local-commander-agent 0.3.45 → 0.3.47

package/runtime/agent.mjs

@@ -2125,7 +2125,7 @@ var require_extension = __commonJS({
       if (dest[name2] === void 0) dest[name2] = [elem];
       else dest[name2].push(elem);
     }
-    function parse3(header) {
+    function parse4(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -2265,7 +2265,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse: parse3 };
+    module.exports = { format, parse: parse4 };
   }
 });
 
@@ -2276,9 +2276,9 @@ var require_websocket = __commonJS({
     var EventEmitter = __require("events");
     var https2 = __require("https");
     var http2 = __require("http");
-    var net2 = __require("net");
+    var net3 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes10, createHash: createHash21 } = __require("crypto");
+    var { randomBytes: randomBytes11, createHash: createHash21 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2299,7 +2299,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format, parse: parse3 } = require_extension();
+    var { format, parse: parse4 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = /* @__PURE__ */ Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -2829,7 +2829,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes10(16).toString("base64");
+      const key = randomBytes11(16).toString("base64");
       const request = isSecure ? https2.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -2989,7 +2989,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse3(secWebSocketExtensions);
+            extensions = parse4(secWebSocketExtensions);
           } catch (err) {
             const message2 = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message2);
@@ -3033,12 +3033,12 @@ var require_websocket = __commonJS({
     }
     function netConnect2(options) {
       options.path = options.socketPath;
-      return net2.connect(options);
+      return net3.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net2.isIP(options.host) ? "" : options.host;
+        options.servername = net3.isIP(options.host) ? "" : options.host;
       }
       return tls2.connect(options);
     }
@@ -3281,7 +3281,7 @@ var require_subprotocol = __commonJS({
   "../../node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function parse3(header) {
+    function parse4(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -3317,7 +3317,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol2);
       return protocols;
     }
-    module.exports = { parse: parse3 };
+    module.exports = { parse: parse4 };
   }
 });
 
@@ -4541,10 +4541,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path29) {
-  if (!path29)
+function getElementAtPath(obj, path30) {
+  if (!path30)
     return obj;
-  return path29.reduce((acc, key) => acc?.[key], obj);
+  return path30.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4884,11 +4884,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path29, issues) {
+function prefixIssues(path30, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path29);
+    iss.path.unshift(path30);
     return iss;
   });
 }
@@ -5338,16 +5338,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path29 = []) => {
+  const processError = (error63, path30 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else {
-        const fullpath = [...path29, ...issue2.path];
+        const fullpath = [...path30, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5386,17 +5386,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path29 = []) => {
+  const processError = (error63, path30 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
       } else {
-        const fullpath = [...path29, ...issue2.path];
+        const fullpath = [...path30, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5435,8 +5435,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path29 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path29) {
+  const path30 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path30) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -5570,18 +5570,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result2.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse4 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse4(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -22538,13 +22538,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path29 = ref.slice(1).split("/").filter(Boolean);
-  if (path29.length === 0) {
+  const path30 = ref.slice(1).split("/").filter(Boolean);
+  if (path30.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path29[0] === defsKey) {
-    const key = path29[1] === void 0 ? void 0 : decodeJSONPointerSegment(path29[1]);
+  if (path30[0] === defsKey) {
+    const key = path30[1] === void 0 ? void 0 : decodeJSONPointerSegment(path30[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23179,7 +23179,7 @@ function visit(schema, fnOrHandlers) {
     return h ? h(node2, rewritten) : node2;
   };
   const cache2 = /* @__PURE__ */ new Map();
-  function run(s) {
+  function run2(s) {
     const cached2 = cache2.get(s);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
@@ -23205,21 +23205,21 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newShape = {};
         for (const k of keys) {
-          const mapped = run(oldShape[k]);
+          const mapped = run2(oldShape[k]);
           if (mapped !== oldShape[k])
             changed = true;
           newShape[k] = mapped;
         }
         let newCatchall = def.catchall;
         if (def.catchall) {
-          newCatchall = run(def.catchall);
+          newCatchall = run2(def.catchall);
           if (newCatchall !== def.catchall)
             changed = true;
         }
         return changed ? clone(s, { ...def, shape: newShape, catchall: newCatchall }) : s;
       }
       case "array": {
-        const mapped = run(def.element);
+        const mapped = run2(def.element);
         return mapped === def.element ? s : clone(s, { ...def, element: mapped });
       }
       case "tuple": {
@@ -23227,14 +23227,14 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newItems = [];
         for (const item of oldItems) {
-          const mapped = run(item);
+          const mapped = run2(item);
           if (mapped !== item)
             changed = true;
           newItems.push(mapped);
         }
         let newRest = def.rest;
         if (def.rest) {
-          newRest = run(def.rest);
+          newRest = run2(def.rest);
           if (newRest !== def.rest)
             changed = true;
         }
@@ -23242,12 +23242,12 @@ function visit(schema, fnOrHandlers) {
       }
       case "record":
       case "map": {
-        const newKey = run(def.keyType);
-        const newVal = run(def.valueType);
+        const newKey = run2(def.keyType);
+        const newVal = run2(def.valueType);
         return newKey === def.keyType && newVal === def.valueType ? s : clone(s, { ...def, keyType: newKey, valueType: newVal });
       }
       case "set": {
-        const newVal = run(def.valueType);
+        const newVal = run2(def.valueType);
         return newVal === def.valueType ? s : clone(s, { ...def, valueType: newVal });
       }
       case "union": {
@@ -23255,7 +23255,7 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newOptions = [];
         for (const opt of oldOptions) {
-          const mapped = run(opt);
+          const mapped = run2(opt);
           if (mapped !== opt)
             changed = true;
           newOptions.push(mapped);
@@ -23263,8 +23263,8 @@ function visit(schema, fnOrHandlers) {
         return changed ? clone(s, { ...def, options: newOptions }) : s;
       }
       case "intersection": {
-        const newLeft = run(def.left);
-        const newRight = run(def.right);
+        const newLeft = run2(def.left);
+        const newRight = run2(def.right);
         return newLeft === def.left && newRight === def.right ? s : clone(s, { ...def, left: newLeft, right: newRight });
       }
       case "optional":
@@ -23276,23 +23276,23 @@ function visit(schema, fnOrHandlers) {
       case "nonoptional":
       case "promise":
       case "success": {
-        const newInner = run(def.innerType);
+        const newInner = run2(def.innerType);
         return newInner === def.innerType ? s : clone(s, { ...def, innerType: newInner });
       }
       case "pipe": {
-        const newIn = run(def.in);
-        const newOut = run(def.out);
+        const newIn = run2(def.in);
+        const newOut = run2(def.out);
         return newIn === def.in && newOut === def.out ? s : clone(s, { ...def, in: newIn, out: newOut });
       }
       case "function": {
-        const newInput = run(def.input);
-        const newOutput = run(def.output);
+        const newInput = run2(def.input);
+        const newOutput = run2(def.output);
         return newInput === def.input && newOutput === def.output ? s : clone(s, { ...def, input: newInput, output: newOutput });
       }
       case "lazy": {
         const original = def.getter;
         const { _cachedInner, ...rest } = def;
-        return clone(s, { ...rest, getter: () => run(original()) });
+        return clone(s, { ...rest, getter: () => run2(original()) });
       }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
@@ -23323,7 +23323,7 @@ function visit(schema, fnOrHandlers) {
       }
     }
   }
-  return run(schema);
+  return run2(schema);
 }
 
 // ../../node_modules/zod/v4/classic/deep-partial.js
@@ -25164,8 +25164,8 @@ async function openNetworkPanel(binaryDirectory, identity) {
 }
 
 // agent/src/main.ts
-import path28 from "node:path";
-import os7 from "node:os";
+import path29 from "node:path";
+import os8 from "node:os";
 
 // agent/src/posix-store.ts
 import { constants } from "node:fs";
@@ -25584,7 +25584,7 @@ async function acquirePosixJournalGuard(directory, helper) {
 }
 
 // agent/src/main.ts
-import { mkdir as mkdir14, open as open13, readFile as readFile11, realpath as realpath10, rm as rm9 } from "node:fs/promises";
+import { mkdir as mkdir14, open as open13, readFile as readFile12, realpath as realpath10, rm as rm10 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -25721,13 +25721,13 @@ var exec2 = promisify2(execFile2);
 async function darwinSupervisorLiveness(helper, pids, records = []) {
   if (process.platform !== "darwin" || !process.getuid?.() || process.getuid() !== process.geteuid?.()) return null;
   const remaining = new Set(pids), uid = process.getuid(), deadline = Date.now() + 1e4, env = buildChildEnvironment(process.env);
-  const run = (file2, args) => exec2(
+  const run2 = (file2, args) => exec2(
     file2,
     args,
     { env, timeout: Math.max(1, Math.min(7e3, deadline - Date.now())), maxBuffer: 8192, encoding: "utf8", windowsHide: true }
   );
   try {
-    const boot = (await run("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"])).stdout.trim();
+    const boot = (await run2("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"])).stdout.trim();
     if (!bootSession.test(boot)) return null;
     for (const pid of remaining) {
       if (Date.now() >= deadline) break;
@@ -25736,9 +25736,9 @@ async function darwinSupervisorLiveness(helper, pids, records = []) {
       const proof2 = matches2[0].containment;
       if (!validDarwinContainment(proof2) || proof2.uid !== uid || proof2.bootSession !== boot) continue;
       try {
-        await run(helper, ["--reap", proof2.coalition]);
-        if ((await run(helper, ["--count", proof2.coalition])).stdout.trim() !== "0") continue;
-        await run("/bin/launchctl", ["bootout", "gui/" + uid + "/" + proof2.label]).catch(() => {
+        await run2(helper, ["--reap", proof2.coalition]);
+        if ((await run2(helper, ["--count", proof2.coalition])).stdout.trim() !== "0") continue;
+        await run2("/bin/launchctl", ["bootout", "gui/" + uid + "/" + proof2.label]).catch(() => {
         });
         remaining.delete(pid);
       } catch {
@@ -26445,10 +26445,12 @@ var ToolCallSchema = external_exports.discriminatedUnion("name", [
   external_exports.object({ name: external_exports.literal("git_log"), args: external_exports.object({ path: path5.optional(), limit: external_exports.number().int().min(1).max(50).default(15) }).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("project_snapshot"), args: external_exports.object({ path: path5.optional(), startup: external_exports.boolean().optional(), taskId: external_exports.string().regex(/^[A-Za-z0-9_-]{1,100}$/).optional() }).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("command_run"), args: external_exports.object({ command: external_exports.string().min(1).max(260).refine((v) => !/[\r\n\0]/.test(v)), args: external_exports.array(external_exports.string().max(8192).refine((v) => !v.includes("\0"))).max(128).default([]), cwd: path5.optional(), timeoutMs: external_exports.number().int().min(100).max(864e5).default(6e4) }).strict() }).strict(),
+  // Still image of the device's primary display; the agent requires an owner Full Access workspace.
+  external_exports.object({ name: external_exports.literal("take_screenshot"), args: external_exports.object({}).strict() }).strict(),
   external_exports.object({ name: external_exports.literal("localhost_request"), args: external_exports.object({ url: external_exports.string().url().max(2048), method: external_exports.enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]).default("GET"), headers: external_exports.record(external_exports.string().max(128), external_exports.string().max(2048)).optional(), body: external_exports.string().max(6e4).optional() }).strict() }).strict()
 ]);
 function scopeForTool(call) {
-  if (call.name === "command_run") return "commands:execute";
+  if (call.name === "command_run" || call.name === "take_screenshot") return "commands:execute";
   if (call.name === "localhost_request") return "localhost:access";
   return call.name === "fs_write" || call.name === "fs_replace" ? "files:write" : "files:read";
 }
@@ -26464,10 +26466,12 @@ var ServerFrameSchema = external_exports.discriminatedUnion("type", [
   external_exports.object({ type: external_exports.literal("workspace_ack"), version: external_exports.literal(1), requestId: uuid11, workspaceGrantId: uuid11, accepted: external_exports.boolean(), code: external_exports.string().max(64).optional() }).strict(),
   external_exports.object({ type: external_exports.literal("revoke"), version: external_exports.literal(1), reason: external_exports.enum(["device_revoked", "account_revoked", "server_shutdown", "connection_replaced"]) }).strict()
 ]);
+var WORKSPACE_ACCESS_MODE_CAPABILITY = "workspaceAccessModeV1";
+var WorkspaceAccessModeSchema = external_exports.enum(["full", "scoped"]);
 var ClientFrameSchema = external_exports.discriminatedUnion("type", [
   external_exports.object({ type: external_exports.literal("ready"), version: external_exports.literal(1), safeSlots: external_exports.number().int().min(1).max(128), platform: external_exports.literal("win32"), agentVersion: external_exports.string().regex(/^[A-Za-z0-9._+-]{1,64}$/), supervisor: external_exports.boolean() }).strict(),
   external_exports.object({ type: external_exports.literal("heartbeat"), version: external_exports.literal(1), connectionEpoch: epoch2 }).strict(),
-  external_exports.object({ type: external_exports.literal("workspace_grant"), version: external_exports.literal(1), requestId: uuid11, workspaceGrantId: uuid11, rootHash: hash3, displayName: external_exports.string().min(1).max(120), policyVersion: external_exports.number().int().min(1).max(2147483647) }).strict(),
+  external_exports.object({ type: external_exports.literal("workspace_grant"), version: external_exports.literal(1), requestId: uuid11, workspaceGrantId: uuid11, rootHash: hash3, displayName: external_exports.string().min(1).max(120), policyVersion: external_exports.number().int().min(1).max(2147483647), accessMode: WorkspaceAccessModeSchema.optional() }).strict(),
   external_exports.object({ type: external_exports.literal("workspace_revoke"), version: external_exports.literal(1), requestId: uuid11, workspaceGrantId: uuid11 }).strict(),
   external_exports.object({ type: external_exports.literal("prepared"), version: external_exports.literal(1), binding: ExecutionBindingSchema }).strict(),
   external_exports.object({ type: external_exports.literal("accepted"), version: external_exports.literal(1), binding: ExecutionBindingSchema }).strict(),
@@ -26552,6 +26556,7 @@ function guardAction(binding2, tool, config2, observedAt) {
     throw Error("GUARD_IDENTITY_REQUIRED");
   }
   const name2 = tool.call.name;
+  if (name2 === "take_screenshot") throw Error("GUARD_ACTION_UNSUPPORTED");
   const kind = name2 === "command_run" ? "execute" : name2 === "localhost_request" ? "localhost-access" : name2 === "fs_write" || name2 === "fs_replace" ? "write" : name2.startsWith("git_") ? "git-read" : "read";
   const resourceKind = kind === "execute" ? "workspace" : kind === "localhost-access" ? "localhost-service" : kind === "git-read" ? "git-repository" : name2 === "fs_read" || kind === "write" ? "file" : "workspace";
   return { payloadHash: guardHash(tool.effective), request: BoundActionRequestSchema.parse({
@@ -27027,9 +27032,9 @@ var NativeJournal = class _NativeJournal {
       if (!validPid(pid)) throw failure2("JOURNAL_INPUT_INVALID");
       if (e.state !== "running" || !e.supervisors) throw failure2("JOURNAL_STATE_INVALID");
       if (containment !== void 0) {
-        const linux = validLinuxContainment(containment), darwin = !linux && validDarwinContainment(containment);
-        if (!linux && !darwin || !e.supervisors.includes(pid) || e.linuxSupervisors?.some((s) => s.pid === pid) || e.darwinSupervisors?.some((s) => s.pid === pid)) throw failure2("JOURNAL_INPUT_INVALID");
-        if (linux) (e.linuxSupervisors ??= []).push({ pid, containment: clone2(containment) });
+        const linux2 = validLinuxContainment(containment), darwin = !linux2 && validDarwinContainment(containment);
+        if (!linux2 && !darwin || !e.supervisors.includes(pid) || e.linuxSupervisors?.some((s) => s.pid === pid) || e.darwinSupervisors?.some((s) => s.pid === pid)) throw failure2("JOURNAL_INPUT_INVALID");
+        if (linux2) (e.linuxSupervisors ??= []).push({ pid, containment: clone2(containment) });
         else (e.darwinSupervisors ??= []).push({ pid, containment: clone2(containment) });
       } else {
         if (e.supervisors.length >= MAX_SUPERVISORS) throw failure2("JOURNAL_SUPERVISOR_LIMIT");
@@ -27233,6 +27238,7 @@ import { constants as constants4 } from "node:fs";
 
 // agent/src/posix-consent.ts
 import { openSync, closeSync } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { isatty, ReadStream, WriteStream } from "node:tty";
 import { createInterface } from "node:readline/promises";
 import path8 from "node:path";
@@ -27335,7 +27341,7 @@ async function planPermissionChange(current2, programs, input2) {
 }
 
 // agent/src/posix-consent.ts
-async function terminal2(run, timeoutMs2, signal) {
+async function terminal2(run2, timeoutMs2, signal) {
   if (!process.getuid || process.getuid() === 0 || process.geteuid?.() !== process.getuid() || signal?.aborted) throw Error("OWNER_REVIEW_UNAVAILABLE");
   let readFd;
   try {
@@ -27371,7 +27377,7 @@ async function terminal2(run, timeoutMs2, signal) {
   };
   input2.on("data", bound);
   try {
-    return await run(async (prompt) => {
+    return await run2(async (prompt) => {
       if (stop.signal.aborted) throw Error("OWNER_REVIEW_CANCELLED");
       return review.question(prompt, { signal: stop.signal });
     });
@@ -27400,16 +27406,41 @@ async function choosePosixFolder() {
     return await ask("Read/write folder: " + permissionLabel(folder) + "\nType APPROVE to accept: ") === "APPROVE" ? folder : null;
   }, 12e4);
 }
+var ACCESS_TEXT = "Local Commander lets your AI work on this computer.\n\nFull Access: files, commands and localhost with your account's rights (not an OS sandbox).\nChoose Folder: read and write one folder only.\n\nThis replaces the previous selection and lasts until you change or revoke it.";
+function selection(folder, full) {
+  if (!path8.isAbsolute(folder) || folder.length > 4096 || /[\u0000-\u001f]/.test(folder)) throw Error("WORKSPACE_INVALID");
+  return { mode: full ? "all-drives" : "folders", paths: [full ? "/" : folder] };
+}
+function macDialog() {
+  const script = [
+    "on run argv",
+    'set answer to button returned of (display dialog (item 1 of argv) with title "Local Commander" buttons {"Cancel", "Choose Folder\uFFFD", "Full Access"} default button "Full Access" cancel button "Cancel" with icon note)',
+    'if answer is "Full Access" then return "full"',
+    'return "folder:" & POSIX path of (choose folder with prompt "Choose the folder Local Commander may read and write")',
+    "end run"
+  ];
+  const result2 = spawnSync2(
+    "/usr/bin/osascript",
+    [...script.flatMap((line) => ["-e", line]), ACCESS_TEXT],
+    { encoding: "utf8", timeout: 24e4, maxBuffer: 16384, shell: false }
+  );
+  if (result2.error) return void 0;
+  if (result2.status !== 0) return /\(-128\)/.test(result2.stderr) ? null : void 0;
+  const out = result2.stdout.replace(/\n$/, "");
+  if (out === "full") return selection("/", true);
+  if (out.startsWith("folder:")) return selection(out.slice(7).replace(/(.)\/$/, "$1"), false);
+  return void 0;
+}
 async function choosePosixAccess() {
+  if (process.platform === "darwin") {
+    const chosen = macDialog();
+    if (chosen !== void 0) return chosen;
+  }
   return terminal2(async (ask) => {
-    if (process.platform === "darwin") await ask("Local Commander runs each command as its own launchd job and stops that job's processes when the command ends; work handed to other services is not stopped. Press Enter to review access: ");
-    const choice = await ask("Local Commander access\n1. One folder: read and write files\n2. Full Access: account capabilities across this computer, including commands and localhost\nEnter 1 or 2 (empty cancels): ");
-    if (choice !== "1" && choice !== "2") return null;
-    const folder = choice === "2" ? "/" : await ask("Absolute folder path: ");
-    if (!path8.isAbsolute(folder) || folder.length > 4096 || /[\u0000-\u001f]/.test(folder)) throw Error("WORKSPACE_INVALID");
-    const summary = choice === "2" ? "Full Access allows programs to use your account's capabilities across this computer. This is not an OS sandbox." : "Allow reading and writing files in " + permissionLabel(folder) + ".";
-    if (await ask(summary + "\nThis replaces the previous folder/command/localhost selection and persists until revoked.\nType APPROVE to accept: ") !== "APPROVE") return null;
-    return { mode: choice === "2" ? "all-drives" : "folders", paths: [folder] };
+    const answer = await ask("\n" + ACCESS_TEXT + "\n\nPress Enter for Full Access, type a folder path for one folder, or n to cancel: ");
+    if (answer === "") return selection("/", true);
+    if (/^(n|no|cancel)$/i.test(answer)) return null;
+    return selection(answer, false);
   }, 24e4);
 }
 
@@ -28876,9 +28907,9 @@ var HostMemory = class {
 };
 
 // agent/src/tools.ts
-import { constants as constants7 } from "node:fs";
-import { lstat as lstat7, open as open6, readdir as readdir4, realpath as realpath7, rename as rename4, rm as rm5 } from "node:fs/promises";
-import path17 from "node:path";
+import { constants as constants8 } from "node:fs";
+import { lstat as lstat8, open as open6, readdir as readdir5, realpath as realpath7, rename as rename4, rm as rm6 } from "node:fs/promises";
+import path18 from "node:path";
 import { createHash as createHash14, randomUUID as randomUUID7 } from "node:crypto";
 
 // src/guard.ts
@@ -29322,6 +29353,1249 @@ async function runSupervised(helper, request, options = {}) {
   });
 }
 
+// agent/src/screen-capture.ts
+import { execFile as execFile4 } from "node:child_process";
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { constants as constants7 } from "node:fs";
+import { access as access3, lstat as lstat7, mkdtemp, readFile as readFile6, readdir as readdir4, rm as rm5, unlink as unlink2 } from "node:fs/promises";
+import os4 from "node:os";
+import path17 from "node:path";
+
+// agent/src/dbus-portal.ts
+import net from "node:net";
+function sessionBusSocket(address) {
+  for (const entry of (address ?? "").split(";")) {
+    if (!entry.startsWith("unix:")) continue;
+    for (const part of entry.slice(5).split(",")) {
+      const at = part.indexOf("="), key = part.slice(0, at), value = decodeURIComponent(part.slice(at + 1));
+      if (at > 0 && value && key === "path") return value;
+      if (at > 0 && value && key === "abstract") return "\0" + value;
+    }
+  }
+  return null;
+}
+var Writer = class {
+  bytes = [];
+  align(n) {
+    while (this.bytes.length % n) this.bytes.push(0);
+  }
+  byte(v) {
+    this.bytes.push(v & 255);
+  }
+  u32(v) {
+    this.align(4);
+    this.bytes.push(v & 255, v >>> 8 & 255, v >>> 16 & 255, v >>> 24 & 255);
+  }
+  str(v) {
+    const b = Buffer.from(v, "utf8");
+    this.u32(b.length);
+    this.bytes.push(...b, 0);
+  }
+  sig(v) {
+    this.byte(v.length);
+    this.bytes.push(...Buffer.from(v, "ascii"), 0);
+  }
+  /** Basic value or variant: `s`, `o`, `g`, `u`, `b`, `v` ([signature, value]). */
+  put(type, value) {
+    if (type === "s" || type === "o") this.str(String(value));
+    else if (type === "g") this.sig(String(value));
+    else if (type === "u") this.u32(Number(value));
+    else if (type === "b") this.u32(value ? 1 : 0);
+    else if (type === "v") {
+      const [inner, v] = value;
+      this.sig(inner);
+      this.put(inner, v);
+    } else throw Error("type " + type);
+  }
+  /** a{sv} */
+  dict(entries) {
+    this.u32(0);
+    const lengthAt = this.bytes.length - 4;
+    this.align(8);
+    const start = this.bytes.length;
+    for (const [key, value] of entries) {
+      this.align(8);
+      this.str(key);
+      this.put("v", value);
+    }
+    const length = this.bytes.length - start;
+    this.bytes.splice(lengthAt, 4, length & 255, length >>> 8 & 255, length >>> 16 & 255, length >>> 24 & 255);
+  }
+};
+var Reader = class {
+  constructor(data, at, le) {
+    this.data = data;
+    this.at = at;
+    this.le = le;
+  }
+  data;
+  at;
+  le;
+  align(n) {
+    this.at = Math.ceil(this.at / n) * n;
+  }
+  u32() {
+    this.align(4);
+    const v = this.le ? this.data.readUInt32LE(this.at) : this.data.readUInt32BE(this.at);
+    this.at += 4;
+    return v;
+  }
+  /** Reads one complete type from `sig` starting at `i`; returns the value and the index after the type. */
+  read(sig2, i) {
+    const c = sig2[i];
+    const fixed = { y: 1, n: 2, q: 2, b: 4, i: 4, u: 4, h: 4, x: 8, t: 8, d: 8 };
+    if (c in fixed) {
+      const size = fixed[c];
+      this.align(size);
+      const v = size === 1 ? this.data[this.at] : size === 2 ? this.le ? this.data.readUInt16LE(this.at) : this.data.readUInt16BE(this.at) : size === 4 ? this.le ? this.data.readUInt32LE(this.at) : this.data.readUInt32BE(this.at) : null;
+      this.at += size;
+      return [c === "b" ? v === 1 : v, i + 1];
+    }
+    if (c === "s" || c === "o") {
+      const n = this.u32(), v = this.data.toString("utf8", this.at, this.at + n);
+      this.at += n + 1;
+      return [v, i + 1];
+    }
+    if (c === "g") {
+      const n = this.data[this.at], v = this.data.toString("ascii", this.at + 1, this.at + 1 + n);
+      this.at += n + 2;
+      return [v, i + 1];
+    }
+    if (c === "v") {
+      const [inner] = this.read("g", 0);
+      return [this.read(inner, 0)[0], i + 1];
+    }
+    if (c === "(" || c === "{") {
+      this.align(8);
+      const close = c === "(" ? ")" : "}", values = [];
+      let j = i + 1;
+      while (sig2[j] !== close) {
+        const [v, next] = this.read(sig2, j);
+        values.push(v);
+        j = next;
+      }
+      return [values, j + 1];
+    }
+    if (c === "a") {
+      const n = this.u32(), element = sig2[i + 1];
+      this.align("xtd({".includes(element) ? 8 : element === "n" || element === "q" ? 2 : element === "y" || element === "g" || element === "v" ? 1 : 4);
+      const end = this.at + n, values = [];
+      let next = skip(sig2, i + 1);
+      while (this.at < end) {
+        const [v, j] = this.read(sig2, i + 1);
+        values.push(v);
+        next = j;
+      }
+      return [values, next];
+    }
+    throw Error("signature " + sig2);
+  }
+};
+function skip(sig2, i) {
+  const c = sig2[i];
+  if (c === "a") return skip(sig2, i + 1);
+  if (c === "(" || c === "{") {
+    let j = i + 1;
+    while (sig2[j] !== (c === "(" ? ")" : "}")) j = skip(sig2, j);
+    return j + 1;
+  }
+  return i + 1;
+}
+function parse3(data) {
+  const le = data[0] === 108, r = new Reader(data, 4, le), bodyLength = r.u32(), serial = r.u32();
+  const [fields] = r.read("a(yv)", 0);
+  const message2 = { type: data[1], serial, signature: "", body: [] };
+  for (const [code, value] of fields) {
+    if (code === 1) message2.path = String(value);
+    else if (code === 2) message2.interface = String(value);
+    else if (code === 3) message2.member = String(value);
+    else if (code === 4) message2.errorName = String(value);
+    else if (code === 5) message2.replySerial = Number(value);
+    else if (code === 8) message2.signature = String(value);
+  }
+  r.align(8);
+  const end = r.at + bodyLength;
+  for (let i = 0; i < message2.signature.length && r.at < end; ) {
+    const [v, next] = r.read(message2.signature, i);
+    message2.body.push(v);
+    i = next;
+  }
+  return message2;
+}
+function frameLength(data) {
+  if (data.length < 16) return 0;
+  const le = data[0] === 108, u = (at) => le ? data.readUInt32LE(at) : data.readUInt32BE(at);
+  const length = Math.ceil((16 + u(12)) / 8) * 8 + u(4);
+  return data.length >= length ? length : 0;
+}
+async function portalScreenshot(socket, uid, token, signal) {
+  const connection = net.createConnection({ path: socket });
+  try {
+    return await new Promise((resolve, reject) => {
+      let serial = 0, buffer = Buffer.alloc(0), authenticated = false, requestPath = "";
+      const pending = /* @__PURE__ */ new Map();
+      const fail7 = (error62) => reject(error62 instanceof Error ? error62 : Error(String(error62)));
+      const abort = () => fail7(Error("ABORTED"));
+      if (signal.aborted) return abort();
+      signal.addEventListener("abort", abort, { once: true });
+      connection.on("error", fail7);
+      connection.on("close", () => fail7(Error("CLOSED")));
+      const call = (destination, path30, iface, member, signature = "", body = () => {
+      }) => new Promise((done, failed) => {
+        const payload2 = new Writer();
+        body(payload2);
+        const header = new Writer(), fields = [[1, "o", path30], [2, "s", iface], [3, "s", member], [6, "s", destination]];
+        if (signature) fields.push([8, "g", signature]);
+        header.byte(108);
+        header.byte(1);
+        header.byte(0);
+        header.byte(1);
+        header.u32(payload2.bytes.length);
+        header.u32(++serial);
+        header.u32(0);
+        const lengthAt = header.bytes.length - 4;
+        header.align(8);
+        const start = header.bytes.length;
+        for (const [code, type, value] of fields) {
+          header.align(8);
+          header.byte(code);
+          header.sig(type);
+          header.put(type, value);
+        }
+        const length = header.bytes.length - start;
+        header.bytes.splice(lengthAt, 4, length & 255, length >>> 8 & 255, length >>> 16 & 255, length >>> 24 & 255);
+        header.align(8);
+        pending.set(serial, (reply) => reply.type === 3 ? failed(Error(reply.errorName ?? "DBUS_ERROR")) : done(reply));
+        connection.write(Buffer.from([...header.bytes, ...payload2.bytes]));
+      });
+      const bus = (member, signature, body) => call("org.freedesktop.DBus", "/org/freedesktop/DBus", "org.freedesktop.DBus", member, signature, body);
+      connection.on("data", (chunk) => {
+        try {
+          receive(chunk);
+        } catch (error62) {
+          fail7(error62);
+        }
+      });
+      const receive = (chunk) => {
+        buffer = Buffer.concat([buffer, chunk]);
+        if (buffer.length > 1048576) return fail7(Error("OVERSIZED"));
+        if (!authenticated) {
+          const end = buffer.indexOf("\r\n");
+          if (end < 0) return;
+          const line = buffer.toString("ascii", 0, end);
+          buffer = buffer.subarray(end + 2);
+          if (!line.startsWith("OK ")) return fail7(Error("AUTH"));
+          authenticated = true;
+          connection.write("BEGIN\r\n");
+          void (async () => {
+            const unique = String((await bus("Hello")).body[0]);
+            requestPath = "/org/freedesktop/portal/desktop/request/" + unique.slice(1).replace(/\./g, "_") + "/" + token;
+            await bus("AddMatch", "s", (w) => w.put("s", "type='signal',interface='org.freedesktop.portal.Request',member='Response',path='" + requestPath + "'"));
+            const handle = await call(
+              "org.freedesktop.portal.Desktop",
+              "/org/freedesktop/portal/desktop",
+              "org.freedesktop.portal.Screenshot",
+              "Screenshot",
+              "sa{sv}",
+              (w) => {
+                w.put("s", "");
+                w.dict([["handle_token", ["s", token]], ["interactive", ["b", false]]]);
+              }
+            );
+            if (handle.body[0] !== requestPath) {
+              requestPath = String(handle.body[0]);
+              await bus("AddMatch", "s", (w) => w.put("s", "type='signal',interface='org.freedesktop.portal.Request',member='Response',path='" + requestPath + "'"));
+            }
+          })().catch(fail7);
+        }
+        for (let length = frameLength(buffer); authenticated && length; length = frameLength(buffer)) {
+          const message2 = parse3(buffer.subarray(0, length));
+          buffer = buffer.subarray(length);
+          if ((message2.type === 2 || message2.type === 3) && message2.replySerial !== void 0) {
+            pending.get(message2.replySerial)?.(message2);
+            pending.delete(message2.replySerial);
+          } else if (message2.type === 4 && message2.member === "Response" && message2.path === requestPath && message2.signature === "ua{sv}") {
+            const results2 = message2.body[1], uri = results2.find(([key]) => key === "uri")?.[1];
+            resolve({ code: Number(message2.body[0]), uri: typeof uri === "string" ? uri : void 0 });
+          }
+        }
+      };
+      connection.on("connect", () => connection.write("\0AUTH EXTERNAL " + Buffer.from(String(uid), "ascii").toString("hex") + "\r\n"));
+    });
+  } finally {
+    connection.destroy();
+  }
+}
+
+// agent/src/screen-image.ts
+import { inflateSync } from "node:zlib";
+var MAX_EDGE = 16384;
+var MAX_PIXELS = 67108864;
+function sizeOk(width, height) {
+  return Number.isSafeInteger(width) && Number.isSafeInteger(height) && width > 0 && height > 0 && width <= MAX_EDGE && height <= MAX_EDGE && width * height <= MAX_PIXELS;
+}
+function decodePng(data) {
+  if (data.length < 33 || data.readUInt32BE(0) !== 2303741511 || data.readUInt32BE(4) !== 218765834) return null;
+  let width = 0, height = 0, channels = 0;
+  const idat = [];
+  for (let at = 8; at + 12 <= data.length; ) {
+    const length = data.readUInt32BE(at), type = data.toString("latin1", at + 4, at + 8), body = at + 8;
+    if (body + length + 4 > data.length) return null;
+    if (type === "IHDR") {
+      if (length !== 13) return null;
+      width = data.readUInt32BE(body);
+      height = data.readUInt32BE(body + 4);
+      const depth = data[body + 8], color = data[body + 9], interlace = data[body + 12];
+      channels = color === 0 ? 1 : color === 2 ? 3 : color === 4 ? 2 : color === 6 ? 4 : 0;
+      if (depth !== 8 || !channels || interlace !== 0 || data[body + 10] !== 0 || data[body + 11] !== 0 || !sizeOk(width, height)) return null;
+    } else if (type === "IDAT") idat.push(data.subarray(body, body + length));
+    else if (type === "IEND") break;
+    at = body + length + 4;
+  }
+  if (!channels || !idat.length) return null;
+  const stride = width * channels, expected = (stride + 1) * height;
+  let raw;
+  try {
+    raw = inflateSync(Buffer.concat(idat), { maxOutputLength: expected });
+  } catch {
+    return null;
+  }
+  if (raw.length !== expected) return null;
+  const rgb = Buffer.alloc(width * height * 3);
+  let previous = Buffer.alloc(stride), current2 = Buffer.alloc(stride);
+  for (let y = 0; y < height; y++) {
+    const filter = raw[y * (stride + 1)], line = raw.subarray(y * (stride + 1) + 1, (y + 1) * (stride + 1));
+    for (let x = 0; x < stride; x++) {
+      const a = x >= channels ? current2[x - channels] : 0, b = previous[x], c = x >= channels ? previous[x - channels] : 0;
+      let value = line[x];
+      if (filter === 1) value += a;
+      else if (filter === 2) value += b;
+      else if (filter === 3) value += a + b >> 1;
+      else if (filter === 4) {
+        const p = a + b - c, pa = Math.abs(p - a), pb = Math.abs(p - b), pc = Math.abs(p - c);
+        value += pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+      } else if (filter !== 0) return null;
+      current2[x] = value & 255;
+    }
+    for (let x = 0, o = y * width * 3; x < width; x++, o += 3) {
+      const i = x * channels;
+      if (channels <= 2) rgb[o] = rgb[o + 1] = rgb[o + 2] = current2[i];
+      else {
+        rgb[o] = current2[i];
+        rgb[o + 1] = current2[i + 1];
+        rgb[o + 2] = current2[i + 2];
+      }
+    }
+    [previous, current2] = [current2, previous];
+  }
+  return { width, height, rgb };
+}
+function decodeXwd(data) {
+  if (data.length < 100) return null;
+  const field = (index) => data.readUInt32BE(index * 4);
+  const headerSize = field(0), version2 = field(1), format = field(2), width = field(4), height = field(5), byteOrder = field(7);
+  const bitsPerPixel = field(11), bytesPerLine = field(12), visualClass = field(13), masks = [field(14), field(15), field(16)], colors = field(19);
+  if (version2 !== 7 || format !== 2 || headerSize < 100 || ![4, 5].includes(visualClass) || ![24, 32].includes(bitsPerPixel) || !sizeOk(width, height) || colors > 65536) return null;
+  const pixelBytes = bitsPerPixel / 8, start = headerSize + colors * 12;
+  if (bytesPerLine < width * pixelBytes || start + bytesPerLine * height > data.length || masks.some((mask) => !mask)) return null;
+  const shifts = masks.map((mask) => {
+    let shift = 0;
+    while (!(mask >>> shift & 1)) shift++;
+    return shift;
+  });
+  const scales = masks.map((mask, i) => 255 / (mask >>> shifts[i]));
+  const rgb = Buffer.alloc(width * height * 3);
+  for (let y = 0; y < height; y++) for (let x = 0, at = start + y * bytesPerLine, o = y * width * 3; x < width; x++, at += pixelBytes, o += 3) {
+    const pixel = pixelBytes === 4 ? byteOrder === 0 ? data.readUInt32LE(at) : data.readUInt32BE(at) : byteOrder === 0 ? data[at] | data[at + 1] << 8 | data[at + 2] << 16 : data[at] << 16 | data[at + 1] << 8 | data[at + 2];
+    for (let c = 0; c < 3; c++) rgb[o + c] = Math.round(((pixel & masks[c]) >>> 0 >>> shifts[c]) * scales[c]);
+  }
+  return { width, height, rgb };
+}
+function downscale(image, edge) {
+  const scale = Math.min(1, edge / Math.max(image.width, image.height));
+  if (scale >= 1) return image;
+  const width = Math.max(1, Math.round(image.width * scale)), height = Math.max(1, Math.round(image.height * scale));
+  const xs = Array.from({ length: width + 1 }, (_, x) => Math.min(image.width, Math.floor(x * image.width / width)));
+  const ys = Array.from({ length: height + 1 }, (_, y) => Math.min(image.height, Math.floor(y * image.height / height)));
+  const rgb = Buffer.alloc(width * height * 3), sums = new Float64Array(width * 3);
+  for (let y = 0; y < height; y++) {
+    sums.fill(0);
+    for (let sy = ys[y]; sy < ys[y + 1]; sy++) for (let x = 0; x < width; x++) for (let sx = xs[x]; sx < xs[x + 1]; sx++) {
+      const i = (sy * image.width + sx) * 3;
+      sums[x * 3] = sums[x * 3] + image.rgb[i];
+      sums[x * 3 + 1] = sums[x * 3 + 1] + image.rgb[i + 1];
+      sums[x * 3 + 2] = sums[x * 3 + 2] + image.rgb[i + 2];
+    }
+    for (let x = 0; x < width; x++) {
+      const count3 = (ys[y + 1] - ys[y]) * (xs[x + 1] - xs[x]);
+      for (let c = 0; c < 3; c++) rgb[(y * width + x) * 3 + c] = Math.round(sums[x * 3 + c] / count3);
+    }
+  }
+  return { width, height, rgb };
+}
+var ZIGZAG = [
+  0,
+  1,
+  5,
+  6,
+  14,
+  15,
+  27,
+  28,
+  2,
+  4,
+  7,
+  13,
+  16,
+  26,
+  29,
+  42,
+  3,
+  8,
+  12,
+  17,
+  25,
+  30,
+  41,
+  43,
+  9,
+  11,
+  18,
+  24,
+  31,
+  40,
+  44,
+  53,
+  10,
+  19,
+  23,
+  32,
+  39,
+  45,
+  52,
+  54,
+  20,
+  22,
+  33,
+  38,
+  46,
+  51,
+  55,
+  60,
+  21,
+  34,
+  37,
+  47,
+  50,
+  56,
+  59,
+  61,
+  35,
+  36,
+  48,
+  49,
+  57,
+  58,
+  62,
+  63
+];
+var LUMA_QUANT = [
+  16,
+  11,
+  10,
+  16,
+  24,
+  40,
+  51,
+  61,
+  12,
+  12,
+  14,
+  19,
+  26,
+  58,
+  60,
+  55,
+  14,
+  13,
+  16,
+  24,
+  40,
+  57,
+  69,
+  56,
+  14,
+  17,
+  22,
+  29,
+  51,
+  87,
+  80,
+  62,
+  18,
+  22,
+  37,
+  56,
+  68,
+  109,
+  103,
+  77,
+  24,
+  35,
+  55,
+  64,
+  81,
+  104,
+  113,
+  92,
+  49,
+  64,
+  78,
+  87,
+  103,
+  121,
+  120,
+  101,
+  72,
+  92,
+  95,
+  98,
+  112,
+  100,
+  103,
+  99
+];
+var CHROMA_QUANT = [17, 18, 24, 47, 99, 99, 99, 99, 18, 21, 26, 66, 99, 99, 99, 99, 24, 26, 56, 99, 99, 99, 99, 99, 47, 66, ...Array(38).fill(99)];
+var AC_LUMA_VALUES = [
+  1,
+  2,
+  3,
+  0,
+  4,
+  17,
+  5,
+  18,
+  33,
+  49,
+  65,
+  6,
+  19,
+  81,
+  97,
+  7,
+  34,
+  113,
+  20,
+  50,
+  129,
+  145,
+  161,
+  8,
+  35,
+  66,
+  177,
+  193,
+  21,
+  82,
+  209,
+  240,
+  36,
+  51,
+  98,
+  114,
+  130,
+  9,
+  10,
+  22,
+  23,
+  24,
+  25,
+  26,
+  37,
+  38,
+  39,
+  40,
+  41,
+  42,
+  52,
+  53,
+  54,
+  55,
+  56,
+  57,
+  58,
+  67,
+  68,
+  69,
+  70,
+  71,
+  72,
+  73,
+  74,
+  83,
+  84,
+  85,
+  86,
+  87,
+  88,
+  89,
+  90,
+  99,
+  100,
+  101,
+  102,
+  103,
+  104,
+  105,
+  106,
+  115,
+  116,
+  117,
+  118,
+  119,
+  120,
+  121,
+  122,
+  131,
+  132,
+  133,
+  134,
+  135,
+  136,
+  137,
+  138,
+  146,
+  147,
+  148,
+  149,
+  150,
+  151,
+  152,
+  153,
+  154,
+  162,
+  163,
+  164,
+  165,
+  166,
+  167,
+  168,
+  169,
+  170,
+  178,
+  179,
+  180,
+  181,
+  182,
+  183,
+  184,
+  185,
+  186,
+  194,
+  195,
+  196,
+  197,
+  198,
+  199,
+  200,
+  201,
+  202,
+  210,
+  211,
+  212,
+  213,
+  214,
+  215,
+  216,
+  217,
+  218,
+  225,
+  226,
+  227,
+  228,
+  229,
+  230,
+  231,
+  232,
+  233,
+  234,
+  241,
+  242,
+  243,
+  244,
+  245,
+  246,
+  247,
+  248,
+  249,
+  250
+];
+var AC_CHROMA_VALUES = [
+  0,
+  1,
+  2,
+  3,
+  17,
+  4,
+  5,
+  33,
+  49,
+  6,
+  18,
+  65,
+  81,
+  7,
+  97,
+  113,
+  19,
+  34,
+  50,
+  129,
+  8,
+  20,
+  66,
+  145,
+  161,
+  177,
+  193,
+  9,
+  35,
+  51,
+  82,
+  240,
+  21,
+  98,
+  114,
+  209,
+  10,
+  22,
+  36,
+  52,
+  225,
+  37,
+  241,
+  23,
+  24,
+  25,
+  26,
+  38,
+  39,
+  40,
+  41,
+  42,
+  53,
+  54,
+  55,
+  56,
+  57,
+  58,
+  67,
+  68,
+  69,
+  70,
+  71,
+  72,
+  73,
+  74,
+  83,
+  84,
+  85,
+  86,
+  87,
+  88,
+  89,
+  90,
+  99,
+  100,
+  101,
+  102,
+  103,
+  104,
+  105,
+  106,
+  115,
+  116,
+  117,
+  118,
+  119,
+  120,
+  121,
+  122,
+  130,
+  131,
+  132,
+  133,
+  134,
+  135,
+  136,
+  137,
+  138,
+  146,
+  147,
+  148,
+  149,
+  150,
+  151,
+  152,
+  153,
+  154,
+  162,
+  163,
+  164,
+  165,
+  166,
+  167,
+  168,
+  169,
+  170,
+  178,
+  179,
+  180,
+  181,
+  182,
+  183,
+  184,
+  185,
+  186,
+  194,
+  195,
+  196,
+  197,
+  198,
+  199,
+  200,
+  201,
+  202,
+  210,
+  211,
+  212,
+  213,
+  214,
+  215,
+  216,
+  217,
+  218,
+  226,
+  227,
+  228,
+  229,
+  230,
+  231,
+  232,
+  233,
+  234,
+  242,
+  243,
+  244,
+  245,
+  246,
+  247,
+  248,
+  249,
+  250
+];
+var DC_VALUES = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11];
+var HUFFMAN = [
+  [0, [0, 1, 5, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0], DC_VALUES],
+  [16, [0, 2, 1, 3, 3, 2, 4, 3, 5, 5, 4, 4, 0, 0, 1, 125], AC_LUMA_VALUES],
+  [1, [0, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0], DC_VALUES],
+  [17, [0, 2, 1, 2, 4, 4, 3, 4, 7, 5, 4, 4, 0, 1, 2, 119], AC_CHROMA_VALUES]
+];
+var CODES = HUFFMAN.map(([, counts, values]) => {
+  const table2 = [];
+  let code = 0, at = 0;
+  counts.forEach((count3, index) => {
+    for (let i = 0; i < count3; i++) table2[values[at++]] = [code++, index + 1];
+    code <<= 1;
+  });
+  return table2;
+});
+var AAN = [1, 1.387039845, 1.306562965, 1.175875602, 1, 0.785694958, 0.5411961, 0.275899379];
+function quantTables(quality) {
+  const factor = quality < 50 ? 5e3 / quality : 200 - quality * 2;
+  const scaled = (base) => base.map((value) => Math.min(255, Math.max(1, Math.floor((value * factor + 50) / 100))));
+  const divisors = (table2) => Float64Array.from(table2, (value, k) => 1 / (value * AAN[k >> 3] * AAN[k & 7] * 8));
+  const luma = scaled(LUMA_QUANT), chroma = scaled(CHROMA_QUANT);
+  return { luma, chroma, lumaDivisors: divisors(luma), chromaDivisors: divisors(chroma) };
+}
+var BitWriter = class {
+  buffer = Buffer.alloc(65536);
+  length = 0;
+  bits = 0;
+  count = 0;
+  byte(value) {
+    if (this.length === this.buffer.length) {
+      const next = Buffer.alloc(this.buffer.length * 2);
+      this.buffer.copy(next);
+      this.buffer = next;
+    }
+    this.buffer[this.length++] = value;
+  }
+  bytes(values) {
+    for (const value of values) this.byte(value);
+  }
+  write(code, length) {
+    this.bits = (this.bits << length | code) >>> 0;
+    this.count += length;
+    while (this.count >= 8) {
+      const value = this.bits >>> this.count - 8 & 255;
+      this.byte(value);
+      if (value === 255) this.byte(0);
+      this.count -= 8;
+      this.bits &= (1 << this.count) - 1;
+    }
+  }
+  flush() {
+    if (this.count > 0) this.write((1 << 8 - this.count) - 1, 8 - this.count);
+  }
+  result() {
+    return Buffer.from(this.buffer.subarray(0, this.length));
+  }
+};
+function transform2(block, divisors, out) {
+  for (let pass = 0; pass < 2; pass++) for (let i = 0; i < 8; i++) {
+    const step = pass ? 8 : 1, base = pass ? i : i * 8, at = (k) => base + k * step;
+    const d0 = block[at(0)], d1 = block[at(1)], d2 = block[at(2)], d3 = block[at(3)], d4 = block[at(4)], d5 = block[at(5)], d6 = block[at(6)], d7 = block[at(7)];
+    const t0 = d0 + d7, t7 = d0 - d7, t1 = d1 + d6, t6 = d1 - d6, t2 = d2 + d5, t5 = d2 - d5, t3 = d3 + d4, t4 = d3 - d4;
+    const t10 = t0 + t3, t13 = t0 - t3, t11 = t1 + t2, t12 = t1 - t2;
+    block[at(0)] = t10 + t11;
+    block[at(4)] = t10 - t11;
+    const z1 = (t12 + t13) * 0.707106781;
+    block[at(2)] = t13 + z1;
+    block[at(6)] = t13 - z1;
+    const o10 = t4 + t5, o11 = t5 + t6, o12 = t6 + t7;
+    const z5 = (o10 - o12) * 0.382683433, z2 = 0.5411961 * o10 + z5, z4 = 1.306562965 * o12 + z5, z3 = o11 * 0.707106781;
+    const z11 = t7 + z3, z13 = t7 - z3;
+    block[at(5)] = z13 + z2;
+    block[at(3)] = z13 - z2;
+    block[at(1)] = z11 + z4;
+    block[at(7)] = z11 - z4;
+  }
+  for (let k = 0; k < 64; k++) out[ZIGZAG[k]] = Math.round(block[k] * divisors[k]);
+}
+function magnitude(value) {
+  const absolute2 = Math.abs(value);
+  let length = 0;
+  while (absolute2 >> length) length++;
+  return [value < 0 ? value + (1 << length) - 1 : value, length];
+}
+function encodeJpeg(image, quality) {
+  const { width, height, rgb } = image, tables = quantTables(Math.min(100, Math.max(1, Math.round(quality))));
+  const out = new BitWriter(), word = (value) => [value >> 8, value & 255];
+  out.bytes([255, 216, 255, 224, 0, 16, 74, 70, 73, 70, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0]);
+  out.bytes([255, 219, 0, 132]);
+  for (const [id2, table2] of [[0, tables.luma], [1, tables.chroma]]) {
+    const zig = new Array(64);
+    table2.forEach((value, k) => {
+      zig[ZIGZAG[k]] = value;
+    });
+    out.bytes([id2, ...zig]);
+  }
+  out.bytes([255, 192, 0, 17, 8, ...word(height), ...word(width), 3, 1, 34, 0, 2, 17, 1, 3, 17, 1]);
+  out.bytes([255, 196, ...word(2 + HUFFMAN.reduce((sum, [, , values]) => sum + 17 + values.length, 0))]);
+  for (const [id2, counts, values] of HUFFMAN) out.bytes([id2, ...counts, ...values]);
+  out.bytes([255, 218, 0, 12, 3, 1, 0, 2, 17, 3, 17, 0, 63, 0]);
+  const block = new Float64Array(64), coefficients = new Int32Array(64), dc = [0, 0, 0];
+  const Y = new Float64Array(256), Cb = new Float64Array(256), Cr = new Float64Array(256);
+  const encode5 = (component, divisors) => {
+    transform2(block, divisors, coefficients);
+    const dcCodes = CODES[component ? 2 : 0], acCodes = CODES[component ? 3 : 1];
+    const diff = coefficients[0] - dc[component];
+    dc[component] = coefficients[0];
+    const [bits, size] = magnitude(diff);
+    out.write(...dcCodes[size]);
+    if (size) out.write(bits, size);
+    let last = 63;
+    while (last > 0 && coefficients[last] === 0) last--;
+    for (let k = 1, zeros = 0; k <= last; k++) {
+      if (coefficients[k] === 0) {
+        zeros++;
+        continue;
+      }
+      while (zeros >= 16) {
+        out.write(...acCodes[240]);
+        zeros -= 16;
+      }
+      const [value, length] = magnitude(coefficients[k]);
+      out.write(...acCodes[(zeros << 4) + length]);
+      out.write(value, length);
+      zeros = 0;
+    }
+    if (last < 63) out.write(...acCodes[0]);
+  };
+  for (let my = 0; my < height; my += 16) for (let mx = 0; mx < width; mx += 16) {
+    for (let y = 0; y < 16; y++) for (let x = 0; x < 16; x++) {
+      const i = (Math.min(height - 1, my + y) * width + Math.min(width - 1, mx + x)) * 3, r = rgb[i], g = rgb[i + 1], b = rgb[i + 2];
+      Y[y * 16 + x] = 0.299 * r + 0.587 * g + 0.114 * b - 128;
+      Cb[y * 16 + x] = -0.168736 * r - 0.331264 * g + 0.5 * b;
+      Cr[y * 16 + x] = 0.5 * r - 0.418688 * g - 0.081312 * b;
+    }
+    for (const [ox, oy] of [[0, 0], [8, 0], [0, 8], [8, 8]]) {
+      for (let y = 0; y < 8; y++) for (let x = 0; x < 8; x++) block[y * 8 + x] = Y[(oy + y) * 16 + ox + x];
+      encode5(0, tables.lumaDivisors);
+    }
+    for (const [component, plane] of [[1, Cb], [2, Cr]]) {
+      for (let y = 0; y < 8; y++) for (let x = 0; x < 8; x++) {
+        const at = y * 32 + x * 2;
+        block[y * 8 + x] = (plane[at] + plane[at + 1] + plane[at + 16] + plane[at + 17]) / 4;
+      }
+      encode5(component, tables.chromaDivisors);
+    }
+  }
+  out.flush();
+  out.bytes([255, 217]);
+  return out.result();
+}
+function fitJpeg(image, maxEdge, maxBytes) {
+  for (const edge of [maxEdge, 1280, 1024, 800, 640]) {
+    const scaled = downscale(image, edge);
+    for (const quality of [75, 60, 45, 35]) {
+      const data = encodeJpeg(scaled, quality);
+      if (data.length <= maxBytes) return { data, width: scaled.width, height: scaled.height };
+    }
+  }
+  return null;
+}
+
+// agent/src/screen-capture.ts
+var SCREENSHOT_MAX_JPEG_BYTES = 131072;
+var SCREENSHOT_MAX_EDGE = 1568;
+function screenshotEnabled(env = process.env) {
+  return env.LC_SCREENSHOT_ENABLED === "true";
+}
+var SCREENSHOT_ACCEPTANCE_FILE = "screenshot-acceptance-enabled";
+var SCREENSHOT_OWNER_OFF_FILE = "screenshot-disabled-by-owner";
+var ScreenCaptureError = class extends Error {
+  constructor(code, detail) {
+    super(code);
+    this.code = code;
+    this.detail = detail;
+    this.name = "ScreenCaptureError";
+  }
+  code;
+  detail;
+};
+var KNOWN = /^(SCREEN_UNAVAILABLE|SCREEN_LOCKED|SCREEN_ENCODER_UNAVAILABLE|SCREENSHOT_TOO_LARGE|ARGUMENT_INVALID)$/;
+function jpegSize(data) {
+  if (data.length < 4 || data[0] !== 255 || data[1] !== 216 || data[data.length - 2] !== 255 || data[data.length - 1] !== 217) return null;
+  for (let at = 2; at + 9 < data.length; ) {
+    if (data[at] !== 255) return null;
+    const marker = data[at + 1], length = data.readUInt16BE(at + 2);
+    if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+      const height = data.readUInt16BE(at + 5), width = data.readUInt16BE(at + 7);
+      return width > 0 && height > 0 ? { width, height } : null;
+    }
+    at += 2 + length;
+  }
+  return null;
+}
+function run(file2, args, signal, maxBuffer = 65536, env = buildChildEnvironment(process.env, process.platform)) {
+  return new Promise((resolve, reject) => {
+    execFile4(
+      file2,
+      args,
+      { encoding: "buffer", timeout: 15e3, maxBuffer, windowsHide: true, shell: false, env, signal },
+      (error62, stdout, stderr) => error62 ? reject(Object.assign(error62, { stdout, stderr })) : resolve({ stdout, stderr })
+    );
+  });
+}
+async function windows(bridge, signal) {
+  if (!path17.isAbsolute(bridge)) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  let stdout;
+  try {
+    ({ stdout } = await run(bridge, ["screenshot", String(SCREENSHOT_MAX_EDGE), String(SCREENSHOT_MAX_JPEG_BYTES)], signal, 262144));
+  } catch (error62) {
+    if (signal.aborted) throw new ScreenCaptureError("CANCELLED");
+    const code = /^\{"error":"([A-Z_]+)"\}$/.exec(String(error62.stderr ?? ""))?.[1];
+    throw new ScreenCaptureError(code && KNOWN.test(code) ? code : "SCREEN_UNAVAILABLE");
+  }
+  try {
+    const value = JSON.parse(stdout.toString("utf8"));
+    const data = Buffer.from(value.data, "base64"), size = jpegSize(data);
+    if (!size || size.width !== value.width || size.height !== value.height || !Number.isSafeInteger(value.sourceWidth) || !Number.isSafeInteger(value.sourceHeight)) throw Error();
+    return { data, width: size.width, height: size.height, sourceWidth: value.sourceWidth, sourceHeight: value.sourceHeight };
+  } catch {
+    throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  }
+}
+async function mac3(signal) {
+  try {
+    const preflight = await run("/usr/bin/osascript", ["-l", "JavaScript", "-e", "ObjC.import('CoreGraphics'); $.CGPreflightScreenCaptureAccess()"], signal);
+    if (preflight.stdout.toString("utf8").trim() !== "true") {
+      await run("/usr/bin/osascript", ["-l", "JavaScript", "-e", "ObjC.import('CoreGraphics'); $.CGRequestScreenCaptureAccess()"], signal).catch(() => {
+      });
+      throw new ScreenCaptureError("SCREEN_RECORDING_PERMISSION_REQUIRED");
+    }
+  } catch (error62) {
+    if (error62 instanceof ScreenCaptureError) throw error62;
+    throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+  }
+  const folder = await mkdtemp(path17.join(os4.tmpdir(), "lc-screen-"));
+  try {
+    const full = path17.join(folder, "full.png"), small = path17.join(folder, "small.jpg");
+    try {
+      await run("/usr/sbin/screencapture", ["-x", "-m", "-t", "png", full], signal);
+    } catch {
+      throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+    }
+    const source = (await run("/usr/bin/sips", ["-g", "pixelWidth", "-g", "pixelHeight", full], signal)).stdout.toString("utf8");
+    const sourceWidth = Number(/pixelWidth: (\d+)/.exec(source)?.[1]), sourceHeight = Number(/pixelHeight: (\d+)/.exec(source)?.[1]);
+    if (!sourceWidth || !sourceHeight) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+    for (const edge of [SCREENSHOT_MAX_EDGE, 1280, 1024, 800, 640]) {
+      const target = Math.min(edge, Math.max(sourceWidth, sourceHeight));
+      for (const quality of [75, 60, 45, 35]) {
+        await run("/usr/bin/sips", ["-Z", String(target), "-s", "format", "jpeg", "-s", "formatOptions", String(quality), full, "--out", small], signal);
+        const data = await readFile6(small), size = jpegSize(data);
+        if (!size) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+        if (data.length <= SCREENSHOT_MAX_JPEG_BYTES) return { data, ...size, sourceWidth, sourceHeight };
+      }
+    }
+    throw new ScreenCaptureError("SCREENSHOT_TOO_LARGE");
+  } catch (error62) {
+    if (error62 instanceof ScreenCaptureError) throw error62;
+    throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+  } finally {
+    await rm5(folder, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+var SESSION_KEYS = ["DISPLAY", "WAYLAND_DISPLAY", "XAUTHORITY", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS", "XDG_SESSION_TYPE", "XDG_CURRENT_DESKTOP"];
+var SESSION_VALUE = /^[A-Za-z0-9_.:,;=@+/-]{1,256}$/;
+var LINUX_SOURCE_BYTES = 150994944;
+async function linuxTool(name2) {
+  for (const directory of ["/usr/bin", "/bin", "/usr/local/bin"]) {
+    const file2 = path17.posix.join(directory, name2);
+    try {
+      await access3(file2, constants7.X_OK);
+      return file2;
+    } catch {
+    }
+  }
+  return null;
+}
+async function linuxSession(signal) {
+  const session = {}, uid = process.getuid?.();
+  const take = (key, value) => {
+    if (value && !session[key] && SESSION_VALUE.test(value)) session[key] = value;
+  };
+  const base = buildChildEnvironment(process.env, "linux");
+  for (const key of SESSION_KEYS) take(key, process.env[key]);
+  if (!session.DISPLAY && !session.WAYLAND_DISPLAY) {
+    const systemctl = await linuxTool("systemctl");
+    if (systemctl) try {
+      const { stdout } = await run(systemctl, ["--user", "show-environment"], signal, 262144, base);
+      for (const line of stdout.toString("utf8").split("\n")) {
+        const at = line.indexOf("=");
+        if (at > 0 && SESSION_KEYS.includes(line.slice(0, at))) take(line.slice(0, at), line.slice(at + 1));
+      }
+    } catch {
+      if (signal.aborted) throw new ScreenCaptureError("CANCELLED");
+    }
+  }
+  if (uid !== void 0) take("XDG_RUNTIME_DIR", "/run/user/" + uid);
+  if (!session.DISPLAY && !session.WAYLAND_DISPLAY) {
+    if (session.XDG_RUNTIME_DIR) for (const name2 of ["wayland-0", "wayland-1"]) {
+      const socket = await lstat7(path17.posix.join(session.XDG_RUNTIME_DIR, name2)).catch(() => null);
+      if (socket?.isSocket() && socket.uid === uid) {
+        session.WAYLAND_DISPLAY = name2;
+        break;
+      }
+    }
+    if (!session.WAYLAND_DISPLAY) {
+      const servers = [];
+      for (const name2 of await readdir4("/tmp/.X11-unix").catch(() => [])) {
+        const n = /^X(\d{1,4})$/.exec(name2)?.[1], socket = n ? await lstat7("/tmp/.X11-unix/" + name2).catch(() => null) : null;
+        if (n && socket?.isSocket()) servers.push({ n: Number(n), own: socket.uid === uid });
+      }
+      const server = servers.sort((a, b) => Number(b.own) - Number(a.own) || a.n - b.n)[0];
+      if (server) session.DISPLAY = ":" + server.n;
+    }
+  }
+  if (session.DISPLAY && !session.XAUTHORITY) {
+    const file2 = path17.posix.join(os4.homedir(), ".Xauthority");
+    if ((await lstat7(file2).catch(() => null))?.isFile()) take("XAUTHORITY", file2);
+  }
+  if (session.XDG_RUNTIME_DIR) take("DBUS_SESSION_BUS_ADDRESS", "unix:path=" + session.XDG_RUNTIME_DIR + "/bus");
+  const wayland = !!session.WAYLAND_DISPLAY || session.XDG_SESSION_TYPE === "wayland";
+  return { env: { ...base, ...session }, wayland, x11: !wayland && !!session.DISPLAY };
+}
+async function busSocket(env) {
+  const socket = sessionBusSocket(env.DBUS_SESSION_BUS_ADDRESS);
+  if (!socket || socket.startsWith("\0")) return socket;
+  return (await lstat7(socket).catch(() => null))?.isSocket() ? socket : null;
+}
+async function portalCapture(socket, signal) {
+  const token = "lc" + randomBytes6(8).toString("hex"), started = Date.now(), uid = process.getuid?.();
+  if (uid === void 0) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  let answer;
+  try {
+    answer = await portalScreenshot(socket, uid, token, AbortSignal.any([signal, AbortSignal.timeout(3e4)]));
+  } catch {
+    throw new ScreenCaptureError(signal.aborted ? "CANCELLED" : "SCREEN_UNAVAILABLE");
+  }
+  const { code, uri } = answer;
+  if (code === 1) throw new ScreenCaptureError("SCREEN_RECORDING_PERMISSION_REQUIRED");
+  if (code !== 0 || !uri?.startsWith("file://")) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+  const file2 = decodeURIComponent(new URL(uri).pathname), info = await lstat7(file2);
+  const fresh = info.isFile() && info.uid === uid && info.mtimeMs >= started - 5e3;
+  try {
+    if (!fresh || info.size > LINUX_SOURCE_BYTES) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
+    return await readFile6(file2);
+  } finally {
+    if (fresh) await unlink2(file2).catch(() => {
+    });
+  }
+}
+async function linux(signal) {
+  const session = await linuxSession(signal);
+  if (!session.wayland && !session.x11) throw new ScreenCaptureError("SCREENSHOT_UNSUPPORTED", { reason: "NO_DISPLAY" });
+  const output2 = (args) => async (tool) => (await run(tool, args, signal, LINUX_SOURCE_BYTES, session.env)).stdout;
+  const portal = (socket) => portalCapture(socket, signal);
+  const methods = session.wayland ? [["grim", "grim", output2(["-t", "png", "-"])], ["portal", "", portal]] : [
+    ["xwd", "xwd", output2(["-root", "-silent"])],
+    ["import", "import", output2(["-silent", "-window", "root", "png:-"])],
+    ["maim", "maim", output2(["-f", "png"])],
+    ["portal", "", portal]
+  ];
+  const tried = [];
+  for (const [name2, program, capture2] of methods) {
+    const tool = program ? await linuxTool(program) : await busSocket(session.env);
+    if (!tool) {
+      tried.push(name2 + ":missing");
+      continue;
+    }
+    let image;
+    try {
+      const source = await capture2(tool);
+      image = decodePng(source) ?? decodeXwd(source);
+    } catch (error62) {
+      if (signal.aborted) throw new ScreenCaptureError("CANCELLED");
+      if (error62 instanceof ScreenCaptureError && error62.code === "SCREEN_RECORDING_PERMISSION_REQUIRED") throw error62;
+      tried.push(name2 + ":failed");
+      continue;
+    }
+    if (!image) {
+      tried.push(name2 + ":unreadable");
+      continue;
+    }
+    const fitted = fitJpeg(image, SCREENSHOT_MAX_EDGE, SCREENSHOT_MAX_JPEG_BYTES);
+    if (!fitted) throw new ScreenCaptureError("SCREENSHOT_TOO_LARGE");
+    return { ...fitted, sourceWidth: image.width, sourceHeight: image.height };
+  }
+  throw new ScreenCaptureError("SCREENSHOT_UNSUPPORTED", {
+    reason: tried.every((entry) => entry.endsWith(":missing")) ? "NO_CAPTURE_TOOL" : "CAPTURE_FAILED",
+    session: session.wayland ? "wayland" : "x11",
+    tried
+  });
+}
+async function captureScreen(options) {
+  if (options.signal.aborted) throw new ScreenCaptureError("CANCELLED");
+  if (process.platform === "win32") return windows(options.ownerBridgePath, options.signal);
+  if (process.platform === "darwin") return mac3(options.signal);
+  if (process.platform === "linux") return linux(options.signal);
+  throw new ScreenCaptureError("SCREENSHOT_UNSUPPORTED", { reason: "PLATFORM_UNSUPPORTED" });
+}
+
 // agent/src/tools.ts
 var NativeToolError = class extends Error {
   constructor(code) {
@@ -29352,7 +30626,7 @@ function stopped(signal) {
   if (signal.aborted) fail3("CANCELLED");
 }
 async function readBoundedFile(file2, maxBytes, bridge, signal) {
-  const stat2 = await lstat7(file2);
+  const stat2 = await lstat8(file2);
   if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > maxBytes) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
   if (process.platform === "win32") {
     if (maxBytes <= 1048576 || stat2.size <= 1048576) return readWindowsFile(bridge, file2, Math.min(maxBytes, 1048576), signal);
@@ -29360,7 +30634,7 @@ async function readBoundedFile(file2, maxBytes, bridge, signal) {
     if (read.truncated) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
     return read.data;
   }
-  const handle = await open6(file2, constants7.O_RDONLY | (constants7.O_NOFOLLOW ?? 0));
+  const handle = await open6(file2, constants8.O_RDONLY | (constants8.O_NOFOLLOW ?? 0));
   try {
     const current2 = await handle.stat();
     if (!current2.isFile() || current2.size > maxBytes) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
@@ -29412,13 +30686,13 @@ var NativeTools = class {
   constructor(options) {
     this.options = options;
     this.options = structuredClone(options);
-    this.memory = new HostMemory(path17.join(options.stateDirectory, "host-memory.json"), Object.keys(options.programs), Object.fromEntries(Object.entries(options.programs).map(([name2, program]) => [name2, program.executable])));
+    this.memory = new HostMemory(path18.join(options.stateDirectory, "host-memory.json"), Object.keys(options.programs), Object.fromEntries(Object.entries(options.programs).map(([name2, program]) => [name2, program.executable])));
   }
   options;
   memory;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path17.join(path17.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail3(error62.message);
@@ -29428,31 +30702,31 @@ var NativeTools = class {
   /** Windows only: up to 64 files of at most 1 MiB in one bridge process, each with its own result. */
   async readFiles(files, maxTotalBytes, signal) {
     try {
-      return await readWindowsFiles(this.options.ownerBridgePath ?? path17.join(path17.dirname(this.options.helperPath), "OwnerBridge.exe"), files, 1048576, maxTotalBytes, signal);
+      return await readWindowsFiles(this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), files, 1048576, maxTotalBytes, signal);
     } catch (error62) {
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail3(error62.message);
       throw error62;
     }
   }
-  async prepare(workspace2, candidate, selection) {
+  async prepare(workspace2, candidate, selection2) {
     let prepared;
     try {
       let projectRoot;
-      if (selection) {
-        const target = ProjectTargetBindingSchema.parse(selection);
+      if (selection2) {
+        const target = ProjectTargetBindingSchema.parse(selection2);
         if (workspace2.rootHash !== target.workspaceRootHash) fail3("PROJECT_IDENTITY_MISMATCH");
         const identity = await this.prepareTool(workspace2, { name: "project_identity", args: { path: target.relativePath } });
         const proof2 = JSON.parse((await identity.run(AbortSignal.timeout(15e3))).stdout);
         if (!proof2.repositoryFingerprint) fail3("PROJECT_IDENTITY_UNKNOWN");
         if (proof2.repositoryFingerprint !== target.repositoryFingerprint) fail3("PROJECT_IDENTITY_MISMATCH");
-        projectRoot = path17.resolve(workspace2.root, target.relativePath);
+        projectRoot = path18.resolve(workspace2.root, target.relativePath);
         const common = identity.claims.find((claim2) => claim2.namespace === "git")?.path;
         if (common) workspace2 = { ...workspace2, gitCommonDir: common };
       }
       prepared = await this.prepareTool(workspace2, candidate, projectRoot);
     } catch (error62) {
       const parsed = ToolCallSchema.safeParse(candidate);
-      if (parsed.success && parsed.data.name === "command_run") await this.memory.record({ ...parsed.data.args, cwd: path17.resolve(workspace2.root, parsed.data.args.cwd ?? ".") }, void 0, error62).catch(() => {
+      if (parsed.success && parsed.data.name === "command_run") await this.memory.record({ ...parsed.data.args, cwd: path18.resolve(workspace2.root, parsed.data.args.cwd ?? ".") }, void 0, error62).catch(() => {
       });
       throw error62;
     }
@@ -29472,17 +30746,17 @@ var NativeTools = class {
     try {
       const canonical2 = await realpath7(workspace2.root);
       if (!equalPath3(canonical2, workspace2.root) || hash6(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace2.rootHash) fail3("WORKSPACE_CHANGED");
-      const runtimeDirectory = path17.dirname(this.options.helperPath);
+      const runtimeDirectory = path18.dirname(this.options.helperPath);
       const protectedPaths = [
         this.options.stateDirectory,
         this.options.helperPath,
-        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe", "node", "owner-store", "posix-host", "job-host.mjs", "lifecycle.mjs", "manifest.json"].map((name2) => path17.join(runtimeDirectory, name2))
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe", "node", "owner-store", "posix-host", "job-host.mjs", "lifecycle.mjs", "manifest.json"].map((name2) => path18.join(runtimeDirectory, name2))
       ];
       if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
-      if (process.platform === "win32" && process.env.LOCALAPPDATA && path17.isAbsolute(process.env.LOCALAPPDATA)) {
-        protectedPaths.push(path17.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path18.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path18.join(process.env.LOCALAPPDATA, "LocalCommander"));
       }
-      if (process.platform !== "win32") protectedPaths.push(path17.join(process.env.LC_AGENT_DATA_DIR || posixDataHome(), "LocalCommander"));
+      if (process.platform !== "win32") protectedPaths.push(path18.join(process.env.LC_AGENT_DATA_DIR || posixDataHome(), "LocalCommander"));
       guard = await PathGuard.create([canonical2], false, { protectedPaths });
       if (projectRoot) {
         const selected = await guard.resolveDirectory(projectRoot);
@@ -29571,7 +30845,7 @@ var NativeTools = class {
         }
         if (taken === first - 1 && first <= end) fail3("OUTPUT_LIMIT_EXCEEDED");
         const remaining = lines.length - (lines.length > 1 && lines.at(-1) === "" ? 1 : 0);
-        return result({ path: path17.relative(workspace2.root, filename), sha256: hash6(bytes3), startLine: first, endLine: Math.min(taken === first - 1 ? last : taken, lines.length), totalLines: lines.length, content: lines.slice(first - 1, taken).join("\n"), truncated: taken < remaining });
+        return result({ path: path18.relative(workspace2.root, filename), sha256: hash6(bytes3), startLine: first, endLine: Math.min(taken === first - 1 ? last : taken, lines.length), totalLines: lines.length, content: lines.slice(first - 1, taken).join("\n"), truncated: taken < remaining });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -29614,8 +30888,8 @@ var NativeTools = class {
           bytes3 = encodeText(pieces.join(newText), original.encoding);
         }
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail3("FILE_WRITE_LIMIT");
-        const temp = path17.join(path17.dirname(target), ".lc-write-" + randomUUID7() + ".tmp");
-        const handle = await open6(temp, constants7.O_CREAT | constants7.O_EXCL | constants7.O_WRONLY, 384);
+        const temp = path18.join(path18.dirname(target), ".lc-write-" + randomUUID7() + ".tmp");
+        const handle = await open6(temp, constants8.O_CREAT | constants8.O_EXCL | constants8.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
           await handle.sync();
@@ -29631,7 +30905,7 @@ var NativeTools = class {
                 break;
               } catch (error62) {
                 if (process.platform !== "win32" || !["EPERM", "EBUSY", "EACCES"].includes(error62.code ?? "")) throw error62;
-                if (attempt === 4) fail3((await lstat7(target)).mode & 128 ? "FILE_IN_USE" : "FILE_READ_ONLY");
+                if (attempt === 4) fail3((await lstat8(target)).mode & 128 ? "FILE_IN_USE" : "FILE_READ_ONLY");
                 await delay2(50 << attempt);
                 stopped(signal);
               }
@@ -29646,18 +30920,18 @@ var NativeTools = class {
             }
             for (let attempt = 0; attempt < 3; attempt++) {
               try {
-                await rm5(temp);
+                await rm6(temp);
                 break;
               } catch {
                 await delay2(100);
               }
             }
           }
-          return result({ path: path17.relative(workspace2.root, target), bytes: bytes3.length, sha256: hash6(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path18.relative(workspace2.root, target), bytes: bytes3.length, sha256: hash6(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
-          await rm5(temp, { force: true }).catch(() => {
+          await rm6(temp, { force: true }).catch(() => {
           });
           throw e;
         }
@@ -29679,7 +30953,7 @@ var NativeTools = class {
           const lines = decodeText(bytes3).text.split(/\r?\n/);
           scanned++;
           for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) {
-            const match = { path: path17.relative(workspace2.root, filename), line: i + 1, text: lines[i].slice(0, 500) };
+            const match = { path: path18.relative(workspace2.root, filename), line: i + 1, text: lines[i].slice(0, 500) };
             if ((room -= Buffer.byteLength(JSON.stringify(match)) + 1) < 0) {
               incomplete = true;
               break;
@@ -29722,7 +30996,7 @@ var NativeTools = class {
             continue;
           }
           try {
-            const filename = await guard.resolveExisting(path17.join(base, entry.path));
+            const filename = await guard.resolveExisting(path18.join(base, entry.path));
             guard.assertSafeFile(filename);
             if (!batched) {
               searchFile(filename, await this.readFile(filename, 1048576, signal));
@@ -29746,6 +31020,42 @@ var NativeTools = class {
         return result({ matches: matches2, scannedFiles: scanned, truncated: listing.truncated || incomplete || matches2.length >= call.args.maxResults || scanned >= 300 });
       } };
     }
+    if (call.name === "take_screenshot") {
+      if (!screenshotEnabled() && !await lstat8(path18.join(this.options.stateDirectory, SCREENSHOT_ACCEPTANCE_FILE)).then((s) => s.isFile(), () => false)) fail3("SCREENSHOT_DISABLED");
+      if (!workspace2.fullAccess) fail3("FULL_ACCESS_REQUIRED");
+      if (await lstat8(path18.join(this.options.stateDirectory, SCREENSHOT_OWNER_OFF_FILE)).then(() => true, (error62) => error62.code !== "ENOENT")) fail3("SCREENSHOT_DISABLED_BY_OWNER");
+      const bridge = this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe");
+      return { call, claims: [{ path: path18.join(this.options.stateDirectory, "screen-capture"), mode: "read" }], run: async (signal) => {
+        let shot;
+        try {
+          shot = await captureScreen({ ownerBridgePath: bridge, signal });
+        } catch (error62) {
+          if (error62 instanceof ScreenCaptureError && error62.detail) return {
+            exitCode: 1,
+            timedOut: false,
+            cancelled: false,
+            treeTerminated: true,
+            stdout: JSON.stringify({ type: "screenshot_error", resultCode: error62.code, ...error62.detail }),
+            stderr: "",
+            stdoutTruncated: false,
+            stderrTruncated: false,
+            resultCode: error62.code
+          };
+          fail3(error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message) ? error62.message : "SCREEN_UNAVAILABLE");
+        }
+        return result({
+          type: "screenshot",
+          mimeType: "image/jpeg",
+          width: shot.width,
+          height: shot.height,
+          sourceWidth: shot.sourceWidth,
+          sourceHeight: shot.sourceHeight,
+          bytes: shot.data.length,
+          capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: shot.data.toString("base64")
+        });
+      } };
+    }
     if (call.name === "localhost_request") {
       const url2 = new URL(call.args.url), port = Number(url2.port || (url2.protocol === "https:" ? 443 : 80));
       if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || (workspace2.fullAccess ? workspace2.deniedLocalhostPorts?.includes(port) : !workspace2.localhostPorts.includes(port)) || this.options.protectedPorts?.includes(port)) fail3("LOCALHOST_NOT_ALLOWED");
@@ -29816,9 +31126,9 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path17.resolve(cwd, call.args.file));
-        const relative = path17.relative(cwd, file2);
-        if (relative.startsWith(".." + path17.sep) || relative === ".." || path17.isAbsolute(relative)) fail3("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path18.resolve(cwd, call.args.file));
+        const relative = path18.relative(cwd, file2);
+        if (relative.startsWith(".." + path18.sep) || relative === ".." || path18.isAbsolute(relative)) fail3("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail3("TOOL_MISSING");
@@ -29829,7 +31139,7 @@ var NativeTools = class {
         const listing = await this.list(guard, cwd, 1, call.args.startup ? 20 : 150, signal);
         let packageInfo = null;
         try {
-          const name2 = await guard.resolveExisting(path17.join(cwd, "package.json"));
+          const name2 = await guard.resolveExisting(path18.join(cwd, "package.json"));
           guard.assertSafeFile(name2);
           const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
@@ -29849,7 +31159,7 @@ var NativeTools = class {
           }
           const contextFile = async (relative, limit, optional2 = false) => {
             try {
-              const file2 = await guard.resolveExisting(path17.join(primary, relative));
+              const file2 = await guard.resolveExisting(path18.join(primary, relative));
               guard.assertSafeFile(file2);
               return utf8(await this.readFile(file2, limit, signal));
             } catch (error62) {
@@ -29882,19 +31192,19 @@ var NativeTools = class {
     } };
   }
   async resolveProgram(name2, workspace2, args) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => equalPath3(key, name2) || path17.isAbsolute(name2) && equalPath3(value.executable, path17.resolve(name2)));
+    const entry = Object.entries(this.options.programs).find(([key, value]) => equalPath3(key, name2) || path18.isAbsolute(name2) && equalPath3(value.executable, path18.resolve(name2)));
     if (workspace2.fullAccess) {
-      const commandKey = (value) => process.platform === "win32" ? path17.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "") : path17.basename(value);
+      const commandKey = (value) => process.platform === "win32" ? path18.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "") : path18.basename(value);
       const denied = new Set((workspace2.deniedCommands ?? []).map(commandKey));
       if (denied.has(commandKey(name2)) || entry && denied.has(commandKey(entry[0]))) fail3("COMMAND_NOT_ALLOWED");
-      const extension2 = path17.extname(name2).toLowerCase();
-      const candidate = entry?.[1].executable ?? (process.platform !== "win32" ? await resolvePosixExecutable(name2) : path17.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
+      const extension2 = path18.extname(name2).toLowerCase();
+      const candidate = entry?.[1].executable ?? (process.platform !== "win32" ? await resolvePosixExecutable(name2) : path18.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
         commandKey(name2),
         [".exe", ".com", ".cmd", ".bat"].includes(extension2) ? { ...process.env, PATHEXT: extension2 } : process.env
       )?.file : void 0);
-      if (!candidate || !path17.isAbsolute(candidate)) fail3("COMMAND_NOT_FOUND");
+      if (!candidate || !path18.isAbsolute(candidate)) fail3("COMMAND_NOT_FOUND");
       const executable = await realpath7(candidate).catch(() => fail3("COMMAND_NOT_FOUND"));
-      if (!(await lstat7(executable)).isFile()) fail3("COMMAND_NOT_FOUND");
+      if (!(await lstat8(executable)).isFile()) fail3("COMMAND_NOT_FOUND");
       if (denied.has(commandKey(executable))) fail3("COMMAND_NOT_ALLOWED");
       for (const key of workspace2.deniedCommands ?? []) {
         const configured = this.options.programs[key]?.executable;
@@ -29907,7 +31217,7 @@ var NativeTools = class {
       if (/\.(cmd|bat)$/i.test(executable)) {
         if ([executable, ...args].some((value) => /[&|<>^%!"\r\n]/.test(value))) fail3("INVALID_SCRIPT_ARGUMENTS");
         const literal2 = (value) => "'" + value.replaceAll("'", "''") + "'";
-        const shell = path17.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        const shell = path18.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
         if (denied.has("powershell") || denied.has("cmd")) fail3("COMMAND_NOT_ALLOWED");
         const script = "& " + literal2(executable) + " @(" + args.map(literal2).join(",") + "); exit $LASTEXITCODE";
         return { executable: shell, args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
@@ -29915,7 +31225,7 @@ var NativeTools = class {
       if (!/\.(exe|com)$/i.test(executable)) fail3("COMMAND_NOT_ALLOWED");
       return { executable, args: [...entry?.[1].prefixArgs ?? [], ...args] };
     }
-    if (!entry || !workspace2.allowedCommands.some((v) => equalPath3(v, entry[0])) || !path17.isAbsolute(entry[1].executable)) fail3("COMMAND_NOT_ALLOWED");
+    if (!entry || !workspace2.allowedCommands.some((v) => equalPath3(v, entry[0])) || !path18.isAbsolute(entry[1].executable)) fail3("COMMAND_NOT_ALLOWED");
     return { executable: entry[1].executable, args: [...entry[1].prefixArgs ?? [], ...args] };
   }
   async memoryContext(workspace2) {
@@ -29930,13 +31240,13 @@ var NativeTools = class {
   async gitExecution(cwd, args) {
     if (!["win32", "linux", "darwin"].includes(process.platform)) fail3("COMMAND_NOT_ALLOWED");
     const configured = this.options.programs.git;
-    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path17.isAbsolute(root)).map(([root, suffix]) => path17.join(root, suffix, "cmd", "git.exe")) : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
+    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path18.isAbsolute(root)).map(([root, suffix]) => path18.join(root, suffix, "cmd", "git.exe")) : ["/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"];
     for (const source of candidates) {
-      if (!path17.isAbsolute(source)) continue;
+      if (!path18.isAbsolute(source)) continue;
       const candidate = process.platform === "win32" ? source : await resolvePosixExecutable(source);
       if (!candidate) continue;
       try {
-        const stat2 = await lstat7(candidate);
+        const stat2 = await lstat8(candidate);
         if (!stat2.isFile() || stat2.isSymbolicLink() || !equalPath3(candidate, await realpath7(candidate))) continue;
       } catch {
         continue;
@@ -29954,7 +31264,7 @@ var NativeTools = class {
       const current2 = queue.shift();
       let names;
       try {
-        names = await readdir4(current2.path, { withFileTypes: true });
+        names = await readdir5(current2.path, { withFileTypes: true });
       } catch (error62) {
         if (current2.level === 0) throw error62;
         continue;
@@ -29966,7 +31276,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path17.join(current2.path, item.name);
+        const candidate = path18.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -29976,11 +31286,11 @@ var NativeTools = class {
         }
         if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path17.relative(root, resolved), type: "directory" });
+          entries.push({ path: path18.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
-          const stat2 = await lstat7(resolved).catch(() => null);
-          if (stat2) entries.push({ path: path17.relative(root, resolved), type: "file", size: stat2.size });
+          const stat2 = await lstat8(resolved).catch(() => null);
+          if (stat2) entries.push({ path: path18.relative(root, resolved), type: "file", size: stat2.size });
         }
       }
       if (truncated) break;
@@ -29990,49 +31300,49 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace2, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace2.root)) {
-      const dotGit = path17.join(directory, ".git");
+      const dotGit = path18.join(directory, ".git");
       try {
-        const stat2 = await lstat7(dotGit);
+        const stat2 = await lstat8(dotGit);
         if (stat2.isSymbolicLink()) fail3("GIT_METADATA_CHANGED");
         let gitDir;
         if (stat2.isDirectory()) gitDir = await realpath7(dotGit);
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail3("GIT_METADATA_CHANGED");
-          gitDir = await realpath7(path17.resolve(directory, content.slice(8)));
+          gitDir = await realpath7(path18.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace2.root) && (!workspace2.gitCommonDir || !guard.isWithin(gitDir, workspace2.gitCommonDir))) fail3("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path17.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path18.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail3("GIT_METADATA_CHANGED");
-          common = await realpath7(path17.resolve(gitDir, content));
+          common = await realpath7(path18.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
-        if (!(await lstat7(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail3("GIT_METADATA_CHANGED");
+        if (!(await lstat8(common)).isDirectory() || guard.isWithin(common, this.options.stateDirectory)) fail3("GIT_METADATA_CHANGED");
         if (!guard.isWithin(common, workspace2.root) && (!workspace2.gitCommonDir || !equalPath3(common, workspace2.gitCommonDir))) fail3("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         return common;
       } catch (e) {
         if (e.code !== "ENOENT") throw e;
       }
       if (equalPath3(directory, workspace2.root)) break;
-      directory = path17.dirname(directory);
+      directory = path18.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path18 from "node:path";
-import os4 from "node:os";
+import path19 from "node:path";
+import os5 from "node:os";
 function canonical(value) {
-  const p = path18.resolve(value);
+  const p = path19.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path18.relative(a, b);
-  return relative === "" || !path18.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path18.sep);
+  const relative = path19.relative(a, b);
+  return relative === "" || !path19.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path19.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -30040,7 +31350,7 @@ function claimsConflict(a, b) {
 var NativeScheduler = class {
   constructor(options = {}) {
     this.options = options;
-    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os4.availableParallelism?.() ?? os4.cpus().length) / 2)));
+    const capacity = Math.max(1, Math.min(16, Math.floor(Math.max(2, os5.availableParallelism?.() ?? os5.cpus().length) / 2)));
     this.safeSlots = options.safeSlots ?? capacity;
     this.maxQueued = options.maxQueued ?? 32;
     if (!Number.isInteger(this.safeSlots) || this.safeSlots < 1 || this.safeSlots > 32 || !Number.isInteger(this.maxQueued) || this.maxQueued < 1 || this.maxQueued > 256) throw Error("INVALID_SCHEDULER_LIMIT");
@@ -30058,16 +31368,16 @@ var NativeScheduler = class {
     } catch {
     }
   }
-  schedule(id2, claims, deadlineAt, run, signal) {
+  schedule(id2, claims, deadlineAt, run2, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id2 || id2.length > 100 || this.active.has(id2) || this.waiting.some((j) => j.id === id2)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path18.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path19.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
     if (this.waiting.length >= this.maxQueued) return Promise.reject(Error("RESOURCE_BUSY"));
     return new Promise((resolve, reject) => {
-      const job = { id: id2, claims: claims.map((c) => ({ ...c, path: canonical(c.path) })), deadline, run, signal, resolve, reject };
+      const job = { id: id2, claims: claims.map((c) => ({ ...c, path: canonical(c.path) })), deadline, run: run2, signal, resolve, reject };
       const remove = (reason) => {
         const index = this.waiting.indexOf(job);
         if (index < 0) return;
@@ -30766,7 +32076,45 @@ function journalBinding(entry, binding2) {
 function journalResult(value, code) {
   return { ...value, resultCode: code ?? (value.treeTerminated ? value.cancelled ? "CANCELLED" : value.timedOut ? "TIMEOUT" : value.exitCode === 0 ? "SUCCESS" : "USER_PROGRAM_FAILED" : "EXECUTION_UNKNOWN") };
 }
-var knownCodes = /* @__PURE__ */ new Set(["PROJECT_IDENTITY_UNKNOWN", "PROJECT_IDENTITY_MISMATCH", "INVALID_TOOL_ARGUMENTS", "LOCAL_PERMISSION_REQUIRED", "PATH_NOT_ALLOWED", "FILE_CHANGED", "FILE_NOT_FOUND", "FILE_ALREADY_EXISTS", "REPLACEMENT_NOT_UNIQUE", "OUTPUT_LIMIT_EXCEEDED", "BINARY_FILE_NOT_SUPPORTED", "FILE_UNSUPPORTED_OR_TOO_LARGE", "INVALID_LINE_RANGE", "FILE_IN_USE", "FILE_READ_ONLY", "FILE_WRITE_LIMIT", "GIT_METADATA_CHANGED", "GIT_COMMON_DIRECTORY_NOT_APPROVED", "GIT_NOT_INSTALLED", "LOCALHOST_NOT_ALLOWED", "COMMAND_NOT_ALLOWED", "WORKSPACE_CHANGED", "WORKSPACE_UNAVAILABLE", "RESOURCE_BUSY", "AGENT_PAUSED", "CANCELLED_BEFORE_ACCEPTANCE", "ADMISSION_DEADLINE_EXPIRED"]);
+var knownCodes = /* @__PURE__ */ new Set([
+  "PROJECT_IDENTITY_UNKNOWN",
+  "PROJECT_IDENTITY_MISMATCH",
+  "INVALID_TOOL_ARGUMENTS",
+  "LOCAL_PERMISSION_REQUIRED",
+  "PATH_NOT_ALLOWED",
+  "FILE_CHANGED",
+  "FILE_NOT_FOUND",
+  "FILE_ALREADY_EXISTS",
+  "REPLACEMENT_NOT_UNIQUE",
+  "OUTPUT_LIMIT_EXCEEDED",
+  "BINARY_FILE_NOT_SUPPORTED",
+  "FILE_UNSUPPORTED_OR_TOO_LARGE",
+  "INVALID_LINE_RANGE",
+  "FILE_IN_USE",
+  "FILE_READ_ONLY",
+  "FILE_WRITE_LIMIT",
+  "GIT_METADATA_CHANGED",
+  "GIT_COMMON_DIRECTORY_NOT_APPROVED",
+  "GIT_NOT_INSTALLED",
+  "LOCALHOST_NOT_ALLOWED",
+  "COMMAND_NOT_ALLOWED",
+  "WORKSPACE_CHANGED",
+  "WORKSPACE_UNAVAILABLE",
+  "RESOURCE_BUSY",
+  "AGENT_PAUSED",
+  "CANCELLED_BEFORE_ACCEPTANCE",
+  "ADMISSION_DEADLINE_EXPIRED",
+  // take_screenshot refusals (#434, #486): without these the client sees TOOL_FAILED.
+  "FULL_ACCESS_REQUIRED",
+  "SCREENSHOT_DISABLED",
+  "SCREENSHOT_DISABLED_BY_OWNER",
+  "SCREENSHOT_UNSUPPORTED",
+  "SCREENSHOT_TOO_LARGE",
+  "SCREEN_UNAVAILABLE",
+  "SCREEN_LOCKED",
+  "SCREEN_ENCODER_UNAVAILABLE",
+  "SCREEN_RECORDING_PERMISSION_REQUIRED"
+]);
 function safeCode(error62) {
   const code = error62 instanceof NativeToolError ? error62.code : error62 instanceof Error ? error62.message : "";
   return knownCodes.has(code) || /^GUARD_[A-Z_]{1,30}$/.test(code) ? code : "TOOL_FAILED";
@@ -30777,6 +32125,14 @@ function resultOutcome(result2) {
   if (!result2.treeTerminated || result2.exitCode === null) return "unknown";
   return result2.exitCode === 0 ? "success" : "failed";
 }
+function screenshotMetadata(stdout) {
+  try {
+    const { data: _data, ...metadata } = JSON.parse(stdout);
+    return JSON.stringify(metadata);
+  } catch {
+    return "";
+  }
+}
 async function outboundResult(call, result2, binding2, optional2, ledger) {
   const shaped = call.name === "command_run" ? shapeCommandResultForAgentDetailed({ command: call.args.command, args: call.args.args, cwd: call.args.cwd ?? "." }, result2) : { result: result2, telemetry: unshapedResultTelemetry(result2) };
   if (ledger) {
@@ -30829,7 +32185,7 @@ var NativeRuntime = class {
     }
     if (frame.type === "result" && this.options.contentAudit) {
       const call = this.contexts.get(frame.binding.executionId)?.tool.call;
-      if (call) try {
+      if (call && call.name !== "take_screenshot") try {
         this.options.contentAudit.record(frame.binding, call, frame.result);
       } catch {
       }
@@ -30966,8 +32322,10 @@ var NativeRuntime = class {
         const checked = ResultSchema.parse(output2);
         const { resultCode, ...journalOutput } = checked;
         if (context.guardPermit) await this.options.guard.result(context.guardPermit, checked);
-        const final = await this.options.journal.finish(binding2.executionId, journalOutput, resultCode);
-        this.send({ type: "result", version: 1, binding: binding2, result: await outboundResult(runnable.call, journalResult(final.result, resultCode), binding2, this.optionalTelemetry, this.options.efficiencyLedger) });
+        const image = runnable.call.name === "take_screenshot" ? journalOutput.stdout : void 0;
+        const final = await this.options.journal.finish(binding2.executionId, image === void 0 ? journalOutput : { ...journalOutput, stdout: screenshotMetadata(image) }, resultCode);
+        const outbound = await outboundResult(runnable.call, journalResult(final.result, resultCode), binding2, this.optionalTelemetry, this.options.efficiencyLedger);
+        this.send({ type: "result", version: 1, binding: binding2, result: image === void 0 ? outbound : { ...outbound, stdout: image } });
       }, abort.signal);
       context.task = work.catch(async (error62) => {
         if (!context.accepted) {
@@ -31189,10 +32547,10 @@ var NativeRelayBridge = class {
 };
 
 // agent/src/local-direct.ts
-import net from "node:net";
-import path19 from "node:path";
-import { createHmac as createHmac2, hkdfSync, randomBytes as randomBytes6, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-import { mkdir as mkdir7, readFile as readFile7, rename as rename5, rm as rm6, writeFile as writeFile3 } from "node:fs/promises";
+import net2 from "node:net";
+import path20 from "node:path";
+import { createHmac as createHmac2, hkdfSync, randomBytes as randomBytes7, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { mkdir as mkdir7, readFile as readFile8, rename as rename5, rm as rm7, writeFile as writeFile3 } from "node:fs/promises";
 var LocalDirectError = class extends Error {
   constructor(code) {
     super(code);
@@ -31210,11 +32568,11 @@ var ADMISSION_MS = 6e4;
 var MAX_IN_FLIGHT = 16;
 var MAX_CONNECTIONS = 32;
 function localDirectDirectory(appData) {
-  return path19.join(appData, "LocalCommander", "LocalMcp");
+  return path20.join(appData, "LocalCommander", "LocalMcp");
 }
 async function localDirectEnabled(directory) {
   try {
-    return JSON.parse(await readFile7(path19.join(directory, "settings.json"), "utf8"))?.enabled === true;
+    return JSON.parse(await readFile8(path20.join(directory, "settings.json"), "utf8"))?.enabled === true;
   } catch {
     return false;
   }
@@ -31228,7 +32586,7 @@ function sameProof(candidate, expected) {
   const a = Buffer.from(candidate), b = Buffer.from(expected);
   return a.length === b.length && timingSafeEqual3(a, b);
 }
-var nonce = () => randomBytes6(32).toString("base64url");
+var nonce = () => randomBytes7(32).toString("base64url");
 var NONCE = /^[A-Za-z0-9_-]{43}$/;
 function codeOf(error62) {
   const code = error62 instanceof NativeToolError || error62 instanceof LocalDirectError ? error62.code : error62 instanceof Error ? error62.message : "";
@@ -31287,7 +32645,7 @@ var Lines = class {
 async function readEndpoint(directory) {
   let value;
   try {
-    value = JSON.parse(await readFile7(path19.join(directory, "endpoint.json"), "utf8"));
+    value = JSON.parse(await readFile8(path20.join(directory, "endpoint.json"), "utf8"));
   } catch {
     fail4("LOCAL_AGENT_NOT_RUNNING");
   }
@@ -31304,13 +32662,13 @@ var LocalDirectServer = class _LocalDirectServer {
   sockets = /* @__PURE__ */ new Set();
   /** Listens only while the owner has enabled direct local access; null otherwise. */
   static async start(options) {
-    const endpointFile = path19.join(options.directory, "endpoint.json");
+    const endpointFile = path20.join(options.directory, "endpoint.json");
     if (!await localDirectEnabled(options.directory)) {
-      await rm6(endpointFile, { force: true }).catch(() => {
+      await rm7(endpointFile, { force: true }).catch(() => {
       });
       return null;
     }
-    const server = net.createServer(), self = new _LocalDirectServer(server, options);
+    const server = net2.createServer(), self = new _LocalDirectServer(server, options);
     server.on("connection", (socket) => self.accept(socket));
     await new Promise((resolve, reject) => {
       server.once("error", reject);
@@ -31332,7 +32690,7 @@ var LocalDirectServer = class _LocalDirectServer {
     for (const socket of this.sockets) socket.destroy();
     await new Promise((resolve) => this.server.close(() => resolve()));
     try {
-      if ((await readEndpoint(this.options.directory)).pid === process.pid) await rm6(path19.join(this.options.directory, "endpoint.json"), { force: true });
+      if ((await readEndpoint(this.options.directory)).pid === process.pid) await rm7(path20.join(this.options.directory, "endpoint.json"), { force: true });
     } catch {
     }
   }
@@ -31467,7 +32825,7 @@ var LocalDirectClient = class _LocalDirectClient {
   static async connect(options) {
     if (!await localDirectEnabled(options.directory)) fail4("LOCAL_ACCESS_DISABLED");
     const endpoint2 = await readEndpoint(options.directory);
-    const socket = net.createConnection({ host: "127.0.0.1", port: endpoint2.port });
+    const socket = net2.createConnection({ host: "127.0.0.1", port: endpoint2.port });
     let handler = () => {
     };
     const lines = new Lines(socket, (frame) => handler(frame));
@@ -35187,9 +36545,9 @@ var rev2026Codec = {
     });
     const parsed = buildSchemas2026().RequestMetaEnvelopeSchema.safeParse(meta3);
     if (!parsed.success) for (const issue2 of parsed.error.issues) {
-      const path29 = issue2.path.map(String);
-      const key = path29.length > 0 ? path29.join(".") : "_meta";
-      if (path29.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
+      const path30 = issue2.path.map(String);
+      const key = path30.length > 0 ? path30.join(".") : "_meta";
+      if (path30.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
       issues.push({
         key,
         problem: issue2.message
@@ -35491,29 +36849,29 @@ var PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
-  const visit2 = (node2, path29, reachable) => {
+  const visit2 = (node2, path30, reachable) => {
     if (node2 === null || typeof node2 !== "object") return void 0;
     const schema = node2;
     if (X_MCP_HEADER_KEY in schema) {
-      if (!reachable || path29.length === 0) return `${pathName(path29)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
+      if (!reachable || path30.length === 0) return `${pathName(path30)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
       const raw = schema[X_MCP_HEADER_KEY];
-      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path29)}: x-mcp-header MUST be a non-empty string`;
-      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path29)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
+      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path30)}: x-mcp-header MUST be a non-empty string`;
+      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path30)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       const type = typeof schema.type === "string" ? schema.type : void 0;
-      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path29)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path30)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
       const lower = raw.toLowerCase();
       const prior = seenLower.get(lower);
       if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
       seenLower.set(lower, raw);
       declarations.push({
-        path: path29,
+        path: path30,
         headerName: raw,
         type
       });
     }
     const properties = schema.properties;
     if (properties !== null && typeof properties === "object") for (const [key, child] of Object.entries(properties)) {
-      const fault$1 = visit2(child, [...path29, key], reachable);
+      const fault$1 = visit2(child, [...path30, key], reachable);
       if (fault$1 !== void 0) return fault$1;
     }
     for (const k of NON_REACHABLE_SUBSCHEMA_KEYWORDS) {
@@ -35521,7 +36879,7 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (sub === void 0) continue;
       const branches = Array.isArray(sub) ? sub : sub !== null && typeof sub === "object" && OBJECT_VALUED_SUBSCHEMA_KEYWORDS.has(k) ? Object.values(sub) : [sub];
       for (const branch of branches) {
-        const fault$1 = visit2(branch, [...path29, `<${k}>`], false);
+        const fault$1 = visit2(branch, [...path30, `<${k}>`], false);
         if (fault$1 !== void 0) return fault$1;
       }
     }
@@ -35561,8 +36919,8 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "$defs",
   "definitions"
 ]);
-function pathName(path29) {
-  return path29.length === 0 ? "<root>" : path29.join(".");
+function pathName(path30) {
+  return path30.length === 0 ? "<root>" : path30.join(".");
 }
 var HEADER_MISMATCH_ERROR_CODE = -32020;
 var INBOUND_VALIDATION_LADDER = [
@@ -35812,7 +37170,7 @@ var PROPERTY_KEYS_BY_TYPE = {
   array: shapeKeys([UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema])
 };
 var SUPPORTED_STRING_FORMATS = new Set(StringSchemaSchema.shape.format.unwrap().options);
-function walkProperty(node2, path29, vendor, unsupported) {
+function walkProperty(node2, path30, vendor, unsupported) {
   if (!isJsonObject(node2)) return node2;
   const allowedKeys = typeof node2.type === "string" && Object.hasOwn(PROPERTY_KEYS_BY_TYPE, node2.type) ? PROPERTY_KEYS_BY_TYPE[node2.type] : void 0;
   if (allowedKeys === void 0) return node2;
@@ -35820,8 +37178,8 @@ function walkProperty(node2, path29, vendor, unsupported) {
   for (const [key, value] of Object.entries(node2)) if (allowedKeys.has(key) || isAnnotationOnlyJsonSchemaKeyword(key)) pruned[key] = value;
   else if (key === "pattern" && node2.type === "string" && typeof node2.format === "string") {
     if (!SUPPORTED_STRING_FORMATS.has(node2.format)) pruned[key] = value;
-    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path29}.${key}`);
-  } else unsupported.push(`${path29}.${key}`);
+    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path30}.${key}`);
+  } else unsupported.push(`${path30}.${key}`);
   return pruned;
 }
 function walkRequestedSchema(converted, vendor) {
@@ -35838,11 +37196,11 @@ function describeUnsupportedProperties(pruned, fallback) {
   const offenders = Object.entries(pruned.properties).filter(([, node2]) => !parseSchema(PrimitiveSchemaDefinitionSchema, node2).success).map(([name2]) => `properties.${name2}`);
   return offenders.length > 0 ? offenders.join(", ") : fallback;
 }
-function findDroppedConstraintPaths(original, parsed, path29 = "") {
-  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path29}[${index}]`));
+function findDroppedConstraintPaths(original, parsed, path30 = "") {
+  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path30}[${index}]`));
   if (!isJsonObject(original) || !isJsonObject(parsed)) return [];
   return Object.entries(original).flatMap(([key, value]) => {
-    const childPath = path29 ? `${path29}.${key}` : key;
+    const childPath = path30 ? `${path30}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(parsed, key)) return isAnnotationOnlyJsonSchemaKeyword(key) ? [] : [childPath];
     return findDroppedConstraintPaths(value, parsed[key], childPath);
   });
@@ -36990,8 +38348,8 @@ var require_content_type = /* @__PURE__ */ __commonJSMin(((exports) => {
   var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
   var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
   var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  exports.parse = parse3;
-  function parse3(string4) {
+  exports.parse = parse4;
+  function parse4(string4) {
     if (!string4) throw new TypeError("argument string is required");
     var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
     if (typeof header !== "string") throw new TypeError("argument string is required to be a string");
@@ -37515,9 +38873,9 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
       const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
       return `${varKind} ${this.name}${rhs};` + _n;
     }
-    optimizeNames(names, constants10) {
+    optimizeNames(names, constants11) {
       if (!names[this.name.str]) return;
-      if (this.rhs) this.rhs = optimizeExpr(this.rhs, names, constants10);
+      if (this.rhs) this.rhs = optimizeExpr(this.rhs, names, constants11);
       return this;
     }
     get names() {
@@ -37534,9 +38892,9 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
     render({ _n }) {
       return `${this.lhs} = ${this.rhs};` + _n;
     }
-    optimizeNames(names, constants10) {
+    optimizeNames(names, constants11) {
       if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects) return;
-      this.rhs = optimizeExpr(this.rhs, names, constants10);
+      this.rhs = optimizeExpr(this.rhs, names, constants11);
       return this;
     }
     get names() {
@@ -37595,8 +38953,8 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
     optimizeNodes() {
       return `${this.code}` ? this : void 0;
     }
-    optimizeNames(names, constants10) {
-      this.code = optimizeExpr(this.code, names, constants10);
+    optimizeNames(names, constants11) {
+      this.code = optimizeExpr(this.code, names, constants11);
       return this;
     }
     get names() {
@@ -37622,12 +38980,12 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
       }
       return nodes.length > 0 ? this : void 0;
     }
-    optimizeNames(names, constants10) {
+    optimizeNames(names, constants11) {
       const { nodes } = this;
       let i = nodes.length;
       while (i--) {
         const n = nodes[i];
-        if (n.optimizeNames(names, constants10)) continue;
+        if (n.optimizeNames(names, constants11)) continue;
         subtractNames(names, n.names);
         nodes.splice(i, 1);
       }
@@ -37674,11 +39032,11 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
       if (cond === false || !this.nodes.length) return void 0;
       return this;
     }
-    optimizeNames(names, constants10) {
+    optimizeNames(names, constants11) {
       var _a3;
-      this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants10);
-      if (!(super.optimizeNames(names, constants10) || this.else)) return;
-      this.condition = optimizeExpr(this.condition, names, constants10);
+      this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants11);
+      if (!(super.optimizeNames(names, constants11) || this.else)) return;
+      this.condition = optimizeExpr(this.condition, names, constants11);
       return this;
     }
     get names() {
@@ -37700,9 +39058,9 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
     render(opts) {
       return `for(${this.iteration})` + super.render(opts);
     }
-    optimizeNames(names, constants10) {
-      if (!super.optimizeNames(names, constants10)) return;
-      this.iteration = optimizeExpr(this.iteration, names, constants10);
+    optimizeNames(names, constants11) {
+      if (!super.optimizeNames(names, constants11)) return;
+      this.iteration = optimizeExpr(this.iteration, names, constants11);
       return this;
     }
     get names() {
@@ -37737,9 +39095,9 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
     render(opts) {
       return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
     }
-    optimizeNames(names, constants10) {
-      if (!super.optimizeNames(names, constants10)) return;
-      this.iterable = optimizeExpr(this.iterable, names, constants10);
+    optimizeNames(names, constants11) {
+      if (!super.optimizeNames(names, constants11)) return;
+      this.iterable = optimizeExpr(this.iterable, names, constants11);
       return this;
     }
     get names() {
@@ -37778,11 +39136,11 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
       (_b = this.finally) === null || _b === void 0 || _b.optimizeNodes();
       return this;
     }
-    optimizeNames(names, constants10) {
+    optimizeNames(names, constants11) {
       var _a3, _b;
-      super.optimizeNames(names, constants10);
-      (_a3 = this.catch) === null || _a3 === void 0 || _a3.optimizeNames(names, constants10);
-      (_b = this.finally) === null || _b === void 0 || _b.optimizeNames(names, constants10);
+      super.optimizeNames(names, constants11);
+      (_a3 = this.catch) === null || _a3 === void 0 || _a3.optimizeNames(names, constants11);
+      (_b = this.finally) === null || _b === void 0 || _b.optimizeNames(names, constants11);
       return this;
     }
     get names() {
@@ -38031,7 +39389,7 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
   function addExprNames(names, from) {
     return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
   }
-  function optimizeExpr(expr, names, constants10) {
+  function optimizeExpr(expr, names, constants11) {
     if (expr instanceof code_1.Name) return replaceName(expr);
     if (!canOptimize(expr)) return expr;
     return new code_1._Code(expr._items.reduce((items, c) => {
@@ -38041,13 +39399,13 @@ var require_codegen = /* @__PURE__ */ __commonJSMin(((exports) => {
       return items;
     }, []));
     function replaceName(n) {
-      const c = constants10[n.str];
+      const c = constants11[n.str];
       if (c === void 0 || names[n.str] !== 1) return n;
       delete names[n.str];
       return c;
     }
     function canOptimize(e) {
-      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants10[c.str] !== void 0);
+      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants11[c.str] !== void 0);
     }
   }
   function subtractNames(names, from) {
@@ -39918,8 +41276,8 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     for (let i = 0; i < str.length; i++) if (str[i] === token) ind++;
     return ind;
   }
-  function removeDotSegments(path29) {
-    let input2 = path29;
+  function removeDotSegments(path30) {
+    let input2 = path30;
     const output2 = [];
     let nextSlash = -1;
     let len = 0;
@@ -40072,8 +41430,8 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       wsComponent.secure = void 0;
     }
     if (wsComponent.resourceName) {
-      const [path29, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path29 && path29 !== "/" ? path29 : void 0;
+      const [path30, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path30 && path30 !== "/" ? path30 : void 0;
       wsComponent.query = query;
       wsComponent.resourceName = void 0;
     }
@@ -40179,21 +41537,21 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
   const { SCHEMES, getSchemeHandler } = require_schemes();
   function normalize(uri, options) {
-    if (typeof uri === "string") uri = serialize(parse3(uri, options), options);
-    else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
+    if (typeof uri === "string") uri = serialize(parse4(uri, options), options);
+    else if (typeof uri === "object") uri = parse4(serialize(uri, options), options);
     return uri;
   }
   function resolve(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
+    const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
   function resolveComponent(base, relative, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
-      base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      base = parse4(serialize(base, options), options);
+      relative = parse4(serialize(relative, options), options);
     }
     options = options || {};
     if (!options.tolerant && relative.scheme) {
@@ -40237,7 +41595,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   function equal(uriA, uriB, options) {
     if (typeof uriA === "string") {
       uriA = unescape(uriA);
-      uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), {
+      uriA = serialize(normalizeComponentEncoding(parse4(uriA, options), true), {
         ...options,
         skipEscape: true
       });
@@ -40247,7 +41605,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     });
     if (typeof uriB === "string") {
       uriB = unescape(uriB);
-      uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), {
+      uriB = serialize(normalizeComponentEncoding(parse4(uriB, options), true), {
         ...options,
         skipEscape: true
       });
@@ -40300,7 +41658,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     return uriTokens.join("");
   }
   const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-  function parse3(uri, opts) {
+  function parse4(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
       scheme: void 0,
@@ -40361,7 +41719,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     resolveComponent,
     equal,
     serialize,
-    parse: parse3
+    parse: parse4
   };
   module.exports = fastUri;
   module.exports.default = fastUri;
@@ -45640,7 +46998,8 @@ var DESCRIPTIONS = {
   git_diff: ["Git diff of the repository at a workspace-relative path.", { readOnlyHint: true, openWorldHint: false }],
   git_log: ["Recent Git commits of the repository at a workspace-relative path.", { readOnlyHint: true, openWorldHint: false }],
   project_snapshot: ["Compact project overview: Git state and, with startup, AGENTS.md policy and task continuation.", { readOnlyHint: true, openWorldHint: false }],
-  command_run: ["Run one executable with an argument array (no shell parsing), hidden, with captured output. Uses this Windows account's rights within the owner's grant.", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
+  command_run: ["Run one executable with an argument array (no shell parsing), hidden, with captured output. Uses this user account's rights within the owner's grant.", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }],
+  take_screenshot: ["Take a still image of this computer's primary screen, returned as a JPEG image. It contains everything visible on the screen, including any open passwords, keys or private messages. Needs a Full Access workspace; the lock screen is never captured.", { readOnlyHint: true, openWorldHint: false }],
   localhost_request: ["HTTP request to a service on this computer (localhost only).", { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }]
 };
 var workspace = external_exports.string().min(1).max(4096).optional().describe("Workspace grant id, root path (for example D:\\) or display name from workspace_list. Optional when only one workspace is approved.");
@@ -45653,6 +47012,14 @@ function failure4(error62) {
   return text2(code + hint, true);
 }
 function render(name2, result2) {
+  if (name2 === "take_screenshot" && result2.resultCode === "SUCCESS") {
+    try {
+      const { data, mimeType, ...metadata } = JSON.parse(result2.stdout);
+      if (typeof data === "string" && data && mimeType === "image/jpeg") return { content: [{ type: "image", data, mimeType }, { type: "text", text: JSON.stringify(metadata) }] };
+    } catch {
+    }
+    return text2(JSON.stringify({ resultCode: "SCREEN_UNAVAILABLE" }), true);
+  }
   if (name2 !== "command_run" && result2.resultCode === "SUCCESS") return text2(result2.stdout);
   const { exitCode, resultCode, timedOut, cancelled, stdout, stderr, stdoutTruncated, stderrTruncated } = result2;
   return text2(
@@ -45673,7 +47040,7 @@ async function serveLocalMcp(options) {
     return connecting;
   };
   const server = new McpServer({ name: "local-commander-local", version: options.agentVersion }, {
-    instructions: "Local Commander direct access to this computer, through the owner's approved workspaces. Paths are relative to the selected workspace root; call workspace_list to see roots. Commands run hidden with this Windows account's rights; owner denials still apply."
+    instructions: "Local Commander direct access to this computer, through the owner's approved workspaces. Paths are relative to the selected workspace root; call workspace_list to see roots. Commands run hidden with this user account's rights; owner denials still apply."
   });
   server.registerTool(
     "workspace_list",
@@ -45688,7 +47055,7 @@ async function serveLocalMcp(options) {
   );
   for (const option of ToolCallSchema.options) {
     const name2 = option.shape.name.value, entry = DESCRIPTIONS[name2];
-    if (!entry) continue;
+    if (!entry || name2 === "take_screenshot" && !screenshotEnabled()) continue;
     const inputSchema = option.shape.args.extend({ workspace });
     const callback = async (input2, ctx) => {
       const { workspace: selected, ...args } = input2;
@@ -46154,6 +47521,7 @@ async function connectOnce(options) {
     const incidents = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes("incidentBatchV1");
     const monitorHeartbeat = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes("monitorHeartbeatV1") && typeof readyFrame.heartbeatMs === "number" && Number.isInteger(readyFrame.heartbeatMs) && readyFrame.heartbeatMs >= 1e3 && readyFrame.heartbeatMs <= 6e4 ? readyFrame.heartbeatMs : void 0;
     const nativeStatus = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(NATIVE_STATUS_CAPABILITY) && options.status;
+    const accessModes = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(WORKSPACE_ACCESS_MODE_CAPABILITY);
     const reportStatus = () => {
       if (!nativeStatus) return;
       const { safeSlots, active, queued, paused } = nativeStatus();
@@ -46380,7 +47748,16 @@ async function connectOnce(options) {
       registerWorkspace: (workspace2) => {
         if (pendingWorkspace.size >= 32) return Promise.reject(new RelayClientError("RELAY_PENDING_LIMIT"));
         const requestId = randomUUID10();
-        const event = { type: "workspace_grant", version: 1, requestId, workspaceGrantId: workspace2.workspaceGrantId, rootHash: workspace2.rootHash, displayName: workspace2.displayName, policyVersion: workspace2.policyVersion };
+        const event = {
+          type: "workspace_grant",
+          version: 1,
+          requestId,
+          workspaceGrantId: workspace2.workspaceGrantId,
+          rootHash: workspace2.rootHash,
+          displayName: workspace2.displayName,
+          policyVersion: workspace2.policyVersion,
+          ...accessModes ? { accessMode: workspace2.fullAccess === true ? "full" : "scoped" } : {}
+        };
         return new Promise((resolve, reject) => {
           const timer = setTimeout(() => {
             pendingWorkspace.delete(requestId);
@@ -46427,16 +47804,16 @@ async function connectOnce(options) {
 // agent/src/machine-identity.ts
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import os5 from "node:os";
+import os6 from "node:os";
 import { open as open7 } from "node:fs/promises";
-import { constants as constants8 } from "node:fs";
-import path20 from "node:path";
+import { constants as constants9 } from "node:fs";
+import path21 from "node:path";
 var MACHINE_GUID = /^\s*MachineGuid\s+REG_SZ\s+([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\s*$/m;
 async function readMachineGuid(timeoutMs2 = 5e3) {
   if (process.platform === "linux") {
     let handle;
     try {
-      handle = await open7("/etc/machine-id", constants8.O_RDONLY | constants8.O_NOFOLLOW);
+      handle = await open7("/etc/machine-id", constants9.O_RDONLY | constants9.O_NOFOLLOW);
       const stat2 = await handle.stat();
       if (!stat2.isFile() || stat2.size > 128) return null;
       const data = Buffer.alloc(129);
@@ -46451,7 +47828,7 @@ async function readMachineGuid(timeoutMs2 = 5e3) {
     }
   }
   if (!["win32", "darwin"].includes(process.platform)) return null;
-  const reg = process.platform === "darwin" ? "/usr/sbin/ioreg" : path20.join(process.env.SystemRoot || "C:\\Windows", "System32", "reg.exe");
+  const reg = process.platform === "darwin" ? "/usr/sbin/ioreg" : path21.join(process.env.SystemRoot || "C:\\Windows", "System32", "reg.exe");
   const args = process.platform === "darwin" ? ["-rd1", "-c", "IOPlatformExpertDevice"] : ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid", "/reg:64"];
   const pattern = process.platform === "darwin" ? /"IOPlatformUUID"\s*=\s*"([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})"/ : MACHINE_GUID;
   return new Promise((resolve) => {
@@ -46485,7 +47862,7 @@ async function readComputerName(timeoutMs2 = 5e3) {
   if (process.platform === "linux") {
     let handle;
     try {
-      handle = await open7("/etc/hostname", constants8.O_RDONLY | constants8.O_NOFOLLOW);
+      handle = await open7("/etc/hostname", constants9.O_RDONLY | constants9.O_NOFOLLOW);
       const data = Buffer.alloc(257), { bytesRead } = await handle.read(data, 0, data.length, 0);
       const name2 = data.subarray(0, bytesRead).toString("utf8").trim();
       if (bytesRead <= 256 && valid(name2)) return name2;
@@ -46523,9 +47900,9 @@ async function readComputerName(timeoutMs2 = 5e3) {
     });
     if (valid(name2)) return name2;
   }
-  return os5.hostname();
+  return os6.hostname();
 }
-function machineProof(deviceId, machineGuid, computerName = os5.hostname()) {
+function machineProof(deviceId, machineGuid, computerName = os6.hostname()) {
   const name2 = computerName.slice(0, 120);
   if (!name2 || name2.trim() !== name2 || /[\u0000-\u001f\u007f]/.test(name2)) return null;
   const fingerprint3 = createHash16("sha256").update("lcmcp-machine-v1\0" + deviceId.toLowerCase() + "\0" + machineGuid.toLowerCase() + "\0" + name2.toUpperCase(), "utf8").digest("hex");
@@ -46566,8 +47943,8 @@ function canonicalOrigin2(value) {
     fail6("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path29) {
-  return origin + path29;
+function endpoint(origin, path30) {
+  return origin + path30;
 }
 function uuid21(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail6(code);
@@ -47068,29 +48445,29 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 }
 
 // agent/src/optimization-ledger.ts
-import { constants as constants9 } from "node:fs";
-import { lstat as lstat8, mkdir as mkdir8, open as open8, readFile as readFile8, realpath as realpath8 } from "node:fs/promises";
-import path21 from "node:path";
+import { constants as constants10 } from "node:fs";
+import { lstat as lstat9, mkdir as mkdir8, open as open8, readFile as readFile9, realpath as realpath8 } from "node:fs/promises";
+import path22 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure5(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path21.resolve(directory);
+  const absolute2 = path22.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
-      if ((await lstat8(current2)).isSymbolicLink()) throw failure5("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
+      if ((await lstat9(current2)).isSymbolicLink()) throw failure5("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path21.dirname(current2);
+    const parent = path22.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
   await mkdir8(absolute2, { recursive: true, mode: 448 });
-  const stat2 = await lstat8(absolute2);
+  const stat2 = await lstat9(absolute2);
   if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw failure5("OPTIMIZATION_LEDGER_DIRECTORY_INVALID");
   return realpath8(absolute2);
 }
@@ -47120,29 +48497,29 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path21.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path21.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path22.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path22.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
-      const stat2 = await lstat8(filename);
+      const stat2 = await lstat9(filename);
       if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > MAX_LEDGER_BYTES) {
         throw failure5("OPTIMIZATION_LEDGER_INVALID");
       }
-      existing = await readFile8(filename, "utf8");
+      existing = await readFile9(filename, "utf8");
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
     const handle = await open8(
       filename,
-      constants9.O_CREAT | constants9.O_APPEND | constants9.O_WRONLY | (constants9.O_NOFOLLOW ?? 0),
+      constants10.O_CREAT | constants10.O_APPEND | constants10.O_WRONLY | (constants10.O_NOFOLLOW ?? 0),
       384
     );
     const ledger = new _OptimizationLedger(filename, handle, noticesFilename);
     try {
       try {
-        const noticeStat = await lstat8(noticesFilename);
+        const noticeStat = await lstat9(noticesFilename);
         if (!noticeStat.isFile() || noticeStat.isSymbolicLink() || noticeStat.size > MAX_NOTICE_LEDGER_BYTES) throw failure5("OPTIMIZATION_NOTICE_LEDGER_INVALID");
-        const notices = await readFile8(noticesFilename, "utf8");
+        const notices = await readFile9(noticesFilename, "utf8");
         for (const line of notices.split("\n")) {
           if (!line) continue;
           const parsed = JSON.parse(line);
@@ -47222,7 +48599,7 @@ var OptimizationLedger = class _OptimizationLedger {
       const marker = JSON.stringify({ sessionId: event.sessionId, checkpointCalls, deliveredAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n";
       let currentBytes = 0;
       try {
-        const stat2 = await lstat8(this.noticesFilename);
+        const stat2 = await lstat9(this.noticesFilename);
         if (!stat2.isFile() || stat2.isSymbolicLink()) throw failure5("OPTIMIZATION_NOTICE_LEDGER_INVALID");
         currentBytes = stat2.size;
       } catch (error62) {
@@ -47231,7 +48608,7 @@ var OptimizationLedger = class _OptimizationLedger {
       if (currentBytes + Buffer.byteLength(marker, "utf8") > MAX_NOTICE_LEDGER_BYTES) throw failure5("OPTIMIZATION_NOTICE_LEDGER_CAPACITY_EXCEEDED");
       const markerHandle = await open8(
         this.noticesFilename,
-        constants9.O_CREAT | constants9.O_APPEND | constants9.O_WRONLY | (constants9.O_NOFOLLOW ?? 0),
+        constants10.O_CREAT | constants10.O_APPEND | constants10.O_WRONLY | (constants10.O_NOFOLLOW ?? 0),
         384
       );
       try {
@@ -47270,9 +48647,9 @@ var OptimizationLedger = class _OptimizationLedger {
 
 // agent/src/monitor.ts
 import { createHash as createHash17, randomUUID as randomUUID12 } from "node:crypto";
-import { lstat as lstat9, mkdir as mkdir9, open as open9, rename as rename6, rm as rm7 } from "node:fs/promises";
-import path22 from "node:path";
-import os6 from "node:os";
+import { lstat as lstat10, mkdir as mkdir9, open as open9, rename as rename6, rm as rm8 } from "node:fs/promises";
+import path23 from "node:path";
+import os7 from "node:os";
 
 // packages/agent-cli/bin/monitor-savings.mjs
 var count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e15;
@@ -47294,7 +48671,7 @@ function lifetimeSavingsView(raw) {
 // agent/src/monitor.ts
 function commandSummary2(tool) {
   if (tool.name !== "command_run") return { name: tool.name, command: tool.name };
-  const candidate = path22.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
+  const candidate = path23.win32.basename(tool.args.command).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
   const name2 = ["node", "npm", "npx", "git", "rg", "powershell", "pwsh", "cmd", "tsc", "python", "dotnet"].includes(candidate) ? candidate : "command";
   let command = name2;
   if (name2 === "node" && tool.args.args.includes("--test") && !tool.args.args.some((arg) => ["-e", "--eval", "-p", "--print"].includes(arg))) command += " --test";
@@ -47307,9 +48684,9 @@ function commandSummary2(tool) {
 var ProductionMonitor = class {
   constructor(directory, stateDirectory, agentVersion3) {
     this.agentVersion = agentVersion3;
-    const key = createHash17("sha256").update(path22.resolve(stateDirectory).toLowerCase()).digest("hex");
-    this.file = path22.join(directory, key + ".json");
-    this.transportFile = path22.join(directory, key + ".transport");
+    const key = createHash17("sha256").update(path23.resolve(stateDirectory).toLowerCase()).digest("hex");
+    this.file = path23.join(directory, key + ".json");
+    this.transportFile = path23.join(directory, key + ".transport");
   }
   agentVersion;
   instanceId = randomUUID12();
@@ -47320,7 +48697,7 @@ var ProductionMonitor = class {
   measured = /* @__PURE__ */ new Set();
   polls = { status: 0, output: 0 };
   efficiencyCalls = 0;
-  computer = os6.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
+  computer = os7.hostname().replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 64) || "PC";
   sequence = 0;
   connection = {
     state: "starting",
@@ -47501,7 +48878,7 @@ var ProductionMonitor = class {
       schemaVersion: 1,
       instanceId: this.instanceId,
       pid: process.pid,
-      savingsSourceId: path22.basename(this.file, ".json"),
+      savingsSourceId: path23.basename(this.file, ".json"),
       lifetimeSavings: this.lifetimeSavings && { ...this.lifetimeSavings },
       computer: this.computer,
       processName: "lc-agent",
@@ -47535,9 +48912,9 @@ var ProductionMonitor = class {
     return this.writing;
   }
   async write(file2, contents) {
-    const directory = path22.dirname(file2);
+    const directory = path23.dirname(file2);
     await mkdir9(directory, { recursive: true, mode: 448 });
-    const stat2 = await lstat9(directory);
+    const stat2 = await lstat10(directory);
     if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
     const temporary = file2 + "." + this.instanceId + ".tmp";
     const handle = await open9(temporary, "wx", 384);
@@ -47549,7 +48926,7 @@ var ProductionMonitor = class {
       }
       await rename6(temporary, file2);
     } finally {
-      await rm7(temporary, { force: true });
+      await rm8(temporary, { force: true });
     }
   }
   async close() {
@@ -47960,27 +49337,27 @@ var NativeFabricObserver = class {
 };
 
 // agent/src/native-fabric-startup.ts
-import { lstat as lstat11, mkdir as mkdir12, open as open11, readFile as readFile9 } from "node:fs/promises";
-import path25 from "node:path";
+import { lstat as lstat12, mkdir as mkdir12, open as open11, readFile as readFile10 } from "node:fs/promises";
+import path26 from "node:path";
 
 // src/agent-fabric-service.ts
-import { lstat as lstat10, mkdir as mkdir11, realpath as realpath9 } from "node:fs/promises";
+import { lstat as lstat11, mkdir as mkdir11, realpath as realpath9 } from "node:fs/promises";
 import { watch } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/agent-runtime-identity.ts
-import { createHash as createHash19, randomBytes as randomBytes7, randomUUID as randomUUID14, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { createHash as createHash19, randomBytes as randomBytes8, randomUUID as randomUUID14, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 
 // src/agent-fabric-state.ts
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { mkdir as mkdir10, open as open10, rename as rename7, unlink as unlink2 } from "node:fs/promises";
-import path23 from "node:path";
+import { mkdir as mkdir10, open as open10, rename as rename7, unlink as unlink3 } from "node:fs/promises";
+import path24 from "node:path";
 var queues = /* @__PURE__ */ new Map();
 var FabricStateFile = class {
-  constructor(file2, maxBytes, parse3) {
+  constructor(file2, maxBytes, parse4) {
     this.maxBytes = maxBytes;
-    this.parse = parse3;
-    this.file = path23.resolve(file2);
+    this.parse = parse4;
+    this.file = path24.resolve(file2);
   }
   maxBytes;
   parse;
@@ -48024,7 +49401,7 @@ var FabricStateFile = class {
   }
   update(fn, create) {
     return this.serial(async () => {
-      if (create) await mkdir10(path23.dirname(this.file), { recursive: true });
+      if (create) await mkdir10(path24.dirname(this.file), { recursive: true });
       const lockPath = this.file + ".lock";
       const token = randomUUID13();
       const lock = await open10(lockPath, "wx", 384).catch((error62) => {
@@ -48055,7 +49432,7 @@ var FabricStateFile = class {
           }
           await rename7(temporary, this.file);
         } finally {
-          await unlink2(temporary).catch((error62) => {
+          await unlink3(temporary).catch((error62) => {
             if (error62.code !== "ENOENT") throw error62;
           });
         }
@@ -48069,7 +49446,7 @@ var FabricStateFile = class {
         } finally {
           await current2.close();
         }
-        await unlink2(lockPath);
+        await unlink3(lockPath);
       }
     });
   }
@@ -48123,7 +49500,7 @@ var AgentRuntimeIdentityStore = class {
     return this.serial((state) => {
       if (state.bindings.length >= MAX_BINDINGS) throw Error("RUNTIME_IDENTITY_LIMIT");
       const runtimeId = "rt-" + randomUUID14();
-      const runtimeKey = randomBytes7(32).toString("base64url");
+      const runtimeKey = randomBytes8(32).toString("base64url");
       const now = this.now();
       state.bindings.push({ runtimeId, keyHash: encodedDigest(runtimeKey), createdAt: now, lastUsedAt: now, revoked: false });
       return { runtimeId, runtimeKey };
@@ -48668,9 +50045,9 @@ var WorkerRequest = external_exports.discriminatedUnion("operation", [
 var AgentFabricService = class _AgentFabricService {
   constructor(directory, controllerId) {
     this.directory = directory;
-    this.identities = new AgentRuntimeIdentityStore(path24.join(directory, "identities.json"));
+    this.identities = new AgentRuntimeIdentityStore(path25.join(directory, "identities.json"));
     this.mailbox = new AgentWorkerMailbox(
-      path24.join(directory, "mailbox.json"),
+      path25.join(directory, "mailbox.json"),
       controllerId,
       this.identities,
       void 0,
@@ -48685,21 +50062,21 @@ var AgentFabricService = class _AgentFabricService {
   closed = false;
   static async open(directory, controllerId, device = null, initialize = true) {
     const expected = Binding.parse({ version: 1, controllerId, device, initialized: false });
-    const absolute2 = path24.resolve(directory);
-    for (let current2 = absolute2; ; current2 = path24.dirname(current2)) {
+    const absolute2 = path25.resolve(directory);
+    for (let current2 = absolute2; ; current2 = path25.dirname(current2)) {
       try {
-        if ((await lstat10(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
+        if ((await lstat11(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
-      if (path24.dirname(current2) === current2) break;
+      if (path25.dirname(current2) === current2) break;
     }
     if (initialize) await mkdir11(absolute2, { recursive: true, mode: 448 });
-    if (!(await lstat10(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
+    if (!(await lstat11(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
       throw Error("FABRIC_DIRECTORY_INVALID");
     const present = /* @__PURE__ */ new Set();
     for (const name2 of ["binding.json", "mailbox.json", "identities.json"]) {
-      const file2 = await lstat10(path24.join(absolute2, name2)).catch((error62) => {
+      const file2 = await lstat11(path25.join(absolute2, name2)).catch((error62) => {
         if (error62.code === "ENOENT") return null;
         throw error62;
       });
@@ -48707,7 +50084,7 @@ var AgentFabricService = class _AgentFabricService {
       if (file2) present.add(name2);
     }
     if (!present.has("binding.json") && present.size) throw Error("FABRIC_BINDING_MISSING");
-    const binding2 = new FabricStateFile(path24.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
+    const binding2 = new FabricStateFile(path25.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
     const service2 = new _AgentFabricService(absolute2, controllerId);
     await binding2.update(async (state) => {
       if (state.controllerId !== expected.controllerId || JSON.stringify(state.device) !== JSON.stringify(expected.device))
@@ -48722,7 +50099,7 @@ var AgentFabricService = class _AgentFabricService {
         state.initialized = true;
       }
       const snapshot2 = await service2.mailbox.snapshot();
-      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat10(path24.join(absolute2, "identities.json"));
+      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat11(path25.join(absolute2, "identities.json"));
     }, initialize ? () => expected : void 0);
     return service2;
   }
@@ -48809,19 +50186,19 @@ var Delivery = external_exports.strictObject({ capability: external_exports.stri
 async function openNativeFabric(stateDirectory, enrollment, box, initialize = true) {
   const controllerId = "device-" + external_exports.string().uuid().parse(enrollment.deviceId).toLowerCase();
   const tenantId = external_exports.string().uuid().parse(enrollment.tenantId).toLowerCase();
-  const parent = path25.join(stateDirectory, ".local-commander"), marker = path25.join(parent, "fabric-established.json");
+  const parent = path26.join(stateDirectory, ".local-commander"), marker = path26.join(parent, "fabric-established.json");
   try {
     await mkdir12(parent, { mode: 448 });
   } catch (error62) {
     if (error62.code !== "EEXIST") throw error62;
   }
-  const parentInfo = await lstat11(parent);
+  const parentInfo = await lstat12(parent);
   if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
   const expected = JSON.stringify({ version: 1, controllerId, tenantId });
   let fresh = false;
   try {
-    const info = await lstat11(marker);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile9(marker, "utf8") !== expected)
+    const info = await lstat12(marker);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile10(marker, "utf8") !== expected)
       throw Error("FABRIC_BINDING_CHANGED");
   } catch (error62) {
     if (error62.code !== "ENOENT" || !initialize) throw error62;
@@ -48835,22 +50212,22 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
     fresh = true;
   }
   const service2 = await AgentFabricService.open(
-    path25.join(stateDirectory, ".local-commander", "fabric"),
+    path26.join(stateDirectory, ".local-commander", "fabric"),
     controllerId,
     { deviceId: enrollment.deviceId.toLowerCase(), enrollmentEvidenceRef: "enrollment-" + tenantId },
     fresh
   );
   const purpose = "native-fabric:" + tenantId + ":" + controllerId;
-  const credentialFile = (workerId) => path25.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
+  const credentialFile = (workerId) => path26.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
   const decode4 = (value) => {
     const credential = Credential.parse(JSON.parse(box.open(Buffer.from(value, "base64"), purpose).toString("utf8")));
     if (credential.controllerId !== controllerId) throw Error("FABRIC_WORKER_DENIED");
     return credential;
   };
   async function capability(workerId) {
-    const file2 = credentialFile(workerId), info = await lstat11(file2);
+    const file2 = credentialFile(workerId), info = await lstat12(file2);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw Error("FABRIC_CREDENTIAL_UNKNOWN");
-    const encoded = await readFile9(file2, "utf8");
+    const encoded = await readFile10(file2, "utf8");
     if (decode4(encoded).workerId !== workerId) throw Error("FABRIC_WORKER_DENIED");
     return encoded;
   }
@@ -48942,7 +50319,7 @@ async function readFabricRequest(input2 = process.stdin) {
 
 // agent/src/supervisor-liveness.ts
 import { spawn as spawn6 } from "node:child_process";
-import path26 from "node:path";
+import path27 from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 var ROW = /^"([^"]+)","(\d{1,10})"/;
 function parseTasklist(output2, image) {
@@ -48957,7 +50334,7 @@ function parseTasklist(output2, image) {
 }
 function listProcesses(image, timeoutMs2 = 5e3) {
   if (process.platform !== "win32" || !/^[A-Za-z0-9._-]{1,64}\.exe$/i.test(image)) return Promise.resolve(null);
-  const tasklist = path26.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
+  const tasklist = path27.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
   return new Promise((resolve) => {
     let output2 = "", settled = false;
     const finish = (value) => {
@@ -48986,8 +50363,8 @@ function listProcesses(image, timeoutMs2 = 5e3) {
 }
 function supervisorLiveness(helperPath, options = {}) {
   if (process.platform === "linux" && !options.list) return linuxSupervisorLiveness;
-  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path26.join(path26.dirname(helperPath), "posix-host"), pids, darwin);
-  const image = path26.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
+  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path27.join(path27.dirname(helperPath), "posix-host"), pids, darwin);
+  const image = path27.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
   return async (pids) => {
     const deadline = Date.now() + waitMs;
     for (; ; ) {
@@ -49002,14 +50379,14 @@ function supervisorLiveness(helperPath, options = {}) {
 
 // agent/src/content-audit.ts
 import { createReadStream } from "node:fs";
-import { appendFile, lstat as lstat12, mkdir as mkdir13, open as open12, readdir as readdir5, readFile as readFile10, rename as rename8, rm as rm8, writeFile as writeFile4 } from "node:fs/promises";
-import path27 from "node:path";
+import { appendFile, lstat as lstat13, mkdir as mkdir13, open as open12, readdir as readdir6, readFile as readFile11, rename as rename8, rm as rm9, writeFile as writeFile4 } from "node:fs/promises";
+import path28 from "node:path";
 import { performance as performance3 } from "node:perf_hooks";
 import { createInterface as createInterface2 } from "node:readline";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 
 // src/audit-crypto.ts
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, createHash as createHash20, randomBytes as randomBytes8 } from "node:crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, createHash as createHash20, randomBytes as randomBytes9 } from "node:crypto";
 import { promisify as promisify3 } from "node:util";
 import { gunzipSync, gzip, gzipSync } from "node:zlib";
 var gzipAsync = promisify3(gzip);
@@ -49061,7 +50438,7 @@ async function encryptAuditRecordAsync(record2, keyInput, keyId2) {
 function sealCompressed(compressed, keyInput, keyId2) {
   const key = parseAuditRecoveryKey(keyInput);
   const kid = keyId2?.trim() || auditRecoveryKeyId(key);
-  const iv = randomBytes8(IV_BYTES);
+  const iv = randomBytes9(IV_BYTES);
   try {
     const cipher = createCipheriv3("aes-256-gcm", key, iv, { authTagLength: TAG_BYTES });
     cipher.setAAD(additionalData(kid));
@@ -49172,17 +50549,17 @@ var FILE = /^(full|metrics)-(\d{4}-\d{2}-\d{2})\.jsonl$/;
 var PAUSED_FILE = "paused.json";
 var DAY_MS = 864e5;
 function contentAuditDirectory(stateDir) {
-  return path27.join(path27.dirname(path27.resolve(stateDir)), "Audit");
+  return path28.join(path28.dirname(path28.resolve(stateDir)), "Audit");
 }
 async function plainDirectory(dir) {
   await mkdir13(dir, { recursive: true, mode: 448 });
-  const info = await lstat12(dir);
+  const info = await lstat13(dir);
   if (info.isSymbolicLink() || !info.isDirectory()) throw Error("AUDIT_DIRECTORY_INVALID");
 }
 async function auditFiles(dir) {
   let names;
   try {
-    names = await readdir5(dir);
+    names = await readdir6(dir);
   } catch (error62) {
     if (error62.code === "ENOENT") return [];
     throw error62;
@@ -49191,18 +50568,18 @@ async function auditFiles(dir) {
   for (const name2 of names) {
     const match = FILE.exec(name2);
     if (!match) continue;
-    const info = await lstat12(path27.join(dir, name2));
+    const info = await lstat13(path28.join(dir, name2));
     if (info.isFile()) files.push({ name: name2, kind: match[1], day: match[2], bytes: info.size });
   }
   return files.sort((a, b) => a.name.localeCompare(b.name));
 }
 async function writeJsonAtomic(file2, value) {
-  const temp = `${file2}.${randomBytes9(6).toString("hex")}.tmp`;
+  const temp = `${file2}.${randomBytes10(6).toString("hex")}.tmp`;
   try {
     await writeFile4(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
     await rename8(temp, file2);
   } finally {
-    await rm8(temp, { force: true }).catch(() => {
+    await rm9(temp, { force: true }).catch(() => {
     });
   }
 }
@@ -49229,7 +50606,7 @@ var ContentAudit = class _ContentAudit {
   skipped = 0;
   closed = false;
   static async open(options) {
-    const dir = path27.resolve(options.directory);
+    const dir = path28.resolve(options.directory);
     await plainDirectory(dir);
     const audit = new _ContentAudit(
       dir,
@@ -49238,7 +50615,7 @@ var ContentAudit = class _ContentAudit {
       { retentionDays: options.retentionDays ?? AUDIT_RETENTION_DAYS, maxBytes: options.maxBytes ?? AUDIT_MAX_BYTES },
       options.now ?? (() => /* @__PURE__ */ new Date())
     );
-    await rm8(path27.join(dir, PAUSED_FILE), { force: true });
+    await rm9(path28.join(dir, PAUSED_FILE), { force: true });
     await audit.rollover(audit.now());
     if (audit.usedBytes >= audit.limits.maxBytes) await audit.pause("QUOTA_EXCEEDED");
     return audit;
@@ -49308,8 +50685,8 @@ var ContentAudit = class _ContentAudit {
       await this.pause("QUOTA_EXCEEDED");
       return;
     }
-    await appendFile(path27.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
-    await appendFile(path27.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
+    await appendFile(path28.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
+    await appendFile(path28.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
     this.usedBytes += bytes3;
   }
   /** Daily retention runs on the first write of a new day; no timer or background scan. */
@@ -49318,7 +50695,7 @@ var ContentAudit = class _ContentAudit {
     const cutoff = new Date(at.getTime() - this.limits.retentionDays * DAY_MS).toISOString().slice(0, 10);
     let used = 0;
     for (const file2 of await auditFiles(this.dir)) {
-      if (file2.day <= cutoff) await rm8(path27.join(this.dir, file2.name), { force: true });
+      if (file2.day <= cutoff) await rm9(path28.join(this.dir, file2.name), { force: true });
       else used += file2.bytes;
     }
     this.usedBytes = used;
@@ -49326,7 +50703,7 @@ var ContentAudit = class _ContentAudit {
   async pause(reason) {
     if (this.paused) return;
     this.paused = reason;
-    await writeJsonAtomic(path27.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
+    await writeJsonAtomic(path28.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
   }
 };
 function percentiles(values) {
@@ -49348,13 +50725,13 @@ async function* jsonLines(file2) {
 }
 var count2 = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
 async function summarizeContentAudit(directory, key) {
-  const dir = path27.resolve(directory);
+  const dir = path28.resolve(directory);
   const files = await auditFiles(dir);
   const days = /* @__PURE__ */ new Map();
   const sizes = [];
   const timings = [];
   for (const file2 of files.filter((f) => f.kind === "metrics")) {
-    for await (const line of jsonLines(path27.join(dir, file2.name))) {
+    for await (const line of jsonLines(path28.join(dir, file2.name))) {
       let day = days.get(file2.day);
       if (!day) {
         day = { day: file2.day, records: 0, failed: 0, rawBytes: 0, sanitizedBytes: 0, compressedBytes: 0, envelopeBytes: 0 };
@@ -49374,7 +50751,7 @@ async function summarizeContentAudit(directory, key) {
   }
   let paused = null;
   try {
-    const value = JSON.parse(await readFile10(path27.join(dir, PAUSED_FILE), "utf8"));
+    const value = JSON.parse(await readFile11(path28.join(dir, PAUSED_FILE), "utf8"));
     if (typeof value.reason === "string" && typeof value.at === "string") paused = { reason: value.reason.slice(0, 40), at: value.at.slice(0, 40) };
   } catch {
   }
@@ -49382,7 +50759,7 @@ async function summarizeContentAudit(directory, key) {
   const newest = files.filter((f) => f.kind === "full").at(-1);
   if (key && newest) {
     const tail = [];
-    for await (const line of jsonLines(path27.join(dir, newest.name))) {
+    for await (const line of jsonLines(path28.join(dir, newest.name))) {
       tail.push(line);
       if (tail.length > 5) tail.shift();
     }
@@ -49416,10 +50793,10 @@ async function summarizeContentAudit(directory, key) {
   };
 }
 async function restoreContentAudit(input2, output2, key) {
-  const handle = await open12(path27.resolve(output2), "wx", 384);
+  const handle = await open12(path28.resolve(output2), "wx", 384);
   let records = 0, failed = 0;
   try {
-    for await (const line of jsonLines(path27.resolve(input2))) {
+    for await (const line of jsonLines(path28.resolve(input2))) {
       try {
         await handle.appendFile(JSON.stringify(decryptAuditRecord(line, key)) + "\n");
         records += 1;
@@ -49434,7 +50811,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.45" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.47" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 function processAlive(pid) {
@@ -49448,7 +50825,7 @@ function processAlive(pid) {
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
   await mkdir14(stateDir, { recursive: true });
-  const file2 = path28.join(stateDir, "agent-process.json");
+  const file2 = path29.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       const handle = await open13(file2, "wx", 384);
@@ -49459,8 +50836,8 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       }
       return async () => {
         try {
-          const current2 = JSON.parse(await readFile11(file2, "utf8"));
-          if (current2.pid === process.pid) await rm9(file2, { force: true });
+          const current2 = JSON.parse(await readFile12(file2, "utf8"));
+          if (current2.pid === process.pid) await rm10(file2, { force: true });
         } catch {
         }
       };
@@ -49468,12 +50845,12 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       if (!error62 || typeof error62 !== "object" || !("code" in error62) || error62.code !== "EEXIST") throw error62;
       let stale = true;
       try {
-        const current2 = JSON.parse(await readFile11(file2, "utf8"));
+        const current2 = JSON.parse(await readFile12(file2, "utf8"));
         stale = typeof current2.pid !== "number" || !processAlive(current2.pid);
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm9(file2, { force: true });
+      await rm10(file2, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -49724,10 +51101,10 @@ async function openContentAudit(store, stateDir) {
 async function main() {
   if (!["win32", "linux", "darwin"].includes(process.platform)) throw Error("PLATFORM_UNSUPPORTED");
   const appData = process.env.LC_AGENT_DATA_DIR ?? (process.platform === "win32" ? process.env.LOCALAPPDATA : posixDataHome());
-  if (!appData || !path28.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path28.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path28.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path28.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
+  if (!appData || !path29.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path29.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path29.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path29.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (process.platform !== "win32" && (command.startsWith("guard-") || command.startsWith("network-"))) throw Error("FEATURE_PLATFORM_UNSUPPORTED");
@@ -49737,7 +51114,7 @@ async function main() {
     const pairing = new PairingClient(store, { controlPlaneOrigin: origin, agentVersion: AGENT_VERSION2 });
     const begun = await pairing.begin();
     process.stdout.write(JSON.stringify({ approvalUrl: begun.approvalUrl, confirmationCode: begun.confirmationCode, expiresAt: begun.expiresAt.toISOString() }) + "\n");
-    await pairing.waitAndComplete(begun, os7.hostname().slice(0, 120));
+    await pairing.waitAndComplete(begun, os8.hostname().slice(0, 120));
     process.stdout.write("DEVICE_PAIRED\n");
     return;
   }
@@ -49822,7 +51199,7 @@ async function main() {
   }
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path28.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path29.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -49832,7 +51209,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path28.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path29.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -49851,7 +51228,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path28.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -49863,7 +51240,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path28.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -49941,27 +51318,27 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
-  const monitor = new ProductionMonitor(path28.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path29.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
   const publishMonitor = () => monitor.flush().catch(() => {
     process.stderr.write("MONITOR_WRITE_FAILED\n");
   });
   await publishMonitor();
   try {
     const journal = await NativeJournal.open(
-      path28.join(stateDir, "journal"),
+      path29.join(stateDir, "journal"),
       new SecretBox({ "1": await store.loadDataKey() }),
-      process.platform === "win32" ? {} : { lockHelper: path28.join(binaryDir, "posix-host") }
+      process.platform === "win32" ? {} : { lockHelper: path29.join(binaryDir, "posix-host") }
     );
     const ledgerLoss = () => {
       process.stderr.write("OPTIMIZATION_TELEMETRY_INCOMPLETE\n");
     };
     const efficiencyLedger = await new OptionalWork(ledgerLoss, 1e3, 1).run(
-      () => OptimizationLedger.open(path28.join(stateDir, "optimization")),
+      () => OptimizationLedger.open(path29.join(stateDir, "optimization")),
       void 0,
       (ledger) => ledger.close()
     );
     try {
-      const helperPath = process.env.LC_JOB_HOST ?? path28.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
+      const helperPath = process.env.LC_JOB_HOST ?? path29.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
       const tools = new NativeTools({ stateDirectory: stateDir, helperPath, ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
@@ -50032,7 +51409,7 @@ async function main() {
     await releaseProcess();
   }
 }
-var entrypoint = process.argv[1] && (process.platform === "win32" ? path28.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
+var entrypoint = process.argv[1] && (process.platform === "win32" ? path29.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
 if (entrypoint === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";