local-commander-agent 0.3.44 → 0.3.46

package/runtime/agent.mjs

@@ -4541,10 +4541,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path29) {
-  if (!path29)
+function getElementAtPath(obj, path30) {
+  if (!path30)
     return obj;
-  return path29.reduce((acc, key) => acc?.[key], obj);
+  return path30.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4884,11 +4884,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path29, issues) {
+function prefixIssues(path30, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path29);
+    iss.path.unshift(path30);
     return iss;
   });
 }
@@ -5338,16 +5338,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path29 = []) => {
+  const processError = (error63, path30 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else {
-        const fullpath = [...path29, ...issue2.path];
+        const fullpath = [...path30, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5386,17 +5386,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path29 = []) => {
+  const processError = (error63, path30 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else {
-        const fullpath = [...path29, ...issue2.path];
+        const fullpath = [...path30, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5435,8 +5435,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path29 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path29) {
+  const path30 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path30) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -22538,13 +22538,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path29 = ref.slice(1).split("/").filter(Boolean);
-  if (path29.length === 0) {
+  const path30 = ref.slice(1).split("/").filter(Boolean);
+  if (path30.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path29[0] === defsKey) {
-    const key = path29[1] === void 0 ? void 0 : decodeJSONPointerSegment(path29[1]);
+  if (path30[0] === defsKey) {
+    const key = path30[1] === void 0 ? void 0 : decodeJSONPointerSegment(path30[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23179,7 +23179,7 @@ function visit(schema, fnOrHandlers) {
     return h ? h(node2, rewritten) : node2;
   };
   const cache2 = /* @__PURE__ */ new Map();
-  function run(s) {
+  function run2(s) {
     const cached2 = cache2.get(s);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
@@ -23205,21 +23205,21 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newShape = {};
         for (const k of keys) {
-          const mapped = run(oldShape[k]);
+          const mapped = run2(oldShape[k]);
           if (mapped !== oldShape[k])
             changed = true;
           newShape[k] = mapped;
         }
         let newCatchall = def.catchall;
         if (def.catchall) {
-          newCatchall = run(def.catchall);
+          newCatchall = run2(def.catchall);
           if (newCatchall !== def.catchall)
             changed = true;
         }
         return changed ? clone(s, { ...def, shape: newShape, catchall: newCatchall }) : s;
       }
       case "array": {
-        const mapped = run(def.element);
+        const mapped = run2(def.element);
         return mapped === def.element ? s : clone(s, { ...def, element: mapped });
       }
       case "tuple": {
@@ -23227,14 +23227,14 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newItems = [];
         for (const item of oldItems) {
-          const mapped = run(item);
+          const mapped = run2(item);
           if (mapped !== item)
             changed = true;
           newItems.push(mapped);
         }
         let newRest = def.rest;
         if (def.rest) {
-          newRest = run(def.rest);
+          newRest = run2(def.rest);
           if (newRest !== def.rest)
             changed = true;
         }
@@ -23242,12 +23242,12 @@ function visit(schema, fnOrHandlers) {
       }
       case "record":
       case "map": {
-        const newKey = run(def.keyType);
-        const newVal = run(def.valueType);
+        const newKey = run2(def.keyType);
+        const newVal = run2(def.valueType);
         return newKey === def.keyType && newVal === def.valueType ? s : clone(s, { ...def, keyType: newKey, valueType: newVal });
       }
       case "set": {
-        const newVal = run(def.valueType);
+        const newVal = run2(def.valueType);
         return newVal === def.valueType ? s : clone(s, { ...def, valueType: newVal });
       }
       case "union": {
@@ -23255,7 +23255,7 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newOptions = [];
         for (const opt of oldOptions) {
-          const mapped = run(opt);
+          const mapped = run2(opt);
           if (mapped !== opt)
             changed = true;
           newOptions.push(mapped);
@@ -23263,8 +23263,8 @@ function visit(schema, fnOrHandlers) {
         return changed ? clone(s, { ...def, options: newOptions }) : s;
       }
       case "intersection": {
-        const newLeft = run(def.left);
-        const newRight = run(def.right);
+        const newLeft = run2(def.left);
+        const newRight = run2(def.right);
         return newLeft === def.left && newRight === def.right ? s : clone(s, { ...def, left: newLeft, right: newRight });
       }
       case "optional":
@@ -23276,23 +23276,23 @@ function visit(schema, fnOrHandlers) {
       case "nonoptional":
       case "promise":
       case "success": {
-        const newInner = run(def.innerType);
+        const newInner = run2(def.innerType);
         return newInner === def.innerType ? s : clone(s, { ...def, innerType: newInner });
       }
       case "pipe": {
-        const newIn = run(def.in);
-        const newOut = run(def.out);
+        const newIn = run2(def.in);
+        const newOut = run2(def.out);
         return newIn === def.in && newOut === def.out ? s : clone(s, { ...def, in: newIn, out: newOut });
       }
       case "function": {
-        const newInput = run(def.input);
-        const newOutput = run(def.output);
+        const newInput = run2(def.input);
+        const newOutput = run2(def.output);
         return newInput === def.input && newOutput === def.output ? s : clone(s, { ...def, input: newInput, output: newOutput });
       }
       case "lazy": {
         const original = def.getter;
         const { _cachedInner, ...rest } = def;
-        return clone(s, { ...rest, getter: () => run(original()) });
+        return clone(s, { ...rest, getter: () => run2(original()) });
       }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
@@ -23323,7 +23323,7 @@ function visit(schema, fnOrHandlers) {
       }
     }
   }
-  return run(schema);
+  return run2(schema);
 }
 
 // ../../node_modules/zod/v4/classic/deep-partial.js
@@ -25164,8 +25164,8 @@ async function openNetworkPanel(binaryDirectory, identity) {
 }
 
 // agent/src/main.ts
-import path28 from "node:path";
-import os7 from "node:os";
+import path29 from "node:path";
+import os8 from "node:os";
 
 // agent/src/posix-store.ts
 import { constants } from "node:fs";
@@ -25388,6 +25388,7 @@ async function secretCommand(executable, args, input2) {
 async function secretServicePresent() {
   const bus = path3.join("/run/user", String(process.getuid()), "bus");
   if (!process.env.DBUS_SESSION_BUS_ADDRESS && await absent(bus)) return false;
+  if (await absent("/usr/bin/gdbus")) return false;
   const args = ["call", "--session", "--dest", "org.freedesktop.DBus", "--object-path", "/org/freedesktop/DBus", "--method"];
   for (const method of ["org.freedesktop.DBus.ListNames", "org.freedesktop.DBus.ListActivatableNames"]) {
     const output2 = (await secretCommand("/usr/bin/gdbus", [...args, method])).toString("utf8");
@@ -25583,7 +25584,7 @@ async function acquirePosixJournalGuard(directory, helper) {
 }
 
 // agent/src/main.ts
-import { mkdir as mkdir14, open as open13, readFile as readFile11, realpath as realpath10, rm as rm9 } from "node:fs/promises";
+import { mkdir as mkdir14, open as open13, readFile as readFile12, realpath as realpath10, rm as rm10 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -25720,13 +25721,13 @@ var exec2 = promisify2(execFile2);
 async function darwinSupervisorLiveness(helper, pids, records = []) {
   if (process.platform !== "darwin" || !process.getuid?.() || process.getuid() !== process.geteuid?.()) return null;
   const remaining = new Set(pids), uid = process.getuid(), deadline = Date.now() + 1e4, env = buildChildEnvironment(process.env);
-  const run = (file2, args) => exec2(
+  const run2 = (file2, args) => exec2(
     file2,
     args,
     { env, timeout: Math.max(1, Math.min(7e3, deadline - Date.now())), maxBuffer: 8192, encoding: "utf8", windowsHide: true }
   );
   try {
-    const boot = (await run("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"])).stdout.trim();
+    const boot = (await run2("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"])).stdout.trim();
     if (!bootSession.test(boot)) return null;
     for (const pid of remaining) {
       if (Date.now() >= deadline) break;
@@ -25735,9 +25736,9 @@ async function darwinSupervisorLiveness(helper, pids, records = []) {
       const proof2 = matches2[0].containment;
       if (!validDarwinContainment(proof2) || proof2.uid !== uid || proof2.bootSession !== boot) continue;
       try {
-        await run(helper, ["--reap", proof2.coalition]);
-        if ((await run(helper, ["--count", proof2.coalition])).stdout.trim() !== "0") continue;
-        await run("/bin/launchctl", ["bootout", "gui/" + uid + "/" + proof2.label]).catch(() => {
+        await run2(helper, ["--reap", proof2.coalition]);
+        if ((await run2(helper, ["--count", proof2.coalition])).stdout.trim() !== "0") continue;
+        await run2("/bin/launchctl", ["bootout", "gui/" + uid + "/" + proof2.label]).catch(() => {
         });
         remaining.delete(pid);
       } catch {
@@ -26444,10 +26445,12 @@ var ToolCallSchema = external_exports.discriminatedUnion("name", [
   external_exports.object({ name: external_exports.literal("git_log"), args: external_exports.object({ path: path5.optional(), limit: external_exports.number().int().min(1).max(50).default(15) }).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("project_snapshot"), args: external_exports.object({ path: path5.optional(), startup: external_exports.boolean().optional(), taskId: external_exports.string().regex(/^[A-Za-z0-9_-]{1,100}$/).optional() }).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("command_run"), args: external_exports.object({ command: external_exports.string().min(1).max(260).refine((v) => !/[\r\n\0]/.test(v)), args: external_exports.array(external_exports.string().max(8192).refine((v) => !v.includes("\0"))).max(128).default([]), cwd: path5.optional(), timeoutMs: external_exports.number().int().min(100).max(864e5).default(6e4) }).strict() }).strict(),
+  // Still image of the device's primary display; the agent requires an owner Full Access workspace.
+  external_exports.object({ name: external_exports.literal("take_screenshot"), args: external_exports.object({}).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("localhost_request"), args: external_exports.object({ url: external_exports.string().url().max(2048), method: external_exports.enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]).default("GET"), headers: external_exports.record(external_exports.string().max(128), external_exports.string().max(2048)).optional(), body: external_exports.string().max(6e4).optional() }).strict() }).strict()
 ]);
 function scopeForTool(call) {
-  if (call.name === "command_run") return "commands:execute";
+  if (call.name === "command_run" || call.name === "take_screenshot") return "commands:execute";
   if (call.name === "localhost_request") return "localhost:access";
   return call.name === "fs_write" || call.name === "fs_replace" ? "files:write" : "files:read";
 }
@@ -26484,6 +26487,7 @@ var NativeCapacitySchema = external_exports.object({ type: external_exports.lite
 var NATIVE_STATUS_CAPABILITY = "nativeStatusV1";
 var NativeStatusSchema = NativeCapacitySchema.extend({ type: external_exports.literal("nativeStatus"), active: external_exports.number().int().min(0).max(32), queued: external_exports.number().int().min(0).max(256), paused: external_exports.boolean() }).strict().refine((v) => v.active <= v.safeSlots);
 var TerminalEventSchema = external_exports.object({ type: external_exports.literal("executionResult"), protocolVersion: external_exports.literal(1), requestId: uuid11, tenantId: uuid11, deviceId: uuid11, connectionEpoch: epoch2, binding: ExecutionBindingSchema, state: external_exports.enum(["finished", "failed", "cancelled", "unknown", "rejected"]), resultCode: external_exports.string().regex(/^[A-Z0-9_]{1,40}$/), metrics: TerminalMetricsSchema.optional() }).strict();
+var HeldLeasesFrameSchema = external_exports.object({ type: external_exports.literal("heldLeases"), protocolVersion: external_exports.literal(1), connectionEpoch: epoch2, bindings: external_exports.array(ExecutionBindingSchema).min(1).max(64) }).strict();
 var TerminalEventAckSchema = external_exports.object({ type: external_exports.literal("executionResultAck"), protocolVersion: external_exports.literal(1), requestId: uuid11, ok: external_exports.boolean() }).strict();
 function canonicalJson(value) {
   function canonical2(v) {
@@ -26550,6 +26554,7 @@ function guardAction(binding2, tool, config2, observedAt) {
     throw Error("GUARD_IDENTITY_REQUIRED");
   }
   const name2 = tool.call.name;
+  if (name2 === "take_screenshot") throw Error("GUARD_ACTION_UNSUPPORTED");
   const kind = name2 === "command_run" ? "execute" : name2 === "localhost_request" ? "localhost-access" : name2 === "fs_write" || name2 === "fs_replace" ? "write" : name2.startsWith("git_") ? "git-read" : "read";
   const resourceKind = kind === "execute" ? "workspace" : kind === "localhost-access" ? "localhost-service" : kind === "git-read" ? "git-repository" : name2 === "fs_read" || kind === "write" ? "file" : "workspace";
   return { payloadHash: guardHash(tool.effective), request: BoundActionRequestSchema.parse({
@@ -26763,9 +26768,19 @@ var NativeJournal = class _NativeJournal {
   sizes = /* @__PURE__ */ new Map();
   digests = /* @__PURE__ */ new Map();
   totalBytes = 0;
+  /** First connection epoch this journal saw (#448): from then on every received request has an entry. "0" for a journal
+   * an older agent created (continuous since pairing); null until a new journal's first connection. */
+  firstEpoch = null;
   static async open(directory, box, options = {}) {
     const maxEntries = options.maxEntries ?? 2e3, maxBytes = options.maxBytes ?? 64 * 1048576, retentionMs = options.retentionMs ?? 864e5;
     if (!Number.isInteger(maxEntries) || maxEntries < 1 || maxEntries > 1e4 || !Number.isInteger(maxBytes) || maxBytes < 1024 || maxBytes > 64 * 1048576 || !Number.isInteger(retentionMs) || retentionMs < 0 || retentionMs > 30 * 864e5) throw failure2("JOURNAL_LIMIT_INVALID");
+    let existed = true;
+    try {
+      await lstat2(path6.resolve(directory));
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+      existed = false;
+    }
     const dir = await safeDirectory(directory), lockPath = path6.join(dir, "journal.lock"), nonce2 = randomBytes4(16).toString("hex");
     const guard = options.lockHelper ? await acquirePosixJournalGuard(dir, options.lockHelper) : void 0;
     let file2;
@@ -26781,6 +26796,7 @@ var NativeJournal = class _NativeJournal {
       await file2.writeFile(JSON.stringify({ pid: process.pid, nonce: nonce2, createdAt: journal.now().toISOString() }));
       await file2.sync();
       await journal.load();
+      await journal.loadStart(existed);
       return journal;
     } catch (e) {
       await file2.close().catch(() => {
@@ -26862,6 +26878,65 @@ var NativeJournal = class _NativeJournal {
       this.digests.set(id2, digest2(envelope));
     }
   }
+  async loadStart(existed) {
+    const filename = path6.join(this.dir, "journal.start");
+    let envelope;
+    try {
+      const stat2 = await lstat2(filename);
+      if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 4096) throw failure2("JOURNAL_CORRUPT");
+      envelope = await readFile3(filename);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+      return this.writeStart(existed ? "0" : null);
+    }
+    try {
+      const value = JSON.parse(this.box.open(envelope, "journal-start").toString("utf8"));
+      if (value?.version !== 1 || Object.keys(value).length !== 2 || value.firstEpoch !== null && (typeof value.firstEpoch !== "string" || !/^(0|[1-9]\d{0,18})$/.test(value.firstEpoch))) throw Error();
+      this.firstEpoch = value.firstEpoch;
+    } catch {
+      throw failure2("JOURNAL_CORRUPT");
+    }
+  }
+  async writeStart(firstEpoch) {
+    const temporary = path6.join(this.dir, "journal-start." + this.lock.nonce + "." + randomBytes4(8).toString("hex") + ".tmp");
+    const handle = await open3(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+    try {
+      await handle.writeFile(this.box.seal(Buffer.from(JSON.stringify({ version: 1, firstEpoch })), "journal-start"));
+      await handle.sync();
+      await handle.close();
+      await rename(temporary, path6.join(this.dir, "journal.start"));
+      if (process.platform !== "win32") {
+        const d = await open3(this.dir, constants2.O_RDONLY);
+        try {
+          await d.sync();
+        } finally {
+          await d.close();
+        }
+      }
+    } catch (e) {
+      await handle.close().catch(() => {
+      });
+      await rm2(temporary, { force: true }).catch(() => {
+      });
+      throw e;
+    }
+    this.firstEpoch = firstEpoch;
+  }
+  /** Called on every connection before any request of it is served; only the first one is recorded. */
+  recordConnection(connectionEpoch) {
+    return this.enqueue(async () => {
+      if (!/^[1-9]\d{0,18}$/.test(connectionEpoch)) throw failure2("JOURNAL_INPUT_INVALID");
+      if (this.firstEpoch === null) await this.writeStart(connectionEpoch);
+    });
+  }
+  /** True only when this journal existed for the whole connection that leased the request and has no entry for it:
+   * every received request is journaled synchronously on arrival, before it can start (#448). */
+  neverReceived(executionId, connectionEpoch) {
+    return this.enqueue(async () => {
+      if (!uuid14.test(executionId) || !/^[1-9]\d{0,18}$/.test(connectionEpoch)) throw failure2("JOURNAL_INPUT_INVALID");
+      return this.firstEpoch !== null && BigInt(connectionEpoch) >= BigInt(this.firstEpoch) && !this.entries.has(executionId);
+    });
+  }
   async persist(entry) {
     const st = await lstat2(this.dir);
     if (!st.isDirectory() || st.isSymbolicLink()) throw failure2("JOURNAL_DIRECTORY_INVALID");
@@ -27161,6 +27236,7 @@ import { constants as constants4 } from "node:fs";
 
 // agent/src/posix-consent.ts
 import { openSync, closeSync } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { isatty, ReadStream, WriteStream } from "node:tty";
 import { createInterface } from "node:readline/promises";
 import path8 from "node:path";
@@ -27263,7 +27339,7 @@ async function planPermissionChange(current2, programs, input2) {
 }
 
 // agent/src/posix-consent.ts
-async function terminal2(run, timeoutMs2, signal) {
+async function terminal2(run2, timeoutMs2, signal) {
   if (!process.getuid || process.getuid() === 0 || process.geteuid?.() !== process.getuid() || signal?.aborted) throw Error("OWNER_REVIEW_UNAVAILABLE");
   let readFd;
   try {
@@ -27299,7 +27375,7 @@ async function terminal2(run, timeoutMs2, signal) {
   };
   input2.on("data", bound);
   try {
-    return await run(async (prompt) => {
+    return await run2(async (prompt) => {
       if (stop.signal.aborted) throw Error("OWNER_REVIEW_CANCELLED");
       return review.question(prompt, { signal: stop.signal });
     });
@@ -27328,16 +27404,41 @@ async function choosePosixFolder() {
     return await ask("Read/write folder: " + permissionLabel(folder) + "\nType APPROVE to accept: ") === "APPROVE" ? folder : null;
   }, 12e4);
 }
+var ACCESS_TEXT = "Local Commander lets your AI work on this computer.\n\nFull Access: files, commands and localhost with your account's rights (not an OS sandbox).\nChoose Folder: read and write one folder only.\n\nThis replaces the previous selection and lasts until you change or revoke it.";
+function selection(folder, full) {
+  if (!path8.isAbsolute(folder) || folder.length > 4096 || /[\u0000-\u001f]/.test(folder)) throw Error("WORKSPACE_INVALID");
+  return { mode: full ? "all-drives" : "folders", paths: [full ? "/" : folder] };
+}
+function macDialog() {
+  const script = [
+    "on run argv",
+    'set answer to button returned of (display dialog (item 1 of argv) with title "Local Commander" buttons {"Cancel", "Choose Folder\uFFFD", "Full Access"} default button "Full Access" cancel button "Cancel" with icon note)',
+    'if answer is "Full Access" then return "full"',
+    'return "folder:" & POSIX path of (choose folder with prompt "Choose the folder Local Commander may read and write")',
+    "end run"
+  ];
+  const result2 = spawnSync2(
+    "/usr/bin/osascript",
+    [...script.flatMap((line) => ["-e", line]), ACCESS_TEXT],
+    { encoding: "utf8", timeout: 24e4, maxBuffer: 16384, shell: false }
+  );
+  if (result2.error) return void 0;
+  if (result2.status !== 0) return /\(-128\)/.test(result2.stderr) ? null : void 0;
+  const out = result2.stdout.replace(/\n$/, "");
+  if (out === "full") return selection("/", true);
+  if (out.startsWith("folder:")) return selection(out.slice(7).replace(/(.)\/$/, "$1"), false);
+  return void 0;
+}
 async function choosePosixAccess() {
+  if (process.platform === "darwin") {
+    const chosen = macDialog();
+    if (chosen !== void 0) return chosen;
+  }
   return terminal2(async (ask) => {
-    if (process.platform === "darwin") await ask("Local Commander runs each command as its own launchd job and stops that job's processes when the command ends; work handed to other services is not stopped. Press Enter to review access: ");
-    const choice = await ask("Local Commander access\n1. One folder: read and write files\n2. Full Access: account capabilities across this computer, including commands and localhost\nEnter 1 or 2 (empty cancels): ");
-    if (choice !== "1" && choice !== "2") return null;
-    const folder = choice === "2" ? "/" : await ask("Absolute folder path: ");
-    if (!path8.isAbsolute(folder) || folder.length > 4096 || /[\u0000-\u001f]/.test(folder)) throw Error("WORKSPACE_INVALID");
-    const summary = choice === "2" ? "Full Access allows programs to use your account's capabilities across this computer. This is not an OS sandbox." : "Allow reading and writing files in " + permissionLabel(folder) + ".";
-    if (await ask(summary + "\nThis replaces the previous folder/command/localhost selection and persists until revoked.\nType APPROVE to accept: ") !== "APPROVE") return null;
-    return { mode: choice === "2" ? "all-drives" : "folders", paths: [folder] };
+    const answer = await ask("\n" + ACCESS_TEXT + "\n\nPress Enter for Full Access, type a folder path for one folder, or n to cancel: ");
+    if (answer === "") return selection("/", true);
+    if (/^(n|no|cancel)$/i.test(answer)) return null;
+    return selection(answer, false);
   }, 24e4);
 }
 
@@ -28805,8 +28906,8 @@ var HostMemory = class {
 
 // agent/src/tools.ts
 import { constants as constants7 } from "node:fs";
-import { lstat as lstat7, open as open6, readdir as readdir4, realpath as realpath7, rename as rename4, rm as rm5 } from "node:fs/promises";
-import path17 from "node:path";
+import { lstat as lstat7, open as open6, readdir as readdir4, realpath as realpath7, rename as rename4, rm as rm6 } from "node:fs/promises";
+import path18 from "node:path";
 import { createHash as createHash14, randomUUID as randomUUID7 } from "node:crypto";
 
 // src/guard.ts
@@ -29250,6 +29351,116 @@ async function runSupervised(helper, request, options = {}) {
   });
 }
 
+// agent/src/screen-capture.ts
+import { execFile as execFile4 } from "node:child_process";
+import { mkdtemp, readFile as readFile6, rm as rm5 } from "node:fs/promises";
+import os4 from "node:os";
+import path17 from "node:path";
+var SCREENSHOT_MAX_JPEG_BYTES = 131072;
+var SCREENSHOT_MAX_EDGE = 1568;
+function screenshotEnabled(env = process.env) {
+  return env.LC_SCREENSHOT_ENABLED === "true";
+}
+var SCREENSHOT_ACCEPTANCE_FILE = "screenshot-acceptance-enabled";
+var ScreenCaptureError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "ScreenCaptureError";
+  }
+  code;
+};
+var KNOWN = /^(SCREEN_UNAVAILABLE|SCREEN_LOCKED|SCREEN_ENCODER_UNAVAILABLE|SCREENSHOT_TOO_LARGE|ARGUMENT_INVALID)$/;
+function jpegSize(data) {
+  if (data.length < 4 || data[0] !== 255 || data[1] !== 216 || data[data.length - 2] !== 255 || data[data.length - 1] !== 217) return null;
+  for (let at = 2; at + 9 < data.length; ) {
+    if (data[at] !== 255) return null;
+    const marker = data[at + 1], length = data.readUInt16BE(at + 2);
+    if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+      const height = data.readUInt16BE(at + 5), width = data.readUInt16BE(at + 7);
+      return width > 0 && height > 0 ? { width, height } : null;
+    }
+    at += 2 + length;
+  }
+  return null;
+}
+function run(file2, args, signal, maxBuffer = 65536) {
+  return new Promise((resolve, reject) => {
+    execFile4(
+      file2,
+      args,
+      { encoding: "buffer", timeout: 15e3, maxBuffer, windowsHide: true, shell: false, env: buildChildEnvironment(process.env, process.platform), signal },
+      (error62, stdout, stderr) => error62 ? reject(Object.assign(error62, { stdout, stderr })) : resolve({ stdout, stderr })
+    );
+  });
+}
+async function windows(bridge, signal) {
+  if (!path17.isAbsolute(bridge)) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  let stdout;
+  try {
+    ({ stdout } = await run(bridge, ["screenshot", String(SCREENSHOT_MAX_EDGE), String(SCREENSHOT_MAX_JPEG_BYTES)], signal, 262144));
+  } catch (error62) {
+    if (signal.aborted) throw new ScreenCaptureError("CANCELLED");
+    const code = /^\{"error":"([A-Z_]+)"\}$/.exec(String(error62.stderr ?? ""))?.[1];
+    throw new ScreenCaptureError(code && KNOWN.test(code) ? code : "SCREEN_UNAVAILABLE");
+  }
+  try {
+    const value = JSON.parse(stdout.toString("utf8"));
+    const data = Buffer.from(value.data, "base64"), size = jpegSize(data);
+    if (!size || size.width !== value.width || size.height !== value.height || !Number.isSafeInteger(value.sourceWidth) || !Number.isSafeInteger(value.sourceHeight)) throw Error();
+    return { data, width: size.width, height: size.height, sourceWidth: value.sourceWidth, sourceHeight: value.sourceHeight };
+  } catch {
+    throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  }
+}
+async function mac3(signal) {
+  try {
+    const preflight = await run("/usr/bin/osascript", ["-l", "JavaScript", "-e", "ObjC.import('CoreGraphics'); $.CGPreflightScreenCaptureAccess()"], signal);
+    if (preflight.stdout.toString("utf8").trim() !== "true") {
+      await run("/usr/bin/osascript", ["-l", "JavaScript", "-e", "ObjC.import('CoreGraphics'); $.CGRequestScreenCaptureAccess()"], signal).catch(() => {
+      });
+      throw new ScreenCaptureError("SCREEN_RECORDING_PERMISSION_REQUIRED");
+    }
+  } catch (error62) {
+    if (error62 instanceof ScreenCaptureError) throw error62;
+    throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+  }
+  const folder = await mkdtemp(path17.join(os4.tmpdir(), "lc-screen-"));
+  try {
+    const full = path17.join(folder, "full.png"), small = path17.join(folder, "small.jpg");
+    try {
+      await run("/usr/sbin/screencapture", ["-x", "-m", "-t", "png", full], signal);
+    } catch {
+      throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+    }
+    const source = (await run("/usr/bin/sips", ["-g", "pixelWidth", "-g", "pixelHeight", full], signal)).stdout.toString("utf8");
+    const sourceWidth = Number(/pixelWidth: (\d+)/.exec(source)?.[1]), sourceHeight = Number(/pixelHeight: (\d+)/.exec(source)?.[1]);
+    if (!sourceWidth || !sourceHeight) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+    for (const edge of [SCREENSHOT_MAX_EDGE, 1280, 1024, 800, 640]) {
+      const target = Math.min(edge, Math.max(sourceWidth, sourceHeight));
+      for (const quality of [75, 60, 45, 35]) {
+        await run("/usr/bin/sips", ["-Z", String(target), "-s", "format", "jpeg", "-s", "formatOptions", String(quality), full, "--out", small], signal);
+        const data = await readFile6(small), size = jpegSize(data);
+        if (!size) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+        if (data.length <= SCREENSHOT_MAX_JPEG_BYTES) return { data, ...size, sourceWidth, sourceHeight };
+      }
+    }
+    throw new ScreenCaptureError("SCREENSHOT_TOO_LARGE");
+  } catch (error62) {
+    if (error62 instanceof ScreenCaptureError) throw error62;
+    throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+  } finally {
+    await rm5(folder, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function captureScreen(options) {
+  if (options.signal.aborted) throw new ScreenCaptureError("CANCELLED");
+  if (process.platform === "win32") return windows(options.ownerBridgePath, options.signal);
+  if (process.platform === "darwin") return mac3(options.signal);
+  throw new ScreenCaptureError("SCREENSHOT_UNSUPPORTED");
+}
+
 // agent/src/tools.ts
 var NativeToolError = class extends Error {
   constructor(code) {
@@ -29340,13 +29551,13 @@ var NativeTools = class {
   constructor(options) {
     this.options = options;
     this.options = structuredClone(options);
-    this.memory = new HostMemory(path17.join(options.stateDirectory, "host-memory.json"), Object.keys(options.programs), Object.fromEntries(Object.entries(options.programs).map(([name2, program]) => [name2, program.executable])));
+    this.memory = new HostMemory(path18.join(options.stateDirectory, "host-memory.json"), Object.keys(options.programs), Object.fromEntries(Object.entries(options.programs).map(([name2, program]) => [name2, program.executable])));
   }
   options;
   memory;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path17.join(path17.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail3(error62.message);
@@ -29356,31 +29567,31 @@ var NativeTools = class {
   /** Windows only: up to 64 files of at most 1 MiB in one bridge process, each with its own result. */
   async readFiles(files, maxTotalBytes, signal) {
     try {
-      return await readWindowsFiles(this.options.ownerBridgePath ?? path17.join(path17.dirname(this.options.helperPath), "OwnerBridge.exe"), files, 1048576, maxTotalBytes, signal);
+      return await readWindowsFiles(this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), files, 1048576, maxTotalBytes, signal);
     } catch (error62) {
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail3(error62.message);
       throw error62;
     }
   }
-  async prepare(workspace2, candidate, selection) {
+  async prepare(workspace2, candidate, selection2) {
     let prepared;
     try {
       let projectRoot;
-      if (selection) {
-        const target = ProjectTargetBindingSchema.parse(selection);
+      if (selection2) {
+        const target = ProjectTargetBindingSchema.parse(selection2);
         if (workspace2.rootHash !== target.workspaceRootHash) fail3("PROJECT_IDENTITY_MISMATCH");
         const identity = await this.prepareTool(workspace2, { name: "project_identity", args: { path: target.relativePath } });
         const proof2 = JSON.parse((await identity.run(AbortSignal.timeout(15e3))).stdout);
         if (!proof2.repositoryFingerprint) fail3("PROJECT_IDENTITY_UNKNOWN");
         if (proof2.repositoryFingerprint !== target.repositoryFingerprint) fail3("PROJECT_IDENTITY_MISMATCH");
-        projectRoot = path17.resolve(workspace2.root, target.relativePath);
+        projectRoot = path18.resolve(workspace2.root, target.relativePath);
         const common = identity.claims.find((claim2) => claim2.namespace === "git")?.path;
         if (common) workspace2 = { ...workspace2, gitCommonDir: common };
       }
       prepared = await this.prepareTool(workspace2, candidate, projectRoot);
     } catch (error62) {
       const parsed = ToolCallSchema.safeParse(candidate);
-      if (parsed.success && parsed.data.name === "command_run") await this.memory.record({ ...parsed.data.args, cwd: path17.resolve(workspace2.root, parsed.data.args.cwd ?? ".") }, void 0, error62).catch(() => {
+      if (parsed.success && parsed.data.name === "command_run") await this.memory.record({ ...parsed.data.args, cwd: path18.resolve(workspace2.root, parsed.data.args.cwd ?? ".") }, void 0, error62).catch(() => {
       });
       throw error62;
     }
@@ -29400,17 +29611,17 @@ var NativeTools = class {
     try {
       const canonical2 = await realpath7(workspace2.root);
       if (!equalPath3(canonical2, workspace2.root) || hash6(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace2.rootHash) fail3("WORKSPACE_CHANGED");
-      const runtimeDirectory = path17.dirname(this.options.helperPath);
+      const runtimeDirectory = path18.dirname(this.options.helperPath);
       const protectedPaths = [
         this.options.stateDirectory,
         this.options.helperPath,
-        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe", "node", "owner-store", "posix-host", "job-host.mjs", "lifecycle.mjs", "manifest.json"].map((name2) => path17.join(runtimeDirectory, name2))
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe", "node", "owner-store", "posix-host", "job-host.mjs", "lifecycle.mjs", "manifest.json"].map((name2) => path18.join(runtimeDirectory, name2))
       ];
       if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
-      if (process.platform === "win32" && process.env.LOCALAPPDATA && path17.isAbsolute(process.env.LOCALAPPDATA)) {
-        protectedPaths.push(path17.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path18.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path18.join(process.env.LOCALAPPDATA, "LocalCommander"));
       }
-      if (process.platform !== "win32") protectedPaths.push(path17.join(process.env.LC_AGENT_DATA_DIR || posixDataHome(), "LocalCommander"));
+      if (process.platform !== "win32") protectedPaths.push(path18.join(process.env.LC_AGENT_DATA_DIR || posixDataHome(), "LocalCommander"));
       guard = await PathGuard.create([canonical2], false, { protectedPaths });
       if (projectRoot) {
         const selected = await guard.resolveDirectory(projectRoot);
@@ -29499,7 +29710,7 @@ var NativeTools = class {
         }
         if (taken === first - 1 && first <= end) fail3("OUTPUT_LIMIT_EXCEEDED");
         const remaining = lines.length - (lines.length > 1 && lines.at(-1) === "" ? 1 : 0);
-        return result({ path: path17.relative(workspace2.root, filename), sha256: hash6(bytes3), startLine: first, endLine: Math.min(taken === first - 1 ? last : taken, lines.length), totalLines: lines.length, content: lines.slice(first - 1, taken).join("\n"), truncated: taken < remaining });
+        return result({ path: path18.relative(workspace2.root, filename), sha256: hash6(bytes3), startLine: first, endLine: Math.min(taken === first - 1 ? last : taken, lines.length), totalLines: lines.length, content: lines.slice(first - 1, taken).join("\n"), truncated: taken < remaining });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -29542,7 +29753,7 @@ var NativeTools = class {
           bytes3 = encodeText(pieces.join(newText), original.encoding);
         }
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail3("FILE_WRITE_LIMIT");
-        const temp = path17.join(path17.dirname(target), ".lc-write-" + randomUUID7() + ".tmp");
+        const temp = path18.join(path18.dirname(target), ".lc-write-" + randomUUID7() + ".tmp");
         const handle = await open6(temp, constants7.O_CREAT | constants7.O_EXCL | constants7.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
@@ -29574,18 +29785,18 @@ var NativeTools = class {
             }
             for (let attempt = 0; attempt < 3; attempt++) {
               try {
-                await rm5(temp);
+                await rm6(temp);
                 break;
               } catch {
                 await delay2(100);
               }
             }
           }
-          return result({ path: path17.relative(workspace2.root, target), bytes: bytes3.length, sha256: hash6(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path18.relative(workspace2.root, target), bytes: bytes3.length, sha256: hash6(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
-          await rm5(temp, { force: true }).catch(() => {
+          await rm6(temp, { force: true }).catch(() => {
           });
           throw e;
         }
@@ -29607,7 +29818,7 @@ var NativeTools = class {
           const lines = decodeText(bytes3).text.split(/\r?\n/);
           scanned++;
           for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) {
-            const match = { path: path17.relative(workspace2.root, filename), line: i + 1, text: lines[i].slice(0, 500) };
+            const match = { path: path18.relative(workspace2.root, filename), line: i + 1, text: lines[i].slice(0, 500) };
             if ((room -= Buffer.byteLength(JSON.stringify(match)) + 1) < 0) {
               incomplete = true;
               break;
@@ -29650,7 +29861,7 @@ var NativeTools = class {
             continue;
           }
           try {
-            const filename = await guard.resolveExisting(path17.join(base, entry.path));
+            const filename = await guard.resolveExisting(path18.join(base, entry.path));
             guard.assertSafeFile(filename);
             if (!batched) {
               searchFile(filename, await this.readFile(filename, 1048576, signal));
@@ -29674,6 +29885,30 @@ var NativeTools = class {
         return result({ matches: matches2, scannedFiles: scanned, truncated: listing.truncated || incomplete || matches2.length >= call.args.maxResults || scanned >= 300 });
       } };
     }
+    if (call.name === "take_screenshot") {
+      if (!screenshotEnabled() && !await lstat7(path18.join(this.options.stateDirectory, SCREENSHOT_ACCEPTANCE_FILE)).then((s) => s.isFile(), () => false)) fail3("SCREENSHOT_DISABLED");
+      if (!workspace2.fullAccess) fail3("FULL_ACCESS_REQUIRED");
+      const bridge = this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe");
+      return { call, claims: [{ path: path18.join(this.options.stateDirectory, "screen-capture"), mode: "read" }], run: async (signal) => {
+        let shot;
+        try {
+          shot = await captureScreen({ ownerBridgePath: bridge, signal });
+        } catch (error62) {
+          fail3(error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message) ? error62.message : "SCREEN_UNAVAILABLE");
+        }
+        return result({
+          type: "screenshot",
+          mimeType: "image/jpeg",
+          width: shot.width,
+          height: shot.height,
+          sourceWidth: shot.sourceWidth,
+          sourceHeight: shot.sourceHeight,
+          bytes: shot.data.length,
+          capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: shot.data.toString("base64")
+        });
+      } };
+    }
     if (call.name === "localhost_request") {
       const url2 = new URL(call.args.url), port = Number(url2.port || (url2.protocol === "https:" ? 443 : 80));
       if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || (workspace2.fullAccess ? workspace2.deniedLocalhostPorts?.includes(port) : !workspace2.localhostPorts.includes(port)) || this.options.protectedPorts?.includes(port)) fail3("LOCALHOST_NOT_ALLOWED");
@@ -29744,9 +29979,9 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path17.resolve(cwd, call.args.file));
-        const relative = path17.relative(cwd, file2);
-        if (relative.startsWith(".." + path17.sep) || relative === ".." || path17.isAbsolute(relative)) fail3("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path18.resolve(cwd, call.args.file));
+        const relative = path18.relative(cwd, file2);
+        if (relative.startsWith(".." + path18.sep) || relative === ".." || path18.isAbsolute(relative)) fail3("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail3("TOOL_MISSING");
@@ -29757,7 +29992,7 @@ var NativeTools = class {
         const listing = await this.list(guard, cwd, 1, call.args.startup ? 20 : 150, signal);
         let packageInfo = null;
         try {
-          const name2 = await guard.resolveExisting(path17.join(cwd, "package.json"));
+          const name2 = await guard.resolveExisting(path18.join(cwd, "package.json"));
           guard.assertSafeFile(name2);
           const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
@@ -29777,7 +30012,7 @@ var NativeTools = class {
           }
           const contextFile = async (relative, limit, optional2 = false) => {
             try {
-              const file2 = await guard.resolveExisting(path17.join(primary, relative));
+              const file2 = await guard.resolveExisting(path18.join(primary, relative));
               guard.assertSafeFile(file2);
               return utf8(await this.readFile(file2, limit, signal));
             } catch (error62) {
@@ -29810,17 +30045,17 @@ var NativeTools = class {
     } };
   }
   async resolveProgram(name2, workspace2, args) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => equalPath3(key, name2) || path17.isAbsolute(name2) && equalPath3(value.executable, path17.resolve(name2)));
+    const entry = Object.entries(this.options.programs).find(([key, value]) => equalPath3(key, name2) || path18.isAbsolute(name2) && equalPath3(value.executable, path18.resolve(name2)));
     if (workspace2.fullAccess) {
-      const commandKey = (value) => process.platform === "win32" ? path17.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "") : path17.basename(value);
+      const commandKey = (value) => process.platform === "win32" ? path18.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "") : path18.basename(value);
       const denied = new Set((workspace2.deniedCommands ?? []).map(commandKey));
       if (denied.has(commandKey(name2)) || entry && denied.has(commandKey(entry[0]))) fail3("COMMAND_NOT_ALLOWED");
-      const extension2 = path17.extname(name2).toLowerCase();
-      const candidate = entry?.[1].executable ?? (process.platform !== "win32" ? await resolvePosixExecutable(name2) : path17.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
+      const extension2 = path18.extname(name2).toLowerCase();
+      const candidate = entry?.[1].executable ?? (process.platform !== "win32" ? await resolvePosixExecutable(name2) : path18.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
         commandKey(name2),
         [".exe", ".com", ".cmd", ".bat"].includes(extension2) ? { ...process.env, PATHEXT: extension2 } : process.env
       )?.file : void 0);
-      if (!candidate || !path17.isAbsolute(candidate)) fail3("COMMAND_NOT_FOUND");
+      if (!candidate || !path18.isAbsolute(candidate)) fail3("COMMAND_NOT_FOUND");
       const executable = await realpath7(candidate).catch(() => fail3("COMMAND_NOT_FOUND"));
       if (!(await lstat7(executable)).isFile()) fail3("COMMAND_NOT_FOUND");
       if (denied.has(commandKey(executable))) fail3("COMMAND_NOT_ALLOWED");
@@ -29835,7 +30070,7 @@ var NativeTools = class {
       if (/\.(cmd|bat)$/i.test(executable)) {
         if ([executable, ...args].some((value) => /[&|<>^%!"\r\n]/.test(value))) fail3("INVALID_SCRIPT_ARGUMENTS");
         const literal2 = (value) => "'" + value.replaceAll("'", "''") + "'";
-        const shell = path17.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        const shell = path18.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
         if (denied.has("powershell") || denied.has("cmd")) fail3("COMMAND_NOT_ALLOWED");
         const script = "& " + literal2(executable) + " @(" + args.map(literal2).join(",") + "); exit $LASTEXITCODE";
         return { executable: shell, args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
@@ -29843,7 +30078,7 @@ var NativeTools = class {
       if (!/\.(exe|com)$/i.test(executable)) fail3("COMMAND_NOT_ALLOWED");
       return { executable, args: [...entry?.[1].prefixArgs ?? [], ...args] };
     }
-    if (!entry || !workspace2.allowedCommands.some((v) => equalPath3(v, entry[0])) || !path17.isAbsolute(entry[1].executable)) fail3("COMMAND_NOT_ALLOWED");
+    if (!entry || !workspace2.allowedCommands.some((v) => equalPath3(v, entry[0])) || !path18.isAbsolute(entry[1].executable)) fail3("COMMAND_NOT_ALLOWED");
     return { executable: entry[1].executable, args: [...entry[1].prefixArgs ?? [], ...args] };
   }
   async memoryContext(workspace2) {
@@ -29858,9 +30093,9 @@ var NativeTools = class {
   async gitExecution(cwd, args) {
     if (!["win32", "linux", "darwin"].includes(process.platform)) fail3("COMMAND_NOT_ALLOWED");
     const configured = this.options.programs.git;
-    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path17.isAbsolute(root)).map(([root, suffix]) => path17.join(root, suffix, "cmd", "git.exe")) : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
+    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path18.isAbsolute(root)).map(([root, suffix]) => path18.join(root, suffix, "cmd", "git.exe")) : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
     for (const source of candidates) {
-      if (!path17.isAbsolute(source)) continue;
+      if (!path18.isAbsolute(source)) continue;
       const candidate = process.platform === "win32" ? source : await resolvePosixExecutable(source);
       if (!candidate) continue;
       try {
@@ -29894,7 +30129,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path17.join(current2.path, item.name);
+        const candidate = path18.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -29904,11 +30139,11 @@ var NativeTools = class {
         }
         if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path17.relative(root, resolved), type: "directory" });
+          entries.push({ path: path18.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
           const stat2 = await lstat7(resolved).catch(() => null);
-          if (stat2) entries.push({ path: path17.relative(root, resolved), type: "file", size: stat2.size });
+          if (stat2) entries.push({ path: path18.relative(root, resolved), type: "file", size: stat2.size });
         }
       }
       if (truncated) break;
@@ -29918,7 +30153,7 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace2, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace2.root)) {
-      const dotGit = path17.join(directory, ".git");
+      const dotGit = path18.join(directory, ".git");
       try {
         const stat2 = await lstat7(dotGit);
         if (stat2.isSymbolicLink()) fail3("GIT_METADATA_CHANGED");
@@ -29927,14 +30162,14 @@ var NativeTools = class {
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail3("GIT_METADATA_CHANGED");
-          gitDir = await realpath7(path17.resolve(directory, content.slice(8)));
+          gitDir = await realpath7(path18.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace2.root) && (!workspace2.gitCommonDir || !guard.isWithin(gitDir, workspace2.gitCommonDir))) fail3("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path17.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path18.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail3("GIT_METADATA_CHANGED");
-          common = await realpath7(path17.resolve(gitDir, content));
+          common = await realpath7(path18.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
@@ -29945,22 +30180,22 @@ var NativeTools = class {
         if (e.code !== "ENOENT") throw e;
       }
       if (equalPath3(directory, workspace2.root)) break;
-      directory = path17.dirname(directory);
+      directory = path18.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path18 from "node:path";
-import os4 from "node:os";
+import path19 from "node:path";
+import os5 from "node:os";
 function canonical(value) {
-  const p = path18.resolve(value);
+  const p = path19.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path18.relative(a, b);
-  return relative === "" || !path18.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path18.sep);
+  const relative = path19.relative(a, b);
+  return relative === "" || !path19.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path19.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -29968,7 +30203,7 @@ function claimsConflict(a, b) {
 var NativeScheduler = class {
   constructor(options = {}) {
     this.options = options;
-    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os4.availableParallelism?.() ?? os4.cpus().length) / 2)));
+    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os5.availableParallelism?.() ?? os5.cpus().length) / 2)));
     this.safeSlots = options.safeSlots ?? capacity;
     this.maxQueued = options.maxQueued ?? 32;
     if (!Number.isInteger(this.safeSlots) || this.safeSlots < 1 || this.safeSlots > 32 || !Number.isInteger(this.maxQueued) || this.maxQueued < 1 || this.maxQueued > 256) throw Error("INVALID_SCHEDULER_LIMIT");
@@ -29986,16 +30221,16 @@ var NativeScheduler = class {
     } catch {
     }
   }
-  schedule(id2, claims, deadlineAt, run, signal) {
+  schedule(id2, claims, deadlineAt, run2, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id2 || id2.length > 100 || this.active.has(id2) || this.waiting.some((j) => j.id === id2)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path18.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path19.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
     if (this.waiting.length >= this.maxQueued) return Promise.reject(Error("RESOURCE_BUSY"));
     return new Promise((resolve, reject) => {
-      const job = { id: id2, claims: claims.map((c) => ({ ...c, path: canonical(c.path) })), deadline, run, signal, resolve, reject };
+      const job = { id: id2, claims: claims.map((c) => ({ ...c, path: canonical(c.path) })), deadline, run: run2, signal, resolve, reject };
       const remove = (reason) => {
         const index = this.waiting.indexOf(job);
         if (index < 0) return;
@@ -30705,6 +30940,14 @@ function resultOutcome(result2) {
   if (!result2.treeTerminated || result2.exitCode === null) return "unknown";
   return result2.exitCode === 0 ? "success" : "failed";
 }
+function screenshotMetadata(stdout) {
+  try {
+    const { data: _data, ...metadata } = JSON.parse(stdout);
+    return JSON.stringify(metadata);
+  } catch {
+    return "";
+  }
+}
 async function outboundResult(call, result2, binding2, optional2, ledger) {
   const shaped = call.name === "command_run" ? shapeCommandResultForAgentDetailed({ command: call.args.command, args: call.args.args, cwd: call.args.cwd ?? "." }, result2) : { result: result2, telemetry: unshapedResultTelemetry(result2) };
   if (ledger) {
@@ -30757,7 +31000,7 @@ var NativeRuntime = class {
     }
     if (frame.type === "result" && this.options.contentAudit) {
       const call = this.contexts.get(frame.binding.executionId)?.tool.call;
-      if (call) try {
+      if (call && call.name !== "take_screenshot") try {
         this.options.contentAudit.record(frame.binding, call, frame.result);
       } catch {
       }
@@ -30894,8 +31137,10 @@ var NativeRuntime = class {
         const checked = ResultSchema.parse(output2);
         const { resultCode, ...journalOutput } = checked;
         if (context.guardPermit) await this.options.guard.result(context.guardPermit, checked);
-        const final = await this.options.journal.finish(binding2.executionId, journalOutput, resultCode);
-        this.send({ type: "result", version: 1, binding: binding2, result: await outboundResult(runnable.call, journalResult(final.result, resultCode), binding2, this.optionalTelemetry, this.options.efficiencyLedger) });
+        const image = runnable.call.name === "take_screenshot" ? journalOutput.stdout : void 0;
+        const final = await this.options.journal.finish(binding2.executionId, image === void 0 ? journalOutput : { ...journalOutput, stdout: screenshotMetadata(image) }, resultCode);
+        const outbound = await outboundResult(runnable.call, journalResult(final.result, resultCode), binding2, this.optionalTelemetry, this.options.efficiencyLedger);
+        this.send({ type: "result", version: 1, binding: binding2, result: image === void 0 ? outbound : { ...outbound, stdout: image } });
       }, abort.signal);
       context.task = work.catch(async (error62) => {
         if (!context.accepted) {
@@ -31009,6 +31254,7 @@ var NativeRelayBridge = class {
   async connected(connection) {
     if (this.connection) await this.disconnected();
     this.connection = { ...connection };
+    await this.journal.recordConnection?.(connection.connectionEpoch);
     this.runtime.connected(connection, (frame) => {
       if (frame.type === "control_result") this.control.get(frame.requestId)?.resolve(frame);
       else if ("binding" in frame) this.execution.get(frame.binding.executionId)?.resolve(frame);
@@ -31036,6 +31282,22 @@ var NativeRelayBridge = class {
       }
     }
   }
+  /** Leases the cloud holds from earlier connections that this device never accepted (#448). Each one the journal
+   * never received gets the same never-started receipt as #143; the cloud checks it against its own rows. */
+  async heldLeases(bindings) {
+    for (const binding2 of bindings) {
+      const connection = this.connection, id2 = binding2.executionId;
+      if (!connection || binding2.tenantId !== connection.tenantId || binding2.deviceId !== connection.deviceId || BigInt(binding2.connectionEpoch) >= BigInt(connection.connectionEpoch)) continue;
+      if (this.terminalSending.has(id2)) continue;
+      this.terminalSending.add(id2);
+      try {
+        if (await this.journal.neverReceived?.(id2, binding2.connectionEpoch)) await this.sendTerminal(binding2, "rejected", "PRE_ACCEPTANCE_REJECTED");
+      } catch {
+      } finally {
+        this.terminalSending.delete(id2);
+      }
+    }
+  }
   async disconnected() {
     this.connection = null;
     for (const pending of [...this.execution.values(), ...this.control.values()]) pending.resolve(null);
@@ -31101,9 +31363,9 @@ var NativeRelayBridge = class {
 
 // agent/src/local-direct.ts
 import net from "node:net";
-import path19 from "node:path";
+import path20 from "node:path";
 import { createHmac as createHmac2, hkdfSync, randomBytes as randomBytes6, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-import { mkdir as mkdir7, readFile as readFile7, rename as rename5, rm as rm6, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdir as mkdir7, readFile as readFile8, rename as rename5, rm as rm7, writeFile as writeFile3 } from "node:fs/promises";
 var LocalDirectError = class extends Error {
   constructor(code) {
     super(code);
@@ -31121,11 +31383,11 @@ var ADMISSION_MS = 6e4;
 var MAX_IN_FLIGHT = 16;
 var MAX_CONNECTIONS = 32;
 function localDirectDirectory(appData) {
-  return path19.join(appData, "LocalCommander", "LocalMcp");
+  return path20.join(appData, "LocalCommander", "LocalMcp");
 }
 async function localDirectEnabled(directory) {
   try {
-    return JSON.parse(await readFile7(path19.join(directory, "settings.json"), "utf8"))?.enabled === true;
+    return JSON.parse(await readFile8(path20.join(directory, "settings.json"), "utf8"))?.enabled === true;
   } catch {
     return false;
   }
@@ -31198,7 +31460,7 @@ var Lines = class {
 async function readEndpoint(directory) {
   let value;
   try {
-    value = JSON.parse(await readFile7(path19.join(directory, "endpoint.json"), "utf8"));
+    value = JSON.parse(await readFile8(path20.join(directory, "endpoint.json"), "utf8"));
   } catch {
     fail4("LOCAL_AGENT_NOT_RUNNING");
   }
@@ -31215,9 +31477,9 @@ var LocalDirectServer = class _LocalDirectServer {
   sockets = /* @__PURE__ */ new Set();
   /** Listens only while the owner has enabled direct local access; null otherwise. */
   static async start(options) {
-    const endpointFile = path19.join(options.directory, "endpoint.json");
+    const endpointFile = path20.join(options.directory, "endpoint.json");
     if (!await localDirectEnabled(options.directory)) {
-      await rm6(endpointFile, { force: true }).catch(() => {
+      await rm7(endpointFile, { force: true }).catch(() => {
       });
       return null;
     }
@@ -31243,7 +31505,7 @@ var LocalDirectServer = class _LocalDirectServer {
     for (const socket of this.sockets) socket.destroy();
     await new Promise((resolve) => this.server.close(() => resolve()));
     try {
-      if ((await readEndpoint(this.options.directory)).pid === process.pid) await rm6(path19.join(this.options.directory, "endpoint.json"), { force: true });
+      if ((await readEndpoint(this.options.directory)).pid === process.pid) await rm7(path20.join(this.options.directory, "endpoint.json"), { force: true });
     } catch {
     }
   }
@@ -35098,9 +35360,9 @@ var rev2026Codec = {
     });
     const parsed = buildSchemas2026().RequestMetaEnvelopeSchema.safeParse(meta3);
     if (!parsed.success) for (const issue2 of parsed.error.issues) {
-      const path29 = issue2.path.map(String);
-      const key = path29.length > 0 ? path29.join(".") : "_meta";
-      if (path29.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
+      const path30 = issue2.path.map(String);
+      const key = path30.length > 0 ? path30.join(".") : "_meta";
+      if (path30.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
       issues.push({
         key,
         problem: issue2.message
@@ -35402,29 +35664,29 @@ var PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
-  const visit2 = (node2, path29, reachable) => {
+  const visit2 = (node2, path30, reachable) => {
     if (node2 === null || typeof node2 !== "object") return void 0;
     const schema = node2;
     if (X_MCP_HEADER_KEY in schema) {
-      if (!reachable || path29.length === 0) return `${pathName(path29)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
+      if (!reachable || path30.length === 0) return `${pathName(path30)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
       const raw = schema[X_MCP_HEADER_KEY];
-      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path29)}: x-mcp-header MUST be a non-empty string`;
-      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path29)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
+      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path30)}: x-mcp-header MUST be a non-empty string`;
+      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path30)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       const type = typeof schema.type === "string" ? schema.type : void 0;
-      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path29)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path30)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
       const lower = raw.toLowerCase();
       const prior = seenLower.get(lower);
       if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
       seenLower.set(lower, raw);
       declarations.push({
-        path: path29,
+        path: path30,
         headerName: raw,
         type
       });
     }
     const properties = schema.properties;
     if (properties !== null && typeof properties === "object") for (const [key, child] of Object.entries(properties)) {
-      const fault$1 = visit2(child, [...path29, key], reachable);
+      const fault$1 = visit2(child, [...path30, key], reachable);
       if (fault$1 !== void 0) return fault$1;
     }
     for (const k of NON_REACHABLE_SUBSCHEMA_KEYWORDS) {
@@ -35432,7 +35694,7 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (sub === void 0) continue;
       const branches = Array.isArray(sub) ? sub : sub !== null && typeof sub === "object" && OBJECT_VALUED_SUBSCHEMA_KEYWORDS.has(k) ? Object.values(sub) : [sub];
       for (const branch of branches) {
-        const fault$1 = visit2(branch, [...path29, `<${k}>`], false);
+        const fault$1 = visit2(branch, [...path30, `<${k}>`], false);
         if (fault$1 !== void 0) return fault$1;
       }
     }
@@ -35472,8 +35734,8 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "$defs",
   "definitions"
 ]);
-function pathName(path29) {
-  return path29.length === 0 ? "<root>" : path29.join(".");
+function pathName(path30) {
+  return path30.length === 0 ? "<root>" : path30.join(".");
 }
 var HEADER_MISMATCH_ERROR_CODE = -32020;
 var INBOUND_VALIDATION_LADDER = [
@@ -35723,7 +35985,7 @@ var PROPERTY_KEYS_BY_TYPE = {
   array: shapeKeys([UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema])
 };
 var SUPPORTED_STRING_FORMATS = new Set(StringSchemaSchema.shape.format.unwrap().options);
-function walkProperty(node2, path29, vendor, unsupported) {
+function walkProperty(node2, path30, vendor, unsupported) {
   if (!isJsonObject(node2)) return node2;
   const allowedKeys = typeof node2.type === "string" && Object.hasOwn(PROPERTY_KEYS_BY_TYPE, node2.type) ? PROPERTY_KEYS_BY_TYPE[node2.type] : void 0;
   if (allowedKeys === void 0) return node2;
@@ -35731,8 +35993,8 @@ function walkProperty(node2, path29, vendor, unsupported) {
   for (const [key, value] of Object.entries(node2)) if (allowedKeys.has(key) || isAnnotationOnlyJsonSchemaKeyword(key)) pruned[key] = value;
   else if (key === "pattern" && node2.type === "string" && typeof node2.format === "string") {
     if (!SUPPORTED_STRING_FORMATS.has(node2.format)) pruned[key] = value;
-    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path29}.${key}`);
-  } else unsupported.push(`${path29}.${key}`);
+    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path30}.${key}`);
+  } else unsupported.push(`${path30}.${key}`);
   return pruned;
 }
 function walkRequestedSchema(converted, vendor) {
@@ -35749,11 +36011,11 @@ function describeUnsupportedProperties(pruned, fallback) {
   const offenders = Object.entries(pruned.properties).filter(([, node2]) => !parseSchema(PrimitiveSchemaDefinitionSchema, node2).success).map(([name2]) => `properties.${name2}`);
   return offenders.length > 0 ? offenders.join(", ") : fallback;
 }
-function findDroppedConstraintPaths(original, parsed, path29 = "") {
-  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path29}[${index}]`));
+function findDroppedConstraintPaths(original, parsed, path30 = "") {
+  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path30}[${index}]`));
   if (!isJsonObject(original) || !isJsonObject(parsed)) return [];
   return Object.entries(original).flatMap(([key, value]) => {
-    const childPath = path29 ? `${path29}.${key}` : key;
+    const childPath = path30 ? `${path30}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(parsed, key)) return isAnnotationOnlyJsonSchemaKeyword(key) ? [] : [childPath];
     return findDroppedConstraintPaths(value, parsed[key], childPath);
   });
@@ -39829,8 +40091,8 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     for (let i = 0; i < str.length; i++) if (str[i] === token) ind++;
     return ind;
   }
-  function removeDotSegments(path29) {
-    let input2 = path29;
+  function removeDotSegments(path30) {
+    let input2 = path30;
     const output2 = [];
     let nextSlash = -1;
     let len = 0;
@@ -39983,8 +40245,8 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       wsComponent.secure = void 0;
     }
     if (wsComponent.resourceName) {
-      const [path29, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path29 && path29 !== "/" ? path29 : void 0;
+      const [path30, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path30 && path30 !== "/" ? path30 : void 0;
       wsComponent.query = query;
       wsComponent.resourceName = void 0;
     }
@@ -45551,7 +45813,8 @@ var DESCRIPTIONS = {
   git_diff: ["Git diff of the repository at a workspace-relative path.", { readOnlyHint: true, openWorldHint: false }],
   git_log: ["Recent Git commits of the repository at a workspace-relative path.", { readOnlyHint: true, openWorldHint: false }],
   project_snapshot: ["Compact project overview: Git state and, with startup, AGENTS.md policy and task continuation.", { readOnlyHint: true, openWorldHint: false }],
-  command_run: ["Run one executable with an argument array (no shell parsing), hidden, with captured output. Uses this Windows account's rights within the owner's grant.", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
+  command_run: ["Run one executable with an argument array (no shell parsing), hidden, with captured output. Uses this user account's rights within the owner's grant.", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
+  take_screenshot: ["Take a still image of this computer's primary screen, returned as a JPEG image. Needs a Full Access workspace; the lock screen is never captured.", { readOnlyHint: true, openWorldHint: false }],
   localhost_request: ["HTTP request to a service on this computer (localhost only).", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }]
 };
 var workspace = external_exports.string().min(1).max(4096).optional().describe("Workspace grant id, root path (for example D:\\) or display name from workspace_list. Optional when only one workspace is approved.");
@@ -45564,6 +45827,14 @@ function failure4(error62) {
   return text2(code + hint, true);
 }
 function render(name2, result2) {
+  if (name2 === "take_screenshot" && result2.resultCode === "SUCCESS") {
+    try {
+      const { data, mimeType, ...metadata } = JSON.parse(result2.stdout);
+      if (typeof data === "string" && data && mimeType === "image/jpeg") return { content: [{ type: "image", data, mimeType }, { type: "text", text: JSON.stringify(metadata) }] };
+    } catch {
+    }
+    return text2(JSON.stringify({ resultCode: "SCREEN_UNAVAILABLE" }), true);
+  }
   if (name2 !== "command_run" && result2.resultCode === "SUCCESS") return text2(result2.stdout);
   const { exitCode, resultCode, timedOut, cancelled, stdout, stderr, stdoutTruncated, stderrTruncated } = result2;
   return text2(
@@ -45584,7 +45855,7 @@ async function serveLocalMcp(options) {
     return connecting;
   };
   const server = new McpServer({ name: "local-commander-local", version: options.agentVersion }, {
-    instructions: "Local Commander direct access to this computer, through the owner's approved workspaces. Paths are relative to the selected workspace root; call workspace_list to see roots. Commands run hidden with this Windows account's rights; owner denials still apply."
+    instructions: "Local Commander direct access to this computer, through the owner's approved workspaces. Paths are relative to the selected workspace root; call workspace_list to see roots. Commands run hidden with this user account's rights; owner denials still apply."
   });
   server.registerTool(
     "workspace_list",
@@ -45599,7 +45870,7 @@ async function serveLocalMcp(options) {
   );
   for (const option of ToolCallSchema.options) {
     const name2 = option.shape.name.value, entry = DESCRIPTIONS[name2];
-    if (!entry) continue;
+    if (!entry || name2 === "take_screenshot" && !screenshotEnabled()) continue;
     const inputSchema = option.shape.args.extend({ workspace });
     const callback = async (input2, ctx) => {
       const { workspace: selected, ...args } = input2;
@@ -46035,7 +46306,8 @@ async function connectOnce(options) {
       tenantId,
       deviceId,
       guardIdentity: true,
-      ...options.aiConnectivity ? { aiConnectivity: true } : {}
+      ...options.aiConnectivity ? { aiConnectivity: true } : {},
+      ...options.onHeldLeases ? { heldLeases: true } : {}
     }, maxFrameBytes);
     const challenge = validateChallenge(await waitForMessage(socket, maxFrameBytes, connectTimeoutMs, "RELAY_HANDSHAKE_TIMEOUT"), protocolVersion2);
     const machine = challenge.machineIdentity ? options.machineIdentity?.(deviceId) ?? null : null;
@@ -46069,8 +46341,22 @@ async function connectOnce(options) {
       const { safeSlots, active, queued, paused } = nativeStatus();
       sendJson(socket, NativeStatusSchema.parse({ type: "nativeStatus", protocolVersion: 1, connectionEpoch, agentVersion: options.agentVersion, safeSlots, active, queued, paused }), maxFrameBytes);
     };
+    let watchdog;
+    const armWatchdog = () => {
+      clearTimeout(watchdog);
+      watchdog = setTimeout(() => {
+        process.stderr.write("RELAY_HEARTBEAT_LOST\n");
+        socket.terminate();
+      }, monitorHeartbeat * 3);
+      watchdog.unref();
+    };
+    if (monitorHeartbeat) {
+      armWatchdog();
+      socket.once("close", () => clearTimeout(watchdog));
+    }
     if (monitorHeartbeat) socket.on("ping", (data) => {
       if (data.toString() !== "lcmcp-monitor:" + connectionEpoch) return;
+      armWatchdog();
       try {
         void Promise.resolve(options.onMonitorHeartbeat?.()).catch(() => {
         });
@@ -46158,6 +46444,15 @@ async function connectOnce(options) {
             ack.data.ok ? pending.resolve() : pending.reject(new RelayClientError("RELAY_RESULT_REJECTED"));
             return;
           }
+          if (frame.type === "heldLeases") {
+            const held = HeldLeasesFrameSchema.safeParse(frame);
+            if (!held.success || !options.onHeldLeases || held.data.connectionEpoch !== connectionEpoch) fail5("RELAY_FRAME_INVALID");
+            try {
+              options.onHeldLeases(held.data.bindings);
+            } catch {
+            }
+            return;
+          }
           if (frame.type === "workspace_ack") {
             const ack = ServerFrameSchema.safeParse(frame);
             if (!ack.success || ack.data.type !== "workspace_ack" || !pendingWorkspace.has(ack.data.requestId)) fail5("RELAY_FRAME_INVALID");
@@ -46314,10 +46609,10 @@ async function connectOnce(options) {
 // agent/src/machine-identity.ts
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import os5 from "node:os";
+import os6 from "node:os";
 import { open as open7 } from "node:fs/promises";
 import { constants as constants8 } from "node:fs";
-import path20 from "node:path";
+import path21 from "node:path";
 var MACHINE_GUID = /^\s*MachineGuid\s+REG_SZ\s+([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\s*$/m;
 async function readMachineGuid(timeoutMs2 = 5e3) {
   if (process.platform === "linux") {
@@ -46338,7 +46633,7 @@ async function readMachineGuid(timeoutMs2 = 5e3) {
     }
   }
   if (!["win32", "darwin"].includes(process.platform)) return null;
-  const reg = process.platform === "darwin" ? "/usr/sbin/ioreg" : path20.join(process.env.SystemRoot || "C:\\Windows", "System32", "reg.exe");
+  const reg = process.platform === "darwin" ? "/usr/sbin/ioreg" : path21.join(process.env.SystemRoot || "C:\\Windows", "System32", "reg.exe");
   const args = process.platform === "darwin" ? ["-rd1", "-c", "IOPlatformExpertDevice"] : ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid", "/reg:64"];
   const pattern = process.platform === "darwin" ? /"IOPlatformUUID"\s*=\s*"([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})"/ : MACHINE_GUID;
   return new Promise((resolve) => {
@@ -46367,7 +46662,52 @@ async function readMachineGuid(timeoutMs2 = 5e3) {
     child.on("close", (code) => finish(code === 0 ? pattern.exec(output2)?.[1]?.toLowerCase() ?? null : null));
   });
 }
-function machineProof(deviceId, machineGuid, computerName = os5.hostname()) {
+async function readComputerName(timeoutMs2 = 5e3) {
+  const valid = (name2) => !!name2 && name2.length <= 120 && name2.trim() === name2 && !/[\u0000-\u001f\u007f]/.test(name2);
+  if (process.platform === "linux") {
+    let handle;
+    try {
+      handle = await open7("/etc/hostname", constants8.O_RDONLY | constants8.O_NOFOLLOW);
+      const data = Buffer.alloc(257), { bytesRead } = await handle.read(data, 0, data.length, 0);
+      const name2 = data.subarray(0, bytesRead).toString("utf8").trim();
+      if (bytesRead <= 256 && valid(name2)) return name2;
+    } catch {
+    } finally {
+      await handle?.close().catch(() => {
+      });
+    }
+  }
+  if (process.platform === "darwin") {
+    const name2 = await new Promise((resolve) => {
+      let output2 = "", settled = false;
+      const finish = (value) => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolve(value);
+        }
+      };
+      const child = spawn5("/usr/sbin/scutil", ["--get", "ComputerName"], { shell: false, stdio: ["ignore", "pipe", "ignore"], env: buildChildEnvironment(process.env) });
+      const timer = setTimeout(() => {
+        child.kill();
+        finish("");
+      }, timeoutMs2);
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        if (output2.length + chunk.length <= 1024) output2 += chunk;
+        else {
+          child.kill();
+          finish("");
+        }
+      });
+      child.on("error", () => finish(""));
+      child.on("close", (code) => finish(code === 0 ? output2.replace(/\n$/, "") : ""));
+    });
+    if (valid(name2)) return name2;
+  }
+  return os6.hostname();
+}
+function machineProof(deviceId, machineGuid, computerName = os6.hostname()) {
   const name2 = computerName.slice(0, 120);
   if (!name2 || name2.trim() !== name2 || /[\u0000-\u001f\u007f]/.test(name2)) return null;
   const fingerprint3 = createHash16("sha256").update("lcmcp-machine-v1\0" + deviceId.toLowerCase() + "\0" + machineGuid.toLowerCase() + "\0" + name2.toUpperCase(), "utf8").digest("hex");
@@ -46408,8 +46748,8 @@ function canonicalOrigin2(value) {
     fail6("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path29) {
-  return origin + path29;
+function endpoint(origin, path30) {
+  return origin + path30;
 }
 function uuid21(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail6(code);
@@ -46911,15 +47251,15 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 
 // agent/src/optimization-ledger.ts
 import { constants as constants9 } from "node:fs";
-import { lstat as lstat8, mkdir as mkdir8, open as open8, readFile as readFile8, realpath as realpath8 } from "node:fs/promises";
-import path21 from "node:path";
+import { lstat as lstat8, mkdir as mkdir8, open as open8, readFile as readFile9, realpath as realpath8 } from "node:fs/promises";
+import path22 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure5(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path21.resolve(directory);
+  const absolute2 = path22.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
@@ -46927,7 +47267,7 @@ async function safeDirectory2(directory) {
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path21.dirname(current2);
+    const parent = path22.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
@@ -46962,15 +47302,15 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path21.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path21.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path22.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path22.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
       const stat2 = await lstat8(filename);
       if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > MAX_LEDGER_BYTES) {
         throw failure5("OPTIMIZATION_LEDGER_INVALID");
       }
-      existing = await readFile8(filename, "utf8");
+      existing = await readFile9(filename, "utf8");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
@@ -46984,7 +47324,7 @@ var OptimizationLedger = class _OptimizationLedger {
       try {
         const noticeStat = await lstat8(noticesFilename);
         if (!noticeStat.isFile() || noticeStat.isSymbolicLink() || noticeStat.size > MAX_NOTICE_LEDGER_BYTES) throw failure5("OPTIMIZATION_NOTICE_LEDGER_INVALID");
-        const notices = await readFile8(noticesFilename, "utf8");
+        const notices = await readFile9(noticesFilename, "utf8");
         for (const line of notices.split("\n")) {
           if (!line) continue;
           const parsed = JSON.parse(line);
@@ -47112,9 +47452,9 @@ var OptimizationLedger = class _OptimizationLedger {
 
 // agent/src/monitor.ts
 import { createHash as createHash17, randomUUID as randomUUID12 } from "node:crypto";
-import { lstat as lstat9, mkdir as mkdir9, open as open9, rename as rename6, rm as rm7 } from "node:fs/promises";
-import path22 from "node:path";
-import os6 from "node:os";
+import { lstat as lstat9, mkdir as mkdir9, open as open9, rename as rename6, rm as rm8 } from "node:fs/promises";
+import path23 from "node:path";
+import os7 from "node:os";
 
 // packages/agent-cli/bin/monitor-savings.mjs
 var count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e15;
@@ -47136,7 +47476,7 @@ function lifetimeSavingsView(raw) {
 // agent/src/monitor.ts
 function commandSummary2(tool) {
   if (tool.name !== "command_run") return { name: tool.name, command: tool.name };
-  const candidate = path22.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
+  const candidate = path23.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
   const name2 = ["node", "npm", "npx", "git", "rg", "powershell", "pwsh", "cmd", "tsc", "python", "dotnet"].includes(candidate) ? candidate : "command";
   let command = name2;
   if (name2 === "node" && tool.args.args.includes("--test") && !tool.args.args.some((arg) => ["-e", "--eval", "-p", "--print"].includes(arg))) command += " --test";
@@ -47149,9 +47489,9 @@ function commandSummary2(tool) {
 var ProductionMonitor = class {
   constructor(directory, stateDirectory, agentVersion3) {
     this.agentVersion = agentVersion3;
-    const key = createHash17("sha256").update(path22.resolve(stateDirectory).toLowerCase()).digest("hex");
-    this.file = path22.join(directory, key + ".json");
-    this.transportFile = path22.join(directory, key + ".transport");
+    const key = createHash17("sha256").update(path23.resolve(stateDirectory).toLowerCase()).digest("hex");
+    this.file = path23.join(directory, key + ".json");
+    this.transportFile = path23.join(directory, key + ".transport");
   }
   agentVersion;
   instanceId = randomUUID12();
@@ -47162,7 +47502,7 @@ var ProductionMonitor = class {
   measured = /* @__PURE__ */ new Set();
   polls = { status: 0, output: 0 };
   efficiencyCalls = 0;
-  computer = os6.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
+  computer = os7.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
   sequence = 0;
   connection = {
     state: "starting",
@@ -47343,7 +47683,7 @@ var ProductionMonitor = class {
       schemaVersion: 1,
       instanceId: this.instanceId,
       pid: process.pid,
-      savingsSourceId: path22.basename(this.file, ".json"),
+      savingsSourceId: path23.basename(this.file, ".json"),
       lifetimeSavings: this.lifetimeSavings && { ...this.lifetimeSavings },
       computer: this.computer,
       processName: "lc-agent",
@@ -47377,7 +47717,7 @@ var ProductionMonitor = class {
     return this.writing;
   }
   async write(file2, contents) {
-    const directory = path22.dirname(file2);
+    const directory = path23.dirname(file2);
     await mkdir9(directory, { recursive: true, mode: 448 });
     const stat2 = await lstat9(directory);
     if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
@@ -47391,7 +47731,7 @@ var ProductionMonitor = class {
       }
       await rename6(temporary, file2);
     } finally {
-      await rm7(temporary, { force: true });
+      await rm8(temporary, { force: true });
     }
   }
   async close() {
@@ -47802,13 +48142,13 @@ var NativeFabricObserver = class {
 };
 
 // agent/src/native-fabric-startup.ts
-import { lstat as lstat11, mkdir as mkdir12, open as open11, readFile as readFile9 } from "node:fs/promises";
-import path25 from "node:path";
+import { lstat as lstat11, mkdir as mkdir12, open as open11, readFile as readFile10 } from "node:fs/promises";
+import path26 from "node:path";
 
 // src/agent-fabric-service.ts
 import { lstat as lstat10, mkdir as mkdir11, realpath as realpath9 } from "node:fs/promises";
 import { watch } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/agent-runtime-identity.ts
 import { createHash as createHash19, randomBytes as randomBytes7, randomUUID as randomUUID14, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
@@ -47816,13 +48156,13 @@ import { createHash as createHash19, randomBytes as randomBytes7, randomUUID as
 // src/agent-fabric-state.ts
 import { randomUUID as randomUUID13 } from "node:crypto";
 import { mkdir as mkdir10, open as open10, rename as rename7, unlink as unlink2 } from "node:fs/promises";
-import path23 from "node:path";
+import path24 from "node:path";
 var queues = /* @__PURE__ */ new Map();
 var FabricStateFile = class {
   constructor(file2, maxBytes, parse3) {
     this.maxBytes = maxBytes;
     this.parse = parse3;
-    this.file = path23.resolve(file2);
+    this.file = path24.resolve(file2);
   }
   maxBytes;
   parse;
@@ -47866,7 +48206,7 @@ var FabricStateFile = class {
   }
   update(fn, create) {
     return this.serial(async () => {
-      if (create) await mkdir10(path23.dirname(this.file), { recursive: true });
+      if (create) await mkdir10(path24.dirname(this.file), { recursive: true });
       const lockPath = this.file + ".lock";
       const token = randomUUID13();
       const lock = await open10(lockPath, "wx", 384).catch((error62) => {
@@ -48510,9 +48850,9 @@ var WorkerRequest = external_exports.discriminatedUnion("operation", [
 var AgentFabricService = class _AgentFabricService {
   constructor(directory, controllerId) {
     this.directory = directory;
-    this.identities = new AgentRuntimeIdentityStore(path24.join(directory, "identities.json"));
+    this.identities = new AgentRuntimeIdentityStore(path25.join(directory, "identities.json"));
     this.mailbox = new AgentWorkerMailbox(
-      path24.join(directory, "mailbox.json"),
+      path25.join(directory, "mailbox.json"),
       controllerId,
       this.identities,
       void 0,
@@ -48527,21 +48867,21 @@ var AgentFabricService = class _AgentFabricService {
   closed = false;
   static async open(directory, controllerId, device = null, initialize = true) {
     const expected = Binding.parse({ version: 1, controllerId, device, initialized: false });
-    const absolute2 = path24.resolve(directory);
-    for (let current2 = absolute2; ; current2 = path24.dirname(current2)) {
+    const absolute2 = path25.resolve(directory);
+    for (let current2 = absolute2; ; current2 = path25.dirname(current2)) {
       try {
         if ((await lstat10(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
-      if (path24.dirname(current2) === current2) break;
+      if (path25.dirname(current2) === current2) break;
     }
     if (initialize) await mkdir11(absolute2, { recursive: true, mode: 448 });
     if (!(await lstat10(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
       throw Error("FABRIC_DIRECTORY_INVALID");
     const present = /* @__PURE__ */ new Set();
     for (const name2 of ["binding.json", "mailbox.json", "identities.json"]) {
-      const file2 = await lstat10(path24.join(absolute2, name2)).catch((error62) => {
+      const file2 = await lstat10(path25.join(absolute2, name2)).catch((error62) => {
         if (error62.code === "ENOENT") return null;
         throw error62;
       });
@@ -48549,7 +48889,7 @@ var AgentFabricService = class _AgentFabricService {
       if (file2) present.add(name2);
     }
     if (!present.has("binding.json") && present.size) throw Error("FABRIC_BINDING_MISSING");
-    const binding2 = new FabricStateFile(path24.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
+    const binding2 = new FabricStateFile(path25.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
     const service2 = new _AgentFabricService(absolute2, controllerId);
     await binding2.update(async (state) => {
       if (state.controllerId !== expected.controllerId || JSON.stringify(state.device) !== JSON.stringify(expected.device))
@@ -48564,7 +48904,7 @@ var AgentFabricService = class _AgentFabricService {
         state.initialized = true;
       }
       const snapshot2 = await service2.mailbox.snapshot();
-      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat10(path24.join(absolute2, "identities.json"));
+      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat10(path25.join(absolute2, "identities.json"));
     }, initialize ? () => expected : void 0);
     return service2;
   }
@@ -48651,7 +48991,7 @@ var Delivery = external_exports.strictObject({ capability: external_exports.stri
 async function openNativeFabric(stateDirectory, enrollment, box, initialize = true) {
   const controllerId = "device-" + external_exports.string().uuid().parse(enrollment.deviceId).toLowerCase();
   const tenantId = external_exports.string().uuid().parse(enrollment.tenantId).toLowerCase();
-  const parent = path25.join(stateDirectory, ".local-commander"), marker = path25.join(parent, "fabric-established.json");
+  const parent = path26.join(stateDirectory, ".local-commander"), marker = path26.join(parent, "fabric-established.json");
   try {
     await mkdir12(parent, { mode: 448 });
   } catch (error62) {
@@ -48663,7 +49003,7 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
   let fresh = false;
   try {
     const info = await lstat11(marker);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile9(marker, "utf8") !== expected)
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile10(marker, "utf8") !== expected)
       throw Error("FABRIC_BINDING_CHANGED");
   } catch (error62) {
     if (error62.code !== "ENOENT" || !initialize) throw error62;
@@ -48677,13 +49017,13 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
     fresh = true;
   }
   const service2 = await AgentFabricService.open(
-    path25.join(stateDirectory, ".local-commander", "fabric"),
+    path26.join(stateDirectory, ".local-commander", "fabric"),
     controllerId,
     { deviceId: enrollment.deviceId.toLowerCase(), enrollmentEvidenceRef: "enrollment-" + tenantId },
     fresh
   );
   const purpose = "native-fabric:" + tenantId + ":" + controllerId;
-  const credentialFile = (workerId) => path25.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
+  const credentialFile = (workerId) => path26.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
   const decode4 = (value) => {
     const credential = Credential.parse(JSON.parse(box.open(Buffer.from(value, "base64"), purpose).toString("utf8")));
     if (credential.controllerId !== controllerId) throw Error("FABRIC_WORKER_DENIED");
@@ -48692,7 +49032,7 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
   async function capability(workerId) {
     const file2 = credentialFile(workerId), info = await lstat11(file2);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw Error("FABRIC_CREDENTIAL_UNKNOWN");
-    const encoded = await readFile9(file2, "utf8");
+    const encoded = await readFile10(file2, "utf8");
     if (decode4(encoded).workerId !== workerId) throw Error("FABRIC_WORKER_DENIED");
     return encoded;
   }
@@ -48784,7 +49124,7 @@ async function readFabricRequest(input2 = process.stdin) {
 
 // agent/src/supervisor-liveness.ts
 import { spawn as spawn6 } from "node:child_process";
-import path26 from "node:path";
+import path27 from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 var ROW = /^"([^"]+)","(\d{1,10})"/;
 function parseTasklist(output2, image) {
@@ -48799,7 +49139,7 @@ function parseTasklist(output2, image) {
 }
 function listProcesses(image, timeoutMs2 = 5e3) {
   if (process.platform !== "win32" || !/^[A-Za-z0-9._-]{1,64}\.exe$/i.test(image)) return Promise.resolve(null);
-  const tasklist = path26.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
+  const tasklist = path27.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
   return new Promise((resolve) => {
     let output2 = "", settled = false;
     const finish = (value) => {
@@ -48828,8 +49168,8 @@ function listProcesses(image, timeoutMs2 = 5e3) {
 }
 function supervisorLiveness(helperPath, options = {}) {
   if (process.platform === "linux" && !options.list) return linuxSupervisorLiveness;
-  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path26.join(path26.dirname(helperPath), "posix-host"), pids, darwin);
-  const image = path26.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
+  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path27.join(path27.dirname(helperPath), "posix-host"), pids, darwin);
+  const image = path27.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
   return async (pids) => {
     const deadline = Date.now() + waitMs;
     for (; ; ) {
@@ -48844,8 +49184,8 @@ function supervisorLiveness(helperPath, options = {}) {
 
 // agent/src/content-audit.ts
 import { createReadStream } from "node:fs";
-import { appendFile, lstat as lstat12, mkdir as mkdir13, open as open12, readdir as readdir5, readFile as readFile10, rename as rename8, rm as rm8, writeFile as writeFile4 } from "node:fs/promises";
-import path27 from "node:path";
+import { appendFile, lstat as lstat12, mkdir as mkdir13, open as open12, readdir as readdir5, readFile as readFile11, rename as rename8, rm as rm9, writeFile as writeFile4 } from "node:fs/promises";
+import path28 from "node:path";
 import { performance as performance3 } from "node:perf_hooks";
 import { createInterface as createInterface2 } from "node:readline";
 import { randomBytes as randomBytes9 } from "node:crypto";
@@ -49014,7 +49354,7 @@ var FILE = /^(full|metrics)-(\d{4}-\d{2}-\d{2})\.jsonl$/;
 var PAUSED_FILE = "paused.json";
 var DAY_MS = 864e5;
 function contentAuditDirectory(stateDir) {
-  return path27.join(path27.dirname(path27.resolve(stateDir)), "Audit");
+  return path28.join(path28.dirname(path28.resolve(stateDir)), "Audit");
 }
 async function plainDirectory(dir) {
   await mkdir13(dir, { recursive: true, mode: 448 });
@@ -49033,7 +49373,7 @@ async function auditFiles(dir) {
   for (const name2 of names) {
     const match = FILE.exec(name2);
     if (!match) continue;
-    const info = await lstat12(path27.join(dir, name2));
+    const info = await lstat12(path28.join(dir, name2));
     if (info.isFile()) files.push({ name: name2, kind: match[1], day: match[2], bytes: info.size });
   }
   return files.sort((a, b) => a.name.localeCompare(b.name));
@@ -49044,7 +49384,7 @@ async function writeJsonAtomic(file2, value) {
     await writeFile4(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
     await rename8(temp, file2);
   } finally {
-    await rm8(temp, { force: true }).catch(() => {
+    await rm9(temp, { force: true }).catch(() => {
     });
   }
 }
@@ -49071,7 +49411,7 @@ var ContentAudit = class _ContentAudit {
   skipped = 0;
   closed = false;
   static async open(options) {
-    const dir = path27.resolve(options.directory);
+    const dir = path28.resolve(options.directory);
     await plainDirectory(dir);
     const audit = new _ContentAudit(
       dir,
@@ -49080,7 +49420,7 @@ var ContentAudit = class _ContentAudit {
       { retentionDays: options.retentionDays ?? AUDIT_RETENTION_DAYS, maxBytes: options.maxBytes ?? AUDIT_MAX_BYTES },
       options.now ?? (() => /* @__PURE__ */ new Date())
     );
-    await rm8(path27.join(dir, PAUSED_FILE), { force: true });
+    await rm9(path28.join(dir, PAUSED_FILE), { force: true });
     await audit.rollover(audit.now());
     if (audit.usedBytes >= audit.limits.maxBytes) await audit.pause("QUOTA_EXCEEDED");
     return audit;
@@ -49150,8 +49490,8 @@ var ContentAudit = class _ContentAudit {
       await this.pause("QUOTA_EXCEEDED");
       return;
     }
-    await appendFile(path27.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
-    await appendFile(path27.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
+    await appendFile(path28.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
+    await appendFile(path28.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
     this.usedBytes += bytes3;
   }
   /** Daily retention runs on the first write of a new day; no timer or background scan. */
@@ -49160,7 +49500,7 @@ var ContentAudit = class _ContentAudit {
     const cutoff = new Date(at.getTime() - this.limits.retentionDays * DAY_MS).toISOString().slice(0, 10);
     let used = 0;
     for (const file2 of await auditFiles(this.dir)) {
-      if (file2.day <= cutoff) await rm8(path27.join(this.dir, file2.name), { force: true });
+      if (file2.day <= cutoff) await rm9(path28.join(this.dir, file2.name), { force: true });
       else used += file2.bytes;
     }
     this.usedBytes = used;
@@ -49168,7 +49508,7 @@ var ContentAudit = class _ContentAudit {
   async pause(reason) {
     if (this.paused) return;
     this.paused = reason;
-    await writeJsonAtomic(path27.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
+    await writeJsonAtomic(path28.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
   }
 };
 function percentiles(values) {
@@ -49190,13 +49530,13 @@ async function* jsonLines(file2) {
 }
 var count2 = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
 async function summarizeContentAudit(directory, key) {
-  const dir = path27.resolve(directory);
+  const dir = path28.resolve(directory);
   const files = await auditFiles(dir);
   const days = /* @__PURE__ */ new Map();
   const sizes = [];
   const timings = [];
   for (const file2 of files.filter((f) => f.kind === "metrics")) {
-    for await (const line of jsonLines(path27.join(dir, file2.name))) {
+    for await (const line of jsonLines(path28.join(dir, file2.name))) {
       let day = days.get(file2.day);
       if (!day) {
         day = { day: file2.day, records: 0, failed: 0, rawBytes: 0, sanitizedBytes: 0, compressedBytes: 0, envelopeBytes: 0 };
@@ -49216,7 +49556,7 @@ async function summarizeContentAudit(directory, key) {
   }
   let paused = null;
   try {
-    const value = JSON.parse(await readFile10(path27.join(dir, PAUSED_FILE), "utf8"));
+    const value = JSON.parse(await readFile11(path28.join(dir, PAUSED_FILE), "utf8"));
     if (typeof value.reason === "string" && typeof value.at === "string") paused = { reason: value.reason.slice(0, 40), at: value.at.slice(0, 40) };
   } catch {
   }
@@ -49224,7 +49564,7 @@ async function summarizeContentAudit(directory, key) {
   const newest = files.filter((f) => f.kind === "full").at(-1);
   if (key && newest) {
     const tail = [];
-    for await (const line of jsonLines(path27.join(dir, newest.name))) {
+    for await (const line of jsonLines(path28.join(dir, newest.name))) {
       tail.push(line);
       if (tail.length > 5) tail.shift();
     }
@@ -49258,10 +49598,10 @@ async function summarizeContentAudit(directory, key) {
   };
 }
 async function restoreContentAudit(input2, output2, key) {
-  const handle = await open12(path27.resolve(output2), "wx", 384);
+  const handle = await open12(path28.resolve(output2), "wx", 384);
   let records = 0, failed = 0;
   try {
-    for await (const line of jsonLines(path27.resolve(input2))) {
+    for await (const line of jsonLines(path28.resolve(input2))) {
       try {
         await handle.appendFile(JSON.stringify(decryptAuditRecord(line, key)) + "\n");
         records += 1;
@@ -49276,7 +49616,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.44" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.46" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 function processAlive(pid) {
@@ -49290,7 +49630,7 @@ function processAlive(pid) {
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
   await mkdir14(stateDir, { recursive: true });
-  const file2 = path28.join(stateDir, "agent-process.json");
+  const file2 = path29.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       const handle = await open13(file2, "wx", 384);
@@ -49301,8 +49641,8 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       }
       return async () => {
         try {
-          const current2 = JSON.parse(await readFile11(file2, "utf8"));
-          if (current2.pid === process.pid) await rm9(file2, { force: true });
+          const current2 = JSON.parse(await readFile12(file2, "utf8"));
+          if (current2.pid === process.pid) await rm10(file2, { force: true });
         } catch {
         }
       };
@@ -49310,12 +49650,12 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       if (!error62 || typeof error62 !== "object" || !("code" in error62) || error62.code !== "EEXIST") throw error62;
       let stale = true;
       try {
-        const current2 = JSON.parse(await readFile11(file2, "utf8"));
+        const current2 = JSON.parse(await readFile12(file2, "utf8"));
         stale = typeof current2.pid !== "number" || !processAlive(current2.pid);
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm9(file2, { force: true });
+      await rm10(file2, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -49355,7 +49695,8 @@ async function runAgent(options) {
     throw error62;
   }
   const machineGuid = await readMachineGuid();
-  const machineIdentity = machineGuid ? (deviceId) => machineProof(deviceId, machineGuid) : void 0;
+  let computerName = "";
+  const machineIdentity = machineGuid ? (deviceId) => machineProof(deviceId, machineGuid, computerName) : void 0;
   const ledger = options.efficiencyLedger;
   monitor(() => options.monitor?.setLifetimeSavings(ledger?.savingsSnapshot?.()));
   const efficiencyLedger = ledger && {
@@ -49422,6 +49763,7 @@ async function runAgent(options) {
   });
   try {
     while (!options.signal.aborted) {
+      computerName = await readComputerName();
       let ready;
       const readyPromise = new Promise((resolve) => {
         ready = resolve;
@@ -49436,6 +49778,11 @@ async function runAgent(options) {
           safeSlots: runtime.status().safeSlots,
           status: () => runtime.status(),
           onIncidentAck: (ack) => incidentProducer.ack(ack),
+          // After bridge.connected, like requests: the journal has recorded this connection first.
+          onHeldLeases: (bindings) => {
+            void readyPromise.then(() => bridge.heldLeases(bindings)).catch(() => {
+            });
+          },
           handleRequest: async (request) => {
             await readyPromise;
             monitor(() => {
@@ -49559,10 +49906,10 @@ async function openContentAudit(store, stateDir) {
 async function main() {
   if (!["win32", "linux", "darwin"].includes(process.platform)) throw Error("PLATFORM_UNSUPPORTED");
   const appData = process.env.LC_AGENT_DATA_DIR ?? (process.platform === "win32" ? process.env.LOCALAPPDATA : posixDataHome());
-  if (!appData || !path28.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path28.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path28.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path28.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
+  if (!appData || !path29.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path29.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path29.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path29.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (process.platform !== "win32" && (command.startsWith("guard-") || command.startsWith("network-"))) throw Error("FEATURE_PLATFORM_UNSUPPORTED");
@@ -49572,7 +49919,7 @@ async function main() {
     const pairing = new PairingClient(store, { controlPlaneOrigin: origin, agentVersion: AGENT_VERSION2 });
     const begun = await pairing.begin();
     process.stdout.write(JSON.stringify({ approvalUrl: begun.approvalUrl, confirmationCode: begun.confirmationCode, expiresAt: begun.expiresAt.toISOString() }) + "\n");
-    await pairing.waitAndComplete(begun, os7.hostname().slice(0, 120));
+    await pairing.waitAndComplete(begun, os8.hostname().slice(0, 120));
     process.stdout.write("DEVICE_PAIRED\n");
     return;
   }
@@ -49657,7 +50004,7 @@ async function main() {
   }
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path28.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path29.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -49667,7 +50014,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path28.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path29.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -49686,7 +50033,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path28.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -49698,7 +50045,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path28.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -49776,27 +50123,27 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
-  const monitor = new ProductionMonitor(path28.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path29.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
   const publishMonitor = () => monitor.flush().catch(() => {
     process.stderr.write("MONITOR_WRITE_FAILED\n");
   });
   await publishMonitor();
   try {
     const journal = await NativeJournal.open(
-      path28.join(stateDir, "journal"),
+      path29.join(stateDir, "journal"),
       new SecretBox({ "1": await store.loadDataKey() }),
-      process.platform === "win32" ? {} : { lockHelper: path28.join(binaryDir, "posix-host") }
+      process.platform === "win32" ? {} : { lockHelper: path29.join(binaryDir, "posix-host") }
     );
     const ledgerLoss = () => {
       process.stderr.write("OPTIMIZATION_TELEMETRY_INCOMPLETE\n");
     };
     const efficiencyLedger = await new OptionalWork(ledgerLoss, 1e3, 1).run(
-      () => OptimizationLedger.open(path28.join(stateDir, "optimization")),
+      () => OptimizationLedger.open(path29.join(stateDir, "optimization")),
       void 0,
       (ledger) => ledger.close()
     );
     try {
-      const helperPath = process.env.LC_JOB_HOST ?? path28.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
+      const helperPath = process.env.LC_JOB_HOST ?? path29.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
       const tools = new NativeTools({ stateDirectory: stateDir, helperPath, ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
@@ -49867,7 +50214,7 @@ async function main() {
     await releaseProcess();
   }
 }
-var entrypoint = process.argv[1] && (process.platform === "win32" ? path28.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
+var entrypoint = process.argv[1] && (process.platform === "win32" ? path29.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
 if (entrypoint === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";