local-commander-agent 0.3.6 → 0.3.7

package/runtime/agent.mjs

@@ -2278,7 +2278,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash10 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash11 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2959,7 +2959,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash11("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest4) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3240,7 +3240,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._final(callback);
           });
           return;
@@ -3261,7 +3261,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -3328,7 +3328,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash10 } = __require("crypto");
+    var { createHash: createHash11 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3635,7 +3635,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest4 = createHash10("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash11("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3723,9 +3723,9 @@ var require_websocket_server = __commonJS({
 });
 
 // agent/src/main.ts
-import path12 from "node:path";
+import path14 from "node:path";
 import os3 from "node:os";
-import { mkdir as mkdir5, open as open6, readFile as readFile5, rm as rm4 } from "node:fs/promises";
+import { mkdir as mkdir6, open as open7, readFile as readFile5, rm as rm5 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
 // packages/operations/src/crypto.ts
@@ -4674,10 +4674,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path13) {
-  if (!path13)
+function getElementAtPath(obj, path15) {
+  if (!path15)
     return obj;
-  return path13.reduce((acc, key) => acc?.[key], obj);
+  return path15.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -5017,11 +5017,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path13, issues) {
+function prefixIssues(path15, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path13);
+    iss.path.unshift(path15);
     return iss;
   });
 }
@@ -5471,16 +5471,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path13 = []) => {
+  const processError = (error63, path15 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path13, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5519,17 +5519,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result2 = { errors: [] };
-  const processError = (error63, path13 = []) => {
+  const processError = (error63, path15 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path13, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           result2.errors.push(mapper(issue2));
           continue;
@@ -5568,8 +5568,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path13) {
+  const path15 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path15) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -22671,13 +22671,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path13 = ref.slice(1).split("/").filter(Boolean);
-  if (path13.length === 0) {
+  const path15 = ref.slice(1).split("/").filter(Boolean);
+  if (path15.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path13[0] === defsKey) {
-    const key = path13[1] === void 0 ? void 0 : decodeJSONPointerSegment(path13[1]);
+  if (path15[0] === defsKey) {
+    const key = path15[1] === void 0 ? void 0 : decodeJSONPointerSegment(path15[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25288,12 +25288,21 @@ async function planPermissionChange(current2, programs, input2) {
     workspace.permissions.writeFiles = change.enabled;
     detail = "File writes: " + (change.enabled ? "ALLOW" : "DENY");
   } else if (change.kind === "localhost") {
+    if (workspace.fullAccess) {
+      workspace.deniedLocalhostPorts = change.enabled ? (workspace.deniedLocalhostPorts ?? []).filter((port) => port !== change.port) : [.../* @__PURE__ */ new Set([...workspace.deniedLocalhostPorts ?? [], change.port])];
+      if (workspace.deniedLocalhostPorts.length > 32) invalid2("PERMISSION_LIMIT");
+    }
     workspace.localhostPorts = change.enabled ? [.../* @__PURE__ */ new Set([...workspace.localhostPorts, change.port])].sort((a, b) => a - b) : workspace.localhostPorts.filter((port) => port !== change.port);
     if (workspace.localhostPorts.length > 32) invalid2("PERMISSION_LIMIT");
-    workspace.permissions.localhost = workspace.localhostPorts.length > 0;
+    workspace.permissions.localhost = workspace.fullAccess === true || workspace.localhostPorts.length > 0;
     resource = { rootHash: workspace.rootHash, kind: change.kind, port: change.port };
     detail = "Localhost port " + change.port + ": " + (change.enabled ? "ALLOW" : "DENY");
   } else {
+    if (workspace.fullAccess) {
+      const key = change.name.replace(/\.(exe|com|cmd|bat)$/i, "");
+      workspace.deniedCommands = change.enabled ? (workspace.deniedCommands ?? []).filter((name2) => name2.replace(/\.(exe|com|cmd|bat)$/i, "") !== key) : [.../* @__PURE__ */ new Set([...workspace.deniedCommands ?? [], change.name])];
+      if (workspace.deniedCommands.length > 32) invalid2("PERMISSION_LIMIT");
+    }
     let executableIdentity = null;
     if (change.enabled) {
       const executable = change.executable;
@@ -25307,7 +25316,7 @@ async function planPermissionChange(current2, programs, input2) {
       if (workspace.allowedCommands.length > 32 || Object.keys(nextPrograms).length > 32) invalid2("PERMISSION_LIMIT");
       executableIdentity = { executable: canonical2, dev: stat.dev, ino: stat.ino, size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs };
     } else workspace.allowedCommands = workspace.allowedCommands.filter((value) => value !== change.name);
-    workspace.permissions.executeCommands = workspace.allowedCommands.length > 0;
+    workspace.permissions.executeCommands = workspace.fullAccess === true || workspace.allowedCommands.length > 0;
     resource = { rootHash: workspace.rootHash, kind: change.kind, name: change.name, executable: nextPrograms[change.name] ?? null, executableIdentity };
     detail = "Command " + permissionLabel(change.name) + ": " + (change.enabled ? "ALLOW" : "DENY") + "\nExact executable: " + permissionLabel(nextPrograms[change.name] ?? "not registered") + nonAsciiNotice(nextPrograms[change.name]) + "\nA permitted program can access resources available to your Windows account, including outside this folder. This is not an OS sandbox.";
   }
@@ -25679,9 +25688,12 @@ function validateState(value) {
   const pendingWorkspaceRevokes = value.pendingWorkspaceRevokes ?? [];
   if (!Array.isArray(pendingWorkspaceRevokes) || pendingWorkspaceRevokes.length > 32 || pendingWorkspaceRevokes.some((id) => typeof id !== "string" || !UUID.test(id) || id !== id.toLowerCase()) || new Set(pendingWorkspaceRevokes).size !== pendingWorkspaceRevokes.length) throw fail("STATE_CORRUPT");
   if (!programs || typeof programs !== "object" || Array.isArray(programs) || Object.keys(programs).length > 32 || Object.entries(programs).some(([name2, executable]) => !/^[a-z0-9_.-]{1,64}$/.test(name2) || typeof executable !== "string" || !path5.isAbsolute(executable) || executable.length > 4096 || /[\u0000-\u001f]/.test(executable))) throw fail("STATE_CORRUPT");
-  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path5.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name2) => typeof name2 !== "string" || !Object.hasOwn(programs, name2)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== w.allowedCommands.length > 0 || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== w.localhostPorts.length > 0)) throw fail("STATE_CORRUPT");
+  if (!Array.isArray(workspaces) || workspaces.length > 32 || workspaces.some((w) => !w || !UUID.test(w.workspaceGrantId) || typeof w.root !== "string" || !path5.isAbsolute(w.root) || w.root.length > 4096 || /[\u0000-\u001f]/.test(w.root) || !/^[a-f0-9]{64}$/.test(w.rootHash) || typeof w.displayName !== "string" || !w.displayName || w.displayName.length > 120 || w.policyVersion !== 1 || !w.permissions || w.permissions.readFiles !== true || typeof w.permissions.writeFiles !== "boolean" || typeof w.permissions.executeCommands !== "boolean" || typeof w.permissions.localhost !== "boolean" || !Array.isArray(w.allowedCommands) || w.allowedCommands.length > 32 || w.allowedCommands.some((name2) => typeof name2 !== "string" || !Object.hasOwn(programs, name2)) || new Set(w.allowedCommands).size !== w.allowedCommands.length || w.permissions.executeCommands !== (w.fullAccess === true || w.allowedCommands.length > 0) || !Array.isArray(w.localhostPorts) || w.localhostPorts.length > 32 || w.localhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(w.localhostPorts).size !== w.localhostPorts.length || w.permissions.localhost !== (w.fullAccess === true || w.localhostPorts.length > 0))) throw fail("STATE_CORRUPT");
   if (new Set(workspaces.map((w) => w.workspaceGrantId)).size !== workspaces.length || new Set(workspaces.map((w) => w.rootHash)).size !== workspaces.length) throw fail("STATE_CORRUPT");
   if (workspaces.some((w) => pendingWorkspaceRevokes.includes(w.workspaceGrantId))) throw fail("STATE_CORRUPT");
+  for (const w of workspaces) {
+    if (w.fullAccess !== void 0 && w.fullAccess !== true || w.deniedCommands !== void 0 && (!w.fullAccess || !Array.isArray(w.deniedCommands) || w.deniedCommands.length > 32 || w.deniedCommands.some((name2) => typeof name2 !== "string" || !/^[a-z0-9_.-]{1,64}$/.test(name2))) || w.deniedLocalhostPorts !== void 0 && (!w.fullAccess || !Array.isArray(w.deniedLocalhostPorts) || w.deniedLocalhostPorts.length > 32 || w.deniedLocalhostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535))) throw fail("STATE_CORRUPT");
+  }
   return { version: 1, publicKeyPem: value.publicKeyPem, privateKeyPem: value.privateKeyPem, fingerprint: value.fingerprint, dataKey: value.dataKey, ...enrollment ? { enrollment } : {}, workspaces, programs, pendingWorkspaceRevokes, ...value.permissionHistory ? { permissionHistory: permissionHistory.data } : {}, ...policyBundle ? { policyBundle } : {}, ...approvals?.success ? { approvals: approvals.data } : {}, ...value.guardRequired ? { guardRequired: true } : {}, ...guard ? { guard } : {} };
 }
 async function noSymlinkChain(target) {
@@ -26154,7 +26166,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
     return this.run(async () => {
       const state = await this.readState();
       if (guardActive === false && state?.guardRequired) throw fail("GUARD_RESTART_REQUIRED");
-      return [...state?.workspaces ?? []].map((w) => ({ ...w, permissions: { ...w.permissions }, allowedCommands: [...w.allowedCommands], localhostPorts: [...w.localhostPorts] }));
+      return structuredClone(state?.workspaces ?? []);
     });
   }
   loadPrograms() {
@@ -26178,7 +26190,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       const before = await this.rawHash();
       state.workspaces = state.workspaces.filter((w) => w.workspaceGrantId !== id);
       state.pendingWorkspaceRevokes = [...state.pendingWorkspaceRevokes ?? [], id];
-      for (const name2 of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
+      for (const name2 of Object.keys(state.programs ?? {})) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2) || w.deniedCommands?.includes(name2))) delete state.programs[name2];
       await this.writeState(state, before);
     }));
   }
@@ -26220,7 +26232,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
       const before = await this.rawHash();
       state.workspaces = state.workspaces.map((w) => w.workspaceGrantId === verified.workspace.workspaceGrantId ? verified.workspace : w);
       state.programs = verified.programs;
-      for (const name2 of Object.keys(state.programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2))) delete state.programs[name2];
+      for (const name2 of Object.keys(state.programs)) if (!state.workspaces.some((w) => w.allowedCommands.includes(name2) || w.deniedCommands?.includes(name2))) delete state.programs[name2];
       const record2 = {
         id: randomUUID3(),
         changedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -26267,7 +26279,8 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
           rootHash,
           displayName: (path5.basename(root) || root).slice(0, 120),
           policyVersion: 1,
-          permissions: { readFiles: true, writeFiles: true, executeCommands: false, localhost: false },
+          ...selected.mode === "all-drives" ? { fullAccess: true } : {},
+          permissions: { readFiles: true, writeFiles: true, executeCommands: selected.mode === "all-drives", localhost: selected.mode === "all-drives" },
           allowedCommands: [],
           localhostPorts: []
         };
@@ -26323,7 +26336,7 @@ var WindowsPrivateStore = class _WindowsPrivateStore {
 // agent/src/tools.ts
 import { constants as constants3 } from "node:fs";
 import { lstat as lstat5, open as open4, readdir as readdir3, realpath as realpath5, rename as rename3, rm as rm3 } from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/guard.ts
@@ -26567,11 +26580,31 @@ function invokeRead(bridge, file2, maxBytes, prefix, signal) {
   });
 }
 
+// src/process.ts
+import { statSync } from "node:fs";
+import path8 from "node:path";
+var WINDOWS_LAUNCH_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
+function resolveWindowsLauncher(commandName, env = process.env) {
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => ext.trim().toLowerCase()).filter((ext) => WINDOWS_LAUNCH_EXTENSIONS.includes(ext));
+  for (const entry of (env.PATH ?? "").split(";")) {
+    const dir = entry.trim().replace(/^"(.*)"$/, "$1");
+    if (!path8.win32.isAbsolute(dir)) continue;
+    for (const ext of extensions) {
+      const file2 = path8.win32.join(dir, commandName + ext);
+      try {
+        if (statSync(file2).isFile()) return { file: file2, shell: ext === ".bat" || ext === ".cmd" };
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+
 // agent/src/job-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
-import path8 from "node:path";
+import path9 from "node:path";
 function absolute(value) {
-  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path8.isAbsolute(value) && path8.resolve(value) === value;
+  return typeof value === "string" && value.length > 0 && value.length < 32767 && !value.includes("\0") && path9.isAbsolute(value) && path9.resolve(value) === value;
 }
 async function runSupervised(helper, request, options = {}) {
   if (process.platform !== "win32") throw Error("WINDOWS_SUPERVISOR_REQUIRED");
@@ -26587,7 +26620,7 @@ async function runSupervised(helper, request, options = {}) {
     let pid = null, outcome = null;
     let buffer = "", failure5 = null, closed = false, cancelSent = false;
     let killTimer, hardTimer;
-    const child = spawn2(helper, [], { cwd: path8.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
+    const child = spawn2(helper, [], { cwd: path9.dirname(helper), stdio: ["pipe", "pipe", "pipe"], windowsHide: true, shell: false, env: buildChildEnvironment(process.env) });
     const cancel = () => {
       if (closed || cancelSent) return;
       cancelSent = true;
@@ -26741,7 +26774,7 @@ var NativeTools = class {
   options;
   async readFile(file2, maxBytes, signal) {
     try {
-      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path9.join(path9.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
+      return await readBoundedFile(file2, maxBytes, this.options.ownerBridgePath ?? path10.join(path10.dirname(this.options.helperPath), "OwnerBridge.exe"), signal);
     } catch (error62) {
       if (error62.code === "ENOENT") throw error62;
       if (error62 instanceof Error && /^[A-Z_]{1,40}$/.test(error62.message)) fail2(error62.message);
@@ -26766,15 +26799,15 @@ var NativeTools = class {
     try {
       const canonical2 = await realpath5(workspace.root);
       if (!equalPath3(canonical2, workspace.root) || hash5(process.platform === "win32" ? canonical2.toLowerCase() : canonical2) !== workspace.rootHash) fail2("WORKSPACE_CHANGED");
-      const runtimeDirectory = path9.dirname(this.options.helperPath);
+      const runtimeDirectory = path10.dirname(this.options.helperPath);
       const protectedPaths = [
         this.options.stateDirectory,
         this.options.helperPath,
-        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path9.join(runtimeDirectory, name2))
+        ...["agent.mjs", "node.exe", "OwnerBridge.exe", "LocalCommanderAgent.exe"].map((name2) => path10.join(runtimeDirectory, name2))
       ];
       if (this.options.ownerBridgePath) protectedPaths.push(this.options.ownerBridgePath);
-      if (process.platform === "win32" && process.env.LOCALAPPDATA && path9.isAbsolute(process.env.LOCALAPPDATA)) {
-        protectedPaths.push(path9.join(process.env.LOCALAPPDATA, "LocalCommander"));
+      if (process.platform === "win32" && process.env.LOCALAPPDATA && path10.isAbsolute(process.env.LOCALAPPDATA)) {
+        protectedPaths.push(path10.join(process.env.LOCALAPPDATA, "LocalCommander"));
       }
       guard = await PathGuard.create([canonical2], false, { protectedPaths });
     } catch (e) {
@@ -26806,7 +26839,7 @@ var NativeTools = class {
         const bytes3 = await this.readFile(filename, 1048576, signal), contents = utf8(bytes3), lines = contents.split(/\r?\n/);
         const selected = lines.slice(first - 1, Math.min(last, lines.length)).join("\n");
         if (Buffer.byteLength(selected) > 12e4) fail2("OUTPUT_LIMIT_EXCEEDED");
-        return result({ path: path9.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
+        return result({ path: path10.relative(workspace.root, filename), sha256: hash5(bytes3), startLine: first, endLine: Math.min(last, lines.length), totalLines: lines.length, content: selected, truncated: last < lines.length });
       } };
     }
     if (call.name === "fs_write" || call.name === "fs_replace") {
@@ -26842,7 +26875,7 @@ var NativeTools = class {
         }
         const bytes3 = Buffer.from(contents, "utf8");
         if (bytes3.length > MAX_FILE_WRITE_BYTES) fail2("FILE_WRITE_LIMIT");
-        const temp = path9.join(path9.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
+        const temp = path10.join(path10.dirname(target), ".lc-write-" + randomUUID4() + ".tmp");
         const handle = await open4(temp, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
         try {
           await handle.writeFile(bytes3);
@@ -26859,7 +26892,7 @@ var NativeTools = class {
             await link(temp, target);
             await rm3(temp);
           }
-          return result({ path: path9.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
+          return result({ path: path10.relative(workspace.root, target), bytes: bytes3.length, sha256: hash5(bytes3), ...call.name === "fs_replace" ? { replacements } : {} });
         } catch (e) {
           await handle.close().catch(() => {
           });
@@ -26880,12 +26913,12 @@ var NativeTools = class {
           stopped(signal);
           if (matches2.length >= call.args.maxResults || scanned >= 300) break;
           try {
-            const filename = await guard.resolveExisting(path9.join(base, entry.path));
+            const filename = await guard.resolveExisting(path10.join(base, entry.path));
             guard.assertSafeFile(filename);
             const data = utf8(await this.readFile(filename, 256e3, signal));
             scanned++;
             const lines = data.split(/\r?\n/);
-            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path9.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
+            for (let i = 0; i < lines.length && matches2.length < call.args.maxResults; i++) if ((call.args.caseSensitive ? lines[i] : lines[i].toLowerCase()).includes(query)) matches2.push({ path: path10.relative(workspace.root, filename), line: i + 1, text: lines[i].slice(0, 500) });
           } catch (error62) {
             if (error62 instanceof NativeToolError && ["FILE_READ_FAILED", "CANCELLED"].includes(error62.code)) throw error62;
           }
@@ -26895,7 +26928,7 @@ var NativeTools = class {
     }
     if (call.name === "localhost_request") {
       const url2 = new URL(call.args.url), port = Number(url2.port || (url2.protocol === "https:" ? 443 : 80));
-      if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || !workspace.localhostPorts.includes(port) || this.options.protectedPorts?.includes(port)) fail2("LOCALHOST_NOT_ALLOWED");
+      if (!["http:", "https:"].includes(url2.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname) || url2.username || url2.password || url2.hash || (workspace.fullAccess ? workspace.deniedLocalhostPorts?.includes(port) : !workspace.localhostPorts.includes(port)) || this.options.protectedPorts?.includes(port)) fail2("LOCALHOST_NOT_ALLOWED");
       const headers = {};
       for (const [name2, value] of Object.entries(call.args.headers ?? {})) {
         if (!/^[A-Za-z0-9-]+$/.test(name2) || /[\r\n]/.test(value) || ["host", "connection", "content-length", "transfer-encoding", "upgrade", "proxy-authorization", "proxy-connection"].includes(name2.toLowerCase()) || Object.keys(headers).some((k) => k.toLowerCase() === name2.toLowerCase())) fail2("INVALID_HTTP_HEADER");
@@ -26935,10 +26968,10 @@ var NativeTools = class {
       } };
     }
     if (call.name === "command_run") {
-      const cwd2 = await resolve(call.args.cwd, true), program = this.resolveProgram(call.args.command, workspace);
+      const cwd2 = await resolve(call.args.cwd, true), program = await this.resolveProgram(call.args.command, workspace, call.args.args);
       const claims2 = writeClaim(cwd2);
-      return { call, claims: claims2, execution: { executable: program.executable, args: [...program.prefixArgs ?? [], ...call.args.args], cwd: cwd2 }, run: async (signal, onStarted, onOutput) => {
-        const r = await runSupervised(this.options.helperPath, { executable: program.executable, args: [...program.prefixArgs ?? [], ...call.args.args], cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
+      return { call, claims: claims2, execution: { ...program, cwd: cwd2 }, run: async (signal, onStarted, onOutput) => {
+        const r = await runSupervised(this.options.helperPath, { ...program, cwd: cwd2, timeoutMs: call.args.timeoutMs, maxProcesses: 32 }, { signal, maxOutputBytes: 9e4, onStarted, onOutput });
         const { pid: _pid, ...output2 } = r;
         return { ...output2, resultCode: r.cancelled ? "CANCELLED" : r.timedOut ? "TIMEOUT" : r.exitCode === 0 ? "SUCCESS" : "USER_PROGRAM_FAILED" };
       } };
@@ -26952,9 +26985,9 @@ var NativeTools = class {
     else if (call.name === "git_diff") {
       argv = ["diff", "--no-ext-diff", "--no-textconv", ...call.args.staged ? ["--cached"] : []];
       if (call.args.file) {
-        const file2 = await resolve(path9.resolve(cwd, call.args.file));
-        const relative = path9.relative(cwd, file2);
-        if (relative.startsWith(".." + path9.sep) || relative === ".." || path9.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
+        const file2 = await resolve(path10.resolve(cwd, call.args.file));
+        const relative = path10.relative(cwd, file2);
+        if (relative.startsWith(".." + path10.sep) || relative === ".." || path10.isAbsolute(relative)) fail2("PATH_NOT_ALLOWED");
         argv.push("--", relative);
       } else argv.push("--stat");
     } else fail2("TOOL_MISSING");
@@ -26965,7 +26998,7 @@ var NativeTools = class {
         const listing = await this.list(guard, cwd, 1, 150, signal);
         let packageInfo = null;
         try {
-          const name2 = await guard.resolveExisting(path9.join(cwd, "package.json"));
+          const name2 = await guard.resolveExisting(path10.join(cwd, "package.json"));
           guard.assertSafeFile(name2);
           const value = JSON.parse(utf8(await this.readFile(name2, 64e3, signal)));
           packageInfo = { name: typeof value.name === "string" ? value.name : null, version: typeof value.version === "string" ? value.version : null, scripts: value.scripts && typeof value.scripts === "object" ? Object.keys(value.scripts).slice(0, 100) : [] };
@@ -26981,16 +27014,44 @@ var NativeTools = class {
       return { ...output2, resultCode: r.exitCode === 0 ? "SUCCESS" : "GIT_FAILED" };
     } };
   }
-  resolveProgram(name2, workspace) {
-    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path9.isAbsolute(name2) && equalPath3(value.executable, path9.resolve(name2)));
-    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path9.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
-    return { executable: entry[1].executable, prefixArgs: [...entry[1].prefixArgs ?? []] };
+  async resolveProgram(name2, workspace, args) {
+    const entry = Object.entries(this.options.programs).find(([key, value]) => key.toLowerCase() === name2.toLowerCase() || path10.isAbsolute(name2) && equalPath3(value.executable, path10.resolve(name2)));
+    if (workspace.fullAccess) {
+      const commandKey = (value) => path10.basename(value).toLowerCase().replace(/\.(exe|com|cmd|bat)$/i, "");
+      const denied = new Set((workspace.deniedCommands ?? []).map(commandKey));
+      if (denied.has(commandKey(name2)) || entry && denied.has(commandKey(entry[0]))) fail2("COMMAND_NOT_ALLOWED");
+      const extension2 = path10.extname(name2).toLowerCase();
+      const candidate = entry?.[1].executable ?? (path10.isAbsolute(name2) ? name2 : /^[\w.-]+$/.test(name2) ? resolveWindowsLauncher(
+        commandKey(name2),
+        [".exe", ".com", ".cmd", ".bat"].includes(extension2) ? { ...process.env, PATHEXT: extension2 } : process.env
+      )?.file : void 0);
+      if (!candidate || !path10.isAbsolute(candidate)) fail2("COMMAND_NOT_FOUND");
+      const executable = await realpath5(candidate).catch(() => fail2("COMMAND_NOT_FOUND"));
+      if (!(await lstat5(executable)).isFile()) fail2("COMMAND_NOT_FOUND");
+      if (denied.has(commandKey(executable))) fail2("COMMAND_NOT_ALLOWED");
+      for (const key of workspace.deniedCommands ?? []) {
+        const configured = this.options.programs[key]?.executable;
+        if (configured && equalPath3(executable, await realpath5(configured).catch(() => configured))) fail2("COMMAND_NOT_ALLOWED");
+      }
+      if (/\.(cmd|bat)$/i.test(executable)) {
+        if ([executable, ...args].some((value) => /[&|<>^%!"\r\n]/.test(value))) fail2("INVALID_SCRIPT_ARGUMENTS");
+        const literal2 = (value) => "'" + value.replaceAll("'", "''") + "'";
+        const shell = path10.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        if (denied.has("powershell") || denied.has("cmd")) fail2("COMMAND_NOT_ALLOWED");
+        const script = "& " + literal2(executable) + " @(" + args.map(literal2).join(",") + "); exit $LASTEXITCODE";
+        return { executable: shell, args: ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] };
+      }
+      if (!/\.(exe|com)$/i.test(executable)) fail2("COMMAND_NOT_ALLOWED");
+      return { executable, args: [...entry?.[1].prefixArgs ?? [], ...args] };
+    }
+    if (!entry || !workspace.allowedCommands.some((v) => v.toLowerCase() === entry[0].toLowerCase()) || !path10.isAbsolute(entry[1].executable)) fail2("COMMAND_NOT_ALLOWED");
+    return { executable: entry[1].executable, args: [...entry[1].prefixArgs ?? [], ...args] };
   }
   async gitExecution(cwd, args) {
     const configured = this.options.programs.git;
-    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path9.isAbsolute(root)).map(([root, suffix]) => path9.join(root, suffix, "cmd", "git.exe")) : [];
+    const candidates = configured ? [configured.executable] : process.platform === "win32" ? [[process.env.ProgramFiles, "Git"], [process.env["ProgramFiles(x86)"], "Git"], [process.env.LOCALAPPDATA, "Programs/Git"]].filter(([root]) => root && path10.isAbsolute(root)).map(([root, suffix]) => path10.join(root, suffix, "cmd", "git.exe")) : [];
     for (const candidate of candidates) {
-      if (!path9.isAbsolute(candidate)) continue;
+      if (!path10.isAbsolute(candidate)) continue;
       try {
         const stat = await lstat5(candidate);
         if (!stat.isFile() || stat.isSymbolicLink() || !equalPath3(candidate, await realpath5(candidate))) continue;
@@ -27016,7 +27077,7 @@ var NativeTools = class {
           break;
         }
         if (item.isSymbolicLink() || excluded.has(item.name.toLowerCase())) continue;
-        const candidate = path9.join(current2.path, item.name);
+        const candidate = path10.join(current2.path, item.name);
         let resolved;
         try {
           resolved = await guard.resolveExisting(candidate);
@@ -27026,11 +27087,11 @@ var NativeTools = class {
         }
         if (!equalPath3(candidate, resolved)) continue;
         if (item.isDirectory()) {
-          entries.push({ path: path9.relative(root, resolved), type: "directory" });
+          entries.push({ path: path10.relative(root, resolved), type: "directory" });
           if (current2.level < depth) queue.push({ path: resolved, level: current2.level + 1 });
         } else if (item.isFile()) {
           const stat = await lstat5(resolved);
-          entries.push({ path: path9.relative(root, resolved), type: "file", size: stat.size });
+          entries.push({ path: path10.relative(root, resolved), type: "file", size: stat.size });
         }
       }
       if (truncated) break;
@@ -27040,7 +27101,7 @@ var NativeTools = class {
   async gitCommonDir(cwd, workspace, guard) {
     let directory = cwd;
     while (guard.isWithin(directory, workspace.root)) {
-      const dotGit = path9.join(directory, ".git");
+      const dotGit = path10.join(directory, ".git");
       try {
         const stat = await lstat5(dotGit);
         if (stat.isSymbolicLink()) fail2("GIT_METADATA_CHANGED");
@@ -27049,14 +27110,14 @@ var NativeTools = class {
         else {
           const content = utf8(await this.readFile(dotGit, 4096)).trim();
           if (!content.startsWith("gitdir: ")) fail2("GIT_METADATA_CHANGED");
-          gitDir = await realpath5(path9.resolve(directory, content.slice(8)));
+          gitDir = await realpath5(path10.resolve(directory, content.slice(8)));
         }
         if (guard.isWithin(gitDir, this.options.stateDirectory) || !guard.isWithin(gitDir, workspace.root) && (!workspace.gitCommonDir || !guard.isWithin(gitDir, workspace.gitCommonDir))) fail2("GIT_COMMON_DIRECTORY_NOT_APPROVED");
         let common = gitDir;
         try {
-          const content = utf8(await this.readFile(path9.join(gitDir, "commondir"), 4096)).trim();
+          const content = utf8(await this.readFile(path10.join(gitDir, "commondir"), 4096)).trim();
           if (!content) fail2("GIT_METADATA_CHANGED");
-          common = await realpath5(path9.resolve(gitDir, content));
+          common = await realpath5(path10.resolve(gitDir, content));
         } catch (e) {
           if (e.code !== "ENOENT") throw e;
         }
@@ -27067,22 +27128,22 @@ var NativeTools = class {
         if (e.code !== "ENOENT") throw e;
       }
       if (equalPath3(directory, workspace.root)) break;
-      directory = path9.dirname(directory);
+      directory = path10.dirname(directory);
     }
     return null;
   }
 };
 
 // agent/src/scheduler.ts
-import path10 from "node:path";
+import path11 from "node:path";
 import os2 from "node:os";
 function canonical(value) {
-  const p = path10.resolve(value);
+  const p = path11.resolve(value);
   return process.platform === "win32" ? p.toLowerCase() : p;
 }
 function ancestor(a, b) {
-  const relative = path10.relative(a, b);
-  return relative === "" || !path10.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path10.sep);
+  const relative = path11.relative(a, b);
+  return relative === "" || !path11.isAbsolute(relative) && relative !== ".." && !relative.startsWith(".." + path11.sep);
 }
 function claimsConflict(a, b) {
   return a.some((x) => b.some((y) => (x.namespace ?? "filesystem") === (y.namespace ?? "filesystem") && (x.mode === "write" || y.mode === "write") && (ancestor(x.path, y.path) || ancestor(y.path, x.path))));
@@ -27102,7 +27163,7 @@ var NativeScheduler = class {
   schedule(id, claims, deadlineAt, run, signal) {
     if (!this.accepting) return Promise.reject(Error("AGENT_PAUSED"));
     if (!id || id.length > 100 || this.active.has(id) || this.waiting.some((j) => j.id === id)) return Promise.reject(Error("DUPLICATE_SCHEDULED_EXECUTION"));
-    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path10.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
+    if (!Array.isArray(claims) || !claims.length || claims.length > 32 || claims.some((c) => !c || !path11.isAbsolute(c.path) || !["read", "write"].includes(c.mode))) return Promise.reject(Error("INVALID_RESOURCE_CLAIM"));
     const deadline = deadlineAt.getTime();
     if (!Number.isFinite(deadline) || deadline <= Date.now()) return Promise.reject(Error("ADMISSION_DEADLINE_EXPIRED"));
     if (signal?.aborted) return Promise.reject(Error("CANCELLED_BEFORE_ACCEPTANCE"));
@@ -28553,8 +28614,8 @@ function canonicalOrigin2(value) {
     fail4("ORIGIN_INVALID");
   }
 }
-function endpoint(origin, path13) {
-  return origin + path13;
+function endpoint(origin, path15) {
+  return origin + path15;
 }
 function uuid17(value, code) {
   if (typeof value !== "string" || !UUID3.test(value)) fail4(code);
@@ -29057,14 +29118,14 @@ async function deliverGuardEvidence(target, packet, options = {}) {
 // agent/src/optimization-ledger.ts
 import { constants as constants4 } from "node:fs";
 import { lstat as lstat6, mkdir as mkdir4, open as open5, readFile as readFile4, realpath as realpath6 } from "node:fs/promises";
-import path11 from "node:path";
+import path12 from "node:path";
 var MAX_LEDGER_BYTES = 64 * 1024 * 1024;
 var MAX_NOTICE_LEDGER_BYTES = 8 * 1024 * 1024;
 function failure4(code) {
   return Object.assign(new Error(code), { code });
 }
 async function safeDirectory2(directory) {
-  const absolute2 = path11.resolve(directory);
+  const absolute2 = path12.resolve(directory);
   let current2 = absolute2;
   for (; ; ) {
     try {
@@ -29072,7 +29133,7 @@ async function safeDirectory2(directory) {
     } catch (error62) {
       if (error62.code !== "ENOENT") throw error62;
     }
-    const parent = path11.dirname(current2);
+    const parent = path12.dirname(current2);
     if (parent === current2) break;
     current2 = parent;
   }
@@ -29097,8 +29158,8 @@ var OptimizationLedger = class _OptimizationLedger {
   closed = false;
   static async open(directory) {
     const dir = await safeDirectory2(directory);
-    const filename = path11.join(dir, "live-efficiency.v1.jsonl");
-    const noticesFilename = path11.join(dir, "live-efficiency-notices.v1.jsonl");
+    const filename = path12.join(dir, "live-efficiency.v1.jsonl");
+    const noticesFilename = path12.join(dir, "live-efficiency-notices.v1.jsonl");
     let existing = "";
     try {
       const stat = await lstat6(filename);
@@ -29230,8 +29291,144 @@ var OptimizationLedger = class _OptimizationLedger {
   }
 };
 
+// agent/src/monitor.ts
+import { createHash as createHash10, randomUUID as randomUUID7 } from "node:crypto";
+import { lstat as lstat7, mkdir as mkdir5, open as open6, rename as rename4, rm as rm4 } from "node:fs/promises";
+import path13 from "node:path";
+var ProductionMonitor = class {
+  constructor(directory, stateDirectory, agentVersion3) {
+    this.agentVersion = agentVersion3;
+    const key = createHash10("sha256").update(path13.resolve(stateDirectory).toLowerCase()).digest("hex");
+    this.file = path13.join(directory, key + ".json");
+  }
+  agentVersion;
+  instanceId = randomUUID7();
+  events = [];
+  sessions = /* @__PURE__ */ new Map();
+  sequence = 0;
+  connection = {
+    state: "starting",
+    origin: null,
+    epoch: null
+  };
+  writing = null;
+  file;
+  record(event, details = {}) {
+    this.events.push({ seq: ++this.sequence, at: (/* @__PURE__ */ new Date()).toISOString(), event, ...details });
+    if (this.events.length > 100) this.events.shift();
+  }
+  configureOrigin(origin) {
+    try {
+      const url2 = new URL(origin);
+      if (url2.origin === origin && !url2.username && !url2.password && (url2.protocol === "https:" || url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) {
+        this.connection.origin = url2.origin;
+      }
+    } catch {
+    }
+  }
+  setConnection(state, connection) {
+    if (connection) {
+      try {
+        this.configureOrigin(new URL(connection.url).origin.replace(/^ws/, "http"));
+      } catch {
+      }
+      this.connection.epoch = connection.connectionEpoch;
+    }
+    this.connection.state = state;
+    this.record(state);
+  }
+  request(request) {
+    const payload = request.payload;
+    const parsed = ExecutionBindingSchema.safeParse(payload?.binding);
+    if (!parsed.success || parsed.data.tenantId !== request.tenantId || parsed.data.deviceId !== request.deviceId || parsed.data.executionId !== request.executionId || parsed.data.operationId !== request.operationId) return;
+    const binding2 = parsed.data;
+    this.sessions.delete(binding2.sessionId);
+    this.sessions.set(binding2.sessionId, {
+      sessionId: binding2.sessionId,
+      workspaceGrantId: binding2.workspaceGrantId,
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      model: null
+    });
+    if (this.sessions.size > 32) this.sessions.delete(this.sessions.keys().next().value);
+    const tool = ToolCallSchema.safeParse(payload?.tool);
+    this.record(request.kind, {
+      sessionId: binding2.sessionId,
+      executionId: binding2.executionId,
+      ...tool.success ? { tool: tool.data.name } : {}
+    });
+  }
+  result(binding2, state, code) {
+    this.record(["finished", "failed", "cancelled", "unknown"].includes(state) ? state : "result", {
+      sessionId: binding2.sessionId,
+      executionId: binding2.executionId,
+      code: code === "SUCCESS" || ErrorCodeSchema.safeParse(code).success ? code : "RESULT"
+    });
+  }
+  requestFailed() {
+    this.record("request_failed");
+  }
+  connectionFailed(error62) {
+    const code = error62 instanceof Error ? error62.message : "";
+    this.record("connection_error", { code: [
+      "RELAY_CONNECT_FAILED",
+      "RELAY_CONNECT_CLOSED",
+      "RELAY_CONNECT_TIMEOUT",
+      "RELAY_HANDSHAKE_TIMEOUT",
+      "RELAY_RESULT_TIMEOUT",
+      "WORKSPACE_ACK_TIMEOUT"
+    ].includes(code) ? code : "CONNECTION_FAILED" });
+  }
+  response(value) {
+    const result2 = value;
+    if (result2?.accepted === false) this.record("rejected", {
+      code: ErrorCodeSchema.safeParse(result2.code).success ? String(result2.code) : "REJECTED"
+    });
+  }
+  snapshot() {
+    return {
+      schemaVersion: 1,
+      instanceId: this.instanceId,
+      pid: process.pid,
+      agentVersion: this.agentVersion,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      connection: { ...this.connection },
+      sessions: [...this.sessions.values()].map((session) => ({ ...session })),
+      events: this.events.map((event) => ({ ...event }))
+    };
+  }
+  flush() {
+    if (this.writing) return this.writing;
+    this.writing = (async () => {
+      const directory = path13.dirname(this.file);
+      await mkdir5(directory, { recursive: true, mode: 448 });
+      const stat = await lstat7(directory);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw Error("MONITOR_DIRECTORY_INVALID");
+      const temporary = this.file + "." + this.instanceId + ".tmp";
+      const handle = await open6(temporary, "wx", 384);
+      try {
+        try {
+          await handle.writeFile(JSON.stringify(this.snapshot()) + "\n");
+        } finally {
+          await handle.close();
+        }
+        await rename4(temporary, this.file);
+      } finally {
+        await rm4(temporary, { force: true });
+      }
+    })().finally(() => {
+      this.writing = null;
+    });
+    return this.writing;
+  }
+  async close() {
+    await this.writing?.catch(() => {
+    });
+    await this.flush();
+  }
+};
+
 // agent/src/main.ts
-var AGENT_VERSION2 = true ? "0.3.6" : "0.3.2";
+var AGENT_VERSION2 = true ? "0.3.7" : "0.3.2";
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -29242,11 +29439,11 @@ function processAlive(pid) {
   }
 }
 async function claimAgentProcess(stateDir, runtimeDir, version2) {
-  await mkdir5(stateDir, { recursive: true });
-  const file2 = path12.join(stateDir, "agent-process.json");
+  await mkdir6(stateDir, { recursive: true });
+  const file2 = path14.join(stateDir, "agent-process.json");
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await open6(file2, "wx", 384);
+      const handle = await open7(file2, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify({ pid: process.pid, runtimeDir, version: version2, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n", "utf8");
       } finally {
@@ -29255,7 +29452,7 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       return async () => {
         try {
           const current2 = JSON.parse(await readFile5(file2, "utf8"));
-          if (current2.pid === process.pid) await rm4(file2, { force: true });
+          if (current2.pid === process.pid) await rm5(file2, { force: true });
         } catch {
         }
       };
@@ -29268,7 +29465,7 @@ async function claimAgentProcess(stateDir, runtimeDir, version2) {
       } catch {
       }
       if (!stale) throw Error("AGENT_ALREADY_RUNNING");
-      await rm4(file2, { force: true });
+      await rm5(file2, { force: true });
     }
   }
   throw Error("AGENT_ALREADY_RUNNING");
@@ -29291,6 +29488,7 @@ async function runAgent(options) {
     if (!Number.isInteger(delay) || delay < 0 || delay > 3e4) throw Error("RECONNECT_DELAY_INVALID");
     const identity = await options.store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
+    options.monitor?.configureOrigin(identity.enrollment.serverOrigin);
     await options.journal.recoverAfterRestart();
     await options.store.loadWorkspaces();
   } catch (error62) {
@@ -29300,6 +29498,7 @@ async function runAgent(options) {
   const runtime = new NativeRuntime({ journal: options.journal, tools: options.tools, scheduler: new NativeScheduler(), workspaces: () => options.store.loadWorkspaces(Boolean(options.guard)), guard: options.guard, efficiencyLedger: options.efficiencyLedger });
   let connection = null;
   const bridge = new NativeRelayBridge(runtime, (binding2, state, code, metrics) => {
+    options.monitor?.result(binding2, state, code);
     if (!connection) throw Error("RELAY_SOCKET_CLOSED");
     return connection.sendTerminal(binding2, state, code, metrics);
   }, options.journal);
@@ -29311,11 +29510,21 @@ async function runAgent(options) {
         ready = resolve;
       });
       try {
+        options.monitor?.setConnection("connecting");
         connection = await connect({ store: options.store, agentVersion: options.agentVersion, handleRequest: async (request) => {
           await readyPromise;
-          return bridge.handle(request);
+          options.monitor?.request(request);
+          try {
+            const result2 = await bridge.handle(request);
+            options.monitor?.response(result2);
+            return result2;
+          } catch (error62) {
+            options.monitor?.requestFailed();
+            throw error62;
+          }
         } });
         await bridge.connected(connection);
+        options.monitor?.setConnection("connected", connection);
         ready();
         if (options.signal.aborted) connection.close("agent_shutdown");
         else {
@@ -29337,9 +29546,11 @@ async function runAgent(options) {
         }
       } catch (error62) {
         ready();
+        options.monitor?.connectionFailed(error62);
         if (error62 instanceof RelayClientError && ["RELAY_CONNECT_FAILED", "RELAY_CONNECT_CLOSED", "RELAY_CONNECT_TIMEOUT", "RELAY_HANDSHAKE_TIMEOUT"].includes(error62.code)) {
         } else throw error62;
       } finally {
+        options.monitor?.setConnection("disconnected");
         connection?.close("agent_disconnect");
         await bridge.disconnected();
         connection = null;
@@ -29354,10 +29565,10 @@ async function runAgent(options) {
 async function main() {
   if (process.platform !== "win32") throw Error("WINDOWS_REQUIRED");
   const appData = process.env.LOCALAPPDATA;
-  if (!appData || !path12.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
-  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path12.join(appData, "LocalCommander", "Agent");
-  const binaryDir = path12.dirname(process.execPath);
-  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path12.join(binaryDir, "OwnerBridge.exe");
+  if (!appData || !path14.isAbsolute(appData)) throw Error("APP_DATA_MISSING");
+  const stateDir = process.env.LC_AGENT_STATE_DIR ?? path14.join(appData, "LocalCommander", "Agent");
+  const binaryDir = path14.dirname(process.execPath);
+  const ownerBridgePath = process.env.LC_OWNER_BRIDGE ?? path14.join(binaryDir, "OwnerBridge.exe");
   const store = await WindowsPrivateStore.open(stateDir, ownerBridgePath);
   const command = process.argv[2] ?? "run";
   if (command === "pair") {
@@ -29395,6 +29606,9 @@ async function main() {
       displayName: w.displayName,
       path: w.root,
       permissions: w.permissions,
+      accessMode: w.fullAccess ? "full" : "scoped",
+      deniedCommands: w.deniedCommands ?? [],
+      deniedLocalhostPorts: w.deniedLocalhostPorts ?? [],
       allowedCommands: w.allowedCommands,
       executables: Object.fromEntries(w.allowedCommands.map((name2) => [name2, programs[name2]?.executable ?? null])),
       localhostPorts: w.localhostPorts,
@@ -29405,7 +29619,7 @@ async function main() {
   const args = process.argv.slice(3);
   if (command === "efficiency-report") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const ledger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
+    const ledger = await OptimizationLedger.open(path14.join(stateDir, "optimization"));
     try {
       process.stdout.write(JSON.stringify(await ledger.report(), null, 2) + "\n");
     } finally {
@@ -29415,7 +29629,7 @@ async function main() {
   }
   if (command === "guard-configure") {
     if (args.length !== 1) throw Error("AGENT_COMMAND_INVALID");
-    const filename = await (await import("node:fs/promises")).realpath(path12.resolve(args[0]));
+    const filename = await (await import("node:fs/promises")).realpath(path14.resolve(args[0]));
     const input2 = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readWindowsFile(ownerBridgePath, filename, 2e5)));
     if (!input2 || typeof input2 !== "object" || Object.keys(input2).sort().join(",") !== "compact,settings") throw Error("GUARD_CONFIGURATION_INVALID");
     await store.configureGuard(input2.settings, input2.compact);
@@ -29434,7 +29648,7 @@ async function main() {
   }
   if (command === "guard-evidence") {
     if (args.length) throw Error("AGENT_COMMAND_INVALID");
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       process.stdout.write(JSON.stringify(await journal.guardEvidence()) + "\n");
     } finally {
@@ -29446,7 +29660,7 @@ async function main() {
     if (args.length !== (command === "guard-export" ? 0 : 1)) throw Error("AGENT_COMMAND_INVALID");
     const identity = await store.load();
     if (!identity?.enrollment) throw Error("ENROLLMENT_MISSING");
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
     try {
       const { tenantId, deviceId } = identity.enrollment;
       const records = (await journal.guardEvidence()).filter((record2) => record2.tenantId === tenantId && record2.deviceId === deviceId);
@@ -29484,25 +29698,41 @@ async function main() {
   if (args.length) throw Error("AGENT_COMMAND_INVALID");
   if (!(await store.load())?.enrollment) throw Error("ENROLLMENT_MISSING");
   const releaseProcess = await claimAgentProcess(stateDir, binaryDir, AGENT_VERSION2);
+  const monitor = new ProductionMonitor(path14.join(appData, "LocalCommander", "Monitor"), stateDir, AGENT_VERSION2);
+  const publishMonitor = () => monitor.flush().catch(() => {
+    process.stderr.write("MONITOR_WRITE_FAILED\n");
+  });
+  await publishMonitor();
+  const monitorTimer = setInterval(() => {
+    void publishMonitor();
+  }, 2e3);
   try {
-    const journal = await NativeJournal.open(path12.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
-    const efficiencyLedger = await OptimizationLedger.open(path12.join(stateDir, "optimization"));
+    const journal = await NativeJournal.open(path14.join(stateDir, "journal"), new SecretBox({ "1": await store.loadDataKey() }));
+    const efficiencyLedger = await OptimizationLedger.open(path14.join(stateDir, "optimization"));
     try {
-      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path12.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
+      const tools = new NativeTools({ stateDirectory: stateDir, helperPath: process.env.LC_JOB_HOST ?? path14.join(binaryDir, "JobHost.exe"), ownerBridgePath, programs: await store.loadPrograms() });
       const stop = new AbortController();
       process.once("SIGINT", () => stop.abort());
       process.once("SIGTERM", () => stop.abort());
       const guard = await NativeGuard.open(store, journal);
-      await runAgent({ store, journal, tools, signal: stop.signal, agentVersion: AGENT_VERSION2, guard, efficiencyLedger });
+      await runAgent({ store, journal, tools, signal: stop.signal, agentVersion: AGENT_VERSION2, guard, efficiencyLedger, monitor });
+      monitor.setConnection("stopped");
     } finally {
       await efficiencyLedger.close();
       await journal.close();
     }
+  } catch (error62) {
+    monitor.setConnection("failed");
+    throw error62;
   } finally {
+    clearInterval(monitorTimer);
+    await monitor.close().catch(() => {
+      process.stderr.write("MONITOR_WRITE_FAILED\n");
+    });
     await releaseProcess();
   }
 }
-if (process.argv[1] && path12.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (process.argv[1] && path14.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   void main().catch((error62) => {
     const code = error62 instanceof Error && /^[A-Z0-9_]{1,64}$/.test(error62.message) ? error62.message : "AGENT_START_FAILED";
     process.stderr.write(code + "\n");