           const encoded = box.seal(Buffer.from(JSON.stringify({ ...credential, workerId: worker.workerId, controllerId })), purpose).toString("base64");
-          const file2 = await open8(credentialFile(worker.workerId), "wx", 384);
+          const file2 = await open9(credentialFile(worker.workerId), "wx", 384);
           try {
             await file2.writeFile(encoded);
             await file2.datasync();
@@ -31339,7 +31601,7 @@ async function readFabricRequest(input2 = process.stdin) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.13-launcher.1" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.14-cli.1" : "0.3.2";
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -31350,11 +31612,11 @@ function processAlive(pid) {
   }
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
-  await mkdir9(stateDir, { recursive: true });
-  const file2 = path17.join(stateDir, "agent-process.json");
+  await mkdir10(stateDir, { recursive: true });
+  const file2 = path18.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await open9(file2, "wx", 384);
+      const handle = await open10(file2, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, runtimeDir, version: version2, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n", "utf8");
       } finally {
@@ -31362,8 +31624,8 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       }
       return async () => {
         try {
-          const current2 = JSON.parse(await readFile6(file2, "utf8"));
-          if (current2.pid === process.pid) await rm5(file2, { force: true });
+          const current2 = JSON.parse(await readFile7(file2, "utf8"));
+          if (current2.pid === process.pid) await rm6(file2, { force: true });
         } catch {
         }
       };
@@ -31371,12 +31633,12 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       if (!error62 || typeof error62 !== "object" || !("code" in error62) || error62.code !== "EEXIST") throw error62;
       let stale = true;
       try {
-        const current2 = JSON.parse(await readFile6(file2, "utf8"));
+        const current2 = JSON.parse(await readFile7(file2, "utf8"));
         stale = typeof current2.pid !== "number" || !processAlive(current2.pid);
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm5(file2, { force: true });
+      await rm6(file2, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -31548,10 +31810,10 @@ async function runAgent(options) {
 async function main() {
   if (process.platform !== "win32") throw Error("WINDOWS_REQUIRED");
   const appData = process.env.LOCALAPPDATA;
-  if (!appData || !path17.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path17.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path17.dirname(process.execPath);
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path17.join(binaryDir, "OwnerBridge.exe");
+  if (!appData || !path18.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path18.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path18.dirname(process.execPath);
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path18.join(binaryDir, "OwnerBridge.exe");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (command === "pair") {
@@ -31560,7 +31822,7 @@ async function main() {
     const pairing = new PairingClient(store, { controlPlaneOrigin: origin, agentVersion: AGENT_VERSION2 });
     const begun = await pairing.begin();
     process.stdout.write(JSON.stringify({ approvalUrl: begun.approvalUrl, confirmationCode: begun.confirmationCode, expiresAt: begun.expiresAt.toISOString() }) + "\n");
-    await pairing.waitAndComplete(begun, os4.hostname().slice(0, 120));
+    await pairing.waitAndComplete(begun, os5.hostname().slice(0, 120));
     process.stdout.write("DEVICE_PAIRED\n");
     return;
   }
@@ -31621,7 +31883,7 @@ async function main() {
   }
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path17.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path18.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -31631,7 +31893,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path17.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path18.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -31650,7 +31912,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path17.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path18.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -31662,7 +31924,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path17.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path18.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -31700,16 +31962,16 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
-  const monitor = new ProductionMonitor(path17.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path18.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
   const publishMonitor = () => monitor.flush().catch(() => {
     process.stderr.write("MONITOR_WRITE_FAILED\n");
   });
   await publishMonitor();
   try {
-    const journal = await NativeJournal.open(path17.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
-    const efficiencyLedger = await OptimizationLedger.open(path17.join(stateDir, "optimization"));
+    const journal = await NativeJournal.open(path18.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const efficiencyLedger = await OptimizationLedger.open(path18.join(stateDir, "optimization"));
     try {
-      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path17.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
+      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path18.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
       process.once("SIGTERM", () => stop.abort());
@@ -31755,7 +32017,7 @@ async function main() {
     await releaseProcess();
   }
 }
-if (process.argv[1] && path17.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (process.argv[1] && path18.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";
     process.stderr.write(code + "\n");