npm - local-commander-agent - Versions diffs - 0.3.49 → 0.3.51 - Mend

local-commander-agent 0.3.49 → 0.3.51

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/CHANGELOG.md +12 -1
package/README.md +216 -216
package/bin/localcommander.mjs +3 -1
package/bin/monitor-context.d.mts +7 -7
package/bin/monitor-savings.d.mts +20 -20
package/package.json +4 -4
package/runtime/JobHost.exe +0 -0
package/runtime/LocalCommanderAgent.exe +0 -0
package/runtime/OwnerBridge.exe +0 -0
package/runtime/agent.mjs +380 -249

package/runtime/agent.mjs CHANGED Viewed

@@ -4541,10 +4541,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path30) {
-  if (!path30)
+function getElementAtPath(obj, path31) {
+  if (!path31)
     return obj;
-  return path30.reduce((acc, key) => acc?.[key], obj);
+  return path31.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4884,11 +4884,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path30, issues) {
+function prefixIssues(path31, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path30);
+    iss.path.unshift(path31);
     return iss;
   });
 }
@@ -5158,8 +5158,8 @@ var _E = "captureStackTrace" in Error ? Error : null;
 function newError(Definition) {
   const E = _E;
   if (E) {
-    const saved = E.stackTraceLimit;
-    if (typeof saved === "number") {
+    const saved2 = E.stackTraceLimit;
+    if (typeof saved2 === "number") {
       try {
         E.stackTraceLimit = 0;
       } catch {
@@ -5169,7 +5169,7 @@ function newError(Definition) {
       try {
         return new Definition();
       } finally {
-        E.stackTraceLimit = saved;
+        E.stackTraceLimit = saved2;
       }
     }
   }
@@ -5338,16 +5338,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path30 = []) => {
+  const processError = (error63, path31 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path31, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
       } else {
-        const fullpath = [...path30, ...issue2.path];
+        const fullpath = [...path31, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5386,17 +5386,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path30 = []) => {
+  const processError = (error63, path31 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path30, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path31, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path30, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
       } else {
-        const fullpath = [...path30, ...issue2.path];
+        const fullpath = [...path31, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5435,8 +5435,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path30 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path30) {
+  const path31 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path31) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -22538,13 +22538,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path30 = ref.slice(1).split("/").filter(Boolean);
-  if (path30.length === 0) {
+  const path31 = ref.slice(1).split("/").filter(Boolean);
+  if (path31.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path30[0] === defsKey) {
-    const key = path30[1] === void 0 ? void 0 : decodeJSONPointerSegment(path30[1]);
+  if (path31[0] === defsKey) {
+    const key = path31[1] === void 0 ? void 0 : decodeJSONPointerSegment(path31[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -24917,14 +24917,14 @@ async function loadProxyModeFlag(dir) {
   }
 }
 async function writeProxyState(dir, state) {
-  const file2 = path.join(dir, "proxy.json");
+  const file3 = path.join(dir, "proxy.json");
   try {
     if (!state) {
-      await rm(file2, { force: true });
+      await rm(file3, { force: true });
       return;
     }
     await mkdir(dir, { recursive: true });
-    await writeFile(file2, JSON.stringify({ ...state, updatedAt: Date.now() }), { mode: 384 });
+    await writeFile(file3, JSON.stringify({ ...state, updatedAt: Date.now() }), { mode: 384 });
   } catch {
   }
 }
@@ -25049,9 +25049,9 @@ async function networkDirectory(stateDirectory) {
 }
 async function networkPrepared(stateDirectory, identity) {
   try {
-    const file2 = networkPath(stateDirectory, "network-prepared.json"), stat2 = await fs.lstat(file2);
+    const file3 = networkPath(stateDirectory, "network-prepared.json"), stat2 = await fs.lstat(file3);
     if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 1024) return false;
-    const receipt = Receipt.parse(JSON.parse(await fs.readFile(file2, "utf8"))), e = identity.enrollment;
+    const receipt = Receipt.parse(JSON.parse(await fs.readFile(file3, "utf8"))), e = identity.enrollment;
     return !!e && receipt.deviceId === e.deviceId && receipt.tenantId === e.tenantId && receipt.accountId === e.accountId;
   } catch {
     return false;
@@ -25131,10 +25131,10 @@ async function setupNetwork(binaryDirectory, stateDirectory, identity) {
     await elevated(bundle.helper, "setup", requestPath, directory);
     await localNetworkControl(e.deviceId);
     const receipt = Receipt.parse({ version: 1, deviceId: e.deviceId, tenantId: e.tenantId, accountId: e.accountId, bundleId: bundle.bundleId });
-    const file2 = path2.join(directory, "network-prepared.json"), temp = file2 + "." + randomUUID2();
+    const file3 = path2.join(directory, "network-prepared.json"), temp = file3 + "." + randomUUID2();
     await fs.writeFile(temp, JSON.stringify(receipt), { flag: "wx", mode: 384 });
     try {
-      await fs.rename(temp, file2);
+      await fs.rename(temp, file3);
     } finally {
       await fs.rm(temp, { force: true });
     }
@@ -25164,7 +25164,7 @@ async function openNetworkPanel(binaryDirectory, identity) {
 }
 // agent/src/main.ts
-import path29 from "node:path";
+import path30 from "node:path";
 import os8 from "node:os";
 // agent/src/posix-store.ts
@@ -25584,7 +25584,7 @@ async function acquirePosixJournalGuard(directory, helper) {
 }
 // agent/src/main.ts
-import { mkdir as mkdir14, open as open13, readFile as readFile12, realpath as realpath10, rm as rm10 } from "node:fs/promises";
+import { mkdir as mkdir15, open as open13, readFile as readFile13, realpath as realpath10, rm as rm11 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 // packages/operations/src/crypto.ts
@@ -25721,8 +25721,8 @@ var exec2 = promisify2(execFile2);
 async function darwinSupervisorLiveness(helper, pids, records = []) {
   if (process.platform !== "darwin" || !process.getuid?.() || process.getuid() !== process.geteuid?.()) return null;
   const remaining = new Set(pids), uid = process.getuid(), deadline = Date.now() + 1e4, env = buildChildEnvironment(process.env);
-  const run2 = (file2, args) => exec2(
-    file2,
+  const run2 = (file3, args) => exec2(
+    file3,
     args,
     { env, timeout: Math.max(1, Math.min(7e3, deadline - Date.now())), maxBuffer: 8192, encoding: "utf8", windowsHide: true }
   );
@@ -26490,6 +26490,7 @@ var NATIVE_STATUS_CAPABILITY = "nativeStatusV1";
 var NativeStatusSchema = NativeCapacitySchema.extend({ type: external_exports.literal("nativeStatus"), active: external_exports.number().int().min(0).max(32), queued: external_exports.number().int().min(0).max(256), paused: external_exports.boolean() }).strict().refine((v) => v.active <= v.safeSlots);
 var TerminalEventSchema = external_exports.object({ type: external_exports.literal("executionResult"), protocolVersion: external_exports.literal(1), requestId: uuid11, tenantId: uuid11, deviceId: uuid11, connectionEpoch: epoch2, binding: ExecutionBindingSchema, state: external_exports.enum(["finished", "failed", "cancelled", "unknown", "rejected"]), resultCode: external_exports.string().regex(/^[A-Z0-9_]{1,40}$/), metrics: TerminalMetricsSchema.optional() }).strict();
 var HeldLeasesFrameSchema = external_exports.object({ type: external_exports.literal("heldLeases"), protocolVersion: external_exports.literal(1), connectionEpoch: epoch2, bindings: external_exports.array(ExecutionBindingSchema).min(1).max(64) }).strict();
+var FullLogStateSchema = external_exports.object({ type: external_exports.literal("fullLogState"), protocolVersion: external_exports.literal(1), connectionEpoch: epoch2, enabled: external_exports.boolean().nullable() }).strict();
 var TerminalEventAckSchema = external_exports.object({ type: external_exports.literal("executionResultAck"), protocolVersion: external_exports.literal(1), requestId: uuid11, ok: external_exports.boolean() }).strict();
 function canonicalJson(value) {
   function canonical2(v) {
@@ -26785,23 +26786,23 @@ var NativeJournal = class _NativeJournal {
     }
     const dir = await safeDirectory(directory), lockPath = path6.join(dir, "journal.lock"), nonce2 = randomBytes4(16).toString("hex");
     const guard = options.lockHelper ? await acquirePosixJournalGuard(dir, options.lockHelper) : void 0;
-    let file2;
+    let file3;
     try {
-      file2 = await open3(lockPath, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+      file3 = await open3(lockPath, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
     } catch (e) {
       await guard?.close();
       if (e.code === "EEXIST") throw failure2("JOURNAL_LOCKED");
       throw e;
     }
-    const journal = new _NativeJournal(dir, box, { path: lockPath, nonce: nonce2, file: file2, guard }, { maxEntries, maxBytes, retentionMs, now: options.now ?? (() => /* @__PURE__ */ new Date()) });
+    const journal = new _NativeJournal(dir, box, { path: lockPath, nonce: nonce2, file: file3, guard }, { maxEntries, maxBytes, retentionMs, now: options.now ?? (() => /* @__PURE__ */ new Date()) });
     try {
-      await file2.writeFile(JSON.stringify({ pid: process.pid, nonce: nonce2, createdAt: journal.now().toISOString() }));
-      await file2.sync();
+      await file3.writeFile(JSON.stringify({ pid: process.pid, nonce: nonce2, createdAt: journal.now().toISOString() }));
+      await file3.sync();
       await journal.load();
       await journal.loadStart(existed);
       return journal;
     } catch (e) {
-      await file2.close().catch(() => {
+      await file3.close().catch(() => {
       });
       try {
         const value = JSON.parse(await readFile3(lockPath, "utf8"));
@@ -28768,9 +28769,9 @@ function resolveWindowsLauncher(commandName, env = process.env) {
     const dir = entry.trim().replace(/^"(.*)"$/, "$1");
     if (!path11.win32.isAbsolute(dir)) continue;
     for (const ext of extensions) {
-      const file2 = path11.win32.join(dir, commandName + ext);
+      const file3 = path11.win32.join(dir, commandName + ext);
       try {
-        if (statSync(file2).isFile()) return { file: file2, shell: ext === ".bat" || ext === ".cmd" };
+        if (statSync(file3).isFile()) return { file: file3, shell: ext === ".bat" || ext === ".cmd" };
       } catch {
       }
     }
@@ -28791,8 +28792,8 @@ var Entry = external_exports.strictObject({
 });
 var State = external_exports.strictObject({ version: external_exports.literal(1), platform: external_exports.string().max(16), entries: external_exports.array(Entry).max(32) });
 var HostMemory = class {
-  constructor(file2, allowed, programs) {
-    this.file = file2;
+  constructor(file3, allowed, programs) {
+    this.file = file3;
     this.allowed = allowed;
     this.programs = programs;
   }
@@ -28832,9 +28833,9 @@ var HostMemory = class {
       else if (!this.programs && !available) available = (process.env.PATH ?? "").split(path12.delimiter).some((dir) => {
         if (!path12.isAbsolute(dir)) return false;
         try {
-          const file2 = path12.join(dir, command);
-          accessSync(file2, constants5.X_OK);
-          return statSync2(file2).isFile();
+          const file3 = path12.join(dir, command);
+          accessSync(file3, constants5.X_OK);
+          return statSync2(file3).isFile();
         } catch {
           return false;
         }
@@ -28894,13 +28895,13 @@ var HostMemory = class {
       await mkdir5(directory2, { recursive: true, mode: 448 });
       const stat2 = await lstat5(directory2);
       if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw Error("HOST_MEMORY_DIRECTORY_INVALID");
-      const file2 = await open5(temp, "wx", 384);
+      const file3 = await open5(temp, "wx", 384);
       try {
-        await file2.writeFile(encoded);
-        await file2.close();
+        await file3.writeFile(encoded);
+        await file3.close();
         await rename3(temp, this.file);
       } finally {
-        await file2.close().catch(() => {
+        await file3.close().catch(() => {
         });
         await rm4(temp, { force: true }).catch(() => {
         });
@@ -29127,11 +29128,11 @@ var PathGuard = class _PathGuard {
 // src/windows-file-read.ts
 import { execFile as execFile3 } from "node:child_process";
 import path14 from "node:path";
-function readWindowsFile(bridge, file2, maxBytes, signal) {
-  return invokeRead(bridge, file2, maxBytes, false, signal);
+function readWindowsFile(bridge, file3, maxBytes, signal) {
+  return invokeRead(bridge, file3, maxBytes, false, signal);
 }
-async function readWindowsFilePrefix(bridge, file2, maxBytes, signal) {
-  const output2 = await invokeRead(bridge, file2, maxBytes, true, signal);
+async function readWindowsFilePrefix(bridge, file3, maxBytes, signal) {
+  const output2 = await invokeRead(bridge, file3, maxBytes, true, signal);
   try {
     const value = JSON.parse(output2.toString("utf8"));
     if (!value || Object.keys(value).length !== 4 || typeof value.data !== "string" || !Number.isSafeInteger(value.size) || value.size < 0 || typeof value.modifiedAt !== "string" || new Date(value.modifiedAt).toISOString() !== value.modifiedAt || value.truncated !== value.size > maxBytes) throw Error();
@@ -29144,7 +29145,7 @@ async function readWindowsFilePrefix(bridge, file2, maxBytes, signal) {
 }
 function readWindowsFiles(bridge, files, maxBytes, maxTotalBytes, signal) {
   const input2 = JSON.stringify({ paths: files });
-  if (process.platform !== "win32" || !path14.isAbsolute(bridge) || files.length < 1 || files.length > 64 || files.some((file2) => !path14.isAbsolute(file2)) || Buffer.byteLength(input2) > 3e5 || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 1048576 || !Number.isSafeInteger(maxTotalBytes) || maxTotalBytes < 1 || maxTotalBytes > 16777216) {
+  if (process.platform !== "win32" || !path14.isAbsolute(bridge) || files.length < 1 || files.length > 64 || files.some((file3) => !path14.isAbsolute(file3)) || Buffer.byteLength(input2) > 3e5 || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 1048576 || !Number.isSafeInteger(maxTotalBytes) || maxTotalBytes < 1 || maxTotalBytes > 16777216) {
     return Promise.reject(new Error("FILE_READ_ARGUMENT_INVALID"));
   }
   if (signal?.aborted) return Promise.reject(new Error("CANCELLED"));
@@ -29181,8 +29182,8 @@ function readWindowsFiles(bridge, files, maxBytes, maxTotalBytes, signal) {
     child.stdin.end(input2);
   });
 }
-function invokeRead(bridge, file2, maxBytes, prefix, signal) {
-  if (process.platform !== "win32" || !path14.isAbsolute(bridge) || !path14.isAbsolute(file2) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
+function invokeRead(bridge, file3, maxBytes, prefix, signal) {
+  if (process.platform !== "win32" || !path14.isAbsolute(bridge) || !path14.isAbsolute(file3) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > (prefix ? 16777216 : 1048576)) {
     return Promise.reject(new Error("FILE_READ_ARGUMENT_INVALID"));
   }
   if (signal?.aborted) return Promise.reject(new Error("CANCELLED"));
@@ -29205,7 +29206,7 @@ function invokeRead(bridge, file2, maxBytes, prefix, signal) {
     });
     child.stdin.on("error", () => {
     });
-    child.stdin.end(JSON.stringify({ path: file2 }));
+    child.stdin.end(JSON.stringify({ path: file3 }));
   });
 }
@@ -29545,11 +29546,11 @@ async function portalScreenshot(socket, uid, token, signal) {
       signal.addEventListener("abort", abort, { once: true });
       connection.on("error", fail7);
       connection.on("close", () => fail7(Error("CLOSED")));
-      const call = (destination, path30, iface, member, signature = "", body = () => {
+      const call = (destination, path31, iface, member, signature = "", body = () => {
       }) => new Promise((done, failed) => {
         const payload2 = new Writer();
         body(payload2);
-        const header = new Writer(), fields = [[1, "o", path30], [2, "s", iface], [3, "s", member], [6, "s", destination]];
+        const header = new Writer(), fields = [[1, "o", path31], [2, "s", iface], [3, "s", member], [6, "s", destination]];
         if (signature) fields.push([8, "g", signature]);
         header.byte(108);
         header.byte(1);
@@ -30394,10 +30395,10 @@ function jpegSize(data) {
   }
   return null;
 }
-function run(file2, args, signal, maxBuffer = 65536, env = buildChildEnvironment(process.env, process.platform)) {
+function run(file3, args, signal, maxBuffer = 65536, env = buildChildEnvironment(process.env, process.platform)) {
   return new Promise((resolve, reject) => {
     execFile4(
-      file2,
+      file3,
       args,
       { encoding: "buffer", timeout: 15e3, maxBuffer, windowsHide: true, shell: false, env, signal },
       (error62, stdout, stderr) => error62 ? reject(Object.assign(error62, { stdout, stderr })) : resolve({ stdout, stderr })
@@ -30469,10 +30470,10 @@ var SESSION_VALUE = /^[A-Za-z0-9_.:,;=@+/-]{1,256}$/;
 var LINUX_SOURCE_BYTES = 150994944;
 async function linuxTool(name2) {
   for (const directory of ["/usr/bin", "/bin", "/usr/local/bin"]) {
-    const file2 = path17.posix.join(directory, name2);
+    const file3 = path17.posix.join(directory, name2);
     try {
-      await access3(file2, constants7.X_OK);
-      return file2;
+      await access3(file3, constants7.X_OK);
+      return file3;
     } catch {
     }
   }
@@ -30517,8 +30518,8 @@ async function linuxSession(signal) {
     }
   }
   if (session.DISPLAY && !session.XAUTHORITY) {
-    const file2 = path17.posix.join(os4.homedir(), ".Xauthority");
-    if ((await lstat7(file2).catch(() => null))?.isFile()) take("XAUTHORITY", file2);
+    const file3 = path17.posix.join(os4.homedir(), ".Xauthority");
+    if ((await lstat7(file3).catch(() => null))?.isFile()) take("XAUTHORITY", file3);
   }
   if (session.XDG_RUNTIME_DIR) take("DBUS_SESSION_BUS_ADDRESS", "unix:path=" + session.XDG_RUNTIME_DIR + "/bus");
   const wayland = !!session.WAYLAND_DISPLAY || session.XDG_SESSION_TYPE === "wayland";
@@ -30541,13 +30542,13 @@ async function portalCapture(socket, signal) {
   const { code, uri } = answer;
   if (code === 1) throw new ScreenCaptureError("SCREEN_RECORDING_PERMISSION_REQUIRED");
   if (code !== 0 || !uri?.startsWith("file://")) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
-  const file2 = decodeURIComponent(new URL(uri).pathname), info = await lstat7(file2);
+  const file3 = decodeURIComponent(new URL(uri).pathname), info = await lstat7(file3);
   const fresh = info.isFile() && info.uid === uid && info.mtimeMs >= started - 5e3;
   try {
     if (!fresh || info.size > LINUX_SOURCE_BYTES) throw new ScreenCaptureError("SCREEN_UNAVAILABLE");
-    return await readFile6(file2);
+    return await readFile6(file3);
   } finally {
-    if (fresh) await unlink2(file2).catch(() => {
+    if (fresh) await unlink2(file3).catch(() => {
     });
   }
 }
@@ -30630,16 +30631,16 @@ function result(body) {
 function stopped(signal) {
   if (signal.aborted) fail3("CANCELLED");
 }
-async function readBoundedFile(file2, maxBytes, bridge, signal) {
-  const stat2 = await lstat8(file2);
+async function readBoundedFile(file3, maxBytes, bridge, signal) {
+  const stat2 = await lstat8(file3);
   if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > maxBytes) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
   if (process.platform === "win32") {
-    if (maxBytes <= 1048576 || stat2.size <= 1048576) return readWindowsFile(bridge, file2, Math.min(maxBytes, 1048576), signal);
-    const read = await readWindowsFilePrefix(bridge, file2, maxBytes, signal);
+    if (maxBytes <= 1048576 || stat2.size <= 1048576) return readWindowsFile(bridge, file3, Math.min(maxBytes, 1048576), signal);
+    const read = await readWindowsFilePrefix(bridge, file3, maxBytes, signal);
     if (read.truncated) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
     return read.data;
   }
-  const handle = await open6(file2, constants8.O_RDONLY | (constants8.O_NOFOLLOW ?? 0));
+  const handle = await open6(file3, constants8.O_RDONLY | (constants8.O_NOFOLLOW ?? 0));
   try {
     const current2 = await handle.stat();
     if (!current2.isFile() || current2.size > maxBytes) fail3("FILE_UNSUPPORTED_OR_TOO_LARGE");
@@ -30695,9 +30696,9 @@ var NativeTools = class {
   }
   options;
   memory;
-  async readFile(file2, maxBytes, signal) {
+  async readFile(file3, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file3, maxBytes, this.options.ownerBridgePath ?? path18.join(path18.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail3(error62.message);
@@ -31131,8 +31132,8 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path18.resolve(cwd, call.args.file));
-        const relative = path18.relative(cwd, file2);
+        const file3 = await resolve(path18.resolve(cwd, call.args.file));
+        const relative = path18.relative(cwd, file3);
         if (relative.startsWith(".." + path18.sep) || relative === ".." || path18.isAbsolute(relative)) fail3("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
@@ -31164,9 +31165,9 @@ var NativeTools = class {
           }
           const contextFile = async (relative, limit, optional2 = false) => {
             try {
-              const file2 = await guard.resolveExisting(path18.join(primary, relative));
-              guard.assertSafeFile(file2);
-              return utf8(await this.readFile(file2, limit, signal));
+              const file3 = await guard.resolveExisting(path18.join(primary, relative));
+              guard.assertSafeFile(file3);
+              return utf8(await this.readFile(file3, limit, signal));
             } catch (error62) {
               if (optional2 && error62.code === "ENOENT") return null;
               throw error62;
@@ -31859,7 +31860,7 @@ function shapeCommandResultForAgentDetailed(input2, result2) {
   if (parsed.state !== "candidate" && result2.exitCode === 0 && !result2.stdoutTruncated && !result2.stderrTruncated && result2.stderr === "") {
     const compact = compactJsonOutput(result2.stdout);
     if (compact !== null) {
-      const sent = bytes(compact), saved = originalBytes - sent;
+      const sent = bytes(compact), saved2 = originalBytes - sent;
       return Object.freeze({ result: Object.freeze({ ...result2, stdout: compact }), telemetry: Object.freeze({
         parserId: "json-whitespace",
         parserVersion: "1",
@@ -31868,8 +31869,8 @@ function shapeCommandResultForAgentDetailed(input2, result2) {
         reason: "validated_compact",
         originalStdoutBytes: originalBytes,
         sentStdoutBytes: sent,
-        savedStdoutBytes: saved,
-        reductionPercent: originalBytes === 0 ? 0 : saved / originalBytes * 100
+        savedStdoutBytes: saved2,
+        reductionPercent: originalBytes === 0 ? 0 : saved2 / originalBytes * 100
       }) });
     }
   }
@@ -36574,9 +36575,9 @@ var rev2026Codec = {
     });
     const parsed = buildSchemas2026().RequestMetaEnvelopeSchema.safeParse(meta3);
     if (!parsed.success) for (const issue2 of parsed.error.issues) {
-      const path30 = issue2.path.map(String);
-      const key = path30.length > 0 ? path30.join(".") : "_meta";
-      if (path30.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
+      const path31 = issue2.path.map(String);
+      const key = path31.length > 0 ? path31.join(".") : "_meta";
+      if (path31.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
       issues.push({
         key,
         problem: issue2.message
@@ -36878,29 +36879,29 @@ var PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
-  const visit2 = (node2, path30, reachable) => {
+  const visit2 = (node2, path31, reachable) => {
     if (node2 === null || typeof node2 !== "object") return void 0;
     const schema = node2;
     if (X_MCP_HEADER_KEY in schema) {
-      if (!reachable || path30.length === 0) return `${pathName(path30)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
+      if (!reachable || path31.length === 0) return `${pathName(path31)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
       const raw = schema[X_MCP_HEADER_KEY];
-      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path30)}: x-mcp-header MUST be a non-empty string`;
-      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path30)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
+      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path31)}: x-mcp-header MUST be a non-empty string`;
+      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path31)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       const type = typeof schema.type === "string" ? schema.type : void 0;
-      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path30)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path31)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
       const lower = raw.toLowerCase();
       const prior = seenLower.get(lower);
       if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
       seenLower.set(lower, raw);
       declarations.push({
-        path: path30,
+        path: path31,
         headerName: raw,
         type
       });
     }
     const properties = schema.properties;
     if (properties !== null && typeof properties === "object") for (const [key, child] of Object.entries(properties)) {
-      const fault$1 = visit2(child, [...path30, key], reachable);
+      const fault$1 = visit2(child, [...path31, key], reachable);
       if (fault$1 !== void 0) return fault$1;
     }
     for (const k of NON_REACHABLE_SUBSCHEMA_KEYWORDS) {
@@ -36908,7 +36909,7 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (sub === void 0) continue;
       const branches = Array.isArray(sub) ? sub : sub !== null && typeof sub === "object" && OBJECT_VALUED_SUBSCHEMA_KEYWORDS.has(k) ? Object.values(sub) : [sub];
       for (const branch of branches) {
-        const fault$1 = visit2(branch, [...path30, `<${k}>`], false);
+        const fault$1 = visit2(branch, [...path31, `<${k}>`], false);
         if (fault$1 !== void 0) return fault$1;
       }
     }
@@ -36948,8 +36949,8 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "$defs",
   "definitions"
 ]);
-function pathName(path30) {
-  return path30.length === 0 ? "<root>" : path30.join(".");
+function pathName(path31) {
+  return path31.length === 0 ? "<root>" : path31.join(".");
 }
 var HEADER_MISMATCH_ERROR_CODE = -32020;
 var INBOUND_VALIDATION_LADDER = [
@@ -37199,7 +37200,7 @@ var PROPERTY_KEYS_BY_TYPE = {
   array: shapeKeys([UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema])
 };
 var SUPPORTED_STRING_FORMATS = new Set(StringSchemaSchema.shape.format.unwrap().options);
-function walkProperty(node2, path30, vendor, unsupported) {
+function walkProperty(node2, path31, vendor, unsupported) {
   if (!isJsonObject(node2)) return node2;
   const allowedKeys = typeof node2.type === "string" && Object.hasOwn(PROPERTY_KEYS_BY_TYPE, node2.type) ? PROPERTY_KEYS_BY_TYPE[node2.type] : void 0;
   if (allowedKeys === void 0) return node2;
@@ -37207,8 +37208,8 @@ function walkProperty(node2, path30, vendor, unsupported) {
   for (const [key, value] of Object.entries(node2)) if (allowedKeys.has(key) || isAnnotationOnlyJsonSchemaKeyword(key)) pruned[key] = value;
   else if (key === "pattern" && node2.type === "string" && typeof node2.format === "string") {
     if (!SUPPORTED_STRING_FORMATS.has(node2.format)) pruned[key] = value;
-    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path30}.${key}`);
-  } else unsupported.push(`${path30}.${key}`);
+    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path31}.${key}`);
+  } else unsupported.push(`${path31}.${key}`);
   return pruned;
 }
 function walkRequestedSchema(converted, vendor) {
@@ -37225,11 +37226,11 @@ function describeUnsupportedProperties(pruned, fallback) {
   const offenders = Object.entries(pruned.properties).filter(([, node2]) => !parseSchema(PrimitiveSchemaDefinitionSchema, node2).success).map(([name2]) => `properties.${name2}`);
   return offenders.length > 0 ? offenders.join(", ") : fallback;
 }
-function findDroppedConstraintPaths(original, parsed, path30 = "") {
-  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path30}[${index}]`));
+function findDroppedConstraintPaths(original, parsed, path31 = "") {
+  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path31}[${index}]`));
   if (!isJsonObject(original) || !isJsonObject(parsed)) return [];
   return Object.entries(original).flatMap(([key, value]) => {
-    const childPath = path30 ? `${path30}.${key}` : key;
+    const childPath = path31 ? `${path31}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(parsed, key)) return isAnnotationOnlyJsonSchemaKeyword(key) ? [] : [childPath];
     return findDroppedConstraintPaths(value, parsed[key], childPath);
   });
@@ -41305,8 +41306,8 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     for (let i = 0; i < str.length; i++) if (str[i] === token) ind++;
     return ind;
   }
-  function removeDotSegments(path30) {
-    let input2 = path30;
+  function removeDotSegments(path31) {
+    let input2 = path31;
     const output2 = [];
     let nextSlash = -1;
     let len = 0;
@@ -41459,8 +41460,8 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       wsComponent.secure = void 0;
     }
     if (wsComponent.resourceName) {
-      const [path30, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path30 && path30 !== "/" ? path30 : void 0;
+      const [path31, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path31 && path31 !== "/" ? path31 : void 0;
       wsComponent.query = query;
       wsComponent.resourceName = void 0;
     }
@@ -47410,9 +47411,9 @@ function waitForMessage(socket, maxBytes, timeoutMs2, timeoutCode) {
       cleanup();
       reject(new RelayClientError(error62.code === "WS_ERR_UNSUPPORTED_MESSAGE_LENGTH" ? "RELAY_FRAME_TOO_LARGE" : "RELAY_SOCKET_FAILED"));
     };
-    const onClose = () => {
+    const onClose = (code, reason) => {
       cleanup();
-      reject(new RelayClientError("RELAY_SOCKET_CLOSED"));
+      reject(new RelayClientError(code === 1008 && reason.toString("utf8") === "device_quarantined" ? "RELAY_DEVICE_QUARANTINED" : "RELAY_SOCKET_CLOSED"));
     };
     socket.once("message", onMessage);
     socket.once("error", onError);
@@ -47521,7 +47522,8 @@ async function connectOnce(options) {
       deviceId,
       guardIdentity: true,
       ...options.aiConnectivity ? { aiConnectivity: true } : {},
-      ...options.onHeldLeases ? { heldLeases: true } : {}
+      ...options.onHeldLeases ? { heldLeases: true } : {},
+      ...options.onFullLogChoice ? { fullLogNotice: true } : {}
     }, maxFrameBytes);
     const challenge = validateChallenge(await waitForMessage(socket, maxFrameBytes, connectTimeoutMs, "RELAY_HANDSHAKE_TIMEOUT"), protocolVersion2);
     const machine = challenge.machineIdentity ? options.machineIdentity?.(deviceId) ?? null : null;
@@ -47624,6 +47626,17 @@ async function connectOnce(options) {
       void (async () => {
         try {
           const frame = parseFrame(data, maxFrameBytes);
+          if (frame.type === "fullLogState") {
+            const state = FullLogStateSchema.safeParse(frame);
+            if (state.success && state.data.connectionEpoch === connectionEpoch) {
+              try {
+                void Promise.resolve(options.onFullLogChoice?.(state.data.enabled)).catch(() => {
+                });
+              } catch {
+              }
+            }
+            return;
+          }
           if (frame.type === "aiConnectivityRevoked") {
             if (connectivity && frame.protocolVersion === 1 && frame.connectionEpoch === connectionEpoch) notifyConnectivityRevoked();
             return;
@@ -47972,8 +47985,8 @@ function canonicalOrigin2(value) {
     fail6("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path30) {
-  return origin + path30;
+function endpoint(origin, path31) {
+  return origin + path31;
 }
 function uuid21(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail6(code);
@@ -48940,12 +48953,12 @@ var ProductionMonitor = class {
     });
     return this.writing;
   }
-  async write(file2, contents) {
-    const directory = path23.dirname(file2);
+  async write(file3, contents) {
+    const directory = path23.dirname(file3);
     await mkdir9(directory, { recursive: true, mode: 448 });
     const stat2 = await lstat10(directory);
     if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
-    const temporary = file2 + "." + this.instanceId + ".tmp";
+    const temporary = file3 + "." + this.instanceId + ".tmp";
     const handle = await open9(temporary, "wx", 384);
     try {
       try {
@@ -48953,7 +48966,7 @@ var ProductionMonitor = class {
       } finally {
         await handle.close();
       }
-      await rename6(temporary, file2);
+      await rename6(temporary, file3);
     } finally {
       await rm8(temporary, { force: true });
     }
@@ -48965,6 +48978,108 @@ var ProductionMonitor = class {
   }
 };
+// agent/src/full-log-notice.ts
+import { execFile as execFile5 } from "node:child_process";
+import { randomUUID as randomUUID13 } from "node:crypto";
+import { lstat as lstat11, mkdir as mkdir10, readFile as readFile10, rename as rename7, rm as rm9, writeFile as writeFile4 } from "node:fs/promises";
+import path24 from "node:path";
+import { promisify as promisify3 } from "node:util";
+var exec3 = promisify3(execFile5);
+var manageUrl = "https://localcmd.app";
+var noticeDirectory = (directory) => path24.join(directory, "optimization");
+var file2 = (directory) => path24.join(noticeDirectory(directory), "full-log-notice.json");
+async function saved(directory, enrollment) {
+  if (!enrollment) return null;
+  try {
+    const parent = await lstat11(noticeDirectory(directory));
+    if (!parent.isDirectory() || parent.isSymbolicLink()) return null;
+    const info = await lstat11(file2(directory));
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) return null;
+    const value = JSON.parse(await readFile10(file2(directory), "utf8"));
+    if (value.tenantId !== enrollment.tenantId || value.deviceId !== enrollment.deviceId || !(value.enabled === null || typeof value.enabled === "boolean") || !(value.lastNotified === null || typeof value.lastNotified === "boolean") || !Number.isInteger(value.pid) || value.pid <= 0 || !Number.isFinite(Date.parse(value.confirmedAt))) return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+async function readFullLogNotice(directory, enrollment) {
+  const value = await saved(directory, enrollment);
+  let live = false;
+  if (value) {
+    try {
+      const processRecord = JSON.parse(await readFile10(path24.join(directory, "agent-process.json"), "utf8"));
+      if (processRecord.pid === value.pid && Date.parse(processRecord.startedAt) <= Date.parse(value.confirmedAt)) {
+        process.kill(value.pid, 0);
+        live = true;
+      }
+    } catch {
+    }
+  }
+  return { enabled: live ? value.enabled : null, confirmedAt: value?.confirmedAt ?? null, manageUrl };
+}
+async function showFullLogNotice(enabled) {
+  const title = "Local Commander: full logs " + (enabled ? "enabled" : "disabled");
+  const body = enabled ? "Your account owner enabled full logs for this computer. Tool requests and responses may be stored for up to 7 days. Review the choice at localcmd.app." : "Your account owner disabled full logs for this computer. Review the choice and deletion status at localcmd.app.";
+  const options = { windowsHide: true, timeout: 12e3, maxBuffer: 4096 };
+  if (process.platform === "win32") {
+    const script = `Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $notice=New-Object System.Windows.Forms.NotifyIcon; try { $notice.Icon=[System.Drawing.SystemIcons]::Information; $notice.Visible=$true; $notice.ShowBalloonTip(8000,'${title}','${body}',[System.Windows.Forms.ToolTipIcon]::Info); Start-Sleep -Seconds 8 } finally { $notice.Dispose() }`;
+    await exec3("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], options);
+  } else if (process.platform === "darwin") {
+    await exec3("/usr/bin/osascript", ["-e", `display notification "${body}" with title "${title}"`], options);
+  } else if (process.platform === "linux") {
+    await exec3("notify-send", ["--app-name=Local Commander", title, body], options);
+  }
+}
+var FullLogNotice = class {
+  constructor(directory, enrollment, notify = showFullLogNotice) {
+    this.directory = directory;
+    this.enrollment = enrollment;
+    this.notify = notify;
+  }
+  directory;
+  enrollment;
+  notify;
+  pending;
+  writing;
+  update(enabled) {
+    this.pending = enabled;
+    return this.writing ??= this.drain().finally(() => {
+      this.writing = void 0;
+    });
+  }
+  async drain() {
+    await mkdir10(noticeDirectory(this.directory), { mode: 448 }).catch((error62) => {
+      if (error62.code !== "EEXIST") throw error62;
+    });
+    const parent = await lstat11(noticeDirectory(this.directory));
+    if (!parent.isDirectory() || parent.isSymbolicLink()) throw Error("FULL_LOG_NOTICE_DIRECTORY_INVALID");
+    let previous = await saved(this.directory, this.enrollment);
+    while (this.pending !== void 0) {
+      const enabled = this.pending;
+      this.pending = void 0;
+      const changed = enabled !== null && enabled !== previous?.lastNotified && (enabled || previous?.lastNotified === true);
+      const next = {
+        ...this.enrollment,
+        enabled,
+        lastNotified: changed ? enabled : previous?.lastNotified ?? null,
+        confirmedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        pid: process.pid
+      };
+      const temporary = file2(this.directory) + "." + randomUUID13() + ".tmp";
+      try {
+        await writeFile4(temporary, JSON.stringify(next) + "\n", { flag: "wx", mode: 384 });
+        await rename7(temporary, file2(this.directory));
+      } finally {
+        await rm9(temporary, { force: true }).catch(() => {
+        });
+      }
+      previous = next;
+      if (changed) void this.notify(enabled).catch(() => {
+      });
+    }
+  }
+};
 // agent/src/native-event-buffer.ts
 import { createHash as createHash18 } from "node:crypto";
 function nativeFingerprint(code, executionId = "") {
@@ -49366,27 +49481,27 @@ var NativeFabricObserver = class {
 };
 // agent/src/native-fabric-startup.ts
-import { lstat as lstat12, mkdir as mkdir12, open as open11, readFile as readFile10 } from "node:fs/promises";
-import path26 from "node:path";
+import { lstat as lstat13, mkdir as mkdir13, open as open11, readFile as readFile11 } from "node:fs/promises";
+import path27 from "node:path";
 // src/agent-fabric-service.ts
-import { lstat as lstat11, mkdir as mkdir11, realpath as realpath9 } from "node:fs/promises";
+import { lstat as lstat12, mkdir as mkdir12, realpath as realpath9 } from "node:fs/promises";
 import { watch } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 // src/agent-runtime-identity.ts
-import { createHash as createHash19, randomBytes as randomBytes8, randomUUID as randomUUID14, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { createHash as createHash19, randomBytes as randomBytes8, randomUUID as randomUUID15, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 // src/agent-fabric-state.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
-import { mkdir as mkdir10, open as open10, rename as rename7, unlink as unlink3 } from "node:fs/promises";
-import path24 from "node:path";
+import { randomUUID as randomUUID14 } from "node:crypto";
+import { mkdir as mkdir11, open as open10, rename as rename8, unlink as unlink3 } from "node:fs/promises";
+import path25 from "node:path";
 var queues = /* @__PURE__ */ new Map();
 var FabricStateFile = class {
-  constructor(file2, maxBytes, parse4) {
+  constructor(file3, maxBytes, parse4) {
     this.maxBytes = maxBytes;
     this.parse = parse4;
-    this.file = path24.resolve(file2);
+    this.file = path25.resolve(file3);
   }
   maxBytes;
   parse;
@@ -49430,9 +49545,9 @@ var FabricStateFile = class {
   }
   update(fn, create) {
     return this.serial(async () => {
-      if (create) await mkdir10(path24.dirname(this.file), { recursive: true });
+      if (create) await mkdir11(path25.dirname(this.file), { recursive: true });
       const lockPath = this.file + ".lock";
-      const token = randomUUID13();
+      const token = randomUUID14();
       const lock = await open10(lockPath, "wx", 384).catch((error62) => {
         if (error62.code === "EEXIST") throw Error("FABRIC_STATE_BUSY");
         throw error62;
@@ -49459,7 +49574,7 @@ var FabricStateFile = class {
           } finally {
             await handle.close();
           }
-          await rename7(temporary, this.file);
+          await rename8(temporary, this.file);
         } finally {
           await unlink3(temporary).catch((error62) => {
             if (error62.code !== "ENOENT") throw error62;
@@ -49507,9 +49622,9 @@ function validKey(value) {
   return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 var AgentRuntimeIdentityStore = class {
-  constructor(file2, now = Date.now) {
+  constructor(file3, now = Date.now) {
     this.now = now;
-    this.state = new FabricStateFile(file2, MAX_BYTES, (value) => {
+    this.state = new FabricStateFile(file3, MAX_BYTES, (value) => {
       const state = StateSchema.parse(value);
       if (new Set(state.bindings.map((item) => item.runtimeId)).size !== state.bindings.length)
         throw Error("RUNTIME_IDENTITY_STATE_CORRUPT");
@@ -49528,7 +49643,7 @@ var AgentRuntimeIdentityStore = class {
   issue() {
     return this.serial((state) => {
       if (state.bindings.length >= MAX_BINDINGS) throw Error("RUNTIME_IDENTITY_LIMIT");
-      const runtimeId = "rt-" + randomUUID14();
+      const runtimeId = "rt-" + randomUUID15();
       const runtimeKey = randomBytes8(32).toString("base64url");
       const now = this.now();
       state.bindings.push({ runtimeId, keyHash: encodedDigest(runtimeKey), createdAt: now, lastUsedAt: now, revoked: false });
@@ -49561,10 +49676,10 @@ var AgentRuntimeIdentityStore = class {
 };
 // src/agent-fabric-mailbox.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 // src/agent-fabric-timeline.ts
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
 import { performance as performance2 } from "node:perf_hooks";
 var FabricId = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/);
 var FabricUtc = external_exports.string().datetime({ precision: 3 }).refine((value) => new Date(value).toISOString() === value);
@@ -49573,7 +49688,7 @@ var FabricStampSchema = external_exports.strictObject({
   clockId: FabricId,
   monotonicMs: external_exports.number().finite().nonnegative().max(Number.MAX_SAFE_INTEGER)
 });
-var processClockId = "clock-" + randomUUID15();
+var processClockId = "clock-" + randomUUID16();
 function createFabricClock() {
   return () => ({ atUtc: (/* @__PURE__ */ new Date()).toISOString(), clockId: processClockId, monotonicMs: performance2.now() });
 }
@@ -49759,12 +49874,12 @@ function parseState(value) {
   return state;
 }
 var AgentWorkerMailbox = class {
-  constructor(file2, controllerId, identities, clock = createFabricClock(), notify) {
+  constructor(file3, controllerId, identities, clock = createFabricClock(), notify) {
     this.identities = identities;
     this.clock = clock;
     this.notify = notify;
     this.controllerId = FabricId.parse(controllerId);
-    this.state = new FabricStateFile(file2, 2 * 1024 * 1024, (value) => {
+    this.state = new FabricStateFile(file3, 2 * 1024 * 1024, (value) => {
       const state = parseState(value);
       if (state.controllerId !== this.controllerId) throw Error("FABRIC_CONTROLLER_MISMATCH");
       return state;
@@ -49830,7 +49945,7 @@ var AgentWorkerMailbox = class {
       const now = this.clock().atUtc;
       const worker = {
         ...registration,
-        workerId: randomUUID16(),
+        workerId: randomUUID17(),
         controllerId: this.controllerId,
         runtimeId: null,
         attribution: WorkerAttributionSchema.parse({}),
@@ -49864,7 +49979,7 @@ var AgentWorkerMailbox = class {
     if (state.messages.length >= MAX_MESSAGES) throw Error("FABRIC_MESSAGE_LIMIT");
     const now = this.clock();
     const message2 = {
-      messageId: randomUUID16(),
+      messageId: randomUUID17(),
       key: request.key,
       assignmentId: assignment.assignmentId,
       direction,
@@ -49881,7 +49996,7 @@ var AgentWorkerMailbox = class {
   }
   async assign(input2) {
     const request = AssignmentInput.parse(input2);
-    const saved = await this.state.update((state) => {
+    const saved2 = await this.state.update((state) => {
       this.worker(state, request.workerId);
       const existing = state.assignments.find((a) => a.runId === request.runId && a.selectedRuntime === request.selectedRuntime);
       if (existing) {
@@ -49894,7 +50009,7 @@ var AgentWorkerMailbox = class {
       const now = this.clock().atUtc;
       const assignment = {
         ...request,
-        assignmentId: randomUUID16(),
+        assignmentId: randomUUID17(),
         phase: "assigned",
         createdAt: now,
         updatedAt: now,
@@ -49909,30 +50024,30 @@ var AgentWorkerMailbox = class {
       const { message: message2 } = this.append(state, assignment, "ASSIGN", "controller", { key: "assign", payloadRef: request.payloadRef });
       return { state, assignment, notice: message2 };
     });
-    if (saved.notice) this.emit(saved.state, saved.notice);
-    return saved.assignment;
+    if (saved2.notice) this.emit(saved2.state, saved2.notice);
+    return saved2.assignment;
   }
   async control(assignmentId, kind, input2) {
     Control.parse(kind);
-    const saved = await this.state.update((state) => {
+    const saved2 = await this.state.update((state) => {
       const assignment = this.assignment(state, assignmentId);
       if (!assignmentActive(assignment)) throw Error("FABRIC_ASSIGNMENT_INACTIVE");
       return { state, ...this.append(state, assignment, kind, "controller", input2) };
     });
-    if (saved.added) this.emit(saved.state, saved.message);
-    return saved.message;
+    if (saved2.added) this.emit(saved2.state, saved2.message);
+    return saved2.message;
   }
   async report(workerId, credential, assignmentId, kind, input2) {
     Report.parse(kind);
     await this.identities.authenticate(credential.runtimeId, credential.runtimeKey);
-    const saved = await this.state.update((state) => {
+    const saved2 = await this.state.update((state) => {
       this.bound(state, workerId, credential);
       const assignment = this.assignment(state, assignmentId);
       if (assignment.workerId !== workerId || assignment.phase === "not_started") throw Error("FABRIC_ASSIGNMENT_DENIED");
       return { state, ...this.append(state, assignment, kind, "worker", input2) };
     });
-    if (saved.added) this.emit(saved.state, saved.message);
-    return saved.message;
+    if (saved2.added) this.emit(saved2.state, saved2.message);
+    return saved2.message;
   }
   pending(state, direction, workerId) {
     const now = this.clock().atUtc;
@@ -49972,12 +50087,12 @@ var AgentWorkerMailbox = class {
     return this.state.update((state) => this.acknowledge(state, messageId, "to_controller"));
   }
   async adapterResult(assignmentId, payloadRef) {
-    const saved = await this.state.update((state) => {
+    const saved2 = await this.state.update((state) => {
       const assignment = this.assignment(state, assignmentId);
       if (assignment.phase !== "exited") throw Error("FABRIC_RESULT_UNCONFIRMED");
       return { state, ...this.append(state, assignment, "RESULT", "adapter", { key: "result", payloadRef }) };
     });
-    if (saved.added) this.emit(saved.state, saved.message);
+    if (saved2.added) this.emit(saved2.state, saved2.message);
   }
   claimLaunch(assignmentId) {
     return this.state.update((state) => {
@@ -50074,9 +50189,9 @@ var WorkerRequest = external_exports.discriminatedUnion("operation", [
 var AgentFabricService = class _AgentFabricService {
   constructor(directory, controllerId) {
     this.directory = directory;
-    this.identities = new AgentRuntimeIdentityStore(path25.join(directory, "identities.json"));
+    this.identities = new AgentRuntimeIdentityStore(path26.join(directory, "identities.json"));
     this.mailbox = new AgentWorkerMailbox(
-      path25.join(directory, "mailbox.json"),
+      path26.join(directory, "mailbox.json"),
       controllerId,
       this.identities,
       void 0,
@@ -50091,29 +50206,29 @@ var AgentFabricService = class _AgentFabricService {
   closed = false;
   static async open(directory, controllerId, device = null, initialize = true) {
     const expected = Binding.parse({ version: 1, controllerId, device, initialized: false });
-    const absolute2 = path25.resolve(directory);
-    for (let current2 = absolute2; ; current2 = path25.dirname(current2)) {
+    const absolute2 = path26.resolve(directory);
+    for (let current2 = absolute2; ; current2 = path26.dirname(current2)) {
       try {
-        if ((await lstat11(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
+        if ((await lstat12(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
-      if (path25.dirname(current2) === current2) break;
+      if (path26.dirname(current2) === current2) break;
     }
-    if (initialize) await mkdir11(absolute2, { recursive: true, mode: 448 });
-    if (!(await lstat11(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
+    if (initialize) await mkdir12(absolute2, { recursive: true, mode: 448 });
+    if (!(await lstat12(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
       throw Error("FABRIC_DIRECTORY_INVALID");
     const present = /* @__PURE__ */ new Set();
     for (const name2 of ["binding.json", "mailbox.json", "identities.json"]) {
-      const file2 = await lstat11(path25.join(absolute2, name2)).catch((error62) => {
+      const file3 = await lstat12(path26.join(absolute2, name2)).catch((error62) => {
         if (error62.code === "ENOENT") return null;
         throw error62;
       });
-      if (file2 && (!file2.isFile() || file2.isSymbolicLink())) throw Error("FABRIC_FILE_INVALID");
-      if (file2) present.add(name2);
+      if (file3 && (!file3.isFile() || file3.isSymbolicLink())) throw Error("FABRIC_FILE_INVALID");
+      if (file3) present.add(name2);
     }
     if (!present.has("binding.json") && present.size) throw Error("FABRIC_BINDING_MISSING");
-    const binding2 = new FabricStateFile(path25.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
+    const binding2 = new FabricStateFile(path26.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
     const service2 = new _AgentFabricService(absolute2, controllerId);
     await binding2.update(async (state) => {
       if (state.controllerId !== expected.controllerId || JSON.stringify(state.device) !== JSON.stringify(expected.device))
@@ -50128,7 +50243,7 @@ var AgentFabricService = class _AgentFabricService {
         state.initialized = true;
       }
       const snapshot2 = await service2.mailbox.snapshot();
-      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat11(path25.join(absolute2, "identities.json"));
+      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat12(path26.join(absolute2, "identities.json"));
     }, initialize ? () => expected : void 0);
     return service2;
   }
@@ -50145,8 +50260,8 @@ var AgentFabricService = class _AgentFabricService {
     this.listeners.add(callback);
     try {
       if (!this.watcher) {
-        this.watcher = watch(this.directory, { persistent: false }, (_event, file2) => {
-          if (file2?.toString().toLowerCase() === "mailbox.json") this.changed();
+        this.watcher = watch(this.directory, { persistent: false }, (_event, file3) => {
+          if (file3?.toString().toLowerCase() === "mailbox.json") this.changed();
         });
         this.watcher.on("error", () => {
           this.watcher?.close();
@@ -50215,48 +50330,48 @@ var Delivery = external_exports.strictObject({ capability: external_exports.stri
 async function openNativeFabric(stateDirectory, enrollment, box, initialize = true) {
   const controllerId = "device-" + external_exports.string().uuid().parse(enrollment.deviceId).toLowerCase();
   const tenantId = external_exports.string().uuid().parse(enrollment.tenantId).toLowerCase();
-  const parent = path26.join(stateDirectory, ".local-commander"), marker = path26.join(parent, "fabric-established.json");
+  const parent = path27.join(stateDirectory, ".local-commander"), marker = path27.join(parent, "fabric-established.json");
   try {
-    await mkdir12(parent, { mode: 448 });
+    await mkdir13(parent, { mode: 448 });
   } catch (error62) {
     if (error62.code !== "EEXIST") throw error62;
   }
-  const parentInfo = await lstat12(parent);
+  const parentInfo = await lstat13(parent);
   if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
   const expected = JSON.stringify({ version: 1, controllerId, tenantId });
   let fresh = false;
   try {
-    const info = await lstat12(marker);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile10(marker, "utf8") !== expected)
+    const info = await lstat13(marker);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile11(marker, "utf8") !== expected)
       throw Error("FABRIC_BINDING_CHANGED");
   } catch (error62) {
     if (error62.code !== "ENOENT" || !initialize) throw error62;
-    const file2 = await open11(marker, "wx", 384);
+    const file3 = await open11(marker, "wx", 384);
     try {
-      await file2.writeFile(expected);
-      await file2.datasync();
+      await file3.writeFile(expected);
+      await file3.datasync();
     } finally {
-      await file2.close();
+      await file3.close();
     }
     fresh = true;
   }
   const service2 = await AgentFabricService.open(
-    path26.join(stateDirectory, ".local-commander", "fabric"),
+    path27.join(stateDirectory, ".local-commander", "fabric"),
     controllerId,
     { deviceId: enrollment.deviceId.toLowerCase(), enrollmentEvidenceRef: "enrollment-" + tenantId },
     fresh
   );
   const purpose = "native-fabric:" + tenantId + ":" + controllerId;
-  const credentialFile = (workerId) => path26.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
+  const credentialFile = (workerId) => path27.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
   const decode4 = (value) => {
     const credential = Credential.parse(JSON.parse(box.open(Buffer.from(value, "base64"), purpose).toString("utf8")));
     if (credential.controllerId !== controllerId) throw Error("FABRIC_WORKER_DENIED");
     return credential;
   };
   async function capability(workerId) {
-    const file2 = credentialFile(workerId), info = await lstat12(file2);
+    const file3 = credentialFile(workerId), info = await lstat13(file3);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw Error("FABRIC_CREDENTIAL_UNKNOWN");
-    const encoded = await readFile10(file2, "utf8");
+    const encoded = await readFile11(file3, "utf8");
     if (decode4(encoded).workerId !== workerId) throw Error("FABRIC_WORKER_DENIED");
     return encoded;
   }
@@ -50289,12 +50404,12 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
         } else {
           const credential = await service2.identities.issue();
           const encoded = box.seal(Buffer.from(JSON.stringify({ ...credential, workerId: worker.workerId, controllerId })), purpose).toString("base64");
-          const file2 = await open11(credentialFile(worker.workerId), "wx", 384);
+          const file3 = await open11(credentialFile(worker.workerId), "wx", 384);
           try {
-            await file2.writeFile(encoded);
-            await file2.datasync();
+            await file3.writeFile(encoded);
+            await file3.datasync();
           } finally {
-            await file2.close();
+            await file3.close();
           }
           await service2.mailbox.bindRuntime(worker.workerId, credential);
         }
@@ -50348,7 +50463,7 @@ async function readFabricRequest(input2 = process.stdin) {
 // agent/src/supervisor-liveness.ts
 import { spawn as spawn6 } from "node:child_process";
-import path27 from "node:path";
+import path28 from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 var ROW = /^"([^"]+)","(\d{1,10})"/;
 function parseTasklist(output2, image) {
@@ -50363,7 +50478,7 @@ function parseTasklist(output2, image) {
 }
 function listProcesses(image, timeoutMs2 = 5e3) {
   if (process.platform !== "win32" || !/^[A-Za-z0-9._-]{1,64}\.exe$/i.test(image)) return Promise.resolve(null);
-  const tasklist = path27.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
+  const tasklist = path28.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
   return new Promise((resolve) => {
     let output2 = "", settled = false;
     const finish = (value) => {
@@ -50392,8 +50507,8 @@ function listProcesses(image, timeoutMs2 = 5e3) {
 }
 function supervisorLiveness(helperPath, options = {}) {
   if (process.platform === "linux" && !options.list) return linuxSupervisorLiveness;
-  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path27.join(path27.dirname(helperPath), "posix-host"), pids, darwin);
-  const image = path27.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
+  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path28.join(path28.dirname(helperPath), "posix-host"), pids, darwin);
+  const image = path28.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
   return async (pids) => {
     const deadline = Date.now() + waitMs;
     for (; ; ) {
@@ -50408,17 +50523,17 @@ function supervisorLiveness(helperPath, options = {}) {
 // agent/src/content-audit.ts
 import { createReadStream } from "node:fs";
-import { appendFile, lstat as lstat13, mkdir as mkdir13, open as open12, readdir as readdir6, readFile as readFile11, rename as rename8, rm as rm9, writeFile as writeFile4 } from "node:fs/promises";
-import path28 from "node:path";
+import { appendFile, lstat as lstat14, mkdir as mkdir14, open as open12, readdir as readdir6, readFile as readFile12, rename as rename9, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
+import path29 from "node:path";
 import { performance as performance3 } from "node:perf_hooks";
 import { createInterface as createInterface2 } from "node:readline";
 import { randomBytes as randomBytes10 } from "node:crypto";
 // src/audit-crypto.ts
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, createHash as createHash20, randomBytes as randomBytes9 } from "node:crypto";
-import { promisify as promisify3 } from "node:util";
+import { promisify as promisify4 } from "node:util";
 import { gunzipSync, gzip, gzipSync } from "node:zlib";
-var gzipAsync = promisify3(gzip);
+var gzipAsync = promisify4(gzip);
 var AUDIT_ENCRYPTION_ALGORITHM = "A256GCM";
 var AUDIT_COMPRESSION = "gzip";
 var AUDIT_RECOVERY_KEY_PREFIX = "lca1_";
@@ -50578,11 +50693,11 @@ var FILE = /^(full|metrics)-(\d{4}-\d{2}-\d{2})\.jsonl$/;
 var PAUSED_FILE = "paused.json";
 var DAY_MS = 864e5;
 function contentAuditDirectory(stateDir) {
-  return path28.join(path28.dirname(path28.resolve(stateDir)), "Audit");
+  return path29.join(path29.dirname(path29.resolve(stateDir)), "Audit");
 }
 async function plainDirectory(dir) {
-  await mkdir13(dir, { recursive: true, mode: 448 });
-  const info = await lstat13(dir);
+  await mkdir14(dir, { recursive: true, mode: 448 });
+  const info = await lstat14(dir);
   if (info.isSymbolicLink() || !info.isDirectory()) throw Error("AUDIT_DIRECTORY_INVALID");
 }
 async function auditFiles(dir) {
@@ -50597,18 +50712,18 @@ async function auditFiles(dir) {
   for (const name2 of names) {
     const match = FILE.exec(name2);
     if (!match) continue;
-    const info = await lstat13(path28.join(dir, name2));
+    const info = await lstat14(path29.join(dir, name2));
     if (info.isFile()) files.push({ name: name2, kind: match[1], day: match[2], bytes: info.size });
   }
   return files.sort((a, b) => a.name.localeCompare(b.name));
 }
-async function writeJsonAtomic(file2, value) {
-  const temp = `${file2}.${randomBytes10(6).toString("hex")}.tmp`;
+async function writeJsonAtomic(file3, value) {
+  const temp = `${file3}.${randomBytes10(6).toString("hex")}.tmp`;
   try {
-    await writeFile4(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
-    await rename8(temp, file2);
+    await writeFile5(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
+    await rename9(temp, file3);
   } finally {
-    await rm9(temp, { force: true }).catch(() => {
+    await rm10(temp, { force: true }).catch(() => {
     });
   }
 }
@@ -50635,7 +50750,7 @@ var ContentAudit = class _ContentAudit {
   skipped = 0;
   closed = false;
   static async open(options) {
-    const dir = path28.resolve(options.directory);
+    const dir = path29.resolve(options.directory);
     await plainDirectory(dir);
     const audit = new _ContentAudit(
       dir,
@@ -50644,7 +50759,7 @@ var ContentAudit = class _ContentAudit {
       { retentionDays: options.retentionDays ?? AUDIT_RETENTION_DAYS, maxBytes: options.maxBytes ?? AUDIT_MAX_BYTES },
       options.now ?? (() => /* @__PURE__ */ new Date())
     );
-    await rm9(path28.join(dir, PAUSED_FILE), { force: true });
+    await rm10(path29.join(dir, PAUSED_FILE), { force: true });
     await audit.rollover(audit.now());
     if (audit.usedBytes >= audit.limits.maxBytes) await audit.pause("QUOTA_EXCEEDED");
     return audit;
@@ -50714,8 +50829,8 @@ var ContentAudit = class _ContentAudit {
       await this.pause("QUOTA_EXCEEDED");
       return;
     }
-    await appendFile(path28.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
-    await appendFile(path28.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
+    await appendFile(path29.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
+    await appendFile(path29.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
     this.usedBytes += bytes3;
   }
   /** Daily retention runs on the first write of a new day; no timer or background scan. */
@@ -50723,16 +50838,16 @@ var ContentAudit = class _ContentAudit {
     this.day = at.toISOString().slice(0, 10);
     const cutoff = new Date(at.getTime() - this.limits.retentionDays * DAY_MS).toISOString().slice(0, 10);
     let used = 0;
-    for (const file2 of await auditFiles(this.dir)) {
-      if (file2.day <= cutoff) await rm9(path28.join(this.dir, file2.name), { force: true });
-      else used += file2.bytes;
+    for (const file3 of await auditFiles(this.dir)) {
+      if (file3.day <= cutoff) await rm10(path29.join(this.dir, file3.name), { force: true });
+      else used += file3.bytes;
     }
     this.usedBytes = used;
   }
   async pause(reason) {
     if (this.paused) return;
     this.paused = reason;
-    await writeJsonAtomic(path28.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
+    await writeJsonAtomic(path29.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
   }
 };
 function percentiles(values) {
@@ -50741,8 +50856,8 @@ function percentiles(values) {
   const at = (fraction) => sorted[Math.min(sorted.length - 1, Math.ceil(fraction * sorted.length) - 1)];
   return { p50: at(0.5), p95: at(0.95), max: sorted[sorted.length - 1] };
 }
-async function* jsonLines(file2) {
-  const lines = createInterface2({ input: createReadStream(file2, { encoding: "utf8" }), crlfDelay: Infinity });
+async function* jsonLines(file3) {
+  const lines = createInterface2({ input: createReadStream(file3, { encoding: "utf8" }), crlfDelay: Infinity });
   for await (const line of lines) {
     if (!line.trim()) continue;
     try {
@@ -50754,17 +50869,17 @@ async function* jsonLines(file2) {
 }
 var count2 = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
 async function summarizeContentAudit(directory, key) {
-  const dir = path28.resolve(directory);
+  const dir = path29.resolve(directory);
   const files = await auditFiles(dir);
   const days = /* @__PURE__ */ new Map();
   const sizes = [];
   const timings = [];
-  for (const file2 of files.filter((f) => f.kind === "metrics")) {
-    for await (const line of jsonLines(path28.join(dir, file2.name))) {
-      let day = days.get(file2.day);
+  for (const file3 of files.filter((f) => f.kind === "metrics")) {
+    for await (const line of jsonLines(path29.join(dir, file3.name))) {
+      let day = days.get(file3.day);
       if (!day) {
-        day = { day: file2.day, records: 0, failed: 0, rawBytes: 0, sanitizedBytes: 0, compressedBytes: 0, envelopeBytes: 0 };
-        days.set(file2.day, day);
+        day = { day: file3.day, records: 0, failed: 0, rawBytes: 0, sanitizedBytes: 0, compressedBytes: 0, envelopeBytes: 0 };
+        days.set(file3.day, day);
       }
       day.records += 1;
       if (line.resultCode !== "SUCCESS") day.failed += 1;
@@ -50780,7 +50895,7 @@ async function summarizeContentAudit(directory, key) {
   }
   let paused = null;
   try {
-    const value = JSON.parse(await readFile11(path28.join(dir, PAUSED_FILE), "utf8"));
+    const value = JSON.parse(await readFile12(path29.join(dir, PAUSED_FILE), "utf8"));
     if (typeof value.reason === "string" && typeof value.at === "string") paused = { reason: value.reason.slice(0, 40), at: value.at.slice(0, 40) };
   } catch {
   }
@@ -50788,7 +50903,7 @@ async function summarizeContentAudit(directory, key) {
   const newest = files.filter((f) => f.kind === "full").at(-1);
   if (key && newest) {
     const tail = [];
-    for await (const line of jsonLines(path28.join(dir, newest.name))) {
+    for await (const line of jsonLines(path29.join(dir, newest.name))) {
       tail.push(line);
       if (tail.length > 5) tail.shift();
     }
@@ -50806,7 +50921,7 @@ async function summarizeContentAudit(directory, key) {
   const rawBytes = total("rawBytes"), envelopeBytes = total("envelopeBytes");
   return {
     directory: dir,
-    fileBytes: files.reduce((sum, file2) => sum + file2.bytes, 0),
+    fileBytes: files.reduce((sum, file3) => sum + file3.bytes, 0),
     paused,
     records: total("records"),
     rawBytes,
@@ -50822,10 +50937,10 @@ async function summarizeContentAudit(directory, key) {
   };
 }
 async function restoreContentAudit(input2, output2, key) {
-  const handle = await open12(path28.resolve(output2), "wx", 384);
+  const handle = await open12(path29.resolve(output2), "wx", 384);
   let records = 0, failed = 0;
   try {
-    for await (const line of jsonLines(path28.resolve(input2))) {
+    for await (const line of jsonLines(path29.resolve(input2))) {
       try {
         await handle.appendFile(JSON.stringify(decryptAuditRecord(line, key)) + "\n");
         records += 1;
@@ -50840,9 +50955,10 @@ async function restoreContentAudit(input2, output2, key) {
 }
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.49" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.51" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
+var QUARANTINE_RETRY_MS = 6e4;
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -50853,11 +50969,11 @@ function processAlive(pid) {
   }
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
-  await mkdir14(stateDir, { recursive: true });
-  const file2 = path29.join(stateDir, "agent-process.json");
+  await mkdir15(stateDir, { recursive: true });
+  const file3 = path30.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await open13(file2, "wx", 384);
+      const handle = await open13(file3, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, runtimeDir, version: version2, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n", "utf8");
       } finally {
@@ -50865,8 +50981,8 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       }
       return async () => {
         try {
-          const current2 = JSON.parse(await readFile12(file2, "utf8"));
-          if (current2.pid === process.pid) await rm10(file2, { force: true });
+          const current2 = JSON.parse(await readFile13(file3, "utf8"));
+          if (current2.pid === process.pid) await rm11(file3, { force: true });
         } catch {
         }
       };
@@ -50874,12 +50990,12 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       if (!error62 || typeof error62 !== "object" || !("code" in error62) || error62.code !== "EEXIST") throw error62;
       let stale = true;
       try {
-        const current2 = JSON.parse(await readFile12(file2, "utf8"));
+        const current2 = JSON.parse(await readFile13(file3, "utf8"));
         stale = typeof current2.pid !== "number" || !processAlive(current2.pid);
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm10(file2, { force: true });
+      await rm11(file3, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -50988,7 +51104,7 @@ async function runAgent(options) {
   try {
     while (!options.signal.aborted) {
       computerName = await readComputerName();
-      let ready;
+      let ready, wait = delay4;
       const readyPromise = new Promise((resolve) => {
         ready = resolve;
       });
@@ -51002,6 +51118,7 @@ async function runAgent(options) {
           safeSlots: runtime.status().safeSlots,
           status: () => runtime.status(),
           onIncidentAck: (ack) => incidentProducer.ack(ack),
+          onFullLogChoice: options.onFullLogChoice,
           // After bridge.connected, like requests: the journal has recorded this connection first.
           onHeldLeases: (bindings) => {
             void readyPromise.then(() => bridge.heldLeases(bindings)).catch(() => {
@@ -51077,6 +51194,8 @@ async function runAgent(options) {
         ready();
         monitor(() => options.monitor?.connectionFailed(error62));
         if (error62 instanceof RelayClientError && ["RELAY_CONNECT_FAILED", "RELAY_CONNECT_CLOSED", "RELAY_CONNECT_TIMEOUT", "RELAY_HANDSHAKE_TIMEOUT"].includes(error62.code)) {
+        } else if (error62 instanceof RelayClientError && error62.code === "RELAY_DEVICE_QUARANTINED") {
+          wait = Math.max(delay4, QUARANTINE_RETRY_MS);
         } else throw error62;
       } finally {
         connectivity?.close();
@@ -51090,11 +51209,15 @@ async function runAgent(options) {
         incidentProducer.disconnected();
         if (!options.signal.aborted) supervisor.observe({ kind: "disconnected" });
         monitor(() => options.monitor?.setConnection("disconnected"));
+        try {
+          options.onFullLogChoice?.(null);
+        } catch {
+        }
         connection?.close("agent_disconnect");
         await bridge.disconnected();
         connection = null;
       }
-      if (!options.signal.aborted) await aborted2(options.signal, delay4);
+      if (!options.signal.aborted) await aborted2(options.signal, wait);
     }
   } finally {
     try {
@@ -51130,10 +51253,10 @@ async function openContentAudit(store, stateDir) {
 async function main() {
   if (!["win32", "linux", "darwin"].includes(process.platform)) throw Error("PLATFORM_UNSUPPORTED");
   const appData = process.env.LC_AGENT_DATA_DIR ?? (process.platform === "win32" ? process.env.LOCALAPPDATA : posixDataHome());
-  if (!appData || !path29.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path29.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path29.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path29.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
+  if (!appData || !path30.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path30.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path30.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path30.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (process.platform !== "win32" && (command.startsWith("guard-") || command.startsWith("network-"))) throw Error("FEATURE_PLATFORM_UNSUPPORTED");
@@ -51152,7 +51275,8 @@ async function main() {
     process.stdout.write(JSON.stringify({
       paired: !!identity?.enrollment,
       accountEmail: identity?.enrollment?.accountEmail ?? null,
-      deviceId: identity?.enrollment?.deviceId ?? null
+      deviceId: identity?.enrollment?.deviceId ?? null,
+      fullLogs: await readFullLogNotice(stateDir, identity?.enrollment)
     }) + "\n");
     return;
   }
@@ -51228,7 +51352,7 @@ async function main() {
   }
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path29.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path30.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -51238,7 +51362,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path29.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path30.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -51257,7 +51381,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path30.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -51269,7 +51393,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path29.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path30.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -51347,33 +51471,39 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
-  const monitor = new ProductionMonitor(path29.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path30.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
   const publishMonitor = () => monitor.flush().catch(() => {
     process.stderr.write("MONITOR_WRITE_FAILED\n");
   });
   await publishMonitor();
   try {
     const journal = await NativeJournal.open(
-      path29.join(stateDir, "journal"),
+      path30.join(stateDir, "journal"),
       new SecretBox({ "1": await store.loadDataKey() }),
-      process.platform === "win32" ? {} : { lockHelper: path29.join(binaryDir, "posix-host") }
+      process.platform === "win32" ? {} : { lockHelper: path30.join(binaryDir, "posix-host") }
     );
     const ledgerLoss = () => {
       process.stderr.write("OPTIMIZATION_TELEMETRY_INCOMPLETE\n");
     };
     const efficiencyLedger = await new OptionalWork(ledgerLoss, 1e3, 1).run(
-      () => OptimizationLedger.open(path29.join(stateDir, "optimization")),
+      () => OptimizationLedger.open(path30.join(stateDir, "optimization")),
       void 0,
       (ledger) => ledger.close()
     );
     try {
-      const helperPath = process.env.LC_JOB_HOST ?? path29.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
+      const helperPath = process.env.LC_JOB_HOST ?? path30.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
       const tools = new NativeTools({ stateDirectory: stateDir, helperPath, ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
       process.once("SIGTERM", () => stop.abort());
       const guard = await NativeGuard.open(store, journal);
       const enrollment = (await store.load()).enrollment;
+      const fullLogNotice = new FullLogNotice(stateDir, enrollment);
+      const onFullLogChoice = (enabled) => {
+        void fullLogNotice.update(enabled).catch(() => {
+        });
+      };
+      onFullLogChoice(null);
       const fabric = await openNativeFabric(stateDir, enrollment, new SecretBox({ "1": await store.loadDataKey() })).catch(() => {
         process.stderr.write("FABRIC_STARTUP_FAILED\n");
         return void 0;
@@ -51402,6 +51532,7 @@ async function main() {
             guard,
             efficiencyLedger,
             monitor,
+            onFullLogChoice,
             localDirect: { key: localDirectKey(await store.loadDataKey()), directory: localDirectDirectory(appData) },
             supervisorLiveness: supervisorLiveness(helperPath),
             ...proxyMode ? { proxyMode: { providers: proxyMode.providers, publicKeyPem: NETWORK_PUBLIC_KEY, endpoint: proxyEndpoint, onState: onProxyState } } : {},
@@ -51438,7 +51569,7 @@ async function main() {
     await releaseProcess();
   }
 }
-var entrypoint = process.argv[1] && (process.platform === "win32" ? path29.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
+var entrypoint = process.argv[1] && (process.platform === "win32" ? path30.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
 if (entrypoint === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";