local-commander-agent 0.3.17-journal.1 → 0.3.22-fullaccess.1

package/CHANGELOG.md

@@ -1,11 +1,17 @@
-# Change history
-
-## 0.3.17-journal.1 - 2026-10-08
-
-- Apply existing retention maintenance when a new request reaches the journal entry limit on a long-lived connection.
-- Remove only expired, acknowledged terminal records under the existing integrity and retention checks.
-- Keep active, unknown, unacknowledged and recent records protected; admission still fails closed when no record is eligible.
-
+# Change history
+
+## 0.3.22-fullaccess.1 - 2026-10-10
+
+- Owner-approved Full Access no longer requires per-executable registration for Windows shells or administration tools. The Windows account rights and explicit deny-command restrictions remain enforced.
+- Scoped grants and native authentication, target binding, journal/recovery and concurrency safeguards are unchanged.
+- Local direct MCP and remote startup improvements remain separate issue #104 tasks; this build still uses authenticated hosted relay for ChatGPT web.
+
+## 0.3.17-journal.1 - 2026-10-08
+
+- Apply existing retention maintenance when a new request reaches the journal entry limit on a long-lived connection.
+- Remove only expired, acknowledged terminal records under the existing integrity and retention checks.
+- Keep active, unknown, unacknowledged and recent records protected; admission still fails closed when no record is eligible.
+
 Includes the aligned monitor and expanded names from 0.3.16. This does not release unknown cloud reservations or replay work.
 
 ## 0.3.16-monitor.1 — 2026-10-08
@@ -24,3 +30,10 @@ Names are display hints. IDs and permissions are unchanged. Token figures remain
 - Release cloud reservations only after a rejection receipt passes the existing execution and device checks.
 - Retain fencing for unknown executions without rejection proof.
 - Prune acknowledged terminal journal records using the existing retention rules.
+# 0.3.19-admission.1
+
+New execution admission pauses when protected journal capacity is exhausted; authenticated relay status carries the pause while status, output and cancellation remain available. Retains the verified native18 default of 2,000 entries, the existing byte/retention limits and unknown-execution fencing.
+
+# 0.3.21-project-targets.3
+
+Explicit project targets use on-demand repository identity and constrain session paths to the selected repository. Retains installed target20 behavior and adds accepted journal admission guards and authenticated readiness reporting; existing journal retention, permission checks and unknown-execution fencing remain.

package/README.md

@@ -74,7 +74,7 @@ npx local-commander-agent@latest workspaces
 npx local-commander-agent@latest revoke-workspace <workspaceGrantId>
 ```
 
-`configure-access` reopens the full-access/selected-folder choice. **It replaces current grants and their restrictions.** Full access enables commands and localhost by default; selected folders start read/write with separate command/port allowlists. Choosing a restricted folder removes old broader grants. `approve-workspace` adds another read/write folder without replacing the existing set. `workspaces` shows grant IDs, full/scoped mode and explicit denials. A successful change restarts an already-running agent to synchronize grants; cancellation does not restart it. A revoked drive is not silently re-added in the background.
+`configure-access` reopens the full-access/selected-folder choice. **It replaces the current set of grants and their restrictions.** Full access enables commands and localhost by default; selected folders start read/write with separate command/port allowlists. Choosing a restricted folder removes old broader grants. `approve-workspace` adds another read/write folder without replacing the existing set. `workspaces` shows grant IDs, full/scoped mode and explicit denials. A successful change restarts an already-running agent to synchronize grants; cancellation does not restart it. A revoked drive is not silently re-added in the background.
 
 To enable or remove individual capabilities, replace the placeholders with a grant ID from `workspaces` and an executable path that actually exists on your PC:
 
@@ -90,13 +90,13 @@ npx local-commander-agent@latest deny-localhost <workspaceGrantId> 3000
 
 `allow-command` associates an exact executable with the name the assistant uses; it does not accept a shell command string. Capability changes are local owner actions, not MCP settings the assistant can silently widen. The all-drives decision always requires the local dialog; there is no `--yes` or environment flag to approve it.
 
-### Approve Git from CMD or PowerShell
+### Scoped access: approve Git from CMD or PowerShell
 
 When giving an owner Windows commands, identify the shell before using shell-specific syntax and label the example. Prefer explicit workspace IDs and quoted absolute executable paths that work in both CMD and PowerShell; do not assume a standard installation path.
 
 Use the example for the shell you are running. A prompt such as `C:\project>` is normally **Command Prompt (CMD)**; `PS C:\project>` is normally **PowerShell**. Windows Terminal can host either shell.
 
-First run `npx local-commander-agent@latest workspaces` and copy the intended workspace's grant ID.
+For selected-folders/scoped mode, first run `npx local-commander-agent@latest workspaces` and copy the intended workspace's grant ID. Full Access does not require this setup for Git.
 
 **CMD:** run `where git.exe`. If it lists several paths, choose the Git executable you intend to approve. Replace `WORKSPACE_ID` and the example path below with those actual values; keep the path in double quotes.
 
@@ -118,9 +118,10 @@ Do not paste `(Get-Command git).Source` into CMD: CMD passes it literally instea
 
 Under full access, `deny-command` and `deny-localhost` exclude the named command or port while other commands/ports remain available. Native `.exe`/`.com` commands receive argument arrays directly. `.cmd`/`.bat` launchers use a hidden PowerShell wrapper and reject cmd metacharacters in arguments; use an explicit interpreter for more complex scripts. Allowing a general interpreter is not containment against it launching a denied program.
 
-Full access does not include Windows shells, script hosts or administration binaries (`cmd`, `powershell`, `pwsh`, `wscript`, `cscript`, `mshta`, `rundll32`, `regsvr32`, `certutil`, `bitsadmin`, `msiexec`, `wmic`, `reg`, `schtasks`, `sc`, `net`, `netsh`, `icacls`, `takeown`, `runas`, `psexec`, `wsl`, `bash`, `sh`, `dism`, `winrm` and similar). An assistant request for one of these, by bare name or absolute path, fails with `COMMAND_NOT_ALLOWED` until you register that exact executable yourself with `allow-command <workspace-id> <name> <absolute .exe path>` and confirm the native dialog; it then runs only under the registered name or that exact path. Ordinary developer tools (`node`, `git`, `npm`, `python`, `dotnet`, ...) continue to resolve from your absolute `PATH` entries.
+Under **owner-approved Full Access**, installed Windows shells, script hosts and administration executables (including PowerShell and CMD) work without per-command registration. They execute under the Windows account's own rights, not elevated privileges. Owner-defined `deny-command` exclusions and explicit write/localhost restrictions still apply. A general interpreter can access resources beyond file-tool path checks; Full Access is not an OS sandbox. Existing scoped grants stay scoped until the owner deliberately changes access with `configure-access`.
 
-The MCP discovery sequence is `workspace_list`, `diagnostics`, `execution_session_open`, requested work, output/status, then session close. Diagnostics reports quota separately from the device's execution slot limit. Its optional `repairSafe` mode releases only expired reservations from this OAuth connection that never acquired a dispatch lease. It never retries work, changes permissions or clears unknown executions.
+
+For a remote MCP client with an unknown device/workspace, use `workspace_list`, then `execution_session_open`, perform the requested work and read results. Reuse valid, already authorized session and target context where supported. `diagnostics` is for faults, not a mandatory startup roundtrip. Diagnostics reports quota separately from the device's execution slot limit. Its optional `repairSafe` mode releases only expired reservations from this OAuth connection that never acquired a dispatch lease. It never retries work, changes permissions or clears unknown executions.
 
 ## Troubleshooting
 
@@ -207,4 +208,4 @@ Reload the personal MCP server once to load this source change, then reopen `npm
 
 The view shows measured per-agent calls, mean tool-plus-queue duration, stdout bytes, sent response bytes and errors when an identified reporter has those counters. Native measured calls, status/output polls and session records are separate figures; sessions are not execution capacity. Current savings totals exclude stale native snapshots. Missing measurements remain unavailable.
 
-See [CHANGELOG.md](CHANGELOG.md) for release changes.
+See [CHANGELOG.md](https://github.com/netbka/local-commander-mcp/blob/main/packages/agent-cli/CHANGELOG.md) for release changes.

package/bin/command-path.mjs

@@ -7,7 +7,7 @@ const SHIM_MARKER = "@rem Local Commander managed command\r\n";
 const WRAPPER_MARKER = "# Local Commander managed command\r\n";
 const MONITOR_WRAPPER = "localcommander-monitor.ps1";
 const SHORTCUT_NAME = "Local Commander Monitor";
-const CLI_FILES = ["package.json", "bin/localcommander.mjs", "bin/monitor.mjs", "bin/monitor-agents.mjs", "bin/monitor-context.mjs", "bin/monitor-mcp.mjs", "bin/command-path.mjs"];
+const CLI_FILES = ["package.json", "bin/localcommander.mjs", "bin/monitor.mjs", "bin/monitor-agents.mjs", "bin/monitor-context.mjs", "bin/monitor-mcp.mjs", "bin/monitor-savings.mjs", "bin/command-path.mjs"];
 
 function validVersion(version) {
   if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version)) throw Error("PACKAGE_VERSION_INVALID");

package/bin/monitor-agents.mjs

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { lstat, open } from "node:fs/promises";
-import { lstatSync, readFileSync } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { lstatSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -120,16 +120,16 @@ $rows = @(Get-Process -Name codex,claude,cursor-agent -ErrorAction SilentlyConti
 })
 ConvertTo-Json -InputObject $rows -Compress`;
 
-export function presenceDirectory(projectRoot = process.cwd()) {
-  let state = process.env.LCMCP_OAUTH_STATE_PATH;
-  if (!state) try {
-    const file = path.resolve(projectRoot, process.env.LCMCP_CONFIG?.trim() || "local-commander.config.json");
-    const stat = lstatSync(file);
-    if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 65536)
-      state = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, "")).auth?.oauthStatePath;
-  } catch { /* Missing/unreadable local configuration leaves observations unavailable. */ }
-  return typeof state === "string" && state.trim() ? path.join(path.dirname(path.resolve(projectRoot, state)), ".local-commander") : path.join(projectRoot, ".local-commander");
-}
+export function presenceDirectory(projectRoot = process.cwd()) {
+  let state = process.env.LCMCP_OAUTH_STATE_PATH;
+  if (!state) try {
+    const file = path.resolve(projectRoot, process.env.LCMCP_CONFIG?.trim() || "local-commander.config.json");
+    const stat = lstatSync(file);
+    if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 65536)
+      state = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, "")).auth?.oauthStatePath;
+  } catch { /* Missing/unreadable local configuration leaves observations unavailable. */ }
+  return typeof state === "string" && state.trim() ? path.join(path.dirname(path.resolve(projectRoot, state)), ".local-commander") : path.join(projectRoot, ".local-commander");
+}
 
 export async function readAgentActivity(directory, { previousHosts = new Map(), signal, projectRoot = process.cwd() } = {}) {
   const computer = os.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";

package/bin/monitor-savings.d.mts

@@ -0,0 +1,20 @@
+export interface LifetimeSavings {
+  scope: "all_time";
+  coverage: "recorded_native_results";
+  since: string | null;
+  asOf: string | null;
+  calls: number;
+  originalBytes: number;
+  sentBytes: number;
+  savedBytes: number;
+}
+export function lifetimeSavingsView(raw: unknown): LifetimeSavings | null;
+export function summarizeLifetimeSavings(result: {
+  instances?: Array<{ lifetimeSavings?: unknown; savingsSourceId?: string }>;
+  unavailable?: number;
+}): { available: boolean; partial: boolean; unavailable: number; sources?: number;
+  calls?: number; originalBytes?: number; sentBytes?: number; savedBytes?: number;
+  since?: string | null; asOf?: string | null; estimatedSavedTokens?: number };
+export function formatLifetimeSavings(result: Parameters<typeof summarizeLifetimeSavings>[0] & {
+  mcp?: { instances: Array<{ instanceId: string; metrics?: Array<{ savedBytes: number }> }>; unavailable?: number };
+}): string[];

package/bin/monitor-savings.mjs

@@ -0,0 +1,71 @@
+// Scalar projections only. Never read a ledger, private state or provider data here.
+const count = value => Number.isSafeInteger(value) && value >= 0 && value <= 1e15;
+const date = value => typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+
+/** Invalid or older optional telemetry must not hide the rest of a computer. */
+export function lifetimeSavingsView(raw) {
+  if (!raw || raw.scope !== "all_time" || raw.coverage !== "recorded_native_results" ||
+      ![raw.calls, raw.originalBytes, raw.sentBytes, raw.savedBytes].every(count) ||
+      raw.sentBytes > raw.originalBytes || raw.savedBytes !== raw.originalBytes - raw.sentBytes ||
+      (raw.calls === 0 ? raw.since !== null || raw.asOf !== null || raw.originalBytes !== 0 :
+        !date(raw.since) || !date(raw.asOf) || raw.since > raw.asOf)) return null;
+  return { scope: "all_time", coverage: "recorded_native_results", since: raw.since, asOf: raw.asOf,
+    calls: raw.calls, originalBytes: raw.originalBytes, sentBytes: raw.sentBytes, savedBytes: raw.savedBytes };
+}
+
+/** Aggregate complete scalar native histories, even when their producers have stopped. */
+export function summarizeLifetimeSavings(result) {
+  const sources = new Map(), rejected = new Set();
+  let unavailable = result.unavailable ?? 0;
+  // Ascending counts expose old conflicts too, regardless of the reader's file order.
+  const snapshots = (result.instances ?? []).map(instance => ({
+    id: instance.savingsSourceId, value: lifetimeSavingsView(instance.lifetimeSavings)
+  })).sort((a, b) => (a.value?.calls ?? 0) - (b.value?.calls ?? 0));
+  for (const { id, value } of snapshots) {
+    if (typeof id !== "string" || !/^[a-f0-9]{64}$/.test(id)) { unavailable++; continue; }
+    if (rejected.has(id)) continue;
+    const old = sources.get(id);
+    const conflict = old && (value?.calls === old.calls ?
+      Object.keys(old).some(key => value[key] !== old[key]) :
+      value && (["originalBytes", "sentBytes", "savedBytes"].some(key => value[key] < old[key]) ||
+        (old.since !== null && value.since > old.since) || (old.asOf !== null && value.asOf < old.asOf)));
+    if (!value || conflict) {
+      sources.delete(id); rejected.add(id); unavailable++; continue;
+    }
+    sources.set(id, value);
+  }
+  const values = [...sources.values()];
+  const totals = { calls: 0, originalBytes: 0, sentBytes: 0, savedBytes: 0 };
+  for (const value of values) for (const key of Object.keys(totals)) totals[key] += value[key];
+  if (!Object.values(totals).every(count)) return { available: false, partial: true, unavailable: unavailable + 1 };
+  const dates = values.map(value => value.since).filter(Boolean).sort();
+  const updates = values.map(value => value.asOf).filter(Boolean).sort();
+  return { available: values.length > 0, partial: unavailable > 0, unavailable, sources: values.length,
+    ...totals, since: dates[0] ?? null, asOf: updates.at(-1) ?? null,
+    estimatedSavedTokens: Math.round(totals.savedBytes / 4) };
+}
+
+/** Native all-time and retained personal MCP have different coverage and byte units. */
+export function formatLifetimeSavings(result) {
+  const total = summarizeLifetimeSavings(result);
+  const tokens = bytes => "~" + Math.round(bytes / 4).toLocaleString("en-US");
+  const personal = new Map();
+  for (const instance of result.mcp?.instances ?? []) personal.set(instance.instanceId, instance);
+  const personalBytes = [...personal.values()].flatMap(instance => instance.metrics ?? [])
+    .reduce((sum, metric) => sum + metric.savedBytes, 0);
+  const personalKnown = [...personal.values()].some(instance => instance.metrics?.length) && count(personalBytes);
+  const knownBytes = (total.available ? total.savedBytes : 0) + (personalKnown ? personalBytes : 0);
+  const available = (total.available || personalKnown) && count(knownBytes);
+  const partial = total.partial || !total.available || personal.size > 0 || Boolean(result.mcp?.unavailable);
+  const lines = [available ?
+    "All-time saved" + (partial ? " (partial)" : " (native)") + ": " + tokens(knownBytes) + " tokens" :
+    "All-time saved: unavailable | historical measurements not reported"];
+  if (total.available) lines.push("Native history: Raw " + tokens(total.originalBytes) + " | Sent " + tokens(total.sentBytes) +
+    " | " + (total.originalBytes ? (100 * total.savedBytes / total.originalBytes).toFixed(1) : "0.0") + "% | " +
+    (total.since ? "since " + total.since.slice(0, 10) + " | as of " + total.asOf.slice(0, 16).replace("T", " ") + "Z" : "no recorded results"));
+  lines.push(personalKnown ?
+    "Personal MCP (partial): " + tokens(personalBytes) + " tok retained" :
+    "Personal MCP saved: unavailable (historical total not reported)");
+  lines.push("Est: bytes/4; provider tokens unknown");
+  return lines;
+}

package/bin/monitor.mjs

@@ -1,4 +1,5 @@
 import { lstat, open, readdir } from "node:fs/promises";
+import { lifetimeSavingsView, formatLifetimeSavings } from "./monitor-savings.mjs";
 import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { readAgentActivity } from "./monitor-agents.mjs";
@@ -99,7 +100,9 @@ export function monitorView(raw, now = Date.now(), alive = pidAlive) {
   });
   return { instanceId: raw.instanceId, pid: raw.pid, agentVersion: raw.agentVersion, updatedAt: raw.updatedAt,
     running, connection, origin, sessions, events, computer: raw.computer ?? null, processName: "lc-agent", executions,
-    efficiency: efficiencyView(raw.efficiency) };
+    efficiency: efficiencyView(raw.efficiency),
+    savingsSourceId: typeof raw.savingsSourceId === "string" && /^[a-f0-9]{64}$/.test(raw.savingsSourceId) ? raw.savingsSourceId : null,
+    lifetimeSavings: lifetimeSavingsView(raw.lifetimeSavings) };
 }
 
 export async function readMonitors(directory) {
@@ -247,9 +250,10 @@ export function formatMonitor(result, columns = process.stdout.columns ?? 120, h
   let shown = 0, shownPcs = 0, shownAgents = 0;
   const footer = [
     "-".repeat(width),
-    stats.length ? "Raw: " + tokens(saved + sent) + " tokens   Sent: " + tokens(sent) + "   Saved: " + tokens(saved) +
+    ...formatLifetimeSavings(result),
+    stats.length ? "Native this run - Raw: " + tokens(saved + sent) + " tokens   Sent: " + tokens(sent) + "   Saved: " + tokens(saved) +
       "  " + (saved + sent ? Math.round(100 * saved / (saved + sent)) : 0) + "%" + (stats.length < live.length ? " (partial)" : "") :
-      "Raw: n/a   Sent: n/a   Saved: n/a",
+      "Native this run - Raw: n/a   Sent: n/a   Saved: n/a",
     mcp.length ? "MCP this run: " + usageSummary(mcpMetrics) + " | saved stdout " + tokens(mcpMetrics.reduce((sum, row) => sum + row.savedBytes, 0)) + " tok" :
       "~ Tokens: bytes / 4, this run | model: declared or not reported",
     mcpMetrics.length ? "Review: " + [...mcpMetrics].sort((a, b) => b.sentBytes - a.sentBytes).slice(0, 2)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-commander-agent",
-  "version": "0.3.17-journal.1",
+  "version": "0.3.22-fullaccess.1",
   "description": "Windows companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
   "type": "module",
   "bin": {