local-commander-agent 0.3.3 → 0.3.4

package/runtime/agent.mjs

@@ -19,8 +19,8 @@ var __commonJS = (cb, mod) => function __require2() {
   }
 };
 var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -2121,9 +2121,9 @@ var require_extension = __commonJS({
   "node_modules/ws/lib/extension.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function push(dest, name, elem) {
-      if (dest[name] === void 0) dest[name] = [elem];
-      else dest[name].push(elem);
+    function push(dest, name2, elem) {
+      if (dest[name2] === void 0) dest[name2] = [elem];
+      else dest[name2].push(elem);
     }
     function parse3(header) {
       const offers = /* @__PURE__ */ Object.create(null);
@@ -2149,12 +2149,12 @@ var require_extension = __commonJS({
               throw new SyntaxError(`Unexpected character at index ${i}`);
             }
             if (end === -1) end = i;
-            const name = header.slice(start, end);
+            const name2 = header.slice(start, end);
             if (code === 44) {
-              push(offers, name, params);
+              push(offers, name2, params);
               params = /* @__PURE__ */ Object.create(null);
             } else {
-              extensionName = name;
+              extensionName = name2;
             }
             start = end = -1;
           } else {
@@ -2278,7 +2278,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash9 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash10 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2959,7 +2959,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest4 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest4) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3328,7 +3328,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash9 } = __require("crypto");
+    var { createHash: createHash10 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3635,7 +3635,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest4 = createHash9("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3723,7 +3723,7 @@ var require_websocket_server = __commonJS({
 });
 
 // agent/src/main.ts
-import path10 from "node:path";
+import path12 from "node:path";
 import os3 from "node:os";
 import { mkdir as mkdir5, open as open6, readFile as readFile5, rm as rm4 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
@@ -4674,10 +4674,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path11) {
-  if (!path11)
+function getElementAtPath(obj, path13) {
+  if (!path13)
     return obj;
-  return path11.reduce((acc, key) => acc?.[key], obj);
+  return path13.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4976,12 +4976,12 @@ function merge(a, b) {
   });
   return clone(a, def);
 }
-function partial(Class2, schema, mask, name = "partial") {
+function partial(Class2, schema, mask, name2 = "partial") {
   const currDef = schema._zod.def;
   const checks = currDef.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
-    throw new Error(`.${name}() cannot be used on object schemas containing refinements`);
+    throw new Error(`.${name2}() cannot be used on object schemas containing refinements`);
   }
   const selected = mask ? new Set(maskedKeys(schema, mask)) : void 0;
   const newShape = {};
@@ -5017,11 +5017,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path11, issues) {
+function prefixIssues(path13, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path11);
+    iss.path.unshift(path13);
     return iss;
   });
 }
@@ -5309,7 +5309,7 @@ function newError(Definition) {
   return new Definition();
 }
 // @__NO_SIDE_EFFECTS__
-function $constructor(name, initializer3, proto, params) {
+function $constructor(name2, initializer3, proto, params) {
   const zodProto = {};
   function Internals(def) {
     this.def = def;
@@ -5327,10 +5327,10 @@ function $constructor(name, initializer3, proto, params) {
       } finally {
         _zodDesc.value = void 0;
       }
-    } else if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name2)) {
       return;
     }
-    inst._zod.traits.add(name);
+    inst._zod.traits.add(name2);
     initializer3(inst, def);
     if (initialized) {
       const own2 = Object.getPrototypeOf(inst);
@@ -5356,7 +5356,7 @@ function $constructor(name, initializer3, proto, params) {
   const Parent = params?.Parent ?? Object;
   class Definition extends Parent {
   }
-  Object.defineProperty(Definition, "name", { value: name });
+  Object.defineProperty(Definition, "name", { value: name2 });
   function _(def) {
     const inst = params?.Parent ? newError(Definition) : this;
     init(inst, def);
@@ -5377,10 +5377,10 @@ function $constructor(name, initializer3, proto, params) {
     value: (inst) => {
       if (params?.Parent && inst instanceof params.Parent)
         return true;
-      return inst?._zod?.traits?.has(name);
+      return inst?._zod?.traits?.has(name2);
     }
   });
-  Object.defineProperty(_, "name", { value: name });
+  Object.defineProperty(_, "name", { value: name2 });
   return _;
 }
 var $brand = /* @__PURE__ */ Symbol("zod_brand");
@@ -5390,8 +5390,8 @@ var $ZodAsyncError = class extends Error {
   }
 };
 var $ZodEncodeError = class extends Error {
-  constructor(name) {
-    super(`Encountered unidirectional transform during encode: ${name}`);
+  constructor(name2) {
+    super(`Encountered unidirectional transform during encode: ${name2}`);
     this.name = "ZodEncodeError";
   }
 };
@@ -5471,16 +5471,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5519,17 +5519,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5568,8 +5568,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path11) {
+  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path13) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -16890,13 +16890,13 @@ ${code}
   return fn;
 }
 function addConstant(ctx, value) {
-  for (const [name2, v] of ctx.constants) {
+  for (const [name3, v] of ctx.constants) {
     if (v === value)
-      return name2;
+      return name3;
   }
-  const name = `c${ctx.constantCounter++}`;
-  ctx.constants.set(name, value);
-  return name;
+  const name2 = `c${ctx.constantCounter++}`;
+  ctx.constants.set(name2, value);
+  return name2;
 }
 function addUserConstant(ctx, fn) {
   ctx.definite = false;
@@ -22671,13 +22671,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path11 = ref.slice(1).split("/").filter(Boolean);
-  if (path11.length === 0) {
+  const path13 = ref.slice(1).split("/").filter(Boolean);
+  if (path13.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path11[0] === defsKey) {
-    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
+  if (path13[0] === defsKey) {
+    const key = path13[1] === void 0 ? void 0 : decodeJSONPointerSegment(path13[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23643,9 +23643,9 @@ function isDisjoint(...headers) {
       }
   return true;
 }
-function assertNotSet(value, name) {
+function assertNotSet(value, name2) {
   if (value !== void 0)
-    throw new TypeError(`${name} can only be called once`);
+    throw new TypeError(`${name2} can only be called once`);
 }
 function decodeBase64url(value, label, ErrorClass) {
   try {
@@ -23806,7 +23806,7 @@ function invalidKeyType(alg, actual, secret) {
   const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
   return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
 }
-var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+var unusable = (name2, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name2}`);
 function checkUsage(key, usage) {
   if (usage && !key.usages.includes(usage))
     throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
@@ -24547,9 +24547,9 @@ function guardAction(binding2, tool, config2, observedAt) {
   if (!binding2.accountId || binding2.tenantId !== config2.tenantId || binding2.deviceId !== config2.deviceId || !tool.effective) {
     throw Error("GUARD_IDENTITY_REQUIRED");
   }
-  const name = tool.call.name;
-  const kind = name === "command_run" ? "execute" : name === "localhost_request" ? "localhost-access" : name === "fs_write" || name === "fs_replace" ? "write" : name.startsWith("git_") ? "git-read" : "read";
-  const resourceKind = kind === "execute" ? "workspace" : kind === "localhost-access" ? "localhost-service" : kind === "git-read" ? "git-repository" : name === "fs_read" || kind === "write" ? "file" : "workspace";
+  const name2 = tool.call.name;
+  const kind = name2 === "command_run" ? "execute" : name2 === "localhost_request" ? "localhost-access" : name2 === "fs_write" || name2 === "fs_replace" ? "write" : name2.startsWith("git_") ? "git-read" : "read";
+  const resourceKind = kind === "execute" ? "workspace" : kind === "localhost-access" ? "localhost-service" : kind === "git-read" ? "git-repository" : name2 === "fs_read" || kind === "write" ? "file" : "workspace";
   return { payloadHash: guardHash(tool.effective), request: BoundActionRequestSchema.parse({
     protocolVersion: 1,
     requestId: binding2.executionId,
@@ -24569,13 +24569,13 @@ function guardAction(binding2, tool, config2, observedAt) {
       adapter: guardAdapter,
       actor: { kind: "human", subjectRef: binding2.accountId, authenticationClass: "delegated" },
       agent: { agentRef: "grant:" + binding2.grantId },
-      tool: { namespace: "local-commander", name },
+      tool: { namespace: "local-commander", name: name2 },
       resource: { kind: resourceKind, locatorFingerprint: guardHash({
         workspace: binding2.workspaceGrantId,
         resources: tool.claims,
-        ...name === "localhost_request" ? { url: tool.call.args.url } : {}
+        ...name2 === "localhost_request" ? { url: tool.call.args.url } : {}
       }) },
-      action: { kind, verb: name, effect: kind === "execute" ? "external-mutation" : kind === "write" ? "local-mutation" : kind === "localhost-access" ? "external-mutation" : "read-only" },
+      action: { kind, verb: name2, effect: kind === "execute" ? "external-mutation" : kind === "write" ? "local-mutation" : kind === "localhost-access" ? "external-mutation" : "read-only" },
       dataClassifications: ["unknown"],
       environment: config2.environment
     }
@@ -24585,7 +24585,7 @@ function guardSummary(tool) {
   if (!tool.effective) throw Error("GUARD_ACTION_INVALID");
   const call = tool.call;
   const args = { ...call.args };
-  if (args.headers) args.headers = Object.keys(args.headers).map((name) => name + " (value hidden)");
+  if (args.headers) args.headers = Object.keys(args.headers).map((name2) => name2 + " (value hidden)");
   return JSON.stringify({
     tool: call.name,
     resources: tool.claims,
@@ -24695,7 +24695,7 @@ function canonicalTime(value) {
 }
 function validateInput(value) {
   if (!value || typeof value !== "object" || Object.keys(value).some((k) => !bindingKeys.includes(k))) throw failure2("JOURNAL_INPUT_INVALID");
-  for (const name of bindingKeys.slice(0, 6)) if (typeof value[name] !== "string" || !uuid11.test(value[name])) throw failure2("JOURNAL_INPUT_INVALID");
+  for (const name2 of bindingKeys.slice(0, 6)) if (typeof value[name2] !== "string" || !uuid11.test(value[name2])) throw failure2("JOURNAL_INPUT_INVALID");
   if (value.accountId !== void 0 && !uuid11.test(value.accountId)) throw failure2("JOURNAL_INPUT_INVALID");
   if (typeof value.connectionEpoch !== "string" || !/^[1-9]\d{0,18}$/.test(value.connectionEpoch) || BigInt(value.connectionEpoch) > 9223372036854775807n || typeof value.payloadHash !== "string" || !hash4.test(value.payloadHash) || !canonicalTime(value.deadlineAt)) throw failure2("JOURNAL_INPUT_INVALID");
   if (value.workspaceGrantId === void 0 !== (value.policyVersion === void 0) || value.workspaceGrantId !== void 0 && (!uuid11.test(value.workspaceGrantId) || !Number.isInteger(value.policyVersion) || value.policyVersion < 1 || value.policyVersion > 2147483647)) throw failure2("JOURNAL_INPUT_INVALID");
@@ -24817,9 +24817,9 @@ var NativeJournal = class _NativeJournal {
   async load() {
     const names = await readdir(this.dir);
     if (names.length > this.options.maxEntries + 256) throw failure2("JOURNAL_CAPACITY_EXCEEDED");
-    for (const name of names) {
-      if (!name.endsWith(".entry")) continue;
-      const id = name.slice(0, -6);
+    for (const name2 of names) {
+      if (!name2.endsWith(".entry")) continue;
+      const id = name2.slice(0, -6);
       if (!uuid11.test(id)) throw failure2("JOURNAL_CORRUPT");
       const envelope = await this.readOwned(id);
       this.totalBytes += envelope.length;
@@ -25083,10 +25083,10 @@ var NativeJournal = class _NativeJournal {
 
 // agent/src/private-store.ts
 import { constants as constants2 } from "node:fs";
-import { lstat as lstat2, open as open3, readFile as readFile2, readdir as readdir2, realpath as realpath2, rename as rename2, rm as rm2, writeFile } from "node:fs/promises";
-import path3 from "node:path";
+import { lstat as lstat3, open as open3, readFile as readFile2, readdir as readdir2, realpath as realpath3, rename as rename2, rm as rm2, writeFile } from "node:fs/promises";
+import path5 from "node:path";
 import os from "node:os";
-import { createHash as createHash7, createPrivateKey, createPublicKey as createPublicKey3, generateKeyPairSync, randomBytes as randomBytes3, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash8, createPrivateKey, createPublicKey as createPublicKey3, generateKeyPairSync, randomBytes as randomBytes3, randomUUID as randomUUID3 } from "node:crypto";
 import { spawn } from "node:child_process";
 
 // src/child-environment.ts
@@ -25203,13 +25203,123 @@ function buildChildEnvironment(source, platform = process.platform) {
   return result2;
 }
 
+// agent/src/access-selection.ts
+import path3 from "node:path";
+function parseAccessSelection(value) {
+  const fail5 = () => {
+    throw Error("ACCESS_SELECTION_INVALID");
+  };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return fail5();
+  const input2 = value;
+  if (!Array.isArray(input2.paths)) return fail5();
+  if (input2.mode === "cancelled") {
+    if (input2.paths.length !== 0) return fail5();
+    return null;
+  }
+  if (input2.mode !== "folders" && input2.mode !== "all-drives") return fail5();
+  if (input2.paths.length < 1 || input2.paths.length > (input2.mode === "folders" ? 1 : 26)) return fail5();
+  const roots = [];
+  for (const candidate of input2.paths) {
+    if (typeof candidate !== "string" || candidate.length > 4096 || /[\u0000-\u001f]/.test(candidate) || !path3.win32.isAbsolute(candidate)) return fail5();
+    if (input2.mode === "all-drives" && !/^[a-z]:\\$/i.test(candidate)) return fail5();
+    const normalized = path3.win32.normalize(candidate).toLowerCase();
+    if (roots.some((root) => path3.win32.normalize(root).toLowerCase() === normalized)) return fail5();
+    roots.push(candidate);
+  }
+  return { mode: input2.mode, paths: roots };
+}
+
+// agent/src/owner-permissions.ts
+import { createHash as createHash4 } from "node:crypto";
+import { lstat as lstat2, realpath as realpath2 } from "node:fs/promises";
+import path4 from "node:path";
+var uuid12 = external_exports.string().uuid().toLowerCase();
+var name = external_exports.string().regex(/^[a-zA-Z0-9_.-]{1,64}$/).toLowerCase();
+var changeSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ workspaceGrantId: uuid12, kind: external_exports.literal("write"), enabled: external_exports.boolean() }).strict(),
+  external_exports.object({ workspaceGrantId: uuid12, kind: external_exports.literal("localhost"), enabled: external_exports.boolean(), port: external_exports.number().int().min(1).max(65535) }).strict(),
+  external_exports.object({ workspaceGrantId: uuid12, kind: external_exports.literal("command"), enabled: external_exports.boolean(), name, executable: external_exports.string().min(1).max(4096).optional() }).strict()
+]);
+var PERMISSION_HISTORY_LIMIT = 64;
+var PermissionHistorySchema = external_exports.array(external_exports.object({
+  id: uuid12,
+  changedAt: external_exports.string().datetime(),
+  workspaceGrantId: uuid12,
+  kind: external_exports.enum(["write", "command", "localhost"]),
+  enabled: external_exports.boolean(),
+  resourceHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  ownerSid: external_exports.string().max(184).regex(/^S-1-(?:[0-9]+-)+[0-9]+$/)
+}).strict()).max(PERMISSION_HISTORY_LIMIT);
+function permissionHash(value) {
+  return createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function invalid2(code = "PERMISSION_INVALID") {
+  throw Object.assign(new Error(code), { code });
+}
+function parsePermissionChange(value) {
+  const parsed = changeSchema.safeParse(value);
+  if (!parsed.success) invalid2();
+  const change = parsed.data;
+  if (change.kind === "command" && (change.enabled ? !change.executable : change.executable !== void 0)) invalid2();
+  return change;
+}
+function equalPath(a, b) {
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function permissionLabel(value) {
+  return JSON.stringify(value).replace(
+    /[\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/gu,
+    (ch) => "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0")
+  );
+}
+function nonAsciiNotice(value) {
+  if (!value || !/[^\x20-\x7e]/.test(value)) return "";
+  return "\nWarning: this path contains non-ASCII characters: " + value.replace(/[^\x20-\x7e]/g, (ch) => "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0"));
+}
+async function planPermissionChange(current2, programs, input2) {
+  const change = parsePermissionChange(input2);
+  if (current2.workspaceGrantId !== change.workspaceGrantId) invalid2("WORKSPACE_UNKNOWN");
+  const workspace = structuredClone(current2), nextPrograms = { ...programs };
+  let resource = { rootHash: workspace.rootHash, kind: change.kind };
+  let detail;
+  if (change.kind === "write") {
+    workspace.permissions.writeFiles = change.enabled;
+    detail = "File writes: " + (change.enabled ? "ALLOW" : "DENY");
+  } else if (change.kind === "localhost") {
+    workspace.localhostPorts = change.enabled ? [.../* @__PURE__ */ new Set([...workspace.localhostPorts, change.port])].sort((a, b) => a - b) : workspace.localhostPorts.filter((port) => port !== change.port);
+    if (workspace.localhostPorts.length > 32) invalid2("PERMISSION_LIMIT");
+    workspace.permissions.localhost = workspace.localhostPorts.length > 0;
+    resource = { rootHash: workspace.rootHash, kind: change.kind, port: change.port };
+    detail = "Localhost port " + change.port + ": " + (change.enabled ? "ALLOW" : "DENY");
+  } else {
+    let executableIdentity = null;
+    if (change.enabled) {
+      const executable = change.executable;
+      if (!path4.isAbsolute(executable) || path4.extname(executable).toLowerCase() !== ".exe" || /[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/u.test(executable)) invalid2();
+      const stat = await lstat2(executable).catch(() => invalid2());
+      const canonical2 = await realpath2(executable).catch(() => invalid2());
+      if (!stat.isFile() || stat.isSymbolicLink() || !equalPath(path4.resolve(executable), canonical2)) invalid2();
+      if (Object.hasOwn(nextPrograms, change.name) && !equalPath(nextPrograms[change.name], canonical2)) invalid2("COMMAND_CONFLICT");
+      nextPrograms[change.name] = canonical2;
+      workspace.allowedCommands = [.../* @__PURE__ */ new Set([...workspace.allowedCommands, change.name])].sort();
+      if (workspace.allowedCommands.length > 32 || Object.keys(nextPrograms).length > 32) invalid2("PERMISSION_LIMIT");
+      executableIdentity = { executable: canonical2, dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
+    } else workspace.allowedCommands = workspace.allowedCommands.filter((value) => value !== change.name);
+    workspace.permissions.executeCommands = workspace.allowedCommands.length > 0;
+    resource = { rootHash: workspace.rootHash, kind: change.kind, name: change.name, executable: nextPrograms[change.name] ?? null, executableIdentity };
+    detail = "Command " + permissionLabel(change.name) + ": " + (change.enabled ? "ALLOW" : "DENY") + "\nExact executable: " + permissionLabel(nextPrograms[change.name] ?? "not registered") + nonAsciiNotice(nextPrograms[change.name]) + "\nA permitted program can access resources available to your Windows account, including outside this folder. This is not an OS sandbox.";
+  }
+  const summary = "Change Local Commander permissions\nWorkspace: " + permissionLabel(current2.displayName) + "\nWorkspace ID: " + current2.workspaceGrantId + "\nFolder: " + permissionLabel(current2.root) + "\n\n" + detail + "\n\nThis change persists until you revoke it. Other workspaces are not granted this permission.\nReview before approving. Closing this window, rejecting or timing out changes nothing.\nA running agent may restart after the change; running work can be interrupted. Revocation does not undo completed effects.";
+  return { workspace, programs: nextPrograms, change, summary, resourceHash: permissionHash(resource) };
+}
+
 // packages/policy/src/signed-bundle.ts
-import { createHash as createHash5, KeyObject as KeyObject2 } from "node:crypto";
+import { createHash as createHash6, KeyObject as KeyObject2 } from "node:crypto";
 
 // packages/policy/src/evaluator.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-var uuid12 = external_exports.string().uuid().toLowerCase();
+var uuid13 = external_exports.string().uuid().toLowerCase();
 var slug2 = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/);
 var utc = external_exports.iso.datetime({ offset: false });
 var risk = external_exports.enum(["low", "moderate", "high", "critical"]);
@@ -25234,7 +25344,7 @@ var PolicyRuleSchema = external_exports.object({
   }
 });
 var PolicySnapshotSchema = external_exports.object({
-  tenantId: uuid12,
+  tenantId: uuid13,
   policyId: slug2,
   policyVersion: external_exports.string().trim().min(1).max(64),
   issuedAt: utc,
@@ -25264,7 +25374,7 @@ function matches(rule, request, requestRisk) {
   return (!rule.actionKinds || rule.actionKinds.includes(action.kind)) && (!rule.toolNamespaces || rule.toolNamespaces.includes(tool.namespace)) && (!rule.environments || rule.environments.includes(environment.environment)) && (!rule.anyDataClassifications || rule.anyDataClassifications.some((value) => dataClassifications.includes(value))) && (!rule.resourceKinds || rule.resourceKinds.includes(resource.kind)) && (!rule.resourceFingerprints || rule.resourceFingerprints.includes(resource.locatorFingerprint)) && (!rule.riskClasses || rule.riskClasses.includes(requestRisk));
 }
 function decisionId(requestId, policyId, policyVersion, ruleId) {
-  const bytes3 = createHash4("sha256").update(JSON.stringify([requestId, policyId, policyVersion, ruleId])).digest().subarray(0, 16);
+  const bytes3 = createHash5("sha256").update(JSON.stringify([requestId, policyId, policyVersion, ruleId])).digest().subarray(0, 16);
   bytes3[6] = bytes3[6] & 15 | 64;
   bytes3[8] = bytes3[8] & 63 | 128;
   const hex3 = bytes3.toString("hex");
@@ -25333,7 +25443,7 @@ async function verifySignedPolicyBundle(candidate, authority, checkpointInput, n
     if (payload.byteLength > 256 * 1024) throw new Error();
     const bundle = BundleSchema.parse(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payload)));
     const { snapshot: snapshot2 } = bundle;
-    const payloadSha256 = createHash5("sha256").update(payload).digest("hex");
+    const payloadSha256 = createHash6("sha256").update(payload).digest("hex");
     if (snapshot2.tenantId !== expected.tenantId || snapshot2.policyId !== expected.policyId || at < Date.parse(snapshot2.issuedAt) || at >= Date.parse(snapshot2.expiresAt) || bundle.sequence < checkpoint.sequence || bundle.sequence === checkpoint.sequence && payloadSha256 !== checkpoint.payloadSha256) throw new Error();
     return { snapshot: snapshot2, checkpoint: {
       ...expected,
@@ -25347,15 +25457,15 @@ async function verifySignedPolicyBundle(candidate, authority, checkpointInput, n
 }
 
 // packages/policy/src/approvals.ts
-import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
-var uuid13 = TrustedActionBindingSchema.shape.tenantId;
+import { createHash as createHash7, randomUUID as randomUUID2 } from "node:crypto";
+var uuid14 = TrustedActionBindingSchema.shape.tenantId;
 var utc3 = TrustedActionBindingSchema.shape.expiresAt;
 var digest3 = ResourceRefSchema.shape.locatorFingerprint;
 var requirement = PolicyDecisionSchema.shape.approval.unwrap();
 var ApprovalActionSchema = external_exports.object({ request: BoundActionRequestSchema, payloadHash: digest3 }).strict();
 var ApprovalAuthoritySchema = external_exports.object({
-  tenantId: uuid13,
-  accountId: uuid13,
+  tenantId: uuid14,
+  accountId: uuid14,
   approvalClass: requirement.shape.approvalClass,
   authenticatedAt: utc3,
   expiresAt: utc3
@@ -25367,11 +25477,11 @@ var ContextSchema = external_exports.object({
   policyExpiresAt: utc3
 }).strict();
 var GrantSchema = external_exports.object({
-  approvalId: uuid13,
-  requestId: uuid13,
-  decisionId: uuid13,
+  approvalId: uuid14,
+  requestId: uuid14,
+  decisionId: uuid14,
   bindingHash: digest3,
-  approverAccountId: uuid13,
+  approverAccountId: uuid14,
   approvalClass: requirement.shape.approvalClass,
   scope: requirement.shape.scope,
   issuedAt: utc3,
@@ -25380,8 +25490,8 @@ var GrantSchema = external_exports.object({
   uses: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
 }).strict().refine((value) => Date.parse(value.issuedAt) < Date.parse(value.expiresAt) && (value.scope === "once" ? value.uses === (value.state === "consumed" ? 1 : 0) : value.state !== "consumed"));
 var ApprovalLedgerSchema = external_exports.object({
-  tenantId: uuid13,
-  deviceId: uuid13,
+  tenantId: uuid14,
+  deviceId: uuid14,
   lastChangedAt: utc3,
   grants: external_exports.array(GrantSchema).max(128)
 }).strict().refine((value) => new Set(value.grants.map((grant) => grant.approvalId)).size === value.grants.length && new Set(value.grants.map((grant) => grant.requestId)).size === value.grants.length && value.grants.every((grant) => Date.parse(grant.issuedAt) <= Date.parse(value.lastChangedAt)));
@@ -25402,7 +25512,7 @@ function binding(ledger, input2, now) {
     approval.expiresAt ? Date.parse(approval.expiresAt) : Infinity
   );
   if (at >= deadline) throw Error();
-  const bindingHash = createHash6("sha256").update(JSON.stringify([
+  const bindingHash = createHash7("sha256").update(JSON.stringify([
     owner.bindingSource,
     owner.tenantId,
     owner.accountId,
@@ -25458,7 +25568,7 @@ function issueApproval(ledgerInput, context, authorityInput, now, expiresAt) {
 }
 function consumeApproval(ledgerInput, context, approvalId, now) {
   try {
-    const ledger = current(ledgerInput, now), bound = binding(ledger, context, now), id = uuid13.parse(approvalId);
+    const ledger = current(ledgerInput, now), bound = binding(ledger, context, now), id = uuid14.parse(approvalId);
     const grant = ledger.grants.find((candidate) => candidate.approvalId === id);
     if (!grant || grant.state !== "active" || grant.bindingHash !== bound.bindingHash || grant.uses === Number.MAX_SAFE_INTEGER || Date.parse(now) < Date.parse(grant.issuedAt) || grant.scope === "once" && (grant.requestId !== bound.request.requestId || grant.decisionId !== bound.decision.decisionId)) throw Error();
     const consumed = { ...grant, uses: grant.uses + 1, state: grant.scope === "once" ? "consumed" : "active" };
@@ -25469,7 +25579,7 @@ function consumeApproval(ledgerInput, context, approvalId, now) {
 }
 function revokeApproval(ledgerInput, approvalId, now) {
   try {
-    const ledger = current(ledgerInput, now), id = uuid13.parse(approvalId);
+    const ledger = current(ledgerInput, now), id = uuid14.parse(approvalId);
     return { ...ledger, grants: ledger.grants.map((grant) => grant.approvalId === id && grant.state === "active" ? { ...grant, state: "revoked" } : grant) };
   } catch {
     throw Error("APPROVAL_INVALID");
@@ -25484,12 +25594,12 @@ var MAX_STATE_BYTES = 256 * 1024;
 function fail(code) {
   return Object.assign(new Error(code), { code });
 }
-function equalPath(a, b) {
-  return path3.resolve(a).toLowerCase() === path3.resolve(b).toLowerCase();
+function equalPath2(a, b) {
+  return path5.resolve(a).toLowerCase() === path5.resolve(b).toLowerCase();
 }
 function under(child, parent) {
-  const rel = path3.relative(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !path3.isAbsolute(rel);
+  const rel = path5.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path5.isAbsolute(rel);
 }
 function canonicalPublicKey(value) {
   try {
@@ -25501,7 +25611,7 @@ function canonicalPublicKey(value) {
   }
 }
 function fingerprint(publicKeyPem) {
-  return createHash7("sha256").update(canonicalPublicKey(publicKeyPem).der).digest("hex");
+  return createHash8("sha256").update(canonicalPublicKey(publicKeyPem).der).digest("hex");
 }
 function publicFromPrivate(privateKeyPem) {
   try {
@@ -25560,55 +25670,57 @@ function validateState(value) {
   }
   const approvals = value.approvals === void 0 ? void 0 : ApprovalLedgerSchema.safeParse(value.approvals);
   if (approvals && (!approvals.success || approvals.data.tenantId !== enrollment?.tenantId || approvals.data.deviceId !== enrollment.deviceId)) throw fail("STATE_CORRUPT");
+  const permissionHistory = PermissionHistorySchema.safeParse(value.permissionHistory ?? []);
+  if (!permissionHistory.success) throw fail("STATE_CORRUPT");
   const workspaces = value.workspaces ?? [];
   const programs = value.programs ?? {};
   const pendingWorkspaceRevokes = value.pendingWorkspaceRevokes ?? [];
   if (!Array.isArray(pendingWorkspaceRevokes) || pendingWorkspaceRevokes.length > 32 || pendingWorkspaceRevokes.some((id) => typeof id !== "string" || !UUID.test(id) || id !== id.toLowerCase()) || new Set(pendingWorkspaceRevokes).size !== pendingWorkspaceRevokes.length) throw fail("STATE_CORRUPT");
-  if (!programs || typeof programs !== "object" || Array.isArray(programs) || Object.keys(programs).length > 32 || Object.entries(programs).some(([name, executable]) => !/^[a-z0-9_.-]{1,64}$/.test(name) || typeof executable !== "string" || !path3.isAbsolute(executable) || executable.length > 4096 || /[\u0000-\u001f]/.test(executable))) throw fail("STATE_CORRUPT");
-  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path3.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name) => typeof name !== "string" || !Object.hasOwn(programs, name)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== w.allowedCommands.length > 0 || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== w.localhostPorts.length > 0)) throw fail("STATE_CORRUPT");
+  if (!programs || typeof programs !== "object" || Array.isArray(programs) || Object.keys(programs).length > 32 || Object.entries(programs).some(([name2, executable]) => !/^[a-z0-9_.-]{1,64}$/.test(name2) || typeof executable !== "string" || !path5.isAbsolute(executable) || executable.length > 4096 || /[\u0000-\u001f]/.test(executable))) throw fail("STATE_CORRUPT");
+  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path5.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name2) => typeof name2 !== "string" || !Object.hasOwn(programs, name2)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== w.allowedCommands.length > 0 || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== w.localhostPorts.length > 0)) throw fail("STATE_CORRUPT");
   if (new Set(workspaces.map((w) => w.workspaceGrantId)).size !== workspaces.length || new Set(workspaces.map((w) => w.rootHash)).size !== workspaces.length) throw fail("STATE_CORRUPT");
   if (workspaces.some((w) => pendingWorkspaceRevokes.includes(w.workspaceGrantId))) throw fail("STATE_CORRUPT");
-  return { version: 1, publicKeyPem: value.publicKeyPem, privateKeyPem: value.privateKeyPem, fingerprint: value.fingerprint, dataKey: value.dataKey, ...enrollment ? { enrollment } : {}, workspaces, programs, pendingWorkspaceRevokes, ...policyBundle ? { policyBundle } : {}, ...approvals?.success ? { approvals: approvals.data } : {}, ...value.guardRequired ? { guardRequired: true } : {}, ...guard ? { guard } : {} };
+  return { version: 1, publicKeyPem: value.publicKeyPem, privateKeyPem: value.privateKeyPem, fingerprint: value.fingerprint, dataKey: value.dataKey, ...enrollment ? { enrollment } : {}, workspaces, programs, pendingWorkspaceRevokes, ...value.permissionHistory ? { permissionHistory: permissionHistory.data } : {}, ...policyBundle ? { policyBundle } : {}, ...approvals?.success ? { approvals: approvals.data } : {}, ...value.guardRequired ? { guardRequired: true } : {}, ...guard ? { guard } : {} };
 }
 async function noSymlinkChain(target) {
-  if (!path3.isAbsolute(target)) throw fail("STORE_DIRECTORY_INVALID");
-  const absolute2 = path3.resolve(target);
-  if (absolute2 === path3.parse(absolute2).root) throw fail("STORE_DIRECTORY_INVALID");
+  if (!path5.isAbsolute(target)) throw fail("STORE_DIRECTORY_INVALID");
+  const absolute2 = path5.resolve(target);
+  if (absolute2 === path5.parse(absolute2).root) throw fail("STORE_DIRECTORY_INVALID");
   const missing = [];
   let cursor = absolute2;
   for (; ; ) {
     try {
-      const stat = await lstat2(cursor);
+      const stat = await lstat3(cursor);
       if (stat.isSymbolicLink()) throw fail("STORE_DIRECTORY_INVALID");
       break;
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
       missing.push(cursor);
-      const parent = path3.dirname(cursor);
+      const parent = path5.dirname(cursor);
       if (parent === cursor) throw fail("STORE_DIRECTORY_INVALID");
       cursor = parent;
     }
   }
-  const canonicalParent = await realpath2(cursor);
-  if (!equalPath(cursor, canonicalParent)) throw fail("STORE_DIRECTORY_INVALID");
+  const canonicalParent = await realpath3(cursor);
+  if (!equalPath2(cursor, canonicalParent)) throw fail("STORE_DIRECTORY_INVALID");
   return absolute2;
 }
 function allowedDirectory(absolute2) {
-  const localAppData = process.env.LOCALAPPDATA || path3.join(os.homedir(), "AppData", "Local");
-  const appRoot = path3.resolve(localAppData, "LocalCommander");
-  const tempRoot = path3.resolve(os.tmpdir());
+  const localAppData = process.env.LOCALAPPDATA || path5.join(os.homedir(), "AppData", "Local");
+  const appRoot = path5.resolve(localAppData, "LocalCommander");
+  const tempRoot = path5.resolve(os.tmpdir());
   if (under(absolute2, appRoot)) return;
-  if (under(absolute2, tempRoot) && /^lc-private-[A-Za-z0-9_.-]+$/i.test(path3.basename(absolute2))) return;
+  if (under(absolute2, tempRoot) && /^lc-private-[A-Za-z0-9_.-]+$/i.test(path5.basename(absolute2))) return;
   throw fail("STORE_DIRECTORY_POLICY");
 }
 async function canonicalBridge(value) {
-  if (typeof value !== "string" || !path3.isAbsolute(value) || path3.extname(value).toLowerCase() !== ".exe") throw fail("BRIDGE_INVALID");
-  const stat = await lstat2(value).catch(() => {
+  if (typeof value !== "string" || !path5.isAbsolute(value) || path5.extname(value).toLowerCase() !== ".exe") throw fail("BRIDGE_INVALID");
+  const stat = await lstat3(value).catch(() => {
     throw fail("BRIDGE_INVALID");
   });
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 1 || stat.size > 4 * 1024 * 1024) throw fail("BRIDGE_INVALID");
-  const canonical2 = await realpath2(value);
-  if (!equalPath(value, canonical2)) throw fail("BRIDGE_INVALID");
+  const canonical2 = await realpath3(value);
+  if (!equalPath2(value, canonical2)) throw fail("BRIDGE_INVALID");
   return canonical2;
 }
 function parseBridgeData(value, max = MAX_STATE_BYTES * 4) {
@@ -25640,11 +25752,11 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     }
     const approved = /* @__PURE__ */ new Set([MARKER, "owner-state.dat", "owner-state.lock", "journal"]);
     if (names.length && !names.includes(MARKER)) throw fail("STORE_DIRECTORY_UNKNOWN");
-    if (names.some((name) => !approved.has(name))) throw fail("STORE_DIRECTORY_UNKNOWN");
+    if (names.some((name2) => !approved.has(name2))) throw fail("STORE_DIRECTORY_UNKNOWN");
     await _WindowsPrivateStore.invoke(bridge, "init-directory", { path: absolute2 }, 5e3, false);
-    const canonical2 = await realpath2(absolute2);
-    if (!equalPath(absolute2, canonical2) || (await lstat2(canonical2)).isSymbolicLink()) throw fail("STORE_DIRECTORY_INVALID");
-    const markerPath = path3.join(canonical2, MARKER);
+    const canonical2 = await realpath3(absolute2);
+    if (!equalPath2(absolute2, canonical2) || (await lstat3(canonical2)).isSymbolicLink()) throw fail("STORE_DIRECTORY_INVALID");
+    const markerPath = path5.join(canonical2, MARKER);
     try {
       await writeFile(markerPath, "LocalCommander private state\n", { flag: "wx", mode: 384 });
     } catch (error62) {
@@ -25659,10 +25771,10 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     return result2;
   }
   statePath() {
-    return path3.join(this.dir, "owner-state.dat");
+    return path5.join(this.dir, "owner-state.dat");
   }
   lockPath() {
-    return path3.join(this.dir, "owner-state.lock");
+    return path5.join(this.dir, "owner-state.lock");
   }
   static invoke(bridge, arg, body, timeoutMs2, interactive, signal) {
     return new Promise((resolve, reject) => {
@@ -25757,9 +25869,21 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       }
     }
   }
+  /** After an owner approval, a briefly busy lock (the running agent) must not discard the decision. */
+  async withLockWait(fn, waitMs) {
+    const deadline = Date.now() + waitMs;
+    for (; ; ) {
+      try {
+        return await this.withLock(fn);
+      } catch (error62) {
+        if (error62.code !== "STORE_LOCKED" || Date.now() >= deadline) throw error62;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    }
+  }
   async readState() {
     try {
-      const stat = await lstat2(this.statePath());
+      const stat = await lstat3(this.statePath());
       if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 1 || stat.size > MAX_STATE_BYTES * 4) throw fail("STATE_CORRUPT");
       const encrypted = await readFile2(this.statePath());
       const plaintext = await this.unprotect(encrypted);
@@ -25773,9 +25897,9 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
   }
   async rawHash() {
     try {
-      const stat = await lstat2(this.statePath());
+      const stat = await lstat3(this.statePath());
       if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_STATE_BYTES * 4) throw fail("STATE_CORRUPT");
-      return createHash7("sha256").update(await readFile2(this.statePath())).digest("hex");
+      return createHash8("sha256").update(await readFile2(this.statePath())).digest("hex");
     } catch (error62) {
       if (error62.code === "ENOENT") return null;
       throw error62;
@@ -25786,7 +25910,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     const plaintext = Buffer.from(JSON.stringify(validateState(state)), "utf8");
     if (plaintext.length > MAX_STATE_BYTES) throw fail("STATE_TOO_LARGE");
     const encrypted = await this.protect(plaintext);
-    const temp = path3.join(this.dir, "owner-state." + randomBytes3(8).toString("hex") + ".tmp");
+    const temp = path5.join(this.dir, "owner-state." + randomBytes3(8).toString("hex") + ".tmp");
     const handle = await open3(temp, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
     let closed = false;
     try {
@@ -25838,6 +25962,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
         state.workspaces = [];
         state.programs = {};
         state.pendingWorkspaceRevokes = [];
+        delete state.permissionHistory;
       }
       state.enrollment = next;
       await this.writeState(state, before);
@@ -25855,6 +25980,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       state.workspaces = [];
       state.programs = {};
       state.pendingWorkspaceRevokes = [];
+      delete state.permissionHistory;
       await this.writeState(state, before);
     }));
   }
@@ -25974,7 +26100,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       "guard-review",
       { data: Buffer.from(summary).toString("base64") },
       timeoutMs2,
-      false,
+      true,
       signal
     );
     if (typeof answer?.approved !== "boolean" || typeof answer.ownerSid !== "string" || !/^S-1-(?:[0-9]+-)+[0-9]+$/.test(answer.ownerSid)) throw fail("GUARD_REVIEW_INVALID");
@@ -26016,7 +26142,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     });
   }
   loadPrograms() {
-    return this.run(async () => Object.fromEntries(Object.entries((await this.readState())?.programs ?? {}).map(([name, executable]) => [name, { executable }])));
+    return this.run(async () => Object.fromEntries(Object.entries((await this.readState())?.programs ?? {}).map(([name2, executable]) => [name2, { executable }])));
   }
   loadPendingWorkspaceRevokes() {
     return this.run(async () => [...(await this.readState())?.pendingWorkspaceRevokes ?? []]);
@@ -26036,7 +26162,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       const before = await this.rawHash();
       state.workspaces = state.workspaces.filter((w) => w.workspaceGrantId !== id);
       state.pendingWorkspaceRevokes = [...state.pendingWorkspaceRevokes ?? [], id];
-      for (const name of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name))) delete state.programs[name];
+      for (const name2 of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
       await this.writeState(state, before);
     }));
   }
@@ -26049,51 +26175,112 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       await this.writeState(state, before);
     }));
   }
-  setWorkspacePermissions(change) {
-    return this.run(() => this.withLock(async () => {
-      const state = await this.readState();
+  async setWorkspacePermissions(change) {
+    const request = parsePermissionChange(change);
+    const context = (state) => {
       if (!state?.enrollment) throw fail("ENROLLMENT_REQUIRED");
-      if (typeof change.workspaceGrantId !== "string" || !UUID.test(change.workspaceGrantId) || typeof change.enabled !== "boolean") throw fail("PERMISSION_INVALID");
-      const current2 = state.workspaces?.find((w) => w.workspaceGrantId === change.workspaceGrantId.toLowerCase());
-      if (!current2) throw fail("WORKSPACE_UNKNOWN");
-      const workspace = structuredClone(current2), programs = { ...state.programs ?? {} };
-      if (change.kind === "write") workspace.permissions.writeFiles = change.enabled;
-      else if (change.kind === "localhost") {
-        if (!Number.isInteger(change.port) || change.port < 1 || change.port > 65535) throw fail("PERMISSION_INVALID");
-        workspace.localhostPorts = change.enabled ? [.../* @__PURE__ */ new Set([...workspace.localhostPorts, change.port])].sort((a, b) => a - b) : workspace.localhostPorts.filter((port) => port !== change.port);
-        workspace.permissions.localhost = workspace.localhostPorts.length > 0;
-      } else if (change.kind === "command") {
-        const name = change.name?.toLowerCase();
-        if (!name || !/^[a-z0-9_.-]{1,64}$/.test(name)) throw fail("PERMISSION_INVALID");
-        if (change.enabled) {
-          const executable = change.executable;
-          if (typeof executable !== "string" || !path3.isAbsolute(executable) || path3.extname(executable).toLowerCase() !== ".exe" || executable.length > 4096 || /[\u0000-\u001f]/.test(executable)) throw fail("PERMISSION_INVALID");
-          const stat = await lstat2(executable).catch(() => {
-            throw fail("PERMISSION_INVALID");
-          });
-          if (!stat.isFile() || stat.isSymbolicLink() || !equalPath(executable, await realpath2(executable))) throw fail("PERMISSION_INVALID");
-          if (Object.hasOwn(programs, name) && !equalPath(programs[name], executable)) throw fail("COMMAND_CONFLICT");
-          programs[name] = executable;
-          workspace.allowedCommands = [.../* @__PURE__ */ new Set([...workspace.allowedCommands, name])].sort();
-        } else workspace.allowedCommands = workspace.allowedCommands.filter((value) => value !== name);
-        workspace.permissions.executeCommands = workspace.allowedCommands.length > 0;
-      } else throw fail("PERMISSION_INVALID");
-      state.workspaces = state.workspaces.map((w) => w.workspaceGrantId === workspace.workspaceGrantId ? workspace : w);
-      for (const name of Object.keys(programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name))) delete programs[name];
-      state.programs = programs;
+      const workspace = state.workspaces?.find((w) => w.workspaceGrantId === request.workspaceGrantId);
+      if (!workspace) throw fail("WORKSPACE_UNKNOWN");
+      const programs = state.programs ?? {};
+      return { workspace, programs, enrollment: state.enrollment, fingerprint: permissionHash({
+        enrollment: state.enrollment,
+        workspace,
+        programs: Object.entries(programs).sort(([a], [b]) => a.localeCompare(b)),
+        guard: state.guard ?? null,
+        guardRequired: state.guardRequired ?? false
+      }) };
+    };
+    const initial = await this.run(async () => context(await this.readState()));
+    const proposal = await planPermissionChange(initial.workspace, initial.programs, request);
+    const review = await this.reviewGuard("Account: " + permissionLabel(initial.enrollment.accountEmail) + "\n" + proposal.summary, void 0, 6e4);
+    if (!review.approved) throw fail("PERMISSION_REJECTED");
+    return this.run(() => this.withLockWait(async () => {
+      const state = await this.readState();
+      const current2 = context(state);
+      if (current2.fingerprint !== initial.fingerprint) throw fail("PERMISSION_STATE_CHANGED");
+      if (state.guard && state.guard.ownerSid !== review.ownerSid) throw fail("PERMISSION_OWNER_MISMATCH");
+      const verified = await planPermissionChange(current2.workspace, current2.programs, request);
+      if (verified.resourceHash !== proposal.resourceHash) throw fail("PERMISSION_STATE_CHANGED");
       const before = await this.rawHash();
+      state.workspaces = state.workspaces.map((w) => w.workspaceGrantId === verified.workspace.workspaceGrantId ? verified.workspace : w);
+      state.programs = verified.programs;
+      for (const name2 of Object.keys(state.programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
+      const record2 = {
+        id: randomUUID3(),
+        changedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        workspaceGrantId: request.workspaceGrantId,
+        kind: request.kind,
+        enabled: request.enabled,
+        resourceHash: verified.resourceHash,
+        ownerSid: review.ownerSid
+      };
+      state.permissionHistory = PermissionHistorySchema.parse([...state.permissionHistory ?? [], record2].slice(-PERMISSION_HISTORY_LIMIT));
       await this.writeState(state, before);
-      return workspace;
+      return structuredClone(verified.workspace);
+    }, 5e3));
+  }
+  /** Replace scope only after an explicit local dialog; updates never call this implicitly. */
+  async configureAccess() {
+    const expected = await this.run(() => this.withLock(async () => {
+      if (!(await this.readState())?.enrollment) throw fail("ENROLLMENT_REQUIRED");
+      return this.rawHash();
     }));
+    const decision = await this.chooseAccess();
+    if (decision === null) return null;
+    const selected = parseAccessSelection(decision);
+    if (!selected) return null;
+    const roots = [];
+    for (const chosen of selected.paths) {
+      const stat = await lstat3(chosen);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw fail("WORKSPACE_INVALID");
+      const root = await realpath3(chosen);
+      const isDrive = equalPath2(root, path5.parse(root).root);
+      if (!equalPath2(root, chosen) || (selected.mode === "all-drives" ? !isDrive : isDrive) || equalPath2(root, this.dir) || under(root, this.dir) || selected.mode === "folders" && under(this.dir, root)) throw fail("WORKSPACE_INVALID");
+      roots.push(root);
+    }
+    return this.run(() => this.withLock(async () => {
+      if (await this.rawHash() !== expected) throw fail("STATE_CHANGED");
+      const state = await this.readState();
+      if (!state?.enrollment) throw fail("ENROLLMENT_REQUIRED");
+      const workspaces = roots.map((root) => {
+        const rootHash = createHash8("sha256").update(process.platform === "win32" ? root.toLowerCase() : root).digest("hex");
+        const existing = state.workspaces?.find((w) => w.rootHash === rootHash);
+        return {
+          workspaceGrantId: existing?.workspaceGrantId ?? randomUUID3(),
+          root,
+          rootHash,
+          displayName: (path5.basename(root) || root).slice(0, 120),
+          policyVersion: 1,
+          permissions: { readFiles: true, writeFiles: true, executeCommands: false, localhost: false },
+          allowedCommands: [],
+          localhostPorts: []
+        };
+      });
+      const retained = new Set(workspaces.map((w) => w.workspaceGrantId));
+      const removed = (state.workspaces ?? []).filter((w) => !retained.has(w.workspaceGrantId)).map((w) => w.workspaceGrantId);
+      const pending = [.../* @__PURE__ */ new Set([...state.pendingWorkspaceRevokes ?? [], ...removed])];
+      if (pending.length > 32) throw fail("WORKSPACE_REVOKE_LIMIT");
+      state.workspaces = workspaces;
+      state.programs = {};
+      state.pendingWorkspaceRevokes = pending;
+      await this.writeState(state, expected);
+      return structuredClone(workspaces);
+    }));
+  }
+  chooseAccess() {
+    return this.run(async () => parseAccessSelection(await _WindowsPrivateStore.invoke(this.bridge, "choose-access", {}, 24e4, true)));
+  }
+  loadPermissionHistory() {
+    return this.run(async () => structuredClone((await this.readState())?.permissionHistory ?? []));
   }
   async approveWorkspace() {
     const chosen = await this.chooseFolder();
     if (chosen === null) return null;
-    const stat = await lstat2(chosen);
+    const stat = await lstat3(chosen);
     if (!stat.isDirectory() || stat.isSymbolicLink()) throw fail("WORKSPACE_INVALID");
-    const root = await realpath2(chosen);
-    if (!equalPath(root, chosen) || equalPath(root, path3.parse(root).root) || equalPath(root, this.dir) || under(this.dir, root)) throw fail("WORKSPACE_INVALID");
-    const rootHash = createHash7("sha256").update(process.platform === "win32" ? root.toLowerCase() : root).digest("hex");
+    const root = await realpath3(chosen);
+    if (!equalPath2(root, chosen) || equalPath2(root, path5.parse(root).root) || equalPath2(root, this.dir) || under(this.dir, root)) throw fail("WORKSPACE_INVALID");
+    const rootHash = createHash8("sha256").update(process.platform === "win32" ? root.toLowerCase() : root).digest("hex");
     return this.run(() => this.withLock(async () => {
       const state = await this.readState();
       if (!state?.enrollment) throw fail("ENROLLMENT_REQUIRED");
@@ -26101,7 +26288,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       if (existing) return existing;
       if ((state.workspaces?.length ?? 0) >= 32) throw fail("WORKSPACE_LIMIT");
       const before = await this.rawHash();
-      const workspace = { workspaceGrantId: randomUUID3(), root, rootHash, displayName: path3.basename(root).slice(0, 120), policyVersion: 1, permissions: { readFiles: true, writeFiles: false, executeCommands: false, localhost: false }, allowedCommands: [], localhostPorts: [] };
+      const workspace = { workspaceGrantId: randomUUID3(), root, rootHash, displayName: path5.basename(root).slice(0, 120), policyVersion: 1, permissions: { readFiles: true, writeFiles: true, executeCommands: false, localhost: false }, allowedCommands: [], localhostPorts: [] };
       state.workspaces = [...state.workspaces ?? [], workspace];
       await this.writeState(state, before);
       return workspace;
@@ -26111,7 +26298,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     return this.run(async () => {
       const result2 = await _WindowsPrivateStore.invoke(this.bridge, "choose-folder", {}, 12e4, true);
       if (result2.path === null) return null;
-      if (typeof result2.path !== "string" || !path3.isAbsolute(result2.path) || result2.path.length > 4096 || /[\u0000-\u001f]/.test(result2.path)) throw fail("BRIDGE_OUTPUT_INVALID");
+      if (typeof result2.path !== "string" || !path5.isAbsolute(result2.path) || result2.path.length > 4096 || /[\u0000-\u001f]/.test(result2.path)) throw fail("BRIDGE_OUTPUT_INVALID");
       return result2.path;
     });
   }
@@ -26119,22 +26306,40 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
 
 // agent/src/tools.ts
 import { constants as constants3 } from "node:fs";
-import { lstat as lstat4, open as open4, readdir as readdir3, realpath as realpath4, rename as rename3, rm as rm3 } from "node:fs/promises";
-import path7 from "node:path";
-import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
+import { lstat as lstat5, open as open4, readdir as readdir3, realpath as realpath5, rename as rename3, rm as rm3 } from "node:fs/promises";
+import path9 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/guard.ts
-import { lstat as lstat3, realpath as realpath3 } from "node:fs/promises";
-import path4 from "node:path";
+import { lstat as lstat4, realpath as realpath4 } from "node:fs/promises";
+import path6 from "node:path";
 var SENSITIVE_NAMES = /* @__PURE__ */ new Set([
   ".npmrc",
   ".pypirc",
   ".git-credentials",
   "id_rsa",
   "id_ed25519",
-  "credentials.json"
+  "id_ecdsa",
+  "id_dsa",
+  ".netrc",
+  "_netrc",
+  ".pgpass",
+  "credentials.json",
+  "application_default_credentials.json"
 ]);
-var SENSITIVE_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".p12", ".pfx"]);
+var SENSITIVE_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".p12", ".pfx", ".ppk", ".kdbx"]);
+var SENSITIVE_IN_DIRECTORY = [
+  [".aws", "credentials"],
+  [".kube", "config"],
+  [".docker", "config.json"],
+  [".claude", ".credentials.json"],
+  [".codex", "auth.json"],
+  [".azure", "msal_token_cache.json"],
+  [".azure", "accesstokens.json"],
+  ["gh", "hosts.yml"],
+  ["github cli", "hosts.yml"]
+];
+var SENSITIVE_DIRECTORIES = /* @__PURE__ */ new Set([".ssh", ".gnupg"]);
 var PROTECTED_FILE_NAMES = /* @__PURE__ */ new Set([
   ".local-commander-oauth.json",
   "local-commander.config.json"
@@ -26144,12 +26349,12 @@ function comparePath(value) {
   return process.platform === "win32" ? value.toLowerCase() : value;
 }
 function isInside(root, candidate) {
-  const relative = path4.relative(root, candidate);
-  return relative === "" || !path4.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path4.sep}`);
+  const relative = path6.relative(root, candidate);
+  return relative === "" || !path6.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path6.sep}`);
 }
 function splitPathSegments(filePath) {
-  const parsed = path4.parse(path4.resolve(filePath));
-  return path4.relative(parsed.root, path4.resolve(filePath)).split(path4.sep).filter((segment) => segment.length > 0);
+  const parsed = path6.parse(path6.resolve(filePath));
+  return path6.relative(parsed.root, path6.resolve(filePath)).split(path6.sep).filter((segment) => segment.length > 0);
 }
 function isProtectedAuditFile(base) {
   return base === ".local-commander-audit.jsonl" || base.startsWith(".local-commander-audit.jsonl.");
@@ -26164,37 +26369,40 @@ function looksProtected(filePath) {
   return false;
 }
 function looksSensitive(filePath) {
-  const base = path4.basename(filePath).toLowerCase();
+  const base = path6.basename(filePath).toLowerCase();
   if (base === ".env" || base.startsWith(".env.") && base !== ".env.example") return true;
   if (SENSITIVE_NAMES.has(base)) return true;
-  if (SENSITIVE_EXTENSIONS.has(path4.extname(base))) return true;
-  return false;
+  if (SENSITIVE_EXTENSIONS.has(path6.extname(base))) return true;
+  const segments = splitPathSegments(filePath).map((segment) => segment.toLowerCase());
+  if (segments.slice(0, -1).some((segment) => SENSITIVE_DIRECTORIES.has(segment))) return true;
+  const parent = segments.at(-2);
+  return SENSITIVE_IN_DIRECTORY.some(([directory, name2]) => directory === parent && name2 === base);
 }
 async function canonicalizePossiblyMissing(inputPath, base) {
-  const absolute2 = path4.isAbsolute(inputPath) ? path4.resolve(inputPath) : path4.resolve(base, inputPath);
-  const parsed = path4.parse(absolute2);
+  const absolute2 = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
+  const parsed = path6.parse(absolute2);
   let current2 = absolute2;
   const missing = [];
   while (current2 !== parsed.root) {
     try {
-      const resolved = await realpath3(current2);
-      return path4.join(resolved, ...missing.reverse());
+      const resolved = await realpath4(current2);
+      return path6.join(resolved, ...missing.reverse());
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
       let exists = false;
       try {
-        await lstat3(current2);
+        await lstat4(current2);
         exists = true;
       } catch (statError) {
         if (statError.code !== "ENOENT") throw statError;
       }
       if (exists) throw error62;
-      missing.push(path4.basename(current2));
-      current2 = path4.dirname(current2);
+      missing.push(path6.basename(current2));
+      current2 = path6.dirname(current2);
     }
   }
-  const root = await realpath3(parsed.root);
-  return path4.join(root, ...missing.reverse());
+  const root = await realpath4(parsed.root);
+  return path6.join(root, ...missing.reverse());
 }
 var PathGuard = class _PathGuard {
   constructor(roots, allowSensitiveFiles, protectedPaths) {
@@ -26210,11 +26418,11 @@ var PathGuard = class _PathGuard {
     for (const root of roots) {
       let resolved;
       try {
-        resolved = await realpath3(path4.resolve(root));
+        resolved = await realpath4(path6.resolve(root));
       } catch {
         throw new Error(`Configured root does not exist: ${root}`);
       }
-      const stat = await lstat3(resolved);
+      const stat = await lstat4(resolved);
       if (!stat.isDirectory()) throw new Error(`Configured root is not a directory: ${root}`);
       if (!canonical2.some((existing) => comparePath(existing) === comparePath(resolved))) {
         canonical2.push(resolved);
@@ -26223,8 +26431,8 @@ var PathGuard = class _PathGuard {
     if (canonical2.length === 0) throw new Error("At least one allowed root is required");
     const protectedPaths = [];
     for (const protectedPath of options.protectedPaths ?? []) {
-      const base = path4.isAbsolute(protectedPath) ? path4.parse(path4.resolve(protectedPath)).root : canonical2[0];
-      const absolute2 = path4.resolve(base, protectedPath);
+      const base = path6.isAbsolute(protectedPath) ? path6.parse(path6.resolve(protectedPath)).root : canonical2[0];
+      const absolute2 = path6.resolve(base, protectedPath);
       if (!protectedPaths.some((existing) => comparePath(existing) === comparePath(absolute2))) protectedPaths.push(absolute2);
       const resolved = await canonicalizePossiblyMissing(protectedPath, base);
       if (!protectedPaths.some((existing) => comparePath(existing) === comparePath(resolved))) {
@@ -26240,7 +26448,7 @@ var PathGuard = class _PathGuard {
   }
   assertNotProtected(candidate) {
     if (looksProtected(candidate)) {
-      throw new Error(`Local Commander protected state is blocked: ${path4.basename(candidate)}`);
+      throw new Error(`Local Commander protected state is blocked: ${path6.basename(candidate)}`);
     }
     const normalizedCandidate = comparePath(candidate);
     for (const protectedPath of this.protectedPaths) {
@@ -26253,37 +26461,37 @@ var PathGuard = class _PathGuard {
     this.assertNotProtected(filePath);
     if (!this.allowSensitiveFiles && looksSensitive(filePath)) {
       throw new Error(
-        `Sensitive file access is blocked by default: ${path4.basename(filePath)}. Enable files.allowSensitiveFiles only if you really need it.`
+        `Sensitive file access is blocked by default: ${path6.basename(filePath)}. Enable files.allowSensitiveFiles only if you really need it.`
       );
     }
   }
   async resolveExisting(inputPath, cwd) {
     const base = cwd ? await this.resolveExisting(cwd) : this.roots[0];
-    const candidate = path4.isAbsolute(inputPath) ? path4.resolve(inputPath) : path4.resolve(base, inputPath);
+    const candidate = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
     this.assertNotProtected(candidate);
-    const resolved = await realpath3(candidate);
+    const resolved = await realpath4(candidate);
     this.assertWithinRoots(resolved);
     this.assertNotProtected(resolved);
     return resolved;
   }
   async resolveDirectory(inputPath, cwd) {
     const resolved = await this.resolveExisting(inputPath, cwd);
-    const stat = await lstat3(resolved);
+    const stat = await lstat4(resolved);
     if (!stat.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
     return resolved;
   }
   async resolveForWrite(inputPath, cwd) {
     const base = cwd ? await this.resolveDirectory(cwd) : this.roots[0];
-    const candidate = path4.isAbsolute(inputPath) ? path4.resolve(inputPath) : path4.resolve(base, inputPath);
+    const candidate = path6.isAbsolute(inputPath) ? path6.resolve(inputPath) : path6.resolve(base, inputPath);
     this.assertNotProtected(candidate);
     let existing;
     try {
-      existing = await realpath3(candidate);
+      existing = await realpath4(candidate);
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
       let exists = false;
       try {
-        await lstat3(candidate);
+        await lstat4(candidate);
         exists = true;
       } catch (statError) {
         if (statError.code !== "ENOENT") throw statError;
@@ -26296,11 +26504,11 @@ var PathGuard = class _PathGuard {
       this.assertSafeFile(existing);
       return existing;
     }
-    const parent = await realpath3(path4.dirname(candidate));
+    const parent = await realpath4(path6.dirname(candidate));
     this.assertWithinRoots(parent);
     this.assertNotProtected(parent);
     this.assertSafeFile(candidate);
-    const target = path4.join(parent, path4.basename(candidate));
+    const target = path6.join(parent, path6.basename(candidate));
     this.assertSafeFile(target);
     return target;
   }
@@ -26311,12 +26519,12 @@ var PathGuard = class _PathGuard {
 
 // src/windows-file-read.ts
 import { execFile } from "node:child_process";
-import path5 from "node:path";
+import path7 from "node:path";
 function readWindowsFile(bridge, file2, maxBytes, signal) {
   return invokeRead(bridge, file2, maxBytes, false, signal);
 }
 function invokeRead(bridge, file2, maxBytes, prefix, signal) {
-  if (process.platform !== "win32" || !path5.isAbsolute(bridge) || !path5.isAbsolute(file2) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
+  if (process.platform !== "win32" || !path7.isAbsolute(bridge) || !path7.isAbsolute(file2) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
     return Promise.reject(new Error("FILE_READ_ARGUMENT_INVALID"));
   }
   if (signal?.aborted) return Promise.reject(new Error("CANCELLED"));
@@ -26345,9 +26553,9 @@ function invokeRead(bridge, file2, maxBytes, prefix, signal) {
 
 // agent/src/job-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import path6 from "node:path";
+import path8 from "node:path";
 function absolute(value) {
-  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path6.isAbsolute(value) && path6.resolve(value) === value;
+  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path8.isAbsolute(value) && path8.resolve(value) === value;
 }
 async function runSupervised(helper, request, options = {}) {
   if (process.platform !== "win32") throw Error("WINDOWS_SUPERVISOR_REQUIRED");
@@ -26363,7 +26571,7 @@ async function runSupervised(helper, request, options = {}) {
     let pid = null, outcome = null;
     let buffer = "", failure5 = null, closed = false, cancelSent = false;
     let killTimer, hardTimer;
-    const child = spawn2(helper, [], { cwd: path6.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
+    const child = spawn2(helper, [], { cwd: path8.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
     const cancel = () => {
       if (closed || cancelSent) return;
       cancelSent = true;
@@ -26465,9 +26673,9 @@ function fail2(code) {
   throw new NativeToolError(code);
 }
 function hash5(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
-function equalPath2(a, b) {
+function equalPath3(a, b) {
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
 function result(body) {
@@ -26479,7 +26687,7 @@ function stopped(signal) {
   if (signal.aborted) fail2("CANCELLED");
 }
 async function readBoundedFile(file2, maxBytes, bridge, signal) {
-  const stat = await lstat4(file2);
+  const stat = await lstat5(file2);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes) fail2("FILE_UNSUPPORTED_OR_TOO_LARGE");
   if (process.platform === "win32") return readWindowsFile(bridge, file2, maxBytes, signal);
   const handle = await open4(file2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
@@ -26517,7 +26725,7 @@ var NativeTools = class {
   options;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path7.join(path7.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path9.join(path9.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail2(error62.message);
@@ -26540,9 +26748,19 @@ var NativeTools = class {
     if (scope2 === "files:read" && !permission.readFiles || scope2 === "files:write" && !permission.writeFiles || scope2 === "commands:execute" && !permission.executeCommands || scope2 === "localhost:access" && !permission.localhost) fail2("LOCAL_PERMISSION_REQUIRED");
     let guard;
     try {
-      const canonical2 = await realpath4(workspace.root);
-      if (!equalPath2(canonical2, workspace.root) || hash5(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace.rootHash) fail2("WORKSPACE_CHANGED");
-      guard = await PathGuard.create([canonical2], false, { protectedPaths: [this.options.stateDirectory] });
+      const canonical2 = await realpath5(workspace.root);
+      if (!equalPath3(canonical2, workspace.root) || hash5(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace.rootHash) fail2("WORKSPACE_CHANGED");
+      const runtimeDirectory = path9.dirname(this.options.helperPath);
+      const protectedPaths = [
+        this.options.stateDirectory,
+        this.options.helperPath,
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path9.join(runtimeDirectory, name2))
+      ];
+      if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path9.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path9.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      }
+      guard = await PathGuard.create([canonical2], false, { protectedPaths });
     } catch (e) {
       if (e instanceof NativeToolError) throw e;
       fail2("WORKSPACE_UNAVAILABLE");
@@ -26568,11 +26786,11 @@ var NativeTools = class {
       return { call, claims: readClaim(filename), run: async (signal) => {
         stopped(signal);
         const verified = await resolve(call.args.path);
-        if (!equalPath2(verified, filename)) fail2("FILE_CHANGED");
+        if (!equalPath3(verified, filename)) fail2("FILE_CHANGED");
         const bytes3 = await this.readFile(filename, 1048576, signal), contents = utf8(bytes3), lines = contents.split(/\r?\n/);
         const selected = lines.slice(first - 1, Math.min(last, lines.length)).join("\n");
         if (Buffer.byteLength(selected) > 12e4) fail2("OUTPUT_LIMIT_EXCEEDED");
-        return result({ path: path7.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
+        return result({ path: path9.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -26587,7 +26805,7 @@ var NativeTools = class {
       return { call, claims: writeClaim(filename), run: async (signal) => {
         stopped(signal);
         const target = await guard.resolveForWrite(args.path);
-        if (!equalPath2(filename, target)) fail2("FILE_CHANGED");
+        if (!equalPath3(filename, target)) fail2("FILE_CHANGED");
         let old = null;
         try {
           old = await this.readFile(target, 1048576, signal);
@@ -26608,7 +26826,7 @@ var NativeTools = class {
         }
         const bytes3 = Buffer.from(contents, "utf8");
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail2("FILE_WRITE_LIMIT");
-        const temp = path7.join(path7.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
+        const temp = path9.join(path9.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
         const handle = await open4(temp, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
@@ -26616,7 +26834,7 @@ var NativeTools = class {
           await handle.close();
           stopped(signal);
           const again = await guard.resolveForWrite(args.path);
-          if (!equalPath2(target, again)) fail2("FILE_CHANGED");
+          if (!equalPath3(target, again)) fail2("FILE_CHANGED");
           if (old) {
             if (hash5(await this.readFile(target, 1048576, signal)) !== hash5(old)) fail2("FILE_CHANGED");
             await rename3(temp, target);
@@ -26625,7 +26843,7 @@ var NativeTools = class {
             await link(temp, target);
             await rm3(temp);
           }
-          return result({ path: path7.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path9.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
@@ -26646,12 +26864,12 @@ var NativeTools = class {
           stopped(signal);
           if (matches2.length >= call.args.maxResults || scanned >= 300) break;
           try {
-            const filename = await guard.resolveExisting(path7.join(base, entry.path));
+            const filename = await guard.resolveExisting(path9.join(base, entry.path));
             guard.assertSafeFile(filename);
             const data = utf8(await this.readFile(filename, 256e3, signal));
             scanned++;
             const lines = data.split(/\r?\n/);
-            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path7.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
+            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path9.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
           } catch (error62) {
             if (error62 instanceof NativeToolError && ["FILE_READ_FAILED", "CANCELLED"].includes(error62.code)) throw error62;
           }
@@ -26663,9 +26881,9 @@ var NativeTools = class {
       const url2 = new URL(call.args.url), port = Number(url2.port || (url2.protocol === "https:" ? 443 : 80));
       if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || !workspace.localhostPorts.includes(port) || this.options.protectedPorts?.includes(port)) fail2("LOCALHOST_NOT_ALLOWED");
       const headers = {};
-      for (const [name, value] of Object.entries(call.args.headers ?? {})) {
-        if (!/^[A-Za-z0-9-]+$/.test(name) || /[\r\n]/.test(value) || ["host", "connection", "content-length", "transfer-encoding", "upgrade", "proxy-authorization", "proxy-connection"].includes(name.toLowerCase()) || Object.keys(headers).some((k) => k.toLowerCase() === name.toLowerCase())) fail2("INVALID_HTTP_HEADER");
-        headers[name] = value;
+      for (const [name2, value] of Object.entries(call.args.headers ?? {})) {
+        if (!/^[A-Za-z0-9-]+$/.test(name2) || /[\r\n]/.test(value) || ["host", "connection", "content-length", "transfer-encoding", "upgrade", "proxy-authorization", "proxy-connection"].includes(name2.toLowerCase()) || Object.keys(headers).some((k) => k.toLowerCase() === name2.toLowerCase())) fail2("INVALID_HTTP_HEADER");
+        headers[name2] = value;
       }
       if (Object.keys(headers).length > 32 || ["GET", "HEAD"].includes(call.args.method) && call.args.body !== void 0) fail2("INVALID_HTTP_ARGUMENTS");
       if (url2.hostname === "localhost") url2.hostname = "127.0.0.1";
@@ -26673,9 +26891,9 @@ var NativeTools = class {
         const combined = AbortSignal.any([signal, AbortSignal.timeout(1e4)]);
         const response = await fetch(url2, { method: call.args.method, headers, body: call.args.body, redirect: "manual", signal: combined });
         const selectedHeaders = {};
-        for (const name of ["content-type", "content-length", "location", "etag", "last-modified"]) {
-          const value = response.headers.get(name);
-          if (value) selectedHeaders[name] = value.slice(0, 2048);
+        for (const name2 of ["content-type", "content-length", "location", "etag", "last-modified"]) {
+          const value = response.headers.get(name2);
+          if (value) selectedHeaders[name2] = value.slice(0, 2048);
         }
         const reader = response.body?.getReader(), chunks = [];
         let count = 0, truncated = false;
@@ -26720,9 +26938,9 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path7.resolve(cwd, call.args.file));
-        const relative = path7.relative(cwd, file2);
-        if (relative.startsWith(".." + path7.sep) || relative === ".." || path7.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path9.resolve(cwd, call.args.file));
+        const relative = path9.relative(cwd, file2);
+        if (relative.startsWith(".." + path9.sep) || relative === ".." || path9.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail2("TOOL_MISSING");
@@ -26733,9 +26951,9 @@ var NativeTools = class {
         const listing = await this.list(guard, cwd, 1, 150, signal);
         let packageInfo = null;
         try {
-          const name = await guard.resolveExisting(path7.join(cwd, "package.json"));
-          guard.assertSafeFile(name);
-          const value = JSON.parse(utf8(await this.readFile(name, 64e3, signal)));
+          const name2 = await guard.resolveExisting(path9.join(cwd, "package.json"));
+          guard.assertSafeFile(name2);
+          const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
         } catch (error62) {
           if (error62 instanceof NativeToolError && ["FILE_READ_FAILED", "CANCELLED"].includes(error62.code)) throw error62;
@@ -26749,14 +26967,14 @@ var NativeTools = class {
       return { ...output2, resultCode: r.exitCode === 0 ? "SUCCESS" : "GIT_FAILED" };
     } };
   }
-  resolveProgram(name, workspace) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name.toLowerCase() || path7.isAbsolute(name) && equalPath2(value.executable, path7.resolve(name)));
-    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path7.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
+  resolveProgram(name2, workspace) {
+    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path9.isAbsolute(name2) && equalPath3(value.executable, path9.resolve(name2)));
+    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path9.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
     return { executable: entry[1].executable, prefixArgs: [...entry[1].prefixArgs ?? []] };
   }
   gitExecution(cwd, args) {
     const program = this.options.programs.git;
-    if (!program || !path7.isAbsolute(program.executable)) fail2("GIT_NOT_INSTALLED");
+    if (!program || !path9.isAbsolute(program.executable)) fail2("GIT_NOT_INSTALLED");
     return { executable: program.executable, args: ["--no-pager", "--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=" + (process.platform === "win32" ? "NUL" : "/dev/null"), "-c", "diff.external=", ...args], cwd };
   }
   async list(guard, root, depth, maxEntries, signal) {
@@ -26774,7 +26992,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path7.join(current2.path, item.name);
+        const candidate = path9.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -26782,13 +27000,13 @@ var NativeTools = class {
         } catch {
           continue;
         }
-        if (!equalPath2(candidate, resolved)) continue;
+        if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path7.relative(root, resolved), type: "directory" });
+          entries.push({ path: path9.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
-          const stat = await lstat4(resolved);
-          entries.push({ path: path7.relative(root, resolved), type: "file", size: stat.size });
+          const stat = await lstat5(resolved);
+          entries.push({ path: path9.relative(root, resolved), type: "file", size: stat.size });
         }
       }
       if (truncated) break;
@@ -26798,49 +27016,49 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace.root)) {
-      const dotGit = path7.join(directory, ".git");
+      const dotGit = path9.join(directory, ".git");
       try {
-        const stat = await lstat4(dotGit);
+        const stat = await lstat5(dotGit);
         if (stat.isSymbolicLink()) fail2("GIT_METADATA_CHANGED");
         let gitDir;
-        if (stat.isDirectory()) gitDir = await realpath4(dotGit);
+        if (stat.isDirectory()) gitDir = await realpath5(dotGit);
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail2("GIT_METADATA_CHANGED");
-          gitDir = await realpath4(path7.resolve(directory, content.slice(8)));
+          gitDir = await realpath5(path9.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace.root) && (!workspace.gitCommonDir || !guard.isWithin(gitDir, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path7.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path9.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail2("GIT_METADATA_CHANGED");
-          common = await realpath4(path7.resolve(gitDir, content));
+          common = await realpath5(path9.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
-        if (!(await lstat4(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail2("GIT_METADATA_CHANGED");
-        if (!guard.isWithin(common, workspace.root) && (!workspace.gitCommonDir || !equalPath2(common, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
+        if (!(await lstat5(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail2("GIT_METADATA_CHANGED");
+        if (!guard.isWithin(common, workspace.root) && (!workspace.gitCommonDir || !equalPath3(common, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         return common;
       } catch (e) {
         if (e.code !== "ENOENT") throw e;
       }
-      if (equalPath2(directory, workspace.root)) break;
-      directory = path7.dirname(directory);
+      if (equalPath3(directory, workspace.root)) break;
+      directory = path9.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path8 from "node:path";
+import path10 from "node:path";
 import os2 from "node:os";
 function canonical(value) {
-  const p = path8.resolve(value);
+  const p = path10.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path8.relative(a, b);
-  return relative === "" || !path8.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path8.sep);
+  const relative = path10.relative(a, b);
+  return relative === "" || !path10.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path10.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -26860,7 +27078,7 @@ var NativeScheduler = class {
   schedule(id, claims, deadlineAt, run, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id || id.length > 100 || this.active.has(id) || this.waiting.some((j) => j.id === id)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path8.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path10.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
@@ -27320,17 +27538,17 @@ function unshapedResultTelemetry(result2) {
 
 // packages/optimization/src/live-telemetry.ts
 var LIVE_EFFICIENCY_EVENT_VERSION = 1;
-var uuid14 = external_exports.string().uuid().toLowerCase();
+var uuid15 = external_exports.string().uuid().toLowerCase();
 var bytes2 = external_exports.number().int().min(0).max(1e9);
 var utc4 = external_exports.iso.datetime({ offset: false });
 var LiveEfficiencyEventSchema = external_exports.object({
   version: external_exports.literal(LIVE_EFFICIENCY_EVENT_VERSION),
   occurredAt: utc4,
-  tenantId: uuid14,
-  accountId: uuid14.nullable(),
-  sessionId: uuid14,
-  operationId: uuid14,
-  executionId: uuid14,
+  tenantId: uuid15,
+  accountId: uuid15.nullable(),
+  sessionId: uuid15,
+  operationId: uuid15,
+  executionId: uuid15,
   toolName: external_exports.string().trim().min(1).max(120),
   outcome: external_exports.enum(["success", "failed", "timed_out", "cancelled", "unknown"]),
   parserId: external_exports.string().trim().min(1).max(120).nullable(),
@@ -27812,10 +28030,10 @@ var NativeRelayBridge = class {
       const { binding: binding2, tool } = parsed2.data;
       this.binding(request, binding2);
       const prepared = await this.wait(this.execution, binding2.executionId, request, () => this.runtime.receive({ type: "prepare", version: 1, binding: binding2, tool }));
-      if (prepared.type === "not_accepted") return { accepted: false, provedNotStarted: prepared.provedNotStarted };
+      if (prepared.type === "not_accepted") return { accepted: false, provedNotStarted: prepared.provedNotStarted, code: prepared.code };
       if (prepared.type !== "prepared") throw failure3("INFRA_UNAVAILABLE");
       const accepted = await this.wait(this.execution, binding2.executionId, request, () => this.runtime.receive({ type: "execute", version: 1, binding: binding2 }));
-      if (accepted.type === "not_accepted") return { accepted: false, provedNotStarted: accepted.provedNotStarted };
+      if (accepted.type === "not_accepted") return { accepted: false, provedNotStarted: accepted.provedNotStarted, code: accepted.code };
       if (accepted.type !== "accepted") throw failure3("INFRA_UNAVAILABLE");
       return { accepted: true };
     }
@@ -27878,7 +28096,7 @@ function relayUrlFromEnrollment(enrollment) {
   url2.pathname = "/api/agent/relay";
   return url2.toString();
 }
-function uuid15(value, code) {
+function uuid16(value, code) {
   if (typeof value !== "string" || !UUID2.test(value)) fail3(code);
   return value.toLowerCase();
 }
@@ -28008,37 +28226,37 @@ function sendJson(socket, value, maxBytes) {
 function validateChallenge(frame, expectedProtocol) {
   if (frame.type !== "challenge") fail3("RELAY_HANDSHAKE_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  uuid15(frame.gatewayId, "RELAY_HANDSHAKE_INVALID");
+  uuid16(frame.gatewayId, "RELAY_HANDSHAKE_INVALID");
   if (typeof frame.nonce !== "string" || frame.nonce.length < 32 || frame.nonce.length > 512 || /[\u0000-\u001f\u007f]/u.test(frame.nonce)) fail3("RELAY_HANDSHAKE_INVALID");
   if (typeof frame.expiresAt !== "string" || !Number.isFinite(Date.parse(frame.expiresAt)) || Date.parse(frame.expiresAt) <= Date.now()) fail3("RELAY_HANDSHAKE_INVALID");
   return {
-    challengeId: uuid15(frame.challengeId, "RELAY_HANDSHAKE_INVALID"),
+    challengeId: uuid16(frame.challengeId, "RELAY_HANDSHAKE_INVALID"),
     nonce: frame.nonce
   };
 }
 function validateReady(frame, enrollment, expectedProtocol) {
   if (frame.type !== "connected") fail3("RELAY_HANDSHAKE_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  if (uuid15(frame.tenantId, "RELAY_HANDSHAKE_INVALID") !== enrollment.tenantId.toLowerCase()) fail3("RELAY_ID_MISMATCH");
-  if (uuid15(frame.deviceId, "RELAY_HANDSHAKE_INVALID") !== enrollment.deviceId.toLowerCase()) fail3("RELAY_ID_MISMATCH");
+  if (uuid16(frame.tenantId, "RELAY_HANDSHAKE_INVALID") !== enrollment.tenantId.toLowerCase()) fail3("RELAY_ID_MISMATCH");
+  if (uuid16(frame.deviceId, "RELAY_HANDSHAKE_INVALID") !== enrollment.deviceId.toLowerCase()) fail3("RELAY_ID_MISMATCH");
   return epoch2(frame.connectionEpoch);
 }
 function validateRequest(frame, enrollment, expectedProtocol, connectionEpoch) {
   if (frame.type !== "relayFrame") fail3("RELAY_REQUEST_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  const tenantId = uuid15(frame.tenantId, "RELAY_REQUEST_INVALID");
-  const deviceId = uuid15(frame.deviceId, "RELAY_REQUEST_INVALID");
+  const tenantId = uuid16(frame.tenantId, "RELAY_REQUEST_INVALID");
+  const deviceId = uuid16(frame.deviceId, "RELAY_REQUEST_INVALID");
   if (tenantId !== enrollment.tenantId.toLowerCase() || deviceId !== enrollment.deviceId.toLowerCase()) fail3("RELAY_ID_MISMATCH");
   if (epoch2(frame.connectionEpoch) !== connectionEpoch) fail3("RELAY_EPOCH_MISMATCH");
   const kind = frame.kind;
   if (typeof kind !== "string" || !REQUEST_KINDS.has(kind)) fail3("RELAY_REQUEST_INVALID");
   return {
-    requestId: uuid15(frame.requestId, "RELAY_REQUEST_INVALID"),
+    requestId: uuid16(frame.requestId, "RELAY_REQUEST_INVALID"),
     tenantId,
     deviceId,
     connectionEpoch,
-    operationId: uuid15(frame.operationId, "RELAY_REQUEST_INVALID"),
-    executionId: uuid15(frame.executionId, "RELAY_REQUEST_INVALID"),
+    operationId: uuid16(frame.operationId, "RELAY_REQUEST_INVALID"),
+    executionId: uuid16(frame.executionId, "RELAY_REQUEST_INVALID"),
     kind,
     payload: frame.payload,
     deadlineAt: isoDate(frame.deadlineAt)
@@ -28078,8 +28296,8 @@ async function connectOnce(options) {
   const identity = await options.store.load();
   if (!identity || !identity.enrollment) fail3("ENROLLMENT_MISSING");
   const enrollment = identity.enrollment;
-  const tenantId = uuid15(enrollment.tenantId, "ENROLLMENT_INVALID");
-  const deviceId = uuid15(enrollment.deviceId, "ENROLLMENT_INVALID");
+  const tenantId = uuid16(enrollment.tenantId, "ENROLLMENT_INVALID");
+  const deviceId = uuid16(enrollment.deviceId, "ENROLLMENT_INVALID");
   const url2 = relayUrlFromEnrollment(enrollment);
   const socket = new wrapper_default(url2, [], {
     followRedirects: false,
@@ -28299,10 +28517,10 @@ function canonicalOrigin2(value) {
     fail4("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path11) {
-  return origin + path11;
+function endpoint(origin, path13) {
+  return origin + path13;
 }
-function uuid16(value, code) {
+function uuid17(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail4(code);
   return value.toLowerCase();
 }
@@ -28422,7 +28640,7 @@ var PairingClient = class {
       publicKey: identity.publicKeyPem,
       agentVersion: this.version
     }));
-    const pairingId = uuid16(response.pairingId, "PAIRING_RESPONSE_INVALID");
+    const pairingId = uuid17(response.pairingId, "PAIRING_RESPONSE_INVALID");
     const expiresAt = parseDate(response.expiresAt, "PAIRING_RESPONSE_INVALID");
     const now = this.nowMs();
     if (expiresAt.getTime() <= now || expiresAt.getTime() - now > 30 * 6e4) fail4("PAIRING_RESPONSE_INVALID");
@@ -28456,9 +28674,9 @@ var PairingClient = class {
   }
   async completeOnce(beginResult, approved, displayNameValue) {
     const pairing = this.validateBeginResult(beginResult);
-    const tenantId = uuid16(approved.tenantId, "PAIRING_RESPONSE_INVALID");
+    const tenantId = uuid17(approved.tenantId, "PAIRING_RESPONSE_INVALID");
     const email3 = accountEmail(approved.accountEmail);
-    const name = displayName(displayNameValue);
+    const name2 = displayName(displayNameValue);
     const identity = await this.currentIdentity();
     const keyFingerprint = fingerprint2(identity.fingerprint);
     if (keyFingerprint !== pairing.keyFingerprint) fail4("IDENTITY_CHANGED");
@@ -28467,18 +28685,18 @@ var PairingClient = class {
     const response = assertJsonObject(await this.request(endpoint(this.origin, "/api/agent/pairings/" + pairing.pairingId + "/complete"), {
       pairingSecret: pairing.pairingSecret,
       signature,
-      displayName: name,
+      displayName: name2,
       agentVersion: this.version
     }));
-    const completedTenant = uuid16(response.tenantId, "PAIRING_RESPONSE_INVALID");
+    const completedTenant = uuid17(response.tenantId, "PAIRING_RESPONSE_INVALID");
     if (completedTenant !== tenantId) fail4("PAIRING_RESPONSE_INVALID");
-    const deviceId = uuid16(response.deviceId, "PAIRING_RESPONSE_INVALID");
+    const deviceId = uuid17(response.deviceId, "PAIRING_RESPONSE_INVALID");
     const enrollment = {
       tenantId,
       deviceId,
       serverOrigin: this.origin,
       accountEmail: email3,
-      ...response.accountId !== void 0 ? { accountId: uuid16(response.accountId, "PAIRING_RESPONSE_INVALID") } : {}
+      ...response.accountId !== void 0 ? { accountId: uuid17(response.accountId, "PAIRING_RESPONSE_INVALID") } : {}
     };
     await this.store.saveEnrollment(enrollment);
     return { ...enrollment };
@@ -28492,7 +28710,7 @@ var PairingClient = class {
       state: response.state,
       expiresAt: parseDate(response.expiresAt, "PAIRING_RESPONSE_INVALID")
     };
-    if (response.tenantId !== void 0) result2.tenantId = uuid16(response.tenantId, "PAIRING_RESPONSE_INVALID");
+    if (response.tenantId !== void 0) result2.tenantId = uuid17(response.tenantId, "PAIRING_RESPONSE_INVALID");
     if (response.accountEmail !== void 0) result2.accountEmail = accountEmail(response.accountEmail);
     return result2;
   }
@@ -28504,10 +28722,10 @@ var PairingClient = class {
   }
   validateBeginResult(value) {
     return {
-      pairingId: uuid16(value.pairingId, "PAIRING_INVALID"),
+      pairingId: uuid17(value.pairingId, "PAIRING_INVALID"),
       pairingSecret: pairingSecret(value.pairingSecret),
       confirmationCode: confirmationCode(value.confirmationCode),
-      approvalUrl: approvalUrl(value.approvalUrl, this.origin, uuid16(value.pairingId, "PAIRING_INVALID")),
+      approvalUrl: approvalUrl(value.approvalUrl, this.origin, uuid17(value.pairingId, "PAIRING_INVALID")),
       expiresAt: value.expiresAt instanceof Date ? new Date(value.expiresAt.getTime()) : parseDate(value.expiresAt, "PAIRING_INVALID"),
       keyFingerprint: fingerprint2(value.keyFingerprint)
     };
@@ -28802,30 +29020,30 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 
 // agent/src/optimization-ledger.ts
 import { constants as constants4 } from "node:fs";
-import { lstat as lstat5, mkdir as mkdir4, open as open5, readFile as readFile4, realpath as realpath5 } from "node:fs/promises";
-import path9 from "node:path";
+import { lstat as lstat6, mkdir as mkdir4, open as open5, readFile as readFile4, realpath as realpath6 } from "node:fs/promises";
+import path11 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure4(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path9.resolve(directory);
+  const absolute2 = path11.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
-      if ((await lstat5(current2)).isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
+      if ((await lstat6(current2)).isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path9.dirname(current2);
+    const parent = path11.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
   await mkdir4(absolute2, { recursive: true, mode: 448 });
-  const stat = await lstat5(absolute2);
+  const stat = await lstat6(absolute2);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure4("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
-  return realpath5(absolute2);
+  return realpath6(absolute2);
 }
 var OptimizationLedger = class _OptimizationLedger {
   constructor(filename, handle, noticesFilename) {
@@ -28843,11 +29061,11 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path9.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path9.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path11.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path11.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
-      const stat = await lstat5(filename);
+      const stat = await lstat6(filename);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_LEDGER_BYTES) {
         throw failure4("OPTIMIZATION_LEDGER_INVALID");
       }
@@ -28863,7 +29081,7 @@ var OptimizationLedger = class _OptimizationLedger {
     const ledger = new _OptimizationLedger(filename, handle, noticesFilename);
     try {
       try {
-        const noticeStat = await lstat5(noticesFilename);
+        const noticeStat = await lstat6(noticesFilename);
         if (!noticeStat.isFile() || noticeStat.isSymbolicLink() || noticeStat.size > MAX_NOTICE_LEDGER_BYTES) throw failure4("OPTIMIZATION_NOTICE_LEDGER_INVALID");
         const notices = await readFile4(noticesFilename, "utf8");
         for (const line of notices.split("\n")) {
@@ -28930,7 +29148,7 @@ var OptimizationLedger = class _OptimizationLedger {
       const marker = JSON.stringify({ sessionId: event.sessionId, checkpointCalls, deliveredAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
       let currentBytes = 0;
       try {
-        const stat = await lstat5(this.noticesFilename);
+        const stat = await lstat6(this.noticesFilename);
         if (!stat.isFile() || stat.isSymbolicLink()) throw failure4("OPTIMIZATION_NOTICE_LEDGER_INVALID");
         currentBytes = stat.size;
       } catch (error62) {
@@ -28977,7 +29195,7 @@ var OptimizationLedger = class _OptimizationLedger {
 };
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.3" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.4" : "0.3.2";
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -28989,7 +29207,7 @@ function processAlive(pid) {
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
   await mkdir5(stateDir, { recursive: true });
-  const file2 = path10.join(stateDir, "agent-process.json");
+  const file2 = path12.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       const handle = await open6(file2, "wx", 384);
@@ -29100,10 +29318,10 @@ async function runAgent(options) {
 async function main() {
   if (process.platform !== "win32") throw Error("WINDOWS_REQUIRED");
   const appData = process.env.LOCALAPPDATA;
-  if (!appData || !path10.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path10.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path10.dirname(process.execPath);
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path10.join(binaryDir, "OwnerBridge.exe");
+  if (!appData || !path12.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path12.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path12.dirname(process.execPath);
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path12.join(binaryDir, "OwnerBridge.exe");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (command === "pair") {
@@ -29125,18 +29343,33 @@ async function main() {
     }) + "\n");
     return;
   }
+  if (command === "configure-access") {
+    if (process.argv.length !== 3) throw Error("AGENT_COMMAND_INVALID");
+    process.stdout.write(await store.configureAccess() ? "ACCESS_CONFIGURED\n" : "ACCESS_CANCELLED\n");
+    return;
+  }
   if (command === "approve-workspace") {
     process.stdout.write(await store.approveWorkspace() ? "WORKSPACE_APPROVED\n" : "WORKSPACE_CANCELLED\n");
     return;
   }
   if (command === "list-workspaces") {
-    process.stdout.write(JSON.stringify((await store.loadWorkspaces()).map((w) => ({ workspaceGrantId: w.workspaceGrantId, displayName: w.displayName, permissions: w.permissions, allowedCommands: w.allowedCommands, localhostPorts: w.localhostPorts }))) + "\n");
+    const programs = await store.loadPrograms(), history = await store.loadPermissionHistory();
+    process.stdout.write(JSON.stringify((await store.loadWorkspaces()).map((w) => ({
+      workspaceGrantId: w.workspaceGrantId,
+      displayName: w.displayName,
+      path: w.root,
+      permissions: w.permissions,
+      allowedCommands: w.allowedCommands,
+      executables: Object.fromEntries(w.allowedCommands.map((name2) => [name2, programs[name2]?.executable ?? null])),
+      localhostPorts: w.localhostPorts,
+      permissionHistory: history.filter((entry) => entry.workspaceGrantId === w.workspaceGrantId)
+    }))) + "\n");
     return;
   }
   const args = process.argv.slice(3);
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path10.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -29146,7 +29379,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path10.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path12.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -29165,7 +29398,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path10.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -29177,7 +29410,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path10.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -29216,10 +29449,10 @@ async function main() {
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
   try {
-    const journal = await NativeJournal.open(path10.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
-    const efficiencyLedger = await OptimizationLedger.open(path10.join(stateDir, "optimization"));
+    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const efficiencyLedger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
     try {
-      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path10.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
+      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path12.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
       process.once("SIGTERM", () => stop.abort());
@@ -29233,7 +29466,7 @@ async function main() {
     await releaseProcess();
   }
 }
-if (process.argv[1] && path10.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (process.argv[1] && path12.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";
     process.stderr.write(code + "\n");