@coder/ai-sdk-sandbox 0.2.0 → 0.4.0

package/dist/index.js

@@ -496,9 +496,2095 @@ function waitForLocalPort(port, child, timeoutMs, abortSignal) {
   });
 }
 
+// src/native-api.ts
+import { readFile } from "fs/promises";
+import { setTimeout as delay } from "timers/promises";
+import { parse as parseYaml } from "yaml";
+var DEFAULT_BUILD_POLL_INTERVAL_MS = 1e3;
+var DEFAULT_BUILD_TIMEOUT_MS = 30 * 6e4;
+var MAX_API_REDIRECTS = 10;
+var CoderNativeApiError = class extends Error {
+  status;
+  method;
+  path;
+  detail;
+  constructor(options) {
+    super(
+      `Coder API ${options.method} ${options.path} failed (${options.status}): ${options.message}` + (options.detail ? `: ${options.detail}` : "")
+    );
+    this.name = "CoderNativeApiError";
+    this.status = options.status;
+    this.method = options.method;
+    this.path = options.path;
+    this.detail = options.detail;
+  }
+};
+function parseNativeWorkspaceRef(ref) {
+  const parts = ref.split("/");
+  if (parts.length > 2 || parts.some((part) => part === "")) {
+    throw new Error(`invalid workspace reference "${ref}"; expected [owner/]name[.agent]`);
+  }
+  const [first = "", second] = parts;
+  const owner = parts.length === 2 ? first : "me";
+  const nameAndAgent = second ?? first;
+  const dot = nameAndAgent.indexOf(".");
+  const name = dot === -1 ? nameAndAgent : nameAndAgent.slice(0, dot);
+  const agent = dot === -1 ? void 0 : nameAndAgent.slice(dot + 1);
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(name) || agent === "") {
+    throw new Error(`invalid workspace reference "${ref}"; expected [owner/]name[.agent]`);
+  }
+  if (agent !== void 0 && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(agent)) {
+    throw new Error(`invalid workspace reference "${ref}"; expected [owner/]name[.agent]`);
+  }
+  return { owner, name, ...agent === void 0 ? {} : { agent } };
+}
+var CoderApiClient = class {
+  baseUrl;
+  token;
+  headers;
+  #fetch;
+  #buildPollIntervalMs;
+  #buildTimeoutMs;
+  #lifecycleTails = /* @__PURE__ */ new Map();
+  constructor(options) {
+    const parsed = new URL(options.url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error(`Coder URL must use http or https, got ${parsed.protocol}`);
+    }
+    if (options.token === "") throw new Error("Coder session token must not be empty");
+    this.baseUrl = options.url.replace(/\/$/, "");
+    this.token = options.token;
+    this.headers = { ...options.headers };
+    this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.#buildPollIntervalMs = options.buildPollIntervalMs ?? DEFAULT_BUILD_POLL_INTERVAL_MS;
+    this.#buildTimeoutMs = options.buildTimeoutMs ?? DEFAULT_BUILD_TIMEOUT_MS;
+  }
+  websocketUrl(path2) {
+    const url = this.#url(path2);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    return url.toString();
+  }
+  websocketHeaders() {
+    return { ...this.headers, "Coder-Session-Token": this.token };
+  }
+  async workspace(ref, signal) {
+    const { owner, name } = parseNativeWorkspaceRef(ref);
+    try {
+      return await this.request(
+        "GET",
+        `/api/v2/users/${encodeURIComponent(owner)}/workspace/${encodeURIComponent(name)}`,
+        void 0,
+        signal
+      );
+    } catch (error) {
+      if (error instanceof CoderNativeApiError && error.status === 404) return null;
+      throw error;
+    }
+  }
+  async currentUserId(signal) {
+    const user = await this.request("GET", "/api/v2/users/me", void 0, signal);
+    return user.id;
+  }
+  async requireWorkspace(ref, signal) {
+    const workspace = await this.workspace(ref, signal);
+    if (workspace === null) throw new Error(`Coder workspace "${ref}" does not exist`);
+    return workspace;
+  }
+  async resolveAgent(ref, signal) {
+    const parsed = parseNativeWorkspaceRef(ref);
+    const workspace = await this.requireWorkspace(ref, signal);
+    const agents = workspace.latest_build.resources?.flatMap((resource) => resource.agents ?? []) ?? [];
+    const agent = parsed.agent === void 0 ? agents.length === 1 ? agents[0] : void 0 : agents.find((candidate) => candidate.name === parsed.agent);
+    if (agent !== void 0) return { workspace, agent };
+    if (agents.length === 0) {
+      throw new Error(`Coder workspace "${ref}" has no agents in its latest build`);
+    }
+    if (parsed.agent !== void 0) {
+      throw new Error(
+        `Coder workspace "${parsed.owner}/${parsed.name}" has no agent "${parsed.agent}"; available agents: ${agents.map((candidate) => candidate.name).join(", ")}`
+      );
+    }
+    throw new Error(
+      `Coder workspace "${ref}" has multiple agents (${agents.map((candidate) => candidate.name).join(", ")}); select one with workspace.agent`
+    );
+  }
+  async status(ref, options) {
+    const workspace = await this.workspace(ref, options?.abortSignal);
+    return workspace === null ? null : toWorkspaceStatus(workspace);
+  }
+  async start(ref, options) {
+    const signal = options?.abortSignal;
+    const initial = await this.requireWorkspace(ref, signal);
+    await this.#withLifecycleLock(initial.id, signal, async () => {
+      let workspace = await this.requireWorkspace(ref, signal);
+      for (; ; ) {
+        if (workspace.latest_build.status === "running") return;
+        if (isWorkspaceBuildInFlight(workspace.latest_build)) {
+          const transition = workspace.latest_build.transition;
+          const completed = await this.#waitForBuild(workspace.latest_build.id, signal, true);
+          if (transition === "start" && completed.job?.status === "succeeded") return;
+          workspace = await this.requireWorkspace(ref, signal);
+          continue;
+        }
+        if (workspace.latest_build.status === "failed" && workspace.latest_build.transition === "start") {
+          const cleanup = await this.#createBuild(workspace.id, { transition: "stop" }, signal);
+          await this.#waitForBuild(cleanup.id, signal);
+          workspace = await this.requireWorkspace(ref, signal);
+          continue;
+        }
+        if (workspace.dormant_at) {
+          await this.request(
+            "PUT",
+            `/api/v2/workspaces/${workspace.id}/dormant`,
+            { dormant: false },
+            signal
+          );
+        }
+        const templateVersionId = workspace.automatic_updates === "always" || workspace.template_require_active_version ? workspace.template_active_version_id : workspace.latest_build.template_version_id;
+        const build = await this.#createBuild(
+          workspace.id,
+          {
+            transition: "start",
+            ...templateVersionId ? { template_version_id: templateVersionId } : {}
+          },
+          signal
+        );
+        await this.#waitForBuild(build.id, signal);
+        return;
+      }
+    });
+  }
+  async stop(ref, options) {
+    const signal = options?.abortSignal;
+    const initial = await this.requireWorkspace(ref, signal);
+    await this.#withLifecycleLock(initial.id, signal, async () => {
+      let workspace = await this.requireWorkspace(ref, signal);
+      for (; ; ) {
+        if (workspace.latest_build.status === "stopped") return;
+        if (isWorkspaceBuildInFlight(workspace.latest_build)) {
+          const transition = workspace.latest_build.transition;
+          const completed = await this.#waitForBuild(workspace.latest_build.id, signal, true);
+          if (transition === "stop" && completed.job?.status === "succeeded") return;
+          workspace = await this.requireWorkspace(ref, signal);
+          continue;
+        }
+        const build = await this.#createBuild(workspace.id, { transition: "stop" }, signal);
+        await this.#waitForBuild(build.id, signal);
+        return;
+      }
+    });
+  }
+  async destroy(ref, options) {
+    const signal = options?.abortSignal;
+    const initial = await this.workspace(ref, signal);
+    if (initial === null) return;
+    await this.#withLifecycleLock(initial.id, signal, async () => {
+      let workspace = await this.workspace(ref, signal);
+      for (; ; ) {
+        if (workspace === null || workspace.latest_build.status === "deleted") return;
+        if (isWorkspaceBuildInFlight(workspace.latest_build)) {
+          const transition = workspace.latest_build.transition;
+          const completed = await this.#waitForBuild(workspace.latest_build.id, signal, true);
+          if (transition === "delete" && completed.job?.status === "succeeded") return;
+          workspace = await this.workspace(ref, signal);
+          continue;
+        }
+        const build = await this.#createBuild(workspace.id, { transition: "delete" }, signal);
+        await this.#waitForBuild(build.id, signal);
+        return;
+      }
+    });
+  }
+  async create(options) {
+    const ref = parseNativeWorkspaceRef(options.workspace);
+    if (ref.agent !== void 0) {
+      throw new Error("a workspace agent cannot be selected while creating a workspace");
+    }
+    const template = await this.#resolveTemplate(
+      options.template,
+      options.org,
+      options.abortSignal
+    );
+    const versionId = options.templateVersion ? (await this.request(
+      "GET",
+      `/api/v2/templates/${template.id}/versions/${encodeURIComponent(options.templateVersion)}`,
+      void 0,
+      options.abortSignal
+    )).id : template.active_version_id;
+    const noPreset = options.preset?.toLowerCase() === "none";
+    const presets = noPreset ? [] : await this.#presets(versionId, options.abortSignal);
+    const preset = options.preset === void 0 ? presets.find(presetDefault) : presets.find((candidate) => presetName(candidate) === options.preset);
+    if (options.preset !== void 0 && !noPreset && preset === void 0) {
+      throw new Error(
+        `preset "${options.preset}" not found for template "${options.template}"; available presets: ${presets.map(presetName).join(", ") || "none"}`
+      );
+    }
+    const fileParameters = options.parameterFile ? await readParameterFile(options.parameterFile) : {};
+    const parameterValues = {
+      ...fileParameters,
+      ...options.parameters,
+      ...options.ephemeralParameters,
+      ...preset ? presetParameterValues(preset) : {}
+    };
+    const templateParameters = await this.#templateParameters(
+      template,
+      versionId,
+      ref.owner,
+      parameterValues,
+      options.abortSignal
+    );
+    const resolvedParameterValues = resolveCreateParameterValues(
+      templateParameters,
+      parameterValues,
+      options.useParameterDefaults === true
+    );
+    const body = {
+      template_version_id: versionId,
+      name: ref.name,
+      ...options.stopAfter ? { ttl_ms: parseDurationMillis(options.stopAfter) } : {},
+      ...Object.keys(resolvedParameterValues).length > 0 ? {
+        rich_parameter_values: Object.entries(resolvedParameterValues).map(([name, value]) => ({
+          name,
+          value
+        }))
+      } : {},
+      ...options.automaticUpdates ? { automatic_updates: options.automaticUpdates } : {},
+      ...preset ? { template_version_preset_id: presetId(preset) } : {}
+    };
+    const workspace = await this.request(
+      "POST",
+      `/api/v2/users/${encodeURIComponent(ref.owner)}/workspaces`,
+      body,
+      options.abortSignal
+    );
+    await this.#waitForBuild(workspace.latest_build.id, options.abortSignal);
+  }
+  async listPresets(options) {
+    const template = await this.#resolveTemplate(
+      options.template,
+      options.org,
+      options.abortSignal
+    );
+    const versionId = options.templateVersion ? (await this.request(
+      "GET",
+      `/api/v2/templates/${template.id}/versions/${encodeURIComponent(options.templateVersion)}`,
+      void 0,
+      options.abortSignal
+    )).id : template.active_version_id;
+    const presets = await this.#presets(versionId, options.abortSignal);
+    return presets.map((preset) => {
+      const description = preset.Description ?? preset.description;
+      return {
+        name: presetName(preset),
+        default: preset.Default ?? preset.default ?? false,
+        ...description ? { description } : {}
+      };
+    });
+  }
+  async request(method, path2, body, signal) {
+    const requestHeaders = {
+      ...this.headers,
+      "Coder-Session-Token": this.token,
+      Accept: "application/json"
+    };
+    if (body !== void 0) requestHeaders["Content-Type"] = "application/json";
+    const initialUrl = this.#url(path2);
+    let requestUrl = initialUrl;
+    let requestMethod = method.toUpperCase();
+    let requestBody = body === void 0 ? void 0 : JSON.stringify(body);
+    let redirectCount = 0;
+    let response;
+    for (; ; ) {
+      response = await waitWithAbort(
+        this.#fetch(requestUrl, {
+          method: requestMethod,
+          headers: requestHeaders,
+          body: requestBody,
+          signal,
+          redirect: "manual"
+        }),
+        signal
+      );
+      const location = response.headers.get("location");
+      if (!isRedirectStatus(response.status) || location === null) break;
+      redirectCount += 1;
+      if (redirectCount > MAX_API_REDIRECTS) {
+        cancelResponseBody(response);
+        throw new Error(
+          `Coder API ${method} ${path2} exceeded ${MAX_API_REDIRECTS} same-origin redirects`
+        );
+      }
+      const redirectedUrl = new URL(location, requestUrl);
+      if (redirectedUrl.origin !== initialUrl.origin) {
+        cancelResponseBody(response);
+        throw new Error(
+          `Coder API ${method} ${path2} refused cross-origin redirect from ${initialUrl.origin} to ${redirectedUrl.origin}`
+        );
+      }
+      cancelResponseBody(response);
+      if (response.status === 303 && requestMethod !== "GET" && requestMethod !== "HEAD" || (response.status === 301 || response.status === 302) && requestMethod === "POST") {
+        requestMethod = "GET";
+        requestBody = void 0;
+        deleteRequestBodyHeaders(requestHeaders);
+      }
+      requestUrl = redirectedUrl;
+    }
+    const text = await readResponseText(response, signal);
+    let parsed;
+    try {
+      parsed = text === "" ? void 0 : JSON.parse(text);
+    } catch {
+      parsed = void 0;
+    }
+    if (!response.ok) {
+      const error = asRecord2(parsed);
+      const validations = error.validations?.map((validation) => [validation.field, validation.detail].filter(Boolean).join(": ")).filter(Boolean).join("; ");
+      throw new CoderNativeApiError({
+        status: response.status,
+        method,
+        path: path2,
+        message: error.message ?? (response.statusText || "request failed"),
+        detail: [error.detail, validations, parsed === void 0 ? text.slice(0, 500) : void 0].filter(Boolean).join("; ") || void 0
+      });
+    }
+    return parsed;
+  }
+  #url(path2) {
+    const base = this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`;
+    return new URL(path2.replace(/^\//, ""), base);
+  }
+  async #createBuild(workspaceId, body, signal) {
+    return await this.request(
+      "POST",
+      `/api/v2/workspaces/${workspaceId}/builds`,
+      body,
+      signal
+    );
+  }
+  async #withLifecycleLock(workspaceId, signal, operation) {
+    const previous = this.#lifecycleTails.get(workspaceId) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(() => gate);
+    this.#lifecycleTails.set(workspaceId, tail);
+    void tail.then(() => {
+      if (this.#lifecycleTails.get(workspaceId) === tail) {
+        this.#lifecycleTails.delete(workspaceId);
+      }
+    });
+    try {
+      await waitWithAbort(previous, signal);
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+  async #waitForBuild(buildId, signal, allowCanceled = false) {
+    if (signal?.aborted) throw abortReason(signal);
+    const deadline = Date.now() + this.#buildTimeoutMs;
+    const timeoutError = () => new Error(`timed out after ${this.#buildTimeoutMs}ms waiting for Coder build ${buildId}`);
+    for (; ; ) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) throw timeoutError();
+      const controller = new AbortController();
+      let rejectInterrupted;
+      const interrupted = new Promise((_resolve, reject) => {
+        rejectInterrupted = reject;
+      });
+      const onAbort = () => {
+        const error = abortReason(signal);
+        rejectInterrupted(error);
+        controller.abort(error);
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) onAbort();
+      const timer = setTimeout(() => {
+        const error = timeoutError();
+        rejectInterrupted(error);
+        controller.abort(error);
+      }, remaining);
+      let build;
+      try {
+        build = await Promise.race([
+          this.request(
+            "GET",
+            `/api/v2/workspacebuilds/${buildId}`,
+            void 0,
+            controller.signal
+          ),
+          interrupted
+        ]);
+      } finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      }
+      const jobStatus = build.job?.status;
+      if (jobStatus === "succeeded") return build;
+      if (jobStatus === "canceled" && allowCanceled) return build;
+      if (jobStatus === "failed" || jobStatus === "canceled") {
+        throw new Error(
+          `Coder workspace ${build.transition} build ${buildId} ${jobStatus}` + (build.job?.error ? `: ${build.job.error}` : "") + (build.job?.error_code ? ` (${build.job.error_code})` : "")
+        );
+      }
+      const wait = Math.min(this.#buildPollIntervalMs, Math.max(0, deadline - Date.now()));
+      if (wait <= 0) throw timeoutError();
+      try {
+        await delay(wait, void 0, { signal });
+      } catch (error) {
+        if (signal?.aborted) throw abortReason(signal);
+        throw error;
+      }
+    }
+  }
+  async #resolveTemplate(name, org, signal) {
+    const query = new URLSearchParams({ q: `exact_name:"${name}"` });
+    const templates = await this.request(
+      "GET",
+      `/api/v2/templates?${query.toString()}`,
+      void 0,
+      signal
+    );
+    const matches = templates.filter(
+      (template) => template.name === name && (org === void 0 || template.organization_id === org || template.organization_name === org)
+    );
+    const [onlyMatch] = matches;
+    if (matches.length === 1 && onlyMatch !== void 0) return onlyMatch;
+    if (matches.length === 0) {
+      throw new Error(
+        `Coder template "${name}"${org ? ` in organization "${org}"` : ""} was not found`
+      );
+    }
+    throw new Error(
+      `Coder template "${name}" is ambiguous across organizations (${matches.map((template) => template.organization_name).join(", ")}); set org`
+    );
+  }
+  async #presets(versionId, signal) {
+    const presets = await this.request(
+      "GET",
+      `/api/v2/templateversions/${versionId}/presets`,
+      void 0,
+      signal
+    );
+    return Array.isArray(presets) ? presets : [];
+  }
+  async #templateParameters(template, versionId, owner, initialValues, signal) {
+    if (template.use_classic_parameter_flow !== false) {
+      const parameters = await this.request(
+        "GET",
+        `/api/v2/templateversions/${versionId}/rich-parameters`,
+        void 0,
+        signal
+      );
+      return Array.isArray(parameters) ? parameters : [];
+    }
+    const ownerId = owner === "me" ? void 0 : (await this.request(
+      "GET",
+      `/api/v2/users/${encodeURIComponent(owner)}`,
+      void 0,
+      signal
+    )).id;
+    const evaluation = await this.request(
+      "POST",
+      `/api/v2/templateversions/${versionId}/dynamic-parameters/evaluate`,
+      {
+        id: 0,
+        inputs: initialValues,
+        ...ownerId ? { owner_id: ownerId } : {}
+      },
+      signal
+    );
+    return (evaluation.parameters ?? []).map((parameter) => ({
+      name: parameter.name,
+      ...parameter.display_name ? { display_name: parameter.display_name } : {},
+      default_value: parameter.default_value?.value ?? "",
+      ...parameter.default_value?.valid === void 0 ? {} : { default_valid: parameter.default_value.valid },
+      required: parameter.required ?? false,
+      ephemeral: parameter.ephemeral ?? false
+    }));
+  }
+};
+function toWorkspaceStatus(workspace) {
+  const agents = workspace.latest_build.resources?.flatMap(
+    (resource) => (resource.agents ?? []).map((agent) => ({
+      name: agent.name,
+      status: agent.status,
+      lifecycleState: agent.lifecycle_state
+    }))
+  ) ?? [];
+  return {
+    id: workspace.id,
+    name: workspace.name,
+    buildStatus: workspace.latest_build.status,
+    transition: workspace.latest_build.transition,
+    agents
+  };
+}
+function presetName(preset) {
+  return preset.Name ?? preset.name ?? "";
+}
+function presetId(preset) {
+  const id = preset.ID ?? preset.id;
+  if (!id) throw new Error(`Coder preset "${presetName(preset)}" has no id`);
+  return id;
+}
+function presetDefault(preset) {
+  return preset.Default ?? preset.default ?? false;
+}
+function presetParameterValues(preset) {
+  const result = {};
+  for (const parameter of preset.Parameters ?? preset.parameters ?? []) {
+    const name = parameter.Name ?? parameter.name;
+    const value = parameter.Value ?? parameter.value;
+    if (name !== void 0 && value !== void 0) result[name] = value;
+  }
+  return result;
+}
+function resolveCreateParameterValues(parameters, supplied, useDefaults) {
+  const resolved = { ...supplied };
+  const required = [];
+  const awaitingDefaults = [];
+  for (const parameter of parameters) {
+    if (Object.hasOwn(resolved, parameter.name)) continue;
+    if (parameter.ephemeral && !parameter.required) continue;
+    const name = parameter.display_name || parameter.name;
+    if (parameter.required) {
+      required.push(name);
+    } else if (useDefaults && parameter.default_valid !== false) {
+      resolved[parameter.name] = parameter.default_value;
+    } else {
+      awaitingDefaults.push(name);
+    }
+  }
+  if (required.length > 0) {
+    const names = required.map((name) => `"${name}"`).join(", ");
+    throw new Error(
+      `required Coder workspace parameters have no defaults: ${names}; supply values with parameters, parameterFile, or a preset`
+    );
+  }
+  if (awaitingDefaults.length > 0) {
+    const names = awaitingDefaults.map((name) => `"${name}"`).join(", ");
+    throw new Error(
+      `Coder workspace parameters require explicit values: ${names}; supply values with parameters, parameterFile, or a preset` + (useDefaults ? "" : ", or set useParameterDefaults: true")
+    );
+  }
+  return resolved;
+}
+function asRecord2(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function isWorkspaceBuildInFlight(build) {
+  return build.status === "pending" || build.status === "starting" || build.status === "stopping" || build.status === "deleting" || build.status === "canceling";
+}
+function deleteRequestBodyHeaders(headers) {
+  const bodyHeaders = /* @__PURE__ */ new Set([
+    "content-encoding",
+    "content-language",
+    "content-location",
+    "content-type"
+  ]);
+  for (const name of Object.keys(headers)) {
+    if (bodyHeaders.has(name.toLowerCase())) delete headers[name];
+  }
+}
+function cancelResponseBody(response) {
+  try {
+    void response.body?.cancel().catch(() => {
+    });
+  } catch {
+  }
+}
+function abortReason(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  return new DOMException("The operation was aborted", "AbortError");
+}
+async function waitWithAbort(promise, signal) {
+  if (signal === void 0) return await promise;
+  if (signal.aborted) throw abortReason(signal);
+  let onAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    onAbort = () => reject(abortReason(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([promise, aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+async function readResponseText(response, signal) {
+  if (response.body === null) return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let releaseAfterCancel = false;
+  try {
+    for (; ; ) {
+      const { done, value } = await waitWithAbort(reader.read(), signal);
+      if (done) return text + decoder.decode();
+      text += decoder.decode(value, { stream: true });
+    }
+  } catch (error) {
+    if (!signal?.aborted) throw error;
+    const reason = abortReason(signal);
+    releaseAfterCancel = true;
+    try {
+      void reader.cancel(reason).catch(() => {
+      }).then(() => {
+        try {
+          reader.releaseLock();
+        } catch {
+        }
+      });
+    } catch {
+    }
+    throw reason;
+  } finally {
+    if (!releaseAfterCancel) reader.releaseLock();
+  }
+}
+async function readParameterFile(path2) {
+  let parsed;
+  try {
+    parsed = parseYaml(await readFile(path2, "utf8"));
+  } catch (error) {
+    throw new Error(`failed to parse Coder parameter file "${path2}"`, { cause: error });
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Coder parameter file "${path2}" must contain a YAML mapping`);
+  }
+  const result = {};
+  for (const [name, value] of Object.entries(parsed)) {
+    if (typeof value === "string" || typeof value === "boolean" || typeof value === "number") {
+      result[name] = String(value);
+    } else if (Array.isArray(value)) {
+      result[name] = JSON.stringify(value);
+    } else {
+      throw new Error(
+        `invalid value for Coder parameter "${name}" in "${path2}": expected string, number, boolean, or list`
+      );
+    }
+  }
+  return result;
+}
+function parseDurationMillis(input) {
+  const unitMillis = {
+    ms: 1,
+    s: 1e3,
+    m: 6e4,
+    h: 36e5
+  };
+  const pattern = /(\d+(?:\.\d+)?)(ms|s|m|h)/gy;
+  let total = 0;
+  let offset = 0;
+  for (; ; ) {
+    pattern.lastIndex = offset;
+    const match = pattern.exec(input);
+    if (match === null) break;
+    const amount = match[1];
+    const multiplier = match[2] === void 0 ? void 0 : unitMillis[match[2]];
+    if (amount === void 0 || multiplier === void 0) break;
+    total += Number(amount) * multiplier;
+    offset = pattern.lastIndex;
+  }
+  if (offset !== input.length || offset === 0 || !Number.isFinite(total) || total < 0) {
+    throw new Error(
+      `invalid stopAfter duration "${input}"; expected a Go-style duration such as "8h" or "1h30m"`
+    );
+  }
+  return Math.round(total);
+}
+
+// src/native-relay.ts
+import { randomUUID } from "crypto";
+import net2 from "net";
+import WebSocket from "ws";
+var RELAY_PROTOCOL_VERSION = 1;
+var CARRIER_HIGH_WATER_MARK = 1024 * 1024;
+var CARRIER_LOW_WATER_MARK = 256 * 1024;
+var CARRIER_DRAIN_POLL_INTERVAL_MS = 10;
+var PROCESS_STDIN_CHUNK_BYTES = 64 * 1024;
+var PROCESS_STDIN_BATCH_BYTES = 256 * 1024;
+var RELAY_CLOSE_GRACE_MS = 1e3;
+var NATIVE_RELAY_BOOTSTRAP_MARKER = "__CODER_AI_SDK_RELAY_BOOTSTRAP_READY_V1__";
+var BOOTSTRAP_DIAGNOSTIC_LIMIT = 500;
+var BOOTSTRAP_FRAME_LIMIT = 64 * 1024;
+var PROTOCOL_FRAME_LIMIT = 1024 * 1024;
+var NATIVE_RELAY_SOURCE = String.raw`'use strict';
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+const net = require('node:net');
+const os = require('node:os');
+const path = require('node:path');
+const readline = require('node:readline');
+const processes = new Map();
+const discardedProcessOutputs = new Map();
+const processOutputPauses = new Map();
+const processInputPauses = new Set();
+const sockets = new Map();
+const socketOutputPauses = new Map();
+const signalNumbers = os.constants.signals;
+const childShutdownGraceMs = 500;
+let outputCarrierPaused = false;
+function resolveExecutable(name) {
+  for (const directory of String(process.env.PATH || '/usr/local/bin:/usr/bin:/bin').split(path.delimiter)) {
+    const candidate = path.resolve(directory || '.', name);
+    try { fs.accessSync(candidate, fs.constants.X_OK); return candidate; } catch (_) {}
+  }
+  return name;
+}
+const bashPath = resolveExecutable('bash');
+function processStream(child, streamName) {
+  return streamName === 'stdout' ? child && child.stdout : streamName === 'stderr' ? child && child.stderr : undefined;
+}
+function setProcessOutputPaused(id, streamName, reason, paused) {
+  const child = processes.get(id);
+  const pauses = processOutputPauses.get(id);
+  const stream = processStream(child, streamName);
+  const reasons = pauses && pauses[streamName];
+  if (!stream || !reasons) return;
+  if (discardedProcessOutputs.get(id)?.has(streamName)) {
+    reasons.clear();
+    stream.resume();
+    return;
+  }
+  if (paused) {
+    reasons.add(reason);
+    stream.pause();
+  } else if (reasons.delete(reason) && reasons.size === 0) {
+    stream.resume();
+  }
+}
+function setSocketOutputPaused(id, reason, paused) {
+  const socket = sockets.get(id);
+  const reasons = socketOutputPauses.get(id);
+  if (!socket || !reasons) return;
+  if (paused) {
+    reasons.add(reason);
+    socket.pause();
+  } else if (reasons.delete(reason) && reasons.size === 0) {
+    socket.resume();
+  }
+}
+function pauseOutputCarrier() {
+  if (outputCarrierPaused) return;
+  outputCarrierPaused = true;
+  for (const id of processes.keys()) {
+    setProcessOutputPaused(id, 'stdout', 'carrier', true);
+    setProcessOutputPaused(id, 'stderr', 'carrier', true);
+  }
+  for (const id of sockets.keys()) setSocketOutputPaused(id, 'carrier', true);
+}
+function resumeOutputCarrier() {
+  if (!outputCarrierPaused) return;
+  outputCarrierPaused = false;
+  for (const id of processes.keys()) {
+    setProcessOutputPaused(id, 'stdout', 'carrier', false);
+    if (outputCarrierPaused) return;
+    setProcessOutputPaused(id, 'stderr', 'carrier', false);
+    if (outputCarrierPaused) return;
+  }
+  for (const id of sockets.keys()) {
+    setSocketOutputPaused(id, 'carrier', false);
+    if (outputCarrierPaused) return;
+  }
+}
+function emit(message) {
+  if (!process.stdout.write(JSON.stringify(Object.assign({ v: 1 }, message)) + '\n')) pauseOutputCarrier();
+}
+function bytes(value) {
+  return Buffer.from(value || '', 'base64');
+}
+function shellQuote(value) {
+  return "'" + String(value).replace(/'/g, "'\\''") + "'";
+}
+function commandScript(message) {
+  const directory = message.cwd ? 'cd ' + shellQuote(message.cwd) + ' && ' : '';
+  const entries = Object.entries(message.env || {});
+  if (entries.length === 0) return directory + message.command;
+  const assignments = entries.map(([key, value]) => shellQuote(key + '=' + String(value))).join(' ');
+  return directory + 'exec env ' + assignments + ' ' + shellQuote(bashPath) + ' -c ' + shellQuote(message.command);
+}
+function processExitCode(code, signal) {
+  if (typeof code === 'number') return code;
+  return 128 + (signalNumbers[signal] || 0);
+}
+function start(message) {
+  if (processes.has(message.id)) {
+    emit({ type: 'proc-error', id: message.id, message: 'duplicate process id' });
+    return;
+  }
+  const args = [message.loginShell === false ? '-c' : '-lc', commandScript(message)];
+  let child;
+  try {
+    child = childProcess.spawn(bashPath, args, {
+      env: process.env,
+      detached: process.platform !== 'win32',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    emit({ type: 'proc-error', id: message.id, message: String(error && error.message || error) });
+    return;
+  }
+  const discardedOutputs = new Set();
+  processes.set(message.id, child);
+  discardedProcessOutputs.set(message.id, discardedOutputs);
+  processOutputPauses.set(message.id, { stdout: new Set(), stderr: new Set() });
+  child.once('spawn', () => emit({ type: 'started', id: message.id, pid: child.pid }));
+  child.stdout.on('data', (data) => {
+    if (!discardedOutputs.has('stdout')) emit({ type: 'stdout', id: message.id, data: data.toString('base64') });
+  });
+  child.stderr.on('data', (data) => {
+    if (!discardedOutputs.has('stderr')) emit({ type: 'stderr', id: message.id, data: data.toString('base64') });
+  });
+  if (outputCarrierPaused) {
+    setProcessOutputPaused(message.id, 'stdout', 'carrier', true);
+    setProcessOutputPaused(message.id, 'stderr', 'carrier', true);
+  }
+  child.once('error', (error) => {
+    processes.delete(message.id);
+    discardedProcessOutputs.delete(message.id);
+    processOutputPauses.delete(message.id);
+    processInputPauses.delete(message.id);
+    emit({ type: 'proc-error', id: message.id, message: String(error && error.message || error) });
+  });
+  child.once('close', (code, signal) => {
+    if (!processes.delete(message.id)) return;
+    discardedProcessOutputs.delete(message.id);
+    processOutputPauses.delete(message.id);
+    processInputPauses.delete(message.id);
+    emit({ type: 'exit', id: message.id, code: processExitCode(code, signal), signal: signal || undefined });
+  });
+  // Child exit is authoritative; a stdin EPIPE only means it stopped reading.
+  child.stdin.on('error', () => { processInputPauses.delete(message.id); });
+  child.stdin.once('close', () => {
+    processInputPauses.delete(message.id);
+    if (processes.has(message.id)) emit({ type: 'proc-stdin-close', id: message.id });
+  });
+  child.stdin.on('drain', () => {
+    if (processInputPauses.delete(message.id) && processes.has(message.id)) {
+      emit({ type: 'proc-stdin-resume', id: message.id });
+    }
+  });
+  if (message.stdinMode !== 'stream') {
+    if (message.stdin) child.stdin.write(bytes(message.stdin));
+    child.stdin.end();
+  }
+}
+function processStdinData(message) {
+  const child = processes.get(message.id);
+  if (!child || child.stdin.destroyed || child.stdin.writableEnded) return;
+  try {
+    if (!child.stdin.write(bytes(message.data)) && !processInputPauses.has(message.id)) {
+      processInputPauses.add(message.id);
+      emit({ type: 'proc-stdin-pause', id: message.id });
+    }
+  } catch (_) {}
+}
+function processStdinEnd(message) {
+  const child = processes.get(message.id);
+  if (!child || child.stdin.destroyed || child.stdin.writableEnded) return;
+  try { child.stdin.end(); } catch (_) {}
+}
+function signalProcessGroup(pid, signal) {
+  try {
+    process.kill(process.platform !== 'win32' ? -pid : pid, signal);
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+function processGroupAlive(pid) {
+  return signalProcessGroup(pid, 0);
+}
+function terminate(child, signal) {
+  if (!child || !child.pid) return;
+  if (signalProcessGroup(child.pid, signal)) return;
+  try { child.kill(signal); } catch (_) {}
+}
+function discardProcessOutput(id, streamName) {
+  const child = processes.get(id);
+  const discardedOutputs = discardedProcessOutputs.get(id);
+  const stream = processStream(child, streamName);
+  if (!stream || !discardedOutputs) return;
+  discardedOutputs.add(streamName);
+  processOutputPauses.get(id)?.[streamName]?.clear();
+  stream.resume();
+}
+function kill(message) {
+  if (message.discardOutput) {
+    discardProcessOutput(message.id, 'stdout');
+    discardProcessOutput(message.id, 'stderr');
+  }
+  terminate(processes.get(message.id), message.signal || 'SIGTERM');
+}
+function tcpOpen(message) {
+  if (sockets.has(message.id)) {
+    emit({ type: 'tcp-error', id: message.id, message: 'duplicate socket id' });
+    return;
+  }
+  let socket;
+  try { socket = net.createConnection({ host: '127.0.0.1', port: message.port, allowHalfOpen: true }); }
+  catch (error) {
+    emit({ type: 'tcp-error', id: message.id, message: String(error && error.message || error) });
+    emit({ type: 'tcp-close', id: message.id });
+    return;
+  }
+  sockets.set(message.id, socket);
+  socketOutputPauses.set(message.id, new Set());
+  socket.once('connect', () => emit({ type: 'tcp-opened', id: message.id }));
+  socket.on('data', (data) => emit({ type: 'tcp-data', id: message.id, data: data.toString('base64') }));
+  socket.on('drain', () => emit({ type: 'tcp-resume', id: message.id }));
+  socket.once('end', () => emit({ type: 'tcp-end', id: message.id }));
+  socket.once('error', (error) => emit({ type: 'tcp-error', id: message.id, message: String(error && error.message || error) }));
+  socket.once('close', () => {
+    sockets.delete(message.id);
+    socketOutputPauses.delete(message.id);
+    emit({ type: 'tcp-close', id: message.id });
+  });
+  if (outputCarrierPaused) setSocketOutputPaused(message.id, 'carrier', true);
+}
+function receive(line) {
+  if (!line) return;
+  let message;
+  try { message = JSON.parse(line); }
+  catch (error) { emit({ type: 'error', message: 'invalid JSON: ' + String(error && error.message || error) }); return; }
+  if (message.v !== 1) { emit({ type: 'error', message: 'unsupported protocol version' }); return; }
+  switch (message.type) {
+    case 'start': start(message); break;
+    case 'proc-stdin': processStdinData(message); break;
+    case 'proc-stdin-end': processStdinEnd(message); break;
+    case 'kill': kill(message); break;
+    case 'proc-pause': {
+      setProcessOutputPaused(message.id, message.stream, 'host', true);
+      break;
+    }
+    case 'proc-resume': {
+      setProcessOutputPaused(message.id, message.stream, 'host', false);
+      break;
+    }
+    case 'proc-discard': {
+      discardProcessOutput(message.id, message.stream);
+      break;
+    }
+    case 'tcp-open': tcpOpen(message); break;
+    case 'tcp-data': {
+      const socket = sockets.get(message.id);
+      if (socket && !socket.write(bytes(message.data))) emit({ type: 'tcp-pause', id: message.id });
+      break;
+    }
+    case 'tcp-end': { const socket = sockets.get(message.id); if (socket) socket.end(); break; }
+    case 'tcp-close': { const socket = sockets.get(message.id); if (socket) socket.destroy(); break; }
+    case 'tcp-pause': { setSocketOutputPaused(message.id, 'host', true); break; }
+    case 'tcp-resume': { setSocketOutputPaused(message.id, 'host', false); break; }
+    case 'ping': emit({ type: 'pong' }); break;
+    default: emit({ type: 'error', id: message.id, message: 'unknown message type: ' + message.type });
+  }
+}
+let shuttingDown = false;
+function shutdown(exitCode) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  const groupPids = [];
+  for (const [id, child] of processes) {
+    discardProcessOutput(id, 'stdout');
+    discardProcessOutput(id, 'stderr');
+    if (child.pid) groupPids.push(child.pid);
+    terminate(child, 'SIGTERM');
+  }
+  for (const socket of sockets.values()) socket.destroy();
+  if (groupPids.length === 0) {
+    process.exit(exitCode);
+    return;
+  }
+  let pollTimer;
+  let forceTimer;
+  const finish = () => {
+    if (pollTimer) clearInterval(pollTimer);
+    if (forceTimer) clearTimeout(forceTimer);
+    process.exit(exitCode);
+  };
+  pollTimer = setInterval(() => {
+    if (groupPids.every((pid) => !processGroupAlive(pid))) finish();
+  }, 10);
+  forceTimer = setTimeout(() => {
+    for (const pid of groupPids) signalProcessGroup(pid, 'SIGKILL');
+    finish();
+  }, childShutdownGraceMs);
+}
+const input = readline.createInterface({ input: process.stdin, crlfDelay: Infinity, terminal: false });
+process.stdout.on('drain', resumeOutputCarrier);
+input.on('line', receive);
+input.once('close', () => shutdown(0));
+for (const signal of ['SIGHUP', 'SIGINT', 'SIGQUIT', 'SIGTERM']) {
+  process.once(signal, () => shutdown(processExitCode(null, signal)));
+}
+process.once('exit', () => {
+  for (const child of processes.values()) terminate(child, 'SIGKILL');
+});
+emit({ type: 'ready', protocol: 1, pid: process.pid });
+`;
+var NativeRelay = class _NativeRelay {
+  #websocket;
+  #bootstrapReady = deferred();
+  #ready = deferred();
+  #websocketClosed = deferred();
+  #processes = /* @__PURE__ */ new Map();
+  #processInputs = /* @__PURE__ */ new Map();
+  #sockets = /* @__PURE__ */ new Map();
+  #closeListeners = /* @__PURE__ */ new Set();
+  #buffer = "";
+  #bootstrapOutput = "";
+  #bootstrapReadySeen = false;
+  #carrierPaused = false;
+  #carrierDrainTimer;
+  #closed = false;
+  #readySeen = false;
+  #closeError;
+  #websocketClosePromise;
+  constructor(websocket) {
+    this.#websocket = websocket;
+    websocket.on("message", (data) => this.#onData(data));
+    websocket.on("error", (error) => this.#fail(toError(error)));
+    websocket.on("close", (code, reason) => {
+      this.#websocketClosed.resolve();
+      const detail = Buffer.from(reason).toString("utf8");
+      this.#fail(
+        this.#closeError ?? new Error(`Coder native relay WebSocket closed (${code})${detail ? `: ${detail}` : ""}`)
+      );
+    });
+  }
+  static async connect(options) {
+    if (options.signal?.aborted) throw abortError(options.signal);
+    const query = new URLSearchParams({
+      reconnect: randomUUID(),
+      width: "80",
+      height: "24",
+      command: relayBootstrapCommand(options.nodeCommand),
+      backend_type: "buffered"
+    });
+    const url = options.api.websocketUrl(
+      `/api/v2/workspaceagents/${encodeURIComponent(options.agentId)}/pty?${query.toString()}`
+    );
+    const websocketOrigin = new URL(url).origin;
+    const websocket = new WebSocket(url, {
+      headers: options.api.websocketHeaders(),
+      followRedirects: true,
+      perMessageDeflate: false,
+      finishRequest: (request, candidate) => {
+        const candidateOrigin = new URL(candidate.url).origin;
+        if (candidateOrigin !== websocketOrigin) {
+          request.destroy(
+            new Error(
+              `Coder native relay refused cross-origin WebSocket redirect from ${websocketOrigin} to ${candidateOrigin}`
+            )
+          );
+          return;
+        }
+        request.end();
+      }
+    });
+    const relay = new _NativeRelay(websocket);
+    const open = deferred();
+    const onOpen = () => open.resolve();
+    const onError = (error) => open.reject(error);
+    websocket.once("open", onOpen);
+    websocket.once("error", onError);
+    const abort = () => {
+      const error = abortError(options.signal);
+      open.reject(error);
+      relay.#bootstrapReady.reject(error);
+      relay.#ready.reject(error);
+      relay.#fail(error);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => {
+      const error = relay.#connectTimeoutError(options.connectTimeoutMs);
+      open.reject(error);
+      relay.#bootstrapReady.reject(error);
+      relay.#ready.reject(error);
+      relay.#fail(error);
+    }, options.connectTimeoutMs);
+    timer.unref?.();
+    try {
+      await open.promise;
+      websocket.off("error", onError);
+      await relay.#bootstrapReady.promise;
+      relay.#sendPtyData(`${Buffer.from(NATIVE_RELAY_SOURCE).toString("base64")}
+`);
+      await relay.#ready.promise;
+      return relay;
+    } catch (error) {
+      relay.#fail(toError(error));
+      await relay.#closeWebSocket();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+    }
+  }
+  get closed() {
+    return this.#closed;
+  }
+  startProcess(id, options, sink, loginShell) {
+    this.#assertOpen();
+    this.#processes.set(id, sink);
+    if (options.stdin !== void 0) {
+      this.#processInputs.set(id, {
+        data: options.stdin,
+        offset: 0,
+        remotePaused: false,
+        scheduled: false
+      });
+    }
+    try {
+      this.#send({
+        type: "start",
+        id,
+        command: options.command,
+        ...options.workingDirectory ? { cwd: options.workingDirectory } : {},
+        ...options.env ? { env: options.env } : {},
+        ...options.stdin !== void 0 ? { stdinMode: "stream" } : {},
+        loginShell
+      });
+      this.#pumpProcessInput(id);
+    } catch (error) {
+      this.#processes.delete(id);
+      this.#processInputs.delete(id);
+      throw error;
+    }
+  }
+  unregisterProcess(id) {
+    this.#processes.delete(id);
+    this.#processInputs.delete(id);
+  }
+  killProcess(id, signal = "SIGTERM") {
+    if (this.#closed) return;
+    this.#send({ type: "kill", id, signal, discardOutput: true });
+  }
+  pauseProcessOutput(id, stream) {
+    if (this.#closed) return;
+    this.#send({ type: "proc-pause", id, stream });
+  }
+  resumeProcessOutput(id, stream) {
+    if (this.#closed) return;
+    this.#send({ type: "proc-resume", id, stream });
+  }
+  discardProcessOutput(id, stream) {
+    if (this.#closed) return;
+    this.#send({ type: "proc-discard", id, stream });
+  }
+  openTcp(id, port, sink) {
+    this.#assertOpen();
+    this.#sockets.set(id, sink);
+    try {
+      if (this.#carrierPaused) sink.pause("carrier");
+      this.#send({ type: "tcp-open", id, port });
+    } catch (error) {
+      this.#sockets.delete(id);
+      throw error;
+    }
+  }
+  tcpData(id, data) {
+    if (this.#closed) return;
+    this.#send({ type: "tcp-data", id, data: Buffer.from(data).toString("base64") });
+  }
+  tcpEnd(id) {
+    if (this.#closed) return;
+    this.#send({ type: "tcp-end", id });
+  }
+  pauseTcp(id) {
+    if (this.#closed) return;
+    this.#send({ type: "tcp-pause", id });
+  }
+  resumeTcp(id) {
+    if (this.#closed) return;
+    this.#send({ type: "tcp-resume", id });
+  }
+  closeTcp(id) {
+    const existed = this.#sockets.delete(id);
+    if (existed && !this.#closed) this.#send({ type: "tcp-close", id });
+  }
+  onClose(listener) {
+    if (this.#closed) {
+      queueMicrotask(() => listener(this.#closeError));
+      return () => {
+      };
+    }
+    this.#closeListeners.add(listener);
+    return () => this.#closeListeners.delete(listener);
+  }
+  async close() {
+    if (!this.#closed) {
+      this.#closeError = new Error("Coder native relay closed");
+      this.#fail(this.#closeError, 1e3, "transport closed");
+    }
+    await this.#closeWebSocket(1e3, "transport closed");
+  }
+  #send(message) {
+    this.#sendPtyData(`${JSON.stringify({ v: RELAY_PROTOCOL_VERSION, ...message })}
+`);
+  }
+  #sendPtyData(data) {
+    if (this.#websocket.readyState !== WebSocket.OPEN) {
+      throw this.#closeError ?? new Error("Coder native relay WebSocket is not open");
+    }
+    this.#websocket.send(Buffer.from(JSON.stringify({ data }), "utf8"), { binary: true });
+    this.#updateCarrierBackpressure();
+  }
+  #assertOpen() {
+    if (this.#closed || !this.#readySeen) {
+      throw this.#closeError ?? new Error("Coder native relay is not open");
+    }
+  }
+  #connectTimeoutError(timeoutMs) {
+    const phase = this.#websocket.readyState === WebSocket.CONNECTING ? "opening the authenticated PTY WebSocket" : !this.#bootstrapReadySeen ? "waiting for the remote PTY bootstrap" : "starting the workspace relay";
+    const output = (this.#bootstrapReadySeen ? this.#bootstrapOutput : `${this.#bootstrapOutput}${this.#buffer}`.slice(-BOOTSTRAP_DIAGNOSTIC_LIMIT)).trim();
+    return new Error(
+      `timed out after ${timeoutMs}ms ${phase}${output ? `; PTY output: ${output}` : ""}`
+    );
+  }
+  #onData(data) {
+    const chunk = rawDataBuffer(data).toString("utf8");
+    this.#buffer += chunk;
+    if (!this.#bootstrapReadySeen) {
+      const marker = this.#buffer.indexOf(NATIVE_RELAY_BOOTSTRAP_MARKER);
+      if (marker !== -1) {
+        this.#bootstrapOutput = `${this.#bootstrapOutput}${this.#buffer.slice(0, marker)}`.slice(
+          -BOOTSTRAP_DIAGNOSTIC_LIMIT
+        );
+        this.#buffer = this.#buffer.slice(marker + NATIVE_RELAY_BOOTSTRAP_MARKER.length);
+        if (this.#buffer.startsWith("\r\n")) this.#buffer = this.#buffer.slice(2);
+        else if (this.#buffer.startsWith("\n")) this.#buffer = this.#buffer.slice(1);
+        this.#bootstrapReadySeen = true;
+        this.#bootstrapReady.resolve();
+      } else {
+        const markerOverlap = NATIVE_RELAY_BOOTSTRAP_MARKER.length - 1;
+        const consumedLength = Math.max(0, this.#buffer.length - markerOverlap);
+        if (consumedLength > 0) {
+          this.#bootstrapOutput = `${this.#bootstrapOutput}${this.#buffer.slice(
+            0,
+            consumedLength
+          )}`.slice(-BOOTSTRAP_DIAGNOSTIC_LIMIT);
+          this.#buffer = this.#buffer.slice(consumedLength);
+        }
+        return;
+      }
+    }
+    for (; ; ) {
+      const newline = this.#buffer.indexOf("\n");
+      const frameLength = newline === -1 ? this.#buffer.length : newline;
+      const frameLimit = this.#readySeen ? PROTOCOL_FRAME_LIMIT : BOOTSTRAP_FRAME_LIMIT;
+      if (frameLength > frameLimit) {
+        if (!this.#readySeen) {
+          this.#bootstrapOutput = `${this.#bootstrapOutput}${this.#buffer.slice(
+            -BOOTSTRAP_DIAGNOSTIC_LIMIT
+          )}`.slice(-BOOTSTRAP_DIAGNOSTIC_LIMIT);
+        }
+        this.#buffer = "";
+        this.#fail(
+          new Error(
+            this.#readySeen ? `Coder native relay protocol frame exceeded ${PROTOCOL_FRAME_LIMIT} characters` : `Coder native relay bootstrap frame exceeded ${BOOTSTRAP_FRAME_LIMIT} characters`
+          )
+        );
+        return;
+      }
+      if (newline === -1) return;
+      const line = this.#buffer.slice(0, newline).replace(/\r$/, "");
+      this.#buffer = this.#buffer.slice(newline + 1);
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch {
+        if (!this.#readySeen) {
+          this.#bootstrapOutput = `${this.#bootstrapOutput}${line}
+`.slice(
+            -BOOTSTRAP_DIAGNOSTIC_LIMIT
+          );
+          continue;
+        }
+        this.#fail(new Error(`invalid data from Coder native relay: ${line.slice(0, 200)}`));
+        return;
+      }
+      this.#dispatch(message);
+    }
+  }
+  #dispatch(message) {
+    if (message.v !== RELAY_PROTOCOL_VERSION || typeof message.type !== "string") {
+      this.#fail(new Error("Coder native relay returned an unsupported protocol frame"));
+      return;
+    }
+    if (message.type === "ready") {
+      if (message.pid === void 0) {
+        this.#ready.reject(new Error("Coder native relay ready frame had no pid"));
+        return;
+      }
+      this.#readySeen = true;
+      this.#ready.resolve();
+      return;
+    }
+    if (message.type === "error" && message.id === void 0) {
+      this.#fail(new Error(`Coder native relay error: ${message.message ?? "unknown error"}`));
+      return;
+    }
+    if (message.id === void 0) return;
+    const process2 = this.#processes.get(message.id);
+    if (process2 !== void 0) {
+      switch (message.type) {
+        case "started":
+          if (message.pid !== void 0) process2.onStarted(message.pid);
+          break;
+        case "stdout":
+          process2.onStdout(Buffer.from(message.data ?? "", "base64"));
+          break;
+        case "stderr":
+          process2.onStderr(Buffer.from(message.data ?? "", "base64"));
+          break;
+        case "proc-stdin-pause": {
+          const input = this.#processInputs.get(message.id);
+          if (input !== void 0) input.remotePaused = true;
+          break;
+        }
+        case "proc-stdin-resume": {
+          const input = this.#processInputs.get(message.id);
+          if (input !== void 0) {
+            input.remotePaused = false;
+            try {
+              this.#pumpProcessInput(message.id);
+            } catch (error) {
+              this.#fail(toError(error));
+            }
+          }
+          break;
+        }
+        case "proc-stdin-close":
+          this.#processInputs.delete(message.id);
+          break;
+        case "exit":
+          this.#processes.delete(message.id);
+          this.#processInputs.delete(message.id);
+          process2.onExit(message.code ?? 1);
+          break;
+        case "proc-error":
+          this.#processes.delete(message.id);
+          this.#processInputs.delete(message.id);
+          process2.onError(new Error(message.message ?? "workspace process failed"));
+          break;
+      }
+      return;
+    }
+    const socket = this.#sockets.get(message.id);
+    if (socket === void 0) return;
+    switch (message.type) {
+      case "tcp-opened":
+        socket.opened();
+        break;
+      case "tcp-data":
+        socket.data(Buffer.from(message.data ?? "", "base64"));
+        break;
+      case "tcp-end":
+        socket.end();
+        break;
+      case "tcp-pause":
+        socket.pause("remote");
+        break;
+      case "tcp-resume":
+        socket.resume("remote");
+        break;
+      case "tcp-close":
+        this.#sockets.delete(message.id);
+        socket.close();
+        break;
+      case "tcp-error":
+        socket.error(new Error(message.message ?? "workspace TCP connection failed"));
+        break;
+    }
+  }
+  #fail(error, closeCode, closeReason) {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#stopCarrierDrainTimer();
+    this.#closeError = error;
+    this.#bootstrapReady.reject(error);
+    this.#ready.reject(error);
+    for (const process2 of this.#processes.values()) process2.onError(error);
+    this.#processes.clear();
+    this.#processInputs.clear();
+    for (const socket of this.#sockets.values()) socket.error(error);
+    this.#sockets.clear();
+    for (const listener of this.#closeListeners) listener(error);
+    this.#closeListeners.clear();
+    void this.#closeWebSocket(closeCode, closeReason);
+  }
+  #closeWebSocket(code, reason) {
+    if (this.#websocketClosePromise !== void 0) return this.#websocketClosePromise;
+    this.#websocketClosePromise = (async () => {
+      if (isWebSocketClosed(this.#websocket)) return;
+      try {
+        if (this.#websocket.readyState === WebSocket.CONNECTING || this.#websocket.readyState === WebSocket.OPEN) {
+          this.#websocket.close(code, reason);
+        }
+      } catch {
+        this.#websocket.terminate();
+      }
+      if (isWebSocketClosed(this.#websocket)) return;
+      const forceTimer = setTimeout(() => this.#websocket.terminate(), RELAY_CLOSE_GRACE_MS);
+      try {
+        await this.#websocketClosed.promise;
+      } finally {
+        clearTimeout(forceTimer);
+      }
+    })();
+    return this.#websocketClosePromise;
+  }
+  #updateCarrierBackpressure() {
+    if (this.#closed) return;
+    if (!this.#carrierPaused) {
+      if (this.#websocket.bufferedAmount < CARRIER_HIGH_WATER_MARK) return;
+      this.#carrierPaused = true;
+      for (const socket of this.#sockets.values()) socket.pause("carrier");
+      this.#carrierDrainTimer = setInterval(
+        () => this.#updateCarrierBackpressure(),
+        CARRIER_DRAIN_POLL_INTERVAL_MS
+      );
+      this.#carrierDrainTimer.unref?.();
+      return;
+    }
+    if (this.#websocket.bufferedAmount > CARRIER_LOW_WATER_MARK) return;
+    this.#carrierPaused = false;
+    this.#stopCarrierDrainTimer();
+    for (const id of this.#processInputs.keys()) {
+      try {
+        this.#pumpProcessInput(id);
+      } catch (error) {
+        this.#fail(toError(error));
+        return;
+      }
+      if (this.#carrierPaused) return;
+    }
+    for (const socket of this.#sockets.values()) {
+      socket.resume("carrier");
+      if (this.#carrierPaused) break;
+    }
+  }
+  #pumpProcessInput(id) {
+    let input = this.#processInputs.get(id);
+    if (input?.scheduled) return;
+    let sentBytes = 0;
+    while (input !== void 0 && !this.#closed && !this.#carrierPaused && !input.remotePaused && sentBytes < PROCESS_STDIN_BATCH_BYTES) {
+      const chunk = processInputChunk(input);
+      if (chunk === void 0) {
+        this.#send({ type: "proc-stdin-end", id });
+        this.#processInputs.delete(id);
+        return;
+      }
+      this.#send({ type: "proc-stdin", id, data: chunk.toString("base64") });
+      sentBytes += chunk.byteLength;
+      input = this.#processInputs.get(id);
+    }
+    if (input !== void 0 && !this.#closed && !this.#carrierPaused && !input.remotePaused) {
+      input.scheduled = true;
+      const immediate = setImmediate(() => {
+        const scheduled = this.#processInputs.get(id);
+        if (scheduled === void 0) return;
+        scheduled.scheduled = false;
+        try {
+          this.#pumpProcessInput(id);
+        } catch (error) {
+          this.#fail(toError(error));
+        }
+      });
+      immediate.unref?.();
+    }
+  }
+  #stopCarrierDrainTimer() {
+    if (this.#carrierDrainTimer === void 0) return;
+    clearInterval(this.#carrierDrainTimer);
+    this.#carrierDrainTimer = void 0;
+  }
+};
+var NativeSpawnedProcess = class {
+  stdout;
+  stderr;
+  #id = randomUUID();
+  #completion = deferred();
+  #started;
+  #abortSignal;
+  #onAbort;
+  #stdoutController;
+  #stderrController;
+  #relay;
+  #pid;
+  #settled = false;
+  #stdoutCanceled = false;
+  #stderrCanceled = false;
+  #stdoutPaused = false;
+  #stderrPaused = false;
+  constructor(relay, options, loginShell) {
+    this.stdout = new ReadableStream({
+      start: (controller) => {
+        this.#stdoutController = controller;
+      },
+      pull: () => this.#resumeOutput("stdout"),
+      cancel: () => this.#cancelOutput("stdout")
+    });
+    this.stderr = new ReadableStream({
+      start: (controller) => {
+        this.#stderrController = controller;
+      },
+      pull: () => this.#resumeOutput("stderr"),
+      cancel: () => this.#cancelOutput("stderr")
+    });
+    this.#abortSignal = options.abortSignal;
+    this.#onAbort = () => {
+      const error = abortError(this.#abortSignal);
+      this.#relay?.killProcess(this.#id);
+      this.onError(error);
+    };
+    this.#abortSignal?.addEventListener("abort", this.#onAbort, { once: true });
+    if (this.#abortSignal?.aborted) this.#onAbort();
+    this.#started = relay.then((connected) => {
+      if (this.#settled) return;
+      this.#relay = connected;
+      connected.startProcess(this.#id, options, this, loginShell);
+      if (this.#stdoutCanceled) connected.discardProcessOutput(this.#id, "stdout");
+      if (this.#stderrCanceled) connected.discardProcessOutput(this.#id, "stderr");
+    }).catch((error) => this.onError(toError(error)));
+  }
+  get pid() {
+    return this.#pid;
+  }
+  onStarted(pid) {
+    this.#pid = pid;
+  }
+  onStdout(data) {
+    this.#enqueueOutput("stdout", data);
+  }
+  onStderr(data) {
+    this.#enqueueOutput("stderr", data);
+  }
+  onExit(code) {
+    if (this.#settled) return;
+    this.#settled = true;
+    this.#cleanup();
+    if (!this.#stdoutCanceled) this.#stdoutController.close();
+    if (!this.#stderrCanceled) this.#stderrController.close();
+    this.#completion.resolve({ exitCode: code });
+  }
+  onError(error) {
+    if (this.#settled) return;
+    this.#settled = true;
+    this.#cleanup();
+    if (!this.#stdoutCanceled) this.#stdoutController.error(error);
+    if (!this.#stderrCanceled) this.#stderrController.error(error);
+    this.#completion.reject(error);
+  }
+  wait() {
+    return this.#completion.promise;
+  }
+  async kill() {
+    if (this.#settled) return;
+    await this.#started;
+    this.#relay?.killProcess(this.#id);
+  }
+  #enqueueOutput(stream, data) {
+    if (this.#settled || this.#outputCanceled(stream)) return;
+    const controller = stream === "stdout" ? this.#stdoutController : this.#stderrController;
+    controller.enqueue(data);
+    if ((controller.desiredSize ?? 0) > 0) return;
+    if (stream === "stdout") {
+      if (this.#stdoutPaused) return;
+      this.#stdoutPaused = true;
+    } else {
+      if (this.#stderrPaused) return;
+      this.#stderrPaused = true;
+    }
+    this.#relay?.pauseProcessOutput(this.#id, stream);
+  }
+  #resumeOutput(stream) {
+    if (this.#settled || this.#outputCanceled(stream)) return;
+    if (stream === "stdout") {
+      if (!this.#stdoutPaused) return;
+      this.#stdoutPaused = false;
+    } else {
+      if (!this.#stderrPaused) return;
+      this.#stderrPaused = false;
+    }
+    this.#relay?.resumeProcessOutput(this.#id, stream);
+  }
+  #cancelOutput(stream) {
+    if (this.#settled || this.#outputCanceled(stream)) return;
+    if (stream === "stdout") {
+      this.#stdoutCanceled = true;
+      this.#stdoutPaused = false;
+    } else {
+      this.#stderrCanceled = true;
+      this.#stderrPaused = false;
+    }
+    this.#relay?.discardProcessOutput(this.#id, stream);
+  }
+  #outputCanceled(stream) {
+    return stream === "stdout" ? this.#stdoutCanceled : this.#stderrCanceled;
+  }
+  #cleanup() {
+    this.#abortSignal?.removeEventListener("abort", this.#onAbort);
+    this.#relay?.unregisterProcess(this.#id);
+  }
+};
+async function openNativePortForward(relay, options) {
+  const server = net2.createServer({ allowHalfOpen: true });
+  const sockets = /* @__PURE__ */ new Set();
+  let closed = false;
+  let rejectPendingBind;
+  const closeForward = () => {
+    if (closed) return;
+    closed = true;
+    for (const socket of sockets) socket.destroy();
+    sockets.clear();
+    if (server.listening) server.close();
+    else server.once("listening", () => server.close());
+  };
+  const removeCloseListener = relay.onClose(closeForward);
+  server.on("error", closeForward);
+  server.on("connection", (socket) => {
+    const id = randomUUID();
+    sockets.add(socket);
+    socket.pause();
+    let opened = false;
+    let remoteClosed = false;
+    let remoteEnded = false;
+    let remotePaused = false;
+    const uploadPauses = /* @__PURE__ */ new Set();
+    const resumeUpload = () => {
+      if (opened && uploadPauses.size === 0 && !remoteClosed && !socket.destroyed) socket.resume();
+    };
+    const closeRemote = () => {
+      if (remoteClosed) return;
+      remoteClosed = true;
+      relay.closeTcp(id);
+    };
+    socket.on("data", (data) => {
+      if (!remoteClosed) relay.tcpData(id, data);
+    });
+    socket.on("end", () => {
+      if (!remoteClosed) relay.tcpEnd(id);
+    });
+    socket.on("drain", () => {
+      if (remoteClosed || !remotePaused) return;
+      remotePaused = false;
+      relay.resumeTcp(id);
+    });
+    socket.on("close", () => {
+      sockets.delete(socket);
+      closeRemote();
+    });
+    socket.on("error", closeRemote);
+    try {
+      relay.openTcp(id, options.remotePort, {
+        opened: () => {
+          opened = true;
+          resumeUpload();
+        },
+        data: (data) => {
+          if (!socket.destroyed && !socket.write(data) && !remotePaused) {
+            remotePaused = true;
+            relay.pauseTcp(id);
+          }
+        },
+        end: () => {
+          remoteEnded = true;
+          socket.end();
+        },
+        pause: (reason) => {
+          uploadPauses.add(reason);
+          socket.pause();
+        },
+        resume: (reason) => {
+          uploadPauses.delete(reason);
+          resumeUpload();
+        },
+        close: () => {
+          remoteClosed = true;
+          if (socket.destroyed) return;
+          if (remoteEnded) socket.destroySoon();
+          else socket.destroy();
+        },
+        error: (error) => {
+          remoteClosed = true;
+          socket.destroy(error);
+        }
+      });
+    } catch (error) {
+      socket.destroy(toError(error));
+    }
+  });
+  const onAbort = () => {
+    removeCloseListener();
+    rejectPendingBind?.(abortError(options.abortSignal));
+    closeForward();
+  };
+  options.abortSignal?.addEventListener("abort", onAbort, { once: true });
+  if (options.abortSignal?.aborted) {
+    removeCloseListener();
+    throw abortError(options.abortSignal);
+  }
+  try {
+    await new Promise((resolve, reject) => {
+      const onError = (error) => {
+        rejectPendingBind = void 0;
+        reject(error);
+      };
+      rejectPendingBind = (error) => {
+        server.off("error", onError);
+        rejectPendingBind = void 0;
+        reject(error);
+      };
+      server.once("error", onError);
+      server.listen(0, "127.0.0.1", () => {
+        server.off("error", onError);
+        rejectPendingBind = void 0;
+        resolve();
+      });
+    });
+  } catch (error) {
+    closeForward();
+    removeCloseListener();
+    options.abortSignal?.removeEventListener("abort", onAbort);
+    throw error;
+  }
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    closeForward();
+    removeCloseListener();
+    throw new Error("failed to allocate a local port for the Coder native forward");
+  }
+  return {
+    localHost: "127.0.0.1",
+    localPort: address.port,
+    get closed() {
+      return closed || relay.closed;
+    },
+    close: async () => {
+      options.abortSignal?.removeEventListener("abort", onAbort);
+      removeCloseListener();
+      closeForward();
+    }
+  };
+}
+function relayBootstrapCommand(nodeCommand) {
+  const script = `stty raw -echo; printf '%s\\n' ${shellQuote(NATIVE_RELAY_BOOTSTRAP_MARKER)}; IFS= read -r CODER_AI_SDK_RELAY_PAYLOAD; exec ${shellQuote(nodeCommand)} -e "$(printf %s "$CODER_AI_SDK_RELAY_PAYLOAD" | base64 -d)"`;
+  return `exec bash -lc ${shellQuote(script)}`;
+}
+function rawDataBuffer(data) {
+  if (Buffer.isBuffer(data)) return data;
+  if (Array.isArray(data)) return Buffer.concat(data);
+  return Buffer.from(data);
+}
+function processInputChunk(input) {
+  if (typeof input.data === "string") {
+    if (input.offset >= input.data.length) return void 0;
+    const maxCodeUnits = Math.max(1, Math.floor(PROCESS_STDIN_CHUNK_BYTES / 4));
+    let end2 = Math.min(input.data.length, input.offset + maxCodeUnits);
+    if (end2 < input.data.length && isHighSurrogate(input.data.charCodeAt(end2 - 1)) && isLowSurrogate(input.data.charCodeAt(end2))) {
+      end2 -= 1;
+    }
+    const chunk2 = Buffer.from(input.data.slice(input.offset, end2));
+    input.offset = end2;
+    return chunk2;
+  }
+  if (input.offset >= input.data.byteLength) return void 0;
+  const end = Math.min(input.data.byteLength, input.offset + PROCESS_STDIN_CHUNK_BYTES);
+  const chunk = Buffer.from(
+    input.data.buffer,
+    input.data.byteOffset + input.offset,
+    end - input.offset
+  );
+  input.offset = end;
+  return chunk;
+}
+function isHighSurrogate(value) {
+  return value >= 55296 && value <= 56319;
+}
+function isLowSurrogate(value) {
+  return value >= 56320 && value <= 57343;
+}
+function isWebSocketClosed(websocket) {
+  return websocket.readyState === WebSocket.CLOSED;
+}
+function deferred() {
+  let resolve;
+  let reject;
+  const promise = new Promise((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  void promise.catch(() => {
+  });
+  return { promise, resolve, reject };
+}
+function toError(error) {
+  return error instanceof Error ? error : new Error(String(error));
+}
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  return new DOMException("The operation was aborted", "AbortError");
+}
+
+// src/native-transport.ts
+var DEFAULT_RELAY_CONNECT_TIMEOUT_MS = 3e4;
+var CoderNativeTransport = class {
+  #api;
+  #loginShell;
+  #relayNodeCommand;
+  #relayConnectTimeoutMs;
+  #relays = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    const url = options.url ?? process.env.CODER_URL;
+    const token = options.token ?? process.env.CODER_SESSION_TOKEN;
+    if (!url) {
+      throw new Error("CoderNativeTransport requires a Coder URL; pass { url } or set CODER_URL");
+    }
+    if (!token) {
+      throw new Error(
+        "CoderNativeTransport requires a session token; pass { token } or set CODER_SESSION_TOKEN"
+      );
+    }
+    this.#api = new CoderApiClient({
+      url,
+      token,
+      fetch: options.fetch,
+      headers: options.headers,
+      buildPollIntervalMs: options.buildPollIntervalMs,
+      buildTimeoutMs: options.buildTimeoutMs
+    });
+    this.#loginShell = options.loginShell ?? true;
+    this.#relayNodeCommand = options.relayNodeCommand ?? "node";
+    this.#relayConnectTimeoutMs = options.relayConnectTimeoutMs ?? DEFAULT_RELAY_CONNECT_TIMEOUT_MS;
+  }
+  async exec(options) {
+    const process2 = this.spawn(options);
+    const [stdout, stderr, result] = await Promise.all([
+      drain(process2.stdout),
+      drain(process2.stderr),
+      process2.wait()
+    ]);
+    return { exitCode: result.exitCode, stdout, stderr };
+  }
+  spawn(options) {
+    return new NativeSpawnedProcess(
+      this.#relayFor(options.workspace, options.abortSignal),
+      options,
+      this.#loginShell
+    );
+  }
+  async forwardPort(options) {
+    if (!Number.isInteger(options.remotePort) || options.remotePort < 1 || options.remotePort > 65535) {
+      throw new Error(
+        `invalid Coder workspace port ${options.remotePort}; expected an integer from 1 to 65535`
+      );
+    }
+    const relay = await this.#relayFor(options.workspace, options.abortSignal);
+    return await openNativePortForward(relay, options);
+  }
+  async start(workspace, options) {
+    const current = await this.#api.workspace(workspace, options?.abortSignal);
+    if (current?.latest_build.status !== "running") {
+      await this.#closeWorkspaceRelays(
+        workspace,
+        current?.id,
+        current?.owner_name,
+        current?.owner_id,
+        options?.abortSignal
+      );
+    }
+    await this.#api.start(workspace, options);
+  }
+  async stop(workspace, options) {
+    const current = await this.#api.workspace(workspace, options?.abortSignal);
+    await this.#closeWorkspaceRelays(
+      workspace,
+      current?.id,
+      current?.owner_name,
+      current?.owner_id,
+      options?.abortSignal
+    );
+    await this.#api.stop(workspace, options);
+  }
+  async destroy(workspace, options) {
+    const current = await this.#api.workspace(workspace, options?.abortSignal);
+    await this.#closeWorkspaceRelays(
+      workspace,
+      current?.id,
+      current?.owner_name,
+      current?.owner_id,
+      options?.abortSignal
+    );
+    await this.#api.destroy(workspace, options);
+  }
+  status(workspace, options) {
+    return this.#api.status(workspace, options);
+  }
+  create(options) {
+    return this.#api.create(options);
+  }
+  listPresets(options) {
+    return this.#api.listPresets(options);
+  }
+  /** Close every cached workspace relay. Existing local port-forwards close too. */
+  async close() {
+    const setups = [...new Set(this.#relays.values())];
+    this.#relays.clear();
+    const error = new Error("Coder native transport closed");
+    for (const setup of setups) setup.controller.abort(error);
+    const settled = await Promise.allSettled(setups.map((setup) => setup.promise));
+    await Promise.all(
+      settled.filter(
+        (result) => result.status === "fulfilled"
+      ).map((result) => result.value.relay.close())
+    );
+  }
+  async #relayFor(workspace, signal) {
+    if (signal?.aborted) throw abortError2(signal);
+    const referenceKey = relayReferenceKey(workspace);
+    const existing = this.#relays.get(referenceKey);
+    if (existing !== void 0) {
+      const entry = await waitWithAbort2(existing.promise, signal);
+      if (!entry.relay.closed) return entry.relay;
+      this.#removeRelaySetup(existing);
+    }
+    const controller = new AbortController();
+    const workspaceKey = canonicalWorkspaceKey(workspace);
+    let setup;
+    const promise = (async () => {
+      try {
+        const resolved = await waitWithAbort2(
+          this.#api.resolveAgent(workspace, controller.signal),
+          controller.signal
+        );
+        setup.workspaceId = resolved.workspace.id;
+        setup.workspaceKey = canonicalWorkspaceKey(workspace, resolved.workspace.owner_name);
+        const agentKey = relayAgentKey(resolved.workspace.id, resolved.agent.id);
+        const shared = this.#relays.get(agentKey);
+        if (shared !== void 0 && shared !== setup) {
+          this.#relays.set(referenceKey, shared);
+          const entry = await waitWithAbort2(shared.promise, controller.signal);
+          if (!entry.relay.closed) return entry;
+          this.#removeRelaySetup(shared);
+          this.#relays.set(referenceKey, setup);
+        }
+        this.#relays.set(agentKey, setup);
+        if (resolved.workspace.latest_build.status !== "running") {
+          throw new Error(
+            `Coder workspace "${workspace}" is ${resolved.workspace.latest_build.status}; start it before connecting`
+          );
+        }
+        if (resolved.agent.status !== "connected") {
+          throw new Error(
+            `Coder workspace agent "${resolved.agent.name}" is ${resolved.agent.status}; wait for it to connect`
+          );
+        }
+        const relay = await NativeRelay.connect({
+          api: this.#api,
+          agentId: resolved.agent.id,
+          nodeCommand: this.#relayNodeCommand,
+          connectTimeoutMs: this.#relayConnectTimeoutMs,
+          signal: controller.signal
+        });
+        relay.onClose(() => {
+          this.#removeRelaySetup(setup);
+        });
+        return { workspaceId: resolved.workspace.id, relay };
+      } catch (error) {
+        this.#removeRelaySetup(setup);
+        throw error;
+      }
+    })();
+    setup = { controller, promise, workspaceKey };
+    this.#relays.set(referenceKey, setup);
+    return (await waitWithAbort2(promise, signal)).relay;
+  }
+  async #closeWorkspaceRelays(workspace, workspaceId, workspaceOwner, workspaceOwnerId, signal) {
+    const parsedWorkspace = parseNativeWorkspaceRef(workspace);
+    const requestedWorkspaceKey = canonicalWorkspaceKey(workspace);
+    const workspaceKey = canonicalWorkspaceKey(workspace, workspaceOwner);
+    const workspaceKeys = /* @__PURE__ */ new Set([requestedWorkspaceKey, workspaceKey]);
+    const meWorkspaceKey = `me/${parsedWorkspace.name}`;
+    const setups = [...new Set(this.#relays.values())];
+    const hasUnresolvedMeSetup = setups.some(
+      (setup) => setup.workspaceId === void 0 && setup.workspaceKey === meWorkspaceKey
+    );
+    if (parsedWorkspace.owner !== "me" && workspaceOwnerId !== void 0 && hasUnresolvedMeSetup && await waitWithAbort2(this.#api.currentUserId(signal), signal) === workspaceOwnerId) {
+      workspaceKeys.add(meWorkspaceKey);
+    }
+    const entries = setups.filter(
+      (setup) => workspaceKeys.has(setup.workspaceKey) || workspaceId !== void 0 && setup.workspaceId === workspaceId
+    );
+    const error = new Error(`Coder native relay closed for workspace "${workspace}" lifecycle`);
+    for (const setup of entries) {
+      this.#removeRelaySetup(setup);
+      setup.controller.abort(error);
+    }
+    const closing = Promise.allSettled(entries.map((setup) => setup.promise)).then(
+      async (settled) => await Promise.all(
+        settled.filter(
+          (result) => result.status === "fulfilled"
+        ).map((result) => result.value.relay.close())
+      )
+    );
+    await waitWithAbort2(closing, signal);
+  }
+  #removeRelaySetup(setup) {
+    for (const [key, candidate] of this.#relays) {
+      if (candidate === setup) this.#relays.delete(key);
+    }
+  }
+};
+function relayReferenceKey(workspace) {
+  return `reference:${workspace}`;
+}
+function relayAgentKey(workspaceId, agentId) {
+  return `agent:${workspaceId}:${agentId}`;
+}
+function canonicalWorkspaceKey(workspace, resolvedOwner) {
+  const { owner, name } = parseNativeWorkspaceRef(workspace);
+  return `${resolvedOwner ?? owner}/${name}`;
+}
+async function drain(stream) {
+  const reader = stream.getReader();
+  const chunks = [];
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value !== void 0) chunks.push(value);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function waitWithAbort2(promise, signal) {
+  if (signal === void 0) return await promise;
+  if (signal.aborted) throw abortError2(signal);
+  let onAbort;
+  const aborted = new Promise((_resolve, reject) => {
+    onAbort = () => reject(abortError2(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([promise, aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+function abortError2(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  return new DOMException("The operation was aborted", "AbortError");
+}
+
 // src/coder-workspace-provider.ts
 import { createHash } from "crypto";
-import { setTimeout as delay } from "timers/promises";
+import { setTimeout as delay2 } from "timers/promises";
 
 // src/file-io.ts
 import path from "path";
@@ -522,7 +2608,7 @@ async function readBinaryFile(ctx, options) {
   const base64 = result.stdout.replace(/\s+/g, "");
   return new Uint8Array(Buffer.from(base64, "base64"));
 }
-async function readFile(ctx, options) {
+async function readFile2(ctx, options) {
   const bytes = await readBinaryFile(ctx, options);
   if (bytes === null) return null;
   return new ReadableStream({
@@ -648,7 +2734,7 @@ var CoderWorkspaceSession = class {
     this.#ports = [...config.ports];
     this.id = config.id;
     this.defaultWorkingDirectory = config.defaultWorkingDirectory;
-    this.description = `Coder workspace "${config.workspace}". Default working directory: ${config.defaultWorkingDirectory}. Exposed ports: ${this.#ports.length > 0 ? this.#ports.join(", ") : "none"}. Commands run inside the workspace via 'coder ssh'.`;
+    this.description = `Coder workspace "${config.workspace}". Default working directory: ${config.defaultWorkingDirectory}. Exposed ports: ${this.#ports.length > 0 ? this.#ports.join(", ") : "none"}.`;
   }
   get ports() {
     return this.#ports;
@@ -673,14 +2759,14 @@ var CoderWorkspaceSession = class {
   run = (options) => this.#transport.exec(this.#execOptions(options));
   spawn = async (options) => this.#transport.spawn(this.#execOptions(options));
   // --- file I/O surface -----------------------------------------------------
-  readFile = (options) => readFile(this.#fileIoContext(), options);
+  readFile = (options) => readFile2(this.#fileIoContext(), options);
   readBinaryFile = (options) => readBinaryFile(this.#fileIoContext(), options);
   readTextFile = (options) => readTextFile(this.#fileIoContext(), options);
   writeFile = (options) => writeFile(this.#fileIoContext(), options);
   writeBinaryFile = (options) => writeBinaryFile(this.#fileIoContext(), options);
   writeTextFile = (options) => writeTextFile(this.#fileIoContext(), options);
   // --- network surface ------------------------------------------------------
-  getPortUrl = async (options) => {
+  getPortEndpoint = async (options) => {
     if (this.#stopped) {
       throw new Error("cannot resolve a port URL: the sandbox session is stopped");
     }
@@ -704,8 +2790,10 @@ var CoderWorkspaceSession = class {
     }
     const resolved = await forward;
     const scheme = localScheme(options.protocol ?? "ws");
-    return `${scheme}://${resolved.localHost}:${resolved.localPort}`;
+    return { url: `${scheme}://${resolved.localHost}:${resolved.localPort}` };
   };
+  /** @deprecated Kept for the `HarnessV1NetworkSandboxSession` contract; use `getPortEndpoint`. */
+  getPortUrl = async (options) => (await this.getPortEndpoint(options)).url;
   setPorts = async (ports, _options) => {
     const next = [...ports];
     for (const [port, forward] of this.#forwards) {
@@ -970,7 +3058,7 @@ async function waitForReady(transport, workspace, timeoutMs, caller, abortSignal
         `${caller}: timed out after ${timeoutMs}ms waiting for workspace "${workspace}" to become ready (last status: ${last}).`
       );
     }
-    await delay(READY_POLL_INTERVAL_MS, void 0, { signal: abortSignal });
+    await delay2(READY_POLL_INTERVAL_MS, void 0, { signal: abortSignal });
   }
 }
 function deriveWorkspaceName(prefix, sessionId) {
@@ -1004,6 +3092,8 @@ async function resolveHomeDirectory(transport, workspace, abortSignal) {
 export {
   CODER_WORKSPACE_PROVIDER_ID,
   CoderCliTransport,
+  CoderNativeApiError,
+  CoderNativeTransport,
   CoderWorkspaceSession,
   createCoderWorkspace,
   ensureCoderWorkspace