local-commander-agent 0.3.47 → 0.3.49

package/bin/network-package.mjs

@@ -1,38 +1,38 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import { createHash } from "node:crypto";
-
-const HASH=/^[a-f0-9]{64}$/;
-/** Signed bundles may be set up during install; an unsigned pilot only by an explicit owner command. */
-export function implicitSetupAllowed(manifest){return manifest?.signed===true;}
-const FILES=["JobHost.exe","libcronet.dll","sing-box.exe","wintun.dll","sing-box.LICENSE","wintun.LICENSE"];
-async function plainDirectory(directory) {
-  const stat=await fs.lstat(directory);
-  if(!stat.isDirectory()||stat.isSymbolicLink()||(await fs.realpath(directory)).toLowerCase()!==path.resolve(directory).toLowerCase())throw Error("NETWORK_BUNDLE_DIRECTORY_INVALID");
-}
-async function bytes(file,max) {
-  const stat=await fs.lstat(file);
-  if(!stat.isFile()||stat.isSymbolicLink()||stat.size<1||stat.size>max)throw Error("NETWORK_BUNDLE_FILE_INVALID");
-  return fs.readFile(file);
-}
-export async function inspectNetworkBundle(directory) {
-  try {await plainDirectory(directory);}catch(error){if(error.code==="ENOENT")return null;throw error;}
-  const manifest=JSON.parse((await bytes(path.join(directory,"manifest.json"),8192)).toString("utf8"));
-  if(manifest.schemaVersion!==1||manifest.configured!==true||!(manifest.signed===true||manifest.signing==="unsigned-pilot")||!HASH.test(manifest.bundleId)||!HASH.test(manifest.helperSha256)||
-    !manifest.files||typeof manifest.files!=="object"||Array.isArray(manifest.files)||Object.keys(manifest.files).sort().join()!==[...FILES].sort().join())throw Error("NETWORK_BUNDLE_NOT_DEPLOYABLE");
-  const names=[...FILES,"NetworkService.exe","manifest.json"];
-  if((await fs.readdir(directory)).sort().join()!==names.sort().join())throw Error("NETWORK_BUNDLE_ALLOWLIST_FAILED");
-  for(const name of [...FILES,"NetworkService.exe"]){const expected=name==="NetworkService.exe"?manifest.helperSha256:manifest.files[name];
-    if(!HASH.test(expected)||createHash("sha256").update(await bytes(path.join(directory,name),128*1024*1024)).digest("hex")!==expected)throw Error("NETWORK_BUNDLE_DIGEST_MISMATCH");}
-  return {bundleId:manifest.bundleId,files:names,manifest};
-}
-export async function copyNetworkBundle(source,destination) {
-  const bundle=await inspectNetworkBundle(source);if(!bundle)return false;
-  if(path.resolve(source).toLowerCase()===path.resolve(destination).toLowerCase())return true;
-  const exists=await fs.lstat(destination).catch(e=>{if(e.code!=="ENOENT")throw e;return null;});
-  if(exists){const previous=await inspectNetworkBundle(destination);if(previous?.bundleId===bundle.bundleId&&previous.manifest.helperSha256===bundle.manifest.helperSha256)return true;throw Error("NETWORK_BUNDLE_DESTINATION_CONFLICT");}
-  await fs.mkdir(destination,{recursive:false,mode:0o700});
-  try{for(const name of bundle.files)await fs.copyFile(path.join(source,name),path.join(destination,name),fs.constants.COPYFILE_EXCL);await inspectNetworkBundle(destination);}
-  catch(error){for(const name of bundle.files)await fs.rm(path.join(destination,name),{force:true}).catch(()=>{});await fs.rmdir(destination).catch(()=>{});throw error;}
-  return true;
-}
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+const HASH=/^[a-f0-9]{64}$/;
+/** Signed bundles may be set up during install; an unsigned pilot only by an explicit owner command. */
+export function implicitSetupAllowed(manifest){return manifest?.signed===true;}
+const FILES=["JobHost.exe","libcronet.dll","sing-box.exe","wintun.dll","sing-box.LICENSE","wintun.LICENSE"];
+async function plainDirectory(directory) {
+  const stat=await fs.lstat(directory);
+  if(!stat.isDirectory()||stat.isSymbolicLink()||(await fs.realpath(directory)).toLowerCase()!==path.resolve(directory).toLowerCase())throw Error("NETWORK_BUNDLE_DIRECTORY_INVALID");
+}
+async function bytes(file,max) {
+  const stat=await fs.lstat(file);
+  if(!stat.isFile()||stat.isSymbolicLink()||stat.size<1||stat.size>max)throw Error("NETWORK_BUNDLE_FILE_INVALID");
+  return fs.readFile(file);
+}
+export async function inspectNetworkBundle(directory) {
+  try {await plainDirectory(directory);}catch(error){if(error.code==="ENOENT")return null;throw error;}
+  const manifest=JSON.parse((await bytes(path.join(directory,"manifest.json"),8192)).toString("utf8"));
+  if(manifest.schemaVersion!==1||manifest.configured!==true||!(manifest.signed===true||manifest.signing==="unsigned-pilot")||!HASH.test(manifest.bundleId)||!HASH.test(manifest.helperSha256)||
+    !manifest.files||typeof manifest.files!=="object"||Array.isArray(manifest.files)||Object.keys(manifest.files).sort().join()!==[...FILES].sort().join())throw Error("NETWORK_BUNDLE_NOT_DEPLOYABLE");
+  const names=[...FILES,"NetworkService.exe","manifest.json"];
+  if((await fs.readdir(directory)).sort().join()!==names.sort().join())throw Error("NETWORK_BUNDLE_ALLOWLIST_FAILED");
+  for(const name of [...FILES,"NetworkService.exe"]){const expected=name==="NetworkService.exe"?manifest.helperSha256:manifest.files[name];
+    if(!HASH.test(expected)||createHash("sha256").update(await bytes(path.join(directory,name),128*1024*1024)).digest("hex")!==expected)throw Error("NETWORK_BUNDLE_DIGEST_MISMATCH");}
+  return {bundleId:manifest.bundleId,files:names,manifest};
+}
+export async function copyNetworkBundle(source,destination) {
+  const bundle=await inspectNetworkBundle(source);if(!bundle)return false;
+  if(path.resolve(source).toLowerCase()===path.resolve(destination).toLowerCase())return true;
+  const exists=await fs.lstat(destination).catch(e=>{if(e.code!=="ENOENT")throw e;return null;});
+  if(exists){const previous=await inspectNetworkBundle(destination);if(previous?.bundleId===bundle.bundleId&&previous.manifest.helperSha256===bundle.manifest.helperSha256)return true;throw Error("NETWORK_BUNDLE_DESTINATION_CONFLICT");}
+  await fs.mkdir(destination,{recursive:false,mode:0o700});
+  try{for(const name of bundle.files)await fs.copyFile(path.join(source,name),path.join(destination,name),fs.constants.COPYFILE_EXCL);await inspectNetworkBundle(destination);}
+  catch(error){for(const name of bundle.files)await fs.rm(path.join(destination,name),{force:true}).catch(()=>{});await fs.rmdir(destination).catch(()=>{});throw error;}
+  return true;
+}

package/bin/posix.mjs

@@ -1,84 +1,84 @@
-// macOS and Linux: the runtime ships in a per-platform package (an optional dependency, so npm installs only the
-// matching one). Its lifecycle accepts only a private, owner-only artifact directory, so the files are copied from the
-// npx cache into a fresh private directory and the lifecycle installs from there into its own versions directory.
-import { constants } from "node:fs";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-
-const PACKAGES = { "darwin-arm64": "local-commander-agent-darwin-arm64", "linux-x64": "local-commander-agent-linux-x64", "linux-arm64": "local-commander-agent-linux-arm64" };
-// npm command -> lifecycle command. The default (`npx local-commander-agent@latest`) is setup, as on Windows.
-const COMMANDS = { bootstrap: "setup", install: "setup", setup: "setup", update: "update", pair: "pair", access: "access", "configure-access": "access",
-  start: "start", stop: "stop", status: "status", rollback: "rollback", uninstall: "uninstall" };
-const EXECUTABLES = new Set(["node", "posix-host", "owner-store"]);
-
-function fail(code) { const error = new Error(code); error.code = code; throw error; }
-
-export function posixHelp() {
-  return [
-    "Local Commander",
-    "",
-    "  npx local-commander-agent@latest            set up this computer, pair it and choose access",
-    "  npx local-commander-agent@latest update     install this version, keeping pairing and access",
-    "  npx local-commander-agent@latest status|start|stop|pair|access|rollback",
-    "  npx local-commander-agent@latest uninstall [--purge-state]",
-    ""
-  ].join("\n");
-}
-
-// Owner opt-out for take_screenshot under Full Access (#486): a marker in the installed service agent's state folder
-// (the service runs without XDG_DATA_HOME). No runtime staging is needed; the agent checks it on each capture.
-async function screenshotCommand(args) {
-  const action = args[0] || "status";
-  if (args.length > 1 || !["status", "on", "off"].includes(action)) fail("ARGUMENT_INVALID");
-  if (typeof process.getuid === "function" && process.getuid() === 0) fail("POSIX_OWNER_REQUIRED");
-  const state = path.join(os.homedir(), process.platform === "darwin" ? "Library/Application Support" : ".local/share", "LocalCommander", "Agent");
-  const folder = await fs.lstat(state).catch(() => null);
-  if (!folder?.isDirectory() || folder.uid !== process.getuid()) fail("AGENT_NOT_INSTALLED");
-  const file = path.join(state, "screenshot-disabled-by-owner");
-  if (action === "off") await fs.open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600)
-    .then(handle => handle.close(), error => { if (error?.code !== "EEXIST") throw error; });
-  if (action === "on") await fs.rm(file, { force: true });
-  const off = await fs.lstat(file).then(() => true, error => error?.code !== "ENOENT");
-  process.stdout.write(JSON.stringify({ screenshot: off ? "off" : "on" }) + "\n");
-}
-
-export async function runPosix(argv, version) {
-  const name = PACKAGES[process.platform + "-" + process.arch];
-  if (!name) fail(process.platform === "darwin" ? "MACOS_APPLE_SILICON_REQUIRED" : process.platform === "linux" ? "LINUX_X64_OR_ARM64_REQUIRED" : "PLATFORM_UNSUPPORTED");
-  const command = argv[0] || "bootstrap", args = argv.slice(1);
-  if (command === "-h" || command === "--help" || command === "help") { process.stdout.write(posixHelp()); return; }
-  if (command === "screenshot") { await screenshotCommand(args); return; }
-  const lifecycle = COMMANDS[command];
-  if (!lifecycle) fail("ARGUMENT_INVALID");
-  if (lifecycle === "uninstall" ? args.length > 1 || (args.length === 1 && args[0] !== "--purge-state") : args.length) fail("ARGUMENT_INVALID");
-  if (typeof process.getuid === "function" && process.getuid() === 0) fail("POSIX_OWNER_REQUIRED");
-
-  let packageJson;
-  try { packageJson = createRequire(import.meta.url).resolve(name + "/package.json"); } catch { fail("PLATFORM_PACKAGE_MISSING"); }
-  const meta = JSON.parse(await fs.readFile(packageJson, "utf8"));
-  if (meta.name !== name || meta.version !== version) fail("PLATFORM_PACKAGE_MISMATCH");
-  const source = path.join(path.dirname(packageJson), "runtime");
-  const manifest = JSON.parse(await fs.readFile(path.join(source, "manifest.json"), "utf8"));
-  const files = Object.keys(manifest?.files ?? {});
-  if (manifest?.platform !== process.platform || manifest?.arch !== process.arch || !files.length || files.some(file => !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(file))) fail("PLATFORM_PACKAGE_INVALID");
-
-  // Canonical parent: on macOS os.tmpdir() is under /var, a symlink to /private/var, and the lifecycle rejects aliases.
-  const stage = await fs.mkdtemp(path.join(await fs.realpath(os.tmpdir()), "local-commander-"));
-  try {
-    await fs.chmod(stage, 0o700);
-    for (const file of [...files, "manifest.json"]) {
-      const target = path.join(stage, file);
-      await fs.copyFile(path.join(source, file), target, constants.COPYFILE_EXCL);
-      await fs.chmod(target, EXECUTABLES.has(file) ? 0o700 : 0o600);
-    }
-    // The lifecycle verifies every file against the manifest, then copies them into its own versions directory.
-    const result = spawnSync(path.join(stage, "node"), [path.join(stage, "lifecycle.mjs"), lifecycle, ...args], { stdio: "inherit" });
-    if (result.error) throw result.error;
-    process.exitCode = result.status ?? 1;
-  } finally {
-    await fs.rm(stage, { recursive: true, force: true });
-  }
-}
+// macOS and Linux: the runtime ships in a per-platform package (an optional dependency, so npm installs only the
+// matching one). Its lifecycle accepts only a private, owner-only artifact directory, so the files are copied from the
+// npx cache into a fresh private directory and the lifecycle installs from there into its own versions directory.
+import { constants } from "node:fs";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+
+const PACKAGES = { "darwin-arm64": "local-commander-agent-darwin-arm64", "linux-x64": "local-commander-agent-linux-x64", "linux-arm64": "local-commander-agent-linux-arm64" };
+// npm command -> lifecycle command. The default (`npx local-commander-agent@latest`) is setup, as on Windows.
+const COMMANDS = { bootstrap: "setup", install: "setup", setup: "setup", update: "update", pair: "pair", access: "access", "configure-access": "access",
+  start: "start", stop: "stop", status: "status", rollback: "rollback", uninstall: "uninstall" };
+const EXECUTABLES = new Set(["node", "posix-host", "owner-store"]);
+
+function fail(code) { const error = new Error(code); error.code = code; throw error; }
+
+export function posixHelp() {
+  return [
+    "Local Commander",
+    "",
+    "  npx local-commander-agent@latest            set up this computer, pair it and choose access",
+    "  npx local-commander-agent@latest update     install this version, keeping pairing and access",
+    "  npx local-commander-agent@latest status|start|stop|pair|access|rollback",
+    "  npx local-commander-agent@latest uninstall [--purge-state]",
+    ""
+  ].join("\n");
+}
+
+// Owner opt-out for take_screenshot under Full Access (#486): a marker in the installed service agent's state folder
+// (the service runs without XDG_DATA_HOME). No runtime staging is needed; the agent checks it on each capture.
+async function screenshotCommand(args) {
+  const action = args[0] || "status";
+  if (args.length > 1 || !["status", "on", "off"].includes(action)) fail("ARGUMENT_INVALID");
+  if (typeof process.getuid === "function" && process.getuid() === 0) fail("POSIX_OWNER_REQUIRED");
+  const state = path.join(os.homedir(), process.platform === "darwin" ? "Library/Application Support" : ".local/share", "LocalCommander", "Agent");
+  const folder = await fs.lstat(state).catch(() => null);
+  if (!folder?.isDirectory() || folder.uid !== process.getuid()) fail("AGENT_NOT_INSTALLED");
+  const file = path.join(state, "screenshot-disabled-by-owner");
+  if (action === "off") await fs.open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600)
+    .then(handle => handle.close(), error => { if (error?.code !== "EEXIST") throw error; });
+  if (action === "on") await fs.rm(file, { force: true });
+  const off = await fs.lstat(file).then(() => true, error => error?.code !== "ENOENT");
+  process.stdout.write(JSON.stringify({ screenshot: off ? "off" : "on" }) + "\n");
+}
+
+export async function runPosix(argv, version) {
+  const name = PACKAGES[process.platform + "-" + process.arch];
+  if (!name) fail(process.platform === "darwin" ? "MACOS_APPLE_SILICON_REQUIRED" : process.platform === "linux" ? "LINUX_X64_OR_ARM64_REQUIRED" : "PLATFORM_UNSUPPORTED");
+  const command = argv[0] || "bootstrap", args = argv.slice(1);
+  if (command === "-h" || command === "--help" || command === "help") { process.stdout.write(posixHelp()); return; }
+  if (command === "screenshot") { await screenshotCommand(args); return; }
+  const lifecycle = COMMANDS[command];
+  if (!lifecycle) fail("ARGUMENT_INVALID");
+  if (lifecycle === "uninstall" ? args.length > 1 || (args.length === 1 && args[0] !== "--purge-state") : args.length) fail("ARGUMENT_INVALID");
+  if (typeof process.getuid === "function" && process.getuid() === 0) fail("POSIX_OWNER_REQUIRED");
+
+  let packageJson;
+  try { packageJson = createRequire(import.meta.url).resolve(name + "/package.json"); } catch { fail("PLATFORM_PACKAGE_MISSING"); }
+  const meta = JSON.parse(await fs.readFile(packageJson, "utf8"));
+  if (meta.name !== name || meta.version !== version) fail("PLATFORM_PACKAGE_MISMATCH");
+  const source = path.join(path.dirname(packageJson), "runtime");
+  const manifest = JSON.parse(await fs.readFile(path.join(source, "manifest.json"), "utf8"));
+  const files = Object.keys(manifest?.files ?? {});
+  if (manifest?.platform !== process.platform || manifest?.arch !== process.arch || !files.length || files.some(file => !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(file))) fail("PLATFORM_PACKAGE_INVALID");
+
+  // Canonical parent: on macOS os.tmpdir() is under /var, a symlink to /private/var, and the lifecycle rejects aliases.
+  const stage = await fs.mkdtemp(path.join(await fs.realpath(os.tmpdir()), "local-commander-"));
+  try {
+    await fs.chmod(stage, 0o700);
+    for (const file of [...files, "manifest.json"]) {
+      const target = path.join(stage, file);
+      await fs.copyFile(path.join(source, file), target, constants.COPYFILE_EXCL);
+      await fs.chmod(target, EXECUTABLES.has(file) ? 0o700 : 0o600);
+    }
+    // The lifecycle verifies every file against the manifest, then copies them into its own versions directory.
+    const result = spawnSync(path.join(stage, "node"), [path.join(stage, "lifecycle.mjs"), lifecycle, ...args], { stdio: "inherit" });
+    if (result.error) throw result.error;
+    process.exitCode = result.status ?? 1;
+  } finally {
+    await fs.rm(stage, { recursive: true, force: true });
+  }
+}

package/package.json

@@ -1,57 +1,57 @@
-{
-  "name": "local-commander-agent",
-  "version": "0.3.47",
-  "description": "Computer companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
-  "type": "module",
-  "bin": {
-    "localcommander": "bin/localcommander.mjs"
-  },
-  "os": [
-    "win32",
-    "darwin",
-    "linux"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ],
-  "optionalDependencies": {
-    "local-commander-agent-darwin-arm64": "0.3.47",
-    "local-commander-agent-linux-arm64": "0.3.47",
-    "local-commander-agent-linux-x64": "0.3.47"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "files": [
-    "bin/",
-    "runtime/",
-    "README.md",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "prepack": "node ../../scripts/build-npm-agent.mjs",
-    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "mcp",
-    "local",
-    "agent",
-    "chatgpt",
-    "claude",
-    "windows",
-    "macos",
-    "linux"
-  ],
-  "localCommander": {
-    "controlPlaneOrigin": "https://localcmd.app"
-  },
-  "homepage": "https://localcmd.app",
-  "bugs": {
-    "url": "https://localcmd.app/support",
-    "email": "peter.mamrukov@localcmd.app"
-  }
-}
+{
+  "name": "local-commander-agent",
+  "version": "0.3.49",
+  "description": "Computer companion for Local Commander: connect AI clients to local files, approved commands and localhost. Requires https://localcmd.app.",
+  "type": "module",
+  "bin": {
+    "localcommander": "bin/localcommander.mjs"
+  },
+  "os": [
+    "win32",
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "optionalDependencies": {
+    "local-commander-agent-darwin-arm64": "0.3.49",
+    "local-commander-agent-linux-arm64": "0.3.49",
+    "local-commander-agent-linux-x64": "0.3.49"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "files": [
+    "bin/",
+    "runtime/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "prepack": "node ../../scripts/build-npm-agent.mjs",
+    "prepublishOnly": "node ../../scripts/check-npm-publish-auth.mjs && node ../../scripts/verify-npm-agent.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "local",
+    "agent",
+    "chatgpt",
+    "claude",
+    "windows",
+    "macos",
+    "linux"
+  ],
+  "localCommander": {
+    "controlPlaneOrigin": "https://localcmd.app"
+  },
+  "homepage": "https://localcmd.app",
+  "bugs": {
+    "url": "https://localcmd.app/support",
+    "email": "peter.mamrukov@localcmd.app"
+  }
+}

package/runtime/agent.mjs

@@ -27932,11 +27932,16 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     if (process.platform !== "win32") for (const name2 of ["owner-key.json", "owner-key.dat", "owner-key.lock"]) approved.add(name2);
     if (names.length && !names.includes(MARKER)) throw fail2("STORE_DIRECTORY_UNKNOWN");
     const memoryFile = (name2) => name2 === "host-memory.json" || /^host-memory\.json\.[1-9][0-9]{0,9}\.tmp$/.test(name2);
-    if (names.some((name2) => !approved.has(name2) && !memoryFile(name2))) throw fail2("STORE_DIRECTORY_UNKNOWN");
+    const switchFile = (name2) => name2 === "screenshot-acceptance-enabled" || name2 === "screenshot-disabled-by-owner";
+    if (names.some((name2) => !approved.has(name2) && !memoryFile(name2) && !switchFile(name2))) throw fail2("STORE_DIRECTORY_UNKNOWN");
     for (const name2 of names.filter(memoryFile)) {
       const stat2 = await lstat4(path10.join(absolute2, name2));
       if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 32768) throw fail2("STORE_DIRECTORY_INVALID");
     }
+    for (const name2 of names.filter(switchFile)) {
+      const stat2 = await lstat4(path10.join(absolute2, name2));
+      if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 4096) throw fail2("STORE_DIRECTORY_INVALID");
+    }
     for (const name2 of ["agent-process.json", "optimization", ".local-commander"]) {
       if (!names.includes(name2)) continue;
       const filename = path10.join(absolute2, name2), stat2 = await lstat4(filename);
@@ -31100,7 +31105,7 @@ var NativeTools = class {
     if (call.name === "command_run") {
       if (!["win32", "linux", "darwin"].includes(process.platform)) fail3("COMMAND_NOT_ALLOWED");
       const cwd2 = await resolve(call.args.cwd, true), program = await this.resolveProgram(call.args.command, workspace2, call.args.args);
-      const claims2 = writeClaim(cwd2);
+      const claims2 = call.args.cwd === void 0 ? [{ path: cwd2, namespace: "process", mode: "read" }] : writeClaim(cwd2);
       return { call, claims: claims2, execution: { ...program, cwd: cwd2 }, run: async (signal, onStarted, onOutput, onSupervisor) => {
         let r;
         try {
@@ -31368,7 +31373,10 @@ var NativeScheduler = class {
     } catch {
     }
   }
-  schedule(id2, claims, deadlineAt, run2, signal) {
+  /** lockWaitMs: how long a job may wait behind a conflicting claim before it is refused with
+   * RESOURCE_LOCKED (proved not started), so the caller hears back inside its relay window
+   * instead of timing out (#504). Waiting only for a free slot still lasts until the deadline. */
+  schedule(id2, claims, deadlineAt, run2, signal, lockWaitMs) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id2 || id2.length > 100 || this.active.has(id2) || this.waiting.some((j) => j.id === id2)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
     if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path19.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
@@ -31389,6 +31397,12 @@ var NativeScheduler = class {
       };
       job.aborted = () => remove("CANCELLED_BEFORE_ACCEPTANCE");
       job.timer = setTimeout(() => remove("ADMISSION_DEADLINE_EXPIRED"), Math.min(2147483647, Math.max(1, deadline - Date.now())));
+      if (lockWaitMs !== void 0 && Number.isFinite(lockWaitMs) && lockWaitMs >= 0) {
+        const lockIn = Math.min(lockWaitMs, deadline - Date.now() - 1e3);
+        if (lockIn > 0) job.lockTimer = setTimeout(() => {
+          if (this.lockBlocked(job)) remove("RESOURCE_LOCKED");
+        }, lockIn);
+      }
       signal?.addEventListener("abort", job.aborted, { once: true });
       this.waiting.push(job);
       this.observe({ kind: "queued", executionId: id2, deadlineAt: deadline });
@@ -31397,8 +31411,21 @@ var NativeScheduler = class {
   }
   cleanup(job) {
     clearTimeout(job.timer);
+    clearTimeout(job.lockTimer);
     if (job.aborted) job.signal?.removeEventListener("abort", job.aborted);
   }
+  /** True when a waiting job is held by a conflicting claim: a running job, or an earlier conflicting
+   * waiter that is itself lock-blocked. A wait that is only for a free slot is never a lock. */
+  lockBlocked(job) {
+    const index = this.waiting.indexOf(job);
+    if (index < 0) return false;
+    const blocked2 = [];
+    for (let i = 0; i <= index; i++) {
+      const current2 = this.waiting[i];
+      blocked2[i] = [...this.active.values()].some((claims) => claimsConflict(claims, current2.claims)) || this.waiting.slice(0, i).some((older, j) => blocked2[j] === true && claimsConflict(older.claims, current2.claims));
+    }
+    return blocked2[index] === true;
+  }
   pump() {
     for (let i = 0; i < this.waiting.length && this.active.size < this.safeSlots; ) {
       const job = this.waiting[i];
@@ -32101,6 +32128,7 @@ var knownCodes = /* @__PURE__ */ new Set([
   "WORKSPACE_CHANGED",
   "WORKSPACE_UNAVAILABLE",
   "RESOURCE_BUSY",
+  "RESOURCE_LOCKED",
   "AGENT_PAUSED",
   "CANCELLED_BEFORE_ACCEPTANCE",
   "ADMISSION_DEADLINE_EXPIRED",
@@ -32115,6 +32143,7 @@ var knownCodes = /* @__PURE__ */ new Set([
   "SCREEN_ENCODER_UNAVAILABLE",
   "SCREEN_RECORDING_PERMISSION_REQUIRED"
 ]);
+var LOCK_WAIT_MS = 2e4;
 function safeCode(error62) {
   const code = error62 instanceof NativeToolError ? error62.code : error62 instanceof Error ? error62.message : "";
   return knownCodes.has(code) || /^GUARD_[A-Z_]{1,30}$/.test(code) ? code : "TOOL_FAILED";
@@ -32326,7 +32355,7 @@ var NativeRuntime = class {
         const final = await this.options.journal.finish(binding2.executionId, image === void 0 ? journalOutput : { ...journalOutput, stdout: screenshotMetadata(image) }, resultCode);
         const outbound = await outboundResult(runnable.call, journalResult(final.result, resultCode), binding2, this.optionalTelemetry, this.options.efficiencyLedger);
         this.send({ type: "result", version: 1, binding: binding2, result: image === void 0 ? outbound : { ...outbound, stdout: image } });
-      }, abort.signal);
+      }, abort.signal, LOCK_WAIT_MS);
       context.task = work.catch(async (error62) => {
         if (!context.accepted) {
           if (context.guardPermit) await this.options.guard.rejected(context.guardPermit, safeCode(error62)).catch(() => {
@@ -48979,7 +49008,7 @@ var NativeEventBuffer = class {
 
 // agent/src/native-event-supervisor.ts
 var eventKinds = /* @__PURE__ */ new Set(["queued", "admitted", "released", "queue_rejected", "prepared", "accepted", "running", "result", "not_accepted", "connected", "disconnected", "mailbox_expired"]);
-var codes = /* @__PURE__ */ new Set(["SUCCESS", "EXECUTION_UNKNOWN", "AGENT_RESTARTED", "ADMISSION_DEADLINE_EXPIRED", "CANCELLED_BEFORE_ACCEPTANCE", "RESOURCE_BUSY", "AGENT_PAUSED", "PREPARATION_EXPIRED", "CANCELLED", "TIMEOUT", "USER_PROGRAM_FAILED", "TOOL_FAILED", "MAILBOX_EXPIRED"]);
+var codes = /* @__PURE__ */ new Set(["SUCCESS", "EXECUTION_UNKNOWN", "AGENT_RESTARTED", "ADMISSION_DEADLINE_EXPIRED", "CANCELLED_BEFORE_ACCEPTANCE", "RESOURCE_BUSY", "RESOURCE_LOCKED", "AGENT_PAUSED", "PREPARATION_EXPIRED", "CANCELLED", "TIMEOUT", "USER_PROGRAM_FAILED", "TOOL_FAILED", "MAILBOX_EXPIRED"]);
 var NativeEventSupervisor = class {
   constructor(onChange) {
     this.onChange = onChange;
@@ -50811,7 +50840,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.47" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.49" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 function processAlive(pid) {