local-commander-agent 0.3.43 → 0.3.45

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Change history
 
+## 0.3.45 - 2026-10-22
+
+- New: macOS 14 or later on Apple Silicon, and Linux x64 or arm64 with a systemd user session. Run the same `npx local-commander-agent@latest` in Terminal; npm downloads only the runtime for your computer. Setup pairs the computer, asks what may be used in the terminal, and runs the agent as a background service that starts when you sign in.
+- Fixed: a computer that lost its connection without noticing (after sleep, a network change or a server restart) now reconnects within about three minutes instead of staying offline.
+- Fixed: a request that never reached a sleeping computer no longer keeps one of its execution slots busy; the computer frees it when it reconnects.
+- Includes everything in 0.3.44.
+
+## 0.3.44 - 2026-10-22
+
+- New: when you set up a computer, the window that asks what may be used now shows the Local Commander account the computer joined. Someone helping you can approve your computer from their own phone with the code you read to them. Continue only if you know that account; Cancel shares nothing.
+- Includes everything in 0.3.43.
+
 ## 0.3.43 - 2026-10-21
 
 - Faster: file search on Windows reads files in batches through one helper process instead of starting one per file. A search over 300 files now takes well under a second. Results are unchanged.

package/README.md

@@ -1,25 +1,25 @@
 # Local Commander Agent
 
-**Connect your AI assistant to your Windows computer through [Local Commander](https://localcmd.app).** The agent lets an authorized MCP client work with local files, run explicitly approved commands, and access approved localhost services on your paired computer.
+**Connect your AI assistant to your computer through [Local Commander](https://localcmd.app).** The agent lets an authorized MCP client work with local files, run explicitly approved commands, and access approved localhost services on your paired computer.
 
-> **Requires the Local Commander service at https://localcmd.app.** This npm package is its Windows companion, not a standalone MCP server, an offline AI assistant, or a JavaScript SDK. Installing the package alone is not enough: you need a Local Commander account, an approved device pairing, a running agent, an internet connection, and an authorized MCP connection from your AI client. Local management commands such as status and stop do not require the service to be online.
+> **Requires the Local Commander service at https://localcmd.app.** This npm package is its computer companion, not a standalone MCP server, an offline AI assistant, or a JavaScript SDK. Installing the package alone is not enough: you need a Local Commander account, an approved device pairing, a running agent, an internet connection, and an authorized MCP connection from your AI client. Local management commands such as status and stop do not require the service to be online.
 
 [Website and sign-in](https://localcmd.app) ┬╖ [Support](https://localcmd.app/support) ┬╖ [Privacy](https://localcmd.app/privacy)
 
 ## Before you start
 
-Use **Windows 11 x64** and a currently supported Node.js LTS version meeting the package's Node.js 20+ minimum. Node.js/npm are needed to launch `npx`; the installed background agent includes its own Node runtime. You do not need Docker, WSL, a repository checkout, a database, or administrator rights for normal setup. Your AI client must support authenticated remote MCP connections; availability depends on the client and workspace policy.
+Use **Windows 11 x64**, **macOS 14 or later on Apple Silicon**, or **Linux with a systemd user session** (Ubuntu 24.04 x64 or arm64), and a currently supported Node.js LTS version meeting the package's Node.js 20+ minimum. Node.js/npm are needed to launch `npx`; the installed background agent includes its own Node runtime. You do not need Docker, WSL, a repository checkout, a database, or administrator rights for normal setup. Your AI client must support authenticated remote MCP connections; availability depends on the client and workspace policy.
 
 ## Install and connect
 
-1. Open PowerShell or Windows Terminal as your normal Windows user and run:
+1. Open a terminal as your normal user (PowerShell or Windows Terminal on Windows, Terminal on macOS or Linux) and run:
 
    ```powershell
    npx local-commander-agent@latest
    ```
 
 2. The installer opens a browser. Sign in to [Local Commander](https://localcmd.app), check the displayed pairing code, and approve this computer. Approve only a pairing you just started yourself.
-3. Choose access in the local Windows dialog:
+3. Choose access in the local dialog (a window on Windows, a terminal prompt on macOS and Linux):
    - **Full access - all connected drives (default):** approve the available drive letters, file reads/writes, installed commands and localhost services at once. There is no folder picker or separate approval for Node.
    - **Selected folders:** choose one folder in the folder picker. It starts read/write; more folders and write permission can be added later.
 
@@ -32,15 +32,15 @@ Use **Windows 11 x64** and a currently supported Node.js LTS version meeting the
 
    Complete the browser authorization with the same Local Commander account. Device pairing and AI-client authorization are separate steps. For an AI client that runs on this same computer, you can instead use direct local MCP (see "Direct local MCP" below). Do not configure `npx local-commander-agent` itself as a stdio server.
 
-You can close the installation terminal. The agent runs in the background and starts when this Windows user signs in. The PC must be awake and online for remote AI tasks. As a first test, ask the connected assistant to list the files in a folder you approved.
+You can close the installation terminal. The agent runs in the background and starts when you sign in to this computer. The computer must be awake and online for remote AI tasks. As a first test, ask the connected assistant to list the files in a folder you approved.
 
-Installation and update also add `localcommander` to your Windows **user PATH**. Open a new CMD/terminal window, then run `localcommander status`, `localcommander monitor --watch`, or `localcommander logs --follow` from any folder. No global npm installation is needed. The launcher uses your required Node.js installation and an installed copy of the CLI, so clearing npm's cache does not remove the command. Fetch newer releases with `npx local-commander-agent@latest update`. Uninstall removes Local Commander's PATH entry and launcher while preserving your other entries.
+On Windows, installation and update also add `localcommander` to your **user PATH**. Open a new CMD/terminal window, then run `localcommander status`, `localcommander monitor --watch`, or `localcommander logs --follow` from any folder. No global npm installation is needed. The launcher uses your required Node.js installation and an installed copy of the CLI, so clearing npm's cache does not remove the command. Fetch newer releases with `npx local-commander-agent@latest update`. Uninstall removes Local Commander's PATH entry and launcher while preserving your other entries.
 
 ## Direct local MCP (AI clients on this computer)
 
-An AI client that runs on the same Windows computer, such as Claude Code, Codex or Cursor, can use your approved workspaces directly through the running agent. No cloud round trip happens per call. It keeps working while the internet or localcmd.app is unavailable, and calls take milliseconds instead of a cloud admission. Hosted assistants such as ChatGPT or claude.ai on the web still use `https://localcmd.app/mcp`.
+An AI client that runs on the same computer, such as Claude Code, Codex or Cursor, can use your approved workspaces directly through the running agent. No cloud round trip happens per call. It keeps working while the internet or localcmd.app is unavailable, and calls take milliseconds instead of a cloud admission. Hosted assistants such as ChatGPT or claude.ai on the web still use `https://localcmd.app/mcp`.
 
-1. Turn it on once. This is an owner choice for this Windows user, and `off` revokes it immediately:
+1. Turn it on once. This is an owner choice for this user account, and `off` revokes it immediately:
 
    ```powershell
    localcommander mcp on
@@ -57,15 +57,15 @@ An AI client that runs on the same Windows computer, such as Claude Code, Codex
    Other clients:  { "command": "cmd", "args": ["/c", "localcommander", "mcp"] }
    ```
 
-The tools are the same as the remote ones: `workspace_list`, file reads and writes, search, Git, `project_snapshot`, `command_run` and `localhost_request`. Each takes an optional `workspace` (a grant id, a root such as `D:\`, or a display name). The same workspace grants, Full Access or scoped mode and owner denials apply, and commands run hidden with your Windows account's rights.
+The tools are the same as the remote ones: `workspace_list`, file reads and writes, search, Git, `project_snapshot`, `command_run` and `localhost_request`. Each takes an optional `workspace` (a grant id, a root such as `D:\`, or a display name). The same workspace grants, Full Access or scoped mode and owner denials apply, and commands run hidden with your user account's rights.
 
-The agent listens only on `127.0.0.1`, and only while direct local MCP is on. Every connection must first prove a key that only this Windows user's protected Local Commander state can derive, so other Windows users and other computers cannot connect. Check the state with `localcommander mcp status`; turn it off with `localcommander mcp off`. While an enterprise Guard policy is configured, direct local calls are refused so that Guard evidence cannot be bypassed.
+The agent listens only on `127.0.0.1`, and only while direct local MCP is on. Every connection must first prove a key that only this user's protected Local Commander state can derive, so other users and other computers cannot connect. Check the state with `localcommander mcp status`; turn it off with `localcommander mcp off`. While an enterprise Guard policy is configured, direct local calls are refused so that Guard evidence cannot be bypassed.
 
 ## What тАЬall connected drivesтАЭ means
 
 It expands the **filesystem scope** to the drive letters shown at the moment you consent. It includes available local fixed and removable drives. Mapped network drives and `subst` letters are not included. New drive letters, unavailable drives and unmounted volumes are not automatically added; run `configure-access` again after making the desired drive available. Grants are path/drive-letter based, not tied to a particular removable disk's hardware identity: reusing an approved letter gives access under that letter.
 
-Full access allows installed commands resolved from absolute owner PATH entries or an absolute executable path, plus localhost services. Explicit command/port denials and write restrictions still apply. It does not elevate Windows privileges. Protected Local Commander state/runtime and secret-file filters apply to file tools; programs run with your Windows account's rights, so these controls are not an OS sandbox. ChatGPT/Claude or your workspace may still ask for their own action confirmations. Existing installations keep their current permissions until the owner runs `configure-access` and selects full access using a release that supports it.
+Full access allows installed commands resolved from absolute owner PATH entries or an absolute executable path, plus localhost services. Explicit command/port denials and write restrictions still apply. It does not elevate privileges. Protected Local Commander state/runtime and secret-file filters apply to file tools; programs run with your user account's rights, so these controls are not an OS sandbox. ChatGPT/Claude or your workspace may still ask for their own action confirmations. Existing installations keep their current permissions until the owner runs `configure-access` and selects full access using a release that supports it.
 
 ## Manage the installation
 
@@ -143,7 +143,7 @@ Do not paste `(Get-Command git).Source` into CMD: CMD passes it literally instea
 
 Under full access, `deny-command` and `deny-localhost` exclude the named command or port while other commands/ports remain available. Native `.exe`/`.com` commands receive argument arrays directly. `.cmd`/`.bat` launchers use a hidden PowerShell wrapper and reject cmd metacharacters in arguments; use an explicit interpreter for more complex scripts. Allowing a general interpreter is not containment against it launching a denied program.
 
-Under **owner-approved Full Access**, installed Windows shells, script hosts and administration executables (including PowerShell and CMD) work without per-command registration. They execute under the Windows account's own rights, not elevated privileges. Owner-defined `deny-command` exclusions and explicit write/localhost restrictions still apply. A general interpreter can access resources beyond file-tool path checks; Full Access is not an OS sandbox. Existing scoped grants stay scoped until the owner deliberately changes access with `configure-access`.
+Under **owner-approved Full Access**, installed Windows shells, script hosts and administration executables (including PowerShell and CMD) work without per-command registration. They execute under the user account's own rights, not elevated privileges. Owner-defined `deny-command` exclusions and explicit write/localhost restrictions still apply. A general interpreter can access resources beyond file-tool path checks; Full Access is not an OS sandbox. Existing scoped grants stay scoped until the owner deliberately changes access with `configure-access`.
 
 
 For a remote MCP client with an unknown device/workspace, use `workspace_list`, then `execution_session_open`, perform the requested work and read results. Reuse valid, already authorized session and target context where supported. `diagnostics` is for faults, not a mandatory startup roundtrip. Diagnostics reports quota separately from the device's execution slot limit. Its optional `repairSafe` mode releases only expired reservations from this OAuth connection that never acquired a dispatch lease. It never retries work, changes permissions or clears unknown executions.
@@ -153,7 +153,7 @@ For a remote MCP client with an unknown device/workspace, use `workspace_list`,
 | Symptom | What to check |
 | --- | --- |
 | `npx` is not recognized | Install supported Node.js LTS, then open a new terminal. |
-| Unsupported OS or architecture | This package targets Windows x64, not macOS, Linux or Windows ARM64. |
+| Unsupported OS or architecture | Supported: Windows 11 x64, macOS 14 or later on Apple Silicon, Linux x64 or arm64 with systemd. Windows ARM64 and Intel Macs are not supported. |
 | Pairing does not complete | Open https://localcmd.app, verify your account and internet access, then rerun the install command to resume. Do not share pairing codes. |
 | `ACCESS_SETUP_CANCELLED` | No filesystem grant was saved by that dialog. Rerun setup and choose the intended scope. |
 | `STATE_CHANGED` | Local account/policy/permissions changed while the dialog was open. Review current state and reopen the dialog. |

package/bin/localcommander.mjs

@@ -723,8 +723,10 @@ function help() {
   ].join("\n");
 }
 async function main() {
-  requireWindows();
   if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(VERSION)) fail("PACKAGE_VERSION_INVALID");
+  // macOS and Linux run the per-platform runtime package through its own lifecycle (#253).
+  if (process.platform !== "win32") return (await import("./posix.mjs")).runPosix(process.argv.slice(2), VERSION);
+  requireWindows();
   const command = process.argv[2] || "bootstrap";
   const args = process.argv.slice(3);
   if (command === "-h" || command === "--help" || command === "help") {

package/bin/posix.mjs

@@ -0,0 +1,66 @@
+// macOS and Linux: the runtime ships in a per-platform package (an optional dependency, so npm installs only the
+// matching one). Its lifecycle accepts only a private, owner-only artifact directory, so the files are copied from the
+// npx cache into a fresh private directory and the lifecycle installs from there into its own versions directory.
+import { constants } from "node:fs";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+
+const PACKAGES = { "darwin-arm64": "local-commander-agent-darwin-arm64", "linux-x64": "local-commander-agent-linux-x64", "linux-arm64": "local-commander-agent-linux-arm64" };
+// npm command -> lifecycle command. The default (`npx local-commander-agent@latest`) is setup, as on Windows.
+const COMMANDS = { bootstrap: "setup", install: "setup", setup: "setup", update: "update", pair: "pair", access: "access", "configure-access": "access",
+  start: "start", stop: "stop", status: "status", rollback: "rollback", uninstall: "uninstall" };
+const EXECUTABLES = new Set(["node", "posix-host", "owner-store"]);
+
+function fail(code) { const error = new Error(code); error.code = code; throw error; }
+
+export function posixHelp() {
+  return [
+    "Local Commander",
+    "",
+    "  npx local-commander-agent@latest            set up this computer, pair it and choose access",
+    "  npx local-commander-agent@latest update     install this version, keeping pairing and access",
+    "  npx local-commander-agent@latest status|start|stop|pair|access|rollback",
+    "  npx local-commander-agent@latest uninstall [--purge-state]",
+    ""
+  ].join("\n");
+}
+
+export async function runPosix(argv, version) {
+  const name = PACKAGES[process.platform + "-" + process.arch];
+  if (!name) fail(process.platform === "darwin" ? "MACOS_APPLE_SILICON_REQUIRED" : process.platform === "linux" ? "LINUX_X64_OR_ARM64_REQUIRED" : "PLATFORM_UNSUPPORTED");
+  const command = argv[0] || "bootstrap", args = argv.slice(1);
+  if (command === "-h" || command === "--help" || command === "help") { process.stdout.write(posixHelp()); return; }
+  const lifecycle = COMMANDS[command];
+  if (!lifecycle) fail("ARGUMENT_INVALID");
+  if (lifecycle === "uninstall" ? args.length > 1 || (args.length === 1 && args[0] !== "--purge-state") : args.length) fail("ARGUMENT_INVALID");
+  if (typeof process.getuid === "function" && process.getuid() === 0) fail("POSIX_OWNER_REQUIRED");
+
+  let packageJson;
+  try { packageJson = createRequire(import.meta.url).resolve(name + "/package.json"); } catch { fail("PLATFORM_PACKAGE_MISSING"); }
+  const meta = JSON.parse(await fs.readFile(packageJson, "utf8"));
+  if (meta.name !== name || meta.version !== version) fail("PLATFORM_PACKAGE_MISMATCH");
+  const source = path.join(path.dirname(packageJson), "runtime");
+  const manifest = JSON.parse(await fs.readFile(path.join(source, "manifest.json"), "utf8"));
+  const files = Object.keys(manifest?.files ?? {});
+  if (manifest?.platform !== process.platform || manifest?.arch !== process.arch || !files.length || files.some(file => !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(file))) fail("PLATFORM_PACKAGE_INVALID");
+
+  // Canonical parent: on macOS os.tmpdir() is under /var, a symlink to /private/var, and the lifecycle rejects aliases.
+  const stage = await fs.mkdtemp(path.join(await fs.realpath(os.tmpdir()), "local-commander-"));
+  try {
+    await fs.chmod(stage, 0o700);
+    for (const file of [...files, "manifest.json"]) {
+      const target = path.join(stage, file);
+      await fs.copyFile(path.join(source, file), target, constants.COPYFILE_EXCL);
+      await fs.chmod(target, EXECUTABLES.has(file) ? 0o700 : 0o600);
+    }
+    // The lifecycle verifies every file against the manifest, then copies them into its own versions directory.
+    const result = spawnSync(path.join(stage, "node"), [path.join(stage, "lifecycle.mjs"), lifecycle, ...args], { stdio: "inherit" });
+    if (result.error) throw result.error;
+    process.exitCode = result.status ?? 1;
+  } finally {
+    await fs.rm(stage, { recursive: true, force: true });
+  }
+}

package/package.json

@@ -1,47 +1,57 @@
-{
-  "name": "local-commander-agent",
-  "version": "0.3.43",
-  "description": "Windows companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
-  "type": "module",
-  "bin": {
-    "localcommander": "bin/localcommander.mjs"
-  },
-  "os": [
-    "win32"
-  ],
-  "cpu": [
-    "x64"
-  ],
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "files": [
-    "bin/",
-    "runtime/",
-    "README.md",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "prepack": "node ../../scripts/build-npm-agent.mjs",
-    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "mcp",
-    "local",
-    "agent",
-    "chatgpt",
-    "claude",
-    "windows"
-  ],
-  "localCommander": {
-    "controlPlaneOrigin": "https://localcmd.app"
-  },
-  "homepage": "https://localcmd.app",
-  "bugs": {
-    "url": "https://localcmd.app/support",
-    "email": "peter.mamrukov@localcmd.app"
-  }
-}
+{
+  "name": "local-commander-agent",
+  "version": "0.3.45",
+  "description": "Computer companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
+  "type": "module",
+  "bin": {
+    "localcommander": "bin/localcommander.mjs"
+  },
+  "os": [
+    "win32",
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "optionalDependencies": {
+    "local-commander-agent-darwin-arm64": "0.3.45",
+    "local-commander-agent-linux-arm64": "0.3.45",
+    "local-commander-agent-linux-x64": "0.3.45"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "files": [
+    "bin/",
+    "runtime/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "prepack": "node ../../scripts/build-npm-agent.mjs",
+    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "local",
+    "agent",
+    "chatgpt",
+    "claude",
+    "windows",
+    "macos",
+    "linux"
+  ],
+  "localCommander": {
+    "controlPlaneOrigin": "https://localcmd.app"
+  },
+  "homepage": "https://localcmd.app",
+  "bugs": {
+    "url": "https://localcmd.app/support",
+    "email": "peter.mamrukov@localcmd.app"
+  }
+}

package/runtime/agent.mjs

@@ -25388,6 +25388,7 @@ async function secretCommand(executable, args, input2) {
 async function secretServicePresent() {
   const bus = path3.join("/run/user", String(process.getuid()), "bus");
   if (!process.env.DBUS_SESSION_BUS_ADDRESS && await absent(bus)) return false;
+  if (await absent("/usr/bin/gdbus")) return false;
   const args = ["call", "--session", "--dest", "org.freedesktop.DBus", "--object-path", "/org/freedesktop/DBus", "--method"];
   for (const method of ["org.freedesktop.DBus.ListNames", "org.freedesktop.DBus.ListActivatableNames"]) {
     const output2 = (await secretCommand("/usr/bin/gdbus", [...args, method])).toString("utf8");
@@ -26484,6 +26485,7 @@ var NativeCapacitySchema = external_exports.object({ type: external_exports.lite
 var NATIVE_STATUS_CAPABILITY = "nativeStatusV1";
 var NativeStatusSchema = NativeCapacitySchema.extend({ type: external_exports.literal("nativeStatus"), active: external_exports.number().int().min(0).max(32), queued: external_exports.number().int().min(0).max(256), paused: external_exports.boolean() }).strict().refine((v) => v.active <= v.safeSlots);
 var TerminalEventSchema = external_exports.object({ type: external_exports.literal("executionResult"), protocolVersion: external_exports.literal(1), requestId: uuid11, tenantId: uuid11, deviceId: uuid11, connectionEpoch: epoch2, binding: ExecutionBindingSchema, state: external_exports.enum(["finished", "failed", "cancelled", "unknown", "rejected"]), resultCode: external_exports.string().regex(/^[A-Z0-9_]{1,40}$/), metrics: TerminalMetricsSchema.optional() }).strict();
+var HeldLeasesFrameSchema = external_exports.object({ type: external_exports.literal("heldLeases"), protocolVersion: external_exports.literal(1), connectionEpoch: epoch2, bindings: external_exports.array(ExecutionBindingSchema).min(1).max(64) }).strict();
 var TerminalEventAckSchema = external_exports.object({ type: external_exports.literal("executionResultAck"), protocolVersion: external_exports.literal(1), requestId: uuid11, ok: external_exports.boolean() }).strict();
 function canonicalJson(value) {
   function canonical2(v) {
@@ -26763,9 +26765,19 @@ var NativeJournal = class _NativeJournal {
   sizes = /* @__PURE__ */ new Map();
   digests = /* @__PURE__ */ new Map();
   totalBytes = 0;
+  /** First connection epoch this journal saw (#448): from then on every received request has an entry. "0" for a journal
+   * an older agent created (continuous since pairing); null until a new journal's first connection. */
+  firstEpoch = null;
   static async open(directory, box, options = {}) {
     const maxEntries = options.maxEntries ?? 2e3, maxBytes = options.maxBytes ?? 64 * 1048576, retentionMs = options.retentionMs ?? 864e5;
     if (!Number.isInteger(maxEntries) || maxEntries < 1 || maxEntries > 1e4 || !Number.isInteger(maxBytes) || maxBytes < 1024 || maxBytes > 64 * 1048576 || !Number.isInteger(retentionMs) || retentionMs < 0 || retentionMs > 30 * 864e5) throw failure2("JOURNAL_LIMIT_INVALID");
+    let existed = true;
+    try {
+      await lstat2(path6.resolve(directory));
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+      existed = false;
+    }
     const dir = await safeDirectory(directory), lockPath = path6.join(dir, "journal.lock"), nonce2 = randomBytes4(16).toString("hex");
     const guard = options.lockHelper ? await acquirePosixJournalGuard(dir, options.lockHelper) : void 0;
     let file2;
@@ -26781,6 +26793,7 @@ var NativeJournal = class _NativeJournal {
       await file2.writeFile(JSON.stringify({ pid: process.pid, nonce: nonce2, createdAt: journal.now().toISOString() }));
       await file2.sync();
       await journal.load();
+      await journal.loadStart(existed);
       return journal;
     } catch (e) {
       await file2.close().catch(() => {
@@ -26862,6 +26875,65 @@ var NativeJournal = class _NativeJournal {
       this.digests.set(id2, digest2(envelope));
     }
   }
+  async loadStart(existed) {
+    const filename = path6.join(this.dir, "journal.start");
+    let envelope;
+    try {
+      const stat2 = await lstat2(filename);
+      if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 4096) throw failure2("JOURNAL_CORRUPT");
+      envelope = await readFile3(filename);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+      return this.writeStart(existed ? "0" : null);
+    }
+    try {
+      const value = JSON.parse(this.box.open(envelope, "journal-start").toString("utf8"));
+      if (value?.version !== 1 || Object.keys(value).length !== 2 || value.firstEpoch !== null && (typeof value.firstEpoch !== "string" || !/^(0|[1-9]\d{0,18})$/.test(value.firstEpoch))) throw Error();
+      this.firstEpoch = value.firstEpoch;
+    } catch {
+      throw failure2("JOURNAL_CORRUPT");
+    }
+  }
+  async writeStart(firstEpoch) {
+    const temporary = path6.join(this.dir, "journal-start." + this.lock.nonce + "." + randomBytes4(8).toString("hex") + ".tmp");
+    const handle = await open3(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+    try {
+      await handle.writeFile(this.box.seal(Buffer.from(JSON.stringify({ version: 1, firstEpoch })), "journal-start"));
+      await handle.sync();
+      await handle.close();
+      await rename(temporary, path6.join(this.dir, "journal.start"));
+      if (process.platform !== "win32") {
+        const d = await open3(this.dir, constants2.O_RDONLY);
+        try {
+          await d.sync();
+        } finally {
+          await d.close();
+        }
+      }
+    } catch (e) {
+      await handle.close().catch(() => {
+      });
+      await rm2(temporary, { force: true }).catch(() => {
+      });
+      throw e;
+    }
+    this.firstEpoch = firstEpoch;
+  }
+  /** Called on every connection before any request of it is served; only the first one is recorded. */
+  recordConnection(connectionEpoch) {
+    return this.enqueue(async () => {
+      if (!/^[1-9]\d{0,18}$/.test(connectionEpoch)) throw failure2("JOURNAL_INPUT_INVALID");
+      if (this.firstEpoch === null) await this.writeStart(connectionEpoch);
+    });
+  }
+  /** True only when this journal existed for the whole connection that leased the request and has no entry for it:
+   * every received request is journaled synchronously on arrival, before it can start (#448). */
+  neverReceived(executionId, connectionEpoch) {
+    return this.enqueue(async () => {
+      if (!uuid14.test(executionId) || !/^[1-9]\d{0,18}$/.test(connectionEpoch)) throw failure2("JOURNAL_INPUT_INVALID");
+      return this.firstEpoch !== null && BigInt(connectionEpoch) >= BigInt(this.firstEpoch) && !this.entries.has(executionId);
+    });
+  }
   async persist(entry) {
     const st = await lstat2(this.dir);
     if (!st.isDirectory() || st.isSymbolicLink()) throw failure2("JOURNAL_DIRECTORY_INVALID");
@@ -27330,7 +27402,7 @@ async function choosePosixFolder() {
 }
 async function choosePosixAccess() {
   return terminal2(async (ask) => {
-    if (process.platform === "darwin") await ask("This experimental macOS runtime runs each command as its own launchd job and stops that job's processes when the command ends; work handed to other services is not stopped. Press Enter to review access: ");
+    if (process.platform === "darwin") await ask("Local Commander runs each command as its own launchd job and stops that job's processes when the command ends; work handed to other services is not stopped. Press Enter to review access: ");
     const choice = await ask("Local Commander access\n1. One folder: read and write files\n2. Full Access: account capabilities across this computer, including commands and localhost\nEnter 1 or 2 (empty cancels): ");
     if (choice !== "1" && choice !== "2") return null;
     const folder = choice === "2" ? "/" : await ask("Absolute folder path: ");
@@ -28370,11 +28442,14 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
   }
   /** Replace scope only after an explicit local dialog; updates never call this implicitly. */
   async configureAccess() {
+    let account = "";
     const expected = await this.run(() => this.withLock(async () => {
-      if (!(await this.readState())?.enrollment) throw fail2("ENROLLMENT_REQUIRED");
+      const enrollment = (await this.readState())?.enrollment;
+      if (!enrollment) throw fail2("ENROLLMENT_REQUIRED");
+      account = enrollment.accountEmail;
       return this.rawHash();
     }));
-    const decision = await this.chooseAccess();
+    const decision = await this.chooseAccess(account);
     if (decision === null) return null;
     const selected = parseAccessSelection(decision);
     if (!selected) return null;
@@ -28417,9 +28492,9 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       return structuredClone(workspaces);
     }));
   }
-  chooseAccess() {
+  chooseAccess(account) {
     if (this.posix) return this.run(() => choosePosixAccess());
-    return this.run(async () => parseAccessSelection(await _WindowsPrivateStore.invoke(this.bridge, "choose-access", {}, 24e4, true)));
+    return this.run(async () => parseAccessSelection(await _WindowsPrivateStore.invoke(this.bridge, "choose-access", { data: Buffer.from(account, "utf8").toString("base64") }, 24e4, true)));
   }
   loadPermissionHistory() {
     return this.run(async () => structuredClone((await this.readState())?.permissionHistory ?? []));
@@ -31006,6 +31081,7 @@ var NativeRelayBridge = class {
   async connected(connection) {
     if (this.connection) await this.disconnected();
     this.connection = { ...connection };
+    await this.journal.recordConnection?.(connection.connectionEpoch);
     this.runtime.connected(connection, (frame) => {
       if (frame.type === "control_result") this.control.get(frame.requestId)?.resolve(frame);
       else if ("binding" in frame) this.execution.get(frame.binding.executionId)?.resolve(frame);
@@ -31033,6 +31109,22 @@ var NativeRelayBridge = class {
       }
     }
   }
+  /** Leases the cloud holds from earlier connections that this device never accepted (#448). Each one the journal
+   * never received gets the same never-started receipt as #143; the cloud checks it against its own rows. */
+  async heldLeases(bindings) {
+    for (const binding2 of bindings) {
+      const connection = this.connection, id2 = binding2.executionId;
+      if (!connection || binding2.tenantId !== connection.tenantId || binding2.deviceId !== connection.deviceId || BigInt(binding2.connectionEpoch) >= BigInt(connection.connectionEpoch)) continue;
+      if (this.terminalSending.has(id2)) continue;
+      this.terminalSending.add(id2);
+      try {
+        if (await this.journal.neverReceived?.(id2, binding2.connectionEpoch)) await this.sendTerminal(binding2, "rejected", "PRE_ACCEPTANCE_REJECTED");
+      } catch {
+      } finally {
+        this.terminalSending.delete(id2);
+      }
+    }
+  }
   async disconnected() {
     this.connection = null;
     for (const pending of [...this.execution.values(), ...this.control.values()]) pending.resolve(null);
@@ -46032,7 +46124,8 @@ async function connectOnce(options) {
       tenantId,
       deviceId,
       guardIdentity: true,
-      ...options.aiConnectivity ? { aiConnectivity: true } : {}
+      ...options.aiConnectivity ? { aiConnectivity: true } : {},
+      ...options.onHeldLeases ? { heldLeases: true } : {}
     }, maxFrameBytes);
     const challenge = validateChallenge(await waitForMessage(socket, maxFrameBytes, connectTimeoutMs, "RELAY_HANDSHAKE_TIMEOUT"), protocolVersion2);
     const machine = challenge.machineIdentity ? options.machineIdentity?.(deviceId) ?? null : null;
@@ -46066,8 +46159,22 @@ async function connectOnce(options) {
       const { safeSlots, active, queued, paused } = nativeStatus();
       sendJson(socket, NativeStatusSchema.parse({ type: "nativeStatus", protocolVersion: 1, connectionEpoch, agentVersion: options.agentVersion, safeSlots, active, queued, paused }), maxFrameBytes);
     };
+    let watchdog;
+    const armWatchdog = () => {
+      clearTimeout(watchdog);
+      watchdog = setTimeout(() => {
+        process.stderr.write("RELAY_HEARTBEAT_LOST\n");
+        socket.terminate();
+      }, monitorHeartbeat * 3);
+      watchdog.unref();
+    };
+    if (monitorHeartbeat) {
+      armWatchdog();
+      socket.once("close", () => clearTimeout(watchdog));
+    }
     if (monitorHeartbeat) socket.on("ping", (data) => {
       if (data.toString() !== "lcmcp-monitor:" + connectionEpoch) return;
+      armWatchdog();
       try {
         void Promise.resolve(options.onMonitorHeartbeat?.()).catch(() => {
         });
@@ -46155,6 +46262,15 @@ async function connectOnce(options) {
             ack.data.ok ? pending.resolve() : pending.reject(new RelayClientError("RELAY_RESULT_REJECTED"));
             return;
           }
+          if (frame.type === "heldLeases") {
+            const held = HeldLeasesFrameSchema.safeParse(frame);
+            if (!held.success || !options.onHeldLeases || held.data.connectionEpoch !== connectionEpoch) fail5("RELAY_FRAME_INVALID");
+            try {
+              options.onHeldLeases(held.data.bindings);
+            } catch {
+            }
+            return;
+          }
           if (frame.type === "workspace_ack") {
             const ack = ServerFrameSchema.safeParse(frame);
             if (!ack.success || ack.data.type !== "workspace_ack" || !pendingWorkspace.has(ack.data.requestId)) fail5("RELAY_FRAME_INVALID");
@@ -46364,6 +46480,51 @@ async function readMachineGuid(timeoutMs2 = 5e3) {
     child.on("close", (code) => finish(code === 0 ? pattern.exec(output2)?.[1]?.toLowerCase() ?? null : null));
   });
 }
+async function readComputerName(timeoutMs2 = 5e3) {
+  const valid = (name2) => !!name2 && name2.length <= 120 && name2.trim() === name2 && !/[\u0000-\u001f\u007f]/.test(name2);
+  if (process.platform === "linux") {
+    let handle;
+    try {
+      handle = await open7("/etc/hostname", constants8.O_RDONLY | constants8.O_NOFOLLOW);
+      const data = Buffer.alloc(257), { bytesRead } = await handle.read(data, 0, data.length, 0);
+      const name2 = data.subarray(0, bytesRead).toString("utf8").trim();
+      if (bytesRead <= 256 && valid(name2)) return name2;
+    } catch {
+    } finally {
+      await handle?.close().catch(() => {
+      });
+    }
+  }
+  if (process.platform === "darwin") {
+    const name2 = await new Promise((resolve) => {
+      let output2 = "", settled = false;
+      const finish = (value) => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolve(value);
+        }
+      };
+      const child = spawn5("/usr/sbin/scutil", ["--get", "ComputerName"], { shell: false, stdio: ["ignore", "pipe", "ignore"], env: buildChildEnvironment(process.env) });
+      const timer = setTimeout(() => {
+        child.kill();
+        finish("");
+      }, timeoutMs2);
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        if (output2.length + chunk.length <= 1024) output2 += chunk;
+        else {
+          child.kill();
+          finish("");
+        }
+      });
+      child.on("error", () => finish(""));
+      child.on("close", (code) => finish(code === 0 ? output2.replace(/\n$/, "") : ""));
+    });
+    if (valid(name2)) return name2;
+  }
+  return os5.hostname();
+}
 function machineProof(deviceId, machineGuid, computerName = os5.hostname()) {
   const name2 = computerName.slice(0, 120);
   if (!name2 || name2.trim() !== name2 || /[\u0000-\u001f\u007f]/.test(name2)) return null;
@@ -49273,7 +49434,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.43" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.45" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 function processAlive(pid) {
@@ -49352,7 +49513,8 @@ async function runAgent(options) {
     throw error62;
   }
   const machineGuid = await readMachineGuid();
-  const machineIdentity = machineGuid ? (deviceId) => machineProof(deviceId, machineGuid) : void 0;
+  let computerName = "";
+  const machineIdentity = machineGuid ? (deviceId) => machineProof(deviceId, machineGuid, computerName) : void 0;
   const ledger = options.efficiencyLedger;
   monitor(() => options.monitor?.setLifetimeSavings(ledger?.savingsSnapshot?.()));
   const efficiencyLedger = ledger && {
@@ -49419,6 +49581,7 @@ async function runAgent(options) {
   });
   try {
     while (!options.signal.aborted) {
+      computerName = await readComputerName();
       let ready;
       const readyPromise = new Promise((resolve) => {
         ready = resolve;
@@ -49433,6 +49596,11 @@ async function runAgent(options) {
           safeSlots: runtime.status().safeSlots,
           status: () => runtime.status(),
           onIncidentAck: (ack) => incidentProducer.ack(ack),
+          // After bridge.connected, like requests: the journal has recorded this connection first.
+          onHeldLeases: (bindings) => {
+            void readyPromise.then(() => bridge.heldLeases(bindings)).catch(() => {
+            });
+          },
           handleRequest: async (request) => {
             await readyPromise;
             monitor(() => {