terminal-commands 0.1.2 → 0.2.0

package/dist/stdio.js

@@ -410,11 +410,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants2);
+          this.rhs = optimizeExpr(this.rhs, names, constants);
         return this;
       }
       get names() {
@@ -431,10 +431,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants2);
+        this.rhs = optimizeExpr(this.rhs, names, constants);
         return this;
       }
       get names() {
@@ -495,8 +495,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants2) {
-        this.code = optimizeExpr(this.code, names, constants2);
+      optimizeNames(names, constants) {
+        this.code = optimizeExpr(this.code, names, constants);
         return this;
       }
       get names() {
@@ -525,12 +525,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants2))
+          if (n.optimizeNames(names, constants))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -583,12 +583,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants2);
-        if (!(super.optimizeNames(names, constants2) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants);
+        if (!(super.optimizeNames(names, constants) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants2);
+        this.condition = optimizeExpr(this.condition, names, constants);
         return this;
       }
       get names() {
@@ -611,10 +611,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants) {
+        if (!super.optimizeNames(names, constants))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants2);
+        this.iteration = optimizeExpr(this.iteration, names, constants);
         return this;
       }
       get names() {
@@ -650,10 +650,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants2) {
-        if (!super.optimizeNames(names, constants2))
+      optimizeNames(names, constants) {
+        if (!super.optimizeNames(names, constants))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants2);
+        this.iterable = optimizeExpr(this.iterable, names, constants);
         return this;
       }
       get names() {
@@ -695,11 +695,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants2) {
+      optimizeNames(names, constants) {
         var _a3, _b;
-        super.optimizeNames(names, constants2);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants2);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants2);
+        super.optimizeNames(names, constants);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants);
         return this;
       }
       get names() {
@@ -1000,7 +1000,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants2) {
+    function optimizeExpr(expr, names, constants) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -1015,14 +1015,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants2[n.str];
+        const c = constants[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -3262,8 +3262,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input2 = path2;
+    function removeDotSegments(path4) {
+      let input2 = path4;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -3672,8 +3672,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path2 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const path4 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -4148,13 +4148,14 @@ var require_fast_uri = __commonJS({
         if (!malformedIPLiteral) {
           malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         }
-        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-          if (uri.indexOf("%") !== -1) {
-            if (parsed.host !== void 0 && !malformedIPLiteral) {
-              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-              parsed.host = reescapeHostDelimiters(host, isIP);
-            }
+        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP) {
+            host = normalizePercentEncoding(host.toLowerCase());
           }
+          parsed.host = reescapeHostDelimiters(host, isIP);
+        }
+        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
@@ -8017,10 +8018,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -8360,11 +8361,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -8814,16 +8815,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path2 = []) => {
+  const processError = (error63, path4 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -8862,17 +8863,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path2 = []) => {
+  const processError = (error63, path4 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -8911,8 +8912,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path2) {
+  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path4) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -26014,13 +26015,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path2 = ref.slice(1).split("/").filter(Boolean);
-  if (path2.length === 0) {
+  const path4 = ref.slice(1).split("/").filter(Boolean);
+  if (path4.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path2[0] === defsKey) {
-    const key = path2[1] === void 0 ? void 0 : decodeJSONPointerSegment(path2[1]);
+  if (path4[0] === defsKey) {
+    const key = path4[1] === void 0 ? void 0 : decodeJSONPointerSegment(path4[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -28504,9 +28505,6 @@ var StdioServerTransport = class {
   }
 };
 
-// src/server.ts
-import { readdir, writeFile } from "node:fs/promises";
-
 // node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
@@ -28881,8 +28879,8 @@ function getErrorMap2() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -28997,11 +28995,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -32552,11 +32550,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path2) {
-  if (path2.length === 0) {
+function getDotPath(path4) {
+  if (path4.length === 0) {
     return "object root";
   }
-  return path2.reduce((acc, seg, index) => {
+  return path4.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -34000,6 +33998,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -34030,12 +34031,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -34072,7 +34073,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -34200,6 +34201,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -34209,7 +34223,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error62) => this._onerror(new Error(`Failed to send an error response: ${error62}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -34260,7 +34277,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -34295,7 +34315,7 @@ var Protocol = class {
           ...error62["data"] !== void 0 && { data: error62["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -34775,7 +34795,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -34804,12 +34824,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -35688,6 +35709,42 @@ var ExperimentalMcpServerTasks = class {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node2 = stack.pop();
+    if (node2 === null || typeof node2 !== "object")
+      continue;
+    if (Array.isArray(node2)) {
+      for (const child of node2) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node2) {
+        if (!Object.prototype.hasOwnProperty.call(node2, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node2[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -35699,6 +35756,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -35829,12 +35887,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync3(schemaToParse, args);
+    const parseResult = await safeParseAsync3(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error62 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error62);
@@ -36072,7 +36133,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync3(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync3(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error62 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error62);
@@ -36479,14 +36540,28 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// src/runner.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+// src/process-manager.ts
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import path3 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+
+// src/rooted-filesystem.ts
+import { spawn } from "node:child_process";
+import { realpathSync, statSync } from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
 
 // src/security.ts
-import { constants } from "node:fs";
-import { access, lstat, realpath } from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 var DEFAULT_ENVIRONMENT_KEYS = [
   "LANG",
@@ -36519,34 +36594,7 @@ function configuredRoots(raw = process.env.MACHINE_TERMINAL_ROOTS) {
 }
 function isWithinRoot(candidate, root) {
   const relative = path.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
-async function resolveReadablePath(requestedPath, roots2, cwd = roots2[0] ?? os.homedir()) {
-  const resolvedRoots = await Promise.all(roots2.map((root) => realpath(root)));
-  const candidate = await realpath(path.resolve(cwd, requestedPath));
-  if (!resolvedRoots.some((root) => isWithinRoot(candidate, root))) {
-    throw new Error("Path is outside MACHINE_TERMINAL_ROOTS.");
-  }
-  await access(candidate, constants.R_OK);
-  return candidate;
-}
-async function resolveWritablePath(requestedPath, roots2, cwd = roots2[0] ?? os.homedir()) {
-  const absolute = path.resolve(cwd, requestedPath);
-  const resolvedParent = await realpath(path.dirname(absolute));
-  const resolvedRoots = await Promise.all(roots2.map((root) => realpath(root)));
-  const candidate = path.join(resolvedParent, path.basename(absolute));
-  if (!resolvedRoots.some((root) => isWithinRoot(candidate, root))) {
-    throw new Error("Path is outside MACHINE_TERMINAL_ROOTS.");
-  }
-  try {
-    const stats = await lstat(candidate);
-    if (stats.isSymbolicLink()) {
-      throw new Error("Writing through symbolic links is not allowed.");
-    }
-  } catch (error62) {
-    if (error62.code !== "ENOENT") throw error62;
-  }
-  return candidate;
+  return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
 }
 function safeEnvironment(source = process.env) {
   return Object.fromEntries(
@@ -36571,68 +36619,668 @@ function assertProgramAllowed(program) {
   }
 }
 
-// src/runner.ts
-var execFileAsync = promisify(execFile);
-async function runProgram(options) {
-  assertProgramAllowed(options.program);
-  try {
-    const { stdout, stderr } = await execFileAsync(
-      options.program,
-      options.args,
-      {
-        cwd: options.cwd,
-        env: safeEnvironment(),
-        encoding: "utf8",
-        maxBuffer: options.maxOutputChars,
-        timeout: options.timeoutMs,
-        windowsHide: true
+// src/rooted-filesystem.ts
+var filesystemHelperPath = fileURLToPath(
+  new URL(
+    `../dist/native/${process.platform}-${process.arch}/fs-helper${process.platform === "win32" ? ".exe" : ""}`,
+    import.meta.url
+  )
+);
+var RootedFilesystem = class {
+  roots;
+  #specs;
+  #aliases;
+  #child;
+  #pending = /* @__PURE__ */ new Map();
+  #nextID = 0;
+  #buffer = "";
+  #failure;
+  #initialized = false;
+  ready;
+  constructor(roots2) {
+    if (!roots2.length || roots2.length > 128)
+      throw new Error("ROOTED_FILESYSTEM_ROOT_LIMIT");
+    this.#aliases = roots2.map((root) => path2.resolve(root));
+    this.#specs = roots2.map((root) => {
+      const name = realpathSync(root);
+      const info = statSync(name, { bigint: true });
+      if (!info.isDirectory())
+        throw new Error("ROOTED_FILESYSTEM_EXPECTED_DIRECTORY");
+      return { path: name, dev: info.dev.toString(), ino: info.ino.toString() };
+    });
+    this.roots = this.#specs.map((root) => root.path);
+    this.#child = spawn(filesystemHelperPath, [], {
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+      env: safeEnvironment()
+    });
+    this.#child.stderr.resume();
+    this.#child.on(
+      "error",
+      () => this.#fail(new Error("ROOTED_FILESYSTEM_HELPER_UNAVAILABLE"))
+    );
+    this.#child.on(
+      "close",
+      () => this.#fail(new Error("ROOTED_FILESYSTEM_HELPER_CLOSED"))
+    );
+    this.#child.stdin.on(
+      "error",
+      () => this.#fail(new Error("ROOTED_FILESYSTEM_HELPER_CLOSED"))
+    );
+    this.#child.stdout.on(
+      "error",
+      () => this.#fail(new Error("ROOTED_FILESYSTEM_HELPER_CLOSED"))
+    );
+    this.#child.stderr.on(
+      "error",
+      () => this.#fail(new Error("ROOTED_FILESYSTEM_HELPER_CLOSED"))
+    );
+    this.#child.stdout.setEncoding("utf8");
+    this.#child.stdout.on("data", (data) => {
+      this.#buffer += data;
+      if (Buffer.byteLength(this.#buffer) > 4 * 1024 * 1024) {
+        this.#fail(new Error("ROOTED_FILESYSTEM_REPLY_LIMIT"));
+        return;
+      }
+      let newline;
+      while ((newline = this.#buffer.indexOf("\n")) !== -1) {
+        const line = this.#buffer.slice(0, newline);
+        this.#buffer = this.#buffer.slice(newline + 1);
+        try {
+          const reply = JSON.parse(line);
+          const waiting = this.#pending.get(reply.id);
+          if (!waiting) continue;
+          this.#pending.delete(reply.id);
+          clearTimeout(waiting.timer);
+          if (reply.error) waiting.reject(new Error(reply.error));
+          else waiting.resolve(reply);
+        } catch {
+          this.#fail(new Error("ROOTED_FILESYSTEM_INVALID_REPLY"));
+          return;
+        }
       }
+      this.#referenceWork();
+    });
+    this.ready = this.#request("init", { roots: this.#specs }).then(() => {
+      this.#initialized = true;
+    });
+    void this.ready.catch(() => void 0);
+  }
+  #referenceWork() {
+    const method = this.#pending.size ? "ref" : "unref";
+    this.#child[method]();
+    for (const stream of [
+      this.#child.stdin,
+      this.#child.stdout,
+      this.#child.stderr
+    ])
+      stream[method]();
+  }
+  #fail(error62) {
+    this.#failure ??= error62;
+    for (const waiting of this.#pending.values()) {
+      clearTimeout(waiting.timer);
+      waiting.reject(this.#failure);
+    }
+    this.#pending.clear();
+    this.#child.kill();
+    this.#referenceWork();
+  }
+  #request(operation, values) {
+    if (this.#failure) return Promise.reject(this.#failure);
+    if (this.#pending.size >= 16)
+      return Promise.reject(new Error("ROOTED_FILESYSTEM_PENDING_LIMIT"));
+    const id = ++this.#nextID;
+    const message = JSON.stringify({ id, operation, ...values }) + "\n";
+    if (Buffer.byteLength(message) >= 4 * 1024 * 1024)
+      return Promise.reject(new Error("ROOTED_FILESYSTEM_INPUT_LIMIT"));
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () => this.#fail(new Error("ROOTED_FILESYSTEM_TIMEOUT")),
+        1e4
+      );
+      this.#pending.set(id, { resolve, reject, timer });
+      this.#referenceWork();
+      this.#child.stdin.write(message);
+    });
+  }
+  resolve(requestedPath) {
+    const candidate = path2.resolve(this.#aliases[0], requestedPath);
+    const index = this.roots.findIndex(
+      (root, i) => isWithinRoot(candidate, root) || isWithinRoot(candidate, this.#aliases[i])
     );
-    return { exitCode: 0, signal: null, stdout, stderr, timedOut: false };
-  } catch (error62) {
-    const failure2 = error62;
+    if (index === -1)
+      throw new Error("Path is outside MACHINE_TERMINAL_ROOTS.");
+    const base = isWithinRoot(candidate, this.roots[index]) ? this.roots[index] : this.#aliases[index];
+    const relative = path2.relative(base, candidate) || ".";
+    if (relative.length > 4096) throw new Error("ROOTED_FILESYSTEM_PATH_LIMIT");
     return {
-      exitCode: typeof failure2.code === "number" ? failure2.code : null,
-      signal: failure2.signal ?? null,
-      stdout: failure2.stdout ?? "",
-      stderr: failure2.stderr ?? failure2.message,
-      timedOut: failure2.killed === true && failure2.signal === "SIGTERM"
+      root: index,
+      path: relative,
+      displayPath: path2.join(this.roots[index], relative)
     };
   }
-}
+  async read(target, maxCharacters) {
+    await this.ready;
+    const reply = await this.#request("read", { ...target, maxCharacters });
+    const decoded = new TextDecoder().decode(
+      Buffer.from(reply.bytes ?? "", "base64"),
+      { stream: reply.hasUnread }
+    );
+    return {
+      contents: decoded.slice(0, maxCharacters),
+      truncated: reply.hasUnread || decoded.length > maxCharacters
+    };
+  }
+  async write(target, contents, overwrite) {
+    await this.ready;
+    return (await this.#request("write", { ...target, contents, overwrite })).bytesWritten;
+  }
+  async list(target) {
+    await this.ready;
+    const reply = await this.#request("list", { ...target });
+    return { entries: reply.entries ?? [], truncated: reply.truncated };
+  }
+  async execution(requestedPath, program, args) {
+    await this.ready;
+    const target = this.resolve(requestedPath);
+    return {
+      roots: [this.#specs[target.root]],
+      path: target.path,
+      program,
+      args
+    };
+  }
+  async close() {
+    if (this.#child.exitCode !== null || this.#child.signalCode !== null)
+      return;
+    const exited = new Promise(
+      (resolve) => this.#child.once("close", () => resolve())
+    );
+    this.#fail(new Error("ROOTED_FILESYSTEM_CLOSED"));
+    await exited;
+  }
+  get available() {
+    return this.#initialized && !this.#failure;
+  }
+};
 
-// src/file-reader.ts
-import { open as open2 } from "node:fs/promises";
-async function readBoundedTextFile(filename, maxCharacters) {
-  const handle = await open2(filename, "r");
-  try {
-    const stats = await handle.stat();
-    const buffer = Buffer.allocUnsafe(maxCharacters * 4 + 4);
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-    const hasUnreadBytes = bytesRead < stats.size;
-    const decoded = new TextDecoder().decode(buffer.subarray(0, bytesRead), {
-      stream: hasUnreadBytes
+// src/process-manager.ts
+var MAX_EVENT_CHARACTERS = 4096;
+var MAX_RETAINED_EVENTS = 128;
+var MAX_RETAINED_EVENT_CHARACTERS = 64e3;
+var LOCAL_SESSION_RETENTION_MS = 60 * 6e4;
+var MAX_TASK_TOMBSTONES = 2e4;
+var TASK_RECEIPT_RETENTION_MS = 30 * 24 * 60 * 6e4;
+var TERMINATION_GRACE_MS = 1500;
+function appendBounded(current, value, limit) {
+  if (current.length >= limit) return current;
+  return `${current}${value.toString("utf8")}`.slice(0, limit);
+}
+function snapshot(session) {
+  return {
+    sessionId: session.sessionId,
+    ...session.taskId ? { taskId: session.taskId } : {},
+    program: session.program,
+    args: session.args,
+    cwd: session.cwd,
+    pid: session.child.pid ?? null,
+    running: session.running,
+    exitCode: session.exitCode,
+    signal: session.signal,
+    stdout: session.stdout,
+    stderr: session.stderr,
+    timedOut: session.timedOut
+  };
+}
+var ProcessManager = class {
+  constructor(limits = {
+    maxRunning: 32,
+    maxRetained: 512
+  }, receiptFile = process.env.MACHINE_TERMINAL_TASK_RECEIPTS_FILE) {
+    this.limits = limits;
+    this.receiptFile = receiptFile;
+    if (!Number.isInteger(limits.maxRunning) || limits.maxRunning < 1 || !Number.isInteger(limits.maxRetained) || limits.maxRetained < limits.maxRunning) {
+      throw new Error("INVALID_PROCESS_LIMITS: Invalid local process limits.");
+    }
+    this.#loadReceipts();
+  }
+  limits;
+  receiptFile;
+  #sessions = /* @__PURE__ */ new Map();
+  #taskSessions = /* @__PURE__ */ new Map();
+  #taskReceipts = /* @__PURE__ */ new Map();
+  #loadReceipts() {
+    if (!this.receiptFile) return;
+    let raw;
+    try {
+      raw = readFileSync(this.receiptFile, "utf8");
+    } catch (error62) {
+      if (error62.code === "ENOENT") return;
+      throw error62;
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || !Array.isArray(parsed.receipts)) {
+      throw new Error(
+        "INVALID_TASK_RECEIPTS: Refusing to drop existing replay receipts."
+      );
+    }
+    for (const receipt of parsed.receipts) {
+      if (typeof receipt.taskId !== "string" || !Number.isSafeInteger(receipt.createdAt)) {
+        throw new Error("INVALID_TASK_RECEIPTS: Corrupt task-receipt record.");
+      }
+      this.#taskReceipts.set(receipt.taskId, receipt.createdAt);
+    }
+    this.#pruneReceipts();
+  }
+  #persistReceipts() {
+    if (!this.receiptFile) return;
+    mkdirSync(path3.dirname(this.receiptFile), { recursive: true, mode: 448 });
+    const temporary = this.receiptFile + "." + process.pid + "." + randomUUID() + ".tmp";
+    try {
+      writeFileSync(
+        temporary,
+        JSON.stringify({
+          version: 1,
+          receipts: [...this.#taskReceipts].map(([taskId, createdAt]) => ({
+            taskId,
+            createdAt
+          }))
+        }),
+        { mode: 384, flag: "wx", flush: true }
+      );
+      renameSync(temporary, this.receiptFile);
+      if (process.platform !== "win32") {
+        const directory = openSync(path3.dirname(this.receiptFile), "r");
+        try {
+          fsyncSync(directory);
+        } finally {
+          closeSync(directory);
+        }
+      }
+    } finally {
+      rmSync(temporary, { force: true });
+    }
+  }
+  #pruneReceipts() {
+    const cutoff = Date.now() - TASK_RECEIPT_RETENTION_MS;
+    let dirty = false;
+    for (const [taskId, createdAt] of this.#taskReceipts) {
+      if (createdAt < cutoff && !this.#taskSessions.has(taskId)) {
+        this.#taskReceipts.delete(taskId);
+        dirty = true;
+      }
+    }
+    if (dirty) this.#persistReceipts();
+  }
+  #recordTaskReceipt(taskId) {
+    this.#taskReceipts.set(taskId, Date.now());
+    try {
+      this.#persistReceipts();
+    } catch (error62) {
+      this.#taskReceipts.delete(taskId);
+      throw error62;
+    }
+  }
+  #signalProcessTree(session, signal) {
+    const pid = session.child.pid;
+    if (!pid || pid < 1) return;
+    if (process.platform === "win32") {
+      const killer = spawn2("taskkill.exe", ["/PID", String(pid), "/T", "/F"], {
+        windowsHide: true,
+        stdio: "ignore"
+      });
+      killer.on("error", () => session.child.kill("SIGKILL"));
+      killer.on("close", (code) => {
+        if (code !== 0 && session.running) session.child.kill("SIGKILL");
+      });
+      return;
+    }
+    try {
+      process.kill(-pid, signal);
+      return;
+    } catch (error62) {
+      if (error62.code === "ESRCH") return;
+    }
+    session.child.kill(signal);
+  }
+  #unixProcessGroupExists(session) {
+    if (process.platform === "win32") return false;
+    const pid = session.child.pid;
+    if (!pid || pid < 1) return false;
+    try {
+      process.kill(-pid, 0);
+      return true;
+    } catch (error62) {
+      return error62.code !== "ESRCH";
+    }
+  }
+  #finishSession(session, exitCode, signal) {
+    if (session.finishedRecorded) return;
+    session.finishedRecorded = true;
+    session.running = false;
+    session.finishedAt = Date.now();
+    session.exitCode = exitCode;
+    session.signal = signal;
+    if (session.timeout) clearTimeout(session.timeout);
+    if (session.forceKillTimer) {
+      clearTimeout(session.forceKillTimer);
+      session.forceKillTimer = void 0;
+    }
+    this.#record(session, "finished", {
+      exitCode,
+      signal,
+      timedOut: session.timedOut
+    });
+  }
+  #requestTermination(session) {
+    if (!session.running) return;
+    session.terminationRequested = true;
+    this.#signalProcessTree(session, "SIGTERM");
+    if (!session.forceKillTimer) {
+      session.forceKillTimer = setTimeout(() => {
+        session.forceKillTimer = void 0;
+        if (process.platform !== "win32" || session.running) {
+          this.#signalProcessTree(session, "SIGKILL");
+        }
+        const pending = session.pendingTerminationClose;
+        if (pending) {
+          session.pendingTerminationClose = void 0;
+          this.#finishSession(session, pending.exitCode, pending.signal);
+        }
+      }, TERMINATION_GRACE_MS);
+    }
+  }
+  #pruneFinished() {
+    const cutoff = Date.now() - LOCAL_SESSION_RETENTION_MS;
+    for (const [sessionId, session] of this.#sessions) {
+      if (session.finishedAt !== void 0 && session.finishedAt < cutoff && session.watchers.size === 0) {
+        this.#sessions.delete(sessionId);
+        if (session.taskId) this.#taskSessions.delete(session.taskId);
+      }
+    }
+  }
+  #record(session, kind, details = {}) {
+    const event = {
+      sessionId: session.sessionId,
+      ...session.taskId ? { taskId: session.taskId } : {},
+      sequence: ++session.nextSequence,
+      kind,
+      ...details
+    };
+    session.events.push(event);
+    session.retainedEventCharacters += event.data?.length ?? 0;
+    while (session.events.length > MAX_RETAINED_EVENTS || session.retainedEventCharacters > MAX_RETAINED_EVENT_CHARACTERS) {
+      const removed = session.events.shift();
+      session.retainedEventCharacters -= removed.data?.length ?? 0;
+    }
+    for (const wake of session.watchers) wake();
+  }
+  #output(session, stream, chunk) {
+    const before = session[stream].length;
+    const next = appendBounded(
+      session[stream],
+      chunk,
+      session.maxOutputCharacters
+    );
+    session[stream] = next;
+    const appended = next.slice(before);
+    for (let i = 0; i < appended.length; i += MAX_EVENT_CHARACTERS) {
+      this.#record(session, stream, {
+        offset: before + i,
+        data: appended.slice(i, i + MAX_EVENT_CHARACTERS)
+      });
+    }
+  }
+  async watch(sessionId, afterSequence, timeoutMs = 15e3, maxEvents = 32) {
+    this.#pruneFinished();
+    const session = this.#sessions.get(sessionId);
+    if (!session)
+      throw new Error("The requested process session was not found.");
+    if (!Number.isSafeInteger(afterSequence) || afterSequence < 0) {
+      throw new Error("afterSequence must be a non-negative integer.");
+    }
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 2e4) {
+      throw new Error("timeoutMs must be between 100 and 20000.");
+    }
+    if (!Number.isInteger(maxEvents) || maxEvents < 1 || maxEvents > 32) {
+      throw new Error("maxEvents must be between 1 and 32.");
+    }
+    const collect = () => {
+      const first = session.events[0]?.sequence ?? session.nextSequence + 1;
+      const missedEvents = afterSequence + 1 < first;
+      const events = session.events.filter((event) => event.sequence > afterSequence).slice(0, maxEvents);
+      return {
+        sessionId,
+        events,
+        nextSequence: events.at(-1)?.sequence ?? Math.max(afterSequence, session.nextSequence),
+        missedEvents,
+        finished: !session.running
+      };
+    };
+    const initial = collect();
+    if (initial.events.length || initial.finished || initial.missedEvents) {
+      return initial;
+    }
+    return new Promise((resolve) => {
+      let timer;
+      const finish = () => {
+        clearTimeout(timer);
+        session.watchers.delete(finish);
+        resolve(collect());
+      };
+      session.watchers.add(finish);
+      timer = setTimeout(finish, timeoutMs);
+      if (session.nextSequence > afterSequence || !session.running) finish();
+    });
+  }
+  start(options) {
+    this.#pruneReceipts();
+    if (options.taskId) {
+      const existingSession = this.#taskSessions.get(options.taskId);
+      if (existingSession) {
+        const existing = this.#sessions.get(existingSession);
+        if (!existing) throw new Error("PROCESS_TASK_SESSION_LOST");
+        if (existing.program !== options.program || existing.cwd !== options.cwd || existing.args.join("\0") !== options.args.join("\0")) {
+          throw new Error(
+            "PROCESS_TASK_CONFLICT: Task ID already started with different arguments."
+          );
+        }
+        const result2 = snapshot(existing);
+        return {
+          ...result2,
+          nextStdoutOffset: result2.stdout.length,
+          nextStderrOffset: result2.stderr.length
+        };
+      }
+      if (this.#taskReceipts.has(options.taskId)) {
+        throw new Error(
+          "PROCESS_TASK_SESSION_LOST: Task already ran; will not execute again."
+        );
+      }
+    }
+    this.#pruneFinished();
+    if (this.#sessions.size >= this.limits.maxRetained) {
+      throw new Error("PROCESS_LIMIT_REACHED: Local process history is full.");
+    }
+    const running = [...this.#sessions.values()].filter(
+      (session2) => session2.running
+    ).length;
+    if (running >= this.limits.maxRunning) {
+      throw new Error(
+        "PROCESS_LIMIT_REACHED: Too many concurrent local processes."
+      );
+    }
+    if (options.taskId && this.#taskReceipts.size >= MAX_TASK_TOMBSTONES) {
+      throw new Error(
+        "PROCESS_LIMIT_REACHED: Local task receipt capacity reached."
+      );
+    }
+    assertProgramAllowed(options.program);
+    if (options.rootedExecution && (options.rootedExecution.program !== options.program || options.rootedExecution.args.join("\0") !== options.args.join("\0")))
+      throw new Error("ROOTED_EXECUTION_MISMATCH");
+    const rootedPayload = options.rootedExecution ? JSON.stringify(options.rootedExecution) : void 0;
+    if (rootedPayload && Buffer.byteLength(rootedPayload) >= 4 * 1024 * 1024)
+      throw new Error("ROOTED_EXECUTION_INPUT_LIMIT");
+    if (options.taskId) this.#recordTaskReceipt(options.taskId);
+    const child = spawn2(
+      options.rootedExecution ? filesystemHelperPath : options.program,
+      options.rootedExecution ? ["--exec"] : options.args,
+      {
+        cwd: options.rootedExecution ? void 0 : options.cwd,
+        env: safeEnvironment(),
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+        // A separate Unix process group lets us terminate descendants too.
+        detached: process.platform !== "win32"
+      }
+    );
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(rootedPayload);
+    const session = {
+      sessionId: randomUUID(),
+      ...options.taskId ? { taskId: options.taskId } : {},
+      program: options.program,
+      args: [...options.args],
+      cwd: options.cwd,
+      child,
+      maxOutputCharacters: options.maxOutputCharacters,
+      stdout: "",
+      stderr: "",
+      running: true,
+      exitCode: null,
+      signal: null,
+      timedOut: false,
+      nextSequence: 0,
+      events: [],
+      retainedEventCharacters: 0,
+      watchers: /* @__PURE__ */ new Set()
+    };
+    this.#sessions.set(session.sessionId, session);
+    if (session.taskId)
+      this.#taskSessions.set(session.taskId, session.sessionId);
+    this.#record(session, "started");
+    child.stdout.on("data", (chunk) => {
+      this.#output(session, "stdout", chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      this.#output(session, "stderr", chunk);
     });
+    child.once("error", (error62) => {
+      session.stderr = appendBounded(
+        session.stderr,
+        error62.message,
+        session.maxOutputCharacters
+      );
+      session.running = false;
+      session.exitCode = null;
+      session.signal = null;
+      if (session.timeout) clearTimeout(session.timeout);
+    });
+    child.once("close", (exitCode, signal) => {
+      if (session.terminationRequested && session.forceKillTimer && this.#unixProcessGroupExists(session)) {
+        session.pendingTerminationClose = { exitCode, signal };
+        if (session.timeout) clearTimeout(session.timeout);
+        return;
+      }
+      this.#finishSession(session, exitCode, signal);
+    });
+    session.timeout = setTimeout(() => {
+      if (!session.running) return;
+      session.timedOut = true;
+      this.#requestTermination(session);
+    }, options.timeoutMs);
+    const result = snapshot(session);
     return {
-      contents: decoded.slice(0, maxCharacters),
-      truncated: hasUnreadBytes || decoded.length > maxCharacters
+      ...result,
+      nextStdoutOffset: result.stdout.length,
+      nextStderrOffset: result.stderr.length
     };
-  } finally {
-    await handle.close();
   }
-}
+  read(sessionId, stdoutOffset, stderrOffset, maxOutputCharacters) {
+    this.#pruneFinished();
+    const session = this.#sessions.get(sessionId);
+    if (!session)
+      throw new Error("The requested process session was not found.");
+    const safeStdoutOffset = Math.max(
+      0,
+      Math.min(stdoutOffset, session.stdout.length)
+    );
+    const safeStderrOffset = Math.max(
+      0,
+      Math.min(stderrOffset, session.stderr.length)
+    );
+    const stdout = session.stdout.slice(
+      safeStdoutOffset,
+      safeStdoutOffset + maxOutputCharacters
+    );
+    const stderr = session.stderr.slice(
+      safeStderrOffset,
+      safeStderrOffset + maxOutputCharacters
+    );
+    return {
+      ...snapshot(session),
+      stdout,
+      stderr,
+      nextStdoutOffset: safeStdoutOffset + stdout.length,
+      nextStderrOffset: safeStderrOffset + stderr.length
+    };
+  }
+  terminate(sessionId) {
+    this.#pruneFinished();
+    const session = this.#sessions.get(sessionId);
+    if (!session)
+      throw new Error("The requested process session was not found.");
+    this.#requestTermination(session);
+    return snapshot(session);
+  }
+  list() {
+    this.#pruneFinished();
+    return [...this.#sessions.values()].map(snapshot);
+  }
+  close() {
+    for (const session of this.#sessions.values()) {
+      if (session.timeout) clearTimeout(session.timeout);
+      this.#requestTermination(session);
+    }
+    for (const session of this.#sessions.values()) {
+      for (const wake of session.watchers) wake();
+    }
+    this.#sessions.clear();
+    this.#taskSessions.clear();
+  }
+};
 
 // src/server.ts
 var roots = configuredRoots();
+var processManager = new ProcessManager();
+var sharedFilesystem;
+function defaultFilesystem() {
+  return sharedFilesystem ??= new RootedFilesystem(roots);
+}
+async function initializeFilesystemBoundary() {
+  await defaultFilesystem().ready;
+}
+async function closeFilesystemBoundary() {
+  await sharedFilesystem?.close();
+}
 function textResult(value) {
   return {
     content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
     structuredContent: value
   };
 }
-function createServer() {
+function createServer(options = {}) {
+  const filesystem = options.filesystem ?? defaultFilesystem();
+  const requireAuthorizedAgent = () => {
+    if (!options.allowDestructive) {
+      throw new Error(
+        "LOCAL_APPROVAL_REQUIRED: Connect through the approved Terminal Commands agent."
+      );
+    }
+  };
   const server2 = new McpServer(
-    { name: "terminal-commands", version: "0.1.0" },
+    { name: "terminal-commands", version: "0.2.0" },
     {
       instructions: "This server controls the user's machine. Prefer dedicated file tools over commands. Every command and write can modify or expose local data and must receive user approval. Never request secrets or bypass configured roots and safety controls."
     }
@@ -36685,15 +37333,12 @@ function createServer() {
       }
     },
     async ({ path: requestedPath }) => {
-      const directory = await resolveReadablePath(requestedPath, roots);
-      const entries = await readdir(directory, { withFileTypes: true });
+      const directory = filesystem.resolve(requestedPath);
+      const { entries, truncated } = await filesystem.list(directory);
       return textResult({
-        path: directory,
-        entries: entries.slice(0, 1e3).map((entry) => ({
-          name: entry.name,
-          type: entry.isDirectory() ? "directory" : entry.isFile() ? "file" : "other"
-        })),
-        truncated: entries.length > 1e3
+        path: directory.displayPath,
+        entries,
+        truncated
       });
     }
   );
@@ -36718,13 +37363,13 @@ function createServer() {
       }
     },
     async ({ path: requestedPath, maxCharacters }) => {
-      const filename = await resolveReadablePath(requestedPath, roots);
-      const { contents, truncated } = await readBoundedTextFile(
+      const filename = filesystem.resolve(requestedPath);
+      const { contents, truncated } = await filesystem.read(
         filename,
         maxCharacters
       );
       return textResult({
-        path: filename,
+        path: filename.displayPath,
         contents,
         truncated
       });
@@ -36751,23 +37396,26 @@ function createServer() {
       }
     },
     async ({ path: requestedPath, contents, overwrite }) => {
-      const filename = await resolveWritablePath(requestedPath, roots);
-      await writeFile(filename, contents, {
-        encoding: "utf8",
-        flag: overwrite ? "w" : "wx"
-      });
+      requireAuthorizedAgent();
+      const filename = filesystem.resolve(requestedPath);
+      const bytesWritten = await filesystem.write(
+        filename,
+        contents,
+        overwrite
+      );
       return textResult({
-        path: filename,
-        bytesWritten: Buffer.byteLength(contents)
+        path: filename.displayPath,
+        bytesWritten
       });
     }
   );
   server2.registerTool(
-    "run_program",
+    "start_process",
     {
-      title: "Run a local program",
-      description: "Run one executable without a shell. Shells and privilege-elevation programs are blocked unless explicitly enabled by local configuration.",
+      title: "Start a process",
+      description: "Start one approved executable without a shell on this machine and return a session ID for reading its output.",
       inputSchema: {
+        taskId: external_exports.string().uuid().optional(),
         program: external_exports.string().min(1),
         args: external_exports.array(external_exports.string()).max(100).default([]),
         cwd: external_exports.string().min(1).optional(),
@@ -36775,14 +37423,20 @@ function createServer() {
         maxOutputCharacters: external_exports.number().int().min(1e3).max(2e5).default(5e4)
       },
       outputSchema: {
+        sessionId: external_exports.string(),
+        taskId: external_exports.string().uuid().optional(),
         program: external_exports.string(),
         args: external_exports.array(external_exports.string()),
         cwd: external_exports.string(),
+        pid: external_exports.number().int().nullable(),
+        running: external_exports.boolean(),
         exitCode: external_exports.number().int().nullable(),
         signal: external_exports.string().nullable(),
         stdout: external_exports.string(),
         stderr: external_exports.string(),
-        timedOut: external_exports.boolean()
+        timedOut: external_exports.boolean(),
+        nextStdoutOffset: external_exports.number().int().nonnegative(),
+        nextStderrOffset: external_exports.number().int().nonnegative()
       },
       annotations: {
         readOnlyHint: false,
@@ -36790,30 +37444,191 @@ function createServer() {
         openWorldHint: true
       }
     },
-    async ({ program, args, cwd, timeoutMs, maxOutputCharacters }) => {
-      const workingDirectory = await resolveReadablePath(
+    async ({ taskId, program, args, cwd, timeoutMs, maxOutputCharacters }) => {
+      requireAuthorizedAgent();
+      const workingDirectory = filesystem.resolve(cwd ?? roots[0]);
+      const rootedExecution = await filesystem.execution(
         cwd ?? roots[0],
-        roots
-      );
-      const result = await runProgram({
         program,
-        args,
-        cwd: workingDirectory,
+        args
+      );
+      return textResult(
+        processManager.start({
+          taskId,
+          program,
+          args,
+          cwd: workingDirectory.displayPath,
+          rootedExecution,
+          timeoutMs,
+          maxOutputCharacters
+        })
+      );
+    }
+  );
+  server2.registerTool(
+    "read_process_output",
+    {
+      title: "Read process output",
+      description: "Read new stdout and stderr from a previously started process session.",
+      inputSchema: {
+        sessionId: external_exports.string().uuid(),
+        stdoutOffset: external_exports.number().int().min(0).default(0),
+        stderrOffset: external_exports.number().int().min(0).default(0),
+        maxOutputCharacters: external_exports.number().int().min(1e3).max(2e5).default(5e4)
+      },
+      outputSchema: {
+        sessionId: external_exports.string(),
+        taskId: external_exports.string().uuid().optional(),
+        program: external_exports.string(),
+        args: external_exports.array(external_exports.string()),
+        cwd: external_exports.string(),
+        pid: external_exports.number().int().nullable(),
+        running: external_exports.boolean(),
+        exitCode: external_exports.number().int().nullable(),
+        signal: external_exports.string().nullable(),
+        stdout: external_exports.string(),
+        stderr: external_exports.string(),
+        timedOut: external_exports.boolean(),
+        nextStdoutOffset: external_exports.number().int().nonnegative(),
+        nextStderrOffset: external_exports.number().int().nonnegative()
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        openWorldHint: false
+      }
+    },
+    async ({ sessionId, stdoutOffset, stderrOffset, maxOutputCharacters }) => textResult(
+      processManager.read(
+        sessionId,
+        stdoutOffset,
+        stderrOffset,
+        maxOutputCharacters
+      )
+    )
+  );
+  server2.registerTool(
+    "watch_process_events",
+    {
+      title: "Watch local process events",
+      description: "Wait for sequenced, bounded process events after a cursor. Used internally by the companion to push progress over WebSocket.",
+      inputSchema: {
+        sessionId: external_exports.string().uuid(),
+        afterSequence: external_exports.number().int().nonnegative().default(0),
+        timeoutMs: external_exports.number().int().min(100).max(2e4).default(1e4),
+        maxEvents: external_exports.number().int().min(1).max(32).default(32)
+      },
+      outputSchema: {
+        sessionId: external_exports.string().uuid(),
+        events: external_exports.array(
+          external_exports.object({
+            sessionId: external_exports.string().uuid(),
+            taskId: external_exports.string().uuid().optional(),
+            sequence: external_exports.number().int().positive(),
+            kind: external_exports.enum(["started", "stdout", "stderr", "finished"]),
+            offset: external_exports.number().int().nonnegative().optional(),
+            data: external_exports.string().max(4096).optional(),
+            exitCode: external_exports.number().int().nullable().optional(),
+            signal: external_exports.string().nullable().optional(),
+            timedOut: external_exports.boolean().optional()
+          })
+        ).max(32),
+        nextSequence: external_exports.number().int().nonnegative(),
+        missedEvents: external_exports.boolean(),
+        finished: external_exports.boolean()
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        openWorldHint: false
+      }
+    },
+    async ({ sessionId, afterSequence, timeoutMs, maxEvents }) => textResult(
+      await processManager.watch(
+        sessionId,
+        afterSequence,
         timeoutMs,
-        maxOutputChars: maxOutputCharacters
-      });
-      return textResult({ program, args, cwd: workingDirectory, ...result });
+        maxEvents
+      )
+    )
+  );
+  server2.registerTool(
+    "terminate_process",
+    {
+      title: "Terminate a process",
+      description: "Stop a previously started process session on this machine.",
+      inputSchema: { sessionId: external_exports.string().uuid() },
+      outputSchema: {
+        sessionId: external_exports.string(),
+        taskId: external_exports.string().uuid().optional(),
+        program: external_exports.string(),
+        args: external_exports.array(external_exports.string()),
+        cwd: external_exports.string(),
+        pid: external_exports.number().int().nullable(),
+        running: external_exports.boolean(),
+        exitCode: external_exports.number().int().nullable(),
+        signal: external_exports.string().nullable(),
+        stdout: external_exports.string(),
+        stderr: external_exports.string(),
+        timedOut: external_exports.boolean()
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false
+      }
+    },
+    async ({ sessionId }) => {
+      requireAuthorizedAgent();
+      return textResult(processManager.terminate(sessionId));
     }
   );
+  server2.registerTool(
+    "list_processes",
+    {
+      title: "List process sessions",
+      description: "List process sessions started through Terminal Commands.",
+      inputSchema: {},
+      outputSchema: {
+        processes: external_exports.array(
+          external_exports.object({
+            sessionId: external_exports.string(),
+            taskId: external_exports.string().uuid().optional(),
+            program: external_exports.string(),
+            args: external_exports.array(external_exports.string()),
+            cwd: external_exports.string(),
+            pid: external_exports.number().int().nullable(),
+            running: external_exports.boolean(),
+            exitCode: external_exports.number().int().nullable(),
+            signal: external_exports.string().nullable(),
+            stdout: external_exports.string(),
+            stderr: external_exports.string(),
+            timedOut: external_exports.boolean()
+          })
+        )
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        openWorldHint: false
+      }
+    },
+    async () => textResult({ processes: processManager.list() })
+  );
   return server2;
 }
 
 // src/stdio.ts
-var server = createServer();
+var server = createServer({
+  allowDestructive: process.env.MACHINE_TERMINAL_TRUST_STDIO === "1"
+});
 var transport = new StdioServerTransport();
+await initializeFilesystemBoundary();
 await server.connect(transport);
 async function shutdown() {
+  processManager.close();
   await server.close();
+  await closeFilesystemBoundary();
   process.exit(0);
 }
 process.on("SIGINT", () => void shutdown());