@myagentroam/node 0.9.62 → 0.9.65

package/dist/service/external-session-resume-service.js

@@ -1,2 +1,152 @@
-/* mar-release-protected */
-const _0xff519d=_0x50f4;function _0x5176(){const _0x5c92dd=['y2XLyxjgywLSDxjL','CMvZB2X2zq','ChjVzhvJDa','zwzMB3j0','ChjVAMvJDgLVBKzVCG','zw5ZDxjLq29UzMLNDxjHDgLVBG','CMvZDw1L','z2v0','y29Kzq','mtu5mdiZnZL2BwLQy3q','rvHurvjoquW','DhjHBNnPDgLVBNm','C2v0rMfPBhvYzq','C2v0','rvHurvjoquXFqunusvzf','CNvUBMvY','zMfPBhvYzurLDgfPBa','z2v0qwDLBNrtzxnZAw9U','nJaWmJqYngncAvLdAa','ywn0AxzPDhK','BwvZC2fNzuzHAwX1CMvdB2rL','n2PhAg1lqW','y3jLyxrLqwDLBNrtzxnZAw9U','CMvTzw1IzxjoyxrPDMu','nte3mJu5nurhDvrizW','BwvZC2fNzvjLC3vTzuzHAwX1CMvZ','CMvZB2X2zuzVCK1LC3nHz2u','C2vZC2LVBG','CMvZDw1LrxH0zxjUywW','DgHLBG','zMfPBhvYzvrPBwvYCW','CMvZDw1Lzej5rgLYzwn0swq','CMvZDw1LrMfPBhvYzurLDgfPBhm','mJy1nZy2mwfwr2T4wG','neTduMHnyq','uLvotKvsx1voqvzbsuXbqKXf','u0vtu0LptL9srvnvtuvFuKvkrunuruq','tufsx01btKfhruq','nda5ndqXyunUwgHU','CMvZDw1LvgfZA3m','Bw9KzwW','zgvSAxzLCNK','ywnJzxnZ','zxH0zxjUywXby3rPDML0Eq','ywrK','C3rHDgu','B3b0Aw9UCW','rvHurvjoquXFu0vtu0LptL9bq1rjvKu','u0vtu0LptL9ot1rFrK9vtKq','D29YA3nWywnLswq','ywnJzxb0rM9YtwvZC2fNzq','CNvUDgLTzq','uKvkrunuruq','BMf0AxzLq29UDhjVBa','uKvtvu1bqKXf','mtCYmdK4nffcwwLMwG','y29UzMLNDxjHDgLVBG','zgvSzxrL','CMvZDw1LrMfPBhvYzxm','C2v0tMf0AxzLq29UDhjVBa','BwfUywDLzefSAwfZrM9Y','AgfZ','zMfPBhvYzunVzgu','C3rHz2u','zxH0zxjUywXtzxnZAw9Uswq','CNvUBMvYCW','CgvYzM9YBvjLC3vTzq','DhjHBNnPDgLVBMLUzW','yxzHAwXHyMXL','mZqZmdG3nKH6sunhCW','Dw5Yzwy','zMfPBhvYzq','D29YA3nWywnLugf0Aa','CNvUBMvYvgL0Bgu','y3vZDg9TvgL0Bgu','y3DK'];_0x5176=function(){return _0x5c92dd;};return _0x5176();}(function(_0x7d1319,_0x4b05de){const _0x48716b=_0x50f4,_0x36e5de=_0x7d1319();while(!![]){try{const _0x53f089=parseInt(_0x48716b(0x1b1))/(0x14b7+-0x24cc+-0x8e*-0x1d)*(-parseInt(_0x48716b(0x1ad))/(-0x2*0x16f+0x59d*-0x5+0x1ef1))+-parseInt(_0x48716b(0x1ac))/(-0xe8e*-0x1+-0xf16+-0x1*-0x8b)+parseInt(_0x48716b(0x184))/(0x1d*-0x77+-0xa*-0x329+-0x3*0x609)+-parseInt(_0x48716b(0x1a3))/(-0x1*-0x71+-0x1*0x28e+-0x1*-0x222)+parseInt(_0x48716b(0x19d))/(0x227*-0x7+-0x1*0xbe9+0x1b00)+parseInt(_0x48716b(0x1a0))/(-0xb5a*-0x3+0x1103+-0x1*0x330a)*(-parseInt(_0x48716b(0x1c2))/(0x83f*0x2+-0xaf*-0x13+0x15*-0x167))+parseInt(_0x48716b(0x194))/(-0x25ed+-0x9ae+0x2fa4);if(_0x53f089===_0x4b05de)break;else _0x36e5de['push'](_0x36e5de['shift']());}catch(_0x5ae765){_0x36e5de['push'](_0x36e5de['shift']());}}}(_0x5176,-0x2*0x83064+0x8b169+0xd*0x160da));function _0x50f4(_0x2f3e4d,_0x3fbddc){_0x2f3e4d=_0x2f3e4d-(0x617*0x5+0x1e6d*-0x1+0x17d);const _0x34d2fc=_0x5176();let _0x3b27fa=_0x34d2fc[_0x2f3e4d];if(_0x50f4['pQyKaw']===undefined){var _0x22a94a=function(_0x26681d){const _0x5333ef='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x3dd715='',_0xb4d914='';for(let _0x471e42=0xacc+0x713+-0x393*0x5,_0x3287b6,_0xfb3c7d,_0x5be23b=-0x139*0x10+-0x83*-0x37+0x1*-0x895;_0xfb3c7d=_0x26681d['charAt'](_0x5be23b++);~_0xfb3c7d&&(_0x3287b6=_0x471e42%(-0x13da+0x537+0xea7)?_0x3287b6*(0x6a*-0x14+-0x1672+0x1efa)+_0xfb3c7d:_0xfb3c7d,_0x471e42++%(-0x20b0+0x1f5+0x1ebf))?_0x3dd715+=String['fromCharCode'](-0xb26*0x3+0x1e16+0xdf*0x5&_0x3287b6>>(-(0x2*-0x1205+-0x7*0xd0+0x29bc)*_0x471e42&0xc9a+-0x3*-0x8a9+0x1*-0x268f)):-0xbed*0x2+-0x1*0x19cd+0x29d*0x13){_0xfb3c7d=_0x5333ef['indexOf'](_0xfb3c7d);}for(let _0x34b529=-0x8a9+-0xe87+0x10*0x173,_0xe900f7=_0x3dd715['length'];_0x34b529<_0xe900f7;_0x34b529++){_0xb4d914+='%'+('00'+_0x3dd715['charCodeAt'](_0x34b529)['toString'](-0xb*0x1f3+-0x298*0xf+0x3c69))['slice'](-(-0x43*-0x3b+-0x3d5*-0x1+-0x1344));}return decodeURIComponent(_0xb4d914);};_0x50f4['UJamzR']=_0x22a94a,_0x50f4['egDBsm']={},_0x50f4['pQyKaw']=!![];}const _0x36dd66=_0x34d2fc[0x2026+0x96c+0x11*-0x272];_0x50f4['IcFexQ']!==_0x36dd66&&(_0x50f4['egDBsm']={},_0x50f4['IcFexQ']=_0x36dd66);const _0x3b23a4=_0x50f4['egDBsm'][_0x2f3e4d];return _0x3b23a4===undefined?(_0x3b27fa=_0x50f4['UJamzR'](_0x3b27fa),_0x50f4['egDBsm'][_0x2f3e4d]=_0x3b27fa):_0x3b27fa=_0x3b23a4,_0x3b27fa;}const RESUME_FAILURE_TTL_MS=(-0x767+0xf84+0x7ff*-0x1)*(-0x10fb3+0x1*0x15e97+0x9b7c);export class ExternalSessionResumeService{[_0xff519d(0x1b9)];[_0xff519d(0x196)]=new Set();[_0xff519d(0x1b2)]=new Map();constructor(_0x360d47){const _0x31dde1=_0xff519d;this[_0x31dde1(0x1b9)]=_0x360d47;}[_0xff519d(0x1ce)](_0x7ed60a){const _0x362fd3=_0xff519d;return this[_0x362fd3(0x196)][_0x362fd3(0x1c8)](_0x7ed60a);}async[_0xff519d(0x191)](_0x2d861b){const _0x4d3d40=_0xff519d,_0x1c1d4c=this[_0x4d3d40(0x1b2)][_0x4d3d40(0x192)](_0x2d861b['id']);if(_0x1c1d4c!==undefined)return _0x1c1d4c;const _0x2594af=this[_0x4d3d40(0x1cd)](_0x2d861b);this[_0x4d3d40(0x1b2)][_0x4d3d40(0x198)](_0x2d861b['id'],_0x2594af);try{return await _0x2594af;}finally{if(this[_0x4d3d40(0x1b2)][_0x4d3d40(0x192)](_0x2d861b['id'])===_0x2594af)this[_0x4d3d40(0x1b2)][_0x4d3d40(0x1c4)](_0x2d861b['id']);}}async[_0xff519d(0x1cd)](_0x144bb5){const _0x34c0c8=_0xff519d;this[_0x34c0c8(0x18b)](_0x144bb5['id']);const _0x438c0d=this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1b8)][_0x34c0c8(0x1aa)][_0x34c0c8(0x192)](_0x144bb5['id']),_0x4c0d6a=_0x438c0d===undefined?undefined:this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1be)][_0x34c0c8(0x19c)](_0x438c0d);if(_0x4c0d6a!==undefined)return this[_0x34c0c8(0x1b9)][_0x34c0c8(0x190)](_0x4c0d6a);const _0x1b94cc=this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1cc)][_0x34c0c8(0x18d)](_0x144bb5[_0x34c0c8(0x19a)]);if(_0x1b94cc===undefined)return this[_0x34c0c8(0x197)](_0x144bb5['id'],_0x34c0c8(0x1ae)),undefined;this[_0x34c0c8(0x196)][_0x34c0c8(0x1b7)](_0x144bb5['id']);let _0x1de049;try{_0x1de049=await _0x1b94cc[_0x34c0c8(0x1a7)](_0x144bb5,{'available':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x183)](_0x144bb5[_0x34c0c8(0x19a)]),'projectionFor':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x18f)],'managedAliasFor':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1c7)],'currentResumed':_0x7cb731=>{const _0x3b83df=_0x34c0c8,_0x321327=this[_0x3b83df(0x1b9)][_0x3b83df(0x1b8)][_0x3b83df(0x1aa)][_0x3b83df(0x192)](_0x7cb731);return _0x321327===undefined?undefined:this[_0x3b83df(0x1b9)][_0x3b83df(0x1be)][_0x3b83df(0x19c)](_0x321327);},'promote':_0x2cd972=>{const _0x5eaa03=_0x34c0c8;return this[_0x5eaa03(0x1b9)][_0x5eaa03(0x1be)][_0x5eaa03(0x1c6)](_0x2cd972,_0x5eaa03(0x1b0)),this[_0x5eaa03(0x1b9)][_0x5eaa03(0x1be)][_0x5eaa03(0x19c)](_0x2cd972);},'ensureConfiguration':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x190)],'create':_0x2c0680=>{const _0x50f2e9=_0x34c0c8,_0xc85b81=this[_0x50f2e9(0x1b9)][_0x50f2e9(0x1c3)](_0x2c0680);return this[_0x50f2e9(0x1b9)][_0x50f2e9(0x1be)][_0x50f2e9(0x1a1)]({'workspaceId':_0x2c0680[_0x50f2e9(0x1bc)],'runner':_0x2c0680[_0x50f2e9(0x19a)],..._0x2c0680[_0x50f2e9(0x1cb)]===null?{}:{'externalSessionId':_0x2c0680[_0x50f2e9(0x1cb)]},'nativeControl':_0x50f2e9(0x1b0),'cwd':_0x2c0680[_0x50f2e9(0x18a)],'model':_0xc85b81[_0x50f2e9(0x1b3)],'effort':_0xc85b81[_0x50f2e9(0x18e)],'access':_0xc85b81[_0x50f2e9(0x1b5)],..._0x2c0680[_0x50f2e9(0x188)]===null?{}:{'title':_0x2c0680[_0x50f2e9(0x188)]},..._0x2c0680[_0x50f2e9(0x189)]===null?{}:{'customTitle':_0x2c0680[_0x50f2e9(0x189)]}});},'workspacePath':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x187)],'rememberManagedNative':this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1a2)]});}finally{this[_0x34c0c8(0x196)][_0x34c0c8(0x1c4)](_0x144bb5['id']);}if(_0x1de049[_0x34c0c8(0x19e)]!==undefined)this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1b8)][_0x34c0c8(0x1b6)][_0x34c0c8(0x198)](_0x144bb5['id'],_0x1de049[_0x34c0c8(0x19e)]);if(_0x1de049[_0x34c0c8(0x1a6)]!==undefined)return this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1b8)][_0x34c0c8(0x1aa)][_0x34c0c8(0x198)](_0x144bb5['id'],_0x1de049[_0x34c0c8(0x1a6)]['id']),_0x1de049[_0x34c0c8(0x1a6)];return this[_0x34c0c8(0x197)](_0x144bb5['id'],_0x1de049[_0x34c0c8(0x1c9)]??_0x34c0c8(0x1af),_0x1de049[_0x34c0c8(0x19b)]),this[_0x34c0c8(0x1b9)][_0x34c0c8(0x1b8)][_0x34c0c8(0x1a4)][_0x34c0c8(0x198)](_0x144bb5['id'],_0x1de049[_0x34c0c8(0x19f)]??_0x1de049[_0x34c0c8(0x1c9)]??_0x34c0c8(0x1af)),undefined;}[_0xff519d(0x186)](_0x6ddef4){const _0x3d0d85=_0xff519d,_0x54687e=this[_0x3d0d85(0x1b9)][_0x3d0d85(0x1b8)][_0x3d0d85(0x1c5)][_0x3d0d85(0x192)](_0x6ddef4)??_0x3d0d85(0x1af),_0x343b87=this[_0x3d0d85(0x1b9)][_0x3d0d85(0x1b8)][_0x3d0d85(0x1ab)][_0x3d0d85(0x192)](_0x6ddef4);return _0x343b87===undefined?{'code':_0x54687e}:{'code':_0x54687e,'detail':_0x343b87};}async[_0xff519d(0x1a5)](_0xcdd6e1){const _0x47baf6=_0xff519d,_0x268eb7=this[_0x47baf6(0x1b9)][_0x47baf6(0x1b8)][_0x47baf6(0x1aa)][_0x47baf6(0x192)](_0xcdd6e1),_0x59e4f6=this[_0x47baf6(0x1b9)][_0x47baf6(0x1be)][_0x47baf6(0x19c)](_0x268eb7??_0xcdd6e1)??await this[_0x47baf6(0x1b9)][_0x47baf6(0x18c)](_0xcdd6e1);if(_0x59e4f6===undefined)throw new Error(_0x47baf6(0x1bb));if(_0x59e4f6[_0x47baf6(0x1c0)]!==_0x47baf6(0x195))return _0x59e4f6;const _0x4cefd6=await this[_0x47baf6(0x191)](_0x59e4f6);if(_0x4cefd6!==undefined)return _0x4cefd6;if(this[_0x47baf6(0x1b9)][_0x47baf6(0x1b8)][_0x47baf6(0x1b6)][_0x47baf6(0x192)](_0x59e4f6['id'])===_0x47baf6(0x199))throw new Error(_0x47baf6(0x1ba));throw new Error(this[_0x47baf6(0x1b9)][_0x47baf6(0x1b8)][_0x47baf6(0x1a4)][_0x47baf6(0x192)](_0x59e4f6['id'])??this[_0x47baf6(0x186)](_0x59e4f6['id'])[_0x47baf6(0x193)]);}async[_0xff519d(0x1bd)](_0x3b3b4c){const _0x4a07c7=_0xff519d,_0x28beb2=this[_0x4a07c7(0x1b9)][_0x4a07c7(0x1b8)][_0x4a07c7(0x1aa)][_0x4a07c7(0x192)](_0x3b3b4c),_0x375480=this[_0x4a07c7(0x1b9)][_0x4a07c7(0x1be)][_0x4a07c7(0x19c)](_0x28beb2??_0x3b3b4c)??await this[_0x4a07c7(0x1b9)][_0x4a07c7(0x18c)](_0x3b3b4c);if(_0x375480===undefined)throw new Error(_0x4a07c7(0x1bb));if(_0x375480[_0x4a07c7(0x1c0)]!==_0x4a07c7(0x195))return{'session':_0x375480,'ready':Promise[_0x4a07c7(0x18c)](_0x375480),'deferred':![]};const _0x3aeecc=this[_0x4a07c7(0x1b9)][_0x4a07c7(0x18f)](_0x375480)??this[_0x4a07c7(0x1b9)][_0x4a07c7(0x1ca)](_0x375480),_0x3d5c5c=this[_0x4a07c7(0x191)](_0x375480)[_0x4a07c7(0x1a8)](_0x28672f=>{const _0x341a8b=_0x4a07c7;if(_0x28672f!==undefined)return _0x28672f;if(this[_0x341a8b(0x1b9)][_0x341a8b(0x1b8)][_0x341a8b(0x1b6)][_0x341a8b(0x192)](_0x375480['id'])===_0x341a8b(0x199))throw new Error(_0x341a8b(0x1ba));throw new Error(this[_0x341a8b(0x1b9)][_0x341a8b(0x1b8)][_0x341a8b(0x1a4)][_0x341a8b(0x192)](_0x375480['id'])??this[_0x341a8b(0x186)](_0x375480['id'])[_0x341a8b(0x193)]);});return{'session':_0x3aeecc,'ready':_0x3d5c5c,'deferred':!![]};}[_0xff519d(0x1b4)](_0x7dadb6){const _0x4328e0=_0xff519d;return _0x7dadb6[_0x4328e0(0x1c0)]===_0x4328e0(0x195)&&_0x7dadb6[_0x4328e0(0x1cb)]!==null?_0x4328e0(0x1c1):_0x4328e0(0x1bf);}[_0xff519d(0x18b)](_0x3f1132){const _0x1d6b35=_0xff519d,_0x4f665b=this[_0x1d6b35(0x1b9)][_0x1d6b35(0x1b8)][_0x1d6b35(0x1a9)][_0x1d6b35(0x192)](_0x3f1132);if(_0x4f665b!==undefined)clearTimeout(_0x4f665b);this[_0x1d6b35(0x1b9)][_0x1d6b35(0x1b8)][_0x1d6b35(0x1a9)][_0x1d6b35(0x1c4)](_0x3f1132),this[_0x1d6b35(0x1b9)][_0x1d6b35(0x1b8)][_0x1d6b35(0x1c5)][_0x1d6b35(0x1c4)](_0x3f1132),this[_0x1d6b35(0x1b9)][_0x1d6b35(0x1b8)][_0x1d6b35(0x1ab)][_0x1d6b35(0x1c4)](_0x3f1132),this[_0x1d6b35(0x1b9)][_0x1d6b35(0x1b8)][_0x1d6b35(0x1a4)][_0x1d6b35(0x1c4)](_0x3f1132);}[_0xff519d(0x197)](_0x1c201f,_0x352a6d,_0x219ebd){const _0x43f017=_0xff519d;this[_0x43f017(0x18b)](_0x1c201f),this[_0x43f017(0x1b9)][_0x43f017(0x1b8)][_0x43f017(0x1c5)][_0x43f017(0x198)](_0x1c201f,_0x352a6d);if(_0x219ebd===undefined)this[_0x43f017(0x1b9)][_0x43f017(0x1b8)][_0x43f017(0x1ab)][_0x43f017(0x1c4)](_0x1c201f);else this[_0x43f017(0x1b9)][_0x43f017(0x1b8)][_0x43f017(0x1ab)][_0x43f017(0x198)](_0x1c201f,_0x219ebd);const _0x570d12=setTimeout(()=>this[_0x43f017(0x18b)](_0x1c201f),RESUME_FAILURE_TTL_MS);_0x570d12[_0x43f017(0x185)](),this[_0x43f017(0x1b9)][_0x43f017(0x1b8)][_0x43f017(0x1a9)][_0x43f017(0x198)](_0x1c201f,_0x570d12);}}
+const RESUME_FAILURE_TTL_MS = 30 * 60_000;
+export class ExternalSessionResumeService {
+    options;
+    transitions = new Set();
+    resumeTasks = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    transitioning(sessionId) {
+        return this.transitions.has(sessionId);
+    }
+    async resume(external) {
+        const existing = this.resumeTasks.get(external.id);
+        if (existing !== undefined)
+            return existing;
+        const task = this.performResume(external);
+        this.resumeTasks.set(external.id, task);
+        try {
+            return await task;
+        }
+        finally {
+            if (this.resumeTasks.get(external.id) === task)
+                this.resumeTasks.delete(external.id);
+        }
+    }
+    async performResume(external) {
+        this.clearFailure(external.id);
+        const priorId = this.options.state.resumedByDirectId.get(external.id);
+        const prior = priorId === undefined ? undefined : this.options.runtime.getAgentSession(priorId);
+        if (prior !== undefined)
+            return this.options.ensureConfiguration(prior);
+        const runner = this.options.runners.product(external.runner);
+        if (runner === undefined) {
+            this.setFailure(external.id, 'RUNNER_UNAVAILABLE');
+            return undefined;
+        }
+        this.transitions.add(external.id);
+        let result;
+        try {
+            result = await runner.resumeExternal(external, {
+                available: this.options.available(external.runner),
+                projectionFor: this.options.projectionFor,
+                managedAliasFor: this.options.managedAliasFor,
+                currentResumed: (sessionId) => {
+                    const resumedId = this.options.state.resumedByDirectId.get(sessionId);
+                    return resumedId === undefined
+                        ? undefined
+                        : this.options.runtime.getAgentSession(resumedId);
+                },
+                promote: (sessionId) => {
+                    this.options.runtime.setNativeControl(sessionId, 'MAR_MANAGED');
+                    return this.options.runtime.getAgentSession(sessionId);
+                },
+                ensureConfiguration: this.options.ensureConfiguration,
+                create: (session) => {
+                    const configuration = this.options.configuration(session);
+                    return this.options.runtime.createAgentSession({
+                        workspaceId: session.workspaceId,
+                        runner: session.runner,
+                        ...(session.externalSessionId === null
+                            ? {}
+                            : { externalSessionId: session.externalSessionId }),
+                        nativeControl: 'MAR_MANAGED',
+                        cwd: session.cwd,
+                        model: configuration.model,
+                        effort: configuration.effort,
+                        access: configuration.access,
+                        ...(session.runnerTitle === null ? {} : { title: session.runnerTitle }),
+                        ...(session.customTitle === null ? {} : { customTitle: session.customTitle })
+                    });
+                },
+                workspacePath: this.options.workspacePath,
+                rememberManagedNative: this.options.rememberNative
+            });
+        }
+        finally {
+            this.transitions.delete(external.id);
+        }
+        if (result.activity !== undefined)
+            this.options.state.externalActivity.set(external.id, result.activity);
+        if (result.session !== undefined) {
+            this.options.state.resumedByDirectId.set(external.id, result.session.id);
+            return result.session;
+        }
+        this.setFailure(external.id, result.failureCode ?? 'SESSION_RESUME_REJECTED', result.failureDetail);
+        this.options.state.messageResumeFailures.set(external.id, result.messageFailureCode ?? result.failureCode ?? 'SESSION_RESUME_REJECTED');
+        return undefined;
+    }
+    failure(sessionId) {
+        const code = this.options.state.resumeFailures.get(sessionId) ?? 'SESSION_RESUME_REJECTED';
+        const detail = this.options.state.resumeFailureDetails.get(sessionId);
+        return detail === undefined ? { code } : { code, detail };
+    }
+    async resolveForMessage(sessionId) {
+        const resumedId = this.options.state.resumedByDirectId.get(sessionId);
+        const current = this.options.runtime.getAgentSession(resumedId ?? sessionId) ??
+            (await this.options.resolve(sessionId));
+        if (current === undefined)
+            throw new Error('SESSION_NOT_FOUND');
+        if (current.nativeControl !== 'EXTERNAL')
+            return current;
+        const resumed = await this.resume(current);
+        if (resumed !== undefined)
+            return resumed;
+        if (this.options.state.externalActivity.get(current.id) === 'EXTERNAL_ACTIVE')
+            throw new Error('EXTERNAL_SESSION_ACTIVE');
+        throw new Error(this.options.state.messageResumeFailures.get(current.id) ?? this.failure(current.id).code);
+    }
+    async acceptForMessage(sessionId) {
+        const resumedId = this.options.state.resumedByDirectId.get(sessionId);
+        const current = this.options.runtime.getAgentSession(resumedId ?? sessionId) ??
+            (await this.options.resolve(sessionId));
+        if (current === undefined)
+            throw new Error('SESSION_NOT_FOUND');
+        if (current.nativeControl !== 'EXTERNAL')
+            return { session: current, ready: Promise.resolve(current), deferred: false };
+        const staged = this.options.projectionFor(current) ?? this.options.stage(current);
+        const ready = this.resume(current).then((session) => {
+            if (session !== undefined)
+                return session;
+            if (this.options.state.externalActivity.get(current.id) === 'EXTERNAL_ACTIVE')
+                throw new Error('EXTERNAL_SESSION_ACTIVE');
+            throw new Error(this.options.state.messageResumeFailures.get(current.id) ?? this.failure(current.id).code);
+        });
+        return { session: staged, ready, deferred: true };
+    }
+    delivery(session) {
+        return session.nativeControl === 'EXTERNAL' && session.externalSessionId !== null
+            ? 'RESUMABLE'
+            : 'REJECTED';
+    }
+    clearFailure(sessionId) {
+        const timer = this.options.state.failureTimers.get(sessionId);
+        if (timer !== undefined)
+            clearTimeout(timer);
+        this.options.state.failureTimers.delete(sessionId);
+        this.options.state.resumeFailures.delete(sessionId);
+        this.options.state.resumeFailureDetails.delete(sessionId);
+        this.options.state.messageResumeFailures.delete(sessionId);
+    }
+    setFailure(sessionId, code, detail) {
+        this.clearFailure(sessionId);
+        this.options.state.resumeFailures.set(sessionId, code);
+        if (detail === undefined)
+            this.options.state.resumeFailureDetails.delete(sessionId);
+        else
+            this.options.state.resumeFailureDetails.set(sessionId, detail);
+        const timer = setTimeout(() => this.clearFailure(sessionId), RESUME_FAILURE_TTL_MS);
+        timer.unref();
+        this.options.state.failureTimers.set(sessionId, timer);
+    }
+}

package/dist/service/fake-managed-run-service.js

@@ -1,2 +1,60 @@
-/* mar-release-protected */
-function _0x210b(){const _0x4a04f6=['AgfZ','ywrVChrsDw4','ywn0AxzL','ywrK','CNvUDgLTzq','ndKYntaYmdvvvffOr20','nJa0nZC0mun3wvPzua','Aw5WDxq','mtG0nJKWA0rmzxz6','mtC1rhvqBhnk','C2nYAxb0','y3DK','BMfTzq','mtvsC29HtwK','y3jLyxrLqxbWCM92ywW','odm1odK2yKv6C1b4','C2vZC2LVBKLK','C3rHCNq','zMLUywXSEq','mJqYmJi2sfLnyKP2','C3rHDgu','Cgf5Bg9Hza','CNvUBMvY','D29YA3nWywnLswq','zw1PDfj1BG','CNvUswq','CNvUBMvYCW','mty0nZK2oeP1zvL5wa','mtGYmty3me9KAgDdwa','C3rYAw5N','zgvSzxrL','ChjVzhvJDa','zgLZy29UBMvJDa','ChvIBgLZAefWChjVDMfS','B3b0Aw9UCW'];_0x210b=function(){return _0x4a04f6;};return _0x210b();}const _0x1f1d35=_0x19e2;(function(_0x2e3a3d,_0x23469b){const _0x56f817=_0x19e2,_0x1989cc=_0x2e3a3d();while(!![]){try{const _0x3a2b5c=-parseInt(_0x56f817(0x149))/(-0x5ef+-0x25*0xc9+-0x2b1*-0xd)+parseInt(_0x56f817(0x135))/(-0x327*-0xb+-0x55*-0x8+0x1c7*-0x15)*(-parseInt(_0x56f817(0x13a))/(-0x20*-0x2+-0xfa7+-0xf6a*-0x1))+parseInt(_0x56f817(0x13c))/(-0x1*0x234c+0x8ce+0x27*0xae)+parseInt(_0x56f817(0x136))/(-0x1dae+0x1517+0x89c)*(-parseInt(_0x56f817(0x140))/(-0x1*0x1f01+-0x1a68+0x396f))+-parseInt(_0x56f817(0x156))/(0x1d*0x39+0x247d+0x2aeb*-0x1)+-parseInt(_0x56f817(0x148))/(-0xa33+-0x1*-0x2565+-0x1b2a)+parseInt(_0x56f817(0x155))/(0xb20+0x1*0x25b1+-0x37c*0xe);if(_0x3a2b5c===_0x23469b)break;else _0x1989cc['push'](_0x1989cc['shift']());}catch(_0x5dd9db){_0x1989cc['push'](_0x1989cc['shift']());}}}(_0x210b,0x8464a+-0x5cdee*-0x1+-0x19*0x138));function _0x19e2(_0xe97380,_0x3b2f17){_0xe97380=_0xe97380-(-0x7e+0x1683+-0x14d0);const _0x165ec1=_0x210b();let _0x2871cc=_0x165ec1[_0xe97380];if(_0x19e2['EROcBE']===undefined){var _0xc3b1b5=function(_0x21aa4b){const _0x33d98e='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x922bb1='',_0x5a034e='';for(let _0x32ee42=0x117+-0xf3b*0x1+-0x2d4*-0x5,_0x319500,_0xca65a4,_0x32a255=0x21fd+-0x1*0x11d9+-0x409*0x4;_0xca65a4=_0x21aa4b['charAt'](_0x32a255++);~_0xca65a4&&(_0x319500=_0x32ee42%(0xe66+-0x1df9*-0x1+-0x2c5b)?_0x319500*(0x476+-0x1e2b+0x19f5)+_0xca65a4:_0xca65a4,_0x32ee42++%(0x16fb+0x12*0x209+-0x3b99))?_0x922bb1+=String['fromCharCode'](-0x2384*0x1+-0x21bf+0x4642&_0x319500>>(-(0x336+0xd*0x2b3+-0x264b)*_0x32ee42&-0x7*0x10b+-0x70+0x7c3)):0x1294+-0x1*0x1aae+0x81a){_0xca65a4=_0x33d98e['indexOf'](_0xca65a4);}for(let _0xd98dfa=-0x1*-0x17db+-0x3d1*0x1+-0x140a,_0x442af6=_0x922bb1['length'];_0xd98dfa<_0x442af6;_0xd98dfa++){_0x5a034e+='%'+('00'+_0x922bb1['charCodeAt'](_0xd98dfa)['toString'](0x29*0x5b+0xaa9+-0x4*0x64b))['slice'](-(0x40c*0x1+0x3b*-0x1a+-0x4*-0x7d));}return decodeURIComponent(_0x5a034e);};_0x19e2['SLjorG']=_0xc3b1b5,_0x19e2['XvgkTH']={},_0x19e2['EROcBE']=!![];}const _0x1f5197=_0x165ec1[-0x207e+0x76e*0x5+0x12a*-0x4];_0x19e2['fShCKh']!==_0x1f5197&&(_0x19e2['XvgkTH']={},_0x19e2['fShCKh']=_0x1f5197);const _0x4837d8=_0x19e2['XvgkTH'][_0xe97380];return _0x4837d8===undefined?(_0x2871cc=_0x19e2['SLjorG'](_0x2871cc),_0x19e2['XvgkTH'][_0xe97380]=_0x2871cc):_0x2871cc=_0x4837d8,_0x2871cc;}import{isTerminalRunStatus}from'../runner/codex/conversation-parser.js';export class FakeManagedRunService{[_0x1f1d35(0x14f)];constructor(_0x372193){const _0x4d8514=_0x1f1d35;this[_0x4d8514(0x14f)]=_0x372193;}[_0x1f1d35(0x13e)](_0xf72524){const _0x30d22e=_0x1f1d35,_0x592bcb=_0xf72524[_0x30d22e(0x142)];if(typeof _0x592bcb[_0x30d22e(0x146)]!==_0x30d22e(0x14a)||this[_0x30d22e(0x14f)][_0x30d22e(0x141)][_0x30d22e(0x152)][_0x30d22e(0x150)](_0x592bcb[_0x30d22e(0x146)]))return;const _0x19e7e1=_0x592bcb[_0x30d22e(0x146)],_0xf36cd5=typeof _0x592bcb[_0x30d22e(0x138)]===_0x30d22e(0x14a)?_0x592bcb[_0x30d22e(0x138)]:undefined;if(typeof _0x592bcb[_0x30d22e(0x13d)]===_0x30d22e(0x14a)&&typeof _0x592bcb[_0x30d22e(0x143)]===_0x30d22e(0x14a)&&_0xf36cd5!==undefined){const _0x3a984c=this[_0x30d22e(0x14f)][_0x30d22e(0x147)][_0x30d22e(0x14c)](_0x592bcb[_0x30d22e(0x143)]);if(_0x3a984c===undefined)return;this[_0x30d22e(0x14f)][_0x30d22e(0x154)][_0x30d22e(0x151)]({'runId':_0x19e7e1,'sessionId':_0x592bcb[_0x30d22e(0x13d)],...typeof _0x592bcb[_0x30d22e(0x144)]===_0x30d22e(0x14a)?{'workspaceId':_0x592bcb[_0x30d22e(0x144)]}:{},'runner':_0x3a984c[_0x30d22e(0x139)],'cwd':_0xf36cd5});}this[_0x30d22e(0x14f)][_0x30d22e(0x141)][_0x30d22e(0x152)][_0x30d22e(0x153)](_0x19e7e1),void this[_0x30d22e(0x14f)][_0x30d22e(0x143)][_0x30d22e(0x13e)](_0x19e7e1,this[_0x30d22e(0x14f)][_0x30d22e(0x137)](_0x592bcb[_0x30d22e(0x157)],_0x19e7e1),{'event':(_0x2fa8ce,_0x5d0dff,_0x17c73a)=>{const _0x13d73d=_0x30d22e;this[_0x13d73d(0x14f)][_0x13d73d(0x145)](_0x19e7e1,_0x2fa8ce,_0x5d0dff,_0x17c73a),_0x17c73a!==undefined&&isTerminalRunStatus(_0x17c73a)&&this[_0x13d73d(0x14f)][_0x13d73d(0x141)][_0x13d73d(0x152)][_0x13d73d(0x14b)](_0x19e7e1);},'approval':(_0x4142e7,_0x54458e,_0x22e433)=>{const _0x403e44=_0x30d22e;try{this[_0x403e44(0x14f)][_0x403e44(0x154)][_0x403e44(0x13b)]({'runId':_0x19e7e1,'approvalId':_0x4142e7,'payload':_0x54458e,'expiresAt':_0x22e433});}catch{return;}this[_0x403e44(0x14f)][_0x403e44(0x14e)]({'runId':_0x19e7e1,'approvalId':_0x4142e7,'payload':_0x54458e,'expiresAt':_0x22e433});},'disconnect':this[_0x30d22e(0x14f)][_0x30d22e(0x14d)]})[_0x30d22e(0x13f)](()=>this[_0x30d22e(0x14f)][_0x30d22e(0x141)][_0x30d22e(0x152)][_0x30d22e(0x14b)](_0x19e7e1));}}
+import { isTerminalRunStatus } from '../runner/codex/conversation-parser.js';
+/** Test-only managed Run adapter; production Runner paths never depend on it. */
+export class FakeManagedRunService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    start(envelope) {
+        const payload = envelope.payload;
+        if (typeof payload.runId !== 'string' || this.options.state.active.has(payload.runId))
+            return;
+        const runId = payload.runId;
+        const cwd = typeof payload.cwd === 'string' ? payload.cwd : undefined;
+        if (typeof payload.sessionId === 'string' &&
+            typeof payload.runner === 'string' &&
+            cwd !== undefined) {
+            const runner = this.options.runners.product(payload.runner);
+            if (runner === undefined)
+                return;
+            this.options.runtime.adoptRun({
+                runId,
+                sessionId: payload.sessionId,
+                ...(typeof payload.workspaceId === 'string' ? { workspaceId: payload.workspaceId } : {}),
+                runner: runner.name,
+                cwd
+            });
+        }
+        this.options.state.active.add(runId);
+        void this.options.runner
+            .start(runId, this.options.script(payload.input, runId), {
+            event: (eventType, eventPayload, status) => {
+                this.options.emitRun(runId, eventType, eventPayload, status);
+                if (status !== undefined && isTerminalRunStatus(status)) {
+                    this.options.state.active.delete(runId);
+                }
+            },
+            approval: (approvalId, approvalPayload, expiresAt) => {
+                try {
+                    this.options.runtime.createApproval({
+                        runId,
+                        approvalId,
+                        payload: approvalPayload,
+                        expiresAt
+                    });
+                }
+                catch {
+                    return;
+                }
+                this.options.publishApproval({
+                    runId,
+                    approvalId,
+                    payload: approvalPayload,
+                    expiresAt
+                });
+            },
+            disconnect: this.options.disconnect
+        })
+            .finally(() => this.options.state.active.delete(runId));
+    }
+}

package/dist/service/git-execution-service.js

@@ -0,0 +1,418 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { homedir, tmpdir } from 'node:os';
+import { delimiter, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { personalGitRuntimeSchema, selectGitCredential } from '@myagentroam/protocol';
+const execute = promisify(execFile);
+/** Owns only process-scoped Git credentials, never repository or global configuration. */
+export class GitExecutionService {
+    options;
+    contexts = new Map();
+    tokens = new Map();
+    removals = new Set();
+    server;
+    starting;
+    root;
+    wrappers = new Map();
+    closed = false;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async acquire(userId, configuration, baseEnvironment = {}) {
+        if (this.closed)
+            throw new Error('GIT_EXECUTION_CLOSED');
+        if (!Number.isSafeInteger(userId) || userId < 1)
+            throw new Error('USER_AUTHORIZATION_REQUIRED');
+        const parsed = personalGitRuntimeSchema.safeParse(configuration);
+        if (!parsed.success)
+            throw new Error('GIT_CONFIGURATION_INVALID');
+        const key = createHash('sha256')
+            .update(JSON.stringify([
+            userId,
+            parsed.data,
+            Object.entries(baseEnvironment).sort(([a], [b]) => a.localeCompare(b))
+        ]))
+            .digest('hex');
+        const endpoint = await this.start();
+        if (this.closed)
+            throw new Error('GIT_EXECUTION_CLOSED');
+        let context = this.contexts.get(key);
+        if (context === undefined) {
+            const token = randomBytes(32).toString('hex');
+            const original = { ...process.env, ...baseEnvironment };
+            const binary = await gitExecutable(original);
+            const environment = {
+                ...baseEnvironment,
+                MAR_GIT_ENDPOINT: endpoint,
+                MAR_GIT_TOKEN: token
+            };
+            const count = Number(original.GIT_CONFIG_COUNT ?? 0);
+            if (!Number.isSafeInteger(count) || count < 0 || count > 128)
+                throw new Error('GIT_ENVIRONMENT_INVALID');
+            const entries = parsed.data.credentials.some((entry) => entry.protocol === 'HTTPS')
+                ? [
+                    ['credential.helper', ''],
+                    ['credential.helper', `!${helperCommand('git-execution-helper')} credential`],
+                    ['credential.useHttpPath', 'true']
+                ]
+                : [];
+            if (entries.length > 0)
+                environment.GIT_CONFIG_COUNT = String(count + entries.length);
+            for (const [index, [name, value]] of entries.entries()) {
+                environment[`GIT_CONFIG_KEY_${count + index}`] = name;
+                environment[`GIT_CONFIG_VALUE_${count + index}`] = value;
+            }
+            if (parsed.data.credentials.some((entry) => entry.protocol === 'SSH')) {
+                environment.GIT_SSH_COMMAND = `${helperCommand('git-execution-helper')} ssh`;
+                environment.GIT_SSH_VARIANT = 'ssh';
+            }
+            const pathKey = process.platform === 'win32' && original.Path !== undefined ? 'Path' : 'PATH';
+            environment[pathKey] =
+                `${await this.gitWrapper(binary)}${delimiter}${original[pathKey] ?? ''}`;
+            const restore = Object.fromEntries(Object.keys(environment)
+                .filter((name) => environment[name] !== baseEnvironment[name] || name.startsWith('MAR_GIT_'))
+                .map((name) => [name, name.startsWith('MAR_GIT_') ? null : (original[name] ?? null)]));
+            context = {
+                key,
+                token,
+                configuration: parsed.data,
+                environment: Object.freeze(environment),
+                restore,
+                keys: new Map(),
+                references: 0
+            };
+            this.contexts.set(key, context);
+            this.tokens.set(token, context);
+        }
+        return { environment: context.environment, release: this.reference(context) };
+    }
+    retain(environment) {
+        if (environment.MAR_GIT_TOKEN === undefined)
+            return () => undefined;
+        const context = this.tokens.get(environment.MAR_GIT_TOKEN);
+        if (context === undefined || this.closed)
+            throw new Error('GIT_CREDENTIAL_CONTEXT_EXPIRED');
+        return this.reference(context);
+    }
+    reference(context) {
+        clearTimeout(context.timer);
+        delete context.timer;
+        context.references++;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (--context.references !== 0 || this.closed)
+                return;
+            // This outlives the existing 60-second warm Runner window.
+            context.timer = setTimeout(() => this.retire(context), this.options.idleTimeoutMs ?? 70_000);
+            context.timer.unref();
+        };
+    }
+    retire(context) {
+        this.contexts.delete(context.key);
+        this.tokens.delete(context.token);
+        clearTimeout(context.timer);
+        const removal = Promise.allSettled(context.keys.values())
+            .then(async () => {
+            if (context.directory !== undefined)
+                await rm(await context.directory, { recursive: true, force: true });
+        })
+            .catch(() => undefined);
+        this.removals.add(removal);
+        void removal.finally(() => this.removals.delete(removal));
+    }
+    async close() {
+        this.closed = true;
+        await this.starting?.catch(() => undefined);
+        if (this.server !== undefined) {
+            this.server.closeAllConnections();
+            await new Promise((resolve) => this.server.close(() => resolve()));
+        }
+        for (const context of this.contexts.values())
+            this.retire(context);
+        await Promise.all(this.removals);
+        if (this.root !== undefined)
+            await rm(await this.root, { recursive: true, force: true });
+    }
+    start() {
+        this.starting ??= new Promise((resolve, reject) => {
+            const server = createServer((request, response) => {
+                void this.respond(request, response).catch(() => {
+                    if (!response.headersSent)
+                        response.writeHead(500, { 'content-type': 'application/json' });
+                    response.end('{"error":"GIT_CREDENTIAL_UNAVAILABLE"}');
+                });
+            });
+            this.server = server;
+            server.requestTimeout = 10_000;
+            server.headersTimeout = 10_000;
+            server.on('error', reject);
+            server.listen(0, '127.0.0.1', () => {
+                const address = server.address();
+                if (address === null || typeof address === 'string')
+                    return reject(new Error('GIT_CREDENTIAL_UNAVAILABLE'));
+                server.unref();
+                resolve(`http://127.0.0.1:${address.port}`);
+            });
+        });
+        return this.starting;
+    }
+    async respond(request, response) {
+        response.setHeader('content-type', 'application/json');
+        response.setHeader('cache-control', 'no-store');
+        const token = request.headers.authorization?.replace(/^Bearer /u, '');
+        const context = token === undefined ? undefined : this.tokens.get(token);
+        if (request.method !== 'POST' ||
+            request.headers.origin !== undefined ||
+            context === undefined ||
+            this.closed) {
+            response.writeHead(403).end('{"error":"GIT_CREDENTIAL_CONTEXT_EXPIRED"}');
+            return;
+        }
+        const release = this.reference(context);
+        try {
+            let body = '';
+            for await (const chunk of request) {
+                body += String(chunk);
+                if (Buffer.byteLength(body) > 64 * 1024) {
+                    response.writeHead(413).end('{"error":"GIT_CREDENTIAL_REQUEST_INVALID"}');
+                    return;
+                }
+            }
+            const input = JSON.parse(body);
+            if (input === null || typeof input !== 'object' || Array.isArray(input))
+                throw new Error('GIT_CREDENTIAL_REQUEST_INVALID');
+            if (request.url === '/restore') {
+                response.end(JSON.stringify({ restore: context.restore }));
+                return;
+            }
+            if (request.url === '/passphrase') {
+                const credential = context.configuration.credentials.find((candidate) => candidate.id === input.id && candidate.protocol === 'SSH');
+                response.end(JSON.stringify({ passphrase: credential?.passphrase ?? '' }));
+                return;
+            }
+            if (request.url === '/identity') {
+                const match = typeof input.remote === 'string'
+                    ? matchRemoteCredential(context.configuration.credentials, input.remote)
+                    : undefined;
+                if (match?.commitName) {
+                    response.end(JSON.stringify({
+                        matched: true,
+                        name: match.commitName,
+                        email: match.commitEmail
+                    }));
+                }
+                else
+                    response.end('{"matched":false}');
+                return;
+            }
+            if (request.url !== '/credential' && request.url !== '/ssh') {
+                response.writeHead(404).end('{}');
+                return;
+            }
+            const protocol = request.url === '/ssh' ? 'SSH' : 'HTTPS';
+            let match;
+            try {
+                if (protocol === 'HTTPS' && input.protocol !== 'https')
+                    throw new Error('UNMATCHED');
+                if (typeof input.host !== 'string' || typeof input.path !== 'string')
+                    throw new Error('UNMATCHED');
+                const address = new URL(`${protocol === 'SSH' ? 'ssh' : 'https'}://${input.host}`);
+                match = selectGitCredential(context.configuration.credentials, {
+                    protocol,
+                    host: address.hostname,
+                    port: Number(input.port ?? (address.port || (protocol === 'SSH' ? 22 : 443))),
+                    path: protocol === 'SSH' ? input.path : decodeURIComponent(input.path)
+                });
+            }
+            catch {
+                match = undefined;
+            }
+            if (match === undefined) {
+                response.end('{"matched":false}');
+                return;
+            }
+            if (protocol === 'HTTPS') {
+                response.end(JSON.stringify({ matched: true, username: match.username, password: match.secret }));
+                return;
+            }
+            let key = context.keys.get(match.id);
+            if (key === undefined) {
+                const credential = match;
+                key = (async () => {
+                    context.directory ??= this.privateRoot().then(async (root) => {
+                        const directory = await mkdtemp(join(root, 'context-'));
+                        try {
+                            await writeFile(join(directory, 'ssh_config'), '', { mode: 0o600, flag: 'wx' });
+                            return directory;
+                        }
+                        catch (error) {
+                            await rm(directory, { recursive: true, force: true });
+                            throw error;
+                        }
+                    });
+                    const file = join(await context.directory, `${randomBytes(16).toString('hex')}.key`);
+                    await writeFile(file, `${credential.secret.trim()}\n`, { mode: 0o600, flag: 'wx' });
+                    return file;
+                })();
+                context.keys.set(match.id, key);
+            }
+            response.end(JSON.stringify({
+                matched: true,
+                id: match.id,
+                username: match.username,
+                keyFile: await key,
+                configFile: join(await context.directory, 'ssh_config'),
+                knownHostsFile: this.options.knownHostsFile ?? join(homedir(), '.ssh', 'known_hosts'),
+                askpassImport: helperImport('git-askpass')
+            }));
+        }
+        finally {
+            release();
+        }
+    }
+    privateRoot() {
+        this.root ??= (async () => {
+            const parent = this.options.directory ?? tmpdir();
+            if (this.options.directory !== undefined) {
+                await mkdir(parent, { recursive: true, mode: 0o700 });
+                if ((await lstat(parent)).isSymbolicLink())
+                    throw new Error('GIT_CREDENTIAL_DIRECTORY_INVALID');
+                for (const item of await readdir(parent, { withFileTypes: true })) {
+                    const pid = /^mar-git-(\d+)-/u.exec(item.name)?.[1];
+                    if (pid === undefined || !item.isDirectory())
+                        continue;
+                    try {
+                        process.kill(Number(pid), 0);
+                    }
+                    catch (error) {
+                        if (error.code === 'ESRCH')
+                            await rm(join(parent, item.name), { recursive: true, force: true });
+                    }
+                }
+            }
+            const root = await mkdtemp(join(parent, `mar-git-${process.pid}-`));
+            try {
+                if (process.platform === 'win32') {
+                    const { stdout } = await execute('whoami', [], { windowsHide: true });
+                    await execute('icacls', [root, '/inheritance:r', '/grant:r', `${stdout.trim()}:(OI)(CI)F`], { windowsHide: true });
+                }
+                else
+                    await chmod(root, 0o700);
+                return root;
+            }
+            catch {
+                await rm(root, { recursive: true, force: true });
+                throw new Error('GIT_CREDENTIAL_DIRECTORY_INVALID');
+            }
+        })();
+        return this.root;
+    }
+    gitWrapper(binary) {
+        let wrapper = this.wrappers.get(binary);
+        if (wrapper !== undefined)
+            return wrapper;
+        wrapper = (async () => {
+            const directory = join(await this.privateRoot(), `bin-${createHash('sha256').update(binary).digest('hex').slice(0, 16)}`);
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+            if (process.platform === 'win32') {
+                await writeFile(join(directory, 'git.cmd'), `@echo off\r\nset "MAR_GIT_BINARY=${windowsEnvironmentValue(binary)}"\r\n${windowsCommand([...helperArguments('git-execution-helper'), 'invoke'])} %*\r\n`, { mode: 0o700, flag: 'wx' });
+            }
+            else {
+                const executable = join(directory, 'git');
+                await writeFile(executable, `#!/bin/sh\nMAR_GIT_BINARY=${shellArgument(binary)}\nexport MAR_GIT_BINARY\nexec ${helperCommand('git-execution-helper')} invoke "$@"\n`, { mode: 0o700, flag: 'wx' });
+                await chmod(executable, 0o700);
+            }
+            return directory;
+        })();
+        this.wrappers.set(binary, wrapper);
+        return wrapper;
+    }
+}
+function matchRemoteCredential(credentials, remote) {
+    try {
+        if (remote.startsWith('https://')) {
+            const address = new URL(remote);
+            return selectGitCredential(credentials, {
+                protocol: 'HTTPS',
+                host: address.hostname,
+                port: Number(address.port || 443),
+                path: decodeURIComponent(address.pathname)
+            });
+        }
+        if (remote.startsWith('ssh://')) {
+            const address = new URL(remote);
+            return selectGitCredential(credentials, {
+                protocol: 'SSH',
+                host: address.hostname,
+                port: Number(address.port || 22),
+                path: decodeURIComponent(address.pathname)
+            });
+        }
+        const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/u.exec(remote);
+        if (scp === null)
+            return undefined;
+        return selectGitCredential(credentials, {
+            protocol: 'SSH',
+            host: scp[1],
+            port: 22,
+            path: scp[2]
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+async function gitExecutable(environment) {
+    const command = process.platform === 'win32' ? 'where.exe' : '/bin/sh';
+    const args = process.platform === 'win32' ? ['git.exe'] : ['-lc', 'command -v git'];
+    const { stdout } = await execute(command, args, {
+        env: environment,
+        windowsHide: true,
+        maxBuffer: 64 * 1024
+    });
+    const executable = stdout
+        .split(/\r?\n/u)
+        .find((value) => value.trim() !== '')
+        ?.trim();
+    if (executable === undefined)
+        throw new Error('GIT_TRANSPORT_UNAVAILABLE');
+    return executable;
+}
+function helperLocation(name) {
+    const built = new URL(`../${name}.js`, import.meta.url);
+    return existsSync(built) ? built : new URL(`../${name}.ts`, import.meta.url);
+}
+function helperArguments(name) {
+    const url = helperLocation(name);
+    return [
+        process.execPath,
+        ...(url.pathname.endsWith('.ts') ? ['--import', import.meta.resolve('tsx/esm')] : []),
+        fileURLToPath(url)
+    ];
+}
+function helperImport(name) {
+    const url = helperLocation(name);
+    return `${url.pathname.endsWith('.ts') ? `--import ${JSON.stringify(import.meta.resolve('tsx/esm'))} ` : ''}--import ${JSON.stringify(url.href)}`;
+}
+function helperCommand(name) {
+    return helperArguments(name).map(shellArgument).join(' ');
+}
+function shellArgument(value) {
+    return `'${value.replaceAll("'", "'\\''").replaceAll('\\', '/')}'`;
+}
+function windowsCommand(args) {
+    return args.map((value) => `"${value.replaceAll('"', '""')}"`).join(' ');
+}
+function windowsEnvironmentValue(value) {
+    if (/[\r\n\0"]/u.test(value))
+        throw new Error('GIT_TRANSPORT_UNAVAILABLE');
+    return value.replaceAll('%', '%%');
+}