local-commander-agent 0.3.39-pairlink.1 → 0.3.40

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change history
 
+## 0.3.40 - 2026-10-16
+
+- Docs: the README covers only what this package installs. Developer-only notes are removed, and the release-history link no longer points to a private repository.
+- No change to the agent, its commands or its permissions.
+- Includes everything in 0.3.39-pairlink.1.
+
 ## 0.3.39-pairlink.1 - 2026-10-15
 
 - Change: the pairing link printed in the terminal now carries the confirmation code, so the website opens the Connect dialog with the code already filled in. Check that it matches the code in your terminal, then click Approve (#218).

package/README.md

@@ -188,8 +188,6 @@ npx local-commander-agent@latest logs --follow
 
 If the CLI is already on PATH, use `localcommander monitor --watch` or `localcommander logs --follow`. `monitor --json` returns a machine-readable snapshot; `logs` prints recent events once. Ctrl+C exits a live view without stopping the agent. These commands only read local monitoring files; they do not install, pair, restart, dispatch cloud work or consume execution quota.
 
-From the development checkout, `npm run monitor` opens this live view using the same installed-agent snapshots. `npm run monitor -- --json` streams the bounded JSON observations. There is no install or build step for the monitor.
-
 The live view also reads registered runtime presence from the current project's `.local-commander/agents.json` and native workers from the configured agent state's `.local-commander/fabric/mailbox.json`. It observes live local `codex`, `claude` and `cursor-agent` processes through hidden bounded Windows process metadata reads. It shows reporting agents and observed hosts even while they have no active Local Commander command; unused registrations and empty activity rows do not receive named screen rows. Host display IDs are stable eight-character hashes of computer/name/PID/start time; they are process observations, not server-issued AI identities. CPU activity describes measured local CPU use; waiting on a provider or thinking is not inferred.
 
 Reported task activity, confirmed worker model attribution and confirmed execution IDs are used when available. Linked commands appear beneath their agents; only measured savings from those exact linked executions contribute to an agent row. Unlinked host model/savings remain unavailable. A `+` on an agent savings figure marks partial retained execution coverage. The last finished command remains visible with its completion time, so short commands do not disappear between refreshes. `--json` includes all bounded agent/host rows, including those omitted for screen size. A missing/denied/corrupt presence source is isolated and reported as unavailable; the monitor never initializes or mutates those registries and never reads capabilities, credentials or private chat histories. Current commands use bounded redacted previews emitted by the tool runtime.
@@ -211,26 +209,8 @@ Each instance retains its last 64 observed executions, 100 events, 32 sessions a
 An older installed agent produces no monitoring snapshot even if it is running; the CLI reports that monitoring is unavailable. Publishing/installing the updated agent is required before these views can report its connection. The existing `status` command remains available for installation and process state.
 
 
-### Meaningful MCP activity
-
-The terminal also reads the personal MCP server's bounded `.local-commander/activity/*.json` snapshots. It shows actual scheduled/queued calls, command classes, managed background processes through exit, recent failures and message-event metadata. The protected audit log and message bodies are not scanned. Snapshots coalesce changes for250ms. The health row uses the existing loopback health endpoint, cached for30seconds with an800ms timeout; idle activity snapshots are not a failed health check. Relay connection/freshness, queue, diagnostic write errors and dropped events are separate facts; no AI parsing. `localcommander logs --follow` prints bounded completion history and updates deterministic optimization hints every five completions: largest response/output sources, repeated polling, calls/errors, tool-plus-queue duration and measured stdout savings. Hints propose review, not unproven extra savings; command status, failures, warnings and required detail must stay intact.
-
-`agent_presence` allocates a stable alias of at most eight ASCII characters from 128 choices: eighty Jewish, Russian, Arabic, Hindi and Chinese transliterations plus 48 playful names such as Pickle, Waffle and Noodle. The random server-issued runtime UUID selects the pool locally (for example `Yael48` or `Priyabf`); collision resolution is bounded. Labels are optional. Reuse the existing `runtimeId`/`runtimeKey` pair on presence refresh and pass `agent: { runtimeId, runtimeKey }` on ordinary tools, or the same pair in request `_meta.localCommander`. The key stays private and is not retained in monitor snapshots. No second identity/name handshake occurs. `agent_message.to` accepts an active alias as well as existing runtime/role addresses. Names are display/routing hints; UUID/key authentication and ordinary permission checks remain authoritative.
-
-Presence can declare `model`, `project`, `taskId`, `activity` and `phase` (`working`, `analysis`, `message`, `idle`). Model and analysis are labeled reports; the monitor does not read private thoughts or infer them from CPU. Calls without a binding remain visible as **unbound**. Observed CLI hosts get stable short display aliases but remain host observations; their task/model is unavailable without a reporter. Task-log filenames and PR-bearing directory/worktree names are parsed with bounded regex; inferred PRs are marked `(path)`. Sanitized directory context appears beneath current work; bounded simple command arguments appear in redacted previews, while credentials, inline scripts and payloads stay hidden.
-
-The INVESTIGATION panel follows the selected PC: task/project/PR, working directory, current action, then recent outcomes with elapsed time and exit/error codes. Space freezes/resumes the view, Tab focuses the next PC, A shows all PCs and L expands/collapses history. These keys control the investigation view; command dispatch/cancellation still uses the existing authorized MCP tools. Missing model labels say not reported; client presence or explicit batch metadata must declare a known model.
-
-Initial agent_presence and native project_snapshot startup context return a small per-PC memory: Windows/OS, architecture, Node, approved executable availability, eight worked commands and eight recent failures. Facts cache for60seconds;32 outcome signatures persist for30days in protected state. Refresh presence with includeHostMemory:true after a failure or environment change; routine refreshes omit it. Only fully completed exit0 counts as worked. Memory is advice and never widens permission. Package versions are not inferred.
-
-Successful complete stdout can reuse the existing TAP compactor or a lossless JSON whitespace compactor. It preserves duplicate keys, number/string lexemes, stderr and result status; executed commands never change. The optional operator capture runs once for600seconds only with LCMCP_TRAFFIC_CAPTURE_SECONDS=600, retaining bounded pseudonymous authenticated MCP/device-relay metadata rather than raw bodies. Production capture is now off; its observed JSON outputs were already compact, so no extra production JSON savings were measured.
-
-Response bytes count the JSON tool text once (batch child responses are delivered inside the parent). Output bytes and saved stdout bytes have separate counters; tokens are estimates at bytes/4. Runtime/model groups retain their original model declaration, so changing a reported model cannot reattribute earlier savings. Limits:256 in-flight calls,64 agent/model groups and managed process projections,100 completion events,32 source files,1MiB per snapshot. Dropped observations and diagnostic write failures are reported in log insights. Snapshot write failure cannot fail a tool.
-
-Reload the personal MCP server once to load this source change, then reopen `npm run monitor`. New optional personal presence fields read old version1 state; an older strict writer must be reloaded before using them. Existing native snapshots without context remain readable. These changes do not install/restart existing agents or deploy a release.
-
 ### Monitor measurements and release history
 
 The view shows measured per-agent calls, mean tool-plus-queue duration, stdout bytes, sent response bytes and errors when an identified reporter has those counters. Native measured calls, status/output polls and session records are separate figures; sessions are not execution capacity. Current savings totals exclude stale native snapshots. Missing measurements remain unavailable.
 
-See [CHANGELOG.md](https://github.com/netbka/local-commander-mcp/blob/main/packages/agent-cli/CHANGELOG.md) for release changes.
+Release changes are listed in `CHANGELOG.md`, which ships with this package (npm **Code** tab).

package/package.json

@@ -1,47 +1,47 @@
-{
-  "name": "local-commander-agent",
-  "version": "0.3.39-pairlink.1",
-  "description": "Windows companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
-  "type": "module",
-  "bin": {
-    "localcommander": "bin/localcommander.mjs"
-  },
-  "os": [
-    "win32"
-  ],
-  "cpu": [
-    "x64"
-  ],
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "files": [
-    "bin/",
-    "runtime/",
-    "README.md",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "prepack": "node ../../scripts/build-npm-agent.mjs",
-    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "mcp",
-    "local",
-    "agent",
-    "chatgpt",
-    "claude",
-    "windows"
-  ],
-  "localCommander": {
-    "controlPlaneOrigin": "https://localcmd.app"
-  },
-  "homepage": "https://localcmd.app",
-  "bugs": {
-    "url": "https://localcmd.app/support",
-    "email": "peter.mamrukov@localcmd.app"
-  }
-}
+{
+  "name": "local-commander-agent",
+  "version": "0.3.40",
+  "description": "Windows companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
+  "type": "module",
+  "bin": {
+    "localcommander": "bin/localcommander.mjs"
+  },
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "files": [
+    "bin/",
+    "runtime/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "prepack": "node ../../scripts/build-npm-agent.mjs",
+    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "local",
+    "agent",
+    "chatgpt",
+    "claude",
+    "windows"
+  ],
+  "localCommander": {
+    "controlPlaneOrigin": "https://localcmd.app"
+  },
+  "homepage": "https://localcmd.app",
+  "bugs": {
+    "url": "https://localcmd.app/support",
+    "email": "peter.mamrukov@localcmd.app"
+  }
+}

package/runtime/agent.mjs

@@ -48401,7 +48401,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.39-pairlink.1" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.40" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 function processAlive(pid) {