local-commander-agent 0.3.47 → 0.3.49

package/CHANGELOG.md

@@ -1,207 +1,218 @@
-# Change history
-
-## 0.3.47 - 2026-10-22
-
-- New: screenshots on Linux. Where the screenshot tool is available to your account and the computer has Full Access, it now also works on a Linux desktop (Wayland through the desktop portal or grim, X11 through xwd, import or maim). When capture is not possible the client gets a clear reason, such as no desktop session or no capture tool.
-- New: you can turn screenshots off for this computer. Run `localcommander screenshot off` on Windows, or `npx local-commander-agent screenshot off` on macOS and Linux; `screenshot on` turns them back on and `screenshot status` shows the current setting. No restart is needed.
-- The cabinet now shows whether each computer has Full Access or selected folders only.
-- Includes everything in 0.3.46.
-
-## 0.3.46 - 2026-10-22
-
-- Simpler setup on macOS and Linux: the approval page opens in your browser by itself, and on a Mac access is one click in a window (Full Access, or Choose Folder). Linux asks one question in the terminal: press Enter for Full Access or type a folder.
-- Fixed: on macOS, updates keep access to the agent's key in the Keychain.
-- Includes everything in 0.3.45.
-
-## 0.3.45 - 2026-10-22
-
-- New: macOS 14 or later on Apple Silicon, and Linux x64 or arm64 with a systemd user session. Run the same `npx local-commander-agent@latest` in Terminal; npm downloads only the runtime for your computer. Setup pairs the computer, asks what may be used in the terminal, and runs the agent as a background service that starts when you sign in.
-- Fixed: a computer that lost its connection without noticing (after sleep, a network change or a server restart) now reconnects within about three minutes instead of staying offline.
-- Fixed: a request that never reached a sleeping computer no longer keeps one of its execution slots busy; the computer frees it when it reconnects.
-- Includes everything in 0.3.44.
-
-## 0.3.44 - 2026-10-22
-
-- New: when you set up a computer, the window that asks what may be used now shows the Local Commander account the computer joined. Someone helping you can approve your computer from their own phone with the code you read to them. Continue only if you know that account; Cancel shares nothing.
-- Includes everything in 0.3.43.
-
-## 0.3.43 - 2026-10-21
-
-- Faster: file search on Windows reads files in batches through one helper process instead of starting one per file. A search over 300 files now takes well under a second. Results are unchanged.
-- Internal changes that do not change how the agent works on Windows.
-- Includes everything in 0.3.42.
-
-## 0.3.42 - 2026-10-21
-
-- Fix: editing several lines of a file with Windows line breaks (CRLF) now works when the AI sends plain line breaks. The new text keeps the file's Windows line breaks.
-- Fix: files saved as UTF-16 (for example by Windows PowerShell) or with a byte order mark can be read, searched and edited. The encoding and the mark are kept.
-- New: text files up to 16 MiB can be read page by page, for example the end of a large log. Files over 1 MiB used to be refused.
-- Fix: reading a file with very long lines returns the whole lines that fit and where to continue, instead of failing.
-- Fix: searches and folder listings return what fits and say when the result is incomplete, instead of silently skipping files or failing on one unreadable folder.
-- Fix: clear errors for files that are locked by another program, read-only, binary or too large.
-- Internal changes that do not change how the agent works on Windows.
-- Includes everything in 0.3.41.
-
-## 0.3.41 - 2026-10-17
-
-- Fix: the agent no longer exits when the Local Commander service stops answering, for example during a server restart. A connection attempt that gets no answer now gives up after 10 seconds and the agent tries again 2 seconds later, so the computer comes back online by itself.
-- Fix: `update` no longer reports a failure when Windows takes longer than 15 seconds to announce the PATH change. The update had already finished.
-- Includes everything in 0.3.40.
-
-## 0.3.40 - 2026-10-16
-
-- Docs: the README covers only what this package installs. Developer-only notes are removed, and the release-history link no longer points to a private repository.
-- No change to the agent, its commands or its permissions.
-- Includes everything in 0.3.39-pairlink.1.
-
-## 0.3.39-pairlink.1 - 2026-10-15
-
-- Change: the pairing link printed in the terminal now carries the confirmation code, so the website opens the Connect dialog with the code already filled in. Check that it matches the code in your terminal, then click Approve (#218).
-- Includes everything in 0.3.38-local.1.
-
-## 0.3.38-local.1 - 2026-10-15
-
-- New: direct local MCP for AI clients on this computer, such as Claude Code, Codex or Cursor (#104).
-  - Turn it on once with `localcommander mcp on`, then add `cmd /c localcommander mcp` to the client's MCP settings.
-  - Calls go straight to the running agent with no cloud round trip, so they take milliseconds and keep working without internet.
-  - The same approved workspaces, Full Access or scoped mode and your denials apply.
-  - The agent listens only on 127.0.0.1, only while this is on, and accepts only processes of your Windows user. `localcommander mcp off` revokes it immediately.
-- Fix: `localcommander network status` works again, and uninstall can remove the network service on a PC that set it up earlier (#204).
-- Includes everything in 0.3.37-review.1.
-
-## 0.3.37-review.1 - 2026-10-14
-
-- Change: this version ships without the AI connection (the `localcommander network` and `network proxy` commands and the bundled network service). The package is about 82 MB smaller. The agent no longer requests an AI connection or starts proxy mode, even if an earlier version turned it on. `localcommander network off`, `localcommander network proxy off` and uninstall still work, so a PC that enabled it can switch it off (#204).
-- Includes everything in 0.3.36-startup.1.
-
-## 0.3.36-startup.1 - 2026-10-14
-
-- Fix: when an AI opens a project that has no `AGENTS.md` file (most projects), the agent now returns the project overview without project instructions. Before, this first step ended with an "unknown" result and a critical alert in your account, and the AI could stall. Projects with an `AGENTS.md` work as before (#197).
-- Includes everything in 0.3.35-restart.1.
-
-## 0.3.35-restart.1 - 2026-10-14
-
-- Fix: when the agent restarts while a command is running (an update, a crash or a reboot), that command no longer keeps one of your execution slots busy until support frees it. After the restart the agent checks that the command's process is really gone and tells localcmd.app, which frees the slot. The command's result stays "unknown" (code `AGENT_RESTARTED`): it may have done part of its work, so check before running it again. If the agent cannot confirm the process is gone, the slot stays held as before. Commands interrupted under an older agent are not covered.
-- Includes everything in 0.3.34-monitor.1.
-
-## 0.3.34-monitor.1 - 2026-10-14
-
-- Fix: an idle agent no longer rewrites its whole monitor file (about 50 KB) every minute. That came to about 70 MB of disk writes a day while doing nothing. The once-a-minute connection check now updates a small separate file of about 110 bytes, and the monitor file is rewritten only when something actually changes. `localcommander monitor` shows the same connected, stale and stopped states as before.
-- Includes everything in 0.3.33-codepage.1.
-
-## 0.3.33-codepage.1 - 2026-10-14
-
-- Fix: output from programs that print in the Windows ANSI code page is now readable. Examples are `chcp` and Python or Java with default settings; on a Russian PC they write windows-1251, not CP866. Each output stream is now checked against both the ANSI and the console (OEM) code page, and the one that reads as real text is used. `cmd.exe` and Windows PowerShell output in CP866 stays as it was, and UTF-8 output is unchanged.
-- Fix: when the agent was started from a UTF-8 terminal, it took that terminal's code page (65001) as the console code page, so CP866 output came back as `�`. The agent now checks the code page its commands actually get.
-- Includes everything in 0.3.32-identity.1.
-
-## 0.3.32-identity.1 - 2026-10-14
-
-- Protection against running work on the wrong computer: when localcmd.app asks for it, the agent now proves which Windows installation it is running on. It sends a fingerprint of this PC's Windows machine ID and computer name, salted for this pairing so it cannot be matched across pairings. The first connection after updating records it. If a later connection comes from a copied disk image, a cloned virtual machine or a renamed PC, localcmd.app pauses the computer ("quarantined") and runs nothing on it until you confirm it at localcmd.app or remove its access.
-- If the machine ID cannot be read, the agent connects as before, without the proof.
-- Fix: output from Windows console programs that print in the system code page (for example Russian `cmd.exe` messages in CP866) is now readable text instead of `�` characters. UTF-8 output is unchanged. `LCMCP_CONSOLE_ENCODING` overrides the detected code page.
-- Includes everything in 0.3.31-leases.1, the optional encrypted content audit pilot (off by default) and the AI connection network bundle.
-
-## 0.3.31-leases.1 - 2026-10-13
-
-- Fix: commands that never started now always give their slot back. If the connection to Local Commander dropped, or the agent restarted, while a command was waiting to start, the cloud was never told it didn't run. That command kept one of your execution slots until a manual fix, and once enough slots were held, new commands timed out while the computer showed online. The agent now reports these commands as not started, the same way it already did for commands it refused, and earlier ones still in its journal are reported on the first reconnect after updating.
-- Commands the agent turns away before starting, because they arrived on a stale connection or after their deadline, are now reported as not started instead of unknown.
-- Includes the optional encrypted content audit pilot from 0.3.30-audit.1 (off by default) and the AI connection network bundle.
-
-## 0.3.30-audit.1 - 2026-10-12
-
-- Pilot: optional encrypted content audit for this computer, off by default. `localcommander audit on` starts it: each finished request and response is cleaned of credentials, compressed and encrypted with your own recovery key before it is saved under `%LOCALAPPDATA%\LocalCommander\Audit`. The key is copied to your clipboard, never shown. Files are kept 7 days, and capture pauses at 512 MB; your commands are never slowed or blocked by it.
-- `localcommander audit status` shows the real stored sizes per day; `audit off` stops it; `audit copy-key` copies the key again; `audit restore <file> <output>` decrypts a file with your key from `LCMCP_AUDIT_RECOVERY_KEY`.
-- Includes the AI connection network bundle, as in 0.3.28.
-
-## 0.3.29-proxy.5 - 2026-10-11
-
-- The AI proxy no longer asks for a password - the browser and CLIs connect with no sign-in (loopback only). network proxy on now adds a Start menu and Desktop shortcut, "AI Browser (Local Commander)", that opens ChatGPT/Claude already routed in one click.
-- This build ships without the network driver, so there is no antivirus prompt during install; it provides the AI connection through the proxy only.
-
-## 0.3.29-proxy.4 - 2026-10-11
-
-- The AI proxy now keeps the same local port and password across restarts and reboots, so you set up the browser and CLIs once. network proxy on also writes a one-click browser launcher (open-ai-browser.cmd) that opens Chrome/Edge already routed, in a profile that remembers the sign-in.
-
-## 0.3.29-proxy.3 - 2026-10-11
-
-- Fix: the proxy now sends a Basic authentication challenge, so browsers (Chrome/Edge) can sign in to it instead of failing with ERR_PROXY_AUTH_UNSUPPORTED.
-
-## 0.3.29-proxy.2 - 2026-10-11
-
-- Fix: proxy-mode state now lives in its own folder instead of the agent state folder, which refused to start after proxy.1 wrote a file there.
-
-## 0.3.29-proxy.1 - 2026-10-11
-
-- New: driver-free AI connection proxy for machines where antivirus blocks the network driver. `localcommander network proxy on` runs a local proxy that routes ChatGPT/Claude/Cursor through the gateway over HTTPS and everything else directly, for the browser and for CLIs (Claude Code, Codex, and any tool that reads a proxy variable). No TUN driver or privileged service is used; the agent verifies the connection lease itself. `localcommander network proxy status` and `off` manage it.
-
-## 0.3.28-systemca.2 - 2026-10-11
-
-- Fix: if antivirus removes or blocks an AI connection file, `update` and install now skip the AI connection with a message and still start Local Commander. Before, the update stopped with `NETWORK_BUNDLE_ALLOWLIST_FAILED` and left the agent stopped. The AI connection files are still installed only when every file passes its checksum.
-- Unexpected install errors now show the Windows error class, for example `LOCAL_COMMANDER_FAILED (EPERM copyfile)`, without file paths.
-
-## 0.3.28-systemca.1 - 2026-10-11
-
-- Fix: the agent now trusts the certificates Windows trusts, as well as its built-in list. Computers whose antivirus or company network inspects HTTPS (for example Kaspersky Endpoint Security) can pair and connect without extra setup; before this they stopped at `NETWORK_FAILED`. Certificate checking stays on.
-
-## 0.3.27-aiconnect.5 - 2026-10-11
-
-- Fix: the network service could deadlock when its routing core exited. The first protected-route start now waits for the Windows network driver, and setup can replace a service that stopped responding.
-
-## 0.3.26-aiconnect.4 - 2026-10-11
-
-- Fix: network setup files live in their own folder; 0.3.25 wrote its receipt into the agent's private state folder, which then refused to start.
-
-## 0.3.25-aiconnect.3 - 2026-10-11
-
-- Fix: the network service now identifies the local agent from its process token, so the agent can reach it (0.3.24 could not connect).
-
-## 0.3.24-aiconnect.2 - 2026-10-11
-
-- AI connection pilot now reaches the gateway through a published HTTPS (WebSocket) endpoint, which works on networks where direct UDP is blocked. Each AI connection is an authenticated tunnel; the AI service's own encryption stays end to end.
-- The tunnel runs inside Local Commander itself: when the agent stops, the protected route stops too. No extra proxy program is installed on Windows.
-- Still an unsigned pilot: nothing changes until you run `localcommander network setup`.
-
-## 0.3.23-aiconnect.1 - 2026-10-11
-
-- AI connection pilot (#112): an optional Windows network service routes only ChatGPT/OpenAI, Claude and Cursor traffic through Local Commander's gateway, in Automatic, On or Off mode. Other internet traffic keeps its usual route.
-- Access is tied to this computer's live Local Commander connection: short signed leases (45 seconds) that the server stops renewing when the device is revoked, disconnected or turned Off.
-- Pilot build: the network service is not code-signed yet, so Windows shows "Unknown publisher". Nothing changes until you run `localcommander network setup`; `localcommander network off` and `localcommander network status` work locally.
-
-## 0.3.22-fullaccess.1 - 2026-10-10
-
-- Owner-approved Full Access no longer requires per-executable registration for Windows shells or administration tools. The Windows account rights and explicit deny-command restrictions remain enforced.
-- Scoped grants and native authentication, target binding, journal/recovery and concurrency safeguards are unchanged.
-- Local direct MCP and remote startup improvements remain separate issue #104 tasks; this build still uses authenticated hosted relay for ChatGPT web.
-
-## 0.3.17-journal.1 - 2026-10-08
-
-- Apply existing retention maintenance when a new request reaches the journal entry limit on a long-lived connection.
-- Remove only expired, acknowledged terminal records under the existing integrity and retention checks.
-- Keep active, unknown, unacknowledged and recent records protected; admission still fails closed when no record is eligible.
-
-Includes the aligned monitor and expanded names from 0.3.16. This does not release unknown cloud reservations or replay work.
-
-## 0.3.16-monitor.1 — 2026-10-08
-
-- Align monitor columns, including Unicode text, numeric values and states.
-- Leave unused registrations and empty activity rows out of the named agent view.
-- Add 48 playful names to the existing short-name pool, for 128 choices.
-- Show measured call counts, average duration, output and response bytes, errors, and native status/output polls.
-- Exclude stale native snapshots from current per-computer savings totals.
-
-Names are display hints. IDs and permissions are unchanged. Token figures remain estimates from measured bytes; provider usage and prices are not inferred.
-
-## 0.3.15-recovery.1 — 2026-10-07
-
-- Deliver durable proof when the native agent rejects work before acceptance, including after reconnect.
-- Release cloud reservations only after a rejection receipt passes the existing execution and device checks.
-- Retain fencing for unknown executions without rejection proof.
-- Prune acknowledged terminal journal records using the existing retention rules.
-# 0.3.19-admission.1
-
-New execution admission pauses when protected journal capacity is exhausted; authenticated relay status carries the pause while status, output and cancellation remain available. Retains the verified native18 default of 2,000 entries, the existing byte/retention limits and unknown-execution fencing.
-
-# 0.3.21-project-targets.3
-
-Explicit project targets use on-demand repository identity and constrain session paths to the selected repository. Retains installed target20 behavior and adds accepted journal admission guards and authenticated readiness reporting; existing journal retention, permission checks and unknown-execution fencing remain.
+# Change history
+
+## 0.3.49 - 2026-10-23
+
+- Commands without an explicit working folder no longer block file work across the approved drive. Specify cwd when folder serialization is needed.
+- Work held by another task in the same folder now returns RESOURCE_LOCKED after 20 seconds instead of disappearing behind a relay timeout. Nothing ran; retry after the other task finishes.
+- Includes everything in 0.3.48.
+
+## 0.3.48 - 2026-10-22
+
+- Fixed: after the screenshot setting was switched (or screenshots were enabled for testing), the agent could not restart or update and stopped with STORE_DIRECTORY_UNKNOWN. Restarts and updates work again with either setting.
+- Includes everything in 0.3.47.
+
+## 0.3.47 - 2026-10-22
+
+- New: screenshots on Linux. Where the screenshot tool is available to your account and the computer has Full Access, it now also works on a Linux desktop (Wayland through the desktop portal or grim, X11 through xwd, import or maim). When capture is not possible the client gets a clear reason, such as no desktop session or no capture tool.
+- New: you can turn screenshots off for this computer. Run `localcommander screenshot off` on Windows, or `npx local-commander-agent screenshot off` on macOS and Linux; `screenshot on` turns them back on and `screenshot status` shows the current setting. No restart is needed.
+- The cabinet now shows whether each computer has Full Access or selected folders only.
+- Includes everything in 0.3.46.
+
+## 0.3.46 - 2026-10-22
+
+- Simpler setup on macOS and Linux: the approval page opens in your browser by itself, and on a Mac access is one click in a window (Full Access, or Choose Folder). Linux asks one question in the terminal: press Enter for Full Access or type a folder.
+- Fixed: on macOS, updates keep access to the agent's key in the Keychain.
+- Includes everything in 0.3.45.
+
+## 0.3.45 - 2026-10-22
+
+- New: macOS 14 or later on Apple Silicon, and Linux x64 or arm64 with a systemd user session. Run the same `npx local-commander-agent@latest` in Terminal; npm downloads only the runtime for your computer. Setup pairs the computer, asks what may be used in the terminal, and runs the agent as a background service that starts when you sign in.
+- Fixed: a computer that lost its connection without noticing (after sleep, a network change or a server restart) now reconnects within about three minutes instead of staying offline.
+- Fixed: a request that never reached a sleeping computer no longer keeps one of its execution slots busy; the computer frees it when it reconnects.
+- Includes everything in 0.3.44.
+
+## 0.3.44 - 2026-10-22
+
+- New: when you set up a computer, the window that asks what may be used now shows the Local Commander account the computer joined. Someone helping you can approve your computer from their own phone with the code you read to them. Continue only if you know that account; Cancel shares nothing.
+- Includes everything in 0.3.43.
+
+## 0.3.43 - 2026-10-21
+
+- Faster: file search on Windows reads files in batches through one helper process instead of starting one per file. A search over 300 files now takes well under a second. Results are unchanged.
+- Internal changes that do not change how the agent works on Windows.
+- Includes everything in 0.3.42.
+
+## 0.3.42 - 2026-10-21
+
+- Fix: editing several lines of a file with Windows line breaks (CRLF) now works when the AI sends plain line breaks. The new text keeps the file's Windows line breaks.
+- Fix: files saved as UTF-16 (for example by Windows PowerShell) or with a byte order mark can be read, searched and edited. The encoding and the mark are kept.
+- New: text files up to 16 MiB can be read page by page, for example the end of a large log. Files over 1 MiB used to be refused.
+- Fix: reading a file with very long lines returns the whole lines that fit and where to continue, instead of failing.
+- Fix: searches and folder listings return what fits and say when the result is incomplete, instead of silently skipping files or failing on one unreadable folder.
+- Fix: clear errors for files that are locked by another program, read-only, binary or too large.
+- Internal changes that do not change how the agent works on Windows.
+- Includes everything in 0.3.41.
+
+## 0.3.41 - 2026-10-17
+
+- Fix: the agent no longer exits when the Local Commander service stops answering, for example during a server restart. A connection attempt that gets no answer now gives up after 10 seconds and the agent tries again 2 seconds later, so the computer comes back online by itself.
+- Fix: `update` no longer reports a failure when Windows takes longer than 15 seconds to announce the PATH change. The update had already finished.
+- Includes everything in 0.3.40.
+
+## 0.3.40 - 2026-10-16
+
+- Docs: the README covers only what this package installs. Developer-only notes are removed, and the release-history link no longer points to a private repository.
+- No change to the agent, its commands or its permissions.
+- Includes everything in 0.3.39-pairlink.1.
+
+## 0.3.39-pairlink.1 - 2026-10-15
+
+- Change: the pairing link printed in the terminal now carries the confirmation code, so the website opens the Connect dialog with the code already filled in. Check that it matches the code in your terminal, then click Approve (#218).
+- Includes everything in 0.3.38-local.1.
+
+## 0.3.38-local.1 - 2026-10-15
+
+- New: direct local MCP for AI clients on this computer, such as Claude Code, Codex or Cursor (#104).
+  - Turn it on once with `localcommander mcp on`, then add `cmd /c localcommander mcp` to the client's MCP settings.
+  - Calls go straight to the running agent with no cloud round trip, so they take milliseconds and keep working without internet.
+  - The same approved workspaces, Full Access or scoped mode and your denials apply.
+  - The agent listens only on 127.0.0.1, only while this is on, and accepts only processes of your Windows user. `localcommander mcp off` revokes it immediately.
+- Fix: `localcommander network status` works again, and uninstall can remove the network service on a PC that set it up earlier (#204).
+- Includes everything in 0.3.37-review.1.
+
+## 0.3.37-review.1 - 2026-10-14
+
+- Change: this version ships without the AI connection (the `localcommander network` and `network proxy` commands and the bundled network service). The package is about 82 MB smaller. The agent no longer requests an AI connection or starts proxy mode, even if an earlier version turned it on. `localcommander network off`, `localcommander network proxy off` and uninstall still work, so a PC that enabled it can switch it off (#204).
+- Includes everything in 0.3.36-startup.1.
+
+## 0.3.36-startup.1 - 2026-10-14
+
+- Fix: when an AI opens a project that has no `AGENTS.md` file (most projects), the agent now returns the project overview without project instructions. Before, this first step ended with an "unknown" result and a critical alert in your account, and the AI could stall. Projects with an `AGENTS.md` work as before (#197).
+- Includes everything in 0.3.35-restart.1.
+
+## 0.3.35-restart.1 - 2026-10-14
+
+- Fix: when the agent restarts while a command is running (an update, a crash or a reboot), that command no longer keeps one of your execution slots busy until support frees it. After the restart the agent checks that the command's process is really gone and tells localcmd.app, which frees the slot. The command's result stays "unknown" (code `AGENT_RESTARTED`): it may have done part of its work, so check before running it again. If the agent cannot confirm the process is gone, the slot stays held as before. Commands interrupted under an older agent are not covered.
+- Includes everything in 0.3.34-monitor.1.
+
+## 0.3.34-monitor.1 - 2026-10-14
+
+- Fix: an idle agent no longer rewrites its whole monitor file (about 50 KB) every minute. That came to about 70 MB of disk writes a day while doing nothing. The once-a-minute connection check now updates a small separate file of about 110 bytes, and the monitor file is rewritten only when something actually changes. `localcommander monitor` shows the same connected, stale and stopped states as before.
+- Includes everything in 0.3.33-codepage.1.
+
+## 0.3.33-codepage.1 - 2026-10-14
+
+- Fix: output from programs that print in the Windows ANSI code page is now readable. Examples are `chcp` and Python or Java with default settings; on a Russian PC they write windows-1251, not CP866. Each output stream is now checked against both the ANSI and the console (OEM) code page, and the one that reads as real text is used. `cmd.exe` and Windows PowerShell output in CP866 stays as it was, and UTF-8 output is unchanged.
+- Fix: when the agent was started from a UTF-8 terminal, it took that terminal's code page (65001) as the console code page, so CP866 output came back as `�`. The agent now checks the code page its commands actually get.
+- Includes everything in 0.3.32-identity.1.
+
+## 0.3.32-identity.1 - 2026-10-14
+
+- Protection against running work on the wrong computer: when localcmd.app asks for it, the agent now proves which Windows installation it is running on. It sends a fingerprint of this PC's Windows machine ID and computer name, salted for this pairing so it cannot be matched across pairings. The first connection after updating records it. If a later connection comes from a copied disk image, a cloned virtual machine or a renamed PC, localcmd.app pauses the computer ("quarantined") and runs nothing on it until you confirm it at localcmd.app or remove its access.
+- If the machine ID cannot be read, the agent connects as before, without the proof.
+- Fix: output from Windows console programs that print in the system code page (for example Russian `cmd.exe` messages in CP866) is now readable text instead of `�` characters. UTF-8 output is unchanged. `LCMCP_CONSOLE_ENCODING` overrides the detected code page.
+- Includes everything in 0.3.31-leases.1, the optional encrypted content audit pilot (off by default) and the AI connection network bundle.
+
+## 0.3.31-leases.1 - 2026-10-13
+
+- Fix: commands that never started now always give their slot back. If the connection to Local Commander dropped, or the agent restarted, while a command was waiting to start, the cloud was never told it didn't run. That command kept one of your execution slots until a manual fix, and once enough slots were held, new commands timed out while the computer showed online. The agent now reports these commands as not started, the same way it already did for commands it refused, and earlier ones still in its journal are reported on the first reconnect after updating.
+- Commands the agent turns away before starting, because they arrived on a stale connection or after their deadline, are now reported as not started instead of unknown.
+- Includes the optional encrypted content audit pilot from 0.3.30-audit.1 (off by default) and the AI connection network bundle.
+
+## 0.3.30-audit.1 - 2026-10-12
+
+- Pilot: optional encrypted content audit for this computer, off by default. `localcommander audit on` starts it: each finished request and response is cleaned of credentials, compressed and encrypted with your own recovery key before it is saved under `%LOCALAPPDATA%\LocalCommander\Audit`. The key is copied to your clipboard, never shown. Files are kept 7 days, and capture pauses at 512 MB; your commands are never slowed or blocked by it.
+- `localcommander audit status` shows the real stored sizes per day; `audit off` stops it; `audit copy-key` copies the key again; `audit restore <file> <output>` decrypts a file with your key from `LCMCP_AUDIT_RECOVERY_KEY`.
+- Includes the AI connection network bundle, as in 0.3.28.
+
+## 0.3.29-proxy.5 - 2026-10-11
+
+- The AI proxy no longer asks for a password - the browser and CLIs connect with no sign-in (loopback only). network proxy on now adds a Start menu and Desktop shortcut, "AI Browser (Local Commander)", that opens ChatGPT/Claude already routed in one click.
+- This build ships without the network driver, so there is no antivirus prompt during install; it provides the AI connection through the proxy only.
+
+## 0.3.29-proxy.4 - 2026-10-11
+
+- The AI proxy now keeps the same local port and password across restarts and reboots, so you set up the browser and CLIs once. network proxy on also writes a one-click browser launcher (open-ai-browser.cmd) that opens Chrome/Edge already routed, in a profile that remembers the sign-in.
+
+## 0.3.29-proxy.3 - 2026-10-11
+
+- Fix: the proxy now sends a Basic authentication challenge, so browsers (Chrome/Edge) can sign in to it instead of failing with ERR_PROXY_AUTH_UNSUPPORTED.
+
+## 0.3.29-proxy.2 - 2026-10-11
+
+- Fix: proxy-mode state now lives in its own folder instead of the agent state folder, which refused to start after proxy.1 wrote a file there.
+
+## 0.3.29-proxy.1 - 2026-10-11
+
+- New: driver-free AI connection proxy for machines where antivirus blocks the network driver. `localcommander network proxy on` runs a local proxy that routes ChatGPT/Claude/Cursor through the gateway over HTTPS and everything else directly, for the browser and for CLIs (Claude Code, Codex, and any tool that reads a proxy variable). No TUN driver or privileged service is used; the agent verifies the connection lease itself. `localcommander network proxy status` and `off` manage it.
+
+## 0.3.28-systemca.2 - 2026-10-11
+
+- Fix: if antivirus removes or blocks an AI connection file, `update` and install now skip the AI connection with a message and still start Local Commander. Before, the update stopped with `NETWORK_BUNDLE_ALLOWLIST_FAILED` and left the agent stopped. The AI connection files are still installed only when every file passes its checksum.
+- Unexpected install errors now show the Windows error class, for example `LOCAL_COMMANDER_FAILED (EPERM copyfile)`, without file paths.
+
+## 0.3.28-systemca.1 - 2026-10-11
+
+- Fix: the agent now trusts the certificates Windows trusts, as well as its built-in list. Computers whose antivirus or company network inspects HTTPS (for example Kaspersky Endpoint Security) can pair and connect without extra setup; before this they stopped at `NETWORK_FAILED`. Certificate checking stays on.
+
+## 0.3.27-aiconnect.5 - 2026-10-11
+
+- Fix: the network service could deadlock when its routing core exited. The first protected-route start now waits for the Windows network driver, and setup can replace a service that stopped responding.
+
+## 0.3.26-aiconnect.4 - 2026-10-11
+
+- Fix: network setup files live in their own folder; 0.3.25 wrote its receipt into the agent's private state folder, which then refused to start.
+
+## 0.3.25-aiconnect.3 - 2026-10-11
+
+- Fix: the network service now identifies the local agent from its process token, so the agent can reach it (0.3.24 could not connect).
+
+## 0.3.24-aiconnect.2 - 2026-10-11
+
+- AI connection pilot now reaches the gateway through a published HTTPS (WebSocket) endpoint, which works on networks where direct UDP is blocked. Each AI connection is an authenticated tunnel; the AI service's own encryption stays end to end.
+- The tunnel runs inside Local Commander itself: when the agent stops, the protected route stops too. No extra proxy program is installed on Windows.
+- Still an unsigned pilot: nothing changes until you run `localcommander network setup`.
+
+## 0.3.23-aiconnect.1 - 2026-10-11
+
+- AI connection pilot (#112): an optional Windows network service routes only ChatGPT/OpenAI, Claude and Cursor traffic through Local Commander's gateway, in Automatic, On or Off mode. Other internet traffic keeps its usual route.
+- Access is tied to this computer's live Local Commander connection: short signed leases (45 seconds) that the server stops renewing when the device is revoked, disconnected or turned Off.
+- Pilot build: the network service is not code-signed yet, so Windows shows "Unknown publisher". Nothing changes until you run `localcommander network setup`; `localcommander network off` and `localcommander network status` work locally.
+
+## 0.3.22-fullaccess.1 - 2026-10-10
+
+- Owner-approved Full Access no longer requires per-executable registration for Windows shells or administration tools. The Windows account rights and explicit deny-command restrictions remain enforced.
+- Scoped grants and native authentication, target binding, journal/recovery and concurrency safeguards are unchanged.
+- Local direct MCP and remote startup improvements remain separate issue #104 tasks; this build still uses authenticated hosted relay for ChatGPT web.
+
+## 0.3.17-journal.1 - 2026-10-08
+
+- Apply existing retention maintenance when a new request reaches the journal entry limit on a long-lived connection.
+- Remove only expired, acknowledged terminal records under the existing integrity and retention checks.
+- Keep active, unknown, unacknowledged and recent records protected; admission still fails closed when no record is eligible.
+
+Includes the aligned monitor and expanded names from 0.3.16. This does not release unknown cloud reservations or replay work.
+
+## 0.3.16-monitor.1 — 2026-10-08
+
+- Align monitor columns, including Unicode text, numeric values and states.
+- Leave unused registrations and empty activity rows out of the named agent view.
+- Add 48 playful names to the existing short-name pool, for 128 choices.
+- Show measured call counts, average duration, output and response bytes, errors, and native status/output polls.
+- Exclude stale native snapshots from current per-computer savings totals.
+
+Names are display hints. IDs and permissions are unchanged. Token figures remain estimates from measured bytes; provider usage and prices are not inferred.
+
+## 0.3.15-recovery.1 — 2026-10-07
+
+- Deliver durable proof when the native agent rejects work before acceptance, including after reconnect.
+- Release cloud reservations only after a rejection receipt passes the existing execution and device checks.
+- Retain fencing for unknown executions without rejection proof.
+- Prune acknowledged terminal journal records using the existing retention rules.
+# 0.3.19-admission.1
+
+New execution admission pauses when protected journal capacity is exhausted; authenticated relay status carries the pause while status, output and cancellation remain available. Retains the verified native18 default of 2,000 entries, the existing byte/retention limits and unknown-execution fencing.
+
+# 0.3.21-project-targets.3
+
+Explicit project targets use on-demand repository identity and constrain session paths to the selected repository. Retains installed target20 behavior and adds accepted journal admission guards and authenticated readiness reporting; existing journal retention, permission checks and unknown-execution fencing remain.