local-commander-agent 0.3.48 → 0.3.49

package/bin/localcommander.mjs

@@ -1,872 +1,872 @@
-#!/usr/bin/env node
-import { constants as fsConstants } from "node:fs";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { randomBytes } from "node:crypto";
-import { spawn, spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { copyNetworkBundle, implicitSetupAllowed, inspectNetworkBundle } from "./network-package.mjs";
-import { runMonitor } from "./monitor.mjs";
-import { installCommandFiles, installStartMenuShortcut, removeCommandFile, removeStartMenuShortcut, updateUserPath, installBrowserShortcut, removeBrowserShortcut } from "./command-path.mjs";
-
-const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const PACKAGE_META = JSON.parse(await fs.readFile(path.join(PACKAGE_ROOT, "package.json"), "utf8"));
-const VERSION = String(PACKAGE_META.version || "");
-const DEFAULT_ORIGIN = String(PACKAGE_META.localCommander?.controlPlaneOrigin || "");
-const RUNTIME_FILES = ["LocalCommanderAgent.exe", "OwnerBridge.exe", "JobHost.exe", "agent.mjs", "node.exe", "NODE-LICENSE.txt"];
-const RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
-const RUN_VALUE = "LocalCommanderAgent";
-const MAX_STDIO = 1024 * 1024;
-// Owner decision #204: this package ships without the AI connection (#112). The code stays; set this to true
-// (and build with LC_AI_CONNECTIVITY_BUNDLE) to bring it back. Turning it off and uninstalling still clean up.
-const AI_CONNECTION_SHIPPED = false;
-
-function fail(code) {
-  const error = new Error(code);
-  error.code = code;
-  throw error;
-}
-function requireWindows() {
-  if (process.platform !== "win32" || process.arch !== "x64") fail("WINDOWS_X64_REQUIRED");
-}
-function appDataRoot() {
-  const value = process.env.LOCALAPPDATA;
-  if (!value || !path.isAbsolute(value) || /[\u0000-\u001f]/u.test(value)) fail("APP_DATA_MISSING");
-  return path.join(value, "LocalCommander");
-}
-function stateDirectory() {
-  const override = process.env.LC_AGENT_STATE_DIR;
-  if (override) {
-    if (!path.isAbsolute(override) || /[\u0000-\u001f]/u.test(override)) fail("STATE_DIR_INVALID");
-    return path.resolve(override);
-  }
-  return path.join(appDataRoot(), "Agent");
-}
-function versionsDirectory() {
-  return path.join(appDataRoot(), "Versions");
-}
-function currentPath() {
-  return path.join(appDataRoot(), "current.json");
-}
-function runtimeSource() {
-  if (PACKAGE_ROOT.toLowerCase() === path.join(versionsDirectory(), VERSION).toLowerCase()) return PACKAGE_ROOT;
-  return path.join(PACKAGE_ROOT, "runtime");
-}
-function processFile() {
-  return path.join(stateDirectory(), "agent-process.json");
-}
-function under(parent, child) {
-  const rel = path.relative(parent, child);
-  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
-}
-function boundedText(value) {
-  const text = String(value ?? "");
-  return text.length > MAX_STDIO ? text.slice(0, MAX_STDIO) : text;
-}
-async function regular(file) {
-  const stat = await fs.lstat(file);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 1) fail("PACKAGE_RUNTIME_INVALID");
-  return stat;
-}
-async function ensurePlainDirectory(dir) {
-  await fs.mkdir(dir, { recursive: true, mode: 0o700 });
-  const stat = await fs.lstat(dir);
-  if (!stat.isDirectory() || stat.isSymbolicLink()) fail("INSTALL_DIRECTORY_INVALID");
-  return dir;
-}
-async function ensureInstallDirectories() {
-  const root = await ensurePlainDirectory(appDataRoot());
-  const versions = await ensurePlainDirectory(versionsDirectory());
-  if (!under(root, versions)) fail("INSTALL_DIRECTORY_INVALID");
-  return { root, versions };
-}
-async function runtimeValid(dir) {
-  try {
-    for (const name of RUNTIME_FILES) await regular(path.join(dir, name));
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function writeJsonAtomic(file, value) {
-  await ensurePlainDirectory(path.dirname(file));
-  const existing = await fs.lstat(file).catch(error => error?.code === "ENOENT" ? null : Promise.reject(error));
-  if (existing && (!existing.isFile() || existing.isSymbolicLink())) fail("INSTALL_STATE_INVALID");
-  const temp = file + "." + process.pid + "." + randomBytes(6).toString("hex") + ".tmp";
-  await fs.writeFile(temp, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 0o600 });
-  try {
-    await fs.rename(temp, file);
-  } catch (error) {
-    await fs.rm(temp, { force: true });
-    throw error;
-  }
-}
-async function readCurrent() {
-  try {
-    const current = currentPath();
-    const stat = await fs.lstat(current);
-    if (!stat.isFile() || stat.isSymbolicLink()) fail("INSTALL_STATE_INVALID");
-    const raw = JSON.parse(await fs.readFile(current, "utf8"));
-    if (!raw || typeof raw !== "object" || typeof raw.version !== "string" || typeof raw.runtimeDir !== "string") fail("INSTALL_STATE_INVALID");
-    const dir = path.resolve(raw.runtimeDir);
-    if (!under(versionsDirectory(), dir) || !(await runtimeValid(dir))) fail("INSTALL_STATE_INVALID");
-    return { version: raw.version, runtimeDir: dir };
-  } catch (error) {
-    if (error && error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function copyRuntime() {
-  const source = runtimeSource();
-  if (!(await runtimeValid(source))) fail("PACKAGE_RUNTIME_MISSING");
-  const { versions } = await ensureInstallDirectories();
-  const target = path.join(versions, VERSION);
-  if (await runtimeValid(target)) {
-    await writeJsonAtomic(currentPath(), { version: VERSION, runtimeDir: target });
-    return target;
-  }
-  const targetStat = await fs.lstat(target).catch(error => error?.code === "ENOENT" ? null : Promise.reject(error));
-  if (targetStat) {
-    if (!targetStat.isDirectory() || targetStat.isSymbolicLink() || !under(versions, target)) fail("INSTALL_TARGET_INVALID");
-    await fs.rm(target, { recursive: true, force: true });
-  }
-  const temp = path.join(versions, "." + VERSION + "." + process.pid + "." + randomBytes(6).toString("hex"));
-  await fs.mkdir(temp, { recursive: false, mode: 0o700 });
-  try {
-    for (const name of RUNTIME_FILES) {
-      const sourceFile = path.join(source, name);
-      const sourceStat = await regular(sourceFile);
-      const destination = path.join(temp, name);
-      await fs.copyFile(sourceFile, destination, fsConstants.COPYFILE_EXCL);
-      const copied = await regular(destination);
-      if (copied.size !== sourceStat.size) fail("PACKAGE_COPY_INVALID");
-    }
-    try {
-      await fs.rename(temp, target);
-    } catch (error) {
-      if (!(await runtimeValid(target))) throw error;
-      await fs.rm(temp, { recursive: true, force: true });
-    }
-    await writeJsonAtomic(currentPath(), { version: VERSION, runtimeDir: target });
-    return target;
-  } catch (error) {
-    await fs.rm(temp, { recursive: true, force: true });
-    throw error;
-  }
-}
-function runReg(args, allowMissing = false) {
-  const result = spawnSync("reg.exe", args, { windowsHide: true, encoding: "utf8", timeout: 10_000 });
-  if (result.error) fail("AUTOSTART_COMMAND_FAILED");
-  if (result.status !== 0 && !(allowMissing && result.status === 1)) fail("AUTOSTART_COMMAND_FAILED");
-}
-function registerAutostart(runtimeDir) {
-  const exe = path.join(runtimeDir, "LocalCommanderAgent.exe");
-  if (exe.includes('"')) fail("INSTALL_PATH_INVALID");
-  runReg(["ADD", RUN_KEY, "/v", RUN_VALUE, "/t", "REG_SZ", "/d", '"' + exe + '" run', "/f"]);
-}
-function removeAutostart() {
-  runReg(["DELETE", RUN_KEY, "/v", RUN_VALUE, "/f"], true);
-}
-function agentEnv() {
-  const env = { ...process.env, LC_AGENT_STATE_DIR: stateDirectory() };
-  delete env.NODE_OPTIONS;
-  delete env.NODE_PATH;
-  return env;
-}
-function agentExe(runtimeDir) {
-  return path.join(runtimeDir, "LocalCommanderAgent.exe");
-}
-function execAgent(runtimeDir, args, timeout = 30_000) {
-  const result = spawnSync(agentExe(runtimeDir), args, {
-    windowsHide: true,
-    encoding: "utf8",
-    timeout,
-    env: agentEnv()
-  });
-  if (result.error) fail("AGENT_COMMAND_FAILED");
-  return { status: result.status ?? -1, stdout: boundedText(result.stdout), stderr: boundedText(result.stderr) };
-}
-async function fabricCommand(runtimeDir, command) {
-  const chunks = []; let bytes = 0;
-  for await (const chunk of process.stdin) {
-    bytes += chunk.length;
-    if (bytes > 16_384) fail("FABRIC_REQUEST_LIMIT");
-    chunks.push(chunk);
-  }
-  // Private stdin is explicit; no credential arguments, shell, listener or foreground window.
-  const result = spawnSync(path.join(runtimeDir, "node.exe"), [path.join(runtimeDir, "agent.mjs"), command], {
-    input: Buffer.concat(chunks), windowsHide: true, encoding: "utf8", timeout: 30_000,
-    maxBuffer: 2 * 1024 * 1024, env: agentEnv()
-  });
-  if (result.error || result.status !== 0) fail(/^[A-Z0-9_]{1,80}$/u.test(result.stderr?.trim()) ? result.stderr.trim() : "FABRIC_REQUEST_FAILED");
-  process.stdout.write(result.stdout);
-}
-function openBrowser(url) {
-  let parsed;
-  try { parsed = new URL(url); } catch { fail("PAIRING_URL_INVALID"); }
-  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))) fail("PAIRING_URL_INVALID");
-  const child = spawn("rundll32.exe", ["url.dll,FileProtocolHandler", parsed.toString()], { detached: true, windowsHide: true, stdio: "ignore" });
-  child.unref();
-}
-async function identityStatus(runtimeDir) {
-  const result = execAgent(runtimeDir, ["identity-status"], 15_000);
-  if (result.status !== 0) fail(result.stderr.trim() || "IDENTITY_STATUS_FAILED");
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    return { paired: parsed.paired === true, accountEmail: typeof parsed.accountEmail === "string" ? parsed.accountEmail : null, deviceId: typeof parsed.deviceId === "string" ? parsed.deviceId : null };
-  } catch { fail("IDENTITY_STATUS_INVALID"); }
-}
-async function pair(runtimeDir) {
-  const origin = process.env.LC_CONTROL_PLANE_ORIGIN || DEFAULT_ORIGIN;
-  if (!origin) fail("CONTROL_PLANE_ORIGIN_MISSING");
-  const child = spawn(agentExe(runtimeDir), ["pair"], {
-    windowsHide: true,
-    env: { ...agentEnv(), LC_CONTROL_PLANE_ORIGIN: origin },
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  let stdout = "", stderr = "", opened = false;
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stdout.on("data", chunk => {
-    stdout = boundedText(stdout + chunk);
-    if (opened) return;
-    const lineEnd = stdout.indexOf("\n");
-    if (lineEnd < 0) return;
-    const line = stdout.slice(0, lineEnd).trim();
-    try {
-      const begin = JSON.parse(line);
-      if (typeof begin.approvalUrl !== "string" || typeof begin.confirmationCode !== "string") fail("PAIRING_RESPONSE_INVALID");
-      opened = true;
-      // #218: the link carries the code, so the website opens the dialog with it filled in.
-      const link = new URL(begin.approvalUrl);
-      if (/^[A-Za-z2-9]{8}$/.test(begin.confirmationCode)) link.searchParams.set("code", begin.confirmationCode);
-      process.stdout.write("Pairing code: " + begin.confirmationCode + "\n");
-      process.stdout.write("Opening: " + link + "\n");
-      openBrowser(link.toString());
-    } catch {
-      child.kill();
-    }
-  });
-  child.stderr.on("data", chunk => { stderr = boundedText(stderr + chunk); });
-  const exitCode = await new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("exit", code => resolve(code ?? -1));
-  }).catch(() => -1);
-  if (exitCode !== 0) fail(stderr.trim() || "PAIRING_FAILED");
-  if (!opened) fail("PAIRING_RESPONSE_INVALID");
-  process.stdout.write("Device paired.\n");
-}
-async function configureAccess(runtimeDir) {
-  const result = execAgent(runtimeDir, ["configure-access"], 300_000);
-  if (result.status !== 0) fail(result.stderr.trim() || "ACCESS_CONFIGURATION_FAILED");
-  const answer = result.stdout.trim();
-  if (answer === "ACCESS_CANCELLED") return false;
-  if (answer !== "ACCESS_CONFIGURED") fail("ACCESS_CONFIGURATION_INVALID");
-  return true;
-}
-async function restartIfRunning() {
-  const record = await readProcessRecord();
-  if (record && pidAlive(record.pid)) { await stopAgent(); await startAgent(); }
-}
-// Owner opt-in encrypted content audit (#131 pilot). The recovery key goes from the agent straight
-// into the clipboard; it is never printed.
-function copyAuditKey(runtimeDir) {
-  const key = execAgent(runtimeDir, ["audit-key"], 15_000);
-  if (key.status !== 0) fail(key.stderr.trim() || "AUDIT_KEY_MISSING");
-  const clip = spawnSync(path.join(process.env.SystemRoot || "C:\\Windows", "System32", "clip.exe"), [], { input: key.stdout.trim(), windowsHide: true, timeout: 10_000 });
-  if (clip.error || clip.status !== 0) fail("CLIPBOARD_FAILED");
-}
-async function auditCommand(runtimeDir, sub) {
-  const action = sub[0] || "status";
-  const agent = (args, timeout = 30_000) => {
-    const result = execAgent(runtimeDir, args, timeout);
-    if (result.status !== 0) fail(result.stderr.trim() || "AUDIT_ACTION_FAILED");
-    return result.stdout;
-  };
-  if (action === "status" && sub.length <= 1) { process.stdout.write(agent(["audit-status"], 120_000)); return; }
-  if (action === "on" && sub.length === 1) {
-    const info = JSON.parse(agent(["audit-on"]).trim());
-    if (info.created) copyAuditKey(runtimeDir);
-    await restartIfRunning();
-    process.stdout.write([
-      "Encrypted content audit is ON for this computer (pilot).",
-      "Files: " + info.directory + " (kept " + info.retentionDays + " days, capture pauses at " + Math.round(info.maxBytes / 1048576) + " MB)",
-      info.created
-        ? "A new recovery key (" + info.keyId + ") was copied to the clipboard. Paste it into your password manager now, then clear the clipboard.\nWithout it nobody, including Local Commander, can read the audit files on another computer."
-        : "Using your existing recovery key (" + info.keyId + "). Run 'localcommander audit copy-key' to copy it again.",
-      ""
-    ].join("\n"));
-    return;
-  }
-  if (action === "off" && sub.length === 1) {
-    agent(["audit-off"]);
-    await restartIfRunning();
-    process.stdout.write("Encrypted content audit is OFF. Existing files stay until they expire.\n");
-    return;
-  }
-  if (action === "copy-key" && sub.length === 1) {
-    copyAuditKey(runtimeDir);
-    process.stdout.write("Recovery key copied to the clipboard.\n");
-    return;
-  }
-  if (action === "restore" && sub.length === 3) {
-    // Uses the owner's own key copy from LCMCP_AUDIT_RECOVERY_KEY; writes a new plaintext file.
-    process.stdout.write(agent(["audit-restore", path.resolve(sub[1]), path.resolve(sub[2])], 600_000));
-    return;
-  }
-  fail("ARGUMENT_INVALID");
-}
-// Owner opt-out for take_screenshot under Full Access (#486), on by default. Only this owner-run command changes it (the agent
-// state folder is protected from every file tool); the agent checks it on each capture, so no restart is needed.
-const SCREENSHOT_OFF_FILE = "screenshot-disabled-by-owner";
-async function screenshotCommand(args) {
-  const action = args[0] || "status";
-  if (args.length > 1 || !["status", "on", "off"].includes(action)) fail("ARGUMENT_INVALID");
-  if (!(await readCurrent())) fail("AGENT_NOT_INSTALLED");
-  const file = path.join(stateDirectory(), SCREENSHOT_OFF_FILE);
-  if (action === "off") await fs.writeFile(file, "", { flag: "wx" }).catch(error => { if (error?.code !== "EEXIST") throw error; });
-  if (action === "on") await fs.rm(file, { force: true });
-  const off = await fs.lstat(file).then(() => true, error => error?.code !== "ENOENT");
-  process.stdout.write(JSON.stringify({ screenshot: off ? "off" : "on" }) + "\n");
-}
-// Public AI-provider domains routed through the tunnel; everything else stays direct. Mirror of
-// packages/connectivity/src/profiles.ts (stable public suffixes).
-const PROXY_PROVIDERS = {
-  openai: ["chatgpt.com", "openai.com", "oaistatic.com", "oaiusercontent.com", "oaistatsig.com", "cdn.openaimerge.com"],
-  anthropic: ["claude.ai", "claude.com", "anthropic.com"],
-  cursor: ["cursor.sh", "cursor.com", "cursor-cdn.com", "marketplace.cursorapi.com"]
-};
-// Proxy-mode files live in their own folder, never in the private store dir (which rejects unknown files).
-function proxyDir() { return path.join(path.dirname(stateDirectory()), "Proxy"); }
-function proxyModeFile() { return path.join(proxyDir(), "proxy-mode.json"); }
-function proxyStateFile() { return path.join(proxyDir(), "proxy.json"); }
-function proxyPacFile() { return path.join(appDataRoot(), "ai-proxy.pac"); }
-async function readProxyState() {
-  try {
-    const raw = JSON.parse(await fs.readFile(proxyStateFile(), "utf8"));
-    if (!raw || typeof raw.port !== "number" || typeof raw.password !== "string" || typeof raw.username !== "string" || !Array.isArray(raw.providers)) return null;
-    if (typeof raw.expiresAt === "number" && raw.expiresAt < Date.now()) return { ...raw, stale: true };
-    return raw;
-  } catch { return null; }
-}
-function buildPac(providers, port) {
-  const hosts = [...new Set(providers.flatMap(p => PROXY_PROVIDERS[p] ?? []))];
-  const tests = hosts.map(h => `shExpMatch(host, "${h}") || shExpMatch(host, "*.${h}")`).join(" ||\n      ");
-  return `function FindProxyForURL(url, host) {\n  host = host.toLowerCase();\n  if (${tests}) {\n    return "PROXY 127.0.0.1:${port}";\n  }\n  return "DIRECT";\n}\n`;
-}
-function proxyUrl(state) { return state.password ? `http://${state.username}:${state.password}@127.0.0.1:${state.port}` : `http://127.0.0.1:${state.port}`; }
-function browserLauncherFile() { return path.join(appDataRoot(), "open-ai-browser.cmd"); }
-function browserProfileDir() { return path.join(appDataRoot(), "ai-browser"); }
-const BROWSER_SHORTCUT = "AI Browser (Local Commander)";
-async function findBrowser() {
-  const candidates = [
-    [process.env.ProgramFiles, "Google\\Chrome\\Application\\chrome.exe"],
-    [process.env["ProgramFiles(x86)"], "Google\\Chrome\\Application\\chrome.exe"],
-    [process.env.LOCALAPPDATA, "Google\\Chrome\\Application\\chrome.exe"],
-    [process.env["ProgramFiles(x86)"], "Microsoft\\Edge\\Application\\msedge.exe"],
-    [process.env.ProgramFiles, "Microsoft\\Edge\\Application\\msedge.exe"]
-  ];
-  for (const [base, rel] of candidates) {
-    if (!base) continue;
-    const exe = path.join(base, rel);
-    try { if ((await fs.lstat(exe)).isFile()) return exe; } catch { /* try next */ }
-  }
-  return null;
-}
-// A double-click launcher: opens Chrome/Edge through the proxy in a dedicated profile that remembers
-// the proxy sign-in, so after the first time it is seamless. The port is stable across restarts.
-function buildBrowserLauncher(port) {
-  const prof = browserProfileDir();
-  const flags = `--proxy-server=http://127.0.0.1:${port} --user-data-dir="${prof}"`;
-  const chrome = ["%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe", "%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe", "%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe"];
-  const edge = ["%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe", "%ProgramFiles%\\Microsoft\\Edge\\Application\\msedge.exe"];
-  const lines = ["@echo off", "rem Local Commander - open AI sites through the proxy."];
-  for (const exe of [...chrome, ...edge]) lines.push(`if exist "${exe}" start "" "${exe}" ${flags} & goto :eof`);
-  lines.push('echo Could not find Chrome or Edge. Set your browser proxy to 127.0.0.1:' + port + ' (user lc-core).', "pause");
-  return lines.join("\r\n") + "\r\n";
-}
-function printProxyGuidance(state, shortcut) {
-  const url = proxyUrl(state), pac = proxyPacFile(), launcher = browserLauncherFile();
-  process.stdout.write("AI connection proxy is active (providers: " + state.providers.join(", ") + ").\n");
-  process.stdout.write("Loopback HTTP proxy: 127.0.0.1:" + state.port + " (no sign-in). Stable across restarts - set up once.\n\n");
-  if (shortcut) process.stdout.write("Browser: open \"" + BROWSER_SHORTCUT + "\" from the Start menu or your Desktop. It opens ChatGPT/Claude already routed - no password.\n\n");
-  else {
-    process.stdout.write("Browser: double-click this launcher (opens Chrome/Edge already routed - no password):\n");
-    process.stdout.write("  " + launcher + "\n\n");
-  }
-  process.stdout.write("CLIs (Claude Code, Codex, Antigravity, any tool that reads a proxy env var) - in the shell that runs the tool:\n");
-  process.stdout.write("  CMD:         set HTTPS_PROXY=" + url + "\n");
-  process.stdout.write("  PowerShell:  $env:HTTPS_PROXY=\"" + url + "\"\n");
-  process.stdout.write("  (also set HTTP_PROXY and ALL_PROXY to the same value for tools that read those)\n");
-  process.stdout.write("  Non-AI hosts are reached directly, so the one variable is safe for the whole session.\n\n");
-  process.stdout.write("Alternative browser setup (PAC): Settings > Network & Internet > Proxy > Use setup script =\n");
-  process.stdout.write("  file:///" + pac.replace(/\\/g, "/") + "\n");
-}
-async function proxyModeEnabled() {
-  try { return JSON.parse(await fs.readFile(proxyModeFile(), "utf8"))?.enabled === true; } catch { return false; }
-}
-// The running agent rewrites proxy.json every 15 s while it holds a lease and removes it on any
-// failure, so a missing or expired file never means "refreshing": say which condition it is.
-async function explainNoProxyLease(state) {
-  const current = await readCurrent().catch(() => null);
-  const versions = current && current.version !== VERSION
-    ? "Installed agent: " + current.version + "; this command: " + VERSION + ". If the installed agent predates proxy mode, install this version: npx local-commander-agent@" + VERSION + " update\n" : "";
-  const record = await readProcessRecord();
-  if (!record || !pidAlive(record.pid)) return "The Local Commander agent is not running, so no AI connection lease can be obtained. Start it with: localcommander start\nIf it stops again, see why with: localcommander logs\n" + versions;
-  if (state?.stale) {
-    const age = typeof state.updatedAt === "number" ? " (last refreshed " + Math.max(0, Math.round((Date.now() - state.updatedAt) / 1000)) + " s ago)" : "";
-    return "The agent is running but has stopped refreshing the AI connection lease" + age + ". Check: localcommander logs\n" + versions;
-  }
-  return "The agent is running but has no AI connection lease. The server has not granted one to this computer yet. If this lasts more than a minute, check: localcommander logs\n" + versions;
-}
-async function networkProxy(sub) {
-  if (sub.length > 2) fail("ARGUMENT_INVALID");
-  const action = sub[0] || "status";
-  if (!["on", "off", "status"].includes(action)) fail("ARGUMENT_INVALID");
-  if (action === "status") {
-    const state = await readProxyState();
-    if (state && !state.stale) printProxyGuidance(state, (await findBrowser()) ? BROWSER_SHORTCUT : null);
-    else if (!state && !(await proxyModeEnabled())) process.stdout.write("AI connection proxy is not active. Enable it with: localcommander network proxy on\n");
-    else process.stdout.write("AI connection proxy is enabled but has no active lease.\n" + await explainNoProxyLease(state));
-    return;
-  }
-  if (action === "off") {
-    await writeJsonAtomic(proxyModeFile(), { enabled: false });
-    await restartIfRunning();
-    await fs.rm(proxyStateFile(), { force: true }).catch(() => {});
-    await fs.rm(proxyPacFile(), { force: true }).catch(() => {});
-    await fs.rm(browserLauncherFile(), { force: true }).catch(() => {});
-    try { removeBrowserShortcut(BROWSER_SHORTCUT); } catch { /* shortcut optional */ }
-    process.stdout.write("AI connection proxy disabled.\n");
-    return;
-  }
-  const requested = sub[1] ? sub[1].split(",").map(p => p.trim().toLowerCase()) : Object.keys(PROXY_PROVIDERS);
-  const providers = requested.filter(p => Object.hasOwn(PROXY_PROVIDERS, p));
-  if (!providers.length) fail("ARGUMENT_INVALID");
-  await writeJsonAtomic(proxyModeFile(), { enabled: true, providers });
-  const record = await readProcessRecord();
-  if (record && pidAlive(record.pid)) await stopAgent();
-  // A forced stop skips the agent's cleanup; never mistake the old agent's state file for a new lease.
-  await fs.rm(proxyStateFile(), { force: true }).catch(() => {});
-  await startAgent();
-  // The agent reconnects and fetches a lease before it can publish the proxy coordinates.
-  let state = null;
-  for (let i = 0; i < 30 && !(state && !state.stale); i++) {
-    await new Promise(r => setTimeout(r, 1000));
-    state = await readProxyState();
-    const running = await readProcessRecord();
-    if (!(state && !state.stale) && (!running || !pidAlive(running.pid))) break;
-  }
-  if (state && !state.stale) {
-    await fs.writeFile(proxyPacFile(), buildPac(state.providers, state.port), { mode: 0o600 });
-    await fs.writeFile(browserLauncherFile(), buildBrowserLauncher(state.port), { mode: 0o600 });
-    let shortcut = null;
-    try {
-      const exe = await findBrowser();
-      if (exe) shortcut = installBrowserShortcut(BROWSER_SHORTCUT, exe, `--proxy-server=http://127.0.0.1:${state.port} --user-data-dir="${browserProfileDir()}"`);
-    } catch { /* shortcut is a convenience; the launcher .cmd still works */ }
-    printProxyGuidance(state, shortcut);
-  } else process.stdout.write("AI connection proxy enabled, but no lease was obtained.\n" + await explainNoProxyLease(state));
-}
-async function approveWorkspace(runtimeDir) {
-  const result = execAgent(runtimeDir, ["approve-workspace"], 180_000);
-  if (result.status !== 0) fail(result.stderr.trim() || "WORKSPACE_APPROVAL_FAILED");
-  const answer = result.stdout.trim();
-  if (answer === "WORKSPACE_CANCELLED") return false;
-  if (answer !== "WORKSPACE_APPROVED") fail("WORKSPACE_APPROVAL_INVALID");
-  process.stdout.write("Workspace approved.\n");
-  return true;
-}
-// Owner-only local permission surface. These run the installed runtime's own
-// commands on this PC; the cloud, the AI client and MCP calls cannot reach them.
-const PERMISSION_COMMANDS = { "revoke-workspace": 1, "allow-write": 1, "deny-write": 1, "allow-command": 3, "deny-command": 2, "allow-localhost": 2, "deny-localhost": 2 };
-async function listWorkspaces(runtimeDir) {
-  const result = execAgent(runtimeDir, ["list-workspaces"], 15_000);
-  if (result.status !== 0) fail(result.stderr.trim() || "WORKSPACE_LIST_FAILED");
-  try { process.stdout.write(JSON.stringify(JSON.parse(result.stdout.trim() || "[]"), null, 2) + "\n"); }
-  catch { fail("WORKSPACE_LIST_INVALID"); }
-}
-async function changePermission(runtimeDir, command, args) {
-  if (args.length !== PERMISSION_COMMANDS[command]) fail("ARGUMENT_INVALID");
-  // Covers the 60 s native owner review plus DPAPI/state work (see planning/OWNER_PERMISSIONS.md).
-  const result = execAgent(runtimeDir, [command, ...args], 90_000);
-  if (result.status !== 0) fail(result.stderr.trim() || "PERMISSION_UPDATE_FAILED");
-  const record = await readProcessRecord();
-  if (record && pidAlive(record.pid)) {
-    await stopAgent();
-    await startAgent();
-    process.stdout.write("Permission updated; Local Commander restarted.\n");
-  } else process.stdout.write("Permission updated.\n");
-}
-function pidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try { process.kill(pid, 0); return true; }
-  catch (error) { return error && error.code === "EPERM"; }
-}
-async function readProcessRecord() {
-  try {
-    const parsed = JSON.parse(await fs.readFile(processFile(), "utf8"));
-    if (!parsed || typeof parsed !== "object" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || typeof parsed.runtimeDir !== "string") return null;
-    const runtimeDir = path.resolve(parsed.runtimeDir);
-    if (!under(versionsDirectory(), runtimeDir)) return null;
-    return { pid: parsed.pid, runtimeDir, version: typeof parsed.version === "string" ? parsed.version : null, startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : null };
-  } catch { return null; }
-}
-async function statusObject() {
-  const current = await readCurrent();
-  const record = await readProcessRecord();
-  const running = !!record && pidAlive(record.pid);
-  if (record && !running) await fs.rm(processFile(), { force: true }).catch(() => {});
-  const identity = current ? await identityStatus(current.runtimeDir).catch(() => ({ paired: false, accountEmail: null, deviceId: null })) : { paired: false, accountEmail: null, deviceId: null };
-  return {
-    installed: !!current,
-    version: current?.version ?? null,
-    running,
-    pid: running ? record.pid : null,
-    paired: identity.paired,
-    accountEmail: identity.accountEmail,
-    deviceId: identity.deviceId,
-    stateDirectory: stateDirectory()
-  };
-}
-async function verifyOwnedProcess(record) {
-  if (!pidAlive(record.pid)) return false;
-  const script = '$p=Get-CimInstance Win32_Process -Filter "ProcessId = ' + record.pid + '"; if($null -eq $p){exit 3}; [Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Write-Output $p.ExecutablePath; Write-Output $p.CommandLine';
-  const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, encoding: "utf8", timeout: 10_000 });
-  if (result.status === 3) return false;
-  if (result.status !== 0) fail("PROCESS_IDENTITY_CHECK_FAILED");
-  const lines = String(result.stdout || "").split(/\r?\n/u).filter(Boolean);
-  const executable = path.resolve(lines.shift() || "");
-  const expectedNode = path.resolve(record.runtimeDir, "node.exe");
-  const commandLine = lines.join("\n").toLowerCase();
-  return executable.toLowerCase() === expectedNode.toLowerCase() && commandLine.includes(path.join(record.runtimeDir, "agent.mjs").toLowerCase());
-}
-async function stopAgent() {
-  const record = await readProcessRecord();
-  if (!record || !pidAlive(record.pid)) {
-    await fs.rm(processFile(), { force: true }).catch(() => {});
-    return false;
-  }
-  if (!(await verifyOwnedProcess(record))) fail("PROCESS_IDENTITY_MISMATCH");
-  const result = spawnSync("taskkill.exe", ["/PID", String(record.pid), "/T", "/F"], { windowsHide: true, encoding: "utf8", timeout: 15_000 });
-  if (result.status !== 0 && pidAlive(record.pid)) fail("AGENT_STOP_FAILED");
-  for (let i = 0; i < 20 && pidAlive(record.pid); i += 1) await new Promise(resolve => setTimeout(resolve, 100));
-  if (pidAlive(record.pid)) fail("AGENT_STOP_TIMEOUT");
-  await fs.rm(processFile(), { force: true }).catch(() => {});
-  return true;
-}
-async function startAgent() {
-  const current = await readCurrent();
-  if (!current) fail("AGENT_NOT_INSTALLED");
-  const identity = await identityStatus(current.runtimeDir);
-  if (!identity.paired) fail("ENROLLMENT_MISSING");
-  const status = await statusObject();
-  if (status.running) return false;
-  const child = spawn(agentExe(current.runtimeDir), ["run"], { detached: true, windowsHide: true, stdio: "ignore", env: agentEnv() });
-  child.unref();
-  for (let i = 0; i < 40; i += 1) {
-    await new Promise(resolve => setTimeout(resolve, 100));
-    const record = await readProcessRecord();
-    if (record && pidAlive(record.pid)) return true;
-  }
-  fail("AGENT_START_TIMEOUT");
-}
-async function bootstrap({ chooseWorkspace = true } = {}) {
-  const previous = await readCurrent();
-  const target = path.join(versionsDirectory(), VERSION);
-  const running = await readProcessRecord();
-  if (running && pidAlive(running.pid) && path.resolve(running.runtimeDir).toLowerCase() !== path.resolve(target).toLowerCase()) await stopAgent();
-  const runtimeDir = await copyRuntime();
-  const identity = await identityStatus(runtimeDir);
-  if (!identity.paired) await pair(runtimeDir);
-  if (chooseWorkspace) {
-    const list = execAgent(runtimeDir, ["list-workspaces"], 15_000);
-    if (list.status !== 0) fail("WORKSPACE_LIST_FAILED");
-    let existing;
-    try { existing = JSON.parse(list.stdout); } catch { fail("WORKSPACE_LIST_INVALID"); }
-    if (!Array.isArray(existing)) fail("WORKSPACE_LIST_INVALID");
-    if (existing.length === 0 && !(await configureAccess(runtimeDir))) fail("ACCESS_SETUP_CANCELLED");
-  }
-  // Antivirus can remove or lock the network files; the verified bundle is then skipped, but the agent still updates and starts.
-  let networkCopied = false, networkManifest = null, networkError = null;
-  if (AI_CONNECTION_SHIPPED) try {
-    networkCopied = await copyNetworkBundle(path.join(runtimeSource(), "network"), path.join(runtimeDir, "network"));
-    if (networkCopied) networkManifest = (await inspectNetworkBundle(path.join(runtimeDir, "network")))?.manifest;
-  } catch (error) {
-    networkCopied = false;
-    networkError = error && /^[A-Z0-9_]{1,80}$/u.test(error.message) ? error.message : error && /^E[A-Z]{2,20}$/u.test(error.code) ? error.code : "NETWORK_BUNDLE_UNREADABLE";
-  }
-  if (networkError) process.stdout.write("The AI connection files could not be installed (" + networkError + "). Antivirus may have removed or blocked them. Local Commander starts without the AI connection.\n");
-  else if (networkCopied && implicitSetupAllowed(networkManifest)) {
-    const network = execAgent(runtimeDir, ["network-setup"], 330_000);
-    if (network.status !== 0) process.stdout.write("AI network setup was not completed. Local Commander will start without changing your network. Use localcommander network setup to retry.\n");
-  } else if (networkCopied) process.stdout.write("This build includes the AI connection pilot. It changes nothing until you run: localcommander network setup\n");
-  registerAutostart(runtimeDir);
-  await startAgent();
-  const commandBin = await installCommandFiles(PACKAGE_ROOT, appDataRoot(), VERSION);
-  updateUserPath(commandBin);
-  // The Start menu entry is a convenience: a conflicting user shortcut or shell failure must not undo a working installation.
-  let shortcut = null, shortcutError = null;
-  try { shortcut = installStartMenuShortcut(commandBin); } catch (error) { shortcutError = error && typeof error.message === "string" ? error.message : "SHORTCUT_UPDATE_FAILED"; }
-  if (previous && previous.version !== VERSION) process.stdout.write("Updated Local Commander from " + previous.version + " to " + VERSION + ".\n");
-  process.stdout.write("Local Commander " + VERSION + " is installed and running.\n");
-  process.stdout.write("The localcommander command is on your user PATH. Open a new CMD or terminal window to use it.\n");
-  process.stdout.write("Watch connections and tasks with: localcommander monitor --watch\n");
-  if (shortcut) process.stdout.write('Start menu: "' + shortcut + '" opens the same live view without a terminal.\n');
-  else process.stdout.write("The Start menu shortcut was not created (" + shortcutError + "); the localcommander command still works.\n");
-}
-async function uninstall(purgeState) {
-  await stopAgent();
-  const current = await readCurrent();
-  if (current) {
-    const network = execAgent(current.runtimeDir, ["network-uninstall"], 330_000);
-    if (network.status !== 0) process.stdout.write("The network service could not be removed automatically. The agent is stopped, so its VPN authorization cannot renew. Remove LocalCommanderNetwork through the approved administrator workflow.\n");
-  }
-  removeAutostart();
-  try { removeStartMenuShortcut(); } catch (error) { process.stdout.write("The Start menu shortcut was not removed (" + (error?.message || "SHORTCUT_UPDATE_FAILED") + ").\n"); }
-  updateUserPath(path.join(appDataRoot(), "bin"), true);
-  await removeCommandFile(appDataRoot());
-  const versions = versionsDirectory();
-  if (under(appDataRoot(), versions)) await fs.rm(versions, { recursive: true, force: true });
-  await fs.rm(currentPath(), { force: true });
-  if (purgeState) {
-    const state = stateDirectory();
-    const expected = path.join(appDataRoot(), "Agent");
-    if (path.resolve(state).toLowerCase() !== path.resolve(expected).toLowerCase()) fail("CUSTOM_STATE_PURGE_REFUSED");
-    await fs.rm(state, { recursive: true, force: true });
-  }
-  process.stdout.write(purgeState ? "Local Commander removed, including local enrollment state.\n" : "Local Commander removed. Protected enrollment state was preserved.\n");
-}
-function allowCommandHelp() {
-  return [
-    "Usage: npx local-commander-agent@latest allow-command <workspaceGrantId> <name> <absolute-executable-path>",
-    "Exactly three arguments are required. Quote executable paths containing spaces.",
-    "Find the workspace ID with: npx local-commander-agent@latest workspaces",
-    "",
-    "CMD: find Git with where git.exe, then copy the intended full path:",
-    '  npx local-commander-agent@latest allow-command WORKSPACE_ID git "C:\\Path To Git\\git.exe"',
-    "Replace WORKSPACE_ID and the example path with your actual values.",
-    "",
-    "PowerShell only:",
-    "  $gitExe = @(Get-Command git.exe -CommandType Application -ErrorAction Stop)[0].Source",
-    '  npx.cmd local-commander-agent@latest allow-command WORKSPACE_ID git "$gitExe"',
-    "CMD does not evaluate (Get-Command ...).Source. Local Commander never evaluates shell expressions.",
-    "A valid command still requires local owner approval.",
-    ""
-  ].join("\n");
-}
-// #104 slice 2: direct local MCP for AI clients on this computer, with no cloud round trip per call.
-// The owner's opt-in lives outside the agent state directory; the agent re-reads it on every call.
-function localMcpDirectory() { return path.join(appDataRoot(), "LocalMcp"); }
-const LOCAL_MCP_CLIENTS = [
-  "  Claude Code:   claude mcp add local-commander -- cmd /c localcommander mcp",
-  "  Codex:         ~/.codex/config.toml -> [mcp_servers.local-commander] command = \"cmd\", args = [\"/c\", \"localcommander\", \"mcp\"]",
-  "  Other clients: { \"command\": \"cmd\", \"args\": [\"/c\", \"localcommander\", \"mcp\"] }"
-];
-async function localMcpCommand(sub) {
-  if (sub.length > 1) fail("ARGUMENT_INVALID");
-  const action = sub[0], settings = path.join(localMcpDirectory(), "settings.json");
-  const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
-  if (action === undefined) {
-    // Stdio passes straight through: the AI client speaks MCP to the agent runtime, never to this launcher.
-    const child = spawn(path.join(current.runtimeDir, "node.exe"), [path.join(current.runtimeDir, "agent.mjs"), "mcp"], { stdio: "inherit", windowsHide: true, env: agentEnv() });
-    await new Promise(resolve => {
-      child.once("exit", code => { process.exitCode = code ?? 1; resolve(); });
-      child.once("error", () => { process.exitCode = 1; resolve(); });
-    });
-    return;
-  }
-  if (action === "on" || action === "off") {
-    await writeJsonAtomic(settings, { enabled: action === "on", updatedAt: new Date().toISOString() });
-    await restartIfRunning();
-    process.stdout.write(action === "on" ? [
-      "Direct local MCP is ON. AI clients on this computer can use your approved workspaces without the cloud.",
-      "Add Local Commander to a client's MCP settings:", ...LOCAL_MCP_CLIENTS,
-      "Turn it off at any time with: localcommander mcp off", ""].join("\n")
-      : "Direct local MCP is OFF. AI clients on this computer can no longer use Local Commander directly.\n");
-    return;
-  }
-  if (action === "status") {
-    let enabled = false, endpoint = null;
-    try { enabled = JSON.parse(await fs.readFile(settings, "utf8"))?.enabled === true; } catch {}
-    try { endpoint = JSON.parse(await fs.readFile(path.join(localMcpDirectory(), "endpoint.json"), "utf8")); } catch {}
-    const serving = enabled && Number.isSafeInteger(endpoint?.pid) && pidAlive(endpoint.pid);
-    process.stdout.write([
-      "Direct local MCP: " + (enabled ? "ON" : "OFF") + (enabled ? (serving ? " (agent is serving on 127.0.0.1)" : " (agent not serving: run localcommander restart)") : ""),
-      ...(enabled ? ["MCP settings for AI clients on this computer:", ...LOCAL_MCP_CLIENTS] : ["Turn it on with: localcommander mcp on"]), ""].join("\n"));
-    return;
-  }
-  fail("ARGUMENT_INVALID");
-}
-function help() {
-  return [
-    "Local Commander agent " + VERSION,
-    "",
-    "Usage:",
-    "  npx local-commander-agent@latest              install/pair/start",
-    "  npx local-commander-agent@latest status       show local state",
-    "  localcommander monitor --watch              live connections and tasks (also: Start menu > Local Commander Monitor)",
-    "  localcommander monitor --json               monitoring snapshot as JSON",
-    "  localcommander logs --follow                recent production relay events",
-    "  npx local-commander-agent@latest start        start background agent",
-    "  npx local-commander-agent@latest stop         stop background agent",
-    "  npx local-commander-agent@latest restart      restart background agent",
-    "  npx local-commander-agent@latest update       install this package version and restart",
-    "  npx local-commander-agent@latest configure-access  choose all connected drives or selected folders",
-    "  npx local-commander-agent@latest approve-workspace add another read/write folder",
-    "  npx local-commander-agent@latest revoke-workspace <workspaceGrantId>",
-    "  npx local-commander-agent@latest workspaces    list approved workspaces and permissions",
-    ...(AI_CONNECTION_SHIPPED ? [
-      "  localcommander network [status|auto|on|off|setup|panel]  owner-local AI connection controls",
-      "  localcommander network proxy [on|off|status] [providers]  driver-free AI proxy for browser + CLI (no TUN)"
-    ] : []),
-    "  localcommander mcp on|off|status            direct local MCP for AI clients on this computer (no cloud per call)",
-    "  localcommander mcp                          stdio MCP server; start it from an AI client's MCP settings",
-    "  localcommander audit [status|on|off|copy-key]  owner-local encrypted content audit (pilot)",
-    "  localcommander audit restore <file> <output>  decrypt with your key in LCMCP_AUDIT_RECOVERY_KEY",
-    "  localcommander fabric-owner                 owner mailbox request through private stdin",
-    "  localcommander fabric-worker                restricted worker request through private stdin",
-    "  npx local-commander-agent@latest allow-write <workspaceGrantId>",
-    "  npx local-commander-agent@latest allow-command <workspaceGrantId> <name> <absolute-executable-path>",
-    "  npx local-commander-agent@latest allow-command --help  CMD and PowerShell examples",
-    "  npx local-commander-agent@latest allow-localhost <workspaceGrantId> <port>",
-    "  npx local-commander-agent@latest deny-write|deny-command|deny-localhost ...",
-    "  npx local-commander-agent@latest uninstall [--purge-state]",
-    ""
-  ].join("\n");
-}
-async function main() {
-  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(VERSION)) fail("PACKAGE_VERSION_INVALID");
-  // macOS and Linux run the per-platform runtime package through its own lifecycle (#253).
-  if (process.platform !== "win32") return (await import("./posix.mjs")).runPosix(process.argv.slice(2), VERSION);
-  requireWindows();
-  const command = process.argv[2] || "bootstrap";
-  const args = process.argv.slice(3);
-  if (command === "-h" || command === "--help" || command === "help") {
-    process.stdout.write(help());
-    return;
-  }
-  if (command === "allow-command") {
-    if (args.length === 1 && ["--help", "-h"].includes(args[0])) {
-      process.stdout.write(allowCommandHelp());
-      return;
-    }
-    // Reject shell fragments before reading installed state or opening owner consent.
-    if (args.length !== PERMISSION_COMMANDS[command] || !path.win32.isAbsolute(args[2])) fail("ARGUMENT_INVALID");
-  }
-  if (command === "bootstrap" || command === "install") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    await bootstrap();
-    return;
-  }
-  if (command === "update") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    await bootstrap({ chooseWorkspace: false });
-    return;
-  }
-  if (command === "start") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    await startAgent();
-    process.stdout.write("Local Commander is running.\n");
-    return;
-  }
-  if (command === "stop") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    const stopped = await stopAgent();
-    process.stdout.write(stopped ? "Local Commander stopped.\n" : "Local Commander was not running.\n");
-    return;
-  }
-  if (command === "restart") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    await stopAgent();
-    await startAgent();
-    process.stdout.write("Local Commander restarted.\n");
-    return;
-  }
-  if (command === "status") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    process.stdout.write(JSON.stringify(await statusObject(), null, 2) + "\n");
-    return;
-  }
-  if (command === "monitor" || command === "logs") {
-    await runMonitor(path.join(appDataRoot(), "Monitor"), command, args);
-    return;
-  }
-  if (command === "network") {
-    // While the AI connection is not shipped, only checking it and switching it off stay available (for PCs that enabled the pilot).
-    if (!AI_CONNECTION_SHIPPED && !(args.length === 0 || (args.length === 1 && ["status", "off"].includes(args[0])) || (args.length === 2 && args[0] === "proxy" && args[1] === "off"))) fail("AI_CONNECTION_UNAVAILABLE");
-    const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
-    if (args[0] === "proxy") { await networkProxy(args.slice(1)); return; }
-    if (args.length > 1 || !["status", "auto", "on", "off", "setup", "panel"].includes(args[0] || "status")) fail("ARGUMENT_INVALID");
-    const action = args[0] || "status";
-    const childArgs = ["auto", "on", "off"].includes(action) ? ["network-mode", action] : ["network-" + action];
-    const result = execAgent(current.runtimeDir, childArgs, action === "setup" ? 330_000 : 15_000);
-    if (result.status !== 0) fail(result.stderr.trim() || "NETWORK_ACTION_FAILED");
-    process.stdout.write(result.stdout);
-    if (action === "setup") await restartIfRunning();
-    return;
-  }
-  if (command === "screenshot") {
-    await screenshotCommand(args);
-    return;
-  }
-  if (command === "audit") {
-    const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
-    await auditCommand(current.runtimeDir, args);
-    return;
-  }
-  if (command === "mcp") {
-    await localMcpCommand(args);
-    return;
-  }
-  if (command === "fabric-owner" || command === "fabric-worker") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    const current = await readCurrent();
-    if (!current) fail("AGENT_NOT_INSTALLED");
-    await fabricCommand(current.runtimeDir, command);
-    return;
-  }
-  if (command === "configure-access") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    const current = await readCurrent();
-    if (!current) fail("AGENT_NOT_INSTALLED");
-    if (await configureAccess(current.runtimeDir)) {
-      await restartIfRunning();
-      process.stdout.write("Filesystem access configured.\n");
-    } else process.stdout.write("Access selection cancelled; existing permissions were preserved.\n");
-    return;
-  }
-  if (command === "approve-workspace") {
-    if (args.length) fail("ARGUMENT_INVALID");
-    const current = await readCurrent();
-    if (!current) fail("AGENT_NOT_INSTALLED");
-    if (await approveWorkspace(current.runtimeDir)) await restartIfRunning();
-    else process.stdout.write("Workspace selection cancelled.\n");
-    return;
-  }
-  if (command === "workspaces" || Object.hasOwn(PERMISSION_COMMANDS, command)) {
-    if (command === "workspaces" && args.length) fail("ARGUMENT_INVALID");
-    const current = await readCurrent();
-    if (!current) fail("AGENT_NOT_INSTALLED");
-    if (command === "workspaces") await listWorkspaces(current.runtimeDir);
-    else await changePermission(current.runtimeDir, command, args);
-    return;
-  }
-  if (command === "uninstall") {
-    if (args.length > 1 || (args.length === 1 && args[0] !== "--purge-state")) fail("ARGUMENT_INVALID");
-    await uninstall(args[0] === "--purge-state");
-    return;
-  }
-  fail("ARGUMENT_INVALID");
-}
-
-void main().catch(error => {
-  const code = error && typeof error.message === "string" && /^[A-Z0-9_]{1,80}$/u.test(error.message) ? error.message : "LOCAL_COMMANDER_FAILED";
-  // Unlabelled failures show only the system error class and operation (e.g. EPERM copyfile), never paths or messages.
-  const detail = code === "LOCAL_COMMANDER_FAILED" && error && typeof error.code === "string" && /^[A-Z][A-Z0-9_]{1,40}$/u.test(error.code)
-    ? " (" + error.code + (typeof error.syscall === "string" && /^[a-z_]{1,20}$/u.test(error.syscall) ? " " + error.syscall : "") + ")" : "";
-  process.stderr.write(code + detail + "\n");
-  if (code === "ARGUMENT_INVALID" && process.argv[2] === "allow-command") process.stderr.write(allowCommandHelp());
-  if (code === "AI_CONNECTION_UNAVAILABLE") process.stderr.write("The AI connection is not available in this version of Local Commander.\n");
-  process.exitCode = 1;
-});
+#!/usr/bin/env node
+import { constants as fsConstants } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { copyNetworkBundle, implicitSetupAllowed, inspectNetworkBundle } from "./network-package.mjs";
+import { runMonitor } from "./monitor.mjs";
+import { installCommandFiles, installStartMenuShortcut, removeCommandFile, removeStartMenuShortcut, updateUserPath, installBrowserShortcut, removeBrowserShortcut } from "./command-path.mjs";
+
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PACKAGE_META = JSON.parse(await fs.readFile(path.join(PACKAGE_ROOT, "package.json"), "utf8"));
+const VERSION = String(PACKAGE_META.version || "");
+const DEFAULT_ORIGIN = String(PACKAGE_META.localCommander?.controlPlaneOrigin || "");
+const RUNTIME_FILES = ["LocalCommanderAgent.exe", "OwnerBridge.exe", "JobHost.exe", "agent.mjs", "node.exe", "NODE-LICENSE.txt"];
+const RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+const RUN_VALUE = "LocalCommanderAgent";
+const MAX_STDIO = 1024 * 1024;
+// Owner decision #204: this package ships without the AI connection (#112). The code stays; set this to true
+// (and build with LC_AI_CONNECTIVITY_BUNDLE) to bring it back. Turning it off and uninstalling still clean up.
+const AI_CONNECTION_SHIPPED = false;
+
+function fail(code) {
+  const error = new Error(code);
+  error.code = code;
+  throw error;
+}
+function requireWindows() {
+  if (process.platform !== "win32" || process.arch !== "x64") fail("WINDOWS_X64_REQUIRED");
+}
+function appDataRoot() {
+  const value = process.env.LOCALAPPDATA;
+  if (!value || !path.isAbsolute(value) || /[\u0000-\u001f]/u.test(value)) fail("APP_DATA_MISSING");
+  return path.join(value, "LocalCommander");
+}
+function stateDirectory() {
+  const override = process.env.LC_AGENT_STATE_DIR;
+  if (override) {
+    if (!path.isAbsolute(override) || /[\u0000-\u001f]/u.test(override)) fail("STATE_DIR_INVALID");
+    return path.resolve(override);
+  }
+  return path.join(appDataRoot(), "Agent");
+}
+function versionsDirectory() {
+  return path.join(appDataRoot(), "Versions");
+}
+function currentPath() {
+  return path.join(appDataRoot(), "current.json");
+}
+function runtimeSource() {
+  if (PACKAGE_ROOT.toLowerCase() === path.join(versionsDirectory(), VERSION).toLowerCase()) return PACKAGE_ROOT;
+  return path.join(PACKAGE_ROOT, "runtime");
+}
+function processFile() {
+  return path.join(stateDirectory(), "agent-process.json");
+}
+function under(parent, child) {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+function boundedText(value) {
+  const text = String(value ?? "");
+  return text.length > MAX_STDIO ? text.slice(0, MAX_STDIO) : text;
+}
+async function regular(file) {
+  const stat = await fs.lstat(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 1) fail("PACKAGE_RUNTIME_INVALID");
+  return stat;
+}
+async function ensurePlainDirectory(dir) {
+  await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+  const stat = await fs.lstat(dir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail("INSTALL_DIRECTORY_INVALID");
+  return dir;
+}
+async function ensureInstallDirectories() {
+  const root = await ensurePlainDirectory(appDataRoot());
+  const versions = await ensurePlainDirectory(versionsDirectory());
+  if (!under(root, versions)) fail("INSTALL_DIRECTORY_INVALID");
+  return { root, versions };
+}
+async function runtimeValid(dir) {
+  try {
+    for (const name of RUNTIME_FILES) await regular(path.join(dir, name));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function writeJsonAtomic(file, value) {
+  await ensurePlainDirectory(path.dirname(file));
+  const existing = await fs.lstat(file).catch(error => error?.code === "ENOENT" ? null : Promise.reject(error));
+  if (existing && (!existing.isFile() || existing.isSymbolicLink())) fail("INSTALL_STATE_INVALID");
+  const temp = file + "." + process.pid + "." + randomBytes(6).toString("hex") + ".tmp";
+  await fs.writeFile(temp, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 0o600 });
+  try {
+    await fs.rename(temp, file);
+  } catch (error) {
+    await fs.rm(temp, { force: true });
+    throw error;
+  }
+}
+async function readCurrent() {
+  try {
+    const current = currentPath();
+    const stat = await fs.lstat(current);
+    if (!stat.isFile() || stat.isSymbolicLink()) fail("INSTALL_STATE_INVALID");
+    const raw = JSON.parse(await fs.readFile(current, "utf8"));
+    if (!raw || typeof raw !== "object" || typeof raw.version !== "string" || typeof raw.runtimeDir !== "string") fail("INSTALL_STATE_INVALID");
+    const dir = path.resolve(raw.runtimeDir);
+    if (!under(versionsDirectory(), dir) || !(await runtimeValid(dir))) fail("INSTALL_STATE_INVALID");
+    return { version: raw.version, runtimeDir: dir };
+  } catch (error) {
+    if (error && error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function copyRuntime() {
+  const source = runtimeSource();
+  if (!(await runtimeValid(source))) fail("PACKAGE_RUNTIME_MISSING");
+  const { versions } = await ensureInstallDirectories();
+  const target = path.join(versions, VERSION);
+  if (await runtimeValid(target)) {
+    await writeJsonAtomic(currentPath(), { version: VERSION, runtimeDir: target });
+    return target;
+  }
+  const targetStat = await fs.lstat(target).catch(error => error?.code === "ENOENT" ? null : Promise.reject(error));
+  if (targetStat) {
+    if (!targetStat.isDirectory() || targetStat.isSymbolicLink() || !under(versions, target)) fail("INSTALL_TARGET_INVALID");
+    await fs.rm(target, { recursive: true, force: true });
+  }
+  const temp = path.join(versions, "." + VERSION + "." + process.pid + "." + randomBytes(6).toString("hex"));
+  await fs.mkdir(temp, { recursive: false, mode: 0o700 });
+  try {
+    for (const name of RUNTIME_FILES) {
+      const sourceFile = path.join(source, name);
+      const sourceStat = await regular(sourceFile);
+      const destination = path.join(temp, name);
+      await fs.copyFile(sourceFile, destination, fsConstants.COPYFILE_EXCL);
+      const copied = await regular(destination);
+      if (copied.size !== sourceStat.size) fail("PACKAGE_COPY_INVALID");
+    }
+    try {
+      await fs.rename(temp, target);
+    } catch (error) {
+      if (!(await runtimeValid(target))) throw error;
+      await fs.rm(temp, { recursive: true, force: true });
+    }
+    await writeJsonAtomic(currentPath(), { version: VERSION, runtimeDir: target });
+    return target;
+  } catch (error) {
+    await fs.rm(temp, { recursive: true, force: true });
+    throw error;
+  }
+}
+function runReg(args, allowMissing = false) {
+  const result = spawnSync("reg.exe", args, { windowsHide: true, encoding: "utf8", timeout: 10_000 });
+  if (result.error) fail("AUTOSTART_COMMAND_FAILED");
+  if (result.status !== 0 && !(allowMissing && result.status === 1)) fail("AUTOSTART_COMMAND_FAILED");
+}
+function registerAutostart(runtimeDir) {
+  const exe = path.join(runtimeDir, "LocalCommanderAgent.exe");
+  if (exe.includes('"')) fail("INSTALL_PATH_INVALID");
+  runReg(["ADD", RUN_KEY, "/v", RUN_VALUE, "/t", "REG_SZ", "/d", '"' + exe + '" run', "/f"]);
+}
+function removeAutostart() {
+  runReg(["DELETE", RUN_KEY, "/v", RUN_VALUE, "/f"], true);
+}
+function agentEnv() {
+  const env = { ...process.env, LC_AGENT_STATE_DIR: stateDirectory() };
+  delete env.NODE_OPTIONS;
+  delete env.NODE_PATH;
+  return env;
+}
+function agentExe(runtimeDir) {
+  return path.join(runtimeDir, "LocalCommanderAgent.exe");
+}
+function execAgent(runtimeDir, args, timeout = 30_000) {
+  const result = spawnSync(agentExe(runtimeDir), args, {
+    windowsHide: true,
+    encoding: "utf8",
+    timeout,
+    env: agentEnv()
+  });
+  if (result.error) fail("AGENT_COMMAND_FAILED");
+  return { status: result.status ?? -1, stdout: boundedText(result.stdout), stderr: boundedText(result.stderr) };
+}
+async function fabricCommand(runtimeDir, command) {
+  const chunks = []; let bytes = 0;
+  for await (const chunk of process.stdin) {
+    bytes += chunk.length;
+    if (bytes > 16_384) fail("FABRIC_REQUEST_LIMIT");
+    chunks.push(chunk);
+  }
+  // Private stdin is explicit; no credential arguments, shell, listener or foreground window.
+  const result = spawnSync(path.join(runtimeDir, "node.exe"), [path.join(runtimeDir, "agent.mjs"), command], {
+    input: Buffer.concat(chunks), windowsHide: true, encoding: "utf8", timeout: 30_000,
+    maxBuffer: 2 * 1024 * 1024, env: agentEnv()
+  });
+  if (result.error || result.status !== 0) fail(/^[A-Z0-9_]{1,80}$/u.test(result.stderr?.trim()) ? result.stderr.trim() : "FABRIC_REQUEST_FAILED");
+  process.stdout.write(result.stdout);
+}
+function openBrowser(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch { fail("PAIRING_URL_INVALID"); }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))) fail("PAIRING_URL_INVALID");
+  const child = spawn("rundll32.exe", ["url.dll,FileProtocolHandler", parsed.toString()], { detached: true, windowsHide: true, stdio: "ignore" });
+  child.unref();
+}
+async function identityStatus(runtimeDir) {
+  const result = execAgent(runtimeDir, ["identity-status"], 15_000);
+  if (result.status !== 0) fail(result.stderr.trim() || "IDENTITY_STATUS_FAILED");
+  try {
+    const parsed = JSON.parse(result.stdout.trim());
+    return { paired: parsed.paired === true, accountEmail: typeof parsed.accountEmail === "string" ? parsed.accountEmail : null, deviceId: typeof parsed.deviceId === "string" ? parsed.deviceId : null };
+  } catch { fail("IDENTITY_STATUS_INVALID"); }
+}
+async function pair(runtimeDir) {
+  const origin = process.env.LC_CONTROL_PLANE_ORIGIN || DEFAULT_ORIGIN;
+  if (!origin) fail("CONTROL_PLANE_ORIGIN_MISSING");
+  const child = spawn(agentExe(runtimeDir), ["pair"], {
+    windowsHide: true,
+    env: { ...agentEnv(), LC_CONTROL_PLANE_ORIGIN: origin },
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "", stderr = "", opened = false;
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", chunk => {
+    stdout = boundedText(stdout + chunk);
+    if (opened) return;
+    const lineEnd = stdout.indexOf("\n");
+    if (lineEnd < 0) return;
+    const line = stdout.slice(0, lineEnd).trim();
+    try {
+      const begin = JSON.parse(line);
+      if (typeof begin.approvalUrl !== "string" || typeof begin.confirmationCode !== "string") fail("PAIRING_RESPONSE_INVALID");
+      opened = true;
+      // #218: the link carries the code, so the website opens the dialog with it filled in.
+      const link = new URL(begin.approvalUrl);
+      if (/^[A-Za-z2-9]{8}$/.test(begin.confirmationCode)) link.searchParams.set("code", begin.confirmationCode);
+      process.stdout.write("Pairing code: " + begin.confirmationCode + "\n");
+      process.stdout.write("Opening: " + link + "\n");
+      openBrowser(link.toString());
+    } catch {
+      child.kill();
+    }
+  });
+  child.stderr.on("data", chunk => { stderr = boundedText(stderr + chunk); });
+  const exitCode = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", code => resolve(code ?? -1));
+  }).catch(() => -1);
+  if (exitCode !== 0) fail(stderr.trim() || "PAIRING_FAILED");
+  if (!opened) fail("PAIRING_RESPONSE_INVALID");
+  process.stdout.write("Device paired.\n");
+}
+async function configureAccess(runtimeDir) {
+  const result = execAgent(runtimeDir, ["configure-access"], 300_000);
+  if (result.status !== 0) fail(result.stderr.trim() || "ACCESS_CONFIGURATION_FAILED");
+  const answer = result.stdout.trim();
+  if (answer === "ACCESS_CANCELLED") return false;
+  if (answer !== "ACCESS_CONFIGURED") fail("ACCESS_CONFIGURATION_INVALID");
+  return true;
+}
+async function restartIfRunning() {
+  const record = await readProcessRecord();
+  if (record && pidAlive(record.pid)) { await stopAgent(); await startAgent(); }
+}
+// Owner opt-in encrypted content audit (#131 pilot). The recovery key goes from the agent straight
+// into the clipboard; it is never printed.
+function copyAuditKey(runtimeDir) {
+  const key = execAgent(runtimeDir, ["audit-key"], 15_000);
+  if (key.status !== 0) fail(key.stderr.trim() || "AUDIT_KEY_MISSING");
+  const clip = spawnSync(path.join(process.env.SystemRoot || "C:\\Windows", "System32", "clip.exe"), [], { input: key.stdout.trim(), windowsHide: true, timeout: 10_000 });
+  if (clip.error || clip.status !== 0) fail("CLIPBOARD_FAILED");
+}
+async function auditCommand(runtimeDir, sub) {
+  const action = sub[0] || "status";
+  const agent = (args, timeout = 30_000) => {
+    const result = execAgent(runtimeDir, args, timeout);
+    if (result.status !== 0) fail(result.stderr.trim() || "AUDIT_ACTION_FAILED");
+    return result.stdout;
+  };
+  if (action === "status" && sub.length <= 1) { process.stdout.write(agent(["audit-status"], 120_000)); return; }
+  if (action === "on" && sub.length === 1) {
+    const info = JSON.parse(agent(["audit-on"]).trim());
+    if (info.created) copyAuditKey(runtimeDir);
+    await restartIfRunning();
+    process.stdout.write([
+      "Encrypted content audit is ON for this computer (pilot).",
+      "Files: " + info.directory + " (kept " + info.retentionDays + " days, capture pauses at " + Math.round(info.maxBytes / 1048576) + " MB)",
+      info.created
+        ? "A new recovery key (" + info.keyId + ") was copied to the clipboard. Paste it into your password manager now, then clear the clipboard.\nWithout it nobody, including Local Commander, can read the audit files on another computer."
+        : "Using your existing recovery key (" + info.keyId + "). Run 'localcommander audit copy-key' to copy it again.",
+      ""
+    ].join("\n"));
+    return;
+  }
+  if (action === "off" && sub.length === 1) {
+    agent(["audit-off"]);
+    await restartIfRunning();
+    process.stdout.write("Encrypted content audit is OFF. Existing files stay until they expire.\n");
+    return;
+  }
+  if (action === "copy-key" && sub.length === 1) {
+    copyAuditKey(runtimeDir);
+    process.stdout.write("Recovery key copied to the clipboard.\n");
+    return;
+  }
+  if (action === "restore" && sub.length === 3) {
+    // Uses the owner's own key copy from LCMCP_AUDIT_RECOVERY_KEY; writes a new plaintext file.
+    process.stdout.write(agent(["audit-restore", path.resolve(sub[1]), path.resolve(sub[2])], 600_000));
+    return;
+  }
+  fail("ARGUMENT_INVALID");
+}
+// Owner opt-out for take_screenshot under Full Access (#486), on by default. Only this owner-run command changes it (the agent
+// state folder is protected from every file tool); the agent checks it on each capture, so no restart is needed.
+const SCREENSHOT_OFF_FILE = "screenshot-disabled-by-owner";
+async function screenshotCommand(args) {
+  const action = args[0] || "status";
+  if (args.length > 1 || !["status", "on", "off"].includes(action)) fail("ARGUMENT_INVALID");
+  if (!(await readCurrent())) fail("AGENT_NOT_INSTALLED");
+  const file = path.join(stateDirectory(), SCREENSHOT_OFF_FILE);
+  if (action === "off") await fs.writeFile(file, "", { flag: "wx" }).catch(error => { if (error?.code !== "EEXIST") throw error; });
+  if (action === "on") await fs.rm(file, { force: true });
+  const off = await fs.lstat(file).then(() => true, error => error?.code !== "ENOENT");
+  process.stdout.write(JSON.stringify({ screenshot: off ? "off" : "on" }) + "\n");
+}
+// Public AI-provider domains routed through the tunnel; everything else stays direct. Mirror of
+// packages/connectivity/src/profiles.ts (stable public suffixes).
+const PROXY_PROVIDERS = {
+  openai: ["chatgpt.com", "openai.com", "oaistatic.com", "oaiusercontent.com", "oaistatsig.com", "cdn.openaimerge.com"],
+  anthropic: ["claude.ai", "claude.com", "anthropic.com"],
+  cursor: ["cursor.sh", "cursor.com", "cursor-cdn.com", "marketplace.cursorapi.com"]
+};
+// Proxy-mode files live in their own folder, never in the private store dir (which rejects unknown files).
+function proxyDir() { return path.join(path.dirname(stateDirectory()), "Proxy"); }
+function proxyModeFile() { return path.join(proxyDir(), "proxy-mode.json"); }
+function proxyStateFile() { return path.join(proxyDir(), "proxy.json"); }
+function proxyPacFile() { return path.join(appDataRoot(), "ai-proxy.pac"); }
+async function readProxyState() {
+  try {
+    const raw = JSON.parse(await fs.readFile(proxyStateFile(), "utf8"));
+    if (!raw || typeof raw.port !== "number" || typeof raw.password !== "string" || typeof raw.username !== "string" || !Array.isArray(raw.providers)) return null;
+    if (typeof raw.expiresAt === "number" && raw.expiresAt < Date.now()) return { ...raw, stale: true };
+    return raw;
+  } catch { return null; }
+}
+function buildPac(providers, port) {
+  const hosts = [...new Set(providers.flatMap(p => PROXY_PROVIDERS[p] ?? []))];
+  const tests = hosts.map(h => `shExpMatch(host, "${h}") || shExpMatch(host, "*.${h}")`).join(" ||\n      ");
+  return `function FindProxyForURL(url, host) {\n  host = host.toLowerCase();\n  if (${tests}) {\n    return "PROXY 127.0.0.1:${port}";\n  }\n  return "DIRECT";\n}\n`;
+}
+function proxyUrl(state) { return state.password ? `http://${state.username}:${state.password}@127.0.0.1:${state.port}` : `http://127.0.0.1:${state.port}`; }
+function browserLauncherFile() { return path.join(appDataRoot(), "open-ai-browser.cmd"); }
+function browserProfileDir() { return path.join(appDataRoot(), "ai-browser"); }
+const BROWSER_SHORTCUT = "AI Browser (Local Commander)";
+async function findBrowser() {
+  const candidates = [
+    [process.env.ProgramFiles, "Google\\Chrome\\Application\\chrome.exe"],
+    [process.env["ProgramFiles(x86)"], "Google\\Chrome\\Application\\chrome.exe"],
+    [process.env.LOCALAPPDATA, "Google\\Chrome\\Application\\chrome.exe"],
+    [process.env["ProgramFiles(x86)"], "Microsoft\\Edge\\Application\\msedge.exe"],
+    [process.env.ProgramFiles, "Microsoft\\Edge\\Application\\msedge.exe"]
+  ];
+  for (const [base, rel] of candidates) {
+    if (!base) continue;
+    const exe = path.join(base, rel);
+    try { if ((await fs.lstat(exe)).isFile()) return exe; } catch { /* try next */ }
+  }
+  return null;
+}
+// A double-click launcher: opens Chrome/Edge through the proxy in a dedicated profile that remembers
+// the proxy sign-in, so after the first time it is seamless. The port is stable across restarts.
+function buildBrowserLauncher(port) {
+  const prof = browserProfileDir();
+  const flags = `--proxy-server=http://127.0.0.1:${port} --user-data-dir="${prof}"`;
+  const chrome = ["%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe", "%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe", "%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe"];
+  const edge = ["%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe", "%ProgramFiles%\\Microsoft\\Edge\\Application\\msedge.exe"];
+  const lines = ["@echo off", "rem Local Commander - open AI sites through the proxy."];
+  for (const exe of [...chrome, ...edge]) lines.push(`if exist "${exe}" start "" "${exe}" ${flags} & goto :eof`);
+  lines.push('echo Could not find Chrome or Edge. Set your browser proxy to 127.0.0.1:' + port + ' (user lc-core).', "pause");
+  return lines.join("\r\n") + "\r\n";
+}
+function printProxyGuidance(state, shortcut) {
+  const url = proxyUrl(state), pac = proxyPacFile(), launcher = browserLauncherFile();
+  process.stdout.write("AI connection proxy is active (providers: " + state.providers.join(", ") + ").\n");
+  process.stdout.write("Loopback HTTP proxy: 127.0.0.1:" + state.port + " (no sign-in). Stable across restarts - set up once.\n\n");
+  if (shortcut) process.stdout.write("Browser: open \"" + BROWSER_SHORTCUT + "\" from the Start menu or your Desktop. It opens ChatGPT/Claude already routed - no password.\n\n");
+  else {
+    process.stdout.write("Browser: double-click this launcher (opens Chrome/Edge already routed - no password):\n");
+    process.stdout.write("  " + launcher + "\n\n");
+  }
+  process.stdout.write("CLIs (Claude Code, Codex, Antigravity, any tool that reads a proxy env var) - in the shell that runs the tool:\n");
+  process.stdout.write("  CMD:         set HTTPS_PROXY=" + url + "\n");
+  process.stdout.write("  PowerShell:  $env:HTTPS_PROXY=\"" + url + "\"\n");
+  process.stdout.write("  (also set HTTP_PROXY and ALL_PROXY to the same value for tools that read those)\n");
+  process.stdout.write("  Non-AI hosts are reached directly, so the one variable is safe for the whole session.\n\n");
+  process.stdout.write("Alternative browser setup (PAC): Settings > Network & Internet > Proxy > Use setup script =\n");
+  process.stdout.write("  file:///" + pac.replace(/\\/g, "/") + "\n");
+}
+async function proxyModeEnabled() {
+  try { return JSON.parse(await fs.readFile(proxyModeFile(), "utf8"))?.enabled === true; } catch { return false; }
+}
+// The running agent rewrites proxy.json every 15 s while it holds a lease and removes it on any
+// failure, so a missing or expired file never means "refreshing": say which condition it is.
+async function explainNoProxyLease(state) {
+  const current = await readCurrent().catch(() => null);
+  const versions = current && current.version !== VERSION
+    ? "Installed agent: " + current.version + "; this command: " + VERSION + ". If the installed agent predates proxy mode, install this version: npx local-commander-agent@" + VERSION + " update\n" : "";
+  const record = await readProcessRecord();
+  if (!record || !pidAlive(record.pid)) return "The Local Commander agent is not running, so no AI connection lease can be obtained. Start it with: localcommander start\nIf it stops again, see why with: localcommander logs\n" + versions;
+  if (state?.stale) {
+    const age = typeof state.updatedAt === "number" ? " (last refreshed " + Math.max(0, Math.round((Date.now() - state.updatedAt) / 1000)) + " s ago)" : "";
+    return "The agent is running but has stopped refreshing the AI connection lease" + age + ". Check: localcommander logs\n" + versions;
+  }
+  return "The agent is running but has no AI connection lease. The server has not granted one to this computer yet. If this lasts more than a minute, check: localcommander logs\n" + versions;
+}
+async function networkProxy(sub) {
+  if (sub.length > 2) fail("ARGUMENT_INVALID");
+  const action = sub[0] || "status";
+  if (!["on", "off", "status"].includes(action)) fail("ARGUMENT_INVALID");
+  if (action === "status") {
+    const state = await readProxyState();
+    if (state && !state.stale) printProxyGuidance(state, (await findBrowser()) ? BROWSER_SHORTCUT : null);
+    else if (!state && !(await proxyModeEnabled())) process.stdout.write("AI connection proxy is not active. Enable it with: localcommander network proxy on\n");
+    else process.stdout.write("AI connection proxy is enabled but has no active lease.\n" + await explainNoProxyLease(state));
+    return;
+  }
+  if (action === "off") {
+    await writeJsonAtomic(proxyModeFile(), { enabled: false });
+    await restartIfRunning();
+    await fs.rm(proxyStateFile(), { force: true }).catch(() => {});
+    await fs.rm(proxyPacFile(), { force: true }).catch(() => {});
+    await fs.rm(browserLauncherFile(), { force: true }).catch(() => {});
+    try { removeBrowserShortcut(BROWSER_SHORTCUT); } catch { /* shortcut optional */ }
+    process.stdout.write("AI connection proxy disabled.\n");
+    return;
+  }
+  const requested = sub[1] ? sub[1].split(",").map(p => p.trim().toLowerCase()) : Object.keys(PROXY_PROVIDERS);
+  const providers = requested.filter(p => Object.hasOwn(PROXY_PROVIDERS, p));
+  if (!providers.length) fail("ARGUMENT_INVALID");
+  await writeJsonAtomic(proxyModeFile(), { enabled: true, providers });
+  const record = await readProcessRecord();
+  if (record && pidAlive(record.pid)) await stopAgent();
+  // A forced stop skips the agent's cleanup; never mistake the old agent's state file for a new lease.
+  await fs.rm(proxyStateFile(), { force: true }).catch(() => {});
+  await startAgent();
+  // The agent reconnects and fetches a lease before it can publish the proxy coordinates.
+  let state = null;
+  for (let i = 0; i < 30 && !(state && !state.stale); i++) {
+    await new Promise(r => setTimeout(r, 1000));
+    state = await readProxyState();
+    const running = await readProcessRecord();
+    if (!(state && !state.stale) && (!running || !pidAlive(running.pid))) break;
+  }
+  if (state && !state.stale) {
+    await fs.writeFile(proxyPacFile(), buildPac(state.providers, state.port), { mode: 0o600 });
+    await fs.writeFile(browserLauncherFile(), buildBrowserLauncher(state.port), { mode: 0o600 });
+    let shortcut = null;
+    try {
+      const exe = await findBrowser();
+      if (exe) shortcut = installBrowserShortcut(BROWSER_SHORTCUT, exe, `--proxy-server=http://127.0.0.1:${state.port} --user-data-dir="${browserProfileDir()}"`);
+    } catch { /* shortcut is a convenience; the launcher .cmd still works */ }
+    printProxyGuidance(state, shortcut);
+  } else process.stdout.write("AI connection proxy enabled, but no lease was obtained.\n" + await explainNoProxyLease(state));
+}
+async function approveWorkspace(runtimeDir) {
+  const result = execAgent(runtimeDir, ["approve-workspace"], 180_000);
+  if (result.status !== 0) fail(result.stderr.trim() || "WORKSPACE_APPROVAL_FAILED");
+  const answer = result.stdout.trim();
+  if (answer === "WORKSPACE_CANCELLED") return false;
+  if (answer !== "WORKSPACE_APPROVED") fail("WORKSPACE_APPROVAL_INVALID");
+  process.stdout.write("Workspace approved.\n");
+  return true;
+}
+// Owner-only local permission surface. These run the installed runtime's own
+// commands on this PC; the cloud, the AI client and MCP calls cannot reach them.
+const PERMISSION_COMMANDS = { "revoke-workspace": 1, "allow-write": 1, "deny-write": 1, "allow-command": 3, "deny-command": 2, "allow-localhost": 2, "deny-localhost": 2 };
+async function listWorkspaces(runtimeDir) {
+  const result = execAgent(runtimeDir, ["list-workspaces"], 15_000);
+  if (result.status !== 0) fail(result.stderr.trim() || "WORKSPACE_LIST_FAILED");
+  try { process.stdout.write(JSON.stringify(JSON.parse(result.stdout.trim() || "[]"), null, 2) + "\n"); }
+  catch { fail("WORKSPACE_LIST_INVALID"); }
+}
+async function changePermission(runtimeDir, command, args) {
+  if (args.length !== PERMISSION_COMMANDS[command]) fail("ARGUMENT_INVALID");
+  // Covers the 60 s native owner review plus DPAPI/state work (see planning/OWNER_PERMISSIONS.md).
+  const result = execAgent(runtimeDir, [command, ...args], 90_000);
+  if (result.status !== 0) fail(result.stderr.trim() || "PERMISSION_UPDATE_FAILED");
+  const record = await readProcessRecord();
+  if (record && pidAlive(record.pid)) {
+    await stopAgent();
+    await startAgent();
+    process.stdout.write("Permission updated; Local Commander restarted.\n");
+  } else process.stdout.write("Permission updated.\n");
+}
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error && error.code === "EPERM"; }
+}
+async function readProcessRecord() {
+  try {
+    const parsed = JSON.parse(await fs.readFile(processFile(), "utf8"));
+    if (!parsed || typeof parsed !== "object" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || typeof parsed.runtimeDir !== "string") return null;
+    const runtimeDir = path.resolve(parsed.runtimeDir);
+    if (!under(versionsDirectory(), runtimeDir)) return null;
+    return { pid: parsed.pid, runtimeDir, version: typeof parsed.version === "string" ? parsed.version : null, startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : null };
+  } catch { return null; }
+}
+async function statusObject() {
+  const current = await readCurrent();
+  const record = await readProcessRecord();
+  const running = !!record && pidAlive(record.pid);
+  if (record && !running) await fs.rm(processFile(), { force: true }).catch(() => {});
+  const identity = current ? await identityStatus(current.runtimeDir).catch(() => ({ paired: false, accountEmail: null, deviceId: null })) : { paired: false, accountEmail: null, deviceId: null };
+  return {
+    installed: !!current,
+    version: current?.version ?? null,
+    running,
+    pid: running ? record.pid : null,
+    paired: identity.paired,
+    accountEmail: identity.accountEmail,
+    deviceId: identity.deviceId,
+    stateDirectory: stateDirectory()
+  };
+}
+async function verifyOwnedProcess(record) {
+  if (!pidAlive(record.pid)) return false;
+  const script = '$p=Get-CimInstance Win32_Process -Filter "ProcessId = ' + record.pid + '"; if($null -eq $p){exit 3}; [Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Write-Output $p.ExecutablePath; Write-Output $p.CommandLine';
+  const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, encoding: "utf8", timeout: 10_000 });
+  if (result.status === 3) return false;
+  if (result.status !== 0) fail("PROCESS_IDENTITY_CHECK_FAILED");
+  const lines = String(result.stdout || "").split(/\r?\n/u).filter(Boolean);
+  const executable = path.resolve(lines.shift() || "");
+  const expectedNode = path.resolve(record.runtimeDir, "node.exe");
+  const commandLine = lines.join("\n").toLowerCase();
+  return executable.toLowerCase() === expectedNode.toLowerCase() && commandLine.includes(path.join(record.runtimeDir, "agent.mjs").toLowerCase());
+}
+async function stopAgent() {
+  const record = await readProcessRecord();
+  if (!record || !pidAlive(record.pid)) {
+    await fs.rm(processFile(), { force: true }).catch(() => {});
+    return false;
+  }
+  if (!(await verifyOwnedProcess(record))) fail("PROCESS_IDENTITY_MISMATCH");
+  const result = spawnSync("taskkill.exe", ["/PID", String(record.pid), "/T", "/F"], { windowsHide: true, encoding: "utf8", timeout: 15_000 });
+  if (result.status !== 0 && pidAlive(record.pid)) fail("AGENT_STOP_FAILED");
+  for (let i = 0; i < 20 && pidAlive(record.pid); i += 1) await new Promise(resolve => setTimeout(resolve, 100));
+  if (pidAlive(record.pid)) fail("AGENT_STOP_TIMEOUT");
+  await fs.rm(processFile(), { force: true }).catch(() => {});
+  return true;
+}
+async function startAgent() {
+  const current = await readCurrent();
+  if (!current) fail("AGENT_NOT_INSTALLED");
+  const identity = await identityStatus(current.runtimeDir);
+  if (!identity.paired) fail("ENROLLMENT_MISSING");
+  const status = await statusObject();
+  if (status.running) return false;
+  const child = spawn(agentExe(current.runtimeDir), ["run"], { detached: true, windowsHide: true, stdio: "ignore", env: agentEnv() });
+  child.unref();
+  for (let i = 0; i < 40; i += 1) {
+    await new Promise(resolve => setTimeout(resolve, 100));
+    const record = await readProcessRecord();
+    if (record && pidAlive(record.pid)) return true;
+  }
+  fail("AGENT_START_TIMEOUT");
+}
+async function bootstrap({ chooseWorkspace = true } = {}) {
+  const previous = await readCurrent();
+  const target = path.join(versionsDirectory(), VERSION);
+  const running = await readProcessRecord();
+  if (running && pidAlive(running.pid) && path.resolve(running.runtimeDir).toLowerCase() !== path.resolve(target).toLowerCase()) await stopAgent();
+  const runtimeDir = await copyRuntime();
+  const identity = await identityStatus(runtimeDir);
+  if (!identity.paired) await pair(runtimeDir);
+  if (chooseWorkspace) {
+    const list = execAgent(runtimeDir, ["list-workspaces"], 15_000);
+    if (list.status !== 0) fail("WORKSPACE_LIST_FAILED");
+    let existing;
+    try { existing = JSON.parse(list.stdout); } catch { fail("WORKSPACE_LIST_INVALID"); }
+    if (!Array.isArray(existing)) fail("WORKSPACE_LIST_INVALID");
+    if (existing.length === 0 && !(await configureAccess(runtimeDir))) fail("ACCESS_SETUP_CANCELLED");
+  }
+  // Antivirus can remove or lock the network files; the verified bundle is then skipped, but the agent still updates and starts.
+  let networkCopied = false, networkManifest = null, networkError = null;
+  if (AI_CONNECTION_SHIPPED) try {
+    networkCopied = await copyNetworkBundle(path.join(runtimeSource(), "network"), path.join(runtimeDir, "network"));
+    if (networkCopied) networkManifest = (await inspectNetworkBundle(path.join(runtimeDir, "network")))?.manifest;
+  } catch (error) {
+    networkCopied = false;
+    networkError = error && /^[A-Z0-9_]{1,80}$/u.test(error.message) ? error.message : error && /^E[A-Z]{2,20}$/u.test(error.code) ? error.code : "NETWORK_BUNDLE_UNREADABLE";
+  }
+  if (networkError) process.stdout.write("The AI connection files could not be installed (" + networkError + "). Antivirus may have removed or blocked them. Local Commander starts without the AI connection.\n");
+  else if (networkCopied && implicitSetupAllowed(networkManifest)) {
+    const network = execAgent(runtimeDir, ["network-setup"], 330_000);
+    if (network.status !== 0) process.stdout.write("AI network setup was not completed. Local Commander will start without changing your network. Use localcommander network setup to retry.\n");
+  } else if (networkCopied) process.stdout.write("This build includes the AI connection pilot. It changes nothing until you run: localcommander network setup\n");
+  registerAutostart(runtimeDir);
+  await startAgent();
+  const commandBin = await installCommandFiles(PACKAGE_ROOT, appDataRoot(), VERSION);
+  updateUserPath(commandBin);
+  // The Start menu entry is a convenience: a conflicting user shortcut or shell failure must not undo a working installation.
+  let shortcut = null, shortcutError = null;
+  try { shortcut = installStartMenuShortcut(commandBin); } catch (error) { shortcutError = error && typeof error.message === "string" ? error.message : "SHORTCUT_UPDATE_FAILED"; }
+  if (previous && previous.version !== VERSION) process.stdout.write("Updated Local Commander from " + previous.version + " to " + VERSION + ".\n");
+  process.stdout.write("Local Commander " + VERSION + " is installed and running.\n");
+  process.stdout.write("The localcommander command is on your user PATH. Open a new CMD or terminal window to use it.\n");
+  process.stdout.write("Watch connections and tasks with: localcommander monitor --watch\n");
+  if (shortcut) process.stdout.write('Start menu: "' + shortcut + '" opens the same live view without a terminal.\n');
+  else process.stdout.write("The Start menu shortcut was not created (" + shortcutError + "); the localcommander command still works.\n");
+}
+async function uninstall(purgeState) {
+  await stopAgent();
+  const current = await readCurrent();
+  if (current) {
+    const network = execAgent(current.runtimeDir, ["network-uninstall"], 330_000);
+    if (network.status !== 0) process.stdout.write("The network service could not be removed automatically. The agent is stopped, so its VPN authorization cannot renew. Remove LocalCommanderNetwork through the approved administrator workflow.\n");
+  }
+  removeAutostart();
+  try { removeStartMenuShortcut(); } catch (error) { process.stdout.write("The Start menu shortcut was not removed (" + (error?.message || "SHORTCUT_UPDATE_FAILED") + ").\n"); }
+  updateUserPath(path.join(appDataRoot(), "bin"), true);
+  await removeCommandFile(appDataRoot());
+  const versions = versionsDirectory();
+  if (under(appDataRoot(), versions)) await fs.rm(versions, { recursive: true, force: true });
+  await fs.rm(currentPath(), { force: true });
+  if (purgeState) {
+    const state = stateDirectory();
+    const expected = path.join(appDataRoot(), "Agent");
+    if (path.resolve(state).toLowerCase() !== path.resolve(expected).toLowerCase()) fail("CUSTOM_STATE_PURGE_REFUSED");
+    await fs.rm(state, { recursive: true, force: true });
+  }
+  process.stdout.write(purgeState ? "Local Commander removed, including local enrollment state.\n" : "Local Commander removed. Protected enrollment state was preserved.\n");
+}
+function allowCommandHelp() {
+  return [
+    "Usage: npx local-commander-agent@latest allow-command <workspaceGrantId> <name> <absolute-executable-path>",
+    "Exactly three arguments are required. Quote executable paths containing spaces.",
+    "Find the workspace ID with: npx local-commander-agent@latest workspaces",
+    "",
+    "CMD: find Git with where git.exe, then copy the intended full path:",
+    '  npx local-commander-agent@latest allow-command WORKSPACE_ID git "C:\\Path To Git\\git.exe"',
+    "Replace WORKSPACE_ID and the example path with your actual values.",
+    "",
+    "PowerShell only:",
+    "  $gitExe = @(Get-Command git.exe -CommandType Application -ErrorAction Stop)[0].Source",
+    '  npx.cmd local-commander-agent@latest allow-command WORKSPACE_ID git "$gitExe"',
+    "CMD does not evaluate (Get-Command ...).Source. Local Commander never evaluates shell expressions.",
+    "A valid command still requires local owner approval.",
+    ""
+  ].join("\n");
+}
+// #104 slice 2: direct local MCP for AI clients on this computer, with no cloud round trip per call.
+// The owner's opt-in lives outside the agent state directory; the agent re-reads it on every call.
+function localMcpDirectory() { return path.join(appDataRoot(), "LocalMcp"); }
+const LOCAL_MCP_CLIENTS = [
+  "  Claude Code:   claude mcp add local-commander -- cmd /c localcommander mcp",
+  "  Codex:         ~/.codex/config.toml -> [mcp_servers.local-commander] command = \"cmd\", args = [\"/c\", \"localcommander\", \"mcp\"]",
+  "  Other clients: { \"command\": \"cmd\", \"args\": [\"/c\", \"localcommander\", \"mcp\"] }"
+];
+async function localMcpCommand(sub) {
+  if (sub.length > 1) fail("ARGUMENT_INVALID");
+  const action = sub[0], settings = path.join(localMcpDirectory(), "settings.json");
+  const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
+  if (action === undefined) {
+    // Stdio passes straight through: the AI client speaks MCP to the agent runtime, never to this launcher.
+    const child = spawn(path.join(current.runtimeDir, "node.exe"), [path.join(current.runtimeDir, "agent.mjs"), "mcp"], { stdio: "inherit", windowsHide: true, env: agentEnv() });
+    await new Promise(resolve => {
+      child.once("exit", code => { process.exitCode = code ?? 1; resolve(); });
+      child.once("error", () => { process.exitCode = 1; resolve(); });
+    });
+    return;
+  }
+  if (action === "on" || action === "off") {
+    await writeJsonAtomic(settings, { enabled: action === "on", updatedAt: new Date().toISOString() });
+    await restartIfRunning();
+    process.stdout.write(action === "on" ? [
+      "Direct local MCP is ON. AI clients on this computer can use your approved workspaces without the cloud.",
+      "Add Local Commander to a client's MCP settings:", ...LOCAL_MCP_CLIENTS,
+      "Turn it off at any time with: localcommander mcp off", ""].join("\n")
+      : "Direct local MCP is OFF. AI clients on this computer can no longer use Local Commander directly.\n");
+    return;
+  }
+  if (action === "status") {
+    let enabled = false, endpoint = null;
+    try { enabled = JSON.parse(await fs.readFile(settings, "utf8"))?.enabled === true; } catch {}
+    try { endpoint = JSON.parse(await fs.readFile(path.join(localMcpDirectory(), "endpoint.json"), "utf8")); } catch {}
+    const serving = enabled && Number.isSafeInteger(endpoint?.pid) && pidAlive(endpoint.pid);
+    process.stdout.write([
+      "Direct local MCP: " + (enabled ? "ON" : "OFF") + (enabled ? (serving ? " (agent is serving on 127.0.0.1)" : " (agent not serving: run localcommander restart)") : ""),
+      ...(enabled ? ["MCP settings for AI clients on this computer:", ...LOCAL_MCP_CLIENTS] : ["Turn it on with: localcommander mcp on"]), ""].join("\n"));
+    return;
+  }
+  fail("ARGUMENT_INVALID");
+}
+function help() {
+  return [
+    "Local Commander agent " + VERSION,
+    "",
+    "Usage:",
+    "  npx local-commander-agent@latest              install/pair/start",
+    "  npx local-commander-agent@latest status       show local state",
+    "  localcommander monitor --watch              live connections and tasks (also: Start menu > Local Commander Monitor)",
+    "  localcommander monitor --json               monitoring snapshot as JSON",
+    "  localcommander logs --follow                recent production relay events",
+    "  npx local-commander-agent@latest start        start background agent",
+    "  npx local-commander-agent@latest stop         stop background agent",
+    "  npx local-commander-agent@latest restart      restart background agent",
+    "  npx local-commander-agent@latest update       install this package version and restart",
+    "  npx local-commander-agent@latest configure-access  choose all connected drives or selected folders",
+    "  npx local-commander-agent@latest approve-workspace add another read/write folder",
+    "  npx local-commander-agent@latest revoke-workspace <workspaceGrantId>",
+    "  npx local-commander-agent@latest workspaces    list approved workspaces and permissions",
+    ...(AI_CONNECTION_SHIPPED ? [
+      "  localcommander network [status|auto|on|off|setup|panel]  owner-local AI connection controls",
+      "  localcommander network proxy [on|off|status] [providers]  driver-free AI proxy for browser + CLI (no TUN)"
+    ] : []),
+    "  localcommander mcp on|off|status            direct local MCP for AI clients on this computer (no cloud per call)",
+    "  localcommander mcp                          stdio MCP server; start it from an AI client's MCP settings",
+    "  localcommander audit [status|on|off|copy-key]  owner-local encrypted content audit (pilot)",
+    "  localcommander audit restore <file> <output>  decrypt with your key in LCMCP_AUDIT_RECOVERY_KEY",
+    "  localcommander fabric-owner                 owner mailbox request through private stdin",
+    "  localcommander fabric-worker                restricted worker request through private stdin",
+    "  npx local-commander-agent@latest allow-write <workspaceGrantId>",
+    "  npx local-commander-agent@latest allow-command <workspaceGrantId> <name> <absolute-executable-path>",
+    "  npx local-commander-agent@latest allow-command --help  CMD and PowerShell examples",
+    "  npx local-commander-agent@latest allow-localhost <workspaceGrantId> <port>",
+    "  npx local-commander-agent@latest deny-write|deny-command|deny-localhost ...",
+    "  npx local-commander-agent@latest uninstall [--purge-state]",
+    ""
+  ].join("\n");
+}
+async function main() {
+  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u.test(VERSION)) fail("PACKAGE_VERSION_INVALID");
+  // macOS and Linux run the per-platform runtime package through its own lifecycle (#253).
+  if (process.platform !== "win32") return (await import("./posix.mjs")).runPosix(process.argv.slice(2), VERSION);
+  requireWindows();
+  const command = process.argv[2] || "bootstrap";
+  const args = process.argv.slice(3);
+  if (command === "-h" || command === "--help" || command === "help") {
+    process.stdout.write(help());
+    return;
+  }
+  if (command === "allow-command") {
+    if (args.length === 1 && ["--help", "-h"].includes(args[0])) {
+      process.stdout.write(allowCommandHelp());
+      return;
+    }
+    // Reject shell fragments before reading installed state or opening owner consent.
+    if (args.length !== PERMISSION_COMMANDS[command] || !path.win32.isAbsolute(args[2])) fail("ARGUMENT_INVALID");
+  }
+  if (command === "bootstrap" || command === "install") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    await bootstrap();
+    return;
+  }
+  if (command === "update") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    await bootstrap({ chooseWorkspace: false });
+    return;
+  }
+  if (command === "start") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    await startAgent();
+    process.stdout.write("Local Commander is running.\n");
+    return;
+  }
+  if (command === "stop") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    const stopped = await stopAgent();
+    process.stdout.write(stopped ? "Local Commander stopped.\n" : "Local Commander was not running.\n");
+    return;
+  }
+  if (command === "restart") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    await stopAgent();
+    await startAgent();
+    process.stdout.write("Local Commander restarted.\n");
+    return;
+  }
+  if (command === "status") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    process.stdout.write(JSON.stringify(await statusObject(), null, 2) + "\n");
+    return;
+  }
+  if (command === "monitor" || command === "logs") {
+    await runMonitor(path.join(appDataRoot(), "Monitor"), command, args);
+    return;
+  }
+  if (command === "network") {
+    // While the AI connection is not shipped, only checking it and switching it off stay available (for PCs that enabled the pilot).
+    if (!AI_CONNECTION_SHIPPED && !(args.length === 0 || (args.length === 1 && ["status", "off"].includes(args[0])) || (args.length === 2 && args[0] === "proxy" && args[1] === "off"))) fail("AI_CONNECTION_UNAVAILABLE");
+    const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
+    if (args[0] === "proxy") { await networkProxy(args.slice(1)); return; }
+    if (args.length > 1 || !["status", "auto", "on", "off", "setup", "panel"].includes(args[0] || "status")) fail("ARGUMENT_INVALID");
+    const action = args[0] || "status";
+    const childArgs = ["auto", "on", "off"].includes(action) ? ["network-mode", action] : ["network-" + action];
+    const result = execAgent(current.runtimeDir, childArgs, action === "setup" ? 330_000 : 15_000);
+    if (result.status !== 0) fail(result.stderr.trim() || "NETWORK_ACTION_FAILED");
+    process.stdout.write(result.stdout);
+    if (action === "setup") await restartIfRunning();
+    return;
+  }
+  if (command === "screenshot") {
+    await screenshotCommand(args);
+    return;
+  }
+  if (command === "audit") {
+    const current = await readCurrent(); if (!current) fail("AGENT_NOT_INSTALLED");
+    await auditCommand(current.runtimeDir, args);
+    return;
+  }
+  if (command === "mcp") {
+    await localMcpCommand(args);
+    return;
+  }
+  if (command === "fabric-owner" || command === "fabric-worker") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    const current = await readCurrent();
+    if (!current) fail("AGENT_NOT_INSTALLED");
+    await fabricCommand(current.runtimeDir, command);
+    return;
+  }
+  if (command === "configure-access") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    const current = await readCurrent();
+    if (!current) fail("AGENT_NOT_INSTALLED");
+    if (await configureAccess(current.runtimeDir)) {
+      await restartIfRunning();
+      process.stdout.write("Filesystem access configured.\n");
+    } else process.stdout.write("Access selection cancelled; existing permissions were preserved.\n");
+    return;
+  }
+  if (command === "approve-workspace") {
+    if (args.length) fail("ARGUMENT_INVALID");
+    const current = await readCurrent();
+    if (!current) fail("AGENT_NOT_INSTALLED");
+    if (await approveWorkspace(current.runtimeDir)) await restartIfRunning();
+    else process.stdout.write("Workspace selection cancelled.\n");
+    return;
+  }
+  if (command === "workspaces" || Object.hasOwn(PERMISSION_COMMANDS, command)) {
+    if (command === "workspaces" && args.length) fail("ARGUMENT_INVALID");
+    const current = await readCurrent();
+    if (!current) fail("AGENT_NOT_INSTALLED");
+    if (command === "workspaces") await listWorkspaces(current.runtimeDir);
+    else await changePermission(current.runtimeDir, command, args);
+    return;
+  }
+  if (command === "uninstall") {
+    if (args.length > 1 || (args.length === 1 && args[0] !== "--purge-state")) fail("ARGUMENT_INVALID");
+    await uninstall(args[0] === "--purge-state");
+    return;
+  }
+  fail("ARGUMENT_INVALID");
+}
+
+void main().catch(error => {
+  const code = error && typeof error.message === "string" && /^[A-Z0-9_]{1,80}$/u.test(error.message) ? error.message : "LOCAL_COMMANDER_FAILED";
+  // Unlabelled failures show only the system error class and operation (e.g. EPERM copyfile), never paths or messages.
+  const detail = code === "LOCAL_COMMANDER_FAILED" && error && typeof error.code === "string" && /^[A-Z][A-Z0-9_]{1,40}$/u.test(error.code)
+    ? " (" + error.code + (typeof error.syscall === "string" && /^[a-z_]{1,20}$/u.test(error.syscall) ? " " + error.syscall : "") + ")" : "";
+  process.stderr.write(code + detail + "\n");
+  if (code === "ARGUMENT_INVALID" && process.argv[2] === "allow-command") process.stderr.write(allowCommandHelp());
+  if (code === "AI_CONNECTION_UNAVAILABLE") process.stderr.write("The AI connection is not available in this version of Local Commander.\n");
+  process.exitCode = 1;
+});