local-commander-agent 0.3.5 → 0.3.7

package/runtime/agent.mjs

@@ -39,9 +39,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/ws/lib/constants.js
+// ../../node_modules/ws/lib/constants.js
 var require_constants = __commonJS({
-  "node_modules/ws/lib/constants.js"(exports, module) {
+  "../../node_modules/ws/lib/constants.js"(exports, module) {
     "use strict";
     var BINARY_TYPES = ["nodebuffer", "arraybuffer", "fragments"];
     var hasBlob = typeof Blob !== "undefined";
@@ -62,9 +62,9 @@ var require_constants = __commonJS({
   }
 });
 
-// node_modules/ws/lib/buffer-util.js
+// ../../node_modules/ws/lib/buffer-util.js
 var require_buffer_util = __commonJS({
-  "node_modules/ws/lib/buffer-util.js"(exports, module) {
+  "../../node_modules/ws/lib/buffer-util.js"(exports, module) {
     "use strict";
     var { EMPTY_BUFFER } = require_constants();
     var FastBuffer = Buffer[Symbol.species];
@@ -137,9 +137,9 @@ var require_buffer_util = __commonJS({
   }
 });
 
-// node_modules/ws/lib/limiter.js
+// ../../node_modules/ws/lib/limiter.js
 var require_limiter = __commonJS({
-  "node_modules/ws/lib/limiter.js"(exports, module) {
+  "../../node_modules/ws/lib/limiter.js"(exports, module) {
     "use strict";
     var kDone = /* @__PURE__ */ Symbol("kDone");
     var kRun = /* @__PURE__ */ Symbol("kRun");
@@ -187,9 +187,9 @@ var require_limiter = __commonJS({
   }
 });
 
-// node_modules/ws/lib/permessage-deflate.js
+// ../../node_modules/ws/lib/permessage-deflate.js
 var require_permessage_deflate = __commonJS({
-  "node_modules/ws/lib/permessage-deflate.js"(exports, module) {
+  "../../node_modules/ws/lib/permessage-deflate.js"(exports, module) {
     "use strict";
     var zlib = __require("zlib");
     var bufferUtil = require_buffer_util();
@@ -570,9 +570,9 @@ var require_permessage_deflate = __commonJS({
   }
 });
 
-// node_modules/ws/lib/validation.js
+// ../../node_modules/ws/lib/validation.js
 var require_validation = __commonJS({
-  "node_modules/ws/lib/validation.js"(exports, module) {
+  "../../node_modules/ws/lib/validation.js"(exports, module) {
     "use strict";
     var { isUtf8 } = __require("buffer");
     var { hasBlob } = require_constants();
@@ -771,9 +771,9 @@ var require_validation = __commonJS({
   }
 });
 
-// node_modules/ws/lib/receiver.js
+// ../../node_modules/ws/lib/receiver.js
 var require_receiver = __commonJS({
-  "node_modules/ws/lib/receiver.js"(exports, module) {
+  "../../node_modules/ws/lib/receiver.js"(exports, module) {
     "use strict";
     var { Writable } = __require("stream");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -1394,9 +1394,9 @@ var require_receiver = __commonJS({
   }
 });
 
-// node_modules/ws/lib/sender.js
+// ../../node_modules/ws/lib/sender.js
 var require_sender = __commonJS({
-  "node_modules/ws/lib/sender.js"(exports, module) {
+  "../../node_modules/ws/lib/sender.js"(exports, module) {
     "use strict";
     var { Duplex } = __require("stream");
     var { randomFillSync } = __require("crypto");
@@ -1887,9 +1887,9 @@ var require_sender = __commonJS({
   }
 });
 
-// node_modules/ws/lib/event-target.js
+// ../../node_modules/ws/lib/event-target.js
 var require_event_target = __commonJS({
-  "node_modules/ws/lib/event-target.js"(exports, module) {
+  "../../node_modules/ws/lib/event-target.js"(exports, module) {
     "use strict";
     var { kForOnEventAttribute, kListener } = require_constants();
     var kCode = /* @__PURE__ */ Symbol("kCode");
@@ -2116,9 +2116,9 @@ var require_event_target = __commonJS({
   }
 });
 
-// node_modules/ws/lib/extension.js
+// ../../node_modules/ws/lib/extension.js
 var require_extension = __commonJS({
-  "node_modules/ws/lib/extension.js"(exports, module) {
+  "../../node_modules/ws/lib/extension.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
     function push(dest, name2, elem) {
@@ -2269,16 +2269,16 @@ var require_extension = __commonJS({
   }
 });
 
-// node_modules/ws/lib/websocket.js
+// ../../node_modules/ws/lib/websocket.js
 var require_websocket = __commonJS({
-  "node_modules/ws/lib/websocket.js"(exports, module) {
+  "../../node_modules/ws/lib/websocket.js"(exports, module) {
     "use strict";
     var EventEmitter = __require("events");
     var https = __require("https");
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash10 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash11 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2959,7 +2959,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash11("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest4) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3178,9 +3178,9 @@ var require_websocket = __commonJS({
   }
 });
 
-// node_modules/ws/lib/stream.js
+// ../../node_modules/ws/lib/stream.js
 var require_stream = __commonJS({
-  "node_modules/ws/lib/stream.js"(exports, module) {
+  "../../node_modules/ws/lib/stream.js"(exports, module) {
     "use strict";
     var WebSocket2 = require_websocket();
     var { Duplex } = __require("stream");
@@ -3240,7 +3240,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._final(callback);
           });
           return;
@@ -3261,7 +3261,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -3276,9 +3276,9 @@ var require_stream = __commonJS({
   }
 });
 
-// node_modules/ws/lib/subprotocol.js
+// ../../node_modules/ws/lib/subprotocol.js
 var require_subprotocol = __commonJS({
-  "node_modules/ws/lib/subprotocol.js"(exports, module) {
+  "../../node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
     function parse3(header) {
@@ -3321,14 +3321,14 @@ var require_subprotocol = __commonJS({
   }
 });
 
-// node_modules/ws/lib/websocket-server.js
+// ../../node_modules/ws/lib/websocket-server.js
 var require_websocket_server = __commonJS({
-  "node_modules/ws/lib/websocket-server.js"(exports, module) {
+  "../../node_modules/ws/lib/websocket-server.js"(exports, module) {
     "use strict";
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash10 } = __require("crypto");
+    var { createHash: createHash11 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3635,7 +3635,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash11("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3723,9 +3723,9 @@ var require_websocket_server = __commonJS({
 });
 
 // agent/src/main.ts
-import path12 from "node:path";
+import path14 from "node:path";
 import os3 from "node:os";
-import { mkdir as mkdir5, open as open6, readFile as readFile5, rm as rm4 } from "node:fs/promises";
+import { mkdir as mkdir6, open as open7, readFile as readFile5, rm as rm5 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -3858,7 +3858,7 @@ var Utf8OutputTailBuffer = class {
   }
 };
 
-// node_modules/zod/v4/classic/external.js
+// ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
   $brand: () => $brand,
@@ -4121,7 +4121,7 @@ __export(external_exports, {
   xor: () => xor
 });
 
-// node_modules/zod/v4/core/index.js
+// ../../node_modules/zod/v4/core/index.js
 var core_exports2 = {};
 __export(core_exports2, {
   $ZodAny: () => $ZodAny,
@@ -4438,7 +4438,7 @@ __export(core_exports2, {
   withParser: () => withParser
 });
 
-// node_modules/zod/v4/core/util.js
+// ../../node_modules/zod/v4/core/util.js
 var util_exports = {};
 __export(util_exports, {
   BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
@@ -4674,10 +4674,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path13) {
-  if (!path13)
+function getElementAtPath(obj, path15) {
+  if (!path15)
     return obj;
-  return path13.reduce((acc, key) => acc?.[key], obj);
+  return path15.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -5017,11 +5017,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path13, issues) {
+function prefixIssues(path15, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path13);
+    iss.path.unshift(path15);
     return iss;
   });
 }
@@ -5281,7 +5281,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// node_modules/zod/v4/core/core.js
+// ../../node_modules/zod/v4/core/core.js
 var _a;
 var NEVER = /* @__PURE__ */ Object.freeze({
   status: "aborted"
@@ -5403,7 +5403,7 @@ function config(newConfig) {
   return globalConfig;
 }
 
-// node_modules/zod/v4/core/errors.js
+// ../../node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -5471,16 +5471,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path13 = []) => {
+  const processError = (error63, path15 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path13, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5519,17 +5519,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path13 = []) => {
+  const processError = (error63, path15 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path13, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5568,8 +5568,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path13) {
+  const path15 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path15) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -5595,7 +5595,7 @@ function prettifyError(error62) {
   return lines.join("\n");
 }
 
-// node_modules/zod/v4/core/parse.js
+// ../../node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -5755,7 +5755,7 @@ var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 };
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
 
-// node_modules/zod/v4/core/regexes.js
+// ../../node_modules/zod/v4/core/regexes.js
 var regexes_exports = {};
 __export(regexes_exports, {
   anyString: () => anyString,
@@ -5927,7 +5927,7 @@ var sha512_hex = /^[0-9a-fA-F]{128}$/;
 var sha512_base64 = /* @__PURE__ */ fixedBase64(86, "==");
 var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
-// node_modules/zod/v4/core/checks.js
+// ../../node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a3;
   inst._zod ?? (inst._zod = {});
@@ -6403,7 +6403,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// node_modules/zod/v4/core/doc.js
+// ../../node_modules/zod/v4/core/doc.js
 var Doc = class {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -6444,14 +6444,14 @@ ${content.join("\n")}
   }
 };
 
-// node_modules/zod/v4/core/versions.js
+// ../../node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
   patch: 5
 };
 
-// node_modules/zod/v4/core/schemas.js
+// ../../node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a3;
   inst ?? (inst = {});
@@ -8865,7 +8865,7 @@ function handleRefineResult(result2, payload, input2, inst) {
   }
 }
 
-// node_modules/zod/v4/core/memoizer.js
+// ../../node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -9142,7 +9142,7 @@ function isBackEdge(ctx, value) {
   return backEdges !== void 0 && isRef(value) && backEdges.has(value);
 }
 
-// node_modules/zod/v4/locales/index.js
+// ../../node_modules/zod/v4/locales/index.js
 var locales_exports = {};
 __export(locales_exports, {
   ar: () => ar_default,
@@ -9210,7 +9210,7 @@ __export(locales_exports, {
   zhTW: () => zh_TW_default
 });
 
-// node_modules/zod/v4/locales/ar.js
+// ../../node_modules/zod/v4/locales/ar.js
 var error = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0641", verb: "\u0623\u0646 \u064A\u062D\u0648\u064A" },
@@ -9322,7 +9322,7 @@ function ar_default() {
   };
 }
 
-// node_modules/zod/v4/locales/az.js
+// ../../node_modules/zod/v4/locales/az.js
 var error2 = () => {
   const Sizable = {
     string: { unit: "simvol", verb: "olmal\u0131d\u0131r" },
@@ -9433,7 +9433,7 @@ function az_default() {
   };
 }
 
-// node_modules/zod/v4/locales/be.js
+// ../../node_modules/zod/v4/locales/be.js
 function getBelarusianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -9602,7 +9602,7 @@ function be_default() {
   };
 }
 
-// node_modules/zod/v4/locales/bg.js
+// ../../node_modules/zod/v4/locales/bg.js
 var error4 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0430", verb: "\u0434\u0430 \u0441\u044A\u0434\u044A\u0440\u0436\u0430" },
@@ -9728,7 +9728,7 @@ function bg_default() {
   };
 }
 
-// node_modules/zod/v4/locales/bn.js
+// ../../node_modules/zod/v4/locales/bn.js
 var error5 = () => {
   const Sizable = {
     string: { unit: "\u0985\u0995\u09CD\u09B7\u09B0", verb: "\u09A5\u09BE\u0995\u09A4\u09C7 \u09B9\u09AC\u09C7" },
@@ -9842,7 +9842,7 @@ function bn_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ca.js
+// ../../node_modules/zod/v4/locales/ca.js
 var error6 = () => {
   const Sizable = {
     string: { unit: "car\xE0cters", verb: "contenir" },
@@ -9956,7 +9956,7 @@ function ca_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ckb.js
+// ../../node_modules/zod/v4/locales/ckb.js
 var error7 = () => {
   const Sizable = {
     string: { unit: "\u067E\u06CC\u062A", verb: "\u0628\u06CE\u062A" },
@@ -10089,7 +10089,7 @@ function ckb_default() {
   };
 }
 
-// node_modules/zod/v4/locales/cs.js
+// ../../node_modules/zod/v4/locales/cs.js
 var error8 = () => {
   const Sizable = {
     string: { unit: "znak\u016F", verb: "m\xEDt" },
@@ -10206,7 +10206,7 @@ function cs_default() {
   };
 }
 
-// node_modules/zod/v4/locales/da.js
+// ../../node_modules/zod/v4/locales/da.js
 var error9 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "havde" },
@@ -10327,7 +10327,7 @@ function da_default() {
   };
 }
 
-// node_modules/zod/v4/locales/de.js
+// ../../node_modules/zod/v4/locales/de.js
 var error10 = () => {
   const Sizable = {
     string: { unit: "Zeichen", verb: "zu haben" },
@@ -10441,7 +10441,7 @@ function de_default() {
   };
 }
 
-// node_modules/zod/v4/locales/el.js
+// ../../node_modules/zod/v4/locales/el.js
 var error11 = () => {
   const Sizable = {
     string: { unit: "\u03C7\u03B1\u03C1\u03B1\u03BA\u03C4\u03AE\u03C1\u03B5\u03C2", verb: "\u03BD\u03B1 \u03AD\u03C7\u03B5\u03B9" },
@@ -10554,7 +10554,7 @@ function el_default() {
   };
 }
 
-// node_modules/zod/v4/locales/en.js
+// ../../node_modules/zod/v4/locales/en.js
 var error12 = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -10679,7 +10679,7 @@ function en_default() {
   };
 }
 
-// node_modules/zod/v4/locales/eo.js
+// ../../node_modules/zod/v4/locales/eo.js
 var error13 = () => {
   const Sizable = {
     string: { unit: "karaktrojn", verb: "havi" },
@@ -10794,7 +10794,7 @@ function eo_default() {
   };
 }
 
-// node_modules/zod/v4/locales/es.js
+// ../../node_modules/zod/v4/locales/es.js
 var error14 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "tener" },
@@ -10931,7 +10931,7 @@ function es_default() {
   };
 }
 
-// node_modules/zod/v4/locales/fa.js
+// ../../node_modules/zod/v4/locales/fa.js
 var error15 = () => {
   const Sizable = {
     string: { unit: "\u06A9\u0627\u0631\u0627\u06A9\u062A\u0631", verb: "\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F" },
@@ -11051,7 +11051,7 @@ function fa_default() {
   };
 }
 
-// node_modules/zod/v4/locales/fi.js
+// ../../node_modules/zod/v4/locales/fi.js
 var error16 = () => {
   const Sizable = {
     string: { unit: "merkki\xE4", subject: "merkkijonon" },
@@ -11169,7 +11169,7 @@ function fi_default() {
   };
 }
 
-// node_modules/zod/v4/locales/fr.js
+// ../../node_modules/zod/v4/locales/fr.js
 var error17 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11299,7 +11299,7 @@ function fr_default() {
   };
 }
 
-// node_modules/zod/v4/locales/fr-CA.js
+// ../../node_modules/zod/v4/locales/fr-CA.js
 var error18 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11412,7 +11412,7 @@ function fr_CA_default() {
   };
 }
 
-// node_modules/zod/v4/locales/gu.js
+// ../../node_modules/zod/v4/locales/gu.js
 var error19 = () => {
   const Sizable = {
     string: { unit: "\u0A85\u0A95\u0ACD\u0AB7\u0AB0", verb: "\u0AB9\u0ACB\u0AB5\u0ABE \u0A9C\u0ACB\u0A88\u0A8F" },
@@ -11526,7 +11526,7 @@ function gu_default() {
   };
 }
 
-// node_modules/zod/v4/locales/he.js
+// ../../node_modules/zod/v4/locales/he.js
 var error20 = () => {
   const TypeNames = {
     string: { label: "\u05DE\u05D7\u05E8\u05D5\u05D6\u05EA", gender: "f" },
@@ -11728,7 +11728,7 @@ function he_default() {
   };
 }
 
-// node_modules/zod/v4/locales/hi.js
+// ../../node_modules/zod/v4/locales/hi.js
 var error21 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0930\u0916\u0928\u0947 \u0915\u0947 \u0932\u093F\u090F" },
@@ -11840,7 +11840,7 @@ function hi_default() {
   };
 }
 
-// node_modules/zod/v4/locales/hr.js
+// ../../node_modules/zod/v4/locales/hr.js
 var error22 = () => {
   const Sizable = {
     string: { unit: "znakova", verb: "imati" },
@@ -11967,7 +11967,7 @@ function hr_default() {
   };
 }
 
-// node_modules/zod/v4/locales/hu.js
+// ../../node_modules/zod/v4/locales/hu.js
 var error23 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "legyen" },
@@ -12081,7 +12081,7 @@ function hu_default() {
   };
 }
 
-// node_modules/zod/v4/locales/hy.js
+// ../../node_modules/zod/v4/locales/hy.js
 function getArmenianPlural(count, one, many) {
   return Math.abs(count) === 1 ? one : many;
 }
@@ -12240,7 +12240,7 @@ function hy_default() {
   };
 }
 
-// node_modules/zod/v4/locales/id.js
+// ../../node_modules/zod/v4/locales/id.js
 var error25 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "memiliki" },
@@ -12352,7 +12352,7 @@ function id_default() {
   };
 }
 
-// node_modules/zod/v4/locales/is.js
+// ../../node_modules/zod/v4/locales/is.js
 var error26 = () => {
   const Sizable = {
     string: { unit: "stafi", verb: "a\xF0 hafa" },
@@ -12467,7 +12467,7 @@ function is_default() {
   };
 }
 
-// node_modules/zod/v4/locales/it.js
+// ../../node_modules/zod/v4/locales/it.js
 var error27 = () => {
   const Sizable = {
     string: { unit: "caratteri", verb: "avere" },
@@ -12581,7 +12581,7 @@ function it_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ja.js
+// ../../node_modules/zod/v4/locales/ja.js
 var error28 = () => {
   const Sizable = {
     string: { unit: "\u6587\u5B57", verb: "\u3067\u3042\u308B" },
@@ -12694,7 +12694,7 @@ function ja_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ka.js
+// ../../node_modules/zod/v4/locales/ka.js
 var error29 = () => {
   const Sizable = {
     string: { unit: "\u10E1\u10D8\u10DB\u10D1\u10DD\u10DA\u10DD", verb: "\u10E3\u10DC\u10D3\u10D0 \u10E8\u10D4\u10D8\u10EA\u10D0\u10D5\u10D3\u10D4\u10E1" },
@@ -12812,7 +12812,7 @@ function ka_default() {
   };
 }
 
-// node_modules/zod/v4/locales/km.js
+// ../../node_modules/zod/v4/locales/km.js
 var error30 = () => {
   const Sizable = {
     string: { unit: "\u178F\u17BD\u17A2\u1780\u17D2\u179F\u179A", verb: "\u1782\u17BD\u179A\u1798\u17B6\u1793" },
@@ -12928,12 +12928,12 @@ function km_default() {
   };
 }
 
-// node_modules/zod/v4/locales/kh.js
+// ../../node_modules/zod/v4/locales/kh.js
 function kh_default() {
   return km_default();
 }
 
-// node_modules/zod/v4/locales/kn.js
+// ../../node_modules/zod/v4/locales/kn.js
 var error31 = () => {
   const Sizable = {
     string: { unit: "\u0C85\u0C95\u0CCD\u0CB7\u0CB0\u0C97\u0CB3\u0CC1", verb: "\u0CB9\u0CCA\u0C82\u0CA6\u0CB2\u0CC1" },
@@ -13049,7 +13049,7 @@ function kn_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ko.js
+// ../../node_modules/zod/v4/locales/ko.js
 var error32 = () => {
   const Sizable = {
     string: { unit: "\uBB38\uC790", verb: "to have" },
@@ -13166,7 +13166,7 @@ function ko_default() {
   };
 }
 
-// node_modules/zod/v4/locales/lt.js
+// ../../node_modules/zod/v4/locales/lt.js
 var capitalizeFirstCharacter = (text2) => {
   return text2.charAt(0).toUpperCase() + text2.slice(1);
 };
@@ -13374,7 +13374,7 @@ function lt_default() {
   };
 }
 
-// node_modules/zod/v4/locales/mk.js
+// ../../node_modules/zod/v4/locales/mk.js
 var error34 = () => {
   const Sizable = {
     string: { unit: "\u0437\u043D\u0430\u0446\u0438", verb: "\u0434\u0430 \u0438\u043C\u0430\u0430\u0442" },
@@ -13489,7 +13489,7 @@ function mk_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ms.js
+// ../../node_modules/zod/v4/locales/ms.js
 var error35 = () => {
   const Sizable = {
     string: { unit: "aksara", verb: "mempunyai" },
@@ -13602,7 +13602,7 @@ function ms_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ne.js
+// ../../node_modules/zod/v4/locales/ne.js
 var error36 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0939\u0941\u0928\u0941\u092A\u0930\u094D\u091B" },
@@ -13714,7 +13714,7 @@ function ne_default() {
   };
 }
 
-// node_modules/zod/v4/locales/nl.js
+// ../../node_modules/zod/v4/locales/nl.js
 var error37 = () => {
   const Sizable = {
     string: { unit: "tekens", verb: "heeft" },
@@ -13830,7 +13830,7 @@ function nl_default() {
   };
 }
 
-// node_modules/zod/v4/locales/nn.js
+// ../../node_modules/zod/v4/locales/nn.js
 var error38 = () => {
   const Sizable = {
     string: { unit: "teikn", verb: "\xE5 ha" },
@@ -13944,7 +13944,7 @@ function nn_default() {
   };
 }
 
-// node_modules/zod/v4/locales/no.js
+// ../../node_modules/zod/v4/locales/no.js
 var error39 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "\xE5 ha" },
@@ -14058,7 +14058,7 @@ function no_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ota.js
+// ../../node_modules/zod/v4/locales/ota.js
 var error40 = () => {
   const Sizable = {
     string: { unit: "harf", verb: "olmal\u0131d\u0131r" },
@@ -14173,7 +14173,7 @@ function ota_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ps.js
+// ../../node_modules/zod/v4/locales/ps.js
 var error41 = () => {
   const Sizable = {
     string: { unit: "\u062A\u0648\u06A9\u064A", verb: "\u0648\u0644\u0631\u064A" },
@@ -14293,7 +14293,7 @@ function ps_default() {
   };
 }
 
-// node_modules/zod/v4/locales/pl.js
+// ../../node_modules/zod/v4/locales/pl.js
 var error42 = () => {
   const Sizable = {
     string: { unit: "znak\xF3w", verb: "mie\u0107" },
@@ -14408,7 +14408,7 @@ function pl_default() {
   };
 }
 
-// node_modules/zod/v4/locales/pt.js
+// ../../node_modules/zod/v4/locales/pt.js
 var error43 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14552,7 +14552,7 @@ function pt_default() {
   };
 }
 
-// node_modules/zod/v4/locales/pt-BR.js
+// ../../node_modules/zod/v4/locales/pt-BR.js
 var error44 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14697,7 +14697,7 @@ function pt_BR_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ro.js
+// ../../node_modules/zod/v4/locales/ro.js
 var error45 = () => {
   const Sizable = {
     string: { unit: "caractere", verb: "s\u0103 aib\u0103" },
@@ -14820,7 +14820,7 @@ function ro_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ru.js
+// ../../node_modules/zod/v4/locales/ru.js
 function getRussianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -14989,7 +14989,7 @@ function ru_default() {
   };
 }
 
-// node_modules/zod/v4/locales/sk.js
+// ../../node_modules/zod/v4/locales/sk.js
 var error47 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "ma\u0165" },
@@ -15106,7 +15106,7 @@ function sk_default() {
   };
 }
 
-// node_modules/zod/v4/locales/sl.js
+// ../../node_modules/zod/v4/locales/sl.js
 var error48 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "imeti" },
@@ -15221,7 +15221,7 @@ function sl_default() {
   };
 }
 
-// node_modules/zod/v4/locales/sv.js
+// ../../node_modules/zod/v4/locales/sv.js
 var error49 = () => {
   const Sizable = {
     string: { unit: "tecken", verb: "att ha" },
@@ -15337,7 +15337,7 @@ function sv_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ta.js
+// ../../node_modules/zod/v4/locales/ta.js
 var error50 = () => {
   const Sizable = {
     string: { unit: "\u0B8E\u0BB4\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1\u0B95\u0BCD\u0B95\u0BB3\u0BCD", verb: "\u0B95\u0BCA\u0BA3\u0BCD\u0B9F\u0BBF\u0BB0\u0BC1\u0B95\u0BCD\u0B95 \u0BB5\u0BC7\u0BA3\u0BCD\u0B9F\u0BC1\u0BAE\u0BCD" },
@@ -15453,7 +15453,7 @@ function ta_default() {
   };
 }
 
-// node_modules/zod/v4/locales/tg.js
+// ../../node_modules/zod/v4/locales/tg.js
 var error51 = () => {
   const Sizable = {
     string: { unit: "\u0430\u043B\u043E\u043C\u0430\u0442", verb: "\u0434\u043E\u0448\u0442\u0430 \u0431\u043E\u0448\u0430\u0434" },
@@ -15570,7 +15570,7 @@ function tg_default() {
   };
 }
 
-// node_modules/zod/v4/locales/th.js
+// ../../node_modules/zod/v4/locales/th.js
 var error52 = () => {
   const Sizable = {
     string: { unit: "\u0E15\u0E31\u0E27\u0E2D\u0E31\u0E01\u0E29\u0E23", verb: "\u0E04\u0E27\u0E23\u0E21\u0E35" },
@@ -15686,7 +15686,7 @@ function th_default() {
   };
 }
 
-// node_modules/zod/v4/locales/tk.js
+// ../../node_modules/zod/v4/locales/tk.js
 var error53 = () => {
   const Sizable = {
     string: { unit: "simwol", verb: "bolmaly" },
@@ -15794,7 +15794,7 @@ function tk_default() {
   };
 }
 
-// node_modules/zod/v4/locales/tr.js
+// ../../node_modules/zod/v4/locales/tr.js
 var error54 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "olmal\u0131" },
@@ -15905,7 +15905,7 @@ function tr_default() {
   };
 }
 
-// node_modules/zod/v4/locales/uk.js
+// ../../node_modules/zod/v4/locales/uk.js
 var error55 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0456\u0432", verb: "\u043C\u0430\u0442\u0438\u043C\u0435" },
@@ -16019,12 +16019,12 @@ function uk_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ua.js
+// ../../node_modules/zod/v4/locales/ua.js
 function ua_default() {
   return uk_default();
 }
 
-// node_modules/zod/v4/locales/ur.js
+// ../../node_modules/zod/v4/locales/ur.js
 var error56 = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0648\u0641", verb: "\u06C1\u0648\u0646\u0627" },
@@ -16140,7 +16140,7 @@ function ur_default() {
   };
 }
 
-// node_modules/zod/v4/locales/uz.js
+// ../../node_modules/zod/v4/locales/uz.js
 var error57 = () => {
   const Sizable = {
     string: { unit: "belgi", verb: "bo\u2018lishi kerak" },
@@ -16254,7 +16254,7 @@ function uz_default() {
   };
 }
 
-// node_modules/zod/v4/locales/vi.js
+// ../../node_modules/zod/v4/locales/vi.js
 var error58 = () => {
   const Sizable = {
     string: { unit: "k\xFD t\u1EF1", verb: "c\xF3" },
@@ -16368,7 +16368,7 @@ function vi_default() {
   };
 }
 
-// node_modules/zod/v4/locales/zh-CN.js
+// ../../node_modules/zod/v4/locales/zh-CN.js
 var error59 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u7B26", verb: "\u5305\u542B" },
@@ -16483,7 +16483,7 @@ function zh_CN_default() {
   };
 }
 
-// node_modules/zod/v4/locales/zh-TW.js
+// ../../node_modules/zod/v4/locales/zh-TW.js
 var error60 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u5143", verb: "\u64C1\u6709" },
@@ -16596,7 +16596,7 @@ function zh_TW_default() {
   };
 }
 
-// node_modules/zod/v4/locales/yo.js
+// ../../node_modules/zod/v4/locales/yo.js
 var error61 = () => {
   const Sizable = {
     string: { unit: "\xE0mi", verb: "n\xED" },
@@ -16709,7 +16709,7 @@ function yo_default() {
   };
 }
 
-// node_modules/zod/v4/core/registries.js
+// ../../node_modules/zod/v4/core/registries.js
 var _a2;
 var $output = /* @__PURE__ */ Symbol("ZodOutput");
 var $input = /* @__PURE__ */ Symbol("ZodInput");
@@ -16759,7 +16759,7 @@ function registry() {
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
 
-// node_modules/zod/v4/core/compile.js
+// ../../node_modules/zod/v4/core/compile.js
 var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
 var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
@@ -18361,7 +18361,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
   return accessor;
 }
 
-// node_modules/zod/v4/core/api.js
+// ../../node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -19420,7 +19420,7 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
   return inst;
 }
 
-// node_modules/zod/v4/core/to-json-schema.js
+// ../../node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -19950,7 +19950,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   return finalize(ctx, schema);
 };
 
-// node_modules/zod/v4/core/json-schema-processors.js
+// ../../node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === void 0 || value > agg[key])
     agg[key] = value;
@@ -20698,7 +20698,7 @@ function toJSONSchema(input2, params) {
   return finalize(ctx, input2);
 }
 
-// node_modules/zod/v4/core/json-schema-generator.js
+// ../../node_modules/zod/v4/core/json-schema-generator.js
 var JSONSchemaGenerator = class {
   /** @deprecated Access via ctx instead */
   get metadataRegistry() {
@@ -20776,10 +20776,10 @@ var JSONSchemaGenerator = class {
   }
 };
 
-// node_modules/zod/v4/core/json-schema.js
+// ../../node_modules/zod/v4/core/json-schema.js
 var json_schema_exports = {};
 
-// node_modules/zod/v4/classic/schemas.js
+// ../../node_modules/zod/v4/classic/schemas.js
 var schemas_exports2 = {};
 __export(schemas_exports2, {
   ZodAny: () => ZodAny,
@@ -20960,7 +20960,7 @@ __export(schemas_exports2, {
   xor: () => xor
 });
 
-// node_modules/zod/v4/classic/checks.js
+// ../../node_modules/zod/v4/classic/checks.js
 var checks_exports2 = {};
 __export(checks_exports2, {
   endsWith: () => _endsWith,
@@ -20995,7 +20995,7 @@ __export(checks_exports2, {
   uppercase: () => _uppercase
 });
 
-// node_modules/zod/v4/classic/errors.js
+// ../../node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -21041,7 +21041,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, void 0
   Parent: Error
 });
 
-// node_modules/zod/v4/classic/parse.js
+// ../../node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -21055,7 +21055,7 @@ var safeDecode2 = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync2 = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// node_modules/zod/v4/classic/schemas.js
+// ../../node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config(en_default());
@@ -22520,7 +22520,7 @@ function preprocess(fn, schema) {
   });
 }
 
-// node_modules/zod/v4/classic/compat.js
+// ../../node_modules/zod/v4/classic/compat.js
 var ZodIssueCode = {
   invalid_type: "invalid_type",
   too_big: "too_big",
@@ -22546,7 +22546,7 @@ var ZodFirstPartyTypeKind;
 /* @__PURE__ */ (function(ZodFirstPartyTypeKind2) {
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
 
-// node_modules/zod/v4/classic/iso.js
+// ../../node_modules/zod/v4/classic/iso.js
 var iso_exports = {};
 __export(iso_exports, {
   ZodISODate: () => ZodISODate,
@@ -22571,7 +22571,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// node_modules/zod/v4/classic/from-json-schema.js
+// ../../node_modules/zod/v4/classic/from-json-schema.js
 var z = {
   ...schemas_exports2,
   ...checks_exports2,
@@ -22671,13 +22671,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path13 = ref.slice(1).split("/").filter(Boolean);
-  if (path13.length === 0) {
+  const path15 = ref.slice(1).split("/").filter(Boolean);
+  if (path15.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path13[0] === defsKey) {
-    const key = path13[1] === void 0 ? void 0 : decodeJSONPointerSegment(path13[1]);
+  if (path15[0] === defsKey) {
+    const key = path15[1] === void 0 ? void 0 : decodeJSONPointerSegment(path15[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23304,7 +23304,7 @@ function fromJSONSchema(schema, params) {
   return convertSchema(normalized, ctx);
 }
 
-// node_modules/zod/v4/core/visit.js
+// ../../node_modules/zod/v4/core/visit.js
 var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
@@ -23459,7 +23459,7 @@ function visit(schema, fnOrHandlers) {
   return run(schema);
 }
 
-// node_modules/zod/v4/classic/deep-partial.js
+// ../../node_modules/zod/v4/classic/deep-partial.js
 function deepPartial(schema) {
   return visit(schema, {
     object: (s) => s.partial(),
@@ -23471,7 +23471,7 @@ function deepPartial(schema) {
   });
 }
 
-// node_modules/zod/v4/classic/in-out.js
+// ../../node_modules/zod/v4/classic/in-out.js
 function withChecks(side, checks) {
   if (!checks?.length)
     return side;
@@ -23501,7 +23501,7 @@ function output(schema) {
   });
 }
 
-// node_modules/zod/v4/classic/coerce.js
+// ../../node_modules/zod/v4/classic/coerce.js
 var coerce_exports = {};
 __export(coerce_exports, {
   bigint: () => bigint3,
@@ -23529,7 +23529,7 @@ function date4(params) {
 // agent/src/guard-evidence.ts
 import { createHash as createHash2, createPublicKey as createPublicKey2, KeyObject } from "node:crypto";
 
-// node_modules/jose/dist/webapi/lib/buffer_utils.js
+// ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
@@ -23580,7 +23580,7 @@ function decodeBase64(encoded, url2 = false) {
   return bytes3;
 }
 
-// node_modules/jose/dist/webapi/util/errors.js
+// ../../node_modules/jose/dist/webapi/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
@@ -23608,7 +23608,7 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// node_modules/jose/dist/webapi/util/base64url.js
+// ../../node_modules/jose/dist/webapi/util/base64url.js
 var invalid = "The input to be decoded is not correctly encoded.";
 function decode3(input2) {
   try {
@@ -23621,7 +23621,7 @@ function encode4(input2) {
   return encodeBase64(typeof input2 == "string" ? encoder.encode(input2) : input2, true);
 }
 
-// node_modules/jose/dist/webapi/lib/validate.js
+// ../../node_modules/jose/dist/webapi/lib/validate.js
 function assertUint8Array(input2, label) {
   if (!(input2 instanceof Uint8Array))
     throw new TypeError(`${label} must be an instance of Uint8Array`);
@@ -23722,7 +23722,7 @@ function serializeJoseHeader(Err, header) {
   return [parsed, serialized];
 }
 
-// node_modules/jose/dist/webapi/lib/key.js
+// ../../node_modules/jose/dist/webapi/lib/key.js
 var tag = (key) => key[Symbol.toStringTag];
 var jwkMatchesOp = (entry, key, usage) => {
   const { alg } = entry;
@@ -23853,7 +23853,7 @@ async function rawKey(key, expected, usage, extractable = false) {
   return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 
-// node_modules/jose/dist/webapi/lib/key_descriptor.js
+// ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
   const out = { __proto__: null };
   for (const alg in entries)
@@ -23861,7 +23861,7 @@ function table(entries) {
   return out;
 }
 
-// node_modules/jose/dist/webapi/lib/jws_algorithms.js
+// ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
 var sig = [["verify"], ["sign"]];
 function hmac(bits) {
   const subtle = { name: "HMAC", hash: `SHA-${bits}` };
@@ -23931,7 +23931,7 @@ function jwsAlgorithm(alg) {
   return entry;
 }
 
-// node_modules/jose/dist/webapi/lib/jws_verify.js
+// ../../node_modules/jose/dist/webapi/lib/jws_verify.js
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
@@ -23983,13 +23983,13 @@ async function verifyCompact(jws, shared, key) {
   return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
 }
 
-// node_modules/jose/dist/webapi/jws/compact/verify.js
+// ../../node_modules/jose/dist/webapi/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
   const [result2] = await verifyCompact(jws, prepareVerify(options), key);
   return result2;
 }
 
-// node_modules/jose/dist/webapi/lib/jws_sign.js
+// ../../node_modules/jose/dist/webapi/lib/jws_sign.js
 async function createSignature(input2, key, rejectUnencoded) {
   let [payload, protectedHeader, unprotectedHeader, crit] = input2, protectedHeaderString = "";
   if (protectedHeader !== void 0) {
@@ -24027,7 +24027,7 @@ async function createCompactSignature(payload, protectedHeader, crit, key, rejec
   return `${jws.protected}.${jws.payload}.${jws.signature}`;
 }
 
-// node_modules/jose/dist/webapi/jws/compact/sign.js
+// ../../node_modules/jose/dist/webapi/jws/compact/sign.js
 var CompactSign = class {
   #payload;
   #protectedHeader;
@@ -25288,12 +25288,21 @@ async function planPermissionChange(current2, programs, input2) {
     workspace.permissions.writeFiles = change.enabled;
     detail = "File writes: " + (change.enabled ? "ALLOW" : "DENY");
   } else if (change.kind === "localhost") {
+    if (workspace.fullAccess) {
+      workspace.deniedLocalhostPorts = change.enabled ? (workspace.deniedLocalhostPorts ?? []).filter((port) => port !== change.port) : [.../* @__PURE__ */ new Set([...workspace.deniedLocalhostPorts ?? [], change.port])];
+      if (workspace.deniedLocalhostPorts.length > 32) invalid2("PERMISSION_LIMIT");
+    }
     workspace.localhostPorts = change.enabled ? [.../* @__PURE__ */ new Set([...workspace.localhostPorts, change.port])].sort((a, b) => a - b) : workspace.localhostPorts.filter((port) => port !== change.port);
     if (workspace.localhostPorts.length > 32) invalid2("PERMISSION_LIMIT");
-    workspace.permissions.localhost = workspace.localhostPorts.length > 0;
+    workspace.permissions.localhost = workspace.fullAccess === true || workspace.localhostPorts.length > 0;
     resource = { rootHash: workspace.rootHash, kind: change.kind, port: change.port };
     detail = "Localhost port " + change.port + ": " + (change.enabled ? "ALLOW" : "DENY");
   } else {
+    if (workspace.fullAccess) {
+      const key = change.name.replace(/\.(exe|com|cmd|bat)$/i, "");
+      workspace.deniedCommands = change.enabled ? (workspace.deniedCommands ?? []).filter((name2) => name2.replace(/\.(exe|com|cmd|bat)$/i, "") !== key) : [.../* @__PURE__ */ new Set([...workspace.deniedCommands ?? [], change.name])];
+      if (workspace.deniedCommands.length > 32) invalid2("PERMISSION_LIMIT");
+    }
     let executableIdentity = null;
     if (change.enabled) {
       const executable = change.executable;
@@ -25307,7 +25316,7 @@ async function planPermissionChange(current2, programs, input2) {
       if (workspace.allowedCommands.length > 32 || Object.keys(nextPrograms).length > 32) invalid2("PERMISSION_LIMIT");
       executableIdentity = { executable: canonical2, dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
     } else workspace.allowedCommands = workspace.allowedCommands.filter((value) => value !== change.name);
-    workspace.permissions.executeCommands = workspace.allowedCommands.length > 0;
+    workspace.permissions.executeCommands = workspace.fullAccess === true || workspace.allowedCommands.length > 0;
     resource = { rootHash: workspace.rootHash, kind: change.kind, name: change.name, executable: nextPrograms[change.name] ?? null, executableIdentity };
     detail = "Command " + permissionLabel(change.name) + ": " + (change.enabled ? "ALLOW" : "DENY") + "\nExact executable: " + permissionLabel(nextPrograms[change.name] ?? "not registered") + nonAsciiNotice(nextPrograms[change.name]) + "\nA permitted program can access resources available to your Windows account, including outside this folder. This is not an OS sandbox.";
   }
@@ -25679,9 +25688,12 @@ function validateState(value) {
   const pendingWorkspaceRevokes = value.pendingWorkspaceRevokes ?? [];
   if (!Array.isArray(pendingWorkspaceRevokes) || pendingWorkspaceRevokes.length > 32 || pendingWorkspaceRevokes.some((id) => typeof id !== "string" || !UUID.test(id) || id !== id.toLowerCase()) || new Set(pendingWorkspaceRevokes).size !== pendingWorkspaceRevokes.length) throw fail("STATE_CORRUPT");
   if (!programs || typeof programs !== "object" || Array.isArray(programs) || Object.keys(programs).length > 32 || Object.entries(programs).some(([name2, executable]) => !/^[a-z0-9_.-]{1,64}$/.test(name2) || typeof executable !== "string" || !path5.isAbsolute(executable) || executable.length > 4096 || /[\u0000-\u001f]/.test(executable))) throw fail("STATE_CORRUPT");
-  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path5.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name2) => typeof name2 !== "string" || !Object.hasOwn(programs, name2)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== w.allowedCommands.length > 0 || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== w.localhostPorts.length > 0)) throw fail("STATE_CORRUPT");
+  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path5.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name2) => typeof name2 !== "string" || !Object.hasOwn(programs, name2)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== (w.fullAccess === true || w.allowedCommands.length > 0) || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== (w.fullAccess === true || w.localhostPorts.length > 0))) throw fail("STATE_CORRUPT");
   if (new Set(workspaces.map((w) => w.workspaceGrantId)).size !== workspaces.length || new Set(workspaces.map((w) => w.rootHash)).size !== workspaces.length) throw fail("STATE_CORRUPT");
   if (workspaces.some((w) => pendingWorkspaceRevokes.includes(w.workspaceGrantId))) throw fail("STATE_CORRUPT");
+  for (const w of workspaces) {
+    if (w.fullAccess !== void 0 && w.fullAccess !== true || w.deniedCommands !== void 0 && (!w.fullAccess || !Array.isArray(w.deniedCommands) || w.deniedCommands.length > 32 || w.deniedCommands.some((name2) => typeof name2 !== "string" || !/^[a-z0-9_.-]{1,64}$/.test(name2))) || w.deniedLocalhostPorts !== void 0 && (!w.fullAccess || !Array.isArray(w.deniedLocalhostPorts) || w.deniedLocalhostPorts.length > 32 || w.deniedLocalhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535))) throw fail("STATE_CORRUPT");
+  }
   return { version: 1, publicKeyPem: value.publicKeyPem, privateKeyPem: value.privateKeyPem, fingerprint: value.fingerprint, dataKey: value.dataKey, ...enrollment ? { enrollment } : {}, workspaces, programs, pendingWorkspaceRevokes, ...value.permissionHistory ? { permissionHistory: permissionHistory.data } : {}, ...policyBundle ? { policyBundle } : {}, ...approvals?.success ? { approvals: approvals.data } : {}, ...value.guardRequired ? { guardRequired: true } : {}, ...guard ? { guard } : {} };
 }
 async function noSymlinkChain(target) {
@@ -25752,9 +25764,23 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const approved = /* @__PURE__ */ new Set([MARKER, "owner-state.dat", "owner-state.lock", "journal"]);
+    const approved = /* @__PURE__ */ new Set([MARKER, "owner-state.dat", "owner-state.lock", "journal", "agent-process.json", "optimization"]);
     if (names.length && !names.includes(MARKER)) throw fail("STORE_DIRECTORY_UNKNOWN");
     if (names.some((name2) => !approved.has(name2))) throw fail("STORE_DIRECTORY_UNKNOWN");
+    for (const name2 of ["agent-process.json", "optimization"]) {
+      if (!names.includes(name2)) continue;
+      const filename = path5.join(absolute2, name2), stat = await lstat3(filename);
+      if (stat.isSymbolicLink() || (name2 === "optimization" ? !stat.isDirectory() : !stat.isFile() || stat.size < 1 || stat.size > 8192)) throw fail("STORE_DIRECTORY_INVALID");
+      if (name2 === "agent-process.json") {
+        let value;
+        try {
+          value = JSON.parse(await readFile2(filename, "utf8"));
+        } catch {
+          throw fail("STORE_DIRECTORY_INVALID");
+        }
+        if (!value || !Number.isSafeInteger(value.pid) || value.pid <= 0 || typeof value.runtimeDir !== "string" || !path5.isAbsolute(value.runtimeDir) || value.runtimeDir.length > 4096 || /[\u0000-\u001f]/.test(value.runtimeDir) || typeof value.version !== "string" || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][A-Za-z0-9.-]+)?$/.test(value.version) || typeof value.startedAt !== "string" || !Number.isFinite(Date.parse(value.startedAt))) throw fail("STORE_DIRECTORY_INVALID");
+      }
+    }
     await _WindowsPrivateStore.invoke(bridge, "init-directory", { path: absolute2 }, 5e3, false);
     const canonical2 = await realpath3(absolute2);
     if (!equalPath2(absolute2, canonical2) || (await lstat3(canonical2)).isSymbolicLink()) throw fail("STORE_DIRECTORY_INVALID");
@@ -26140,7 +26166,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     return this.run(async () => {
       const state = await this.readState();
       if (guardActive === false && state?.guardRequired) throw fail("GUARD_RESTART_REQUIRED");
-      return [...state?.workspaces ?? []].map((w) => ({ ...w, permissions: { ...w.permissions }, allowedCommands: [...w.allowedCommands], localhostPorts: [...w.localhostPorts] }));
+      return structuredClone(state?.workspaces ?? []);
     });
   }
   loadPrograms() {
@@ -26164,7 +26190,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       const before = await this.rawHash();
       state.workspaces = state.workspaces.filter((w) => w.workspaceGrantId !== id);
       state.pendingWorkspaceRevokes = [...state.pendingWorkspaceRevokes ?? [], id];
-      for (const name2 of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
+      for (const name2 of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2) || w.deniedCommands?.includes(name2))) delete state.programs[name2];
       await this.writeState(state, before);
     }));
   }
@@ -26206,7 +26232,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       const before = await this.rawHash();
       state.workspaces = state.workspaces.map((w) => w.workspaceGrantId === verified.workspace.workspaceGrantId ? verified.workspace : w);
       state.programs = verified.programs;
-      for (const name2 of Object.keys(state.programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
+      for (const name2 of Object.keys(state.programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2) || w.deniedCommands?.includes(name2))) delete state.programs[name2];
       const record2 = {
         id: randomUUID3(),
         changedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -26253,7 +26279,8 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
           rootHash,
           displayName: (path5.basename(root) || root).slice(0, 120),
           policyVersion: 1,
-          permissions: { readFiles: true, writeFiles: true, executeCommands: false, localhost: false },
+          ...selected.mode === "all-drives" ? { fullAccess: true } : {},
+          permissions: { readFiles: true, writeFiles: true, executeCommands: selected.mode === "all-drives", localhost: selected.mode === "all-drives" },
           allowedCommands: [],
           localhostPorts: []
         };
@@ -26309,7 +26336,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
 // agent/src/tools.ts
 import { constants as constants3 } from "node:fs";
 import { lstat as lstat5, open as open4, readdir as readdir3, realpath as realpath5, rename as rename3, rm as rm3 } from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/guard.ts
@@ -26553,11 +26580,31 @@ function invokeRead(bridge, file2, maxBytes, prefix, signal) {
   });
 }
 
+// src/process.ts
+import { statSync } from "node:fs";
+import path8 from "node:path";
+var WINDOWS_LAUNCH_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
+function resolveWindowsLauncher(commandName, env = process.env) {
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => ext.trim().toLowerCase()).filter((ext) => WINDOWS_LAUNCH_EXTENSIONS.includes(ext));
+  for (const entry of (env.PATH ?? "").split(";")) {
+    const dir = entry.trim().replace(/^"(.*)"$/, "$1");
+    if (!path8.win32.isAbsolute(dir)) continue;
+    for (const ext of extensions) {
+      const file2 = path8.win32.join(dir, commandName + ext);
+      try {
+        if (statSync(file2).isFile()) return { file: file2, shell: ext === ".bat" || ext === ".cmd" };
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+
 // agent/src/job-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import path8 from "node:path";
+import path9 from "node:path";
 function absolute(value) {
-  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path8.isAbsolute(value) && path8.resolve(value) === value;
+  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path9.isAbsolute(value) && path9.resolve(value) === value;
 }
 async function runSupervised(helper, request, options = {}) {
   if (process.platform !== "win32") throw Error("WINDOWS_SUPERVISOR_REQUIRED");
@@ -26573,7 +26620,7 @@ async function runSupervised(helper, request, options = {}) {
     let pid = null, outcome = null;
     let buffer = "", failure5 = null, closed = false, cancelSent = false;
     let killTimer, hardTimer;
-    const child = spawn2(helper, [], { cwd: path8.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
+    const child = spawn2(helper, [], { cwd: path9.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
     const cancel = () => {
       if (closed || cancelSent) return;
       cancelSent = true;
@@ -26727,7 +26774,7 @@ var NativeTools = class {
   options;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path9.join(path9.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path10.join(path10.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail2(error62.message);
@@ -26752,15 +26799,15 @@ var NativeTools = class {
     try {
       const canonical2 = await realpath5(workspace.root);
       if (!equalPath3(canonical2, workspace.root) || hash5(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace.rootHash) fail2("WORKSPACE_CHANGED");
-      const runtimeDirectory = path9.dirname(this.options.helperPath);
+      const runtimeDirectory = path10.dirname(this.options.helperPath);
       const protectedPaths = [
         this.options.stateDirectory,
         this.options.helperPath,
-        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path9.join(runtimeDirectory, name2))
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path10.join(runtimeDirectory, name2))
       ];
       if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
-      if (process.platform === "win32" && process.env.LOCALAPPDATA && path9.isAbsolute(process.env.LOCALAPPDATA)) {
-        protectedPaths.push(path9.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path10.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path10.join(process.env.LOCALAPPDATA, "LocalCommander"));
       }
       guard = await PathGuard.create([canonical2], false, { protectedPaths });
     } catch (e) {
@@ -26792,7 +26839,7 @@ var NativeTools = class {
         const bytes3 = await this.readFile(filename, 1048576, signal), contents = utf8(bytes3), lines = contents.split(/\r?\n/);
         const selected = lines.slice(first - 1, Math.min(last, lines.length)).join("\n");
         if (Buffer.byteLength(selected) > 12e4) fail2("OUTPUT_LIMIT_EXCEEDED");
-        return result({ path: path9.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
+        return result({ path: path10.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -26828,7 +26875,7 @@ var NativeTools = class {
         }
         const bytes3 = Buffer.from(contents, "utf8");
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail2("FILE_WRITE_LIMIT");
-        const temp = path9.join(path9.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
+        const temp = path10.join(path10.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
         const handle = await open4(temp, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
@@ -26845,7 +26892,7 @@ var NativeTools = class {
             await link(temp, target);
             await rm3(temp);
           }
-          return result({ path: path9.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path10.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
@@ -26866,12 +26913,12 @@ var NativeTools = class {
           stopped(signal);
           if (matches2.length >= call.args.maxResults || scanned >= 300) break;
           try {
-            const filename = await guard.resolveExisting(path9.join(base, entry.path));
+            const filename = await guard.resolveExisting(path10.join(base, entry.path));
             guard.assertSafeFile(filename);
             const data = utf8(await this.readFile(filename, 256e3, signal));
             scanned++;
             const lines = data.split(/\r?\n/);
-            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path9.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
+            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path10.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
           } catch (error62) {
             if (error62 instanceof NativeToolError && ["FILE_READ_FAILED", "CANCELLED"].includes(error62.code)) throw error62;
           }
@@ -26881,7 +26928,7 @@ var NativeTools = class {
     }
     if (call.name === "localhost_request") {
       const url2 = new URL(call.args.url), port = Number(url2.port || (url2.protocol === "https:" ? 443 : 80));
-      if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || !workspace.localhostPorts.includes(port) || this.options.protectedPorts?.includes(port)) fail2("LOCALHOST_NOT_ALLOWED");
+      if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || (workspace.fullAccess ? workspace.deniedLocalhostPorts?.includes(port) : !workspace.localhostPorts.includes(port)) || this.options.protectedPorts?.includes(port)) fail2("LOCALHOST_NOT_ALLOWED");
       const headers = {};
       for (const [name2, value] of Object.entries(call.args.headers ?? {})) {
         if (!/^[A-Za-z0-9-]+$/.test(name2) || /[\r\n]/.test(value) || ["host", "connection", "content-length", "transfer-encoding", "upgrade", "proxy-authorization", "proxy-connection"].includes(name2.toLowerCase()) || Object.keys(headers).some((k) => k.toLowerCase() === name2.toLowerCase())) fail2("INVALID_HTTP_HEADER");
@@ -26921,10 +26968,10 @@ var NativeTools = class {
       } };
     }
     if (call.name === "command_run") {
-      const cwd2 = await resolve(call.args.cwd, true), program = this.resolveProgram(call.args.command, workspace);
+      const cwd2 = await resolve(call.args.cwd, true), program = await this.resolveProgram(call.args.command, workspace, call.args.args);
       const claims2 = writeClaim(cwd2);
-      return { call, claims: claims2, execution: { executable: program.executable, args: [...program.prefixArgs ?? [], ...call.args.args], cwd: cwd2 }, run: async (signal, onStarted, onOutput) => {
-        const r = await runSupervised(this.options.helperPath, { executable: program.executable, args: [...program.prefixArgs ?? [], ...call.args.args], cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
+      return { call, claims: claims2, execution: { ...program, cwd: cwd2 }, run: async (signal, onStarted, onOutput) => {
+        const r = await runSupervised(this.options.helperPath, { ...program, cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
         const { pid: _pid, ...output2 } = r;
         return { ...output2, resultCode: r.cancelled ? "CANCELLED" : r.timedOut ? "TIMEOUT" : r.exitCode === 0 ? "SUCCESS" : "USER_PROGRAM_FAILED" };
       } };
@@ -26938,20 +26985,20 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path9.resolve(cwd, call.args.file));
-        const relative = path9.relative(cwd, file2);
-        if (relative.startsWith(".." + path9.sep) || relative === ".." || path9.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path10.resolve(cwd, call.args.file));
+        const relative = path10.relative(cwd, file2);
+        if (relative.startsWith(".." + path10.sep) || relative === ".." || path10.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail2("TOOL_MISSING");
-    const execution = common ? this.gitExecution(cwd, argv) : void 0;
+    const execution = common ? await this.gitExecution(cwd, argv) : void 0;
     const runGit = (signal, onStarted, onOutput) => runSupervised(this.options.helperPath, { ...execution, timeoutMs: 1e4, maxProcesses: 8 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
     return { call, claims, ...execution ? { execution } : {}, run: async (signal, onStarted, onOutput) => {
       if (call.name === "project_snapshot") {
         const listing = await this.list(guard, cwd, 1, 150, signal);
         let packageInfo = null;
         try {
-          const name2 = await guard.resolveExisting(path9.join(cwd, "package.json"));
+          const name2 = await guard.resolveExisting(path10.join(cwd, "package.json"));
           guard.assertSafeFile(name2);
           const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
@@ -26967,15 +27014,53 @@ var NativeTools = class {
       return { ...output2, resultCode: r.exitCode === 0 ? "SUCCESS" : "GIT_FAILED" };
     } };
   }
-  resolveProgram(name2, workspace) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path9.isAbsolute(name2) && equalPath3(value.executable, path9.resolve(name2)));
-    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path9.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
-    return { executable: entry[1].executable, prefixArgs: [...entry[1].prefixArgs ?? []] };
-  }
-  gitExecution(cwd, args) {
-    const program = this.options.programs.git;
-    if (!program || !path9.isAbsolute(program.executable)) fail2("GIT_NOT_INSTALLED");
-    return { executable: program.executable, args: ["--no-pager", "--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=" + (process.platform === "win32" ? "NUL" : "/dev/null"), "-c", "diff.external=", ...args], cwd };
+  async resolveProgram(name2, workspace, args) {
+    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path10.isAbsolute(name2) && equalPath3(value.executable, path10.resolve(name2)));
+    if (workspace.fullAccess) {
+      const commandKey = (value) => path10.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "");
+      const denied = new Set((workspace.deniedCommands ?? []).map(commandKey));
+      if (denied.has(commandKey(name2)) || entry && denied.has(commandKey(entry[0]))) fail2("COMMAND_NOT_ALLOWED");
+      const extension2 = path10.extname(name2).toLowerCase();
+      const candidate = entry?.[1].executable ?? (path10.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
+        commandKey(name2),
+        [".exe", ".com", ".cmd", ".bat"].includes(extension2) ? { ...process.env, PATHEXT: extension2 } : process.env
+      )?.file : void 0);
+      if (!candidate || !path10.isAbsolute(candidate)) fail2("COMMAND_NOT_FOUND");
+      const executable = await realpath5(candidate).catch(() => fail2("COMMAND_NOT_FOUND"));
+      if (!(await lstat5(executable)).isFile()) fail2("COMMAND_NOT_FOUND");
+      if (denied.has(commandKey(executable))) fail2("COMMAND_NOT_ALLOWED");
+      for (const key of workspace.deniedCommands ?? []) {
+        const configured = this.options.programs[key]?.executable;
+        if (configured && equalPath3(executable, await realpath5(configured).catch(() => configured))) fail2("COMMAND_NOT_ALLOWED");
+      }
+      if (/\.(cmd|bat)$/i.test(executable)) {
+        if ([executable, ...args].some((value) => /[&|<>^%!"\r\n]/.test(value))) fail2("INVALID_SCRIPT_ARGUMENTS");
+        const literal2 = (value) => "'" + value.replaceAll("'", "''") + "'";
+        const shell = path10.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        if (denied.has("powershell") || denied.has("cmd")) fail2("COMMAND_NOT_ALLOWED");
+        const script = "& " + literal2(executable) + " @(" + args.map(literal2).join(",") + "); exit $LASTEXITCODE";
+        return { executable: shell, args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
+      }
+      if (!/\.(exe|com)$/i.test(executable)) fail2("COMMAND_NOT_ALLOWED");
+      return { executable, args: [...entry?.[1].prefixArgs ?? [], ...args] };
+    }
+    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path10.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
+    return { executable: entry[1].executable, args: [...entry[1].prefixArgs ?? [], ...args] };
+  }
+  async gitExecution(cwd, args) {
+    const configured = this.options.programs.git;
+    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path10.isAbsolute(root)).map(([root, suffix]) => path10.join(root, suffix, "cmd", "git.exe")) : [];
+    for (const candidate of candidates) {
+      if (!path10.isAbsolute(candidate)) continue;
+      try {
+        const stat = await lstat5(candidate);
+        if (!stat.isFile() || stat.isSymbolicLink() || !equalPath3(candidate, await realpath5(candidate))) continue;
+      } catch {
+        continue;
+      }
+      return { executable: candidate, args: ["--no-pager", "--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=" + (process.platform === "win32" ? "NUL" : "/dev/null"), "-c", "diff.external=", ...args], cwd };
+    }
+    fail2("GIT_NOT_INSTALLED");
   }
   async list(guard, root, depth, maxEntries, signal) {
     const entries = [], queue = [{ path: root, level: 0 }];
@@ -26992,7 +27077,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path9.join(current2.path, item.name);
+        const candidate = path10.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -27002,11 +27087,11 @@ var NativeTools = class {
         }
         if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path9.relative(root, resolved), type: "directory" });
+          entries.push({ path: path10.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
           const stat = await lstat5(resolved);
-          entries.push({ path: path9.relative(root, resolved), type: "file", size: stat.size });
+          entries.push({ path: path10.relative(root, resolved), type: "file", size: stat.size });
         }
       }
       if (truncated) break;
@@ -27016,7 +27101,7 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace.root)) {
-      const dotGit = path9.join(directory, ".git");
+      const dotGit = path10.join(directory, ".git");
       try {
         const stat = await lstat5(dotGit);
         if (stat.isSymbolicLink()) fail2("GIT_METADATA_CHANGED");
@@ -27025,14 +27110,14 @@ var NativeTools = class {
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail2("GIT_METADATA_CHANGED");
-          gitDir = await realpath5(path9.resolve(directory, content.slice(8)));
+          gitDir = await realpath5(path10.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace.root) && (!workspace.gitCommonDir || !guard.isWithin(gitDir, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path9.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path10.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail2("GIT_METADATA_CHANGED");
-          common = await realpath5(path9.resolve(gitDir, content));
+          common = await realpath5(path10.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
@@ -27043,22 +27128,22 @@ var NativeTools = class {
         if (e.code !== "ENOENT") throw e;
       }
       if (equalPath3(directory, workspace.root)) break;
-      directory = path9.dirname(directory);
+      directory = path10.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path10 from "node:path";
+import path11 from "node:path";
 import os2 from "node:os";
 function canonical(value) {
-  const p = path10.resolve(value);
+  const p = path11.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path10.relative(a, b);
-  return relative === "" || !path10.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path10.sep);
+  const relative = path11.relative(a, b);
+  return relative === "" || !path11.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path11.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -27078,7 +27163,7 @@ var NativeScheduler = class {
   schedule(id, claims, deadlineAt, run, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id || id.length > 100 || this.active.has(id) || this.waiting.some((j) => j.id === id)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path10.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path11.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
@@ -27761,10 +27846,6 @@ var NativeRuntime = class {
   }
   async prepare(frame) {
     const binding2 = frame.binding;
-    if (this.paused || this.closing) {
-      this.send({ type: "not_accepted", version: 1, binding: binding2, code: "AGENT_PAUSED", provedNotStarted: true });
-      return;
-    }
     const existing = this.contexts.get(binding2.executionId);
     if (existing) {
       if (!sameBinding(existing.binding, binding2)) throw Error("IDEMPOTENCY_CONFLICT");
@@ -27772,15 +27853,15 @@ var NativeRuntime = class {
       if (entry?.state === "prepared" && !existing.launched) this.send({ type: "prepared", version: 1, binding: binding2 });
       return;
     }
-    if (this.contexts.size >= 256) {
-      this.send({ type: "not_accepted", version: 1, binding: binding2, code: "RESOURCE_BUSY", provedNotStarted: true });
-      return;
-    }
+    let preparedHere = false;
     try {
+      const stored = await this.options.journal.prepare({ executionId: binding2.executionId, operationId: binding2.operationId, sessionId: binding2.sessionId, tenantId: binding2.tenantId, grantId: binding2.grantId, deviceId: binding2.deviceId, connectionEpoch: binding2.connectionEpoch, workspaceGrantId: binding2.workspaceGrantId, policyVersion: binding2.policyVersion, payloadHash: binding2.payloadHash, deadlineAt: binding2.deadlineAt, ...binding2.accountId ? { accountId: binding2.accountId } : {} });
+      preparedHere = stored.created;
+      if (this.paused || this.closing) throw new NativeToolError("AGENT_PAUSED");
+      if (this.contexts.size >= 256) throw new NativeToolError("RESOURCE_BUSY");
       const workspace = (await this.options.workspaces()).find((w) => w.workspaceGrantId === binding2.workspaceGrantId && w.policyVersion === binding2.policyVersion);
       if (!workspace) throw new NativeToolError("LOCAL_PERMISSION_REQUIRED");
       const tool = await this.options.tools.prepare(workspace, frame.tool);
-      const stored = await this.options.journal.prepare({ executionId: binding2.executionId, operationId: binding2.operationId, sessionId: binding2.sessionId, tenantId: binding2.tenantId, grantId: binding2.grantId, deviceId: binding2.deviceId, connectionEpoch: binding2.connectionEpoch, workspaceGrantId: binding2.workspaceGrantId, policyVersion: binding2.policyVersion, payloadHash: binding2.payloadHash, deadlineAt: binding2.deadlineAt, ...binding2.accountId ? { accountId: binding2.accountId } : {} });
       if (!stored.created) {
         if (!journalBinding(stored.entry, binding2)) throw Error("IDEMPOTENCY_CONFLICT");
         if (stored.entry.result) {
@@ -27870,12 +27951,14 @@ var NativeRuntime = class {
         if (!context.accepted) {
           if (context.guardPermit) await this.options.guard.rejected(context.guardPermit, safeCode(error62)).catch(() => {
           });
+          let provedNotStarted = false;
           try {
             if (abort.signal.aborted) await this.options.journal.cancelPrepared(binding2.executionId);
             else await this.options.journal.reject(binding2.executionId);
+            provedNotStarted = true;
           } catch {
           }
-          this.send({ type: "not_accepted", version: 1, binding: binding2, code: safeCode(error62), provedNotStarted: true });
+          this.send({ type: "not_accepted", version: 1, binding: binding2, code: safeCode(error62), provedNotStarted });
         } else {
           const isCommand = frame.tool.name === "command_run" || frame.tool.name.startsWith("git_") || frame.tool.name === "project_snapshot";
           const uncertain = error62 instanceof Error && error62.message === "GUARD_EVIDENCE_FAILED" || isCommand && !(error62 instanceof NativeToolError);
@@ -27895,7 +27978,15 @@ var NativeRuntime = class {
       });
       this.options.onActivity?.();
     } catch (error62) {
-      this.send({ type: "not_accepted", version: 1, binding: binding2, code: error62 instanceof Error && error62.message === "IDEMPOTENCY_CONFLICT" ? "IDEMPOTENCY_CONFLICT" : safeCode(error62), provedNotStarted: false });
+      let provedNotStarted = false;
+      if (preparedHere) {
+        try {
+          await this.options.journal.reject(binding2.executionId);
+          provedNotStarted = true;
+        } catch {
+        }
+      }
+      this.send({ type: "not_accepted", version: 1, binding: binding2, code: error62 instanceof Error && error62.message === "IDEMPOTENCY_CONFLICT" ? "IDEMPOTENCY_CONFLICT" : safeCode(error62), provedNotStarted });
     }
   }
   async control(frame) {
@@ -28055,7 +28146,7 @@ var NativeRelayBridge = class {
 // agent/src/relay-client.ts
 import { createPrivateKey as createPrivateKey2, randomUUID as randomUUID5, sign } from "node:crypto";
 
-// node_modules/ws/wrapper.mjs
+// ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
 var import_extension = __toESM(require_extension(), 1);
 var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
@@ -28523,8 +28614,8 @@ function canonicalOrigin2(value) {
     fail4("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path13) {
-  return origin + path13;
+function endpoint(origin, path15) {
+  return origin + path15;
 }
 function uuid17(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail4(code);
@@ -29027,14 +29118,14 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 // agent/src/optimization-ledger.ts
 import { constants as constants4 } from "node:fs";
 import { lstat as lstat6, mkdir as mkdir4, open as open5, readFile as readFile4, realpath as realpath6 } from "node:fs/promises";
-import path11 from "node:path";
+import path12 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure4(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path11.resolve(directory);
+  const absolute2 = path12.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
@@ -29042,7 +29133,7 @@ async function safeDirectory2(directory) {
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path11.dirname(current2);
+    const parent = path12.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
@@ -29067,8 +29158,8 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path11.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path11.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path12.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path12.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
       const stat = await lstat6(filename);
@@ -29200,8 +29291,144 @@ var OptimizationLedger = class _OptimizationLedger {
   }
 };
 
+// agent/src/monitor.ts
+import { createHash as createHash10, randomUUID as randomUUID7 } from "node:crypto";
+import { lstat as lstat7, mkdir as mkdir5, open as open6, rename as rename4, rm as rm4 } from "node:fs/promises";
+import path13 from "node:path";
+var ProductionMonitor = class {
+  constructor(directory, stateDirectory, agentVersion3) {
+    this.agentVersion = agentVersion3;
+    const key = createHash10("sha256").update(path13.resolve(stateDirectory).toLowerCase()).digest("hex");
+    this.file = path13.join(directory, key + ".json");
+  }
+  agentVersion;
+  instanceId = randomUUID7();
+  events = [];
+  sessions = /* @__PURE__ */ new Map();
+  sequence = 0;
+  connection = {
+    state: "starting",
+    origin: null,
+    epoch: null
+  };
+  writing = null;
+  file;
+  record(event, details = {}) {
+    this.events.push({ seq: ++this.sequence, at: (/* @__PURE__ */ new Date()).toISOString(), event, ...details });
+    if (this.events.length > 100) this.events.shift();
+  }
+  configureOrigin(origin) {
+    try {
+      const url2 = new URL(origin);
+      if (url2.origin === origin && !url2.username && !url2.password && (url2.protocol === "https:" || url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) {
+        this.connection.origin = url2.origin;
+      }
+    } catch {
+    }
+  }
+  setConnection(state, connection) {
+    if (connection) {
+      try {
+        this.configureOrigin(new URL(connection.url).origin.replace(/^ws/, "http"));
+      } catch {
+      }
+      this.connection.epoch = connection.connectionEpoch;
+    }
+    this.connection.state = state;
+    this.record(state);
+  }
+  request(request) {
+    const payload = request.payload;
+    const parsed = ExecutionBindingSchema.safeParse(payload?.binding);
+    if (!parsed.success || parsed.data.tenantId !== request.tenantId || parsed.data.deviceId !== request.deviceId || parsed.data.executionId !== request.executionId || parsed.data.operationId !== request.operationId) return;
+    const binding2 = parsed.data;
+    this.sessions.delete(binding2.sessionId);
+    this.sessions.set(binding2.sessionId, {
+      sessionId: binding2.sessionId,
+      workspaceGrantId: binding2.workspaceGrantId,
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      model: null
+    });
+    if (this.sessions.size > 32) this.sessions.delete(this.sessions.keys().next().value);
+    const tool = ToolCallSchema.safeParse(payload?.tool);
+    this.record(request.kind, {
+      sessionId: binding2.sessionId,
+      executionId: binding2.executionId,
+      ...tool.success ? { tool: tool.data.name } : {}
+    });
+  }
+  result(binding2, state, code) {
+    this.record(["finished", "failed", "cancelled", "unknown"].includes(state) ? state : "result", {
+      sessionId: binding2.sessionId,
+      executionId: binding2.executionId,
+      code: code === "SUCCESS" || ErrorCodeSchema.safeParse(code).success ? code : "RESULT"
+    });
+  }
+  requestFailed() {
+    this.record("request_failed");
+  }
+  connectionFailed(error62) {
+    const code = error62 instanceof Error ? error62.message : "";
+    this.record("connection_error", { code: [
+      "RELAY_CONNECT_FAILED",
+      "RELAY_CONNECT_CLOSED",
+      "RELAY_CONNECT_TIMEOUT",
+      "RELAY_HANDSHAKE_TIMEOUT",
+      "RELAY_RESULT_TIMEOUT",
+      "WORKSPACE_ACK_TIMEOUT"
+    ].includes(code) ? code : "CONNECTION_FAILED" });
+  }
+  response(value) {
+    const result2 = value;
+    if (result2?.accepted === false) this.record("rejected", {
+      code: ErrorCodeSchema.safeParse(result2.code).success ? String(result2.code) : "REJECTED"
+    });
+  }
+  snapshot() {
+    return {
+      schemaVersion: 1,
+      instanceId: this.instanceId,
+      pid: process.pid,
+      agentVersion: this.agentVersion,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      connection: { ...this.connection },
+      sessions: [...this.sessions.values()].map((session) => ({ ...session })),
+      events: this.events.map((event) => ({ ...event }))
+    };
+  }
+  flush() {
+    if (this.writing) return this.writing;
+    this.writing = (async () => {
+      const directory = path13.dirname(this.file);
+      await mkdir5(directory, { recursive: true, mode: 448 });
+      const stat = await lstat7(directory);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
+      const temporary = this.file + "." + this.instanceId + ".tmp";
+      const handle = await open6(temporary, "wx", 384);
+      try {
+        try {
+          await handle.writeFile(JSON.stringify(this.snapshot()) + "\n");
+        } finally {
+          await handle.close();
+        }
+        await rename4(temporary, this.file);
+      } finally {
+        await rm4(temporary, { force: true });
+      }
+    })().finally(() => {
+      this.writing = null;
+    });
+    return this.writing;
+  }
+  async close() {
+    await this.writing?.catch(() => {
+    });
+    await this.flush();
+  }
+};
+
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.5" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.7" : "0.3.2";
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -29212,11 +29439,11 @@ function processAlive(pid) {
   }
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
-  await mkdir5(stateDir, { recursive: true });
-  const file2 = path12.join(stateDir, "agent-process.json");
+  await mkdir6(stateDir, { recursive: true });
+  const file2 = path14.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await open6(file2, "wx", 384);
+      const handle = await open7(file2, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, runtimeDir, version: version2, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n", "utf8");
       } finally {
@@ -29225,7 +29452,7 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       return async () => {
         try {
           const current2 = JSON.parse(await readFile5(file2, "utf8"));
-          if (current2.pid === process.pid) await rm4(file2, { force: true });
+          if (current2.pid === process.pid) await rm5(file2, { force: true });
         } catch {
         }
       };
@@ -29238,7 +29465,7 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm4(file2, { force: true });
+      await rm5(file2, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -29261,6 +29488,7 @@ async function runAgent(options) {
     if (!Number.isInteger(delay) || delay < 0 || delay > 3e4) throw Error("RECONNECT_DELAY_INVALID");
     const identity = await options.store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
+    options.monitor?.configureOrigin(identity.enrollment.serverOrigin);
     await options.journal.recoverAfterRestart();
     await options.store.loadWorkspaces();
   } catch (error62) {
@@ -29270,6 +29498,7 @@ async function runAgent(options) {
   const runtime = new NativeRuntime({ journal: options.journal, tools: options.tools, scheduler: new NativeScheduler(), workspaces: () => options.store.loadWorkspaces(Boolean(options.guard)), guard: options.guard, efficiencyLedger: options.efficiencyLedger });
   let connection = null;
   const bridge = new NativeRelayBridge(runtime, (binding2, state, code, metrics) => {
+    options.monitor?.result(binding2, state, code);
     if (!connection) throw Error("RELAY_SOCKET_CLOSED");
     return connection.sendTerminal(binding2, state, code, metrics);
   }, options.journal);
@@ -29281,11 +29510,21 @@ async function runAgent(options) {
         ready = resolve;
       });
       try {
+        options.monitor?.setConnection("connecting");
         connection = await connect({ store: options.store, agentVersion: options.agentVersion, handleRequest: async (request) => {
           await readyPromise;
-          return bridge.handle(request);
+          options.monitor?.request(request);
+          try {
+            const result2 = await bridge.handle(request);
+            options.monitor?.response(result2);
+            return result2;
+          } catch (error62) {
+            options.monitor?.requestFailed();
+            throw error62;
+          }
         } });
         await bridge.connected(connection);
+        options.monitor?.setConnection("connected", connection);
         ready();
         if (options.signal.aborted) connection.close("agent_shutdown");
         else {
@@ -29307,9 +29546,11 @@ async function runAgent(options) {
         }
       } catch (error62) {
         ready();
+        options.monitor?.connectionFailed(error62);
         if (error62 instanceof RelayClientError && ["RELAY_CONNECT_FAILED", "RELAY_CONNECT_CLOSED", "RELAY_CONNECT_TIMEOUT", "RELAY_HANDSHAKE_TIMEOUT"].includes(error62.code)) {
         } else throw error62;
       } finally {
+        options.monitor?.setConnection("disconnected");
         connection?.close("agent_disconnect");
         await bridge.disconnected();
         connection = null;
@@ -29324,10 +29565,10 @@ async function runAgent(options) {
 async function main() {
   if (process.platform !== "win32") throw Error("WINDOWS_REQUIRED");
   const appData = process.env.LOCALAPPDATA;
-  if (!appData || !path12.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path12.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path12.dirname(process.execPath);
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path12.join(binaryDir, "OwnerBridge.exe");
+  if (!appData || !path14.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path14.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path14.dirname(process.execPath);
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path14.join(binaryDir, "OwnerBridge.exe");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (command === "pair") {
@@ -29365,6 +29606,9 @@ async function main() {
       displayName: w.displayName,
       path: w.root,
       permissions: w.permissions,
+      accessMode: w.fullAccess ? "full" : "scoped",
+      deniedCommands: w.deniedCommands ?? [],
+      deniedLocalhostPorts: w.deniedLocalhostPorts ?? [],
       allowedCommands: w.allowedCommands,
       executables: Object.fromEntries(w.allowedCommands.map((name2) => [name2, programs[name2]?.executable ?? null])),
       localhostPorts: w.localhostPorts,
@@ -29375,7 +29619,7 @@ async function main() {
   const args = process.argv.slice(3);
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path14.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -29385,7 +29629,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path12.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path14.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -29404,7 +29648,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -29416,7 +29660,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -29454,25 +29698,41 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path14.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const publishMonitor = () => monitor.flush().catch(() => {
+    process.stderr.write("MONITOR_WRITE_FAILED\n");
+  });
+  await publishMonitor();
+  const monitorTimer = setInterval(() => {
+    void publishMonitor();
+  }, 2e3);
   try {
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
-    const efficiencyLedger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const efficiencyLedger = await OptimizationLedger.open(path14.join(stateDir, "optimization"));
     try {
-      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path12.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
+      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path14.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
       process.once("SIGTERM", () => stop.abort());
       const guard = await NativeGuard.open(store, journal);
-      await runAgent({ store, journal, tools, signal: stop.signal, agentVersion: AGENT_VERSION2, guard, efficiencyLedger });
+      await runAgent({ store, journal, tools, signal: stop.signal, agentVersion: AGENT_VERSION2, guard, efficiencyLedger, monitor });
+      monitor.setConnection("stopped");
     } finally {
       await efficiencyLedger.close();
       await journal.close();
     }
+  } catch (error62) {
+    monitor.setConnection("failed");
+    throw error62;
   } finally {
+    clearInterval(monitorTimer);
+    await monitor.close().catch(() => {
+      process.stderr.write("MONITOR_WRITE_FAILED\n");
+    });
     await releaseProcess();
   }
 }
-if (process.argv[1] && path12.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (process.argv[1] && path14.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";
     process.stderr.write(code + "\n");