local-commander-agent 0.3.51 → 0.3.52

package/runtime/agent.mjs

@@ -3240,7 +3240,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open14() {
+          ws.once("open", function open15() {
             duplex._final(callback);
           });
           return;
@@ -3261,7 +3261,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open14() {
+          ws.once("open", function open15() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -4541,10 +4541,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path31) {
-  if (!path31)
+function getElementAtPath(obj, path32) {
+  if (!path32)
     return obj;
-  return path31.reduce((acc, key) => acc?.[key], obj);
+  return path32.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -4884,11 +4884,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path31, issues) {
+function prefixIssues(path32, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path31);
+    iss.path.unshift(path32);
     return iss;
   });
 }
@@ -4939,14 +4939,14 @@ function codePointLength(str) {
   const units2 = str.length;
   if (!highSurrogate.test(str))
     return units2;
-  let count3 = units2;
+  let count4 = units2;
   for (let i = 0; i < units2 - 1; i++) {
     if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
-      count3--;
+      count4--;
       i++;
     }
   }
-  return count3;
+  return count4;
 }
 function getLengthableOrigin(input2) {
   if (Array.isArray(input2))
@@ -5338,16 +5338,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path31 = []) => {
+  const processError = (error63, path32 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path31, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path32, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path32, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path32, ...issue2.path]);
       } else {
-        const fullpath = [...path31, ...issue2.path];
+        const fullpath = [...path32, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5386,17 +5386,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path31 = []) => {
+  const processError = (error63, path32 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path31, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path32, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path32, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path32, ...issue2.path]);
       } else {
-        const fullpath = [...path31, ...issue2.path];
+        const fullpath = [...path32, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5435,8 +5435,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path31 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path31) {
+  const path32 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path32) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -8551,9 +8551,9 @@ function partPattern(schema) {
     return own2;
   }
   if (def.options) {
-    const sources = def.options.map(partPattern);
-    if (sources.every(Boolean))
-      return `^(${sources.map((s) => cleanRegex(s)).join("|")})$`;
+    const sources2 = def.options.map(partPattern);
+    if (sources2.every(Boolean))
+      return `^(${sources2.map((s) => cleanRegex(s)).join("|")})$`;
   }
   return leafPattern(schema);
 }
@@ -9301,8 +9301,8 @@ function az_default() {
 }
 
 // ../../node_modules/zod/v4/locales/be.js
-function getBelarusianPlural(count3, one, few, many) {
-  const absCount = Math.abs(count3);
+function getBelarusianPlural(count4, one, few, many) {
+  const absCount = Math.abs(count4);
   const lastDigit = absCount % 10;
   const lastTwoDigits = absCount % 100;
   if (lastTwoDigits >= 11 && lastTwoDigits <= 19) {
@@ -11949,8 +11949,8 @@ function hu_default() {
 }
 
 // ../../node_modules/zod/v4/locales/hy.js
-function getArmenianPlural(count3, one, many) {
-  return Math.abs(count3) === 1 ? one : many;
+function getArmenianPlural(count4, one, many) {
+  return Math.abs(count4) === 1 ? one : many;
 }
 function withDefiniteArticle(word) {
   if (!word)
@@ -14688,8 +14688,8 @@ function ro_default() {
 }
 
 // ../../node_modules/zod/v4/locales/ru.js
-function getRussianPlural(count3, one, few, many) {
-  const absCount = Math.abs(count3);
+function getRussianPlural(count4, one, few, many) {
+  const absCount = Math.abs(count4);
   const lastDigit = absCount % 10;
   const lastTwoDigits = absCount % 100;
   if (lastTwoDigits >= 11 && lastTwoDigits <= 19) {
@@ -19288,8 +19288,8 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
 }
 
 // ../../node_modules/zod/v4/core/to-json-schema.js
-function assignProps(target, ...sources) {
-  for (const source of sources) {
+function assignProps(target, ...sources2) {
+  for (const source of sources2) {
     for (const key of Reflect.ownKeys(source)) {
       if (Object.prototype.propertyIsEnumerable.call(source, key)) {
         assignProp(target, key, source[key]);
@@ -22538,13 +22538,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path31 = ref.slice(1).split("/").filter(Boolean);
-  if (path31.length === 0) {
+  const path32 = ref.slice(1).split("/").filter(Boolean);
+  if (path32.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path31[0] === defsKey) {
-    const key = path31[1] === void 0 ? void 0 : decodeJSONPointerSegment(path31[1]);
+  if (path32[0] === defsKey) {
+    const key = path32[1] === void 0 ? void 0 : decodeJSONPointerSegment(path32[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -24580,7 +24580,7 @@ var RelayBridge = class _RelayBridge {
     const upstream = netConnect({ host, port });
     this.tunnels.add(socket);
     this.tunnels.add(upstream);
-    let open14 = false;
+    let open15 = false;
     const cleanup = () => {
       this.tunnels.delete(socket);
       this.tunnels.delete(upstream);
@@ -24588,13 +24588,13 @@ var RelayBridge = class _RelayBridge {
       upstream.destroy();
     };
     const timer = setTimeout(() => {
-      if (!open14) {
+      if (!open15) {
         refuse("504 Gateway Timeout");
         cleanup();
       }
     }, CONNECT_TIMEOUT_MS);
     upstream.once("connect", () => {
-      open14 = true;
+      open15 = true;
       clearTimeout(timer);
       socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
       if (head.length) upstream.write(head);
@@ -24603,7 +24603,7 @@ var RelayBridge = class _RelayBridge {
     });
     upstream.on("error", () => {
       clearTimeout(timer);
-      if (!open14) refuse("502 Bad Gateway");
+      if (!open15) refuse("502 Bad Gateway");
       cleanup();
     });
     socket.on("error", cleanup);
@@ -24624,7 +24624,7 @@ var RelayBridge = class _RelayBridge {
     const remote = (0, import_stream.default)(ws, { allowHalfOpen: false });
     this.tunnels.add(socket);
     this.tunnels.add(remote);
-    let reply = Buffer.alloc(0), open14 = false;
+    let reply = Buffer.alloc(0), open15 = false;
     const cleanup = () => {
       this.tunnels.delete(socket);
       this.tunnels.delete(remote);
@@ -24632,7 +24632,7 @@ var RelayBridge = class _RelayBridge {
       remote.destroy();
     };
     const timer = setTimeout(() => {
-      if (!open14) {
+      if (!open15) {
         refuse("504 Gateway Timeout");
         cleanup();
       }
@@ -24654,7 +24654,7 @@ var RelayBridge = class _RelayBridge {
         cleanup();
         return;
       }
-      open14 = true;
+      open15 = true;
       socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
       const rest = reply.subarray(end + 4);
       if (rest.length) socket.write(rest);
@@ -24671,7 +24671,7 @@ Proxy-Authorization: Basic ${Buffer.from("lc:" + route.token).toString("base64")
       remote.on("data", onReply);
     });
     remote.on("error", () => {
-      if (!open14) refuse("502 Bad Gateway");
+      if (!open15) refuse("502 Bad Gateway");
       cleanup();
     });
     socket.on("error", cleanup);
@@ -25037,19 +25037,19 @@ import path2 from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 var Receipt = external_exports.object({ version: external_exports.literal(1), deviceId: external_exports.string().uuid(), tenantId: external_exports.string().uuid(), accountId: external_exports.string().uuid(), bundleId: external_exports.string().regex(/^[a-f0-9]{64}$/) }).strict();
-function networkPath(stateDirectory, name2) {
-  return path2.join(path2.dirname(stateDirectory), "Network", name2);
+function networkPath(stateDirectory2, name2) {
+  return path2.join(path2.dirname(stateDirectory2), "Network", name2);
 }
-async function networkDirectory(stateDirectory) {
-  const directory = path2.dirname(networkPath(stateDirectory, "x"));
+async function networkDirectory(stateDirectory2) {
+  const directory = path2.dirname(networkPath(stateDirectory2, "x"));
   await fs.mkdir(directory, { recursive: true, mode: 448 });
   const stat2 = await fs.lstat(directory);
   if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw Error("NETWORK_DIRECTORY_INVALID");
   return directory;
 }
-async function networkPrepared(stateDirectory, identity) {
+async function networkPrepared(stateDirectory2, identity) {
   try {
-    const file3 = networkPath(stateDirectory, "network-prepared.json"), stat2 = await fs.lstat(file3);
+    const file3 = networkPath(stateDirectory2, "network-prepared.json"), stat2 = await fs.lstat(file3);
     if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 1024) return false;
     const receipt = Receipt.parse(JSON.parse(await fs.readFile(file3, "utf8"))), e = identity.enrollment;
     return !!e && receipt.deviceId === e.deviceId && receipt.tenantId === e.tenantId && receipt.accountId === e.accountId;
@@ -25087,9 +25087,9 @@ async function payload(binaryDirectory) {
     throw error62;
   }
 }
-async function installedNetworkHelper(stateDirectory) {
+async function installedNetworkHelper(stateDirectory2) {
   try {
-    const receipt = Receipt.parse(JSON.parse(await fs.readFile(networkPath(stateDirectory, "network-prepared.json"), "utf8")));
+    const receipt = Receipt.parse(JSON.parse(await fs.readFile(networkPath(stateDirectory2, "network-prepared.json"), "utf8")));
     const programFiles = process.env.ProgramW6432 ?? process.env.ProgramFiles ?? "C:\\Program Files";
     const helper = path2.join(programFiles, "LocalCommander", "Network", receipt.bundleId, "NetworkService.exe"), stat2 = await fs.lstat(helper);
     if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 4 * 1024 * 1024 || (await fs.realpath(helper)).toLowerCase() !== path2.resolve(helper).toLowerCase()) return null;
@@ -25118,13 +25118,13 @@ async function elevated(helper, command, requestPath, directory) {
     await fs.rm(scriptPath, { force: true });
   }
 }
-async function setupNetwork(binaryDirectory, stateDirectory, identity) {
+async function setupNetwork(binaryDirectory, stateDirectory2, identity) {
   const bundle = await payload(binaryDirectory);
   if (!bundle) return "not_packaged";
   const e = identity.enrollment;
   if (!e?.accountId) throw Error("NETWORK_ACCOUNT_BINDING_REQUIRED");
   const request = { ownerSid: windowsSid(), tenantId: e.tenantId, accountId: e.accountId, deviceId: e.deviceId, keyFingerprint: identity.fingerprint };
-  const directory = await networkDirectory(stateDirectory);
+  const directory = await networkDirectory(stateDirectory2);
   const requestPath = path2.join(directory, "network-setup-" + randomUUID2() + ".json");
   await fs.writeFile(requestPath, JSON.stringify(request), { flag: "wx", mode: 384 });
   try {
@@ -25143,14 +25143,14 @@ async function setupNetwork(binaryDirectory, stateDirectory, identity) {
     await fs.rm(requestPath, { force: true });
   }
 }
-async function removeNetwork(binaryDirectory, stateDirectory, identity) {
+async function removeNetwork(binaryDirectory, stateDirectory2, identity) {
   const e = identity.enrollment;
-  if (!e || !await networkPrepared(stateDirectory, identity)) return;
+  if (!e || !await networkPrepared(stateDirectory2, identity)) return;
   await localNetworkControl(e.deviceId, "off");
-  const helper = (await payload(binaryDirectory))?.helper ?? await installedNetworkHelper(stateDirectory);
+  const helper = (await payload(binaryDirectory))?.helper ?? await installedNetworkHelper(stateDirectory2);
   if (!helper) throw Error("NETWORK_REMOVAL_PACKAGE_REQUIRED");
-  await elevated(helper, "uninstall", void 0, await networkDirectory(stateDirectory));
-  await fs.rm(networkPath(stateDirectory, "network-prepared.json"), { force: true });
+  await elevated(helper, "uninstall", void 0, await networkDirectory(stateDirectory2));
+  await fs.rm(networkPath(stateDirectory2, "network-prepared.json"), { force: true });
 }
 async function openNetworkPanel(binaryDirectory, identity) {
   const bundle = await payload(binaryDirectory), e = identity.enrollment;
@@ -25164,8 +25164,8 @@ async function openNetworkPanel(binaryDirectory, identity) {
 }
 
 // agent/src/main.ts
-import path30 from "node:path";
-import os8 from "node:os";
+import path31 from "node:path";
+import os9 from "node:os";
 
 // agent/src/posix-store.ts
 import { constants } from "node:fs";
@@ -25584,7 +25584,7 @@ async function acquirePosixJournalGuard(directory, helper) {
 }
 
 // agent/src/main.ts
-import { mkdir as mkdir15, open as open13, readFile as readFile13, realpath as realpath10, rm as rm11 } from "node:fs/promises";
+import { mkdir as mkdir16, open as open14, readFile as readFile14, realpath as realpath10, rm as rm12 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -27140,7 +27140,7 @@ var NativeJournal = class _NativeJournal {
    * still alive; otherwise, including every entry from an older agent, it stays EXECUTION_UNKNOWN (#194). */
   recoverAfterRestart(liveness) {
     return this.enqueue(async () => {
-      let count3 = 0;
+      let count4 = 0;
       const interrupted = [...this.entries.values()].filter((e) => ["accepted", "running"].includes(e.state));
       const pids = [...new Set(interrupted.flatMap((e) => e.supervisors ?? []))];
       const linuxSupervisors = interrupted.flatMap((e) => e.linuxSupervisors ?? []), darwinSupervisors = interrupted.flatMap((e) => e.darwinSupervisors ?? []);
@@ -27173,9 +27173,9 @@ var NativeJournal = class _NativeJournal {
           } });
         }
         await this.persist(e);
-        count3++;
+        count4++;
       }
-      return count3;
+      return count4;
     });
   }
   eligibleForPruning(entry, cutoff) {
@@ -27183,20 +27183,20 @@ var NativeJournal = class _NativeJournal {
   }
   admissionAvailable() {
     if (this.closed || this.lock.guard && !this.lock.guard.active) return false;
-    let count3 = this.entries.size, bytes3 = this.totalBytes;
-    if (count3 < this.options.maxEntries && bytes3 + MAX_ENVELOPE <= this.options.maxBytes) return true;
+    let count4 = this.entries.size, bytes3 = this.totalBytes;
+    if (count4 < this.options.maxEntries && bytes3 + MAX_ENVELOPE <= this.options.maxBytes) return true;
     const cutoff = this.now().getTime() - this.options.retentionMs;
     for (const entry of this.entries.values()) {
       if (!this.eligibleForPruning(entry, cutoff)) continue;
-      count3--;
+      count4--;
       bytes3 -= this.sizes.get(entry.executionId);
-      if (count3 < this.options.maxEntries && bytes3 + MAX_ENVELOPE <= this.options.maxBytes) return true;
+      if (count4 < this.options.maxEntries && bytes3 + MAX_ENVELOPE <= this.options.maxBytes) return true;
     }
     return false;
   }
   // Called only inside the serialized queue; enqueueing prune here would deadlock.
   async pruneEligible() {
-    let count3 = 0;
+    let count4 = 0;
     const cutoff = this.now().getTime() - this.options.retentionMs;
     for (const e of [...this.entries.values()]) {
       if (!this.eligibleForPruning(e, cutoff)) continue;
@@ -27206,9 +27206,9 @@ var NativeJournal = class _NativeJournal {
       this.entries.delete(e.executionId);
       this.sizes.delete(e.executionId);
       this.digests.delete(e.executionId);
-      count3++;
+      count4++;
     }
-    return count3;
+    return count4;
   }
   prune() {
     return this.enqueue(() => this.pruneEligible());
@@ -29546,11 +29546,11 @@ async function portalScreenshot(socket, uid, token, signal) {
       signal.addEventListener("abort", abort, { once: true });
       connection.on("error", fail7);
       connection.on("close", () => fail7(Error("CLOSED")));
-      const call = (destination, path31, iface, member, signature = "", body = () => {
+      const call = (destination, path32, iface, member, signature = "", body = () => {
       }) => new Promise((done, failed) => {
         const payload2 = new Writer();
         body(payload2);
-        const header = new Writer(), fields = [[1, "o", path31], [2, "s", iface], [3, "s", member], [6, "s", destination]];
+        const header = new Writer(), fields = [[1, "o", path32], [2, "s", iface], [3, "s", member], [6, "s", destination]];
         if (signature) fields.push([8, "g", signature]);
         header.byte(108);
         header.byte(1);
@@ -29733,8 +29733,8 @@ function downscale(image, edge) {
       sums[x * 3 + 2] = sums[x * 3 + 2] + image.rgb[i + 2];
     }
     for (let x = 0; x < width; x++) {
-      const count3 = (ys[y + 1] - ys[y]) * (xs[x + 1] - xs[x]);
-      for (let c = 0; c < 3; c++) rgb[(y * width + x) * 3 + c] = Math.round(sums[x * 3 + c] / count3);
+      const count4 = (ys[y + 1] - ys[y]) * (xs[x + 1] - xs[x]);
+      for (let c = 0; c < 3; c++) rgb[(y * width + x) * 3 + c] = Math.round(sums[x * 3 + c] / count4);
     }
   }
   return { width, height, rgb };
@@ -30210,8 +30210,8 @@ var HUFFMAN = [
 var CODES = HUFFMAN.map(([, counts, values]) => {
   const table2 = [];
   let code = 0, at = 0;
-  counts.forEach((count3, index) => {
-    for (let i = 0; i < count3; i++) table2[values[at++]] = [code++, index + 1];
+  counts.forEach((count4, index) => {
+    for (let i = 0; i < count4; i++) table2[values[at++]] = [code++, index + 1];
     code <<= 1;
   });
   return table2;
@@ -31081,16 +31081,16 @@ var NativeTools = class {
           if (value) selectedHeaders[name2] = value.slice(0, 2048);
         }
         const reader = response.body?.getReader(), chunks = [];
-        let count3 = 0, truncated = false;
+        let count4 = 0, truncated = false;
         try {
           if (reader) for (; ; ) {
             const part = await reader.read();
             if (part.done) break;
             const b = Buffer.from(part.value);
-            const take = Math.min(b.length, 1e5 - count3);
+            const take = Math.min(b.length, 1e5 - count4);
             chunks.push(b.subarray(0, take));
-            count3 += take;
-            if (take !== b.length || count3 >= 1e5) {
+            count4 += take;
+            if (take !== b.length || count4 >= 1e5) {
               truncated = true;
               break;
             }
@@ -31644,11 +31644,11 @@ function parseNodeTapShadow(input2) {
       return passThrough(input2, "unrecognized_record", true, notices);
     }
     if (line === "") continue;
-    const count3 = SUMMARY_COUNT.exec(line);
-    if (count3) {
-      const key = count3[1];
+    const count4 = SUMMARY_COUNT.exec(line);
+    if (count4) {
+      const key = count4[1];
       if (counts.has(key)) return passThrough(input2, "summary_inconsistent", true, notices);
-      counts.set(key, Number(count3[2]));
+      counts.set(key, Number(count4[2]));
       continue;
     }
     const summaryDuration = SUMMARY_DURATION.exec(line);
@@ -31762,11 +31762,11 @@ function parseNodeTapFailureShadow(input2) {
   let durationMs = null;
   for (const line of lines.slice(index + 1)) {
     if (!line) continue;
-    const count3 = SUMMARY_COUNT.exec(line);
-    if (count3) {
-      const key = count3[1];
+    const count4 = SUMMARY_COUNT.exec(line);
+    if (count4) {
+      const key = count4[1];
       if (counts.has(key)) return fallback("summary_inconsistent");
-      counts.set(key, Number(count3[2]));
+      counts.set(key, Number(count4[2]));
     } else {
       const duration3 = SUMMARY_DURATION.exec(line);
       if (duration3) {
@@ -36575,9 +36575,9 @@ var rev2026Codec = {
     });
     const parsed = buildSchemas2026().RequestMetaEnvelopeSchema.safeParse(meta3);
     if (!parsed.success) for (const issue2 of parsed.error.issues) {
-      const path31 = issue2.path.map(String);
-      const key = path31.length > 0 ? path31.join(".") : "_meta";
-      if (path31.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
+      const path32 = issue2.path.map(String);
+      const key = path32.length > 0 ? path32.join(".") : "_meta";
+      if (path32.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing")) continue;
       issues.push({
         key,
         problem: issue2.message
@@ -36879,29 +36879,29 @@ var PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
-  const visit2 = (node2, path31, reachable) => {
+  const visit2 = (node2, path32, reachable) => {
     if (node2 === null || typeof node2 !== "object") return void 0;
     const schema = node2;
     if (X_MCP_HEADER_KEY in schema) {
-      if (!reachable || path31.length === 0) return `${pathName(path31)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
+      if (!reachable || path32.length === 0) return `${pathName(path32)}: x-mcp-header is only permitted on properties statically reachable via a chain of 'properties' keys (not under items, additionalProperties, oneOf/anyOf/allOf/not, if/then/else, or $ref)`;
       const raw = schema[X_MCP_HEADER_KEY];
-      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path31)}: x-mcp-header MUST be a non-empty string`;
-      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path31)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
+      if (typeof raw !== "string" || raw.length === 0) return `${pathName(path32)}: x-mcp-header MUST be a non-empty string`;
+      if (!RFC9110_TOKEN.test(raw)) return `${pathName(path32)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
       const type = typeof schema.type === "string" ? schema.type : void 0;
-      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path31)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+      if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path32)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
       const lower = raw.toLowerCase();
       const prior = seenLower.get(lower);
       if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
       seenLower.set(lower, raw);
       declarations.push({
-        path: path31,
+        path: path32,
         headerName: raw,
         type
       });
     }
     const properties = schema.properties;
     if (properties !== null && typeof properties === "object") for (const [key, child] of Object.entries(properties)) {
-      const fault$1 = visit2(child, [...path31, key], reachable);
+      const fault$1 = visit2(child, [...path32, key], reachable);
       if (fault$1 !== void 0) return fault$1;
     }
     for (const k of NON_REACHABLE_SUBSCHEMA_KEYWORDS) {
@@ -36909,7 +36909,7 @@ function scanXMcpHeaderDeclarations(inputSchema) {
       if (sub === void 0) continue;
       const branches = Array.isArray(sub) ? sub : sub !== null && typeof sub === "object" && OBJECT_VALUED_SUBSCHEMA_KEYWORDS.has(k) ? Object.values(sub) : [sub];
       for (const branch of branches) {
-        const fault$1 = visit2(branch, [...path31, `<${k}>`], false);
+        const fault$1 = visit2(branch, [...path32, `<${k}>`], false);
         if (fault$1 !== void 0) return fault$1;
       }
     }
@@ -36949,8 +36949,8 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
   "$defs",
   "definitions"
 ]);
-function pathName(path31) {
-  return path31.length === 0 ? "<root>" : path31.join(".");
+function pathName(path32) {
+  return path32.length === 0 ? "<root>" : path32.join(".");
 }
 var HEADER_MISMATCH_ERROR_CODE = -32020;
 var INBOUND_VALIDATION_LADDER = [
@@ -37200,7 +37200,7 @@ var PROPERTY_KEYS_BY_TYPE = {
   array: shapeKeys([UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema])
 };
 var SUPPORTED_STRING_FORMATS = new Set(StringSchemaSchema.shape.format.unwrap().options);
-function walkProperty(node2, path31, vendor, unsupported) {
+function walkProperty(node2, path32, vendor, unsupported) {
   if (!isJsonObject(node2)) return node2;
   const allowedKeys = typeof node2.type === "string" && Object.hasOwn(PROPERTY_KEYS_BY_TYPE, node2.type) ? PROPERTY_KEYS_BY_TYPE[node2.type] : void 0;
   if (allowedKeys === void 0) return node2;
@@ -37208,8 +37208,8 @@ function walkProperty(node2, path31, vendor, unsupported) {
   for (const [key, value] of Object.entries(node2)) if (allowedKeys.has(key) || isAnnotationOnlyJsonSchemaKeyword(key)) pruned[key] = value;
   else if (key === "pattern" && node2.type === "string" && typeof node2.format === "string") {
     if (!SUPPORTED_STRING_FORMATS.has(node2.format)) pruned[key] = value;
-    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path31}.${key}`);
-  } else unsupported.push(`${path31}.${key}`);
+    else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor)) unsupported.push(`${path32}.${key}`);
+  } else unsupported.push(`${path32}.${key}`);
   return pruned;
 }
 function walkRequestedSchema(converted, vendor) {
@@ -37226,11 +37226,11 @@ function describeUnsupportedProperties(pruned, fallback) {
   const offenders = Object.entries(pruned.properties).filter(([, node2]) => !parseSchema(PrimitiveSchemaDefinitionSchema, node2).success).map(([name2]) => `properties.${name2}`);
   return offenders.length > 0 ? offenders.join(", ") : fallback;
 }
-function findDroppedConstraintPaths(original, parsed, path31 = "") {
-  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path31}[${index}]`));
+function findDroppedConstraintPaths(original, parsed, path32 = "") {
+  if (Array.isArray(original) && Array.isArray(parsed)) return original.flatMap((item, index) => findDroppedConstraintPaths(item, parsed[index], `${path32}[${index}]`));
   if (!isJsonObject(original) || !isJsonObject(parsed)) return [];
   return Object.entries(original).flatMap(([key, value]) => {
-    const childPath = path31 ? `${path31}.${key}` : key;
+    const childPath = path32 ? `${path32}.${key}` : key;
     if (!Object.prototype.hasOwnProperty.call(parsed, key)) return isAnnotationOnlyJsonSchemaKeyword(key) ? [] : [childPath];
     return findDroppedConstraintPaths(value, parsed[key], childPath);
   });
@@ -40460,15 +40460,15 @@ var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
     return false;
   }
   function countKeys(schema) {
-    let count3 = 0;
+    let count4 = 0;
     for (const key in schema) {
       if (key === "$ref") return Infinity;
-      count3++;
+      count4++;
       if (SIMPLE_INLINED.has(key)) continue;
-      if (typeof schema[key] == "object") (0, util_1.eachItem)(schema[key], (sch) => count3 += countKeys(sch));
-      if (count3 === Infinity) return Infinity;
+      if (typeof schema[key] == "object") (0, util_1.eachItem)(schema[key], (sch) => count4 += countKeys(sch));
+      if (count4 === Infinity) return Infinity;
     }
-    return count3;
+    return count4;
   }
   function getFullPath(resolver, id2 = "", normalize) {
     if (normalize !== false) id2 = normalizeId(id2);
@@ -41306,8 +41306,8 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     for (let i = 0; i < str.length; i++) if (str[i] === token) ind++;
     return ind;
   }
-  function removeDotSegments(path31) {
-    let input2 = path31;
+  function removeDotSegments(path32) {
+    let input2 = path32;
     const output2 = [];
     let nextSlash = -1;
     let len = 0;
@@ -41460,8 +41460,8 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       wsComponent.secure = void 0;
     }
     if (wsComponent.resourceName) {
-      const [path31, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path31 && path31 !== "/" ? path31 : void 0;
+      const [path32, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path32 && path32 !== "/" ? path32 : void 0;
       wsComponent.query = query;
       wsComponent.resourceName = void 0;
     }
@@ -43068,8 +43068,8 @@ var require_contains = /* @__PURE__ */ __commonJSMin(((exports) => {
       cxt.result(valid, () => cxt.reset());
       function validateItemsWithCount() {
         const schValid = gen.name("_valid");
-        const count3 = gen.let("count", 0);
-        validateItems(schValid, () => gen.if(schValid, () => checkLimits(count3)));
+        const count4 = gen.let("count", 0);
+        validateItems(schValid, () => gen.if(schValid, () => checkLimits(count4)));
       }
       function validateItems(_valid, block) {
         gen.forRange("i", 0, len, (i) => {
@@ -43082,13 +43082,13 @@ var require_contains = /* @__PURE__ */ __commonJSMin(((exports) => {
           block();
         });
       }
-      function checkLimits(count3) {
-        gen.code((0, codegen_1._)`${count3}++`);
-        if (max === void 0) gen.if((0, codegen_1._)`${count3} >= ${min}`, () => gen.assign(valid, true).break());
+      function checkLimits(count4) {
+        gen.code((0, codegen_1._)`${count4}++`);
+        if (max === void 0) gen.if((0, codegen_1._)`${count4} >= ${min}`, () => gen.assign(valid, true).break());
         else {
-          gen.if((0, codegen_1._)`${count3} > ${max}`, () => gen.assign(valid, false).break());
+          gen.if((0, codegen_1._)`${count4} > ${max}`, () => gen.assign(valid, false).break());
           if (min === 1) gen.assign(valid, true);
-          else gen.if((0, codegen_1._)`${count3} >= ${min}`, () => gen.assign(valid, true));
+          else gen.if((0, codegen_1._)`${count4} >= ${min}`, () => gen.assign(valid, true));
         }
       }
     }
@@ -47263,6 +47263,42 @@ var NativeIncidentProducer = class {
   }
 };
 
+// packages/contracts/src/token-usage-protocol.ts
+var TOKEN_USAGE_CAPABILITY = "tokenUsageV1";
+var uuid20 = external_exports.string().uuid().toLowerCase();
+var epoch3 = external_exports.string().refine((v) => /^[1-9]\d{0,18}$/.test(v) && BigInt(v) <= 9223372036854775807n);
+var tokens = external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var TokenUsageClientSchema = external_exports.enum(["claude-code", "codex"]);
+var TOKEN_USAGE_MODEL = /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,79}$/;
+var TokenUsageRowSchema = external_exports.object({
+  day: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).refine((v) => Number.isFinite(Date.parse(v + "T00:00:00Z"))),
+  client: TokenUsageClientSchema,
+  model: external_exports.string().regex(TOKEN_USAGE_MODEL),
+  requests: tokens,
+  inputTokens: tokens,
+  cachedInputTokens: tokens,
+  cacheWriteTokens: tokens,
+  outputTokens: tokens,
+  reasoningTokens: tokens.nullable()
+}).strict().refine((row) => row.cachedInputTokens + row.cacheWriteTokens <= row.inputTokens && (row.reasoningTokens === null || row.reasoningTokens <= row.outputTokens), "Subset exceeds total");
+var TokenUsageBatchSchema = external_exports.object({
+  type: external_exports.literal("tokenUsageBatch"),
+  protocolVersion: external_exports.literal(1),
+  batchId: uuid20,
+  connectionEpoch: epoch3,
+  /** Random per agent state; a new state counts only usage after it started, so states never overlap. */
+  stateId: uuid20,
+  rows: external_exports.array(TokenUsageRowSchema).min(1).max(64)
+}).strict().refine((batch) => new Set(batch.rows.map((r) => `${r.day}|${r.client}|${r.model}`)).size === batch.rows.length, "Duplicate rows");
+var TokenUsageBatchResultSchema = external_exports.enum(["accepted", "invalid", "stale", "disabled", "retry", "busy"]);
+var TokenUsageBatchAckSchema = external_exports.object({
+  type: external_exports.literal("tokenUsageBatchAck"),
+  protocolVersion: external_exports.literal(1),
+  batchId: uuid20.optional(),
+  result: TokenUsageBatchResultSchema
+}).strict();
+var TokenUsageStateSchema = external_exports.object({ type: external_exports.literal("tokenUsageState"), protocolVersion: external_exports.literal(1), connectionEpoch: epoch3, enabled: external_exports.boolean() }).strict();
+
 // agent/src/relay-client.ts
 var RelayClientError = class extends Error {
   constructor(code) {
@@ -47298,7 +47334,7 @@ function relayUrlFromEnrollment(enrollment) {
   url2.pathname = "/api/agent/relay";
   return url2.toString();
 }
-function uuid20(value, code) {
+function uuid21(value, code) {
   if (typeof value !== "string" || !UUID2.test(value)) fail5(code);
   return value.toLowerCase();
 }
@@ -47306,7 +47342,7 @@ function protocol(value, expected) {
   if (value !== expected) fail5("RELAY_PROTOCOL_INVALID");
   return expected;
 }
-function epoch3(value) {
+function epoch4(value) {
   if (typeof value !== "string" || !EPOCH.test(value) || BigInt(value) > 9223372036854775807n) fail5("RELAY_EPOCH_INVALID");
   return value;
 }
@@ -47428,11 +47464,11 @@ function sendJson(socket, value, maxBytes) {
 function validateChallenge(frame, expectedProtocol) {
   if (frame.type !== "challenge") fail5("RELAY_HANDSHAKE_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  uuid20(frame.gatewayId, "RELAY_HANDSHAKE_INVALID");
+  uuid21(frame.gatewayId, "RELAY_HANDSHAKE_INVALID");
   if (typeof frame.nonce !== "string" || frame.nonce.length < 32 || frame.nonce.length > 512 || /[\u0000-\u001f\u007f]/u.test(frame.nonce)) fail5("RELAY_HANDSHAKE_INVALID");
   if (typeof frame.expiresAt !== "string" || !Number.isFinite(Date.parse(frame.expiresAt)) || Date.parse(frame.expiresAt) <= Date.now()) fail5("RELAY_HANDSHAKE_INVALID");
   return {
-    challengeId: uuid20(frame.challengeId, "RELAY_HANDSHAKE_INVALID"),
+    challengeId: uuid21(frame.challengeId, "RELAY_HANDSHAKE_INVALID"),
     nonce: frame.nonce,
     // Older servers offer no capabilities and verify only the v1 proof.
     machineIdentity: Array.isArray(frame.capabilities) && frame.capabilities.includes(MACHINE_IDENTITY_CAPABILITY)
@@ -47441,27 +47477,27 @@ function validateChallenge(frame, expectedProtocol) {
 function validateReady(frame, enrollment, expectedProtocol) {
   if (frame.type !== "connected") fail5("RELAY_HANDSHAKE_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  if (uuid20(frame.tenantId, "RELAY_HANDSHAKE_INVALID") !== enrollment.tenantId.toLowerCase()) fail5("RELAY_ID_MISMATCH");
-  if (uuid20(frame.deviceId, "RELAY_HANDSHAKE_INVALID") !== enrollment.deviceId.toLowerCase()) fail5("RELAY_ID_MISMATCH");
+  if (uuid21(frame.tenantId, "RELAY_HANDSHAKE_INVALID") !== enrollment.tenantId.toLowerCase()) fail5("RELAY_ID_MISMATCH");
+  if (uuid21(frame.deviceId, "RELAY_HANDSHAKE_INVALID") !== enrollment.deviceId.toLowerCase()) fail5("RELAY_ID_MISMATCH");
   const terminalMetrics2 = Array.isArray(frame.capabilities) && frame.capabilities.includes(TERMINAL_METRICS_CAPABILITY);
-  return { connectionEpoch: epoch3(frame.connectionEpoch), terminalMetrics: terminalMetrics2 };
+  return { connectionEpoch: epoch4(frame.connectionEpoch), terminalMetrics: terminalMetrics2 };
 }
 function validateRequest(frame, enrollment, expectedProtocol, connectionEpoch) {
   if (frame.type !== "relayFrame") fail5("RELAY_REQUEST_INVALID");
   protocol(frame.protocolVersion, expectedProtocol);
-  const tenantId = uuid20(frame.tenantId, "RELAY_REQUEST_INVALID");
-  const deviceId = uuid20(frame.deviceId, "RELAY_REQUEST_INVALID");
+  const tenantId = uuid21(frame.tenantId, "RELAY_REQUEST_INVALID");
+  const deviceId = uuid21(frame.deviceId, "RELAY_REQUEST_INVALID");
   if (tenantId !== enrollment.tenantId.toLowerCase() || deviceId !== enrollment.deviceId.toLowerCase()) fail5("RELAY_ID_MISMATCH");
-  if (epoch3(frame.connectionEpoch) !== connectionEpoch) fail5("RELAY_EPOCH_MISMATCH");
+  if (epoch4(frame.connectionEpoch) !== connectionEpoch) fail5("RELAY_EPOCH_MISMATCH");
   const kind = frame.kind;
   if (typeof kind !== "string" || !REQUEST_KINDS.has(kind)) fail5("RELAY_REQUEST_INVALID");
   return {
-    requestId: uuid20(frame.requestId, "RELAY_REQUEST_INVALID"),
+    requestId: uuid21(frame.requestId, "RELAY_REQUEST_INVALID"),
     tenantId,
     deviceId,
     connectionEpoch,
-    operationId: uuid20(frame.operationId, "RELAY_REQUEST_INVALID"),
-    executionId: uuid20(frame.executionId, "RELAY_REQUEST_INVALID"),
+    operationId: uuid21(frame.operationId, "RELAY_REQUEST_INVALID"),
+    executionId: uuid21(frame.executionId, "RELAY_REQUEST_INVALID"),
     kind,
     payload: frame.payload,
     deadlineAt: isoDate(frame.deadlineAt),
@@ -47503,8 +47539,8 @@ async function connectOnce(options) {
   const identity = await options.store.load();
   if (!identity || !identity.enrollment) fail5("ENROLLMENT_MISSING");
   const enrollment = identity.enrollment;
-  const tenantId = uuid20(enrollment.tenantId, "ENROLLMENT_INVALID");
-  const deviceId = uuid20(enrollment.deviceId, "ENROLLMENT_INVALID");
+  const tenantId = uuid21(enrollment.tenantId, "ENROLLMENT_INVALID");
+  const deviceId = uuid21(enrollment.deviceId, "ENROLLMENT_INVALID");
   const url2 = relayUrlFromEnrollment(enrollment);
   const socket = new wrapper_default(url2, [], {
     followRedirects: false,
@@ -47523,7 +47559,8 @@ async function connectOnce(options) {
       guardIdentity: true,
       ...options.aiConnectivity ? { aiConnectivity: true } : {},
       ...options.onHeldLeases ? { heldLeases: true } : {},
-      ...options.onFullLogChoice ? { fullLogNotice: true } : {}
+      ...options.onFullLogChoice ? { fullLogNotice: true } : {},
+      ...options.onTokenUsageState ? { tokenUsage: true } : {}
     }, maxFrameBytes);
     const challenge = validateChallenge(await waitForMessage(socket, maxFrameBytes, connectTimeoutMs, "RELAY_HANDSHAKE_TIMEOUT"), protocolVersion2);
     const machine = challenge.machineIdentity ? options.machineIdentity?.(deviceId) ?? null : null;
@@ -47550,6 +47587,7 @@ async function connectOnce(options) {
     const { connectionEpoch, terminalMetrics: terminalMetrics2 } = validateReady(readyFrame, enrollment, protocolVersion2);
     const rejectionResults = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(REJECTION_RESULT_CAPABILITY);
     const incidents = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes("incidentBatchV1");
+    const tokenUsage = !!options.onTokenUsageState && Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(TOKEN_USAGE_CAPABILITY);
     const monitorHeartbeat = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes("monitorHeartbeatV1") && typeof readyFrame.heartbeatMs === "number" && Number.isInteger(readyFrame.heartbeatMs) && readyFrame.heartbeatMs >= 1e3 && readyFrame.heartbeatMs <= 6e4 ? readyFrame.heartbeatMs : void 0;
     const nativeStatus = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(NATIVE_STATUS_CAPABILITY) && options.status;
     const accessModes = Array.isArray(readyFrame.capabilities) && readyFrame.capabilities.includes(WORKSPACE_ACCESS_MODE_CAPABILITY);
@@ -47637,6 +47675,26 @@ async function connectOnce(options) {
             }
             return;
           }
+          if (frame.type === "tokenUsageState") {
+            const state = TokenUsageStateSchema.safeParse(frame);
+            if (tokenUsage && state.success && state.data.connectionEpoch === connectionEpoch) {
+              try {
+                options.onTokenUsageState?.(state.data.enabled);
+              } catch {
+              }
+            }
+            return;
+          }
+          if (frame.type === "tokenUsageBatchAck") {
+            const ack = TokenUsageBatchAckSchema.safeParse(frame);
+            if (tokenUsage && ack.success) {
+              try {
+                options.onTokenUsageAck?.(ack.data.batchId, ack.data.result);
+              } catch {
+              }
+            }
+            return;
+          }
           if (frame.type === "aiConnectivityRevoked") {
             if (connectivity && frame.protocolVersion === 1 && frame.connectionEpoch === connectionEpoch) notifyConnectivityRevoked();
             return;
@@ -47767,6 +47825,15 @@ async function connectOnce(options) {
           return false;
         }
       } } : {},
+      ...tokenUsage ? { sendTokenUsageBatch: (batch) => {
+        try {
+          if (socket.readyState !== wrapper_default.OPEN) return false;
+          sendJson(socket, TokenUsageBatchSchema.parse({ type: "tokenUsageBatch", protocolVersion: 1, batchId: batch.batchId, connectionEpoch, stateId: batch.stateId, rows: batch.rows }), Math.min(maxFrameBytes, 32768));
+          return true;
+        } catch {
+          return false;
+        }
+      } } : {},
       sendTerminal: (binding2, state, resultCode, metrics) => {
         if (state === "rejected" && !rejectionResults) return Promise.reject(new RelayClientError("RELAY_RESULT_UNSUPPORTED"));
         if (pendingTerminal.size >= 64) return Promise.reject(new RelayClientError("RELAY_PENDING_LIMIT"));
@@ -47985,10 +48052,10 @@ function canonicalOrigin2(value) {
     fail6("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path31) {
-  return origin + path31;
+function endpoint(origin, path32) {
+  return origin + path32;
 }
-function uuid21(value, code) {
+function uuid22(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail6(code);
   return value.toLowerCase();
 }
@@ -48108,7 +48175,7 @@ var PairingClient = class {
       publicKey: identity.publicKeyPem,
       agentVersion: this.version
     }));
-    const pairingId = uuid21(response.pairingId, "PAIRING_RESPONSE_INVALID");
+    const pairingId = uuid22(response.pairingId, "PAIRING_RESPONSE_INVALID");
     const expiresAt = parseDate(response.expiresAt, "PAIRING_RESPONSE_INVALID");
     const now = this.nowMs();
     if (expiresAt.getTime() <= now || expiresAt.getTime() - now > 30 * 6e4) fail6("PAIRING_RESPONSE_INVALID");
@@ -48142,7 +48209,7 @@ var PairingClient = class {
   }
   async completeOnce(beginResult, approved, displayNameValue) {
     const pairing = this.validateBeginResult(beginResult);
-    const tenantId = uuid21(approved.tenantId, "PAIRING_RESPONSE_INVALID");
+    const tenantId = uuid22(approved.tenantId, "PAIRING_RESPONSE_INVALID");
     const email3 = accountEmail(approved.accountEmail);
     const name2 = displayName(displayNameValue);
     const identity = await this.currentIdentity();
@@ -48156,15 +48223,15 @@ var PairingClient = class {
       displayName: name2,
       agentVersion: this.version
     }));
-    const completedTenant = uuid21(response.tenantId, "PAIRING_RESPONSE_INVALID");
+    const completedTenant = uuid22(response.tenantId, "PAIRING_RESPONSE_INVALID");
     if (completedTenant !== tenantId) fail6("PAIRING_RESPONSE_INVALID");
-    const deviceId = uuid21(response.deviceId, "PAIRING_RESPONSE_INVALID");
+    const deviceId = uuid22(response.deviceId, "PAIRING_RESPONSE_INVALID");
     const enrollment = {
       tenantId,
       deviceId,
       serverOrigin: this.origin,
       accountEmail: email3,
-      ...response.accountId !== void 0 ? { accountId: uuid21(response.accountId, "PAIRING_RESPONSE_INVALID") } : {}
+      ...response.accountId !== void 0 ? { accountId: uuid22(response.accountId, "PAIRING_RESPONSE_INVALID") } : {}
     };
     await this.store.saveEnrollment(enrollment);
     return { ...enrollment };
@@ -48178,7 +48245,7 @@ var PairingClient = class {
       state: response.state,
       expiresAt: parseDate(response.expiresAt, "PAIRING_RESPONSE_INVALID")
     };
-    if (response.tenantId !== void 0) result2.tenantId = uuid21(response.tenantId, "PAIRING_RESPONSE_INVALID");
+    if (response.tenantId !== void 0) result2.tenantId = uuid22(response.tenantId, "PAIRING_RESPONSE_INVALID");
     if (response.accountEmail !== void 0) result2.accountEmail = accountEmail(response.accountEmail);
     return result2;
   }
@@ -48190,10 +48257,10 @@ var PairingClient = class {
   }
   validateBeginResult(value) {
     return {
-      pairingId: uuid21(value.pairingId, "PAIRING_INVALID"),
+      pairingId: uuid22(value.pairingId, "PAIRING_INVALID"),
       pairingSecret: pairingSecret(value.pairingSecret),
       confirmationCode: confirmationCode(value.confirmationCode),
-      approvalUrl: approvalUrl(value.approvalUrl, this.origin, uuid21(value.pairingId, "PAIRING_INVALID")),
+      approvalUrl: approvalUrl(value.approvalUrl, this.origin, uuid22(value.pairingId, "PAIRING_INVALID")),
       expiresAt: value.expiresAt instanceof Date ? new Date(value.expiresAt.getTime()) : parseDate(value.expiresAt, "PAIRING_INVALID"),
       keyFingerprint: fingerprint2(value.keyFingerprint)
     };
@@ -48724,9 +48791,9 @@ function commandSummary2(tool) {
   return { name: name2, command };
 }
 var ProductionMonitor = class {
-  constructor(directory, stateDirectory, agentVersion3) {
+  constructor(directory, stateDirectory2, agentVersion3) {
     this.agentVersion = agentVersion3;
-    const key = createHash17("sha256").update(path23.resolve(stateDirectory).toLowerCase()).digest("hex");
+    const key = createHash17("sha256").update(path23.resolve(stateDirectory2).toLowerCase()).digest("hex");
     this.file = path23.join(directory, key + ".json");
     this.transportFile = path23.join(directory, key + ".transport");
   }
@@ -49080,6 +49147,342 @@ var FullLogNotice = class {
   }
 };
 
+// agent/src/token-usage.ts
+import { randomUUID as randomUUID14 } from "node:crypto";
+import { lstat as lstat12, mkdir as mkdir11, open as open10, readdir as readdir6, readFile as readFile11, rename as rename8, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
+import os8 from "node:os";
+import path25 from "node:path";
+var KEEP_DAYS = 35;
+var MAX_FILES = 1e4;
+var MAX_SCAN_BYTES = 256 * 1024 * 1024;
+var CHUNK_BYTES = 4 * 1024 * 1024;
+var MAX_ROWS = 64;
+var DAY_MS = 864e5;
+function tokenUsageRoots(env = process.env) {
+  const home = os8.homedir();
+  const absolute2 = (value, fallback) => value && path25.isAbsolute(value) ? value : fallback;
+  return { claude: absolute2(env.CLAUDE_CONFIG_DIR, path25.join(home, ".claude")), codex: absolute2(env.CODEX_HOME, path25.join(home, ".codex")) };
+}
+var stateDirectory = (directory) => path25.join(directory, "optimization");
+var stateFile = (directory) => path25.join(stateDirectory(directory), "token-usage.json");
+var utcDay = (ms) => new Date(ms).toISOString().slice(0, 10);
+var count2 = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+var modelName = (value) => typeof value === "string" && TOKEN_USAGE_MODEL.test(value) ? value : "unknown";
+async function sources(roots, since) {
+  const found = [];
+  const entries = async (dir) => {
+    try {
+      return await readdir6(dir, { withFileTypes: true });
+    } catch {
+      return [];
+    }
+  };
+  const add = async (client, file3) => {
+    if (found.length >= MAX_FILES) return;
+    try {
+      const info = await lstat12(file3);
+      if (info.isFile() && info.mtimeMs >= since) found.push({ client, file: file3 });
+    } catch {
+    }
+  };
+  const projects = path25.join(roots.claude, "projects");
+  for (const project of await entries(projects)) {
+    if (!project.isDirectory()) continue;
+    for (const entry of await entries(path25.join(projects, project.name))) {
+      if (entry.isFile() && entry.name.endsWith(".jsonl")) await add("claude-code", path25.join(projects, project.name, entry.name));
+      else if (entry.isDirectory()) {
+        const subagents = path25.join(projects, project.name, entry.name, "subagents");
+        for (const agent of await entries(subagents)) if (agent.isFile() && agent.name.endsWith(".jsonl")) await add("claude-code", path25.join(subagents, agent.name));
+      }
+    }
+  }
+  const sessions = path25.join(roots.codex, "sessions"), first = utcDay(since - DAY_MS);
+  for (const year of await entries(sessions)) {
+    if (!year.isDirectory() || !/^\d{4}$/.test(year.name) || year.name < first.slice(0, 4)) continue;
+    for (const month of await entries(path25.join(sessions, year.name))) {
+      if (!month.isDirectory() || !/^\d{2}$/.test(month.name) || `${year.name}-${month.name}` < first.slice(0, 7)) continue;
+      for (const day of await entries(path25.join(sessions, year.name, month.name))) {
+        if (!day.isDirectory() || !/^\d{2}$/.test(day.name) || `${year.name}-${month.name}-${day.name}` < first) continue;
+        const folder = path25.join(sessions, year.name, month.name, day.name);
+        for (const file3 of await entries(folder)) if (file3.isFile() && file3.name.endsWith(".jsonl")) await add("codex", path25.join(folder, file3.name));
+      }
+    }
+  }
+  return found;
+}
+function usageFromLine(client, line, file3) {
+  if (client === "claude-code" ? !line.includes('"usage"') : !line.includes('"token_count"') && !line.includes('"turn_context"')) return null;
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  const at = typeof value?.timestamp === "string" ? Date.parse(value.timestamp) : NaN;
+  if (client === "claude-code") {
+    const message2 = value?.type === "assistant" ? value.message : void 0, usage = message2?.usage;
+    if (!usage || typeof message2.id !== "string" || message2.model === "<synthetic>") return null;
+    if (message2.id === file3.lastMessageId) return null;
+    file3.lastMessageId = message2.id.slice(0, 128);
+    const input3 = count2(usage.input_tokens), cacheWrite2 = count2(usage.cache_creation_input_tokens ?? 0), cached3 = count2(usage.cache_read_input_tokens ?? 0), output3 = count2(usage.output_tokens);
+    if (input3 === null || cacheWrite2 === null || cached3 === null || output3 === null || !Number.isFinite(at)) return null;
+    return { at, model: modelName(message2.model), input: input3 + cacheWrite2 + cached3, cached: cached3, cacheWrite: cacheWrite2, output: output3, reasoning: null };
+  }
+  if (value?.type === "turn_context") {
+    file3.model = modelName(value.payload?.model);
+    return null;
+  }
+  const info = value?.type === "event_msg" && value.payload?.type === "token_count" ? value.payload.info : void 0;
+  const total = count2(info?.total_token_usage?.total_tokens), last = info?.last_token_usage;
+  if (total === null || !last || total === file3.lastTotal) return null;
+  file3.lastTotal = total;
+  const input2 = count2(last.input_tokens), cached2 = count2(last.cached_input_tokens ?? 0), cacheWrite = count2(last.cache_write_input_tokens ?? 0), output2 = count2(last.output_tokens), reasoning = count2(last.reasoning_output_tokens ?? 0);
+  if (input2 === null || cached2 === null || cacheWrite === null || output2 === null || reasoning === null || !Number.isFinite(at)) return null;
+  if (cached2 + cacheWrite > input2 || reasoning > output2) return null;
+  return { at, model: file3.model ?? "unknown", input: input2, cached: cached2, cacheWrite, output: output2, reasoning };
+}
+async function readNew(source, file3, size, budget, countFrom, add) {
+  if (size < file3.offset) Object.assign(file3, { offset: 0, lastMessageId: void 0, lastTotal: void 0, skipping: false });
+  let read = 0;
+  const handle = await open10(source.file, "r");
+  try {
+    while (file3.offset < size && read < budget) {
+      const length = Math.min(CHUNK_BYTES, size - file3.offset);
+      const buffer = Buffer.alloc(length);
+      const { bytesRead } = await handle.read(buffer, 0, length, file3.offset);
+      if (bytesRead <= 0) break;
+      read += bytesRead;
+      const end = buffer.lastIndexOf(10, bytesRead - 1);
+      if (end < 0) {
+        if (bytesRead < CHUNK_BYTES) break;
+        file3.offset += bytesRead;
+        file3.skipping = true;
+        continue;
+      }
+      let start = 0;
+      if (file3.skipping) {
+        start = buffer.indexOf(10) + 1;
+        file3.skipping = false;
+      }
+      for (const line of buffer.toString("utf8", start, end).split("\n")) {
+        const usage = usageFromLine(source.client, line, file3);
+        if (usage && usage.at >= countFrom) add(source.client, usage);
+      }
+      file3.offset += end + 1;
+    }
+  } finally {
+    await handle.close();
+  }
+  return read;
+}
+var TokenUsageReporter = class {
+  constructor(directory, enrollment, options = {}) {
+    this.directory = directory;
+    this.enrollment = enrollment;
+    this.options = options;
+  }
+  directory;
+  enrollment;
+  options;
+  saved;
+  send;
+  enabled = false;
+  wanted = false;
+  timer;
+  running;
+  inFlight;
+  closed = false;
+  failed = false;
+  /** The state frame can arrive before the connection is handed over, so both feed one decision. */
+  connected(send) {
+    this.send = send;
+    this.apply();
+  }
+  disconnected() {
+    this.send = void 0;
+    this.wanted = false;
+    this.apply();
+    if (this.inFlight) {
+      clearTimeout(this.inFlight.timer);
+      this.inFlight = void 0;
+    }
+  }
+  close() {
+    this.closed = true;
+    this.disconnected();
+  }
+  /** The server's choice for this computer, sent after connect and on every change. */
+  state(enabled) {
+    this.wanted = enabled;
+    this.apply();
+    if (!enabled) void this.exclusive(async () => {
+      const saved2 = await this.load();
+      if (!saved2.paused) {
+        saved2.paused = true;
+        await this.persist();
+      }
+    }).catch(() => {
+    });
+  }
+  apply() {
+    const on = this.wanted && !!this.send && !this.closed;
+    if (on && !this.enabled) {
+      this.enabled = true;
+      this.schedule(this.options.firstDelayMs ?? 6e4);
+    } else if (!on && this.enabled) {
+      this.enabled = false;
+      clearTimeout(this.timer);
+      this.timer = void 0;
+    }
+  }
+  ack(batchId, result2) {
+    const flight = this.inFlight;
+    if (!flight || batchId !== flight.batchId) return;
+    clearTimeout(flight.timer);
+    this.inFlight = void 0;
+    if (result2 === "disabled") {
+      this.state(false);
+      return;
+    }
+    if (result2 !== "accepted" && result2 !== "invalid") return;
+    void this.exclusive(async () => {
+      const saved2 = await this.load();
+      for (const [key, version2] of Object.entries(flight.versions)) if (saved2.dirty[key] === version2) delete saved2.dirty[key];
+      await this.persist();
+      if (result2 === "accepted") this.flush();
+    });
+  }
+  /** One scan and report now; used by the timer and by manual checks. */
+  async scanOnce() {
+    await this.exclusive(async () => {
+      const saved2 = await this.load(), now = this.now();
+      if (saved2.paused) {
+        saved2.countFrom = new Date(now).toISOString();
+        saved2.files = {};
+        saved2.baseline = true;
+        delete saved2.paused;
+      }
+      const countFrom = Date.parse(saved2.countFrom);
+      const since = Math.max(countFrom, now - KEEP_DAYS * DAY_MS);
+      let budget = MAX_SCAN_BYTES;
+      const seen = /* @__PURE__ */ new Set();
+      const baseline = saved2.baseline === true;
+      for (const source of await sources(this.roots(), since - DAY_MS)) {
+        if (budget <= 0) break;
+        seen.add(source.file);
+        let info;
+        try {
+          info = await lstat12(source.file);
+        } catch {
+          continue;
+        }
+        const file3 = saved2.files[source.file] ??= { offset: baseline ? info.size : 0, mtimeMs: 0 };
+        file3.mtimeMs = info.mtimeMs;
+        if (info.size === file3.offset) continue;
+        try {
+          budget -= await readNew(source, file3, info.size, budget, countFrom, (client, usage) => this.add(saved2, client, usage));
+        } catch {
+        }
+      }
+      if (baseline) delete saved2.baseline;
+      for (const [name2, file3] of Object.entries(saved2.files)) if (!seen.has(name2) && file3.mtimeMs < now - KEEP_DAYS * DAY_MS) delete saved2.files[name2];
+      const oldest = utcDay(now - KEEP_DAYS * DAY_MS);
+      for (const key of Object.keys(saved2.totals)) if (key.slice(0, 10) < oldest) {
+        delete saved2.totals[key];
+        delete saved2.dirty[key];
+      }
+      await this.persist();
+    });
+    this.flush();
+  }
+  add(saved2, client, usage) {
+    const key = `${utcDay(usage.at)}|${client}|${usage.model}`;
+    const row = saved2.totals[key] ??= { requests: 0, inputTokens: 0, cachedInputTokens: 0, cacheWriteTokens: 0, outputTokens: 0, reasoningTokens: client === "codex" ? 0 : null };
+    row.requests++;
+    row.inputTokens += usage.input;
+    row.cachedInputTokens += usage.cached;
+    row.cacheWriteTokens += usage.cacheWrite;
+    row.outputTokens += usage.output;
+    if (row.reasoningTokens !== null && usage.reasoning !== null) row.reasoningTokens += usage.reasoning;
+    saved2.dirty[key] = (saved2.dirty[key] ?? 0) + 1;
+  }
+  flush() {
+    const saved2 = this.saved, send = this.send;
+    if (!saved2 || !send || !this.enabled || this.inFlight) return;
+    const keys = Object.keys(saved2.dirty).filter((key) => saved2.totals[key]).sort().slice(0, MAX_ROWS);
+    if (!keys.length) return;
+    const rows = keys.map((key) => {
+      const [day, client, model] = key.split("|");
+      return { day, client, model, ...saved2.totals[key] };
+    });
+    const batchId = randomUUID14(), versions = Object.fromEntries(keys.map((key) => [key, saved2.dirty[key]]));
+    let sent = false;
+    try {
+      sent = send({ batchId, stateId: saved2.stateId, rows });
+    } catch {
+    }
+    if (sent) this.inFlight = { batchId, versions, timer: setTimeout(() => {
+      if (this.inFlight?.batchId === batchId) this.inFlight = void 0;
+    }, 3e4).unref() };
+  }
+  schedule(delay4) {
+    clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      if (!this.enabled) return;
+      void this.scanOnce().catch(() => {
+        if (!this.failed) {
+          this.failed = true;
+          process.stderr.write("TOKEN_USAGE_SCAN_FAILED\n");
+        }
+      }).finally(() => {
+        if (this.enabled) this.schedule(this.options.intervalMs ?? 36e5);
+      });
+    }, delay4);
+    this.timer.unref();
+  }
+  exclusive(task) {
+    const next = (this.running ?? Promise.resolve()).then(task, task);
+    this.running = next.catch(() => {
+    });
+    return next;
+  }
+  now() {
+    return (this.options.now ?? Date.now)();
+  }
+  roots() {
+    return this.options.roots ?? tokenUsageRoots();
+  }
+  async load() {
+    if (this.saved) return this.saved;
+    let value;
+    try {
+      const info = await lstat12(stateFile(this.directory));
+      if (info.isFile() && !info.isSymbolicLink() && info.size <= 16 * 1024 * 1024) {
+        const parsed = JSON.parse(await readFile11(stateFile(this.directory), "utf8"));
+        if (parsed.version === 1 && parsed.tenantId === this.enrollment.tenantId && parsed.deviceId === this.enrollment.deviceId && typeof parsed.stateId === "string" && Number.isFinite(Date.parse(parsed.countFrom)) && parsed.files && parsed.totals && parsed.dirty) value = parsed;
+      }
+    } catch {
+    }
+    return this.saved = value ?? { version: 1, ...this.enrollment, stateId: randomUUID14(), countFrom: new Date(this.now()).toISOString(), files: {}, totals: {}, dirty: {}, baseline: true };
+  }
+  async persist() {
+    if (!this.saved) return;
+    await mkdir11(stateDirectory(this.directory), { mode: 448 }).catch((error62) => {
+      if (error62.code !== "EEXIST") throw error62;
+    });
+    const parent = await lstat12(stateDirectory(this.directory));
+    if (!parent.isDirectory() || parent.isSymbolicLink()) throw Error("TOKEN_USAGE_DIRECTORY_INVALID");
+    const temporary = stateFile(this.directory) + "." + randomUUID14() + ".tmp";
+    try {
+      await writeFile5(temporary, JSON.stringify(this.saved), { flag: "wx", mode: 384 });
+      await rename8(temporary, stateFile(this.directory));
+    } finally {
+      await rm10(temporary, { force: true }).catch(() => {
+      });
+    }
+  }
+};
+
 // agent/src/native-event-buffer.ts
 import { createHash as createHash18 } from "node:crypto";
 function nativeFingerprint(code, executionId = "") {
@@ -49362,7 +49765,7 @@ var NativeEventSupervisor = class {
 };
 
 // agent/src/native-fabric-observer.ts
-var uuid22 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var uuid23 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var NativeFabricObserver = class {
   constructor(supervisor, source) {
     this.supervisor = supervisor;
@@ -49384,7 +49787,7 @@ var NativeFabricObserver = class {
   unsubscribe;
   connected(authenticatedDeviceId) {
     this.disconnected();
-    if (uuid22.test(authenticatedDeviceId)) this.deviceId = authenticatedDeviceId.toLowerCase();
+    if (uuid23.test(authenticatedDeviceId)) this.deviceId = authenticatedDeviceId.toLowerCase();
     this.activity();
   }
   disconnected() {
@@ -49419,17 +49822,17 @@ var NativeFabricObserver = class {
     void Promise.resolve().then(() => this.source.mailbox.snapshot()).then((state) => {
       if (this.closed || expired || generation !== this.generation) return;
       if (state.workers.length > 64 || state.assignments.length > 256 || state.messages.length > 1024) throw Error("FABRIC_BOUND_INVALID");
-      const workers = new Set(state.workers.filter((w) => w.device?.deviceId.toLowerCase() === deviceId && uuid22.test(w.workerId)).map((w) => w.workerId));
+      const workers = new Set(state.workers.filter((w) => w.device?.deviceId.toLowerCase() === deviceId && uuid23.test(w.workerId)).map((w) => w.workerId));
       const assignments = new Map(state.assignments.filter((a) => workers.has(a.workerId)).map((a) => [a.assignmentId, a]));
       const refs = /* @__PURE__ */ new Map();
       for (const a of assignments.values()) {
         const id2 = a.execution?.executionId;
-        if (!id2 || !uuid22.test(id2)) continue;
+        if (!id2 || !uuid23.test(id2)) continue;
         if (refs.has(id2.toLowerCase())) throw Error("FABRIC_EXECUTION_CONFLICT");
         refs.set(id2.toLowerCase(), {
           executionId: id2.toLowerCase(),
           workerId: a.workerId.toLowerCase(),
-          ...uuid22.test(a.taskId) ? { taskId: a.taskId.toLowerCase() } : {}
+          ...uuid23.test(a.taskId) ? { taskId: a.taskId.toLowerCase() } : {}
         });
       }
       this.referencesByExecution.clear();
@@ -49481,27 +49884,27 @@ var NativeFabricObserver = class {
 };
 
 // agent/src/native-fabric-startup.ts
-import { lstat as lstat13, mkdir as mkdir13, open as open11, readFile as readFile11 } from "node:fs/promises";
-import path27 from "node:path";
+import { lstat as lstat14, mkdir as mkdir14, open as open12, readFile as readFile12 } from "node:fs/promises";
+import path28 from "node:path";
 
 // src/agent-fabric-service.ts
-import { lstat as lstat12, mkdir as mkdir12, realpath as realpath9 } from "node:fs/promises";
+import { lstat as lstat13, mkdir as mkdir13, realpath as realpath9 } from "node:fs/promises";
 import { watch } from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 
 // src/agent-runtime-identity.ts
-import { createHash as createHash19, randomBytes as randomBytes8, randomUUID as randomUUID15, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { createHash as createHash19, randomBytes as randomBytes8, randomUUID as randomUUID16, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 
 // src/agent-fabric-state.ts
-import { randomUUID as randomUUID14 } from "node:crypto";
-import { mkdir as mkdir11, open as open10, rename as rename8, unlink as unlink3 } from "node:fs/promises";
-import path25 from "node:path";
+import { randomUUID as randomUUID15 } from "node:crypto";
+import { mkdir as mkdir12, open as open11, rename as rename9, unlink as unlink3 } from "node:fs/promises";
+import path26 from "node:path";
 var queues = /* @__PURE__ */ new Map();
 var FabricStateFile = class {
   constructor(file3, maxBytes, parse4) {
     this.maxBytes = maxBytes;
     this.parse = parse4;
-    this.file = path25.resolve(file3);
+    this.file = path26.resolve(file3);
   }
   maxBytes;
   parse;
@@ -49519,7 +49922,7 @@ var FabricStateFile = class {
     return result2;
   }
   async load() {
-    const handle = await open10(this.file, "r");
+    const handle = await open11(this.file, "r");
     try {
       const info = await handle.stat();
       if (!info.isFile() || info.size > this.maxBytes) throw Error("FABRIC_STATE_LIMIT");
@@ -49545,10 +49948,10 @@ var FabricStateFile = class {
   }
   update(fn, create) {
     return this.serial(async () => {
-      if (create) await mkdir11(path25.dirname(this.file), { recursive: true });
+      if (create) await mkdir12(path26.dirname(this.file), { recursive: true });
       const lockPath = this.file + ".lock";
-      const token = randomUUID14();
-      const lock = await open10(lockPath, "wx", 384).catch((error62) => {
+      const token = randomUUID15();
+      const lock = await open11(lockPath, "wx", 384).catch((error62) => {
         if (error62.code === "EEXIST") throw Error("FABRIC_STATE_BUSY");
         throw error62;
       });
@@ -49566,7 +49969,7 @@ var FabricStateFile = class {
         const encoded = JSON.stringify(this.parse(state));
         if (Buffer.byteLength(encoded) > this.maxBytes) throw Error("FABRIC_STATE_LIMIT");
         const temporary = this.file + "." + token + ".tmp";
-        const handle = await open10(temporary, "wx", 384);
+        const handle = await open11(temporary, "wx", 384);
         try {
           try {
             await handle.writeFile(encoded, "utf8");
@@ -49574,7 +49977,7 @@ var FabricStateFile = class {
           } finally {
             await handle.close();
           }
-          await rename8(temporary, this.file);
+          await rename9(temporary, this.file);
         } finally {
           await unlink3(temporary).catch((error62) => {
             if (error62.code !== "ENOENT") throw error62;
@@ -49583,7 +49986,7 @@ var FabricStateFile = class {
         return result2;
       } finally {
         await lock.close();
-        const current2 = await open10(lockPath, "r");
+        const current2 = await open11(lockPath, "r");
         try {
           if ((await current2.stat()).size > 1024 || JSON.parse(await current2.readFile("utf8")).token !== token)
             throw Error("FABRIC_STATE_LOCK_CHANGED");
@@ -49643,7 +50046,7 @@ var AgentRuntimeIdentityStore = class {
   issue() {
     return this.serial((state) => {
       if (state.bindings.length >= MAX_BINDINGS) throw Error("RUNTIME_IDENTITY_LIMIT");
-      const runtimeId = "rt-" + randomUUID15();
+      const runtimeId = "rt-" + randomUUID16();
       const runtimeKey = randomBytes8(32).toString("base64url");
       const now = this.now();
       state.bindings.push({ runtimeId, keyHash: encodedDigest(runtimeKey), createdAt: now, lastUsedAt: now, revoked: false });
@@ -49676,10 +50079,10 @@ var AgentRuntimeIdentityStore = class {
 };
 
 // src/agent-fabric-mailbox.ts
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 
 // src/agent-fabric-timeline.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 import { performance as performance2 } from "node:perf_hooks";
 var FabricId = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/);
 var FabricUtc = external_exports.string().datetime({ precision: 3 }).refine((value) => new Date(value).toISOString() === value);
@@ -49688,7 +50091,7 @@ var FabricStampSchema = external_exports.strictObject({
   clockId: FabricId,
   monotonicMs: external_exports.number().finite().nonnegative().max(Number.MAX_SAFE_INTEGER)
 });
-var processClockId = "clock-" + randomUUID16();
+var processClockId = "clock-" + randomUUID17();
 function createFabricClock() {
   return () => ({ atUtc: (/* @__PURE__ */ new Date()).toISOString(), clockId: processClockId, monotonicMs: performance2.now() });
 }
@@ -49945,7 +50348,7 @@ var AgentWorkerMailbox = class {
       const now = this.clock().atUtc;
       const worker = {
         ...registration,
-        workerId: randomUUID17(),
+        workerId: randomUUID18(),
         controllerId: this.controllerId,
         runtimeId: null,
         attribution: WorkerAttributionSchema.parse({}),
@@ -49979,7 +50382,7 @@ var AgentWorkerMailbox = class {
     if (state.messages.length >= MAX_MESSAGES) throw Error("FABRIC_MESSAGE_LIMIT");
     const now = this.clock();
     const message2 = {
-      messageId: randomUUID17(),
+      messageId: randomUUID18(),
       key: request.key,
       assignmentId: assignment.assignmentId,
       direction,
@@ -50009,7 +50412,7 @@ var AgentWorkerMailbox = class {
       const now = this.clock().atUtc;
       const assignment = {
         ...request,
-        assignmentId: randomUUID17(),
+        assignmentId: randomUUID18(),
         phase: "assigned",
         createdAt: now,
         updatedAt: now,
@@ -50189,9 +50592,9 @@ var WorkerRequest = external_exports.discriminatedUnion("operation", [
 var AgentFabricService = class _AgentFabricService {
   constructor(directory, controllerId) {
     this.directory = directory;
-    this.identities = new AgentRuntimeIdentityStore(path26.join(directory, "identities.json"));
+    this.identities = new AgentRuntimeIdentityStore(path27.join(directory, "identities.json"));
     this.mailbox = new AgentWorkerMailbox(
-      path26.join(directory, "mailbox.json"),
+      path27.join(directory, "mailbox.json"),
       controllerId,
       this.identities,
       void 0,
@@ -50206,21 +50609,21 @@ var AgentFabricService = class _AgentFabricService {
   closed = false;
   static async open(directory, controllerId, device = null, initialize = true) {
     const expected = Binding.parse({ version: 1, controllerId, device, initialized: false });
-    const absolute2 = path26.resolve(directory);
-    for (let current2 = absolute2; ; current2 = path26.dirname(current2)) {
+    const absolute2 = path27.resolve(directory);
+    for (let current2 = absolute2; ; current2 = path27.dirname(current2)) {
       try {
-        if ((await lstat12(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
+        if ((await lstat13(current2)).isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
       } catch (error62) {
         if (error62.code !== "ENOENT") throw error62;
       }
-      if (path26.dirname(current2) === current2) break;
+      if (path27.dirname(current2) === current2) break;
     }
-    if (initialize) await mkdir12(absolute2, { recursive: true, mode: 448 });
-    if (!(await lstat12(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
+    if (initialize) await mkdir13(absolute2, { recursive: true, mode: 448 });
+    if (!(await lstat13(absolute2)).isDirectory() || (await realpath9(absolute2)).toLowerCase() !== absolute2.toLowerCase())
       throw Error("FABRIC_DIRECTORY_INVALID");
     const present = /* @__PURE__ */ new Set();
     for (const name2 of ["binding.json", "mailbox.json", "identities.json"]) {
-      const file3 = await lstat12(path26.join(absolute2, name2)).catch((error62) => {
+      const file3 = await lstat13(path27.join(absolute2, name2)).catch((error62) => {
         if (error62.code === "ENOENT") return null;
         throw error62;
       });
@@ -50228,7 +50631,7 @@ var AgentFabricService = class _AgentFabricService {
       if (file3) present.add(name2);
     }
     if (!present.has("binding.json") && present.size) throw Error("FABRIC_BINDING_MISSING");
-    const binding2 = new FabricStateFile(path26.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
+    const binding2 = new FabricStateFile(path27.join(absolute2, "binding.json"), 2048, (value) => Binding.parse(value));
     const service2 = new _AgentFabricService(absolute2, controllerId);
     await binding2.update(async (state) => {
       if (state.controllerId !== expected.controllerId || JSON.stringify(state.device) !== JSON.stringify(expected.device))
@@ -50243,7 +50646,7 @@ var AgentFabricService = class _AgentFabricService {
         state.initialized = true;
       }
       const snapshot2 = await service2.mailbox.snapshot();
-      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat12(path26.join(absolute2, "identities.json"));
+      if (snapshot2.workers.some((worker) => worker.runtimeId !== null)) await lstat13(path27.join(absolute2, "identities.json"));
     }, initialize ? () => expected : void 0);
     return service2;
   }
@@ -50327,26 +50730,26 @@ var OwnerRequest = external_exports.discriminatedUnion("operation", [
   })
 ]);
 var Delivery = external_exports.strictObject({ capability: external_exports.string().regex(/^[A-Za-z0-9+/]+={0,2}$/).max(4096), request: external_exports.unknown() });
-async function openNativeFabric(stateDirectory, enrollment, box, initialize = true) {
+async function openNativeFabric(stateDirectory2, enrollment, box, initialize = true) {
   const controllerId = "device-" + external_exports.string().uuid().parse(enrollment.deviceId).toLowerCase();
   const tenantId = external_exports.string().uuid().parse(enrollment.tenantId).toLowerCase();
-  const parent = path27.join(stateDirectory, ".local-commander"), marker = path27.join(parent, "fabric-established.json");
+  const parent = path28.join(stateDirectory2, ".local-commander"), marker = path28.join(parent, "fabric-established.json");
   try {
-    await mkdir13(parent, { mode: 448 });
+    await mkdir14(parent, { mode: 448 });
   } catch (error62) {
     if (error62.code !== "EEXIST") throw error62;
   }
-  const parentInfo = await lstat13(parent);
+  const parentInfo = await lstat14(parent);
   if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()) throw Error("FABRIC_DIRECTORY_INVALID");
   const expected = JSON.stringify({ version: 1, controllerId, tenantId });
   let fresh = false;
   try {
-    const info = await lstat13(marker);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile11(marker, "utf8") !== expected)
+    const info = await lstat14(marker);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 2048 || await readFile12(marker, "utf8") !== expected)
       throw Error("FABRIC_BINDING_CHANGED");
   } catch (error62) {
     if (error62.code !== "ENOENT" || !initialize) throw error62;
-    const file3 = await open11(marker, "wx", 384);
+    const file3 = await open12(marker, "wx", 384);
     try {
       await file3.writeFile(expected);
       await file3.datasync();
@@ -50356,22 +50759,22 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
     fresh = true;
   }
   const service2 = await AgentFabricService.open(
-    path27.join(stateDirectory, ".local-commander", "fabric"),
+    path28.join(stateDirectory2, ".local-commander", "fabric"),
     controllerId,
     { deviceId: enrollment.deviceId.toLowerCase(), enrollmentEvidenceRef: "enrollment-" + tenantId },
     fresh
   );
   const purpose = "native-fabric:" + tenantId + ":" + controllerId;
-  const credentialFile = (workerId) => path27.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
+  const credentialFile = (workerId) => path28.join(service2.directory, external_exports.string().uuid().parse(workerId) + ".capability");
   const decode4 = (value) => {
     const credential = Credential.parse(JSON.parse(box.open(Buffer.from(value, "base64"), purpose).toString("utf8")));
     if (credential.controllerId !== controllerId) throw Error("FABRIC_WORKER_DENIED");
     return credential;
   };
   async function capability(workerId) {
-    const file3 = credentialFile(workerId), info = await lstat13(file3);
+    const file3 = credentialFile(workerId), info = await lstat14(file3);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 4096) throw Error("FABRIC_CREDENTIAL_UNKNOWN");
-    const encoded = await readFile11(file3, "utf8");
+    const encoded = await readFile12(file3, "utf8");
     if (decode4(encoded).workerId !== workerId) throw Error("FABRIC_WORKER_DENIED");
     return encoded;
   }
@@ -50404,7 +50807,7 @@ async function openNativeFabric(stateDirectory, enrollment, box, initialize = tr
         } else {
           const credential = await service2.identities.issue();
           const encoded = box.seal(Buffer.from(JSON.stringify({ ...credential, workerId: worker.workerId, controllerId })), purpose).toString("base64");
-          const file3 = await open11(credentialFile(worker.workerId), "wx", 384);
+          const file3 = await open12(credentialFile(worker.workerId), "wx", 384);
           try {
             await file3.writeFile(encoded);
             await file3.datasync();
@@ -50463,7 +50866,7 @@ async function readFabricRequest(input2 = process.stdin) {
 
 // agent/src/supervisor-liveness.ts
 import { spawn as spawn6 } from "node:child_process";
-import path28 from "node:path";
+import path29 from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 var ROW = /^"([^"]+)","(\d{1,10})"/;
 function parseTasklist(output2, image) {
@@ -50478,7 +50881,7 @@ function parseTasklist(output2, image) {
 }
 function listProcesses(image, timeoutMs2 = 5e3) {
   if (process.platform !== "win32" || !/^[A-Za-z0-9._-]{1,64}\.exe$/i.test(image)) return Promise.resolve(null);
-  const tasklist = path28.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
+  const tasklist = path29.join(process.env.SystemRoot || "C:\\Windows", "System32", "tasklist.exe");
   return new Promise((resolve) => {
     let output2 = "", settled = false;
     const finish = (value) => {
@@ -50507,8 +50910,8 @@ function listProcesses(image, timeoutMs2 = 5e3) {
 }
 function supervisorLiveness(helperPath, options = {}) {
   if (process.platform === "linux" && !options.list) return linuxSupervisorLiveness;
-  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path28.join(path28.dirname(helperPath), "posix-host"), pids, darwin);
-  const image = path28.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
+  if (process.platform === "darwin" && !options.list) return (pids, _linux, darwin) => darwinSupervisorLiveness(path29.join(path29.dirname(helperPath), "posix-host"), pids, darwin);
+  const image = path29.basename(helperPath), waitMs = options.waitMs ?? 1e4, pollMs = options.pollMs ?? 500, list = options.list ?? listProcesses;
   return async (pids) => {
     const deadline = Date.now() + waitMs;
     for (; ; ) {
@@ -50523,8 +50926,8 @@ function supervisorLiveness(helperPath, options = {}) {
 
 // agent/src/content-audit.ts
 import { createReadStream } from "node:fs";
-import { appendFile, lstat as lstat14, mkdir as mkdir14, open as open12, readdir as readdir6, readFile as readFile12, rename as rename9, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
-import path29 from "node:path";
+import { appendFile, lstat as lstat15, mkdir as mkdir15, open as open13, readdir as readdir7, readFile as readFile13, rename as rename10, rm as rm11, writeFile as writeFile6 } from "node:fs/promises";
+import path30 from "node:path";
 import { performance as performance3 } from "node:perf_hooks";
 import { createInterface as createInterface2 } from "node:readline";
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -50691,19 +51094,19 @@ var AUDIT_MAX_BYTES = 512 * 1024 * 1024;
 var MAX_PENDING = 64;
 var FILE = /^(full|metrics)-(\d{4}-\d{2}-\d{2})\.jsonl$/;
 var PAUSED_FILE = "paused.json";
-var DAY_MS = 864e5;
+var DAY_MS2 = 864e5;
 function contentAuditDirectory(stateDir) {
-  return path29.join(path29.dirname(path29.resolve(stateDir)), "Audit");
+  return path30.join(path30.dirname(path30.resolve(stateDir)), "Audit");
 }
 async function plainDirectory(dir) {
-  await mkdir14(dir, { recursive: true, mode: 448 });
-  const info = await lstat14(dir);
+  await mkdir15(dir, { recursive: true, mode: 448 });
+  const info = await lstat15(dir);
   if (info.isSymbolicLink() || !info.isDirectory()) throw Error("AUDIT_DIRECTORY_INVALID");
 }
 async function auditFiles(dir) {
   let names;
   try {
-    names = await readdir6(dir);
+    names = await readdir7(dir);
   } catch (error62) {
     if (error62.code === "ENOENT") return [];
     throw error62;
@@ -50712,7 +51115,7 @@ async function auditFiles(dir) {
   for (const name2 of names) {
     const match = FILE.exec(name2);
     if (!match) continue;
-    const info = await lstat14(path29.join(dir, name2));
+    const info = await lstat15(path30.join(dir, name2));
     if (info.isFile()) files.push({ name: name2, kind: match[1], day: match[2], bytes: info.size });
   }
   return files.sort((a, b) => a.name.localeCompare(b.name));
@@ -50720,10 +51123,10 @@ async function auditFiles(dir) {
 async function writeJsonAtomic(file3, value) {
   const temp = `${file3}.${randomBytes10(6).toString("hex")}.tmp`;
   try {
-    await writeFile5(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
-    await rename9(temp, file3);
+    await writeFile6(temp, JSON.stringify(value) + "\n", { flag: "wx", mode: 384 });
+    await rename10(temp, file3);
   } finally {
-    await rm10(temp, { force: true }).catch(() => {
+    await rm11(temp, { force: true }).catch(() => {
     });
   }
 }
@@ -50750,7 +51153,7 @@ var ContentAudit = class _ContentAudit {
   skipped = 0;
   closed = false;
   static async open(options) {
-    const dir = path29.resolve(options.directory);
+    const dir = path30.resolve(options.directory);
     await plainDirectory(dir);
     const audit = new _ContentAudit(
       dir,
@@ -50759,7 +51162,7 @@ var ContentAudit = class _ContentAudit {
       { retentionDays: options.retentionDays ?? AUDIT_RETENTION_DAYS, maxBytes: options.maxBytes ?? AUDIT_MAX_BYTES },
       options.now ?? (() => /* @__PURE__ */ new Date())
     );
-    await rm10(path29.join(dir, PAUSED_FILE), { force: true });
+    await rm11(path30.join(dir, PAUSED_FILE), { force: true });
     await audit.rollover(audit.now());
     if (audit.usedBytes >= audit.limits.maxBytes) await audit.pause("QUOTA_EXCEEDED");
     return audit;
@@ -50829,17 +51232,17 @@ var ContentAudit = class _ContentAudit {
       await this.pause("QUOTA_EXCEEDED");
       return;
     }
-    await appendFile(path29.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
-    await appendFile(path29.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
+    await appendFile(path30.join(this.dir, `full-${day}.jsonl`), line, { mode: 384 });
+    await appendFile(path30.join(this.dir, `metrics-${day}.jsonl`), metrics, { mode: 384 });
     this.usedBytes += bytes3;
   }
   /** Daily retention runs on the first write of a new day; no timer or background scan. */
   async rollover(at) {
     this.day = at.toISOString().slice(0, 10);
-    const cutoff = new Date(at.getTime() - this.limits.retentionDays * DAY_MS).toISOString().slice(0, 10);
+    const cutoff = new Date(at.getTime() - this.limits.retentionDays * DAY_MS2).toISOString().slice(0, 10);
     let used = 0;
     for (const file3 of await auditFiles(this.dir)) {
-      if (file3.day <= cutoff) await rm10(path29.join(this.dir, file3.name), { force: true });
+      if (file3.day <= cutoff) await rm11(path30.join(this.dir, file3.name), { force: true });
       else used += file3.bytes;
     }
     this.usedBytes = used;
@@ -50847,7 +51250,7 @@ var ContentAudit = class _ContentAudit {
   async pause(reason) {
     if (this.paused) return;
     this.paused = reason;
-    await writeJsonAtomic(path29.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
+    await writeJsonAtomic(path30.join(this.dir, PAUSED_FILE), { reason, at: this.now().toISOString() });
   }
 };
 function percentiles(values) {
@@ -50867,15 +51270,15 @@ async function* jsonLines(file3) {
     }
   }
 }
-var count2 = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+var count3 = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
 async function summarizeContentAudit(directory, key) {
-  const dir = path29.resolve(directory);
+  const dir = path30.resolve(directory);
   const files = await auditFiles(dir);
   const days = /* @__PURE__ */ new Map();
   const sizes = [];
   const timings = [];
   for (const file3 of files.filter((f) => f.kind === "metrics")) {
-    for await (const line of jsonLines(path29.join(dir, file3.name))) {
+    for await (const line of jsonLines(path30.join(dir, file3.name))) {
       let day = days.get(file3.day);
       if (!day) {
         day = { day: file3.day, records: 0, failed: 0, rawBytes: 0, sanitizedBytes: 0, compressedBytes: 0, envelopeBytes: 0 };
@@ -50883,19 +51286,19 @@ async function summarizeContentAudit(directory, key) {
       }
       day.records += 1;
       if (line.resultCode !== "SUCCESS") day.failed += 1;
-      day.rawBytes += count2(line.rawBytes);
-      day.sanitizedBytes += count2(line.sanitizedBytes);
-      day.compressedBytes += count2(line.compressedBytes);
-      day.envelopeBytes += count2(line.envelopeBytes);
+      day.rawBytes += count3(line.rawBytes);
+      day.sanitizedBytes += count3(line.sanitizedBytes);
+      day.compressedBytes += count3(line.compressedBytes);
+      day.envelopeBytes += count3(line.envelopeBytes);
       if (sizes.length < 1e5) {
-        sizes.push(count2(line.envelopeBytes));
-        timings.push(count2(line.encryptMs));
+        sizes.push(count3(line.envelopeBytes));
+        timings.push(count3(line.encryptMs));
       }
     }
   }
   let paused = null;
   try {
-    const value = JSON.parse(await readFile12(path29.join(dir, PAUSED_FILE), "utf8"));
+    const value = JSON.parse(await readFile13(path30.join(dir, PAUSED_FILE), "utf8"));
     if (typeof value.reason === "string" && typeof value.at === "string") paused = { reason: value.reason.slice(0, 40), at: value.at.slice(0, 40) };
   } catch {
   }
@@ -50903,7 +51306,7 @@ async function summarizeContentAudit(directory, key) {
   const newest = files.filter((f) => f.kind === "full").at(-1);
   if (key && newest) {
     const tail = [];
-    for await (const line of jsonLines(path29.join(dir, newest.name))) {
+    for await (const line of jsonLines(path30.join(dir, newest.name))) {
       tail.push(line);
       if (tail.length > 5) tail.shift();
     }
@@ -50937,10 +51340,10 @@ async function summarizeContentAudit(directory, key) {
   };
 }
 async function restoreContentAudit(input2, output2, key) {
-  const handle = await open12(path29.resolve(output2), "wx", 384);
+  const handle = await open13(path30.resolve(output2), "wx", 384);
   let records = 0, failed = 0;
   try {
-    for await (const line of jsonLines(path29.resolve(input2))) {
+    for await (const line of jsonLines(path30.resolve(input2))) {
       try {
         await handle.appendFile(JSON.stringify(decryptAuditRecord(line, key)) + "\n");
         records += 1;
@@ -50955,7 +51358,7 @@ async function restoreContentAudit(input2, output2, key) {
 }
 
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.51" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.52" : "0.3.2";
 var NETWORK_PUBLIC_KEY = true ? "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvmu+81vWtJBQDZNHcAIW\nzCSxpG+R9RBsum2df5mP2cOW+wyUDTpnYquFge1qgI5YYTF96j0xCyXL8B9FeNWs\n939opWNmv53j+CQlS4cEIQhBbZSCu0eC4icsVEzBhvf68MB+E668SOtZBcVTEnyh\n96PTcupxS10rQJBWDinbKBXRC2gvGYeu01rWa/nsrndy4vAYP5t3yQtdOC8e8mr0\n+2Mg2Qhiq+KiTCtDd+L9oXvoLqqJYbzUIveNGha25AWxF1Weblp0gOM87hell5gV\nK7q4ZLUq/wBRGYNmQRdLyV7/WRE1FFPSW21/SBZQ/5aU4UqJU/MjMcrJUrnRKngz\nYKmo0czkxS3N7Q2KVxomgR1AQSuQFKMrboZYKjShADp9RIYUxzs7cYg51Of5PnHh\n6Ax+VevDGfzjMD+yHuyxYZqCtX4OwgolJxz63UQbzKlris+8xb5lLYTbIuz90Pss\nn6HK/F5May25c6oMmS3nh/NsiZopL1OvdtWKTt1L4WlRAgMBAAE=\n-----END PUBLIC KEY-----\n" : "";
 var AI_CONNECTION_SHIPPED = false;
 var QUARANTINE_RETRY_MS = 6e4;
@@ -50969,11 +51372,11 @@ function processAlive(pid) {
   }
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
-  await mkdir15(stateDir, { recursive: true });
-  const file3 = path30.join(stateDir, "agent-process.json");
+  await mkdir16(stateDir, { recursive: true });
+  const file3 = path31.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await open13(file3, "wx", 384);
+      const handle = await open14(file3, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, runtimeDir, version: version2, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n", "utf8");
       } finally {
@@ -50981,8 +51384,8 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       }
       return async () => {
         try {
-          const current2 = JSON.parse(await readFile13(file3, "utf8"));
-          if (current2.pid === process.pid) await rm11(file3, { force: true });
+          const current2 = JSON.parse(await readFile14(file3, "utf8"));
+          if (current2.pid === process.pid) await rm12(file3, { force: true });
         } catch {
         }
       };
@@ -50990,12 +51393,12 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       if (!error62 || typeof error62 !== "object" || !("code" in error62) || error62.code !== "EEXIST") throw error62;
       let stale = true;
       try {
-        const current2 = JSON.parse(await readFile13(file3, "utf8"));
+        const current2 = JSON.parse(await readFile14(file3, "utf8"));
         stale = typeof current2.pid !== "number" || !processAlive(current2.pid);
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm11(file3, { force: true });
+      await rm12(file3, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -51119,6 +51522,7 @@ async function runAgent(options) {
           status: () => runtime.status(),
           onIncidentAck: (ack) => incidentProducer.ack(ack),
           onFullLogChoice: options.onFullLogChoice,
+          ...options.tokenUsage ? { onTokenUsageState: (enabled) => options.tokenUsage.state(enabled), onTokenUsageAck: (batchId, result2) => options.tokenUsage.ack(batchId, result2) } : {},
           // After bridge.connected, like requests: the journal has recorded this connection first.
           onHeldLeases: (bindings) => {
             void readyPromise.then(() => bridge.heldLeases(bindings)).catch(() => {
@@ -51152,6 +51556,7 @@ async function runAgent(options) {
         await options.journal.prune();
         connection.reportStatus?.();
         incidentProducer.connected(connection.sendIncidentBatch);
+        options.tokenUsage?.connected(connection.sendTokenUsageBatch);
         supervisor.observe({ kind: "connected" });
         monitor(() => options.monitor?.setConnection("connected", connection));
         if (options.monitor && !connection.monitorFreshnessMs) {
@@ -51207,6 +51612,7 @@ async function runAgent(options) {
         clearInterval(legacyMonitorTimer);
         legacyMonitorTimer = void 0;
         incidentProducer.disconnected();
+        options.tokenUsage?.disconnected();
         if (!options.signal.aborted) supervisor.observe({ kind: "disconnected" });
         monitor(() => options.monitor?.setConnection("disconnected"));
         try {
@@ -51227,6 +51633,7 @@ async function runAgent(options) {
     } finally {
       fabric?.close();
       incidentProducer.close();
+      options.tokenUsage?.close();
       supervisor.close();
       await options.journal.close();
     }
@@ -51253,10 +51660,10 @@ async function openContentAudit(store, stateDir) {
 async function main() {
   if (!["win32", "linux", "darwin"].includes(process.platform)) throw Error("PLATFORM_UNSUPPORTED");
   const appData = process.env.LC_AGENT_DATA_DIR ?? (process.platform === "win32" ? process.env.LOCALAPPDATA : posixDataHome());
-  if (!appData || !path30.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path30.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path30.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path30.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
+  if (!appData || !path31.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path31.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path31.dirname(process.platform === "win32" ? process.execPath : await realpath10(process.execPath));
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path31.join(binaryDir, process.platform === "win32" ? "OwnerBridge.exe" : "owner-store");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (process.platform !== "win32" && (command.startsWith("guard-") || command.startsWith("network-"))) throw Error("FEATURE_PLATFORM_UNSUPPORTED");
@@ -51266,7 +51673,7 @@ async function main() {
     const pairing = new PairingClient(store, { controlPlaneOrigin: origin, agentVersion: AGENT_VERSION2 });
     const begun = await pairing.begin();
     process.stdout.write(JSON.stringify({ approvalUrl: begun.approvalUrl, confirmationCode: begun.confirmationCode, expiresAt: begun.expiresAt.toISOString() }) + "\n");
-    await pairing.waitAndComplete(begun, os8.hostname().slice(0, 120));
+    await pairing.waitAndComplete(begun, os9.hostname().slice(0, 120));
     process.stdout.write("DEVICE_PAIRED\n");
     return;
   }
@@ -51352,7 +51759,7 @@ async function main() {
   }
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path30.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path31.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -51362,7 +51769,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path30.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path31.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -51381,7 +51788,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path30.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path31.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -51393,7 +51800,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path30.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path31.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -51471,27 +51878,27 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
-  const monitor = new ProductionMonitor(path30.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path31.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
   const publishMonitor = () => monitor.flush().catch(() => {
     process.stderr.write("MONITOR_WRITE_FAILED\n");
   });
   await publishMonitor();
   try {
     const journal = await NativeJournal.open(
-      path30.join(stateDir, "journal"),
+      path31.join(stateDir, "journal"),
       new SecretBox({ "1": await store.loadDataKey() }),
-      process.platform === "win32" ? {} : { lockHelper: path30.join(binaryDir, "posix-host") }
+      process.platform === "win32" ? {} : { lockHelper: path31.join(binaryDir, "posix-host") }
     );
     const ledgerLoss = () => {
       process.stderr.write("OPTIMIZATION_TELEMETRY_INCOMPLETE\n");
     };
     const efficiencyLedger = await new OptionalWork(ledgerLoss, 1e3, 1).run(
-      () => OptimizationLedger.open(path30.join(stateDir, "optimization")),
+      () => OptimizationLedger.open(path31.join(stateDir, "optimization")),
       void 0,
       (ledger) => ledger.close()
     );
     try {
-      const helperPath = process.env.LC_JOB_HOST ?? path30.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
+      const helperPath = process.env.LC_JOB_HOST ?? path31.join(binaryDir, process.platform === "win32" ? "JobHost.exe" : "job-host.mjs");
       const tools = new NativeTools({ stateDirectory: stateDir, helperPath, ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
@@ -51504,6 +51911,7 @@ async function main() {
         });
       };
       onFullLogChoice(null);
+      const tokenUsage = process.env.LC_TOKEN_USAGE === "off" ? void 0 : new TokenUsageReporter(stateDir, enrollment);
       const fabric = await openNativeFabric(stateDir, enrollment, new SecretBox({ "1": await store.loadDataKey() })).catch(() => {
         process.stderr.write("FABRIC_STARTUP_FAILED\n");
         return void 0;
@@ -51533,6 +51941,7 @@ async function main() {
             efficiencyLedger,
             monitor,
             onFullLogChoice,
+            ...tokenUsage ? { tokenUsage } : {},
             localDirect: { key: localDirectKey(await store.loadDataKey()), directory: localDirectDirectory(appData) },
             supervisorLiveness: supervisorLiveness(helperPath),
             ...proxyMode ? { proxyMode: { providers: proxyMode.providers, publicKeyPem: NETWORK_PUBLIC_KEY, endpoint: proxyEndpoint, onState: onProxyState } } : {},
@@ -51569,7 +51978,7 @@ async function main() {
     await releaseProcess();
   }
 }
-var entrypoint = process.argv[1] && (process.platform === "win32" ? path30.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
+var entrypoint = process.argv[1] && (process.platform === "win32" ? path31.resolve(process.argv[1]) : await realpath10(process.argv[1]).catch(() => null));
 if (entrypoint === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";