@introspection-ai/recipes 0.19.2 → 0.20.0

package/dist/mcp-chunks/chunk-XRRT3SZM.js

@@ -0,0 +1,1931 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  resolveCommandArgument,
+  resolveCommandArguments
+} from "./chunk-LYZRCACV.js";
+import {
+  parseTree
+} from "./chunk-5HQYKAE7.js";
+import {
+  resolveEnvValue
+} from "./chunk-DIIFWDZ7.js";
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay.js
+import { createHash as createHash4 } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-command.js
+var AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--autoConnect", "--auto-connect"]);
+var NEGATED_AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--no-autoConnect", "--no-auto-connect"]);
+var CONNECTION_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--browserUrl",
+  "--browser-url",
+  "--channel",
+  "--executablePath",
+  "--executable-path",
+  "--userDataDir",
+  "--user-data-dir",
+  "--wsEndpoint",
+  "--ws-endpoint",
+  "--wsHeaders",
+  "--ws-headers",
+  "-e",
+  "-u",
+  "-w"
+]);
+var NPX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+  "--cache",
+  "--package",
+  "--prefix",
+  "--registry",
+  "--userconfig",
+  "--workspace",
+  "-p",
+  "-w"
+]);
+var NPX_COMMAND_STRING_OPTIONS = /* @__PURE__ */ new Set(["--call", "-c"]);
+var NPX_NO_VALUE_OPTIONS = /* @__PURE__ */ new Set(["--ignore-existing", "--no-install", "--quiet", "--silent", "--yes", "-y"]);
+var COMMON_WRAPPERS = /* @__PURE__ */ new Set([
+  "ash",
+  "bash",
+  "csh",
+  "dash",
+  "cmd",
+  "doas",
+  "env",
+  "fish",
+  "ksh",
+  "mksh",
+  "node",
+  "npm",
+  "npx",
+  "bunx",
+  "pnpm",
+  "powershell",
+  "pwsh",
+  "sh",
+  "sudo",
+  "tcsh",
+  "yarn",
+  "zsh"
+]);
+function isChromeDevtoolsToken(token) {
+  const normalized = token.replaceAll("\\", "/").toLowerCase();
+  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return /^chrome-devtools-mcp(?:@[^/]+)?(?:\.(?:bat|cjs|cmd|exe|js|mjs))?$/u.test(basename) || normalized.includes("/chrome-devtools-mcp/") && /\.(?:bat|cjs|cmd|exe|js|mjs)$/u.test(basename);
+}
+function isAmbiguousChromeDevtoolsAutoConnectCommand(command, args) {
+  if (isChromeDevtoolsToken(command))
+    return false;
+  if (isSupportedPackageLauncher(command)) {
+    const target = findPackageLauncherTarget(args);
+    if (!target)
+      return false;
+    if (target.ambiguous)
+      return true;
+    const nestedTarget = commandBasename(args[target.index] ?? "");
+    return COMMON_WRAPPERS.has(nestedTarget) && containsChromeAutoConnectInvocation(args.slice(target.index + 1));
+  }
+  const launcher = commandBasename(command);
+  if (COMMON_WRAPPERS.has(launcher))
+    return containsChromeAutoConnectInvocation(args);
+  const scopedArgs = args.slice(0, optionTerminator(args));
+  const tokenIndex = scopedArgs.findIndex(isChromeDevtoolsToken);
+  return tokenIndex >= 0 && parseChromeDevtoolsAutoConnectArgs(scopedArgs.slice(tokenIndex + 1)).enabled;
+}
+function resolveChromeDevtoolsAutoConnectCommand(command, args) {
+  const target = resolveChromeDevtoolsTarget(command, args);
+  if (!target)
+    return { enabled: false, withoutAutoConnect: args };
+  const parsed = parseChromeDevtoolsAutoConnectArgs(target.args);
+  return {
+    enabled: parsed.enabled,
+    withoutAutoConnect: [...target.prefix, ...parsed.withoutAutoConnect]
+  };
+}
+function replaceChromeDevtoolsAutoConnectArgs(command, args, replacement) {
+  const target = resolveChromeDevtoolsTarget(command, args);
+  if (!target)
+    return args;
+  const parsed = parseChromeDevtoolsAutoConnectArgs(target.args);
+  const stripped = stripConnectionSelectionArgs(parsed.withoutAutoConnect);
+  const targetArgs = [...stripped.args];
+  targetArgs.splice(stripped.insertionIndex, 0, ...replacement);
+  return [...target.prefix, ...targetArgs];
+}
+function resolveChromeDevtoolsTarget(command, args) {
+  if (isChromeDevtoolsToken(command))
+    return { prefix: [], args };
+  if (!isSupportedPackageLauncher(command))
+    return void 0;
+  const target = findPackageLauncherTarget(args);
+  if (!target || target.ambiguous || !isChromeDevtoolsToken(args[target.index] ?? ""))
+    return void 0;
+  const separatorIndex = target.index + 1;
+  const consumesSeparator = target.consumePostTargetSeparator && args[separatorIndex] === "--";
+  const targetStart = consumesSeparator ? separatorIndex + 1 : separatorIndex;
+  return { prefix: args.slice(0, targetStart), args: args.slice(targetStart) };
+}
+function findPackageLauncherTarget(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      return index + 1 < args.length ? { index: index + 1, ambiguous: false, consumePostTargetSeparator: false } : void 0;
+    }
+    if (arg.startsWith("--call=")) {
+      const value = arg.slice("--call=".length);
+      return containsInlineChromeAutoConnect([value]) ? { index, ambiguous: true, consumePostTargetSeparator: false } : void 0;
+    }
+    if (NPX_COMMAND_STRING_OPTIONS.has(arg)) {
+      const value = args[index + 1] ?? "";
+      return containsInlineChromeAutoConnect([value]) ? { index: index + 1, ambiguous: true, consumePostTargetSeparator: false } : void 0;
+    }
+    if (NPX_VALUE_OPTIONS.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if (NPX_NO_VALUE_OPTIONS.has(arg) || /^--[^=]+=.+/u.test(arg))
+      continue;
+    if (arg.startsWith("-")) {
+      return {
+        index,
+        ambiguous: containsChromeAutoConnectInvocation(args.slice(index)),
+        consumePostTargetSeparator: false
+      };
+    }
+    return { index, ambiguous: false, consumePostTargetSeparator: true };
+  }
+  return void 0;
+}
+function isSupportedPackageLauncher(command) {
+  const launcher = commandBasename(command);
+  return launcher === "npx" || launcher === "bunx";
+}
+function containsChromeAutoConnectInvocation(args) {
+  const tokenIndex = args.findIndex(isChromeDevtoolsToken);
+  if (tokenIndex >= 0)
+    return parseChromeDevtoolsAutoConnectArgs(args.slice(tokenIndex + 1)).enabled;
+  return containsInlineChromeAutoConnect(args);
+}
+function containsInlineChromeAutoConnect(args) {
+  const rendered = args.join(" ").toLowerCase();
+  return rendered.includes("chrome-devtools-mcp") && /--(?:auto-connect|autoconnect)(?:=true)?(?:[;'"&|)\]}]|\s|$)/u.test(rendered);
+}
+function commandBasename(command) {
+  const normalized = command.replaceAll("\\", "/").toLowerCase();
+  return normalized.slice(normalized.lastIndexOf("/") + 1).replace(/\.(?:cmd|exe)$/u, "");
+}
+function optionTerminator(args) {
+  const index = args.indexOf("--");
+  return index >= 0 ? index : args.length;
+}
+function stripConnectionSelectionArgs(args) {
+  const result = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      result.push(...args.slice(index));
+      break;
+    }
+    if (CONNECTION_VALUE_FLAGS.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if ([...CONNECTION_VALUE_FLAGS].some((flag) => arg.startsWith(`${flag}=`)))
+      continue;
+    result.push(arg);
+  }
+  const terminatorIndex = result.indexOf("--");
+  return { args: result, insertionIndex: terminatorIndex >= 0 ? terminatorIndex : result.length };
+}
+function parseChromeDevtoolsAutoConnectArgs(args) {
+  const consumed = /* @__PURE__ */ new Set();
+  let enabled = false;
+  let sawOption = false;
+  let terminatorIndex = args.length;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      terminatorIndex = index;
+      break;
+    }
+    if (NEGATED_AUTO_CONNECT_FLAGS.has(arg)) {
+      sawOption = true;
+      enabled = false;
+      consumed.add(index);
+      continue;
+    }
+    let matchedNegatedInline = false;
+    for (const flag of NEGATED_AUTO_CONNECT_FLAGS) {
+      if (!arg.startsWith(`${flag}=`))
+        continue;
+      sawOption = true;
+      enabled = false;
+      consumed.add(index);
+      matchedNegatedInline = true;
+      break;
+    }
+    if (matchedNegatedInline)
+      continue;
+    if (AUTO_CONNECT_FLAGS.has(arg)) {
+      sawOption = true;
+      consumed.add(index);
+      const pairedValue = booleanLiteral(args[index + 1]);
+      if (pairedValue !== void 0) {
+        enabled = pairedValue;
+        consumed.add(index + 1);
+        index += 1;
+      } else {
+        enabled = true;
+      }
+      continue;
+    }
+    for (const flag of AUTO_CONNECT_FLAGS) {
+      if (!arg.startsWith(`${flag}=`))
+        continue;
+      sawOption = true;
+      enabled = arg.slice(flag.length + 1) === "true";
+      consumed.add(index);
+      break;
+    }
+  }
+  const withoutAutoConnect = args.filter((_arg, index) => !consumed.has(index));
+  let insertionIndex = 0;
+  for (let index = 0; index < terminatorIndex; index += 1) {
+    if (!consumed.has(index))
+      insertionIndex += 1;
+  }
+  return { enabled: sawOption && enabled, withoutAutoConnect, insertionIndex };
+}
+function booleanLiteral(value) {
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  return void 0;
+}
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay-proxy.js
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import http, {} from "node:http";
+var WEBSOCKET_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+async function startChromeDevtoolsRelayProxy(options) {
+  const sockets = /* @__PURE__ */ new Set();
+  const clientAuthorization = `Bearer ${randomBytes(32).toString("base64url")}`;
+  let downstreamAccepted = false;
+  let closed = false;
+  const server = http.createServer((_request, response) => {
+    response.writeHead(404, { Connection: "close", "Content-Length": "0" }).end();
+  });
+  server.on("connection", (socket) => trackSocket(sockets, socket));
+  server.on("upgrade", (request, downstream, head) => {
+    if (closed || downstreamAccepted || !isValidDownstreamUpgrade(request, clientAuthorization) || options.upstream.socket.destroyed) {
+      downstream.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+      return;
+    }
+    downstreamAccepted = true;
+    const key = request.headers["sec-websocket-key"];
+    if (typeof key !== "string") {
+      downstream.destroy();
+      return;
+    }
+    const accept = createHash("sha1").update(`${key}${WEBSOCKET_GUID}`).digest("base64");
+    downstream.write([
+      "HTTP/1.1 101 Switching Protocols",
+      "Connection: Upgrade",
+      "Upgrade: websocket",
+      `Sec-WebSocket-Accept: ${accept}`,
+      "",
+      ""
+    ].join("\r\n"));
+    if (options.upstream.head.length > 0)
+      downstream.write(options.upstream.head);
+    if (head.length > 0)
+      options.upstream.socket.write(head);
+    options.upstream.socket.once("error", () => downstream.destroy());
+    options.upstream.socket.once("close", () => downstream.destroy());
+    downstream.once("error", () => options.upstream.socket.destroy());
+    downstream.once("close", () => options.upstream.socket.destroy());
+    downstream.pipe(options.upstream.socket).pipe(downstream);
+    server.close();
+  });
+  const onUpstreamClose = () => {
+    void closeServer(server, sockets);
+  };
+  options.upstream.socket.once("close", onUpstreamClose);
+  try {
+    await new Promise((resolve, reject) => {
+      const onError = (error) => reject(error);
+      server.once("error", onError);
+      server.listen(0, "127.0.0.1", () => {
+        server.off("error", onError);
+        resolve();
+      });
+    });
+  } catch (error) {
+    closeUpstream(options.upstream.socket);
+    throw error;
+  }
+  const address = server.address();
+  if (!address || address.address !== "127.0.0.1") {
+    closeUpstream(options.upstream.socket);
+    server.close();
+    throw new Error("Chrome relay proxy failed to bind to IPv4 loopback.");
+  }
+  let authorizationAvailable = true;
+  return {
+    endpoint: `ws://127.0.0.1:${address.port}/cdp`,
+    consumeClientAuthorization() {
+      if (!authorizationAvailable)
+        throw new Error("Chrome relay authorization handoff already consumed.");
+      authorizationAvailable = false;
+      return clientAuthorization;
+    },
+    async close() {
+      if (closed)
+        return;
+      closed = true;
+      options.upstream.socket.off("close", onUpstreamClose);
+      closeUpstream(options.upstream.socket);
+      await closeServer(server, sockets);
+    }
+  };
+}
+function isValidDownstreamUpgrade(request, expectedAuthorization) {
+  if (request.url !== "/cdp" || request.method !== "GET" || request.headers.upgrade?.toLowerCase() !== "websocket" || !hasToken(request.headers.connection, "upgrade") || request.headers["sec-websocket-version"] !== "13" || countRawHeader(request, "authorization") !== 1 || countRawHeader(request, "sec-websocket-key") !== 1 || !safeHeaderEqual(request.headers.authorization, expectedAuthorization)) {
+    return false;
+  }
+  const key = request.headers["sec-websocket-key"];
+  if (typeof key !== "string" || !/^[A-Za-z0-9+/]{22}==$/u.test(key))
+    return false;
+  const decoded = Buffer.from(key, "base64");
+  return decoded.byteLength === 16 && decoded.toString("base64") === key;
+}
+function countRawHeader(request, expectedName) {
+  let count = 0;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() === expectedName)
+      count += 1;
+  }
+  return count;
+}
+function safeHeaderEqual(actual, expected) {
+  if (!actual)
+    return false;
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes);
+}
+function hasToken(value, expected) {
+  return Boolean(value?.split(",").some((token) => token.trim().toLowerCase() === expected));
+}
+function trackSocket(sockets, socket) {
+  if (sockets.has(socket))
+    return;
+  sockets.add(socket);
+  socket.once("close", () => sockets.delete(socket));
+}
+function closeUpstream(socket) {
+  if (socket.destroyed)
+    return;
+  if (!socket.remoteAddress) {
+    socket.destroy();
+    return;
+  }
+  try {
+    socket.resetAndDestroy();
+  } catch {
+    socket.destroy();
+  }
+}
+async function closeServer(server, sockets) {
+  for (const socket of sockets)
+    socket.destroy();
+  if (!server.listening)
+    return;
+  await new Promise((resolve) => server.close(() => resolve()));
+}
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/browser-relay-auth-v2.js
+import { createHash as createHash2, createHmac, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var BROWSER_RELAY_AUTH_LABEL = "openclaw.browser-relay.auth";
+var BROWSER_RELAY_AUTH_VERSION = 2;
+var BROWSER_RELAY_CHALLENGE_MAX_LIFETIME_MS = 1e4;
+var BROWSER_RELAY_CLOCK_SKEW_MS = 3e4;
+var BROWSER_RELAY_AUTH_CHALLENGE_PATH = "/_openclaw/relay/auth/v2/challenge";
+var BROWSER_RELAY_AUTH_COMPLETE_PATH = "/_openclaw/relay/auth/v2/complete";
+var BROWSER_RELAY_CDP_PATH = "/cdp";
+var BROWSER_RELAY_CDP_ROLE = "cdp";
+var BROWSER_RELAY_CDP_TRANSPORT = "connection";
+var BROWSER_RELAY_CDP_METHOD = "SEQUENCE";
+var BROWSER_RELAY_CDP_RESOURCE = "/json/version -> /cdp";
+var BROWSER_RELAY_CDP_FLOW = "cdp";
+var BROWSER_RELAY_VERSION_PATH = "/json/version";
+function deriveBrowserRelayKeyId(key) {
+  assertRelayKey(key);
+  return createHash2("sha256").update(key).digest("base64url").slice(0, 22);
+}
+function canonicalizeBrowserRelayProof(proofKind, fields, clientProof) {
+  const canonical = [
+    BROWSER_RELAY_AUTH_LABEL,
+    BROWSER_RELAY_AUTH_VERSION,
+    proofKind,
+    fields.keyId,
+    fields.instanceId,
+    fields.sessionId,
+    fields.clientNonce,
+    fields.serverNonce,
+    fields.issuedAtMs,
+    fields.expiresAtMs,
+    fields.role,
+    fields.transport,
+    fields.method,
+    fields.resource,
+    fields.flow
+  ];
+  if (proofKind === "accept") {
+    if (!clientProof || !isCanonicalBase64Url(clientProof, 32)) {
+      throw new Error("Browser relay accept proof requires a 32-byte client proof.");
+    }
+    canonical.push(clientProof);
+  } else if (clientProof !== void 0) {
+    throw new Error("Browser relay client proof is only valid for an accept proof.");
+  }
+  return Buffer.from(JSON.stringify(canonical), "utf8");
+}
+function createBrowserRelayProof(key, proofKind, fields, clientProof) {
+  assertRelayKey(key);
+  return createHmac("sha256", key).update(canonicalizeBrowserRelayProof(proofKind, fields, clientProof)).digest("base64url");
+}
+function verifyBrowserRelayProof(key, proofKind, fields, proof, clientProof) {
+  if (!isCanonicalBase64Url(proof, 32))
+    return false;
+  const actual = Buffer.from(proof, "base64url");
+  const expected = Buffer.from(createBrowserRelayProof(key, proofKind, fields, clientProof), "base64url");
+  return actual.byteLength === expected.byteLength && timingSafeEqual2(actual, expected);
+}
+function assertRelayKey(key) {
+  if (key.byteLength !== 32)
+    throw new Error("Browser relay key must contain 32 bytes.");
+}
+function isCanonicalBase64Url(value, bytes) {
+  if (!/^[A-Za-z0-9_-]+$/u.test(value))
+    return false;
+  const decoded = Buffer.from(value, "base64url");
+  return decoded.byteLength === bytes && decoded.toString("base64url") === value;
+}
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay-client.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import net from "node:net";
+import { TextDecoder } from "node:util";
+var MAX_HEADER_BYTES = 16 * 1024;
+var MAX_JSON_BYTES = 64 * 1024;
+var WEBSOCKET_GUID2 = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var RelayV2Error = class extends Error {
+  reason;
+  status;
+  constructor(reason, status) {
+    super(`Chrome relay authentication failed (${reason}).`);
+    this.reason = reason;
+    this.status = status;
+    this.name = "RelayV2Error";
+  }
+};
+async function connectChromeDevtoolsRelayV2(options) {
+  const startedAt = performance.now();
+  const durationMs = () => Math.max(0, Math.round(performance.now() - startedAt));
+  let socket;
+  let timer;
+  try {
+    let timedOut = false;
+    const timeout = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        const error = new RelayV2Error("timeout");
+        socket?.destroy(error);
+        reject(error);
+      }, options.timeoutMs);
+    });
+    timer?.unref();
+    const addresses = await Promise.race([
+      resolveLoopbackAddresses(options.baseUrl.hostname, options.resolve ?? lookup),
+      timeout
+    ]);
+    const port = resolvePort(options.baseUrl);
+    let lastConnectionError;
+    for (const address of addresses) {
+      socket = net.createConnection({ host: address.address, family: address.family, port });
+      try {
+        await waitForConnect(socket);
+        lastConnectionError = void 0;
+        break;
+      } catch (error) {
+        socket.destroy();
+        if (timedOut || isTimeoutError(error))
+          throw new RelayV2Error("timeout");
+        lastConnectionError = error;
+      }
+    }
+    if (lastConnectionError)
+      throw lastConnectionError;
+    if (!socket || socket.destroyed)
+      throw new RelayV2Error(timedOut ? "timeout" : "network-error");
+    if (!socket.remoteAddress || !isNumericLoopback(socket.remoteAddress))
+      throw new RelayV2Error("protocol");
+    const reader = new SocketReader(socket);
+    const flow = options.flow ?? "cdp";
+    const clientNonce = randomBytes2(32).toString("base64url");
+    const hello = {
+      v: BROWSER_RELAY_AUTH_VERSION,
+      keyId: options.credential.keyId,
+      clientNonce,
+      role: BROWSER_RELAY_CDP_ROLE,
+      transport: BROWSER_RELAY_CDP_TRANSPORT,
+      method: flow === BROWSER_RELAY_CDP_FLOW ? BROWSER_RELAY_CDP_METHOD : "GET",
+      resource: flow === BROWSER_RELAY_CDP_FLOW ? BROWSER_RELAY_CDP_RESOURCE : "/json/list",
+      flow
+    };
+    await writeJsonRequest(socket, options.baseUrl.host, BROWSER_RELAY_AUTH_CHALLENGE_PATH, hello);
+    const challengeResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    ensureAuthStatus(challengeResponse, "challenge");
+    const challenge = parseStrictJsonObject(challengeResponse.body);
+    const fields = validateChallenge(challenge, hello, options.now?.() ?? Date.now());
+    const serverProof = requireString(challenge, "serverProof");
+    if (!verifyBrowserRelayProof(options.credential.key, "server", fields, serverProof)) {
+      throw new RelayV2Error("bad-server-proof");
+    }
+    const clientProof = createBrowserRelayProof(options.credential.key, "client", fields);
+    await writeJsonRequest(socket, options.baseUrl.host, BROWSER_RELAY_AUTH_COMPLETE_PATH, {
+      v: BROWSER_RELAY_AUTH_VERSION,
+      sessionId: fields.sessionId,
+      clientProof
+    });
+    const completeResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    ensureAuthStatus(completeResponse, "complete");
+    const accepted = parseStrictJsonObject(completeResponse.body);
+    validateAccept(accepted, fields.sessionId);
+    if (!verifyBrowserRelayProof(options.credential.key, "accept", fields, requireString(accepted, "acceptProof"), clientProof)) {
+      throw new RelayV2Error("bad-server-proof");
+    }
+    if (flow === "json-list") {
+      await writeRequest(socket, options.baseUrl.host, "GET", "/json/list", []);
+      const listResponse = await reader.readHttpResponse(MAX_JSON_BYTES, true);
+      if (listResponse.status !== 200)
+        throw classifyStatus(listResponse.status, true);
+      const json = parseStrictJson(listResponse.body);
+      if (!Array.isArray(json))
+        throw new RelayV2Error("protocol", 200);
+      socket.destroy();
+      return { reason: "success", durationMs: durationMs(), status: 200, json };
+    }
+    await writeRequest(socket, options.baseUrl.host, "GET", BROWSER_RELAY_VERSION_PATH, []);
+    const versionResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    if (versionResponse.status === 503) {
+      socket.destroy();
+      return { reason: "extension-disconnected", durationMs: durationMs(), status: 503 };
+    }
+    if (versionResponse.status !== 200)
+      throw classifyStatus(versionResponse.status, true);
+    parseStrictJsonObject(versionResponse.body);
+    const websocketKey = randomBytes2(16).toString("base64");
+    await writeRequest(socket, options.baseUrl.host, "GET", BROWSER_RELAY_CDP_PATH, [
+      ["Connection", "Upgrade"],
+      ["Upgrade", "websocket"],
+      ["Sec-WebSocket-Key", websocketKey],
+      ["Sec-WebSocket-Version", "13"]
+    ]);
+    const upgrade = await reader.readHttpUpgrade();
+    if (upgrade.status !== 101)
+      throw classifyStatus(upgrade.status, true);
+    const expectedAccept = createHash3("sha1").update(`${websocketKey}${WEBSOCKET_GUID2}`).digest("base64");
+    if (upgrade.headers.get("upgrade")?.toLowerCase() !== "websocket" || !hasToken2(upgrade.headers.get("connection"), "upgrade") || upgrade.headers.get("sec-websocket-accept") !== expectedAccept) {
+      throw new RelayV2Error("sequence", 101);
+    }
+    const head = reader.release();
+    if (timer)
+      clearTimeout(timer);
+    return { reason: "success", durationMs: durationMs(), status: 200, upstream: { socket, head } };
+  } catch (error) {
+    socket?.destroy();
+    if (error instanceof RelayV2Error) {
+      return { reason: error.reason, durationMs: durationMs(), status: error.status };
+    }
+    return { reason: isTimeoutError(error) ? "timeout" : "network-error", durationMs: durationMs() };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+async function resolveLoopbackAddresses(hostname, resolver) {
+  const normalized = hostname.replace(/^\[(.*)\]$/u, "$1");
+  const addresses = await resolver(normalized, { all: true, verbatim: true });
+  if (addresses.length === 0 || addresses.some((address) => !isNumericLoopback(address.address))) {
+    throw new RelayV2Error("protocol");
+  }
+  return addresses;
+}
+function resolvePort(url) {
+  const port = url.port === "" ? 80 : Number(url.port);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+    throw new RelayV2Error("protocol");
+  return port;
+}
+function isNumericLoopback(address) {
+  if (net.isIPv4(address))
+    return address.startsWith("127.");
+  if (!net.isIPv6(address))
+    return false;
+  const normalized = address.toLowerCase();
+  return normalized === "::1" || normalized.startsWith("::ffff:127.");
+}
+async function waitForConnect(socket) {
+  await new Promise((resolve, reject) => {
+    const onConnect = () => {
+      cleanup();
+      resolve();
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const cleanup = () => {
+      socket.off("connect", onConnect);
+      socket.off("error", onError);
+    };
+    socket.once("connect", onConnect);
+    socket.once("error", onError);
+  });
+}
+var SocketReader = class {
+  socket;
+  buffered = Buffer.alloc(0);
+  failure;
+  ended = false;
+  onData = (chunk) => {
+    this.buffered = Buffer.concat([this.buffered, chunk]);
+  };
+  onError = (error) => {
+    this.failure = error;
+  };
+  onClose = () => {
+    this.ended = true;
+  };
+  constructor(socket) {
+    this.socket = socket;
+    socket.on("data", this.onData);
+    socket.on("error", this.onError);
+    socket.on("close", this.onClose);
+  }
+  async readHttpResponse(maxBodyBytes, allowConnectionClose = false) {
+    const parsed = await this.readHeaders();
+    if (parsed.status === 101)
+      throw new RelayV2Error("protocol", 101);
+    if (parsed.headers.has("transfer-encoding"))
+      throw new RelayV2Error("protocol", parsed.status);
+    if (!allowConnectionClose && parsed.status === 200 && hasToken2(parsed.headers.get("connection"), "close")) {
+      throw new RelayV2Error("protocol", parsed.status);
+    }
+    const rawLength = parsed.headers.get("content-length");
+    if (!rawLength || !/^\d+$/u.test(rawLength))
+      throw new RelayV2Error("protocol", parsed.status);
+    const length = Number(rawLength);
+    if (!Number.isSafeInteger(length) || length > maxBodyBytes)
+      throw new RelayV2Error("protocol", parsed.status);
+    await this.waitForBytes(length);
+    const body = this.buffered.subarray(0, length);
+    this.buffered = this.buffered.subarray(length);
+    if (this.buffered.length > 0)
+      throw new RelayV2Error("protocol", parsed.status);
+    return { ...parsed, body };
+  }
+  async readHttpUpgrade() {
+    const parsed = await this.readHeaders();
+    if (parsed.headers.has("transfer-encoding"))
+      throw new RelayV2Error("protocol", parsed.status);
+    if (parsed.status === 101) {
+      if (parsed.headers.has("content-length"))
+        throw new RelayV2Error("protocol", parsed.status);
+      return { ...parsed, body: Buffer.alloc(0) };
+    }
+    const rawLength = parsed.headers.get("content-length");
+    if (!rawLength || !/^\d+$/u.test(rawLength))
+      throw new RelayV2Error("protocol", parsed.status);
+    const length = Number(rawLength);
+    if (!Number.isSafeInteger(length) || length > MAX_JSON_BYTES)
+      throw new RelayV2Error("protocol", parsed.status);
+    await this.waitForBytes(length);
+    const body = this.buffered.subarray(0, length);
+    this.buffered = this.buffered.subarray(length);
+    if (this.buffered.length > 0)
+      throw new RelayV2Error("protocol", parsed.status);
+    return { ...parsed, body };
+  }
+  release() {
+    this.socket.off("data", this.onData);
+    this.socket.off("error", this.onError);
+    this.socket.off("close", this.onClose);
+    const head = this.buffered;
+    this.buffered = Buffer.alloc(0);
+    return head;
+  }
+  async readHeaders() {
+    let boundary = this.buffered.indexOf("\r\n\r\n");
+    while (boundary < 0) {
+      if (this.buffered.length > MAX_HEADER_BYTES)
+        throw new RelayV2Error("protocol");
+      await this.waitForData();
+      boundary = this.buffered.indexOf("\r\n\r\n");
+    }
+    if (boundary > MAX_HEADER_BYTES)
+      throw new RelayV2Error("protocol");
+    const raw = this.buffered.subarray(0, boundary).toString("latin1");
+    this.buffered = this.buffered.subarray(boundary + 4);
+    const lines = raw.split("\r\n");
+    const statusLine = lines.shift();
+    const match = /^HTTP\/1\.1 ([1-5]\d\d)(?: [\x20-\x7e]*)?$/u.exec(statusLine ?? "");
+    if (!match)
+      throw new RelayV2Error("protocol");
+    const status = Number(match[1]);
+    const headers = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      if (/^[ \t]/u.test(line))
+        throw new RelayV2Error("protocol", status);
+      const separator = line.indexOf(":");
+      if (separator <= 0)
+        throw new RelayV2Error("protocol", status);
+      const name = line.slice(0, separator).toLowerCase();
+      const value = line.slice(separator + 1).trim();
+      if (!/^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(name) || value.includes("\0") || value.includes("\r") || value.includes("\n") || value.includes("\x7F")) {
+        throw new RelayV2Error("protocol", status);
+      }
+      if (headers.has(name))
+        throw new RelayV2Error("protocol", status);
+      headers.set(name, value);
+    }
+    return { status, headers };
+  }
+  async waitForBytes(length) {
+    while (this.buffered.length < length)
+      await this.waitForData();
+  }
+  async waitForData() {
+    if (this.failure)
+      throw this.failure;
+    if (this.ended)
+      throw new RelayV2Error("network-error");
+    await new Promise((resolve, reject) => {
+      const onData = () => {
+        cleanup();
+        resolve();
+      };
+      const onError = (error) => {
+        cleanup();
+        reject(error);
+      };
+      const onClose = () => {
+        cleanup();
+        reject(new RelayV2Error("network-error"));
+      };
+      const cleanup = () => {
+        this.socket.off("data", onData);
+        this.socket.off("error", onError);
+        this.socket.off("close", onClose);
+      };
+      this.socket.once("data", onData);
+      this.socket.once("error", onError);
+      this.socket.once("close", onClose);
+    });
+  }
+};
+async function writeJsonRequest(socket, host, pathname, body) {
+  const encoded = Buffer.from(JSON.stringify(body), "utf8");
+  await writeRequest(socket, host, "POST", pathname, [
+    ["Content-Type", "application/json"],
+    ["Content-Length", String(encoded.byteLength)]
+  ], encoded);
+}
+async function writeRequest(socket, host, method, pathname, headers, body) {
+  const lines = [`${method} ${pathname} HTTP/1.1`, `Host: ${host}`, "Connection: keep-alive"];
+  for (const [name, value] of headers) {
+    if (name.toLowerCase() === "connection")
+      lines[2] = `${name}: ${value}`;
+    else
+      lines.push(`${name}: ${value}`);
+  }
+  const head = Buffer.from(`${lines.join("\r\n")}\r
+\r
+`, "ascii");
+  const output = body ? Buffer.concat([head, body]) : head;
+  await new Promise((resolve, reject) => {
+    socket.write(output, (error) => error ? reject(error) : resolve());
+  });
+}
+function ensureAuthStatus(response, phase) {
+  if (response.status === 200)
+    return;
+  if (phase === "challenge" && response.status === 401 && responseError(response) === "Relay auth challenge rejected") {
+    throw new RelayV2Error("replay", response.status);
+  }
+  if (response.status === 409)
+    throw new RelayV2Error("sequence", response.status);
+  throw classifyStatus(response.status, false);
+}
+function classifyStatus(status, authenticated) {
+  if (!authenticated && (status === 401 || status === 404 || status === 426)) {
+    return new RelayV2Error("unsupported-auth", status);
+  }
+  if (!authenticated && status === 503)
+    return new RelayV2Error("server-auth-failed", status);
+  if (status === 408 || status === 410)
+    return new RelayV2Error("freshness", status);
+  if (status === 409)
+    return new RelayV2Error("sequence", status);
+  if (status === 412)
+    return new RelayV2Error("sequence", status);
+  return new RelayV2Error("protocol", status);
+}
+function responseError(response) {
+  try {
+    const value = parseStrictJsonObject(response.body);
+    return typeof value.error === "string" ? value.error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validateChallenge(value, hello, nowMs) {
+  assertExactKeys(value, [
+    "type",
+    "v",
+    "keyId",
+    "instanceId",
+    "sessionId",
+    "clientNonce",
+    "serverNonce",
+    "issuedAtMs",
+    "expiresAtMs",
+    "role",
+    "transport",
+    "method",
+    "resource",
+    "flow",
+    "serverProof"
+  ]);
+  if (value.type !== "auth.challenge")
+    throw new RelayV2Error("protocol");
+  if (value.v !== BROWSER_RELAY_AUTH_VERSION)
+    throw new RelayV2Error("protocol");
+  for (const key of ["keyId", "clientNonce", "role", "transport", "method", "resource", "flow"]) {
+    if (value[key] !== hello[key])
+      throw new RelayV2Error("protocol");
+  }
+  const fields = {
+    keyId: requireToken(value, "keyId", 22),
+    instanceId: requireEncoded(value, "instanceId", 22),
+    sessionId: requireEncoded(value, "sessionId", 22),
+    clientNonce: requireEncoded(value, "clientNonce", 43),
+    serverNonce: requireEncoded(value, "serverNonce", 43),
+    issuedAtMs: requireInteger(value, "issuedAtMs"),
+    expiresAtMs: requireInteger(value, "expiresAtMs"),
+    role: requireString(value, "role"),
+    transport: requireString(value, "transport"),
+    method: requireString(value, "method"),
+    resource: requireString(value, "resource"),
+    flow: requireString(value, "flow")
+  };
+  requireEncoded(value, "serverProof", 43);
+  const lifetime = fields.expiresAtMs - fields.issuedAtMs;
+  if (lifetime <= 0 || lifetime > BROWSER_RELAY_CHALLENGE_MAX_LIFETIME_MS || fields.issuedAtMs - nowMs > BROWSER_RELAY_CLOCK_SKEW_MS || nowMs > fields.expiresAtMs) {
+    throw new RelayV2Error("freshness");
+  }
+  return fields;
+}
+function validateAccept(value, sessionId) {
+  assertExactKeys(value, ["type", "v", "sessionId", "acceptProof"]);
+  if (value.type !== "auth.ok")
+    throw new RelayV2Error("protocol");
+  if (value.v !== BROWSER_RELAY_AUTH_VERSION || value.sessionId !== sessionId)
+    throw new RelayV2Error("protocol");
+  requireEncoded(value, "acceptProof", 43);
+}
+function parseStrictJsonObject(body) {
+  const value = parseStrictJson(body);
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new RelayV2Error("protocol");
+  return value;
+}
+function parseStrictJson(body) {
+  let source;
+  try {
+    source = new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    throw new RelayV2Error("protocol");
+  }
+  const errors = [];
+  const tree = parseTree(source, errors, { allowTrailingComma: false, disallowComments: true });
+  if (!tree || errors.length > 0)
+    throw new RelayV2Error("protocol");
+  rejectDuplicateJsonKeys(tree);
+  try {
+    return JSON.parse(source);
+  } catch {
+    throw new RelayV2Error("protocol");
+  }
+}
+function rejectDuplicateJsonKeys(node) {
+  if (node.type === "object") {
+    const keys = /* @__PURE__ */ new Set();
+    for (const property of node.children ?? []) {
+      const key = property.children?.[0]?.value;
+      if (typeof key !== "string" || keys.has(key))
+        throw new RelayV2Error("protocol");
+      keys.add(key);
+    }
+  }
+  for (const child of node.children ?? [])
+    rejectDuplicateJsonKeys(child);
+}
+function assertExactKeys(value, required) {
+  const actual = Object.keys(value);
+  if (actual.length !== required.length || required.some((key) => !Object.hasOwn(value, key))) {
+    throw new RelayV2Error("protocol");
+  }
+}
+function requireString(value, key) {
+  const field = value[key];
+  if (typeof field !== "string")
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function requireEncoded(value, key, length) {
+  const field = requireString(value, key);
+  const bytes = length === 22 ? 16 : length === 43 ? 32 : 0;
+  const decoded = Buffer.from(field, "base64url");
+  if (bytes === 0 || field.length !== length || !/^[A-Za-z0-9_-]+$/u.test(field) || decoded.byteLength !== bytes || decoded.toString("base64url") !== field) {
+    throw new RelayV2Error("protocol");
+  }
+  return field;
+}
+function requireToken(value, key, length) {
+  const field = requireString(value, key);
+  if (field.length !== length || !/^[A-Za-z0-9_-]+$/u.test(field))
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function requireInteger(value, key) {
+  const field = value[key];
+  if (typeof field !== "number" || !Number.isSafeInteger(field))
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function hasToken2(value, expected) {
+  return Boolean(value?.split(",").some((token) => token.trim().toLowerCase() === expected));
+}
+function isTimeoutError(error) {
+  return Boolean(error && typeof error === "object" && error.reason === "timeout");
+}
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay-discovery.js
+import { spawn } from "node:child_process";
+import { statSync } from "node:fs";
+import net2 from "node:net";
+import path from "node:path";
+var OPENCLAW_CDP_ARGS = ["browser", "extension", "cdp", "--json"];
+var OPENCLAW_WINDOWS_COMMAND_SUFFIX = "browser extension cdp --json";
+var OPENCLAW_WINDOWS_DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+var OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS = 1e3;
+var OPENCLAW_PROFILE_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+var OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES = 64 * 1024;
+var OPENCLAW_RELAY_DISCOVERY_ENV_KEYS = [
+  "APPDATA",
+  "COMSPEC",
+  "ComSpec",
+  "HOME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LANG",
+  "LC_ALL",
+  "LOCALAPPDATA",
+  "OPENCLAW_CONFIG_PATH",
+  "OPENCLAW_GATEWAY_PORT",
+  "OPENCLAW_HOME",
+  "OPENCLAW_OAUTH_DIR",
+  "OPENCLAW_PROFILE",
+  "OPENCLAW_STATE_DIR",
+  "PATH",
+  "Path",
+  "PATHEXT",
+  "SYSTEMROOT",
+  "SystemRoot",
+  "TEMP",
+  "TMP",
+  "TMPDIR",
+  "USERPROFILE",
+  "WINDIR",
+  "XDG_CONFIG_HOME",
+  "XDG_STATE_HOME"
+];
+function normalizeOpenClawProfile(raw) {
+  const profile = raw?.trim();
+  if (!profile || profile.toLowerCase() === "default" || !OPENCLAW_PROFILE_PATTERN.test(profile)) {
+    return void 0;
+  }
+  return profile;
+}
+async function discoverOpenClawRelayUrl(options) {
+  const platform = options.platform ?? process.platform;
+  const cwd = options.cwd ?? process.cwd();
+  const filteredEnv = openClawDiscoveryEnvironment(options.env);
+  const command = resolveOpenClawRelayDiscoveryCommandPlan(filteredEnv, platform, options.isFile, cwd);
+  if (!command)
+    return { reason: "unavailable" };
+  const env = sanitizeOpenClawDiscoveryCommandEnvironment(filteredEnv, command, platform, cwd);
+  const result = await (options.run ?? runOpenClawRelayDiscovery)({
+    ...command,
+    env,
+    timeoutMs: options.timeoutMs,
+    maxOutputBytes: OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES,
+    shell: false
+  });
+  return validateDiscoveryCommandResult(result, options.keyId);
+}
+function runOpenClawRelayDiscovery(options, runtime = {}) {
+  return new Promise((resolve) => {
+    const child = (runtime.spawn ?? spawn)(options.executable, [...options.args], {
+      cwd: options.cwd,
+      env: options.env,
+      shell: options.shell,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsVerbatimArguments: options.platform === "win32",
+      windowsHide: true
+    });
+    const stdout = [];
+    let outputBytes = 0;
+    let settled = false;
+    let terminating = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve(result);
+    };
+    const terminate = (kind) => {
+      if (settled || terminating)
+        return;
+      terminating = true;
+      child.stdout.destroy();
+      child.stderr.destroy();
+      const plan = createOpenClawRelayDiscoveryTerminationPlan(options, child.pid);
+      const terminateProcessTree = runtime.terminateProcessTree ?? terminateOpenClawRelayDiscoveryProcessTree;
+      let termination = Promise.resolve();
+      if (plan) {
+        try {
+          termination = terminateProcessTree(plan, child);
+        } catch {
+        }
+      }
+      void boundedTreeTermination(termination).finally(() => {
+        child.unref();
+        finish({ kind });
+      });
+    };
+    const collect = (chunk, keep) => {
+      if (settled || terminating)
+        return;
+      outputBytes += chunk.byteLength;
+      if (outputBytes > options.maxOutputBytes) {
+        terminate("overflow");
+        return;
+      }
+      if (keep)
+        stdout.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(chunk, true));
+    child.stderr.on("data", (chunk) => collect(chunk, false));
+    child.once("error", (error) => {
+      if (!terminating)
+        finish({ kind: classifyCommandError(error) });
+    });
+    child.once("close", (code) => {
+      if (!terminating) {
+        finish(code === 0 ? { kind: "success", stdout: Buffer.concat(stdout) } : { kind: "nonzero" });
+      }
+    });
+    timer = setTimeout(() => terminate("timeout"), options.timeoutMs);
+    timer.unref();
+  });
+}
+function resolveOpenClawRelayDiscoveryCommandPlan(env, platform = process.platform, isFile = isRegularFile, cwd = process.cwd()) {
+  if (platform !== "win32")
+    return { executable: "openclaw", args: OPENCLAW_CDP_ARGS, platform };
+  const executable = resolveWindowsCommandInterpreter(env);
+  const openClawShim = resolveWindowsOpenClawShim(env, isFile, cwd);
+  if (!executable || !openClawShim)
+    return void 0;
+  const taskkillExecutable = path.win32.join(path.win32.dirname(executable), "taskkill.exe");
+  if (!isSafeWindowsSystemToolPath(taskkillExecutable, "taskkill.exe"))
+    return void 0;
+  return {
+    executable,
+    // The only variable bytes are the validated absolute shim path. No config,
+    // profile, URL, metadata, or unresolved command name reaches cmd.exe.
+    args: ["/d", "/s", "/c", `""${openClawShim}" ${OPENCLAW_WINDOWS_COMMAND_SUFFIX}"`],
+    cwd: path.win32.dirname(openClawShim),
+    platform,
+    taskkillExecutable
+  };
+}
+function resolveWindowsCommandInterpreter(env) {
+  const systemRoot = env.SYSTEMROOT?.trim() || env.SystemRoot?.trim();
+  const systemCmd = systemRoot && isSafeWindowsSystemRoot(systemRoot) ? path.win32.join(systemRoot, "System32", "cmd.exe") : void 0;
+  const comSpec = env.COMSPEC?.trim() || env.ComSpec?.trim();
+  if (comSpec && isSafeWindowsCmdPath(comSpec)) {
+    const normalizedComSpec = path.win32.normalize(comSpec);
+    if (systemCmd && normalizedComSpec.toLowerCase() === systemCmd.toLowerCase() || !systemCmd && isConventionalWindowsSystemCmd(normalizedComSpec)) {
+      return normalizedComSpec;
+    }
+  }
+  return systemCmd;
+}
+function resolveWindowsOpenClawShim(env, isFile, cwd) {
+  const pathEntries = safeWindowsPathEntries(env.PATH ?? env.Path, cwd);
+  const extensions = windowsPathExtensions(env.PATHEXT);
+  for (const directory of pathEntries) {
+    for (const extension of extensions) {
+      if (extension.toLowerCase() !== ".cmd")
+        continue;
+      const candidate = path.win32.join(directory, `openclaw${extension}`);
+      if (isSafeWindowsCommandPath(candidate) && isFile(candidate))
+        return path.win32.normalize(candidate);
+    }
+  }
+  return void 0;
+}
+function isSafeWindowsCmdPath(value) {
+  return isSafeWindowsSystemToolPath(value, "cmd.exe");
+}
+function isSafeWindowsSystemToolPath(value, basename) {
+  const parent = path.win32.dirname(value);
+  const root = path.win32.dirname(parent);
+  return isSafeWindowsCommandPath(value) && path.win32.basename(value).toLowerCase() === basename && path.win32.basename(parent).toLowerCase() === "system32" && ["windows", "winnt"].includes(path.win32.basename(root).toLowerCase());
+}
+function isSafeWindowsSystemRoot(value) {
+  const basename = path.win32.basename(value).toLowerCase();
+  return isSafeWindowsAbsolutePath(value) && basename !== "cmd.exe" && basename !== "system32";
+}
+function isConventionalWindowsSystemCmd(value) {
+  const parent = path.win32.dirname(value);
+  const root = path.win32.dirname(parent);
+  return path.win32.basename(parent).toLowerCase() === "system32" && ["windows", "winnt"].includes(path.win32.basename(root).toLowerCase());
+}
+function isSafeWindowsAbsolutePath(value) {
+  if (!/^[a-z]:[\\/]/i.test(value) || /["<>|?*]/u.test(value) || hasControlCharacter(value) || value.slice(2).includes(":")) {
+    return false;
+  }
+  const segments = value.replaceAll("/", "\\").split("\\");
+  return !segments.some((segment) => segment === "." || segment === "..");
+}
+function isSafeWindowsCommandPath(value) {
+  return isSafeWindowsAbsolutePath(value) && !/["%&|<>^!]/u.test(value) && !hasControlCharacter(value);
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) < 32)
+      return true;
+  }
+  return false;
+}
+function safeWindowsPathEntries(value, excludedDirectory) {
+  if (!value)
+    return [];
+  const excluded = excludedDirectory && isSafeWindowsCommandPath(excludedDirectory) ? path.win32.resolve(excludedDirectory).toLowerCase() : void 0;
+  return value.split(";").map((entry) => entry.trim()).filter((entry) => entry !== "" && path.win32.isAbsolute(entry) && isSafeWindowsCommandPath(entry)).map((entry) => path.win32.resolve(entry)).filter((entry) => entry.toLowerCase() !== excluded);
+}
+function windowsPathExtensions(value) {
+  const raw = value?.trim() || OPENCLAW_WINDOWS_DEFAULT_PATHEXT;
+  return raw.split(";").map((extension) => extension.trim()).filter((extension) => /^\.[a-z0-9]+$/iu.test(extension));
+}
+function isRegularFile(candidate) {
+  try {
+    return statSync(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function sanitizeOpenClawDiscoveryCommandEnvironment(env, command, platform, sourceCwd) {
+  if (platform !== "win32")
+    return env;
+  const sanitized = { ...env };
+  delete sanitized.ComSpec;
+  delete sanitized.COMSPEC;
+  sanitized.ComSpec = command.executable;
+  const safePath = safeWindowsPathEntries(sanitized.PATH ?? sanitized.Path, sourceCwd).join(";");
+  delete sanitized.Path;
+  delete sanitized.PATH;
+  if (safePath)
+    sanitized.Path = safePath;
+  const systemRoot = sanitized.SYSTEMROOT?.trim() || sanitized.SystemRoot?.trim();
+  if (systemRoot && !isSafeWindowsSystemRoot(systemRoot)) {
+    delete sanitized.SystemRoot;
+    delete sanitized.SYSTEMROOT;
+  }
+  return sanitized;
+}
+function createOpenClawRelayDiscoveryTerminationPlan(options, pid) {
+  if (!Number.isSafeInteger(pid) || !pid || pid <= 0)
+    return void 0;
+  if (options.platform !== "win32")
+    return { kind: "posix-sigkill", pid, signal: "SIGKILL" };
+  if (!options.taskkillExecutable || !isSafeWindowsSystemToolPath(options.taskkillExecutable, "taskkill.exe")) {
+    return void 0;
+  }
+  return {
+    kind: "windows-taskkill",
+    pid,
+    executable: options.taskkillExecutable,
+    args: ["/PID", String(pid), "/T", "/F"],
+    shell: false,
+    windowsHide: true
+  };
+}
+async function terminateOpenClawRelayDiscoveryProcessTree(plan, child) {
+  if (plan.kind === "posix-sigkill") {
+    try {
+      child.kill(plan.signal);
+    } catch {
+    }
+    return;
+  }
+  await new Promise((resolve) => {
+    let killer;
+    try {
+      killer = spawn(plan.executable, [...plan.args], {
+        shell: plan.shell,
+        stdio: "ignore",
+        windowsHide: plan.windowsHide
+      });
+    } catch {
+      resolve();
+      return;
+    }
+    let done = false;
+    const finish = () => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      resolve();
+    };
+    killer.once("error", finish);
+    killer.once("close", finish);
+    const timer = setTimeout(() => {
+      try {
+        killer.kill("SIGKILL");
+      } catch {
+      }
+      finish();
+    }, OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS);
+    timer.unref();
+  });
+}
+async function boundedTreeTermination(termination) {
+  let timer;
+  try {
+    await Promise.race([
+      termination.catch(() => void 0),
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS + 250);
+        timer.unref();
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function classifyCommandError(error) {
+  const details = error;
+  if (details.code === "ENOENT")
+    return "unavailable";
+  if (details.code === "ETIMEDOUT" || details.killed === true)
+    return "timeout";
+  if (details.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" || details.code === "ENOBUFS")
+    return "overflow";
+  return "nonzero";
+}
+function validateDiscoveryCommandResult(result, expectedKeyId) {
+  if (result.kind !== "success")
+    return { reason: result.kind };
+  if (result.stdout.byteLength > OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES)
+    return { reason: "overflow" };
+  const encoded = result.stdout.toString("utf8").trim();
+  const parseErrors = [];
+  const tree = parseTree(encoded, parseErrors, { allowTrailingComma: false, disallowComments: true });
+  if (!tree || parseErrors.length > 0 || hasDuplicateObjectKeys(tree))
+    return { reason: "malformed" };
+  let metadata;
+  try {
+    metadata = JSON.parse(encoded);
+  } catch {
+    return { reason: "malformed" };
+  }
+  if (!isPlainObject(metadata) || !hasExactKeys(metadata, ["auth", "browserUrl", "wsEndpoint"])) {
+    return { reason: "incompatible" };
+  }
+  if (!isPlainObject(metadata.auth) || !hasExactKeys(metadata.auth, [
+    "challengeUrl",
+    "completeUrl",
+    "flow",
+    "keyId",
+    "label",
+    "method",
+    "resource",
+    "role",
+    "transport",
+    "version"
+  ])) {
+    return { reason: "incompatible" };
+  }
+  const browserUrl = parseBrowserUrl(metadata.browserUrl);
+  if (!browserUrl)
+    return { reason: "unsafe" };
+  const wsEndpoint = parseWebSocketUrl(metadata.wsEndpoint);
+  if (!wsEndpoint || wsEndpoint.host !== browserUrl.host)
+    return { reason: "unsafe" };
+  const auth = metadata.auth;
+  if (auth.label !== BROWSER_RELAY_AUTH_LABEL || auth.version !== BROWSER_RELAY_AUTH_VERSION || auth.role !== BROWSER_RELAY_CDP_ROLE || auth.transport !== BROWSER_RELAY_CDP_TRANSPORT || auth.method !== BROWSER_RELAY_CDP_METHOD || auth.resource !== BROWSER_RELAY_CDP_RESOURCE || auth.flow !== BROWSER_RELAY_CDP_FLOW || auth.challengeUrl !== new URL(BROWSER_RELAY_AUTH_CHALLENGE_PATH, browserUrl).toString() || auth.completeUrl !== new URL(BROWSER_RELAY_AUTH_COMPLETE_PATH, browserUrl).toString()) {
+    return { reason: "incompatible" };
+  }
+  if (auth.keyId !== expectedKeyId)
+    return { reason: "key-id-mismatch" };
+  return { reason: "success", url: browserUrl };
+}
+function parseBrowserUrl(value) {
+  if (typeof value !== "string")
+    return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.username !== "" || url.password !== "" || !hasValidPort(url) || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    return void 0;
+  }
+  return new URL(url.origin);
+}
+function parseWebSocketUrl(value) {
+  if (typeof value !== "string")
+    return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "ws:" || !isLoopbackHostname(url.hostname) || url.username !== "" || url.password !== "" || !hasValidPort(url) || url.pathname !== BROWSER_RELAY_CDP_PATH || url.search !== "" || url.hash !== "") {
+    return void 0;
+  }
+  return url;
+}
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.replace(/^\[(.*)\]$/u, "$1").toLowerCase();
+  if (normalized === "localhost" || normalized === "::1")
+    return true;
+  if (net2.isIPv4(normalized))
+    return normalized.startsWith("127.");
+  if (!net2.isIPv6(normalized))
+    return false;
+  return normalized.startsWith("::ffff:127.") || /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/u.test(normalized);
+}
+function hasValidPort(url) {
+  if (url.port === "")
+    return true;
+  const port = Number(url.port);
+  return Number.isSafeInteger(port) && port >= 1 && port <= 65535;
+}
+function isPlainObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function hasExactKeys(value, expected) {
+  const actual = Object.keys(value).toSorted();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function hasDuplicateObjectKeys(node) {
+  if (node.type === "object") {
+    const seen = /* @__PURE__ */ new Set();
+    for (const property of node.children ?? []) {
+      const key = property.children?.[0]?.value;
+      if (typeof key !== "string" || seen.has(key))
+        return true;
+      seen.add(key);
+    }
+  }
+  return (node.children ?? []).some(hasDuplicateObjectKeys);
+}
+function openClawDiscoveryEnvironment(env) {
+  const filtered = Object.fromEntries(OPENCLAW_RELAY_DISCOVERY_ENV_KEYS.flatMap((key) => {
+    const value = env[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+  const profile = normalizeOpenClawProfile(filtered.OPENCLAW_PROFILE);
+  if (profile)
+    filtered.OPENCLAW_PROFILE = profile;
+  else
+    delete filtered.OPENCLAW_PROFILE;
+  return filtered;
+}
+
+// node_modules/.pnpm/mcporter@0.13.6/node_modules/mcporter/dist/chrome-devtools-relay.js
+var DEFAULT_RELAY_PROBE_TIMEOUT_MS = 5e3;
+var MIN_RELAY_PROBE_TIMEOUT_MS = 100;
+var MAX_RELAY_PROBE_TIMEOUT_MS = 3e4;
+var DEFAULT_RELAY_URL = "http://127.0.0.1:18799";
+var DEFAULT_RELAY_IDENTITY_URL = new URL(DEFAULT_RELAY_URL).toString();
+var RELAY_CWD_SENTINEL = "$MCPORTER_CHROME_RELAY_CWD";
+var RELAY_CREDENTIAL_SENTINEL = "$MCPORTER_CHROME_RELAY_CREDENTIAL:";
+var RELAY_DISCOVERY_SENTINEL = "$MCPORTER_CHROME_RELAY_DISCOVERY:";
+var CHROME_DEVTOOLS_RELAY_RUNTIME_IDENTITY_VERSION = 1;
+var CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS = [
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY",
+  "MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY",
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_URL",
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS",
+  ...OPENCLAW_RELAY_DISCOVERY_ENV_KEYS
+];
+var ChromeDevtoolsRelayRequiredError = class extends Error {
+  decision;
+  constructor(decision) {
+    super(`Chrome DevTools relay policy 'require' could not use the OpenClaw extension relay (${decision.reason}). No chrome-devtools-mcp process was launched.`);
+    this.decision = decision;
+    this.name = "ChromeDevtoolsRelayRequiredError";
+  }
+};
+var lastDecisions = /* @__PURE__ */ new Map();
+function recordChromeDevtoolsRelayDecision(server, decision) {
+  lastDecisions.set(server, decision);
+}
+function getChromeDevtoolsRelayDecision(server) {
+  return lastDecisions.get(server);
+}
+function formatChromeDevtoolsRelayDecision(decision) {
+  return JSON.stringify(decision);
+}
+function resolveChromeDevtoolsRelayProbeTimeoutMs(env = process.env) {
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS?.trim();
+  if (!raw || !/^\d+$/.test(raw))
+    return DEFAULT_RELAY_PROBE_TIMEOUT_MS;
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0)
+    return DEFAULT_RELAY_PROBE_TIMEOUT_MS;
+  return Math.min(MAX_RELAY_PROBE_TIMEOUT_MS, Math.max(MIN_RELAY_PROBE_TIMEOUT_MS, parsed));
+}
+function resolveChromeDevtoolsRelayPolicy(configured, env = process.env) {
+  if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY === "1")
+    return "off";
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY?.trim().toLowerCase();
+  if (!raw)
+    return configured ?? "prefer";
+  if (raw === "off" || raw === "prefer" || raw === "require")
+    return raw;
+  throw new Error(`Invalid MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY '${raw}'. Expected off, prefer, or require.`);
+}
+function isChromeDevtoolsAutoConnectCommand(command, args) {
+  return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
+}
+function explicitRelayBaseUrl(env) {
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL?.trim();
+  if (!raw)
+    return { explicit: false };
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { explicit: true };
+  }
+  if (url.protocol !== "http:" || !["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname) || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") {
+    return { explicit: true };
+  }
+  return { explicit: true, url };
+}
+function resolveOpenClawCredentialDir(env) {
+  const oauthOverride = env.OPENCLAW_OAUTH_DIR?.trim();
+  if (oauthOverride)
+    return resolveOpenClawPath(oauthOverride, env);
+  const stateOverride = env.OPENCLAW_STATE_DIR?.trim();
+  const profile = normalizeOpenClawProfile(env.OPENCLAW_PROFILE);
+  const stateDir = stateOverride ? resolveOpenClawPath(stateOverride, env) : path2.join(resolveOpenClawHome(env), profile ? `.openclaw-${profile}` : ".openclaw");
+  return path2.join(stateDir, "credentials");
+}
+function resolveOpenClawHome(env) {
+  const override = env.OPENCLAW_HOME?.trim();
+  const osHome = resolveOpenClawOsHome(env);
+  if (!override)
+    return osHome;
+  if (override === "~")
+    return osHome;
+  if (override.startsWith("~/") || override.startsWith("~\\")) {
+    return path2.resolve(osHome, override.slice(2));
+  }
+  return path2.resolve(override);
+}
+function resolveOpenClawOsHome(env) {
+  for (const value of [env.HOME, env.USERPROFILE]) {
+    const normalized = value?.trim();
+    if (normalized && normalized !== "undefined" && normalized !== "null")
+      return path2.resolve(normalized);
+  }
+  return os.homedir();
+}
+function resolveOpenClawPath(value, env) {
+  if (value === "~")
+    return resolveOpenClawHome(env);
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path2.resolve(resolveOpenClawHome(env), value.slice(2));
+  }
+  return path2.resolve(value);
+}
+function defaultReadCredential(env) {
+  const secretPath = path2.join(resolveOpenClawCredentialDir(env), "browser-extension-relay.secret");
+  return readCredentialPath(secretPath);
+}
+function readCredentialPath(secretPath) {
+  let descriptor;
+  try {
+    descriptor = fs.openSync(secretPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  } catch (error) {
+    return { reason: isErrno(error, "ENOENT") ? "missing-credential" : "invalid-credential" };
+  }
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile())
+      return { reason: "invalid-credential" };
+    if (process.platform !== "win32") {
+      if ((stat.mode & 63) !== 0)
+        return { reason: "invalid-credential" };
+      if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        return { reason: "invalid-credential" };
+    }
+    const encoded = fs.readFileSync(descriptor, "utf8").trim();
+    if (!/^[0-9a-f]{64}$/.test(encoded))
+      return { reason: "invalid-credential" };
+    const key = Buffer.from(encoded, "hex");
+    return { credential: { key, keyId: deriveBrowserRelayKeyId(key) } };
+  } catch {
+    return { reason: "invalid-credential" };
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+async function defaultConnect(baseUrl, credential, timeoutMs) {
+  return await connectChromeDevtoolsRelayV2({ baseUrl, credential, timeoutMs });
+}
+async function rewriteChromeDevtoolsArgsForRelay(command, args, env = process.env, options = {}, configuredPolicy) {
+  const relayEnv = selectChromeDevtoolsRelayRuntimeEnvironment(env);
+  const eligible = isChromeDevtoolsAutoConnectCommand(command, args);
+  if (!eligible) {
+    const ambiguous = isAmbiguousChromeDevtoolsAutoConnectCommand(command, args);
+    if (!ambiguous) {
+      return decide({
+        args,
+        applied: false,
+        decision: { route: "legacy", reason: "not-eligible", policy: configuredPolicy ?? "prefer" }
+      }, options);
+    }
+    const ambiguousPolicy = resolveChromeDevtoolsRelayPolicy(configuredPolicy, relayEnv);
+    if (ambiguousPolicy === "require") {
+      return unavailableOrLegacy(args, ambiguousPolicy, "unsupported-command", void 0, options);
+    }
+    return decide({
+      args,
+      applied: false,
+      decision: { route: "legacy", reason: "not-eligible", policy: ambiguousPolicy }
+    }, options);
+  }
+  const policy = resolveChromeDevtoolsRelayPolicy(configuredPolicy, relayEnv);
+  if (policy === "off") {
+    return decide({ args, applied: false, decision: { route: "legacy", reason: "disabled", policy } }, options);
+  }
+  const explicitBase = explicitRelayBaseUrl(relayEnv);
+  if (explicitBase.explicit && !explicitBase.url) {
+    return unavailableOrLegacy(args, policy, "invalid-endpoint", void 0, options);
+  }
+  const loaded = options.readToken ? (() => {
+    const encoded = options.readToken?.();
+    if (!encoded)
+      return { reason: "missing-credential" };
+    if (!/^[0-9a-f]{64}$/u.test(encoded))
+      return { reason: "invalid-credential" };
+    const key = Buffer.from(encoded, "hex");
+    return { credential: { key, keyId: deriveBrowserRelayKeyId(key) } };
+  })() : defaultReadCredential(relayEnv);
+  if (!loaded.credential) {
+    const base = explicitBase.url ?? new URL(DEFAULT_RELAY_URL);
+    const upstreamEndpoint = new URL("/cdp", base);
+    upstreamEndpoint.protocol = "ws:";
+    return unavailableOrLegacy(args, policy, loaded.reason ?? "invalid-credential", upstreamEndpoint.toString(), options);
+  }
+  const timeoutMs = resolveChromeDevtoolsRelayProbeTimeoutMs(relayEnv);
+  try {
+    const base = explicitBase.url ?? (await discoverOpenClawRelayUrl({
+      env: relayEnv,
+      keyId: loaded.credential.keyId,
+      timeoutMs,
+      run: options.discover,
+      platform: options.discovery?.platform,
+      isFile: options.discovery?.isFile,
+      cwd: options.discovery?.cwd
+    })).url ?? new URL(DEFAULT_RELAY_URL);
+    const upstreamEndpoint = new URL("/cdp", base);
+    upstreamEndpoint.protocol = "ws:";
+    const endpoint = upstreamEndpoint.toString();
+    let probe;
+    try {
+      probe = await (options.connect ?? defaultConnect)(base, loaded.credential, timeoutMs);
+    } catch {
+      return unavailableOrLegacy(args, policy, "network-error", endpoint, options);
+    }
+    const probeDetails = { probeDurationMs: probe.durationMs, probeStatus: probe.status };
+    if (probe.reason !== "success" || !probe.upstream) {
+      probe.upstream?.socket.destroy();
+      const reason = probe.reason === "success" ? "protocol" : probe.reason;
+      return unavailableOrLegacy(args, policy, reason, endpoint, options, probeDetails);
+    }
+    let proxy;
+    try {
+      proxy = await (options.startProxy ?? startChromeDevtoolsRelayProxy)({ upstream: probe.upstream });
+    } catch {
+      probe.upstream.socket.destroy();
+      return unavailableOrLegacy(args, policy, "network-error", endpoint, options, probeDetails);
+    }
+    const rewritten = replaceChromeDevtoolsAutoConnectArgs(command, args, ["--wsEndpoint", proxy.endpoint]);
+    try {
+      return decide({
+        args: rewritten,
+        applied: true,
+        endpoint: proxy.endpoint,
+        proxy,
+        decision: { route: "relay", reason: "success", policy, endpoint, ...probeDetails }
+      }, options);
+    } catch (error) {
+      await proxy.close().catch(() => {
+      });
+      throw error;
+    }
+  } finally {
+    loaded.credential.key.fill(0);
+  }
+}
+function unavailableOrLegacy(args, policy, reason, endpoint, options, probe = {}) {
+  const decision = {
+    route: policy === "require" ? "unavailable" : "legacy",
+    reason,
+    policy,
+    endpoint,
+    ...probe
+  };
+  options.onDecision?.(decision);
+  if (policy === "require")
+    throw new ChromeDevtoolsRelayRequiredError(decision);
+  return { args, applied: false, decision };
+}
+function decide(result, options) {
+  options.onDecision?.(result.decision);
+  return result;
+}
+function resolveChromeDevtoolsRelayEnvironment(overrides, env = process.env) {
+  return { ...env, ...resolveRelayDefinitionEnvOverrides(overrides, env) };
+}
+function selectChromeDevtoolsRelayRuntimeEnvironment(env) {
+  return Object.fromEntries(CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.flatMap((key) => {
+    const value = env[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+}
+function sanitizeRelayIdentityEnvironment(env) {
+  const selected = selectChromeDevtoolsRelayRuntimeEnvironment(env);
+  if (selected.MCPORTER_CHROME_DEVTOOLS_RELAY_URL !== void 0) {
+    const explicit = explicitRelayBaseUrl(selected);
+    selected.MCPORTER_CHROME_DEVTOOLS_RELAY_URL = explicit.url?.toString() ?? "invalid-endpoint";
+  }
+  return selected;
+}
+function chromeDevtoolsRelayEnvironmentKeys(definitions, env = process.env) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const definition of definitions) {
+    if (definition.command.kind !== "stdio")
+      continue;
+    const commandValues = [definition.command.command, ...definition.command.args];
+    const commandEnvironmentKeys = new Set(commandValues.flatMap(referencedEnvironmentVariables));
+    const relevant = commandEnvironmentKeys.size > 0 || isChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args) || isAmbiguousChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args);
+    if (!relevant) {
+      continue;
+    }
+    for (const key of commandEnvironmentKeys)
+      keys.add(key);
+    const resolvedDefinitionEnv = resolveRelayIdentityEnvOverrides(definition.env, env);
+    for (const pathKey of [
+      "HOME",
+      "USERPROFILE",
+      "OPENCLAW_HOME",
+      "OPENCLAW_STATE_DIR",
+      "OPENCLAW_OAUTH_DIR",
+      "OPENCLAW_CONFIG_PATH"
+    ]) {
+      const override = resolvedDefinitionEnv[pathKey]?.trim();
+      if (override && override !== "~" && !override.startsWith("~/") && !override.startsWith("~\\") && !path2.isAbsolute(override)) {
+        keys.add(RELAY_CWD_SENTINEL);
+      }
+    }
+    for (const key of CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS) {
+      keys.add(key);
+      const override = definition.env?.[key];
+      if (!override)
+        continue;
+      for (const referenced of referencedEnvironmentVariables(override))
+        keys.add(referenced);
+    }
+    const effectiveEnv = { ...env, ...resolvedDefinitionEnv };
+    const resolvedCommand = resolveCommandArgument(definition.command.command, env);
+    const resolvedArgs = resolveCommandArguments(definition.command.args, env);
+    if (!isChromeDevtoolsAutoConnectCommand(resolvedCommand, resolvedArgs))
+      continue;
+    const credentialPath = path2.join(resolveOpenClawCredentialDir(effectiveEnv), "browser-extension-relay.secret");
+    keys.add(`${RELAY_CREDENTIAL_SENTINEL}${credentialPath}`);
+    const environment = sanitizeRelayIdentityEnvironment(Object.fromEntries(CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.flatMap((key) => {
+      const value = resolvedDefinitionEnv[key];
+      return value === void 0 ? [] : [[key, value]];
+    })));
+    keys.add(`${RELAY_DISCOVERY_SENTINEL}${Buffer.from(JSON.stringify({ credentialPath, environment, configuredPolicy: definition.chromeDevtoolsRelay }), "utf8").toString("base64url")}`);
+  }
+  return [...keys].toSorted();
+}
+async function resolveChromeDevtoolsRelayRuntimeIdentity(keys, env = process.env, options = {}) {
+  const credentialId = createRelayCredentialIdResolver();
+  const environmentValues = relayEnvironmentIdentityValues(keys, env, credentialId);
+  const discoveryValues = [];
+  for (const key of keys) {
+    if (!key.startsWith(RELAY_DISCOVERY_SENTINEL))
+      continue;
+    const payload = parseRelayDiscoveryIdentity(key.slice(RELAY_DISCOVERY_SENTINEL.length));
+    if (!payload) {
+      discoveryValues.push([key, DEFAULT_RELAY_IDENTITY_URL]);
+      continue;
+    }
+    const effectiveEnv = {
+      ...selectChromeDevtoolsRelayRuntimeEnvironment(env),
+      ...payload.environment
+    };
+    const explicit = explicitRelayBaseUrl(effectiveEnv);
+    if (explicit.explicit) {
+      discoveryValues.push([key, explicit.url?.toString() ?? "invalid-endpoint"]);
+      continue;
+    }
+    if (resolveChromeDevtoolsRelayPolicy(payload.configuredPolicy, effectiveEnv) === "off") {
+      discoveryValues.push([key, "disabled"]);
+      continue;
+    }
+    const keyId = credentialId(payload.credentialPath);
+    if (keyId === "missing-credential" || keyId === "invalid-credential") {
+      discoveryValues.push([key, DEFAULT_RELAY_IDENTITY_URL]);
+      continue;
+    }
+    try {
+      const discovered = await discoverOpenClawRelayUrl({
+        env: effectiveEnv,
+        keyId,
+        timeoutMs: resolveChromeDevtoolsRelayProbeTimeoutMs(effectiveEnv),
+        run: options.discover,
+        platform: options.discovery?.platform,
+        isFile: options.discovery?.isFile,
+        cwd: options.discovery?.cwd
+      });
+      discoveryValues.push([key, discovered.url?.toString() ?? DEFAULT_RELAY_IDENTITY_URL]);
+    } catch {
+      discoveryValues.push([key, DEFAULT_RELAY_IDENTITY_URL]);
+    }
+  }
+  if (discoveryValues.length === 0)
+    return hashRelayIdentityValues(environmentValues);
+  return hashRelayIdentityValues([
+    ...environmentValues,
+    ["$relayRuntimeIdentity", CHROME_DEVTOOLS_RELAY_RUNTIME_IDENTITY_VERSION],
+    ...discoveryValues
+  ]);
+}
+function createRelayCredentialIdResolver() {
+  const credentialIds = /* @__PURE__ */ new Map();
+  return (credentialPath) => {
+    const cached = credentialIds.get(credentialPath);
+    if (cached)
+      return cached;
+    const loaded = readCredentialPath(credentialPath);
+    const value = loaded.credential?.keyId ?? loaded.reason ?? "missing-credential";
+    loaded.credential?.key.fill(0);
+    credentialIds.set(credentialPath, value);
+    return value;
+  };
+}
+function relayEnvironmentIdentityValues(keys, env, credentialId) {
+  const values = keys.map((key) => {
+    if (key === RELAY_CWD_SENTINEL)
+      return [key, process.cwd()];
+    if (key.startsWith(RELAY_CREDENTIAL_SENTINEL)) {
+      const credentialPath = key.slice(RELAY_CREDENTIAL_SENTINEL.length);
+      return [key, credentialId(credentialPath)];
+    }
+    if (key.startsWith(RELAY_DISCOVERY_SENTINEL)) {
+      return [key, "async-discovery"];
+    }
+    return [key, env[key] ?? null];
+  });
+  if (keys.length > 0) {
+    values.push(["$relayAuth", "v2-async-metadata-discovery"]);
+  }
+  return values;
+}
+function hashRelayIdentityValues(values) {
+  return createHash4("sha256").update(JSON.stringify(values)).digest("hex").slice(0, 16);
+}
+function parseRelayDiscoveryIdentity(encoded) {
+  try {
+    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return void 0;
+    const candidate = value;
+    if (typeof candidate.credentialPath !== "string" || !candidate.environment || typeof candidate.environment !== "object") {
+      return void 0;
+    }
+    if (candidate.configuredPolicy !== void 0 && !["off", "prefer", "require"].includes(candidate.configuredPolicy)) {
+      return void 0;
+    }
+    const environment = {};
+    for (const [key, raw] of Object.entries(candidate.environment)) {
+      if (!CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.includes(key) || typeof raw !== "string") {
+        return void 0;
+      }
+      environment[key] = raw;
+    }
+    return {
+      credentialPath: candidate.credentialPath,
+      environment,
+      configuredPolicy: candidate.configuredPolicy
+    };
+  } catch {
+    return void 0;
+  }
+}
+function referencedEnvironmentVariables(value) {
+  const names = /* @__PURE__ */ new Set();
+  if (value.startsWith("$env:"))
+    names.add(value.slice("$env:".length));
+  for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/gu)) {
+    if (match[1])
+      names.add(match[1]);
+  }
+  return [...names];
+}
+function resolveRelayDefinitionEnvOverrides(overrides, env) {
+  const resolved = {};
+  for (const [key, raw] of Object.entries(overrides ?? {})) {
+    const value = resolveEnvValue(raw, env);
+    if (value !== "")
+      resolved[key] = value;
+  }
+  return resolved;
+}
+function resolveRelayIdentityEnvOverrides(overrides, env) {
+  const relevant = Object.fromEntries(CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.flatMap((key) => {
+    const value = overrides?.[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+  return resolveRelayDefinitionEnvOverrides(relevant, env);
+}
+function isErrno(error, code) {
+  return Boolean(error && typeof error === "object" && error.code === code);
+}
+
+export {
+  resolveChromeDevtoolsAutoConnectCommand,
+  CHROME_DEVTOOLS_RELAY_RUNTIME_IDENTITY_VERSION,
+  ChromeDevtoolsRelayRequiredError,
+  recordChromeDevtoolsRelayDecision,
+  getChromeDevtoolsRelayDecision,
+  formatChromeDevtoolsRelayDecision,
+  rewriteChromeDevtoolsArgsForRelay,
+  resolveChromeDevtoolsRelayEnvironment,
+  chromeDevtoolsRelayEnvironmentKeys,
+  resolveChromeDevtoolsRelayRuntimeIdentity
+};